From 0f5d9ebd72b8b757caba5543eeb13bca62829823 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Thu, 20 Aug 2026 18:14:33 +0800
Subject: [PATCH 001/108] feat: add network access policy console API

---
 api/controllers/console/__init__.py           |   2 +
 .../workspace/network_access_policy.py        | 150 ++++++++++++++++++
 api/services/billing_service.py               | 100 ++++++++++++
 .../workspace/test_network_access_policy.py   | 148 +++++++++++++++++
 ...t_network_access_policy_billing_service.py | 111 +++++++++++++
 5 files changed, 511 insertions(+)
 create mode 100644 api/controllers/console/workspace/network_access_policy.py
 create mode 100644 api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
 create mode 100644 api/tests/unit_tests/services/test_network_access_policy_billing_service.py

diff --git a/api/controllers/console/__init__.py b/api/controllers/console/__init__.py
index afad88a8ce3c78..28db0336e13d55 100644
--- a/api/controllers/console/__init__.py
+++ b/api/controllers/console/__init__.py
@@ -155,6 +155,7 @@ def _handle_active_workspace_required_error(error: ActiveWorkspaceRequiredError)
     members,
     model_providers,
     models,
+    network_access_policy,
     plugin,
     rbac,
     snippets,
@@ -219,6 +220,7 @@ def _handle_active_workspace_required_error(error: ActiveWorkspaceRequiredError)
     "model_config",
     "model_providers",
     "models",
+    "network_access_policy",
     "notification",
     "oauth",
     "oauth_server",
diff --git a/api/controllers/console/workspace/network_access_policy.py b/api/controllers/console/workspace/network_access_policy.py
new file mode 100644
index 00000000000000..946607d4f5a5c9
--- /dev/null
+++ b/api/controllers/console/workspace/network_access_policy.py
@@ -0,0 +1,150 @@
+from datetime import datetime
+from typing import Literal
+
+from flask_restx import Resource
+from pydantic import AliasChoices, BaseModel, Field, ValidationError
+from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
+
+from controllers.common.schema import register_response_schema_models, register_schema_models
+from controllers.console import console_ns
+from controllers.console.wraps import (
+    account_initialization_required,
+    model_validate,
+    only_edition_cloud,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
+from extensions.ext_database import db
+from fields.base import ResponseModel
+from libs.helper import dump_response
+from libs.login import login_required
+from models import Account
+from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
+
+NetworkAccessPolicyScope = Literal["service_api", "mcp", "workflow_webhook", "plugin_trigger"]
+NetworkAccessPolicyMode = Literal["disabled", "shadow", "enforce"]
+
+
+class NetworkAccessPolicyPayload(BaseModel):
+    scope: NetworkAccessPolicyScope
+    mode: NetworkAccessPolicyMode
+    allowed_cidrs: list[str] = Field(max_length=100)
+    expected_version: int = Field(ge=0)
+
+
+class NetworkAccessPolicyResponse(ResponseModel):
+    scope: NetworkAccessPolicyScope
+    mode: NetworkAccessPolicyMode
+    allowed_cidrs: list[str] = Field(validation_alias=AliasChoices("allowed_cidrs", "allowedCidrs"))
+    version: int = Field(ge=0)
+    updated_by_account_id: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
+    )
+    created_at: datetime | None = Field(default=None, validation_alias=AliasChoices("created_at", "createdAt"))
+    updated_at: datetime | None = Field(default=None, validation_alias=AliasChoices("updated_at", "updatedAt"))
+
+
+class NetworkAccessPolicyListResponse(ResponseModel):
+    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    entitled: bool
+    policies: list[NetworkAccessPolicyResponse]
+
+
+class NetworkAccessPolicyUpdateResponse(ResponseModel):
+    policy: NetworkAccessPolicyResponse
+
+
+register_schema_models(console_ns, NetworkAccessPolicyPayload)
+register_response_schema_models(
+    console_ns,
+    NetworkAccessPolicyResponse,
+    NetworkAccessPolicyListResponse,
+    NetworkAccessPolicyUpdateResponse,
+)
+
+
+def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
+    """Authorize against persisted workspace membership, including when RBAC is enabled."""
+
+    try:
+        BillingService.is_tenant_owner_or_admin(current_user, session=db.session())
+    except ValueError as exc:
+        raise Forbidden("Only workspace owners and administrators can manage network access policies.") from exc
+
+
+def _translate_upstream_error(exc: NetworkAccessPolicyUpstreamError) -> Exception:
+    if exc.status_code in (400, 422):
+        return BadRequest("Invalid network access policy.")
+    if exc.status_code in (401, 403):
+        return Forbidden("Network access policy is not available for this workspace.")
+    if exc.status_code == 404:
+        return NotFound("Workspace network access policy was not found.")
+    if exc.status_code == 409:
+        return Conflict("The network access policy changed. Refresh it and try again.")
+    if exc.status_code >= 500:
+        return ServiceUnavailable("Network access policy service is unavailable.")
+    return BadGateway("Unexpected response from the network access policy service.")
+
+
+def _serialize_response(response_model: type[ResponseModel], payload: dict):
+    try:
+        return dump_response(response_model, payload)
+    except ValidationError as exc:
+        raise BadGateway("Invalid response from the network access policy service.") from exc
+
+
+@console_ns.route("/workspaces/current/network-access-policy")
+class CurrentWorkspaceNetworkAccessPolicyApi(Resource):
+    @console_ns.response(
+        200,
+        "Workspace network access policies retrieved successfully",
+        console_ns.models[NetworkAccessPolicyListResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, current_user: Account):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.get_network_access_policies(current_tenant_id, current_user.id)
+        except NetworkAccessPolicyUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessPolicyListResponse, payload)
+
+    @console_ns.expect(console_ns.models[NetworkAccessPolicyPayload.__name__])
+    @console_ns.response(
+        200,
+        "Workspace network access policy updated successfully",
+        console_ns.models[NetworkAccessPolicyUpdateResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @model_validate(NetworkAccessPolicyPayload)
+    def put(
+        self,
+        req_data: NetworkAccessPolicyPayload,
+        current_tenant_id: str,
+        current_user: Account,
+    ):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.update_network_access_policy(
+                current_tenant_id,
+                req_data.scope,
+                mode=req_data.mode,
+                allowed_cidrs=req_data.allowed_cidrs,
+                expected_version=req_data.expected_version,
+                actor_account_id=current_user.id,
+            )
+        except NetworkAccessPolicyUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessPolicyUpdateResponse, payload)
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index 2ceaf144498872..caebe84b92461c 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -199,6 +199,14 @@ class DismissNotificationDict(TypedDict):
     success: bool
 
 
+class NetworkAccessPolicyUpstreamError(Exception):
+    """Failure returned by the SaaS network-access-policy control plane."""
+
+    def __init__(self, status_code: int):
+        self.status_code = status_code
+        super().__init__(f"network access policy upstream returned HTTP {status_code}")
+
+
 class BillingService:
     base_url = os.environ.get("BILLING_API_URL", "BILLING_API_URL")
     quota_base_url = os.environ.get("BILLING_QUOTA_API_URL") or base_url
@@ -418,6 +426,98 @@ def get_tenant_feature_plan_usage(cls, tenant_id: str, feature_key: str):
         params = {"tenant_id": tenant_id, "feature_key": feature_key}
         return cls._send_request("GET", "/billing/tenant_feature_plan/usage", params=params)
 
+    @classmethod
+    def get_network_access_policies(cls, tenant_id: str, actor_account_id: str) -> dict[str, Any]:
+        """Fetch workspace network access policies from the SaaS control plane."""
+
+        return cls._send_network_access_policy_request(
+            "GET",
+            f"/tenants/{tenant_id}/network-access-policies",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @classmethod
+    def update_network_access_policy(
+        cls,
+        tenant_id: str,
+        scope: str,
+        *,
+        mode: str,
+        allowed_cidrs: list[str],
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Replace one workspace policy; the authenticated account is injected by the Console BFF."""
+
+        return cls._send_network_access_policy_request(
+            "PUT",
+            f"/tenants/{tenant_id}/network-access-policies/{scope}",
+            payload_json={
+                "mode": mode,
+                "allowed_cidrs": allowed_cidrs,
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @classmethod
+    def _send_network_access_policy_request(
+        cls,
+        method: Literal["GET", "PUT"],
+        endpoint: str,
+        *,
+        payload_json: dict[str, Any] | None = None,
+        params: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        """Call the SaaS policy API while preserving its status for the Console boundary."""
+
+        try:
+            response = cls._send_network_access_policy_http_request(
+                method,
+                endpoint,
+                payload_json=payload_json,
+                params=params,
+            )
+        except httpx.RequestError as exc:
+            raise NetworkAccessPolicyUpstreamError(httpx.codes.SERVICE_UNAVAILABLE) from exc
+
+        if response.status_code != httpx.codes.OK:
+            raise NetworkAccessPolicyUpstreamError(response.status_code)
+
+        try:
+            payload = response.json()
+        except (json.JSONDecodeError, TypeError, ValueError) as exc:
+            raise NetworkAccessPolicyUpstreamError(httpx.codes.BAD_GATEWAY) from exc
+
+        if not isinstance(payload, dict):
+            raise NetworkAccessPolicyUpstreamError(httpx.codes.BAD_GATEWAY)
+        return payload
+
+    @classmethod
+    @retry(
+        wait=wait_fixed(2),
+        stop=stop_before_delay(10),
+        retry=retry_if_exception_type(httpx.RequestError),
+        reraise=True,
+    )
+    def _send_network_access_policy_http_request(
+        cls,
+        method: Literal["GET", "PUT"],
+        endpoint: str,
+        *,
+        payload_json: dict[str, Any] | None = None,
+        params: dict[str, Any] | None = None,
+    ) -> httpx.Response:
+        headers = {"Content-Type": "application/json", "Billing-Api-Secret-Key": cls.secret_key}
+        return _http_client.request(
+            method,
+            f"{cls.base_url}{endpoint}",
+            json=payload_json,
+            params=params,
+            headers=headers,
+            follow_redirects=True,
+        )
+
     @classmethod
     def _send_quota_request(
         cls, method: Literal["GET", "POST", "DELETE", "PUT"], endpoint: str, json=None, params=None
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
new file mode 100644
index 00000000000000..401efbe7c23d86
--- /dev/null
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
@@ -0,0 +1,148 @@
+from datetime import UTC, datetime
+from inspect import unwrap
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from pydantic import ValidationError
+from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
+
+from controllers.console.workspace.network_access_policy import (
+    CurrentWorkspaceNetworkAccessPolicyApi,
+    NetworkAccessPolicyPayload,
+    _translate_upstream_error,
+)
+from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
+
+
+def _policy_payload() -> dict:
+    return {
+        "scope": "service_api",
+        "mode": "enforce",
+        "allowedCidrs": ["203.0.113.7/32"],
+        "version": "2",
+        "updatedByAccountId": "account-1",
+        "createdAt": datetime(2026, 8, 20, tzinfo=UTC).isoformat(),
+        "updatedAt": datetime(2026, 8, 20, tzinfo=UTC).isoformat(),
+    }
+
+
+def test_get_authorizes_and_forwards_tenant_and_actor():
+    api = CurrentWorkspaceNetworkAccessPolicyApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id="account-1")
+    upstream_payload = {"tenantId": "tenant-1", "entitled": True, "policies": [_policy_payload()]}
+
+    with (
+        patch("controllers.console.workspace.network_access_policy.db") as db,
+        patch.object(BillingService, "is_tenant_owner_or_admin") as authorize,
+        patch.object(BillingService, "get_network_access_policies", return_value=upstream_payload) as get_policies,
+    ):
+        result = method(api, current_tenant_id="tenant-1", current_user=current_user)
+
+    authorize.assert_called_once_with(current_user, session=db.session())
+    get_policies.assert_called_once_with("tenant-1", "account-1")
+    assert result["tenant_id"] == "tenant-1"
+    assert result["policies"][0]["scope"] == "service_api"
+    assert result["policies"][0]["updated_at"] == "2026-08-20T00:00:00Z"
+
+
+def test_put_injects_actor_and_does_not_accept_it_from_payload():
+    api = CurrentWorkspaceNetworkAccessPolicyApi()
+    method = unwrap(api.put)
+    current_user = SimpleNamespace(id="account-1")
+    request_payload = NetworkAccessPolicyPayload(
+        scope="service_api",
+        mode="enforce",
+        allowed_cidrs=["203.0.113.7/32"],
+        expected_version=1,
+    )
+
+    with (
+        patch("controllers.console.workspace.network_access_policy.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "update_network_access_policy",
+            return_value={"policy": _policy_payload()},
+        ) as update_policy,
+    ):
+        result = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id="tenant-1",
+            current_user=current_user,
+        )
+
+    update_policy.assert_called_once_with(
+        "tenant-1",
+        "service_api",
+        mode="enforce",
+        allowed_cidrs=["203.0.113.7/32"],
+        expected_version=1,
+        actor_account_id="account-1",
+    )
+    assert result["policy"]["version"] == 2
+
+
+def test_get_rejects_non_privileged_workspace_member_before_upstream_call():
+    api = CurrentWorkspaceNetworkAccessPolicyApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id="account-1")
+
+    with (
+        patch("controllers.console.workspace.network_access_policy.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin", side_effect=ValueError("not privileged")),
+        patch.object(BillingService, "get_network_access_policies") as get_policies,
+        pytest.raises(Forbidden),
+    ):
+        method(api, current_tenant_id="tenant-1", current_user=current_user)
+
+    get_policies.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("status_code", "expected_exception"),
+    [
+        (400, BadRequest),
+        (403, Forbidden),
+        (404, NotFound),
+        (409, Conflict),
+        (500, ServiceUnavailable),
+        (418, BadGateway),
+    ],
+)
+def test_upstream_error_mapping(status_code, expected_exception):
+    assert isinstance(_translate_upstream_error(NetworkAccessPolicyUpstreamError(status_code)), expected_exception)
+
+
+def test_get_maps_invalid_upstream_contract_to_bad_gateway():
+    api = CurrentWorkspaceNetworkAccessPolicyApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id="account-1")
+
+    with (
+        patch("controllers.console.workspace.network_access_policy.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "get_network_access_policies",
+            return_value={"tenant_id": "tenant-1", "entitled": True, "policies": [{"mode": "disabled"}]},
+        ),
+        pytest.raises(BadGateway),
+    ):
+        method(api, current_tenant_id="tenant-1", current_user=current_user)
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        {"scope": "unknown", "mode": "disabled", "allowed_cidrs": [], "expected_version": 0},
+        {"scope": "mcp", "mode": "unknown", "allowed_cidrs": [], "expected_version": 0},
+        {"scope": "mcp", "mode": "disabled", "allowed_cidrs": [], "expected_version": -1},
+        {"scope": "mcp", "mode": "disabled", "allowed_cidrs": ["127.0.0.1"] * 101, "expected_version": 0},
+    ],
+)
+def test_payload_contract_rejects_invalid_shapes(payload):
+    with pytest.raises(ValidationError):
+        NetworkAccessPolicyPayload.model_validate(payload)
diff --git a/api/tests/unit_tests/services/test_network_access_policy_billing_service.py b/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
new file mode 100644
index 00000000000000..61160406f1cc49
--- /dev/null
+++ b/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
@@ -0,0 +1,111 @@
+from unittest.mock import MagicMock, patch
+
+import httpx
+import pytest
+
+from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
+
+
+@pytest.fixture
+def billing_config():
+    with (
+        patch.object(BillingService, "base_url", "https://billing.internal/v1"),
+        patch.object(BillingService, "secret_key", "test-secret"),
+    ):
+        yield
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_get_network_access_policies_uses_authenticated_saas_endpoint():
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {"tenant_id": "tenant-1", "entitled": True, "policies": []}
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        result = BillingService.get_network_access_policies("tenant-1", "account-1")
+
+    assert result == {"tenant_id": "tenant-1", "entitled": True, "policies": []}
+    request.assert_called_once_with(
+        "GET",
+        "https://billing.internal/v1/tenants/tenant-1/network-access-policies",
+        json=None,
+        params={"actor_account_id": "account-1"},
+        headers={"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"},
+        follow_redirects=True,
+    )
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_update_network_access_policy_injects_actor_and_scope():
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {
+        "policy": {
+            "scope": "service_api",
+            "mode": "enforce",
+            "allowed_cidrs": ["203.0.113.7/32"],
+            "version": 2,
+        }
+    }
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        result = BillingService.update_network_access_policy(
+            "tenant-1",
+            "service_api",
+            mode="enforce",
+            allowed_cidrs=["203.0.113.7/32"],
+            expected_version=1,
+            actor_account_id="account-1",
+        )
+
+    assert result["policy"]["version"] == 2
+    request.assert_called_once_with(
+        "PUT",
+        "https://billing.internal/v1/tenants/tenant-1/network-access-policies/service_api",
+        json={
+            "mode": "enforce",
+            "allowed_cidrs": ["203.0.113.7/32"],
+            "expected_version": 1,
+            "actor_account_id": "account-1",
+        },
+        params=None,
+        headers={"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"},
+        follow_redirects=True,
+    )
+
+
+@pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500])
+def test_network_access_policy_request_preserves_upstream_status(status_code):
+    response = MagicMock(status_code=status_code)
+    with (
+        patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
+        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_policy_request("GET", "/policies")
+
+    assert exc_info.value.status_code == status_code
+
+
+def test_network_access_policy_request_maps_transport_failure_to_service_unavailable():
+    request = httpx.Request("GET", "https://billing.internal/v1/policies")
+    with (
+        patch.object(
+            BillingService,
+            "_send_network_access_policy_http_request",
+            side_effect=httpx.ConnectError("unavailable", request=request),
+        ),
+        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_policy_request("GET", "/policies")
+
+    assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
+
+
+def test_network_access_policy_request_rejects_non_object_response():
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = []
+    with (
+        patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
+        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_policy_request("GET", "/policies")
+
+    assert exc_info.value.status_code == httpx.codes.BAD_GATEWAY

From 4dc94b7a0bad0052f5b217bbbcfd53fbd24efc6b Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Thu, 20 Aug 2026 10:35:52 +0000
Subject: [PATCH 002/108] [autofix.ci] apply automated fixes

---
 api/openapi/markdown/console-openapi.md       |  55 +++
 .../api/console/workspaces/orpc.gen.ts        | 382 ++++++++++--------
 .../api/console/workspaces/types.gen.ts       |  55 +++
 .../api/console/workspaces/zod.gen.ts         |  51 +++
 4 files changed, 367 insertions(+), 176 deletions(-)

diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index 6e97fe124e3c7d..b474afac4632dc 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -10698,6 +10698,26 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 200 | Available models retrieved successfully | **application/json**: [AvailableModelListResponse](#availablemodellistresponse)<br> |
 
+### [GET] /workspaces/current/network-access-policy
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access policies retrieved successfully | **application/json**: [NetworkAccessPolicyListResponse](#networkaccesspolicylistresponse)<br> |
+
+### [PUT] /workspaces/current/network-access-policy
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [NetworkAccessPolicyPayload](#networkaccesspolicypayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access policy updated successfully | **application/json**: [NetworkAccessPolicyUpdateResponse](#networkaccesspolicyupdateresponse)<br> |
+
 ### [GET] /workspaces/current/permission
 **Get workspace permission settings**
 
@@ -19087,6 +19107,41 @@ Model with provider entity.
 | dataset | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
 | workspace | [WorkspacePermissionSnapshot](#workspacepermissionsnapshot) |  | No |
 
+#### NetworkAccessPolicyListResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| entitled | boolean |  | Yes |
+| policies | [ [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) ] |  | Yes |
+| tenant_id | string |  | Yes |
+
+#### NetworkAccessPolicyPayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed_cidrs | [ string ] |  | Yes |
+| expected_version | integer |  | Yes |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
+
+#### NetworkAccessPolicyResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed_cidrs | [ string ] |  | Yes |
+| created_at | string |  | No |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
+| updated_at | string |  | No |
+| updated_by_account_id | string |  | No |
+| version | integer |  | Yes |
+
+#### NetworkAccessPolicyUpdateResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| policy | [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) |  | Yes |
+
 #### NewAppResponse
 
 | Name | Type | Description | Required |
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 292ad4b0ebe5b4..499b3ef6e05ef0 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -75,6 +75,7 @@ import {
   zGetWorkspacesCurrentModelProvidersSummaryResponse,
   zGetWorkspacesCurrentModelsModelTypesByModelTypePath,
   zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse,
+  zGetWorkspacesCurrentNetworkAccessPolicyResponse,
   zGetWorkspacesCurrentPermissionResponse,
   zGetWorkspacesCurrentPluginAssetQuery,
   zGetWorkspacesCurrentPluginAssetResponse,
@@ -396,6 +397,8 @@ import {
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsBody,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsPath,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
+  zPutWorkspacesCurrentNetworkAccessPolicyBody,
+  zPutWorkspacesCurrentNetworkAccessPolicyResponse,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
   zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath,
@@ -1583,12 +1586,38 @@ export const models2 = {
   modelTypes,
 }
 
+export const get21 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentNetworkAccessPolicy',
+    path: '/workspaces/current/network-access-policy',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentNetworkAccessPolicyResponse)
+
+export const put4 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putWorkspacesCurrentNetworkAccessPolicy',
+    path: '/workspaces/current/network-access-policy',
+    tags: ['console'],
+  })
+  .input(z.object({ body: zPutWorkspacesCurrentNetworkAccessPolicyBody }))
+  .output(zPutWorkspacesCurrentNetworkAccessPolicyResponse)
+
+export const networkAccessPolicy = {
+  get: get21,
+  put: put4,
+}
+
 /**
  * Get workspace permission settings
  *
  * Returns permission flags that control workspace features like member invitations and owner transfer.
  */
-export const get21 = oc
+export const get22 = oc
   .route({
     description:
       'Returns permission flags that control workspace features like member invitations and owner transfer.',
@@ -1602,10 +1631,10 @@ export const get21 = oc
   .output(zGetWorkspacesCurrentPermissionResponse)
 
 export const permission = {
-  get: get21,
+  get: get22,
 }
 
-export const get22 = oc
+export const get23 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1617,7 +1646,7 @@ export const get22 = oc
   .output(zGetWorkspacesCurrentPluginAssetResponse)
 
 export const asset = {
-  get: get22,
+  get: get23,
 }
 
 export const post26 = oc
@@ -1650,7 +1679,7 @@ export const exclude = {
   post: post27,
 }
 
-export const get23 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1662,7 +1691,7 @@ export const get23 = oc
   .output(zGetWorkspacesCurrentPluginAutoUpgradeFetchResponse)
 
 export const fetch_ = {
-  get: get23,
+  get: get24,
 }
 
 export const autoUpgrade = {
@@ -1671,7 +1700,7 @@ export const autoUpgrade = {
   fetch: fetch_,
 }
 
-export const get24 = oc
+export const get25 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1682,10 +1711,10 @@ export const get24 = oc
   .output(zGetWorkspacesCurrentPluginDebuggingKeyResponse)
 
 export const debuggingKey = {
-  get: get24,
+  get: get25,
 }
 
-export const get25 = oc
+export const get26 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1697,10 +1726,10 @@ export const get25 = oc
   .output(zGetWorkspacesCurrentPluginFetchManifestResponse)
 
 export const fetchManifest = {
-  get: get25,
+  get: get26,
 }
 
-export const get26 = oc
+export const get27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1712,7 +1741,7 @@ export const get26 = oc
   .output(zGetWorkspacesCurrentPluginIconResponse)
 
 export const icon = {
-  get: get26,
+  get: get27,
 }
 
 export const post28 = oc
@@ -1766,7 +1795,7 @@ export const install = {
   pkg,
 }
 
-export const get27 = oc
+export const get28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1778,7 +1807,7 @@ export const get27 = oc
   .output(zGetWorkspacesCurrentPluginInstalledIdsResponse)
 
 export const installedIds = {
-  get: get27,
+  get: get28,
 }
 
 export const post31 = oc
@@ -1815,7 +1844,7 @@ export const latestVersions = {
   post: post32,
 }
 
-export const get28 = oc
+export const get29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1827,12 +1856,12 @@ export const get28 = oc
   .output(zGetWorkspacesCurrentPluginListResponse)
 
 export const list2 = {
-  get: get28,
+  get: get29,
   installations,
   latestVersions,
 }
 
-export const get29 = oc
+export const get30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1844,14 +1873,14 @@ export const get29 = oc
   .output(zGetWorkspacesCurrentPluginMarketplacePkgResponse)
 
 export const pkg2 = {
-  get: get29,
+  get: get30,
 }
 
 export const marketplace2 = {
   pkg: pkg2,
 }
 
-export const get30 = oc
+export const get31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1863,7 +1892,7 @@ export const get30 = oc
   .output(zGetWorkspacesCurrentPluginParametersDynamicOptionsResponse)
 
 export const dynamicOptions = {
-  get: get30,
+  get: get31,
 }
 
 /**
@@ -1907,7 +1936,7 @@ export const change2 = {
   post: post34,
 }
 
-export const get31 = oc
+export const get32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1918,7 +1947,7 @@ export const get31 = oc
   .output(zGetWorkspacesCurrentPluginPermissionFetchResponse)
 
 export const fetch2 = {
-  get: get31,
+  get: get32,
 }
 
 export const permission2 = {
@@ -1926,7 +1955,7 @@ export const permission2 = {
   fetch: fetch2,
 }
 
-export const get32 = oc
+export const get33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1938,7 +1967,7 @@ export const get32 = oc
   .output(zGetWorkspacesCurrentPluginReadmeResponse)
 
 export const readme = {
-  get: get32,
+  get: get33,
 }
 
 export const post35 = oc
@@ -1986,7 +2015,7 @@ export const delete8 = {
   byIdentifier,
 }
 
-export const get33 = oc
+export const get34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1998,11 +2027,11 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentPluginTasksByTaskIdResponse)
 
 export const byTaskId = {
-  get: get33,
+  get: get34,
   delete: delete8,
 }
 
-export const get34 = oc
+export const get35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2014,7 +2043,7 @@ export const get34 = oc
   .output(zGetWorkspacesCurrentPluginTasksResponse)
 
 export const tasks = {
-  get: get34,
+  get: get35,
   deleteAll,
   byTaskId,
 }
@@ -2119,7 +2148,7 @@ export const upload = {
   pkg: pkg3,
 }
 
-export const get35 = oc
+export const get36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2136,7 +2165,7 @@ export const get35 = oc
   .output(zGetWorkspacesCurrentPluginByCategoryListResponse)
 
 export const list3 = {
-  get: get35,
+  get: get36,
 }
 
 export const byCategory = {
@@ -2190,7 +2219,7 @@ export const delete9 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const get36 = oc
+export const get37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2201,7 +2230,7 @@ export const get36 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zGetWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const put4 = oc
+export const put5 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2214,12 +2243,12 @@ export const put4 = oc
 
 export const byPolicyId = {
   delete: delete9,
-  get: get36,
-  put: put4,
+  get: get37,
+  put: put5,
   copy,
 }
 
-export const get37 = oc
+export const get38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2241,12 +2270,12 @@ export const post45 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
 
 export const accessPolicies = {
-  get: get37,
+  get: get38,
   post: post45,
   byPolicyId,
 }
 
-export const put5 = oc
+export const put6 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2258,10 +2287,10 @@ export const put5 = oc
   .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockResponse)
 
 export const lock = {
-  put: put5,
+  put: put6,
 }
 
-export const put6 = oc
+export const put7 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2273,7 +2302,7 @@ export const put6 = oc
   .output(zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdUnlockResponse)
 
 export const unlock = {
-  put: put6,
+  put: put7,
 }
 
 export const byBindingId = {
@@ -2301,7 +2330,7 @@ export const delete10 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get38 = oc
+export const get39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2318,10 +2347,10 @@ export const get38 = oc
 
 export const memberBindings = {
   delete: delete10,
-  get: get38,
+  get: get39,
 }
 
-export const get39 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2337,7 +2366,7 @@ export const get39 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings = {
-  get: get39,
+  get: get40,
 }
 
 export const byPolicyId2 = {
@@ -2349,7 +2378,7 @@ export const accessPolicies2 = {
   byPolicyId: byPolicyId2,
 }
 
-export const get40 = oc
+export const get41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2366,10 +2395,10 @@ export const get40 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
 
 export const accessPolicy = {
-  get: get40,
+  get: get41,
 }
 
-export const get41 = oc
+export const get42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2386,10 +2415,10 @@ export const get41 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies = {
-  get: get41,
+  get: get42,
 }
 
-export const put7 = oc
+export const put8 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2406,7 +2435,7 @@ export const put7 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdUsersByTargetAccountIdAccessPoliciesResponse)
 
 export const accessPolicies3 = {
-  put: put7,
+  put: put8,
 }
 
 export const byTargetAccountId = {
@@ -2417,7 +2446,7 @@ export const users = {
   byTargetAccountId,
 }
 
-export const get42 = oc
+export const get43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2428,7 +2457,7 @@ export const get42 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacAppsByAppIdWhitelistPath }))
   .output(zGetWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
-export const put8 = oc
+export const put9 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2445,8 +2474,8 @@ export const put8 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
 export const whitelist = {
-  get: get42,
-  put: put8,
+  get: get43,
+  put: put9,
 }
 
 export const byAppId = {
@@ -2481,7 +2510,7 @@ export const delete11 = oc
     zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
   )
 
-export const get43 = oc
+export const get44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2502,10 +2531,10 @@ export const get43 = oc
 
 export const memberBindings2 = {
   delete: delete11,
-  get: get43,
+  get: get44,
 }
 
-export const get44 = oc
+export const get45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2521,7 +2550,7 @@ export const get44 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings2 = {
-  get: get44,
+  get: get45,
 }
 
 export const byPolicyId3 = {
@@ -2533,7 +2562,7 @@ export const accessPolicies4 = {
   byPolicyId: byPolicyId3,
 }
 
-export const get45 = oc
+export const get46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2550,10 +2579,10 @@ export const get45 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
 
 export const accessPolicy2 = {
-  get: get45,
+  get: get46,
 }
 
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2570,10 +2599,10 @@ export const get46 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies2 = {
-  get: get46,
+  get: get47,
 }
 
-export const put9 = oc
+export const put10 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2590,7 +2619,7 @@ export const put9 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdUsersByTargetAccountIdAccessPoliciesResponse)
 
 export const accessPolicies5 = {
-  put: put9,
+  put: put10,
 }
 
 export const byTargetAccountId2 = {
@@ -2601,7 +2630,7 @@ export const users2 = {
   byTargetAccountId: byTargetAccountId2,
 }
 
-export const get47 = oc
+export const get48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2612,7 +2641,7 @@ export const get47 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistPath }))
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
-export const put10 = oc
+export const put11 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2629,8 +2658,8 @@ export const put10 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
 export const whitelist2 = {
-  get: get47,
-  put: put10,
+  get: get48,
+  put: put11,
 }
 
 export const byDatasetId = {
@@ -2645,7 +2674,7 @@ export const datasets = {
   byDatasetId,
 }
 
-export const get48 = oc
+export const get49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2656,7 +2685,7 @@ export const get48 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesPath }))
   .output(zGetWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
-export const put11 = oc
+export const put12 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2673,8 +2702,8 @@ export const put11 = oc
   .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
 export const rbacRoles = {
-  get: get48,
-  put: put11,
+  get: get49,
+  put: put12,
 }
 
 export const byMemberId2 = {
@@ -2685,7 +2714,7 @@ export const members2 = {
   byMemberId: byMemberId2,
 }
 
-export const get49 = oc
+export const get50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2696,10 +2725,10 @@ export const get49 = oc
   .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
 
 export const myPermissions = {
-  get: get49,
+  get: get50,
 }
 
-export const get50 = oc
+export const get51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2710,10 +2739,10 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
 
 export const app = {
-  get: get50,
+  get: get51,
 }
 
-export const get51 = oc
+export const get52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2724,10 +2753,10 @@ export const get51 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
 
 export const dataset = {
-  get: get51,
+  get: get52,
 }
 
-export const get52 = oc
+export const get53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2738,7 +2767,7 @@ export const get52 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
 
 export const catalog = {
-  get: get52,
+  get: get53,
   app,
   dataset,
 }
@@ -2763,7 +2792,7 @@ export const copy2 = {
   post: post46,
 }
 
-export const get53 = oc
+export const get54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2775,7 +2804,7 @@ export const get53 = oc
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
 
 export const members3 = {
-  get: get53,
+  get: get54,
 }
 
 export const delete12 = oc
@@ -2789,7 +2818,7 @@ export const delete12 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const get54 = oc
+export const get55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2800,7 +2829,7 @@ export const get54 = oc
   .input(z.object({ params: zGetWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const put12 = oc
+export const put13 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2813,13 +2842,13 @@ export const put12 = oc
 
 export const byRoleId = {
   delete: delete12,
-  get: get54,
-  put: put12,
+  get: get55,
+  put: put13,
   copy: copy2,
   members: members3,
 }
 
-export const get55 = oc
+export const get56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2841,12 +2870,12 @@ export const post47 = oc
   .output(zPostWorkspacesCurrentRbacRolesResponse)
 
 export const roles = {
-  get: get55,
+  get: get56,
   post: post47,
   byRoleId,
 }
 
-export const put13 = oc
+export const put14 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2863,10 +2892,10 @@ export const put13 = oc
   .output(zPutWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdBindingsResponse)
 
 export const bindings = {
-  put: put13,
+  put: put14,
 }
 
-export const get56 = oc
+export const get57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2882,10 +2911,10 @@ export const get56 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings3 = {
-  get: get56,
+  get: get57,
 }
 
-export const get57 = oc
+export const get58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2901,7 +2930,7 @@ export const get57 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings3 = {
-  get: get57,
+  get: get58,
 }
 
 export const byPolicyId4 = {
@@ -2914,7 +2943,7 @@ export const accessPolicies6 = {
   byPolicyId: byPolicyId4,
 }
 
-export const get58 = oc
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2925,7 +2954,7 @@ export const get58 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
 
 export const accessPolicy3 = {
-  get: get58,
+  get: get59,
 }
 
 export const apps2 = {
@@ -2933,7 +2962,7 @@ export const apps2 = {
   accessPolicy: accessPolicy3,
 }
 
-export const put14 = oc
+export const put15 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -2950,10 +2979,10 @@ export const put14 = oc
   .output(zPutWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdBindingsResponse)
 
 export const bindings2 = {
-  put: put14,
+  put: put15,
 }
 
-export const get59 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2969,10 +2998,10 @@ export const get59 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings4 = {
-  get: get59,
+  get: get60,
 }
 
-export const get60 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2988,7 +3017,7 @@ export const get60 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings4 = {
-  get: get60,
+  get: get61,
 }
 
 export const byPolicyId5 = {
@@ -3001,7 +3030,7 @@ export const accessPolicies7 = {
   byPolicyId: byPolicyId5,
 }
 
-export const get61 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3012,7 +3041,7 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
 
 export const accessPolicy4 = {
-  get: get61,
+  get: get62,
 }
 
 export const datasets2 = {
@@ -3037,7 +3066,7 @@ export const rbac = {
   workspace,
 }
 
-export const get62 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3048,10 +3077,10 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentSummaryResponse)
 
 export const summary2 = {
-  get: get62,
+  get: get63,
 }
 
-export const get63 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3062,7 +3091,7 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get63,
+  get: get64,
 }
 
 export const post48 = oc
@@ -3095,7 +3124,7 @@ export const delete13 = {
   post: post49,
 }
 
-export const get64 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3106,11 +3135,11 @@ export const get64 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get65 = {
-  get: get64,
+export const get66 = {
+  get: get65,
 }
 
-export const get66 = oc
+export const get67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3122,7 +3151,7 @@ export const get66 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get66,
+  get: get67,
 }
 
 export const post50 = oc
@@ -3159,7 +3188,7 @@ export const test = {
   pre,
 }
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3171,7 +3200,7 @@ export const get67 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get67,
+  get: get68,
 }
 
 export const post52 = oc
@@ -3192,7 +3221,7 @@ export const update2 = {
 export const api = {
   add,
   delete: delete13,
-  get: get65,
+  get: get66,
   remote,
   schema,
   test,
@@ -3220,7 +3249,7 @@ export const add2 = {
   post: post53,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3237,10 +3266,10 @@ export const get68 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get68,
+  get: get69,
 }
 
-export const get69 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3260,7 +3289,7 @@ export const get69 = oc
   )
 
 export const byCredentialType = {
-  get: get69,
+  get: get70,
 }
 
 export const schema2 = {
@@ -3272,7 +3301,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get70 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3289,7 +3318,7 @@ export const get70 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get70,
+  get: get71,
 }
 
 export const post54 = oc
@@ -3332,7 +3361,7 @@ export const delete14 = {
   post: post55,
 }
 
-export const get71 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3344,10 +3373,10 @@ export const get71 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get71,
+  get: get72,
 }
 
-export const get72 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3359,10 +3388,10 @@ export const get72 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get72,
+  get: get73,
 }
 
-export const get73 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3376,7 +3405,7 @@ export const get73 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get73,
+  get: get74,
 }
 
 export const delete15 = oc
@@ -3394,7 +3423,7 @@ export const delete15 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get74 = oc
+export const get75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3425,7 +3454,7 @@ export const post56 = oc
 
 export const customClient = {
   delete: delete15,
-  get: get74,
+  get: get75,
   post: post56,
 }
 
@@ -3434,7 +3463,7 @@ export const oauth = {
   customClient,
 }
 
-export const get75 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3446,7 +3475,7 @@ export const get75 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get75,
+  get: get76,
 }
 
 export const post57 = oc
@@ -3501,7 +3530,7 @@ export const auth = {
   post: post58,
 }
 
-export const get76 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3513,14 +3542,14 @@ export const get76 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get76,
+  get: get77,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get77 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3532,7 +3561,7 @@ export const get77 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get77,
+  get: get78,
 }
 
 export const update4 = {
@@ -3561,7 +3590,7 @@ export const post59 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderMcpBody }))
   .output(zPostWorkspacesCurrentToolProviderMcpResponse)
 
-export const put15 = oc
+export const put16 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -3575,7 +3604,7 @@ export const put15 = oc
 export const mcp = {
   delete: delete16,
   post: post59,
-  put: put15,
+  put: put16,
   auth,
   tools: tools3,
   update: update4,
@@ -3611,7 +3640,7 @@ export const delete17 = {
   post: post61,
 }
 
-export const get78 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3622,11 +3651,11 @@ export const get78 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get79 = {
-  get: get78,
+export const get80 = {
+  get: get79,
 }
 
-export const get80 = oc
+export const get81 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3638,7 +3667,7 @@ export const get80 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get80,
+  get: get81,
 }
 
 export const post62 = oc
@@ -3659,7 +3688,7 @@ export const update5 = {
 export const workflow = {
   create: create2,
   delete: delete17,
-  get: get79,
+  get: get80,
   tools: tools4,
   update: update5,
 }
@@ -3671,7 +3700,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get81 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3683,10 +3712,10 @@ export const get81 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get81,
+  get: get82,
 }
 
-export const get82 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3697,10 +3726,10 @@ export const get82 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get82,
+  get: get83,
 }
 
-export const get83 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3711,10 +3740,10 @@ export const get83 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get83,
+  get: get84,
 }
 
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3725,10 +3754,10 @@ export const get84 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get84,
+  get: get85,
 }
 
-export const get85 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3739,7 +3768,7 @@ export const get85 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get85,
+  get: get86,
 }
 
 export const tools5 = {
@@ -3749,7 +3778,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get86 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3761,13 +3790,13 @@ export const get86 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get86,
+  get: get87,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get87 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3780,7 +3809,7 @@ export const get87 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get87,
+  get: get88,
 }
 
 /**
@@ -3801,7 +3830,7 @@ export const delete18 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get88 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3835,7 +3864,7 @@ export const post63 = oc
 
 export const client = {
   delete: delete18,
-  get: get88,
+  get: get89,
   post: post63,
 }
 
@@ -3902,7 +3931,7 @@ export const create3 = {
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get89 = oc
+export const get90 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3923,7 +3952,7 @@ export const get89 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get89,
+  get: get90,
 }
 
 export const logs = {
@@ -3997,7 +4026,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get90 = oc
+export const get91 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4018,7 +4047,7 @@ export const get90 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get90,
+  get: get91,
 }
 
 export const builder = {
@@ -4033,7 +4062,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get91 = oc
+export const get92 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4046,13 +4075,13 @@ export const get91 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get91,
+  get: get92,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get92 = oc
+export const get93 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4069,7 +4098,7 @@ export const get92 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get92,
+  get: get93,
 }
 
 export const oauth3 = {
@@ -4186,7 +4215,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get93 = oc
+export const get94 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4198,7 +4227,7 @@ export const get93 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get93,
+  get: get94,
 }
 
 export const current = {
@@ -4211,6 +4240,7 @@ export const current = {
   members,
   modelProviders,
   models: models2,
+  networkAccessPolicy,
   permission,
   plugin: plugin2,
   rbac,
@@ -4243,7 +4273,7 @@ export const webappLogo = {
   upload: upload2,
 }
 
-export const get94 = oc
+export const get95 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4265,7 +4295,7 @@ export const post72 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  get: get94,
+  get: get95,
   post: post72,
   webappLogo,
 }
@@ -4300,7 +4330,7 @@ export const switch3 = {
   post: post74,
 }
 
-export const get95 = oc
+export const get96 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4312,7 +4342,7 @@ export const get95 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get95,
+  get: get96,
 }
 
 export const byIconType = {
@@ -4331,7 +4361,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get96 = oc
+export const get97 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4342,7 +4372,7 @@ export const get96 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get96,
+  get: get97,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 99dab0f62917ed..417061a7caffb8 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -364,6 +364,23 @@ export type AvailableModelListResponse = {
   data: Array<ProviderWithModelsResponse>
 }
 
+export type NetworkAccessPolicyListResponse = {
+  entitled: boolean
+  policies: Array<NetworkAccessPolicyResponse>
+  tenant_id: string
+}
+
+export type NetworkAccessPolicyPayload = {
+  allowed_cidrs: Array<string>
+  expected_version: number
+  mode: 'disabled' | 'enforce' | 'shadow'
+  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
+}
+
+export type NetworkAccessPolicyUpdateResponse = {
+  policy: NetworkAccessPolicyResponse
+}
+
 export type WorkspacePermissionResponse = {
   allow_member_invite: boolean
   allow_owner_transfer: boolean
@@ -1289,6 +1306,16 @@ export type ProviderWithModelsResponse = {
   tenant_id: string
 }
 
+export type NetworkAccessPolicyResponse = {
+  allowed_cidrs: Array<string>
+  created_at?: string | null
+  mode: 'disabled' | 'enforce' | 'shadow'
+  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
+  updated_at?: string | null
+  updated_by_account_id?: string | null
+  version: number
+}
+
 export type PluginAutoUpgradeSettingsPayload = {
   exclude_plugins?: Array<string>
   include_plugins?: Array<string>
@@ -3499,6 +3526,34 @@ export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponses = {
 export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponse =
   GetWorkspacesCurrentModelsModelTypesByModelTypeResponses[keyof GetWorkspacesCurrentModelsModelTypesByModelTypeResponses]
 
+export type GetWorkspacesCurrentNetworkAccessPolicyData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/network-access-policy'
+}
+
+export type GetWorkspacesCurrentNetworkAccessPolicyResponses = {
+  200: NetworkAccessPolicyListResponse
+}
+
+export type GetWorkspacesCurrentNetworkAccessPolicyResponse =
+  GetWorkspacesCurrentNetworkAccessPolicyResponses[keyof GetWorkspacesCurrentNetworkAccessPolicyResponses]
+
+export type PutWorkspacesCurrentNetworkAccessPolicyData = {
+  body: NetworkAccessPolicyPayload
+  path?: never
+  query?: never
+  url: '/workspaces/current/network-access-policy'
+}
+
+export type PutWorkspacesCurrentNetworkAccessPolicyResponses = {
+  200: NetworkAccessPolicyUpdateResponse
+}
+
+export type PutWorkspacesCurrentNetworkAccessPolicyResponse =
+  PutWorkspacesCurrentNetworkAccessPolicyResponses[keyof PutWorkspacesCurrentNetworkAccessPolicyResponses]
+
 export type GetWorkspacesCurrentPermissionData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index c55c0e70099953..7f4c1e7f230364 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -247,6 +247,16 @@ export const zParserPreferredProviderType = z.object({
   preferred_provider_type: z.enum(['custom', 'system']),
 })
 
+/**
+ * NetworkAccessPolicyPayload
+ */
+export const zNetworkAccessPolicyPayload = z.object({
+  allowed_cidrs: z.array(z.string()).max(100),
+  expected_version: z.int().gte(0),
+  mode: z.enum(['disabled', 'enforce', 'shadow']),
+  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
+})
+
 /**
  * WorkspacePermissionResponse
  */
@@ -985,6 +995,35 @@ export const zCredentialConfiguration = z.object({
   credential_name: z.string(),
 })
 
+/**
+ * NetworkAccessPolicyResponse
+ */
+export const zNetworkAccessPolicyResponse = z.object({
+  allowed_cidrs: z.array(z.string()),
+  created_at: z.iso.datetime().nullish(),
+  mode: z.enum(['disabled', 'enforce', 'shadow']),
+  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
+  updated_at: z.iso.datetime().nullish(),
+  updated_by_account_id: z.string().nullish(),
+  version: z.int().gte(0),
+})
+
+/**
+ * NetworkAccessPolicyListResponse
+ */
+export const zNetworkAccessPolicyListResponse = z.object({
+  entitled: z.boolean(),
+  policies: z.array(zNetworkAccessPolicyResponse),
+  tenant_id: z.string(),
+})
+
+/**
+ * NetworkAccessPolicyUpdateResponse
+ */
+export const zNetworkAccessPolicyUpdateResponse = z.object({
+  policy: zNetworkAccessPolicyResponse,
+})
+
 /**
  * TenantPluginAutoUpgradeCategory
  */
@@ -4101,6 +4140,18 @@ export const zGetWorkspacesCurrentModelsModelTypesByModelTypePath = z.object({
  */
 export const zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse = zAvailableModelListResponse
 
+/**
+ * Workspace network access policies retrieved successfully
+ */
+export const zGetWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyListResponse
+
+export const zPutWorkspacesCurrentNetworkAccessPolicyBody = zNetworkAccessPolicyPayload
+
+/**
+ * Workspace network access policy updated successfully
+ */
+export const zPutWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyUpdateResponse
+
 /**
  * Success
  */

From 642c11061a39ed2d25eaa03121c8a175af4a7bff Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Thu, 20 Aug 2026 18:38:07 +0800
Subject: [PATCH 003/108] test: satisfy strict API type checks

---
 .../workspace/test_network_access_policy.py   | 16 +++++++--------
 ...t_network_access_policy_billing_service.py | 20 ++++++++++---------
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
index 401efbe7c23d86..e1a384bf0f1c26 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
@@ -5,7 +5,7 @@
 
 import pytest
 from pydantic import ValidationError
-from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
+from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
 
 from controllers.console.workspace.network_access_policy import (
     CurrentWorkspaceNetworkAccessPolicyApi,
@@ -15,7 +15,7 @@
 from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
 
 
-def _policy_payload() -> dict:
+def _policy_payload() -> dict[str, object]:
     return {
         "scope": "service_api",
         "mode": "enforce",
@@ -27,7 +27,7 @@ def _policy_payload() -> dict:
     }
 
 
-def test_get_authorizes_and_forwards_tenant_and_actor():
+def test_get_authorizes_and_forwards_tenant_and_actor() -> None:
     api = CurrentWorkspaceNetworkAccessPolicyApi()
     method = unwrap(api.get)
     current_user = SimpleNamespace(id="account-1")
@@ -47,7 +47,7 @@ def test_get_authorizes_and_forwards_tenant_and_actor():
     assert result["policies"][0]["updated_at"] == "2026-08-20T00:00:00Z"
 
 
-def test_put_injects_actor_and_does_not_accept_it_from_payload():
+def test_put_injects_actor_and_does_not_accept_it_from_payload() -> None:
     api = CurrentWorkspaceNetworkAccessPolicyApi()
     method = unwrap(api.put)
     current_user = SimpleNamespace(id="account-1")
@@ -85,7 +85,7 @@ def test_put_injects_actor_and_does_not_accept_it_from_payload():
     assert result["policy"]["version"] == 2
 
 
-def test_get_rejects_non_privileged_workspace_member_before_upstream_call():
+def test_get_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
     api = CurrentWorkspaceNetworkAccessPolicyApi()
     method = unwrap(api.get)
     current_user = SimpleNamespace(id="account-1")
@@ -112,11 +112,11 @@ def test_get_rejects_non_privileged_workspace_member_before_upstream_call():
         (418, BadGateway),
     ],
 )
-def test_upstream_error_mapping(status_code, expected_exception):
+def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPException]) -> None:
     assert isinstance(_translate_upstream_error(NetworkAccessPolicyUpstreamError(status_code)), expected_exception)
 
 
-def test_get_maps_invalid_upstream_contract_to_bad_gateway():
+def test_get_maps_invalid_upstream_contract_to_bad_gateway() -> None:
     api = CurrentWorkspaceNetworkAccessPolicyApi()
     method = unwrap(api.get)
     current_user = SimpleNamespace(id="account-1")
@@ -143,6 +143,6 @@ def test_get_maps_invalid_upstream_contract_to_bad_gateway():
         {"scope": "mcp", "mode": "disabled", "allowed_cidrs": ["127.0.0.1"] * 101, "expected_version": 0},
     ],
 )
-def test_payload_contract_rejects_invalid_shapes(payload):
+def test_payload_contract_rejects_invalid_shapes(payload: dict[str, object]) -> None:
     with pytest.raises(ValidationError):
         NetworkAccessPolicyPayload.model_validate(payload)
diff --git a/api/tests/unit_tests/services/test_network_access_policy_billing_service.py b/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
index 61160406f1cc49..550181795ea3dc 100644
--- a/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
@@ -1,3 +1,4 @@
+from collections.abc import Iterator
 from unittest.mock import MagicMock, patch
 
 import httpx
@@ -7,7 +8,7 @@
 
 
 @pytest.fixture
-def billing_config():
+def billing_config() -> Iterator[None]:
     with (
         patch.object(BillingService, "base_url", "https://billing.internal/v1"),
         patch.object(BillingService, "secret_key", "test-secret"),
@@ -16,14 +17,15 @@ def billing_config():
 
 
 @pytest.mark.usefixtures("billing_config")
-def test_get_network_access_policies_uses_authenticated_saas_endpoint():
+def test_get_network_access_policies_uses_authenticated_saas_endpoint() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {"tenant_id": "tenant-1", "entitled": True, "policies": []}
+    policies: list[dict[str, object]] = []
+    response.json.return_value = {"tenant_id": "tenant-1", "entitled": True, "policies": policies}
 
     with patch("services.billing_service._http_client.request", return_value=response) as request:
         result = BillingService.get_network_access_policies("tenant-1", "account-1")
 
-    assert result == {"tenant_id": "tenant-1", "entitled": True, "policies": []}
+    assert result == {"tenant_id": "tenant-1", "entitled": True, "policies": policies}
     request.assert_called_once_with(
         "GET",
         "https://billing.internal/v1/tenants/tenant-1/network-access-policies",
@@ -35,7 +37,7 @@ def test_get_network_access_policies_uses_authenticated_saas_endpoint():
 
 
 @pytest.mark.usefixtures("billing_config")
-def test_update_network_access_policy_injects_actor_and_scope():
+def test_update_network_access_policy_injects_actor_and_scope() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {
         "policy": {
@@ -73,7 +75,7 @@ def test_update_network_access_policy_injects_actor_and_scope():
 
 
 @pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500])
-def test_network_access_policy_request_preserves_upstream_status(status_code):
+def test_network_access_policy_request_preserves_upstream_status(status_code: int) -> None:
     response = MagicMock(status_code=status_code)
     with (
         patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
@@ -84,7 +86,7 @@ def test_network_access_policy_request_preserves_upstream_status(status_code):
     assert exc_info.value.status_code == status_code
 
 
-def test_network_access_policy_request_maps_transport_failure_to_service_unavailable():
+def test_network_access_policy_request_maps_transport_failure_to_service_unavailable() -> None:
     request = httpx.Request("GET", "https://billing.internal/v1/policies")
     with (
         patch.object(
@@ -99,9 +101,9 @@ def test_network_access_policy_request_maps_transport_failure_to_service_unavail
     assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
 
 
-def test_network_access_policy_request_rejects_non_object_response():
+def test_network_access_policy_request_rejects_non_object_response() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = []
+    response.json.return_value = list[object]()
     with (
         patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
         pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,

From 2c254a4a7090e75e82be05576b468d66fc0a427f Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Fri, 21 Aug 2026 11:29:28 +0800
Subject: [PATCH 004/108] feat: manage reusable network access groups

---
 api/controllers/console/__init__.py           |   4 +-
 .../console/workspace/network_access_group.py | 369 ++++++++++
 .../workspace/network_access_policy.py        | 150 -----
 api/openapi/markdown/console-openapi.md       | 170 ++++-
 api/services/billing_service.py               | 157 ++++-
 .../workspace/test_network_access_group.py    | 392 +++++++++++
 .../workspace/test_network_access_policy.py   | 148 ----
 ...st_network_access_group_billing_service.py | 239 +++++++
 ...t_network_access_policy_billing_service.py | 113 ----
 .../generated/api/console/apps/orpc.gen.ts    | 282 ++++----
 .../generated/api/console/apps/types.gen.ts   |  59 ++
 .../generated/api/console/apps/zod.gen.ts     |  59 ++
 .../api/console/workspaces/orpc.gen.ts        | 631 ++++++++++--------
 .../api/console/workspaces/types.gen.ts       | 115 +++-
 .../api/console/workspaces/zod.gen.ts         | 102 ++-
 15 files changed, 2079 insertions(+), 911 deletions(-)
 create mode 100644 api/controllers/console/workspace/network_access_group.py
 delete mode 100644 api/controllers/console/workspace/network_access_policy.py
 create mode 100644 api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
 delete mode 100644 api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
 create mode 100644 api/tests/unit_tests/services/test_network_access_group_billing_service.py
 delete mode 100644 api/tests/unit_tests/services/test_network_access_policy_billing_service.py

diff --git a/api/controllers/console/__init__.py b/api/controllers/console/__init__.py
index 28db0336e13d55..74d037101e9f89 100644
--- a/api/controllers/console/__init__.py
+++ b/api/controllers/console/__init__.py
@@ -155,7 +155,7 @@ def _handle_active_workspace_required_error(error: ActiveWorkspaceRequiredError)
     members,
     model_providers,
     models,
-    network_access_policy,
+    network_access_group,
     plugin,
     rbac,
     snippets,
@@ -220,7 +220,7 @@ def _handle_active_workspace_required_error(error: ActiveWorkspaceRequiredError)
     "model_config",
     "model_providers",
     "models",
-    "network_access_policy",
+    "network_access_group",
     "notification",
     "oauth",
     "oauth_server",
diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
new file mode 100644
index 00000000000000..f22f6399f98292
--- /dev/null
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -0,0 +1,369 @@
+from datetime import datetime
+from typing import Literal
+from uuid import UUID
+
+from flask_restx import Resource
+from pydantic import AliasChoices, BaseModel, Field, ValidationError
+from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
+
+from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
+from controllers.console import console_ns
+from controllers.console.app.wraps import get_app_model
+from controllers.console.wraps import (
+    account_initialization_required,
+    model_validate,
+    only_edition_cloud,
+    setup_required,
+    with_current_tenant_id,
+    with_current_user,
+)
+from extensions.ext_database import db
+from fields.base import ResponseModel
+from libs.helper import dump_response
+from libs.login import login_required
+from models import Account, App
+from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+
+NetworkAccessGroupMode = Literal["disabled", "shadow", "enforce"]
+
+
+class NetworkAccessGroupCreatePayload(BaseModel):
+    name: str = Field(min_length=1, max_length=100)
+    description: str = Field(default="", max_length=500)
+    mode: NetworkAccessGroupMode
+    allowed_cidrs: list[str] = Field(max_length=100)
+
+
+class NetworkAccessGroupUpdatePayload(NetworkAccessGroupCreatePayload):
+    expected_version: int = Field(ge=1)
+
+
+class NetworkAccessGroupDeleteQuery(BaseModel):
+    expected_version: int = Field(ge=1, description="Current group version used for optimistic concurrency")
+
+
+class AppNetworkAccessGroupUpdatePayload(BaseModel):
+    group_id: UUID | None
+    expected_version: int = Field(ge=0)
+
+
+class NetworkAccessGroupResponse(ResponseModel):
+    id: str
+    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    name: str
+    description: str = ""
+    mode: NetworkAccessGroupMode
+    allowed_cidrs: list[str] = Field(
+        default_factory=list,
+        validation_alias=AliasChoices("allowed_cidrs", "allowedCidrs"),
+    )
+    version: int = Field(ge=1)
+    updated_by_account_id: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
+    )
+    created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
+    updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
+
+
+class NetworkAccessGroupListResponse(ResponseModel):
+    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    entitled: bool
+    groups: list[NetworkAccessGroupResponse]
+
+
+class NetworkAccessGroupMutationResponse(ResponseModel):
+    group: NetworkAccessGroupResponse
+
+
+class NetworkAccessGroupDeleteResponse(ResponseModel):
+    deleted: bool
+
+
+class AppNetworkAccessGroupBindingResponse(ResponseModel):
+    id: str
+    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
+    group_id: str | None = Field(default=None, validation_alias=AliasChoices("group_id", "groupId"))
+    version: int = Field(ge=1)
+    updated_by_account_id: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
+    )
+    created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
+    updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
+
+
+class AppNetworkAccessGroupResponse(ResponseModel):
+    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
+    entitled: bool
+    binding: AppNetworkAccessGroupBindingResponse | None
+
+
+class AppNetworkAccessGroupMutationResponse(ResponseModel):
+    binding: AppNetworkAccessGroupBindingResponse
+
+
+register_schema_models(
+    console_ns,
+    NetworkAccessGroupCreatePayload,
+    NetworkAccessGroupUpdatePayload,
+    AppNetworkAccessGroupUpdatePayload,
+)
+register_response_schema_models(
+    console_ns,
+    NetworkAccessGroupResponse,
+    NetworkAccessGroupListResponse,
+    NetworkAccessGroupMutationResponse,
+    NetworkAccessGroupDeleteResponse,
+    AppNetworkAccessGroupBindingResponse,
+    AppNetworkAccessGroupResponse,
+    AppNetworkAccessGroupMutationResponse,
+)
+
+
+def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
+    """Authorize management against the persisted current-workspace membership."""
+
+    try:
+        BillingService.is_tenant_owner_or_admin(current_user, session=db.session())
+    except ValueError as exc:
+        raise Forbidden("Only workspace owners and administrators can manage network access groups.") from exc
+
+
+def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception:
+    if exc.reason == "INVALID_SECRET_KEY":
+        return ServiceUnavailable("Network access group service authentication failed.")
+    if exc.status_code in (400, 422):
+        return BadRequest("Invalid network access group request.")
+    if exc.status_code == 401:
+        return ServiceUnavailable("Network access group service authentication failed.")
+    if exc.status_code == 403:
+        return Forbidden("Network access groups are not available for this workspace.")
+    if exc.status_code == 404:
+        return NotFound("Network access group was not found.")
+    if exc.status_code == 409:
+        message_by_reason = {
+            "NETWORK_ACCESS_VERSION_CONFLICT": "The network access resource changed. Refresh it and try again.",
+            "NETWORK_ACCESS_GROUP_NAME_CONFLICT": "A network access group with this name already exists.",
+            "NETWORK_ACCESS_GROUP_LIMIT": "This workspace has reached the network access group limit.",
+            "NETWORK_ACCESS_GROUP_BOUND": ("Unassign this network access group from every app before deleting it."),
+        }
+        return Conflict(message_by_reason.get(exc.reason or "", "The network access resource is in conflict."))
+    if exc.status_code >= 500:
+        return ServiceUnavailable("Network access group service is unavailable.")
+    return BadGateway("Unexpected response from the network access group service.")
+
+
+def _serialize_response(response_model: type[ResponseModel], payload: dict):
+    try:
+        return dump_response(response_model, payload)
+    except ValidationError as exc:
+        raise BadGateway("Invalid response from the network access group service.") from exc
+
+
+@console_ns.route("/workspaces/current/network-access-groups")
+class CurrentWorkspaceNetworkAccessGroupsApi(Resource):
+    @console_ns.response(
+        200,
+        "Workspace network access groups retrieved successfully",
+        console_ns.models[NetworkAccessGroupListResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, current_user: Account):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.list_network_access_groups(current_tenant_id, current_user.id)
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupListResponse, payload)
+
+    @console_ns.expect(console_ns.models[NetworkAccessGroupCreatePayload.__name__])
+    @console_ns.response(
+        201,
+        "Workspace network access group created successfully",
+        console_ns.models[NetworkAccessGroupMutationResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @model_validate(NetworkAccessGroupCreatePayload)
+    def post(
+        self,
+        req_data: NetworkAccessGroupCreatePayload,
+        current_tenant_id: str,
+        current_user: Account,
+    ):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.create_network_access_group(
+                current_tenant_id,
+                name=req_data.name,
+                description=req_data.description,
+                mode=req_data.mode,
+                allowed_cidrs=req_data.allowed_cidrs,
+                actor_account_id=current_user.id,
+            )
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupMutationResponse, payload), 201
+
+
+@console_ns.route("/workspaces/current/network-access-groups/<uuid:group_id>")
+class CurrentWorkspaceNetworkAccessGroupApi(Resource):
+    @console_ns.response(
+        200,
+        "Workspace network access group retrieved successfully",
+        console_ns.models[NetworkAccessGroupMutationResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    def get(self, current_tenant_id: str, current_user: Account, group_id: UUID):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.get_network_access_group(current_tenant_id, str(group_id), current_user.id)
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupMutationResponse, payload)
+
+    @console_ns.expect(console_ns.models[NetworkAccessGroupUpdatePayload.__name__])
+    @console_ns.response(
+        200,
+        "Workspace network access group updated successfully",
+        console_ns.models[NetworkAccessGroupMutationResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @model_validate(NetworkAccessGroupUpdatePayload)
+    def put(
+        self,
+        req_data: NetworkAccessGroupUpdatePayload,
+        current_tenant_id: str,
+        current_user: Account,
+        group_id: UUID,
+    ):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.update_network_access_group(
+                current_tenant_id,
+                str(group_id),
+                name=req_data.name,
+                description=req_data.description,
+                mode=req_data.mode,
+                allowed_cidrs=req_data.allowed_cidrs,
+                expected_version=req_data.expected_version,
+                actor_account_id=current_user.id,
+            )
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupMutationResponse, payload)
+
+    @console_ns.doc(params=query_params_from_model(NetworkAccessGroupDeleteQuery))
+    @console_ns.response(
+        200,
+        "Workspace network access group deleted successfully",
+        console_ns.models[NetworkAccessGroupDeleteResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @model_validate(NetworkAccessGroupDeleteQuery)
+    def delete(
+        self,
+        req_data: NetworkAccessGroupDeleteQuery,
+        current_tenant_id: str,
+        current_user: Account,
+        group_id: UUID,
+    ):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.delete_network_access_group(
+                current_tenant_id,
+                str(group_id),
+                expected_version=req_data.expected_version,
+                actor_account_id=current_user.id,
+            )
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupDeleteResponse, payload)
+
+
+@console_ns.route("/apps/<uuid:app_id>/network-access-group")
+class AppNetworkAccessGroupApi(Resource):
+    @console_ns.response(
+        200,
+        "App network access group binding retrieved successfully",
+        console_ns.models[AppNetworkAccessGroupResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @get_app_model
+    def get(self, current_tenant_id: str, current_user: Account, app_model: App):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.get_app_network_access_group(
+                current_tenant_id,
+                str(app_model.id),
+                current_user.id,
+            )
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(AppNetworkAccessGroupResponse, payload)
+
+    @console_ns.expect(console_ns.models[AppNetworkAccessGroupUpdatePayload.__name__])
+    @console_ns.response(
+        200,
+        "App network access group binding updated successfully",
+        console_ns.models[AppNetworkAccessGroupMutationResponse.__name__],
+    )
+    @setup_required
+    @login_required
+    @account_initialization_required
+    @only_edition_cloud
+    @with_current_user
+    @with_current_tenant_id
+    @get_app_model
+    @model_validate(AppNetworkAccessGroupUpdatePayload)
+    def put(
+        self,
+        req_data: AppNetworkAccessGroupUpdatePayload,
+        current_tenant_id: str,
+        current_user: Account,
+        app_model: App,
+    ):
+        _ensure_workspace_admin_or_owner(current_user)
+        try:
+            payload = BillingService.update_app_network_access_group(
+                current_tenant_id,
+                str(app_model.id),
+                group_id=str(req_data.group_id) if req_data.group_id is not None else None,
+                expected_version=req_data.expected_version,
+                actor_account_id=current_user.id,
+            )
+        except NetworkAccessGroupUpstreamError as exc:
+            raise _translate_upstream_error(exc) from exc
+        return _serialize_response(AppNetworkAccessGroupMutationResponse, payload)
diff --git a/api/controllers/console/workspace/network_access_policy.py b/api/controllers/console/workspace/network_access_policy.py
deleted file mode 100644
index 946607d4f5a5c9..00000000000000
--- a/api/controllers/console/workspace/network_access_policy.py
+++ /dev/null
@@ -1,150 +0,0 @@
-from datetime import datetime
-from typing import Literal
-
-from flask_restx import Resource
-from pydantic import AliasChoices, BaseModel, Field, ValidationError
-from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
-
-from controllers.common.schema import register_response_schema_models, register_schema_models
-from controllers.console import console_ns
-from controllers.console.wraps import (
-    account_initialization_required,
-    model_validate,
-    only_edition_cloud,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
-from extensions.ext_database import db
-from fields.base import ResponseModel
-from libs.helper import dump_response
-from libs.login import login_required
-from models import Account
-from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
-
-NetworkAccessPolicyScope = Literal["service_api", "mcp", "workflow_webhook", "plugin_trigger"]
-NetworkAccessPolicyMode = Literal["disabled", "shadow", "enforce"]
-
-
-class NetworkAccessPolicyPayload(BaseModel):
-    scope: NetworkAccessPolicyScope
-    mode: NetworkAccessPolicyMode
-    allowed_cidrs: list[str] = Field(max_length=100)
-    expected_version: int = Field(ge=0)
-
-
-class NetworkAccessPolicyResponse(ResponseModel):
-    scope: NetworkAccessPolicyScope
-    mode: NetworkAccessPolicyMode
-    allowed_cidrs: list[str] = Field(validation_alias=AliasChoices("allowed_cidrs", "allowedCidrs"))
-    version: int = Field(ge=0)
-    updated_by_account_id: str | None = Field(
-        default=None,
-        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
-    )
-    created_at: datetime | None = Field(default=None, validation_alias=AliasChoices("created_at", "createdAt"))
-    updated_at: datetime | None = Field(default=None, validation_alias=AliasChoices("updated_at", "updatedAt"))
-
-
-class NetworkAccessPolicyListResponse(ResponseModel):
-    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
-    entitled: bool
-    policies: list[NetworkAccessPolicyResponse]
-
-
-class NetworkAccessPolicyUpdateResponse(ResponseModel):
-    policy: NetworkAccessPolicyResponse
-
-
-register_schema_models(console_ns, NetworkAccessPolicyPayload)
-register_response_schema_models(
-    console_ns,
-    NetworkAccessPolicyResponse,
-    NetworkAccessPolicyListResponse,
-    NetworkAccessPolicyUpdateResponse,
-)
-
-
-def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
-    """Authorize against persisted workspace membership, including when RBAC is enabled."""
-
-    try:
-        BillingService.is_tenant_owner_or_admin(current_user, session=db.session())
-    except ValueError as exc:
-        raise Forbidden("Only workspace owners and administrators can manage network access policies.") from exc
-
-
-def _translate_upstream_error(exc: NetworkAccessPolicyUpstreamError) -> Exception:
-    if exc.status_code in (400, 422):
-        return BadRequest("Invalid network access policy.")
-    if exc.status_code in (401, 403):
-        return Forbidden("Network access policy is not available for this workspace.")
-    if exc.status_code == 404:
-        return NotFound("Workspace network access policy was not found.")
-    if exc.status_code == 409:
-        return Conflict("The network access policy changed. Refresh it and try again.")
-    if exc.status_code >= 500:
-        return ServiceUnavailable("Network access policy service is unavailable.")
-    return BadGateway("Unexpected response from the network access policy service.")
-
-
-def _serialize_response(response_model: type[ResponseModel], payload: dict):
-    try:
-        return dump_response(response_model, payload)
-    except ValidationError as exc:
-        raise BadGateway("Invalid response from the network access policy service.") from exc
-
-
-@console_ns.route("/workspaces/current/network-access-policy")
-class CurrentWorkspaceNetworkAccessPolicyApi(Resource):
-    @console_ns.response(
-        200,
-        "Workspace network access policies retrieved successfully",
-        console_ns.models[NetworkAccessPolicyListResponse.__name__],
-    )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
-        _ensure_workspace_admin_or_owner(current_user)
-        try:
-            payload = BillingService.get_network_access_policies(current_tenant_id, current_user.id)
-        except NetworkAccessPolicyUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        return _serialize_response(NetworkAccessPolicyListResponse, payload)
-
-    @console_ns.expect(console_ns.models[NetworkAccessPolicyPayload.__name__])
-    @console_ns.response(
-        200,
-        "Workspace network access policy updated successfully",
-        console_ns.models[NetworkAccessPolicyUpdateResponse.__name__],
-    )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    @model_validate(NetworkAccessPolicyPayload)
-    def put(
-        self,
-        req_data: NetworkAccessPolicyPayload,
-        current_tenant_id: str,
-        current_user: Account,
-    ):
-        _ensure_workspace_admin_or_owner(current_user)
-        try:
-            payload = BillingService.update_network_access_policy(
-                current_tenant_id,
-                req_data.scope,
-                mode=req_data.mode,
-                allowed_cidrs=req_data.allowed_cidrs,
-                expected_version=req_data.expected_version,
-                actor_account_id=current_user.id,
-            )
-        except NetworkAccessPolicyUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        return _serialize_response(NetworkAccessPolicyUpdateResponse, payload)
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index b474afac4632dc..042e383672f64b 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -2810,6 +2810,38 @@ Check if app name is available
 | ---- | ----------- | ------ |
 | 200 | Name availability checked | **application/json**: [AppDetail](#appdetail)<br> |
 
+### [GET] /apps/{app_id}/network-access-group
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | App network access group binding retrieved successfully | **application/json**: [AppNetworkAccessGroupResponse](#appnetworkaccessgroupresponse)<br> |
+
+### [PUT] /apps/{app_id}/network-access-group
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| app_id | path |  | Yes | string (uuid) |
+
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [AppNetworkAccessGroupUpdatePayload](#appnetworkaccessgroupupdatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | App network access group binding updated successfully | **application/json**: [AppNetworkAccessGroupMutationResponse](#appnetworkaccessgroupmutationresponse)<br> |
+
 ### [POST] /apps/{app_id}/publish-to-creators-platform
 **Publish app to Creators Platform**
 
@@ -10698,25 +10730,71 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 200 | Available models retrieved successfully | **application/json**: [AvailableModelListResponse](#availablemodellistresponse)<br> |
 
-### [GET] /workspaces/current/network-access-policy
+### [GET] /workspaces/current/network-access-groups
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Workspace network access policies retrieved successfully | **application/json**: [NetworkAccessPolicyListResponse](#networkaccesspolicylistresponse)<br> |
+| 200 | Workspace network access groups retrieved successfully | **application/json**: [NetworkAccessGroupListResponse](#networkaccessgrouplistresponse)<br> |
+
+### [POST] /workspaces/current/network-access-groups
+#### Request Body
+
+| Required | Schema |
+| -------- | ------ |
+|  Yes | **application/json**: [NetworkAccessGroupCreatePayload](#networkaccessgroupcreatepayload)<br> |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 201 | Workspace network access group created successfully | **application/json**: [NetworkAccessGroupMutationResponse](#networkaccessgroupmutationresponse)<br> |
+
+### [DELETE] /workspaces/current/network-access-groups/{group_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| expected_version | query | Current group version used for optimistic concurrency | Yes | integer |
+| group_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access group deleted successfully | **application/json**: [NetworkAccessGroupDeleteResponse](#networkaccessgroupdeleteresponse)<br> |
+
+### [GET] /workspaces/current/network-access-groups/{group_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| group_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Workspace network access group retrieved successfully | **application/json**: [NetworkAccessGroupMutationResponse](#networkaccessgroupmutationresponse)<br> |
+
+### [PUT] /workspaces/current/network-access-groups/{group_id}
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| group_id | path |  | Yes | string (uuid) |
 
-### [PUT] /workspaces/current/network-access-policy
 #### Request Body
 
 | Required | Schema |
 | -------- | ------ |
-|  Yes | **application/json**: [NetworkAccessPolicyPayload](#networkaccesspolicypayload)<br> |
+|  Yes | **application/json**: [NetworkAccessGroupUpdatePayload](#networkaccessgroupupdatepayload)<br> |
 
 #### Responses
 
 | Code | Description | Schema |
 | ---- | ----------- | ------ |
-| 200 | Workspace network access policy updated successfully | **application/json**: [NetworkAccessPolicyUpdateResponse](#networkaccesspolicyupdateresponse)<br> |
+| 200 | Workspace network access group updated successfully | **application/json**: [NetworkAccessGroupMutationResponse](#networkaccessgroupmutationresponse)<br> |
 
 ### [GET] /workspaces/current/permission
 **Get workspace permission settings**
@@ -15237,6 +15315,41 @@ AppMCPServer Status Enum
 | ---- | ---- | ----------- | -------- |
 | name | string | Name to check | Yes |
 
+#### AppNetworkAccessGroupBindingResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app_id | string |  | Yes |
+| created_at | dateTime |  | Yes |
+| group_id | string |  | No |
+| id | string |  | Yes |
+| tenant_id | string |  | Yes |
+| updated_at | dateTime |  | Yes |
+| updated_by_account_id | string |  | No |
+| version | integer |  | Yes |
+
+#### AppNetworkAccessGroupMutationResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
+
+#### AppNetworkAccessGroupResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| app_id | string |  | Yes |
+| binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
+| entitled | boolean |  | Yes |
+| tenant_id | string |  | Yes |
+
+#### AppNetworkAccessGroupUpdatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| expected_version | integer |  | Yes |
+| group_id | string |  | Yes |
+
 #### AppPagination
 
 | Name | Type | Description | Required |
@@ -19107,40 +19220,59 @@ Model with provider entity.
 | dataset | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
 | workspace | [WorkspacePermissionSnapshot](#workspacepermissionsnapshot) |  | No |
 
-#### NetworkAccessPolicyListResponse
+#### NetworkAccessGroupCreatePayload
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed_cidrs | [ string ] |  | Yes |
+| description | string |  | No |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| name | string |  | Yes |
+
+#### NetworkAccessGroupDeleteResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| deleted | boolean |  | Yes |
+
+#### NetworkAccessGroupListResponse
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | entitled | boolean |  | Yes |
-| policies | [ [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) ] |  | Yes |
+| groups | [ [NetworkAccessGroupResponse](#networkaccessgroupresponse) ] |  | Yes |
 | tenant_id | string |  | Yes |
 
-#### NetworkAccessPolicyPayload
+#### NetworkAccessGroupMutationResponse
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| allowed_cidrs | [ string ] |  | Yes |
-| expected_version | integer |  | Yes |
-| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
-| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
+| group | [NetworkAccessGroupResponse](#networkaccessgroupresponse) |  | Yes |
 
-#### NetworkAccessPolicyResponse
+#### NetworkAccessGroupResponse
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| allowed_cidrs | [ string ] |  | Yes |
-| created_at | string |  | No |
+| allowed_cidrs | [ string ] |  | No |
+| created_at | dateTime |  | Yes |
+| description | string |  | No |
+| id | string |  | Yes |
 | mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
-| scope | string, <br>**Available values:** "mcp", "plugin_trigger", "service_api", "workflow_webhook" | *Enum:* `"mcp"`, `"plugin_trigger"`, `"service_api"`, `"workflow_webhook"` | Yes |
-| updated_at | string |  | No |
+| name | string |  | Yes |
+| tenant_id | string |  | Yes |
+| updated_at | dateTime |  | Yes |
 | updated_by_account_id | string |  | No |
 | version | integer |  | Yes |
 
-#### NetworkAccessPolicyUpdateResponse
+#### NetworkAccessGroupUpdatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| policy | [NetworkAccessPolicyResponse](#networkaccesspolicyresponse) |  | Yes |
+| allowed_cidrs | [ string ] |  | Yes |
+| description | string |  | No |
+| expected_version | integer |  | Yes |
+| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
+| name | string |  | Yes |
 
 #### NewAppResponse
 
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index caebe84b92461c..0b0359a53d3582 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -199,12 +199,13 @@ class DismissNotificationDict(TypedDict):
     success: bool
 
 
-class NetworkAccessPolicyUpstreamError(Exception):
-    """Failure returned by the SaaS network-access-policy control plane."""
+class NetworkAccessGroupUpstreamError(Exception):
+    """Failure returned by the SaaS network-access-group control plane."""
 
-    def __init__(self, status_code: int):
+    def __init__(self, status_code: int, reason: str | None = None):
         self.status_code = status_code
-        super().__init__(f"network access policy upstream returned HTTP {status_code}")
+        self.reason = reason
+        super().__init__(f"network access group upstream returned HTTP {status_code}")
 
 
 class BillingService:
@@ -427,32 +428,76 @@ def get_tenant_feature_plan_usage(cls, tenant_id: str, feature_key: str):
         return cls._send_request("GET", "/billing/tenant_feature_plan/usage", params=params)
 
     @classmethod
-    def get_network_access_policies(cls, tenant_id: str, actor_account_id: str) -> dict[str, Any]:
-        """Fetch workspace network access policies from the SaaS control plane."""
+    def list_network_access_groups(cls, tenant_id: str, actor_account_id: str) -> dict[str, Any]:
+        """List the reusable network access groups owned by one workspace."""
 
-        return cls._send_network_access_policy_request(
+        return cls._send_network_access_group_request(
             "GET",
-            f"/tenants/{tenant_id}/network-access-policies",
+            f"/tenants/{tenant_id}/network-access-groups",
             params={"actor_account_id": actor_account_id},
         )
 
     @classmethod
-    def update_network_access_policy(
+    def create_network_access_group(
         cls,
         tenant_id: str,
-        scope: str,
         *,
+        name: str,
+        description: str,
+        mode: str,
+        allowed_cidrs: list[str],
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Create a reusable group; the Console BFF injects the authenticated actor."""
+
+        return cls._send_network_access_group_request(
+            "POST",
+            f"/tenants/{tenant_id}/network-access-groups",
+            payload_json={
+                "name": name,
+                "description": description,
+                "mode": mode,
+                "allowed_cidrs": allowed_cidrs,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @classmethod
+    def get_network_access_group(
+        cls,
+        tenant_id: str,
+        group_id: str,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Fetch one reusable group scoped to its owning workspace."""
+
+        return cls._send_network_access_group_request(
+            "GET",
+            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @classmethod
+    def update_network_access_group(
+        cls,
+        tenant_id: str,
+        group_id: str,
+        *,
+        name: str,
+        description: str,
         mode: str,
         allowed_cidrs: list[str],
         expected_version: int,
         actor_account_id: str,
     ) -> dict[str, Any]:
-        """Replace one workspace policy; the authenticated account is injected by the Console BFF."""
+        """Replace a reusable group using optimistic concurrency control."""
 
-        return cls._send_network_access_policy_request(
+        return cls._send_network_access_group_request(
             "PUT",
-            f"/tenants/{tenant_id}/network-access-policies/{scope}",
+            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
             payload_json={
+                "name": name,
+                "description": description,
                 "mode": mode,
                 "allowed_cidrs": allowed_cidrs,
                 "expected_version": expected_version,
@@ -461,36 +506,100 @@ def update_network_access_policy(
         )
 
     @classmethod
-    def _send_network_access_policy_request(
+    def delete_network_access_group(
+        cls,
+        tenant_id: str,
+        group_id: str,
+        *,
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Delete an unbound reusable group using optimistic concurrency control."""
+
+        return cls._send_network_access_group_request(
+            "DELETE",
+            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
+            params={
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @classmethod
+    def get_app_network_access_group(
+        cls,
+        tenant_id: str,
+        app_id: str,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Fetch the reusable group currently assigned to one tenant-scoped app."""
+
+        return cls._send_network_access_group_request(
+            "GET",
+            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @classmethod
+    def update_app_network_access_group(
         cls,
-        method: Literal["GET", "PUT"],
+        tenant_id: str,
+        app_id: str,
+        *,
+        group_id: str | None,
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        """Assign or unassign one reusable group from a tenant-scoped app."""
+
+        return cls._send_network_access_group_request(
+            "PUT",
+            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group",
+            payload_json={
+                "group_id": group_id,
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @classmethod
+    def _send_network_access_group_request(
+        cls,
+        method: Literal["GET", "POST", "PUT", "DELETE"],
         endpoint: str,
         *,
         payload_json: dict[str, Any] | None = None,
         params: dict[str, Any] | None = None,
     ) -> dict[str, Any]:
-        """Call the SaaS policy API while preserving its status for the Console boundary."""
+        """Call the SaaS group API while preserving its status for the Console boundary."""
 
         try:
-            response = cls._send_network_access_policy_http_request(
+            response = cls._send_network_access_group_http_request(
                 method,
                 endpoint,
                 payload_json=payload_json,
                 params=params,
             )
         except httpx.RequestError as exc:
-            raise NetworkAccessPolicyUpstreamError(httpx.codes.SERVICE_UNAVAILABLE) from exc
+            raise NetworkAccessGroupUpstreamError(httpx.codes.SERVICE_UNAVAILABLE) from exc
 
-        if response.status_code != httpx.codes.OK:
-            raise NetworkAccessPolicyUpstreamError(response.status_code)
+        if response.status_code not in (httpx.codes.OK, httpx.codes.CREATED):
+            reason = None
+            try:
+                error_payload = response.json()
+                if isinstance(error_payload, dict) and isinstance(error_payload.get("reason"), str):
+                    reason = error_payload["reason"]
+            except (json.JSONDecodeError, TypeError, ValueError):
+                pass
+            raise NetworkAccessGroupUpstreamError(response.status_code, reason)
 
         try:
             payload = response.json()
         except (json.JSONDecodeError, TypeError, ValueError) as exc:
-            raise NetworkAccessPolicyUpstreamError(httpx.codes.BAD_GATEWAY) from exc
+            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY) from exc
 
         if not isinstance(payload, dict):
-            raise NetworkAccessPolicyUpstreamError(httpx.codes.BAD_GATEWAY)
+            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY)
         return payload
 
     @classmethod
@@ -500,9 +609,9 @@ def _send_network_access_policy_request(
         retry=retry_if_exception_type(httpx.RequestError),
         reraise=True,
     )
-    def _send_network_access_policy_http_request(
+    def _send_network_access_group_http_request(
         cls,
-        method: Literal["GET", "PUT"],
+        method: Literal["GET", "POST", "PUT", "DELETE"],
         endpoint: str,
         *,
         payload_json: dict[str, Any] | None = None,
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
new file mode 100644
index 00000000000000..03842355b360ee
--- /dev/null
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -0,0 +1,392 @@
+from datetime import UTC, datetime
+from inspect import unwrap
+from types import SimpleNamespace
+from unittest.mock import patch
+from uuid import UUID
+
+import pytest
+from pydantic import ValidationError
+from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
+
+from controllers.console.workspace.network_access_group import (
+    AppNetworkAccessGroupApi,
+    AppNetworkAccessGroupUpdatePayload,
+    CurrentWorkspaceNetworkAccessGroupApi,
+    CurrentWorkspaceNetworkAccessGroupsApi,
+    NetworkAccessGroupCreatePayload,
+    NetworkAccessGroupDeleteQuery,
+    NetworkAccessGroupUpdatePayload,
+    _translate_upstream_error,
+)
+from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+
+TENANT_ID = "11111111-1111-4111-8111-111111111111"
+ACCOUNT_ID = "22222222-2222-4222-8222-222222222222"
+APP_ID = "33333333-3333-4333-8333-333333333333"
+GROUP_ID = "44444444-4444-4444-8444-444444444444"
+BINDING_ID = "55555555-5555-4555-8555-555555555555"
+
+
+def _group_payload() -> dict[str, object]:
+    return {
+        "id": GROUP_ID,
+        "tenantId": TENANT_ID,
+        "name": "Office network",
+        "description": "Reusable office egress addresses",
+        "mode": "enforce",
+        "allowedCidrs": ["203.0.113.7/32"],
+        # ProtoJSON represents int64 values as strings and timestamps as RFC 3339.
+        "version": "2",
+        "updatedByAccountId": ACCOUNT_ID,
+        "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
+        "updatedAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
+    }
+
+
+def _binding_payload(*, group_id: str | None = GROUP_ID) -> dict[str, object]:
+    return {
+        "id": BINDING_ID,
+        "tenantId": TENANT_ID,
+        "appId": APP_ID,
+        "groupId": group_id,
+        "version": "3",
+        "updatedByAccountId": ACCOUNT_ID,
+        "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
+        "updatedAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
+    }
+
+
+def test_list_authorizes_and_forwards_tenant_and_actor() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    upstream_payload = {"tenantId": TENANT_ID, "entitled": True, "groups": [_group_payload()]}
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db") as db,
+        patch.object(BillingService, "is_tenant_owner_or_admin") as authorize,
+        patch.object(BillingService, "list_network_access_groups", return_value=upstream_payload) as list_groups,
+    ):
+        result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
+
+    authorize.assert_called_once_with(current_user, session=db.session())
+    list_groups.assert_called_once_with(TENANT_ID, ACCOUNT_ID)
+    assert result["tenant_id"] == TENANT_ID
+    assert result["groups"][0]["name"] == "Office network"
+    assert result["groups"][0]["version"] == 2
+    assert result["groups"][0]["updated_at"] == "2026-08-21T00:00:00Z"
+
+
+def test_create_injects_actor_and_returns_created_contract() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.post)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    request_payload = NetworkAccessGroupCreatePayload(
+        name="Office network",
+        description="Reusable office egress addresses",
+        mode="enforce",
+        allowed_cidrs=["203.0.113.7/32"],
+    )
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "create_network_access_group",
+            return_value={"group": _group_payload()},
+        ) as create_group,
+    ):
+        body, status = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+        )
+
+    create_group.assert_called_once_with(
+        TENANT_ID,
+        name="Office network",
+        description="Reusable office egress addresses",
+        mode="enforce",
+        allowed_cidrs=["203.0.113.7/32"],
+        actor_account_id=ACCOUNT_ID,
+    )
+    assert status == 201
+    assert body["group"]["id"] == GROUP_ID
+
+
+def test_update_group_forwards_path_id_and_expected_version() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupApi()
+    method = unwrap(api.put)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    request_payload = NetworkAccessGroupUpdatePayload(
+        name="Office network",
+        description="Updated",
+        mode="shadow",
+        allowed_cidrs=["203.0.113.0/24"],
+        expected_version=1,
+    )
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "update_network_access_group",
+            return_value={"group": _group_payload()},
+        ) as update_group,
+    ):
+        result = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+            group_id=UUID(GROUP_ID),
+        )
+
+    update_group.assert_called_once_with(
+        TENANT_ID,
+        GROUP_ID,
+        name="Office network",
+        description="Updated",
+        mode="shadow",
+        allowed_cidrs=["203.0.113.0/24"],
+        expected_version=1,
+        actor_account_id=ACCOUNT_ID,
+    )
+    assert result["group"]["version"] == 2
+
+
+def test_delete_group_reads_expected_version_from_query_and_injects_actor() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupApi()
+    method = unwrap(api.delete)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "delete_network_access_group",
+            return_value={"deleted": True},
+        ) as delete_group,
+    ):
+        result = method(
+            api,
+            req_data=NetworkAccessGroupDeleteQuery(expected_version=2),
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+            group_id=UUID(GROUP_ID),
+        )
+
+    delete_group.assert_called_once_with(
+        TENANT_ID,
+        GROUP_ID,
+        expected_version=2,
+        actor_account_id=ACCOUNT_ID,
+    )
+    assert result == {"deleted": True}
+
+
+def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> None:
+    api = AppNetworkAccessGroupApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
+    upstream_payload = {"tenantId": TENANT_ID, "appId": APP_ID, "entitled": True, "binding": None}
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "get_app_network_access_group",
+            return_value=upstream_payload,
+        ) as get_binding,
+    ):
+        result = method(
+            api,
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+            app_model=app_model,
+        )
+
+    get_binding.assert_called_once_with(TENANT_ID, APP_ID, ACCOUNT_ID)
+    assert result["binding"] is None
+
+
+@pytest.mark.parametrize("group_id", [GROUP_ID, None])
+def test_app_put_assigns_or_unassigns_group(group_id: str | None) -> None:
+    api = AppNetworkAccessGroupApi()
+    method = unwrap(api.put)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
+    request_payload = AppNetworkAccessGroupUpdatePayload(group_id=group_id, expected_version=2)
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "update_app_network_access_group",
+            return_value={"binding": _binding_payload(group_id=group_id)},
+        ) as update_binding,
+    ):
+        result = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+            app_model=app_model,
+        )
+
+    update_binding.assert_called_once_with(
+        TENANT_ID,
+        APP_ID,
+        group_id=group_id,
+        expected_version=2,
+        actor_account_id=ACCOUNT_ID,
+    )
+    assert result["binding"]["group_id"] == group_id
+    assert result["binding"]["version"] == 3
+
+
+def test_list_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin", side_effect=ValueError("not privileged")),
+        patch.object(BillingService, "list_network_access_groups") as list_groups,
+        pytest.raises(Forbidden),
+    ):
+        method(api, current_tenant_id=TENANT_ID, current_user=current_user)
+
+    list_groups.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("status_code", "expected_exception"),
+    [
+        (400, BadRequest),
+        (401, ServiceUnavailable),
+        (403, Forbidden),
+        (404, NotFound),
+        (409, Conflict),
+        (500, ServiceUnavailable),
+        (418, BadGateway),
+    ],
+)
+def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPException]) -> None:
+    assert isinstance(_translate_upstream_error(NetworkAccessGroupUpstreamError(status_code)), expected_exception)
+
+
+@pytest.mark.parametrize(
+    ("reason", "expected_message"),
+    [
+        ("NETWORK_ACCESS_VERSION_CONFLICT", "changed"),
+        ("NETWORK_ACCESS_GROUP_NAME_CONFLICT", "already exists"),
+        ("NETWORK_ACCESS_GROUP_LIMIT", "reached"),
+        ("NETWORK_ACCESS_GROUP_BOUND", "Unassign"),
+    ],
+)
+def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, expected_message: str) -> None:
+    error = _translate_upstream_error(NetworkAccessGroupUpstreamError(409, reason))
+    assert isinstance(error, Conflict)
+    assert expected_message in error.description
+
+
+def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None:
+    error = _translate_upstream_error(NetworkAccessGroupUpstreamError(400, "INVALID_SECRET_KEY"))
+    assert isinstance(error, ServiceUnavailable)
+
+
+def test_list_maps_invalid_upstream_contract_to_bad_gateway() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "list_network_access_groups",
+            return_value={"tenant_id": TENANT_ID, "entitled": True, "groups": [{"mode": "disabled"}]},
+        ),
+        pytest.raises(BadGateway),
+    ):
+        method(api, current_tenant_id=TENANT_ID, current_user=current_user)
+
+
+def test_response_contract_accepts_protojson_omitted_empty_group_fields() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.get)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    group = _group_payload()
+    group.pop("description")
+    group.pop("allowedCidrs")
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "list_network_access_groups",
+            return_value={"tenantId": TENANT_ID, "entitled": True, "groups": [group]},
+        ),
+    ):
+        result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
+
+    assert result["groups"][0]["description"] == ""
+    assert result["groups"][0]["allowed_cidrs"] == []
+
+
+def test_binding_response_accepts_protojson_omitted_null_group_id() -> None:
+    api = AppNetworkAccessGroupApi()
+    method = unwrap(api.put)
+    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
+    request_payload = AppNetworkAccessGroupUpdatePayload(group_id=None, expected_version=2)
+    binding = _binding_payload(group_id=None)
+    binding.pop("groupId")
+
+    with (
+        patch("controllers.console.workspace.network_access_group.db"),
+        patch.object(BillingService, "is_tenant_owner_or_admin"),
+        patch.object(
+            BillingService,
+            "update_app_network_access_group",
+            return_value={"binding": binding},
+        ),
+    ):
+        result = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=current_user,
+            app_model=app_model,
+        )
+
+    assert result["binding"]["group_id"] is None
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        {"name": "", "description": "", "mode": "disabled", "allowed_cidrs": []},
+        {"name": "group", "description": "", "mode": "unknown", "allowed_cidrs": []},
+        {"name": "group", "description": "", "mode": "disabled", "allowed_cidrs": ["127.0.0.1"] * 101},
+    ],
+)
+def test_create_payload_contract_rejects_invalid_shapes(payload: dict[str, object]) -> None:
+    with pytest.raises(ValidationError):
+        NetworkAccessGroupCreatePayload.model_validate(payload)
+
+
+def test_binding_payload_rejects_invalid_group_id_and_version() -> None:
+    with pytest.raises(ValidationError):
+        AppNetworkAccessGroupUpdatePayload.model_validate({"group_id": "not-a-uuid", "expected_version": -1})
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
deleted file mode 100644
index e1a384bf0f1c26..00000000000000
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_policy.py
+++ /dev/null
@@ -1,148 +0,0 @@
-from datetime import UTC, datetime
-from inspect import unwrap
-from types import SimpleNamespace
-from unittest.mock import patch
-
-import pytest
-from pydantic import ValidationError
-from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
-
-from controllers.console.workspace.network_access_policy import (
-    CurrentWorkspaceNetworkAccessPolicyApi,
-    NetworkAccessPolicyPayload,
-    _translate_upstream_error,
-)
-from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
-
-
-def _policy_payload() -> dict[str, object]:
-    return {
-        "scope": "service_api",
-        "mode": "enforce",
-        "allowedCidrs": ["203.0.113.7/32"],
-        "version": "2",
-        "updatedByAccountId": "account-1",
-        "createdAt": datetime(2026, 8, 20, tzinfo=UTC).isoformat(),
-        "updatedAt": datetime(2026, 8, 20, tzinfo=UTC).isoformat(),
-    }
-
-
-def test_get_authorizes_and_forwards_tenant_and_actor() -> None:
-    api = CurrentWorkspaceNetworkAccessPolicyApi()
-    method = unwrap(api.get)
-    current_user = SimpleNamespace(id="account-1")
-    upstream_payload = {"tenantId": "tenant-1", "entitled": True, "policies": [_policy_payload()]}
-
-    with (
-        patch("controllers.console.workspace.network_access_policy.db") as db,
-        patch.object(BillingService, "is_tenant_owner_or_admin") as authorize,
-        patch.object(BillingService, "get_network_access_policies", return_value=upstream_payload) as get_policies,
-    ):
-        result = method(api, current_tenant_id="tenant-1", current_user=current_user)
-
-    authorize.assert_called_once_with(current_user, session=db.session())
-    get_policies.assert_called_once_with("tenant-1", "account-1")
-    assert result["tenant_id"] == "tenant-1"
-    assert result["policies"][0]["scope"] == "service_api"
-    assert result["policies"][0]["updated_at"] == "2026-08-20T00:00:00Z"
-
-
-def test_put_injects_actor_and_does_not_accept_it_from_payload() -> None:
-    api = CurrentWorkspaceNetworkAccessPolicyApi()
-    method = unwrap(api.put)
-    current_user = SimpleNamespace(id="account-1")
-    request_payload = NetworkAccessPolicyPayload(
-        scope="service_api",
-        mode="enforce",
-        allowed_cidrs=["203.0.113.7/32"],
-        expected_version=1,
-    )
-
-    with (
-        patch("controllers.console.workspace.network_access_policy.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
-        patch.object(
-            BillingService,
-            "update_network_access_policy",
-            return_value={"policy": _policy_payload()},
-        ) as update_policy,
-    ):
-        result = method(
-            api,
-            req_data=request_payload,
-            current_tenant_id="tenant-1",
-            current_user=current_user,
-        )
-
-    update_policy.assert_called_once_with(
-        "tenant-1",
-        "service_api",
-        mode="enforce",
-        allowed_cidrs=["203.0.113.7/32"],
-        expected_version=1,
-        actor_account_id="account-1",
-    )
-    assert result["policy"]["version"] == 2
-
-
-def test_get_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
-    api = CurrentWorkspaceNetworkAccessPolicyApi()
-    method = unwrap(api.get)
-    current_user = SimpleNamespace(id="account-1")
-
-    with (
-        patch("controllers.console.workspace.network_access_policy.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin", side_effect=ValueError("not privileged")),
-        patch.object(BillingService, "get_network_access_policies") as get_policies,
-        pytest.raises(Forbidden),
-    ):
-        method(api, current_tenant_id="tenant-1", current_user=current_user)
-
-    get_policies.assert_not_called()
-
-
-@pytest.mark.parametrize(
-    ("status_code", "expected_exception"),
-    [
-        (400, BadRequest),
-        (403, Forbidden),
-        (404, NotFound),
-        (409, Conflict),
-        (500, ServiceUnavailable),
-        (418, BadGateway),
-    ],
-)
-def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPException]) -> None:
-    assert isinstance(_translate_upstream_error(NetworkAccessPolicyUpstreamError(status_code)), expected_exception)
-
-
-def test_get_maps_invalid_upstream_contract_to_bad_gateway() -> None:
-    api = CurrentWorkspaceNetworkAccessPolicyApi()
-    method = unwrap(api.get)
-    current_user = SimpleNamespace(id="account-1")
-
-    with (
-        patch("controllers.console.workspace.network_access_policy.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
-        patch.object(
-            BillingService,
-            "get_network_access_policies",
-            return_value={"tenant_id": "tenant-1", "entitled": True, "policies": [{"mode": "disabled"}]},
-        ),
-        pytest.raises(BadGateway),
-    ):
-        method(api, current_tenant_id="tenant-1", current_user=current_user)
-
-
-@pytest.mark.parametrize(
-    "payload",
-    [
-        {"scope": "unknown", "mode": "disabled", "allowed_cidrs": [], "expected_version": 0},
-        {"scope": "mcp", "mode": "unknown", "allowed_cidrs": [], "expected_version": 0},
-        {"scope": "mcp", "mode": "disabled", "allowed_cidrs": [], "expected_version": -1},
-        {"scope": "mcp", "mode": "disabled", "allowed_cidrs": ["127.0.0.1"] * 101, "expected_version": 0},
-    ],
-)
-def test_payload_contract_rejects_invalid_shapes(payload: dict[str, object]) -> None:
-    with pytest.raises(ValidationError):
-        NetworkAccessPolicyPayload.model_validate(payload)
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
new file mode 100644
index 00000000000000..e71e8e98916453
--- /dev/null
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -0,0 +1,239 @@
+from collections.abc import Iterator
+from unittest.mock import MagicMock, call, patch
+
+import httpx
+import pytest
+
+from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+
+TENANT_ID = "11111111-1111-4111-8111-111111111111"
+ACCOUNT_ID = "22222222-2222-4222-8222-222222222222"
+APP_ID = "33333333-3333-4333-8333-333333333333"
+GROUP_ID = "44444444-4444-4444-8444-444444444444"
+HEADERS = {"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"}
+
+
+@pytest.fixture
+def billing_config() -> Iterator[None]:
+    with (
+        patch.object(BillingService, "base_url", "https://billing.internal/v1"),
+        patch.object(BillingService, "secret_key", "test-secret"),
+    ):
+        yield
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.side_effect = [
+        {"tenant_id": TENANT_ID, "entitled": True, "groups": []},
+        {"group": {"id": GROUP_ID}},
+    ]
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        list_result = BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
+        item_result = BillingService.get_network_access_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
+
+    assert list_result["groups"] == []
+    assert item_result["group"]["id"] == GROUP_ID
+    assert request.call_args_list == [
+        call(
+            "GET",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+            json=None,
+            params={"actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+        call(
+            "GET",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups/{GROUP_ID}",
+            json=None,
+            params={"actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+    ]
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_group_mutations_inject_actor_and_use_expected_version() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.side_effect = [
+        {"group": {"id": GROUP_ID, "version": "1"}},
+        {"group": {"id": GROUP_ID, "version": "2"}},
+        {"deleted": True},
+    ]
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        BillingService.create_network_access_group(
+            TENANT_ID,
+            name="Office",
+            description="Office egress",
+            mode="enforce",
+            allowed_cidrs=["203.0.113.7/32"],
+            actor_account_id=ACCOUNT_ID,
+        )
+        BillingService.update_network_access_group(
+            TENANT_ID,
+            GROUP_ID,
+            name="Office",
+            description="Updated office egress",
+            mode="shadow",
+            allowed_cidrs=["203.0.113.0/24"],
+            expected_version=1,
+            actor_account_id=ACCOUNT_ID,
+        )
+        BillingService.delete_network_access_group(
+            TENANT_ID,
+            GROUP_ID,
+            expected_version=2,
+            actor_account_id=ACCOUNT_ID,
+        )
+
+    assert request.call_args_list == [
+        call(
+            "POST",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+            json={
+                "name": "Office",
+                "description": "Office egress",
+                "mode": "enforce",
+                "allowed_cidrs": ["203.0.113.7/32"],
+                "actor_account_id": ACCOUNT_ID,
+            },
+            params=None,
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+        call(
+            "PUT",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups/{GROUP_ID}",
+            json={
+                "name": "Office",
+                "description": "Updated office egress",
+                "mode": "shadow",
+                "allowed_cidrs": ["203.0.113.0/24"],
+                "expected_version": 1,
+                "actor_account_id": ACCOUNT_ID,
+            },
+            params=None,
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+        call(
+            "DELETE",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups/{GROUP_ID}",
+            json=None,
+            params={"expected_version": 2, "actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+    ]
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.side_effect = [
+        {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
+        {"binding": {"app_id": APP_ID, "group_id": GROUP_ID, "version": "1"}},
+        {"binding": {"app_id": APP_ID, "group_id": None, "version": "2"}},
+    ]
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        BillingService.get_app_network_access_group(TENANT_ID, APP_ID, ACCOUNT_ID)
+        BillingService.update_app_network_access_group(
+            TENANT_ID,
+            APP_ID,
+            group_id=GROUP_ID,
+            expected_version=0,
+            actor_account_id=ACCOUNT_ID,
+        )
+        BillingService.update_app_network_access_group(
+            TENANT_ID,
+            APP_ID,
+            group_id=None,
+            expected_version=1,
+            actor_account_id=ACCOUNT_ID,
+        )
+
+    endpoint = f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group"
+    assert request.call_args_list == [
+        call(
+            "GET",
+            endpoint,
+            json=None,
+            params={"actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+        call(
+            "PUT",
+            endpoint,
+            json={"group_id": GROUP_ID, "expected_version": 0, "actor_account_id": ACCOUNT_ID},
+            params=None,
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+        call(
+            "PUT",
+            endpoint,
+            json={"group_id": None, "expected_version": 1, "actor_account_id": ACCOUNT_ID},
+            params=None,
+            headers=HEADERS,
+            follow_redirects=True,
+        ),
+    ]
+
+
+@pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500])
+def test_network_access_group_request_preserves_upstream_status(status_code: int) -> None:
+    response = MagicMock(status_code=status_code)
+    with (
+        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_group_request("GET", "/groups")
+
+    assert exc_info.value.status_code == status_code
+
+
+def test_network_access_group_request_preserves_whitelisted_upstream_reason() -> None:
+    response = MagicMock(status_code=httpx.codes.CONFLICT)
+    response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_GROUP_BOUND", "message": "internal"}
+    with (
+        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_group_request("DELETE", "/groups/id")
+
+    assert exc_info.value.status_code == httpx.codes.CONFLICT
+    assert exc_info.value.reason == "NETWORK_ACCESS_GROUP_BOUND"
+
+
+def test_network_access_group_request_maps_transport_failure_to_service_unavailable() -> None:
+    request = httpx.Request("GET", "https://billing.internal/v1/groups")
+    with (
+        patch.object(
+            BillingService,
+            "_send_network_access_group_http_request",
+            side_effect=httpx.ConnectError("unavailable", request=request),
+        ),
+        pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_group_request("GET", "/groups")
+
+    assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
+
+
+def test_network_access_group_request_rejects_non_object_response() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = list[object]()
+    with (
+        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
+    ):
+        BillingService._send_network_access_group_request("GET", "/groups")
+
+    assert exc_info.value.status_code == httpx.codes.BAD_GATEWAY
diff --git a/api/tests/unit_tests/services/test_network_access_policy_billing_service.py b/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
deleted file mode 100644
index 550181795ea3dc..00000000000000
--- a/api/tests/unit_tests/services/test_network_access_policy_billing_service.py
+++ /dev/null
@@ -1,113 +0,0 @@
-from collections.abc import Iterator
-from unittest.mock import MagicMock, patch
-
-import httpx
-import pytest
-
-from services.billing_service import BillingService, NetworkAccessPolicyUpstreamError
-
-
-@pytest.fixture
-def billing_config() -> Iterator[None]:
-    with (
-        patch.object(BillingService, "base_url", "https://billing.internal/v1"),
-        patch.object(BillingService, "secret_key", "test-secret"),
-    ):
-        yield
-
-
-@pytest.mark.usefixtures("billing_config")
-def test_get_network_access_policies_uses_authenticated_saas_endpoint() -> None:
-    response = MagicMock(status_code=httpx.codes.OK)
-    policies: list[dict[str, object]] = []
-    response.json.return_value = {"tenant_id": "tenant-1", "entitled": True, "policies": policies}
-
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        result = BillingService.get_network_access_policies("tenant-1", "account-1")
-
-    assert result == {"tenant_id": "tenant-1", "entitled": True, "policies": policies}
-    request.assert_called_once_with(
-        "GET",
-        "https://billing.internal/v1/tenants/tenant-1/network-access-policies",
-        json=None,
-        params={"actor_account_id": "account-1"},
-        headers={"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"},
-        follow_redirects=True,
-    )
-
-
-@pytest.mark.usefixtures("billing_config")
-def test_update_network_access_policy_injects_actor_and_scope() -> None:
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {
-        "policy": {
-            "scope": "service_api",
-            "mode": "enforce",
-            "allowed_cidrs": ["203.0.113.7/32"],
-            "version": 2,
-        }
-    }
-
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        result = BillingService.update_network_access_policy(
-            "tenant-1",
-            "service_api",
-            mode="enforce",
-            allowed_cidrs=["203.0.113.7/32"],
-            expected_version=1,
-            actor_account_id="account-1",
-        )
-
-    assert result["policy"]["version"] == 2
-    request.assert_called_once_with(
-        "PUT",
-        "https://billing.internal/v1/tenants/tenant-1/network-access-policies/service_api",
-        json={
-            "mode": "enforce",
-            "allowed_cidrs": ["203.0.113.7/32"],
-            "expected_version": 1,
-            "actor_account_id": "account-1",
-        },
-        params=None,
-        headers={"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"},
-        follow_redirects=True,
-    )
-
-
-@pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500])
-def test_network_access_policy_request_preserves_upstream_status(status_code: int) -> None:
-    response = MagicMock(status_code=status_code)
-    with (
-        patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
-        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
-    ):
-        BillingService._send_network_access_policy_request("GET", "/policies")
-
-    assert exc_info.value.status_code == status_code
-
-
-def test_network_access_policy_request_maps_transport_failure_to_service_unavailable() -> None:
-    request = httpx.Request("GET", "https://billing.internal/v1/policies")
-    with (
-        patch.object(
-            BillingService,
-            "_send_network_access_policy_http_request",
-            side_effect=httpx.ConnectError("unavailable", request=request),
-        ),
-        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
-    ):
-        BillingService._send_network_access_policy_request("GET", "/policies")
-
-    assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
-
-
-def test_network_access_policy_request_rejects_non_object_response() -> None:
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = list[object]()
-    with (
-        patch.object(BillingService, "_send_network_access_policy_http_request", return_value=response),
-        pytest.raises(NetworkAccessPolicyUpstreamError) as exc_info,
-    ):
-        BillingService._send_network_access_policy_request("GET", "/policies")
-
-    assert exc_info.value.status_code == httpx.codes.BAD_GATEWAY
diff --git a/packages/contracts/generated/api/console/apps/orpc.gen.ts b/packages/contracts/generated/api/console/apps/orpc.gen.ts
index 4c2fcd0df73e8d..7245ec0fe9f552 100644
--- a/packages/contracts/generated/api/console/apps/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/apps/orpc.gen.ts
@@ -118,6 +118,8 @@ import {
   zGetAppsByAppIdFeedbacksExportResponse,
   zGetAppsByAppIdMessagesByMessageIdPath,
   zGetAppsByAppIdMessagesByMessageIdResponse,
+  zGetAppsByAppIdNetworkAccessGroupPath,
+  zGetAppsByAppIdNetworkAccessGroupResponse,
   zGetAppsByAppIdPath,
   zGetAppsByAppIdResponse,
   zGetAppsByAppIdServerPath,
@@ -447,6 +449,9 @@ import {
   zPostAppsWorkflowsOnlineUsersBody,
   zPostAppsWorkflowsOnlineUsersResponse,
   zPutAppsByAppIdBody,
+  zPutAppsByAppIdNetworkAccessGroupBody,
+  zPutAppsByAppIdNetworkAccessGroupPath,
+  zPutAppsByAppIdNetworkAccessGroupResponse,
   zPutAppsByAppIdPath,
   zPutAppsByAppIdResponse,
   zPutAppsByAppIdServerBody,
@@ -1965,6 +1970,38 @@ export const name = {
   post: post26,
 }
 
+export const get34 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getAppsByAppIdNetworkAccessGroup',
+    path: '/apps/{app_id}/network-access-group',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetAppsByAppIdNetworkAccessGroupPath }))
+  .output(zGetAppsByAppIdNetworkAccessGroupResponse)
+
+export const put = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'PUT',
+    operationId: 'putAppsByAppIdNetworkAccessGroup',
+    path: '/apps/{app_id}/network-access-group',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      body: zPutAppsByAppIdNetworkAccessGroupBody,
+      params: zPutAppsByAppIdNetworkAccessGroupPath,
+    }),
+  )
+  .output(zPutAppsByAppIdNetworkAccessGroupResponse)
+
+export const networkAccessGroup = {
+  get: get34,
+  put,
+}
+
 /**
  * Publish app to Creators Platform
  */
@@ -2006,7 +2043,7 @@ export const refresh = {
 /**
  * Get MCP server configuration for an application
  */
-export const get34 = oc
+export const get35 = oc
   .route({
     description: 'Get MCP server configuration for an application',
     inputStructure: 'detailed',
@@ -2037,7 +2074,7 @@ export const post29 = oc
 /**
  * Update MCP server configuration for an application
  */
-export const put = oc
+export const put2 = oc
   .route({
     description: 'Update MCP server configuration for an application',
     inputStructure: 'detailed',
@@ -2050,9 +2087,9 @@ export const put = oc
   .output(zPutAppsByAppIdServerResponse)
 
 export const server = {
-  get: get34,
+  get: get35,
   post: post29,
-  put,
+  put: put2,
   refresh,
 }
 
@@ -2152,7 +2189,7 @@ export const star = {
 /**
  * Get average response time statistics for an application
  */
-export const get35 = oc
+export const get36 = oc
   .route({
     description: 'Get average response time statistics for an application',
     inputStructure: 'detailed',
@@ -2170,13 +2207,13 @@ export const get35 = oc
   .output(zGetAppsByAppIdStatisticsAverageResponseTimeResponse)
 
 export const averageResponseTime = {
-  get: get35,
+  get: get36,
 }
 
 /**
  * Get average session interaction statistics for an application
  */
-export const get36 = oc
+export const get37 = oc
   .route({
     description: 'Get average session interaction statistics for an application',
     inputStructure: 'detailed',
@@ -2194,13 +2231,13 @@ export const get36 = oc
   .output(zGetAppsByAppIdStatisticsAverageSessionInteractionsResponse)
 
 export const averageSessionInteractions = {
-  get: get36,
+  get: get37,
 }
 
 /**
  * Get daily conversation statistics for an application
  */
-export const get37 = oc
+export const get38 = oc
   .route({
     description: 'Get daily conversation statistics for an application',
     inputStructure: 'detailed',
@@ -2218,13 +2255,13 @@ export const get37 = oc
   .output(zGetAppsByAppIdStatisticsDailyConversationsResponse)
 
 export const dailyConversations = {
-  get: get37,
+  get: get38,
 }
 
 /**
  * Get daily terminal/end-user statistics for an application
  */
-export const get38 = oc
+export const get39 = oc
   .route({
     description: 'Get daily terminal/end-user statistics for an application',
     inputStructure: 'detailed',
@@ -2242,13 +2279,13 @@ export const get38 = oc
   .output(zGetAppsByAppIdStatisticsDailyEndUsersResponse)
 
 export const dailyEndUsers = {
-  get: get38,
+  get: get39,
 }
 
 /**
  * Get daily message statistics for an application
  */
-export const get39 = oc
+export const get40 = oc
   .route({
     description: 'Get daily message statistics for an application',
     inputStructure: 'detailed',
@@ -2266,13 +2303,13 @@ export const get39 = oc
   .output(zGetAppsByAppIdStatisticsDailyMessagesResponse)
 
 export const dailyMessages = {
-  get: get39,
+  get: get40,
 }
 
 /**
  * Get daily token cost statistics for an application
  */
-export const get40 = oc
+export const get41 = oc
   .route({
     description: 'Get daily token cost statistics for an application',
     inputStructure: 'detailed',
@@ -2290,13 +2327,13 @@ export const get40 = oc
   .output(zGetAppsByAppIdStatisticsTokenCostsResponse)
 
 export const tokenCosts = {
-  get: get40,
+  get: get41,
 }
 
 /**
  * Get tokens per second statistics for an application
  */
-export const get41 = oc
+export const get42 = oc
   .route({
     description: 'Get tokens per second statistics for an application',
     inputStructure: 'detailed',
@@ -2314,13 +2351,13 @@ export const get41 = oc
   .output(zGetAppsByAppIdStatisticsTokensPerSecondResponse)
 
 export const tokensPerSecond = {
-  get: get41,
+  get: get42,
 }
 
 /**
  * Get user satisfaction rate statistics for an application
  */
-export const get42 = oc
+export const get43 = oc
   .route({
     description: 'Get user satisfaction rate statistics for an application',
     inputStructure: 'detailed',
@@ -2338,7 +2375,7 @@ export const get42 = oc
   .output(zGetAppsByAppIdStatisticsUserSatisfactionRateResponse)
 
 export const userSatisfactionRate = {
-  get: get42,
+  get: get43,
 }
 
 export const statistics = {
@@ -2355,7 +2392,7 @@ export const statistics = {
 /**
  * Get available TTS voices for a specific language
  */
-export const get43 = oc
+export const get44 = oc
   .route({
     description: 'Get available TTS voices for a specific language',
     inputStructure: 'detailed',
@@ -2373,7 +2410,7 @@ export const get43 = oc
   .output(zGetAppsByAppIdTextToAudioVoicesResponse)
 
 export const voices = {
-  get: get43,
+  get: get44,
 }
 
 /**
@@ -2403,7 +2440,7 @@ export const textToAudio = {
  *
  * Get app tracing configuration
  */
-export const get44 = oc
+export const get45 = oc
   .route({
     description: 'Get app tracing configuration',
     inputStructure: 'detailed',
@@ -2432,7 +2469,7 @@ export const post35 = oc
   .output(zPostAppsByAppIdTraceResponse)
 
 export const trace = {
-  get: get44,
+  get: get45,
   post: post35,
 }
 
@@ -2463,7 +2500,7 @@ export const delete8 = oc
 /**
  * Get tracing configuration for an application
  */
-export const get45 = oc
+export const get46 = oc
   .route({
     description: 'Get tracing configuration for an application',
     inputStructure: 'detailed',
@@ -2520,7 +2557,7 @@ export const post36 = oc
 
 export const traceConfig = {
   delete: delete8,
-  get: get45,
+  get: get46,
   patch,
   post: post36,
 }
@@ -2552,7 +2589,7 @@ export const triggerEnable = {
 /**
  * Get app triggers list
  */
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2565,7 +2602,7 @@ export const get46 = oc
   .output(zGetAppsByAppIdTriggersResponse)
 
 export const triggers = {
-  get: get46,
+  get: get47,
 }
 
 /**
@@ -2573,7 +2610,7 @@ export const triggers = {
  *
  * Get workflow application execution logs
  */
-export const get47 = oc
+export const get48 = oc
   .route({
     description: 'Get workflow application execution logs',
     inputStructure: 'detailed',
@@ -2592,7 +2629,7 @@ export const get47 = oc
   .output(zGetAppsByAppIdWorkflowAppLogsResponse)
 
 export const workflowAppLogs = {
-  get: get47,
+  get: get48,
 }
 
 /**
@@ -2600,7 +2637,7 @@ export const workflowAppLogs = {
  *
  * Get workflow archived execution logs
  */
-export const get48 = oc
+export const get49 = oc
   .route({
     description: 'Get workflow archived execution logs',
     inputStructure: 'detailed',
@@ -2619,7 +2656,7 @@ export const get48 = oc
   .output(zGetAppsByAppIdWorkflowArchivedLogsResponse)
 
 export const workflowArchivedLogs = {
-  get: get48,
+  get: get49,
 }
 
 /**
@@ -2627,7 +2664,7 @@ export const workflowArchivedLogs = {
  *
  * Get workflow runs count statistics
  */
-export const get49 = oc
+export const get50 = oc
   .route({
     description: 'Get workflow runs count statistics',
     inputStructure: 'detailed',
@@ -2646,7 +2683,7 @@ export const get49 = oc
   .output(zGetAppsByAppIdWorkflowRunsCountResponse)
 
 export const count3 = {
-  get: get49,
+  get: get50,
 }
 
 /**
@@ -2682,7 +2719,7 @@ export const tasks = {
 /**
  * Generate a download URL for an archived workflow run.
  */
-export const get50 = oc
+export const get51 = oc
   .route({
     description: 'Generate a download URL for an archived workflow run.',
     inputStructure: 'detailed',
@@ -2695,7 +2732,7 @@ export const get50 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdExportResponse)
 
 export const export4 = {
-  get: get50,
+  get: get51,
 }
 
 /**
@@ -2703,7 +2740,7 @@ export const export4 = {
  *
  * Get workflow run node execution list
  */
-export const get51 = oc
+export const get52 = oc
   .route({
     description: 'Get workflow run node execution list',
     inputStructure: 'detailed',
@@ -2717,7 +2754,7 @@ export const get51 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdNodeExecutionsResponse)
 
 export const nodeExecutions = {
-  get: get51,
+  get: get52,
 }
 
 /**
@@ -2725,7 +2762,7 @@ export const nodeExecutions = {
  *
  * Get workflow run detail
  */
-export const get52 = oc
+export const get53 = oc
   .route({
     description: 'Get workflow run detail',
     inputStructure: 'detailed',
@@ -2739,7 +2776,7 @@ export const get52 = oc
   .output(zGetAppsByAppIdWorkflowRunsByRunIdResponse)
 
 export const byRunId = {
-  get: get52,
+  get: get53,
   export: export4,
   nodeExecutions,
 }
@@ -2772,7 +2809,7 @@ export const download4 = {
 /**
  * Read a text/binary preview file in a workflow Agent node sandbox
  */
-export const get53 = oc
+export const get54 = oc
   .route({
     description: 'Read a text/binary preview file in a workflow Agent node sandbox',
     inputStructure: 'detailed',
@@ -2790,13 +2827,13 @@ export const get53 = oc
   .output(zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesReadResponse)
 
 export const read = {
-  get: get53,
+  get: get54,
 }
 
 /**
  * List a directory in a workflow Agent node sandbox
  */
-export const get54 = oc
+export const get55 = oc
   .route({
     description: 'List a directory in a workflow Agent node sandbox',
     inputStructure: 'detailed',
@@ -2814,7 +2851,7 @@ export const get54 = oc
   .output(zGetAppsByAppIdWorkflowRunsByWorkflowRunIdAgentNodesByNodeIdSandboxFilesResponse)
 
 export const files3 = {
-  get: get54,
+  get: get55,
   download: download4,
   read,
 }
@@ -2840,7 +2877,7 @@ export const byWorkflowRunId = {
  *
  * Get workflow run list
  */
-export const get55 = oc
+export const get56 = oc
   .route({
     description: 'Get workflow run list',
     inputStructure: 'detailed',
@@ -2859,7 +2896,7 @@ export const get55 = oc
   .output(zGetAppsByAppIdWorkflowRunsResponse)
 
 export const workflowRuns2 = {
-  get: get55,
+  get: get56,
   count: count3,
   tasks,
   byRunId,
@@ -2871,7 +2908,7 @@ export const workflowRuns2 = {
  *
  * Get all users in current tenant for mentions
  */
-export const get56 = oc
+export const get57 = oc
   .route({
     description: 'Get all users in current tenant for mentions',
     inputStructure: 'detailed',
@@ -2885,7 +2922,7 @@ export const get56 = oc
   .output(zGetAppsByAppIdWorkflowCommentsMentionUsersResponse)
 
 export const mentionUsers = {
-  get: get56,
+  get: get57,
 }
 
 /**
@@ -2912,7 +2949,7 @@ export const delete9 = oc
  *
  * Update a comment reply
  */
-export const put2 = oc
+export const put3 = oc
   .route({
     description: 'Update a comment reply',
     inputStructure: 'detailed',
@@ -2932,7 +2969,7 @@ export const put2 = oc
 
 export const byReplyId = {
   delete: delete9,
-  put: put2,
+  put: put3,
 }
 
 /**
@@ -3010,7 +3047,7 @@ export const delete10 = oc
  *
  * Get a specific workflow comment
  */
-export const get57 = oc
+export const get58 = oc
   .route({
     description: 'Get a specific workflow comment',
     inputStructure: 'detailed',
@@ -3028,7 +3065,7 @@ export const get57 = oc
  *
  * Update a workflow comment
  */
-export const put3 = oc
+export const put4 = oc
   .route({
     description: 'Update a workflow comment',
     inputStructure: 'detailed',
@@ -3048,8 +3085,8 @@ export const put3 = oc
 
 export const byCommentId = {
   delete: delete10,
-  get: get57,
-  put: put3,
+  get: get58,
+  put: put4,
   replies,
   resolve,
 }
@@ -3059,7 +3096,7 @@ export const byCommentId = {
  *
  * Get all comments for a workflow
  */
-export const get58 = oc
+export const get59 = oc
   .route({
     description: 'Get all comments for a workflow',
     inputStructure: 'detailed',
@@ -3097,7 +3134,7 @@ export const post42 = oc
   .output(zPostAppsByAppIdWorkflowCommentsResponse)
 
 export const comments = {
-  get: get58,
+  get: get59,
   post: post42,
   mentionUsers,
   byCommentId,
@@ -3106,7 +3143,7 @@ export const comments = {
 /**
  * Get workflow average app interaction statistics
  */
-export const get59 = oc
+export const get60 = oc
   .route({
     description: 'Get workflow average app interaction statistics',
     inputStructure: 'detailed',
@@ -3124,13 +3161,13 @@ export const get59 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsAverageAppInteractionsResponse)
 
 export const averageAppInteractions = {
-  get: get59,
+  get: get60,
 }
 
 /**
  * Get workflow daily runs statistics
  */
-export const get60 = oc
+export const get61 = oc
   .route({
     description: 'Get workflow daily runs statistics',
     inputStructure: 'detailed',
@@ -3148,13 +3185,13 @@ export const get60 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsDailyConversationsResponse)
 
 export const dailyConversations2 = {
-  get: get60,
+  get: get61,
 }
 
 /**
  * Get workflow daily terminals statistics
  */
-export const get61 = oc
+export const get62 = oc
   .route({
     description: 'Get workflow daily terminals statistics',
     inputStructure: 'detailed',
@@ -3172,13 +3209,13 @@ export const get61 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsDailyTerminalsResponse)
 
 export const dailyTerminals = {
-  get: get61,
+  get: get62,
 }
 
 /**
  * Get workflow daily token cost statistics
  */
-export const get62 = oc
+export const get63 = oc
   .route({
     description: 'Get workflow daily token cost statistics',
     inputStructure: 'detailed',
@@ -3196,7 +3233,7 @@ export const get62 = oc
   .output(zGetAppsByAppIdWorkflowStatisticsTokenCostsResponse)
 
 export const tokenCosts2 = {
-  get: get62,
+  get: get63,
 }
 
 export const statistics2 = {
@@ -3216,7 +3253,7 @@ export const workflow = {
  *
  * Get default block configuration by type
  */
-export const get63 = oc
+export const get64 = oc
   .route({
     description: 'Get default block configuration by type',
     inputStructure: 'detailed',
@@ -3235,7 +3272,7 @@ export const get63 = oc
   .output(zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsByBlockTypeResponse)
 
 export const byBlockType = {
-  get: get63,
+  get: get64,
 }
 
 /**
@@ -3243,7 +3280,7 @@ export const byBlockType = {
  *
  * Get default block configurations for workflow
  */
-export const get64 = oc
+export const get65 = oc
   .route({
     description: 'Get default block configurations for workflow',
     inputStructure: 'detailed',
@@ -3257,14 +3294,14 @@ export const get64 = oc
   .output(zGetAppsByAppIdWorkflowsDefaultWorkflowBlockConfigsResponse)
 
 export const defaultWorkflowBlockConfigs = {
-  get: get64,
+  get: get65,
   byBlockType,
 }
 
 /**
  * Get conversation variables for workflow
  */
-export const get65 = oc
+export const get66 = oc
   .route({
     description: 'Get conversation variables for workflow',
     inputStructure: 'detailed',
@@ -3297,7 +3334,7 @@ export const post43 = oc
   .output(zPostAppsByAppIdWorkflowsDraftConversationVariablesResponse)
 
 export const conversationVariables2 = {
-  get: get65,
+  get: get66,
   post: post43,
 }
 
@@ -3306,7 +3343,7 @@ export const conversationVariables2 = {
  *
  * Get environment variables for workflow
  */
-export const get66 = oc
+export const get67 = oc
   .route({
     description: 'Get environment variables for workflow',
     inputStructure: 'detailed',
@@ -3340,7 +3377,7 @@ export const post44 = oc
   .output(zPostAppsByAppIdWorkflowsDraftEnvironmentVariablesResponse)
 
 export const environmentVariables = {
-  get: get66,
+  get: get67,
   post: post44,
 }
 
@@ -3545,7 +3582,7 @@ export const loop2 = {
   nodes: nodes6,
 }
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3559,7 +3596,7 @@ export const get67 = oc
   .output(zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerCandidatesResponse)
 
 export const candidates = {
-  get: get67,
+  get: get68,
 }
 
 export const post51 = oc
@@ -3642,7 +3679,7 @@ export const validate = {
   post: post54,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3658,7 +3695,7 @@ export const get68 = oc
   )
   .output(zGetAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerResponse)
 
-export const put4 = oc
+export const put5 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
@@ -3675,8 +3712,8 @@ export const put4 = oc
   .output(zPutAppsByAppIdWorkflowsDraftNodesByNodeIdAgentComposerResponse)
 
 export const agentComposer = {
-  get: get68,
-  put: put4,
+  get: get69,
+  put: put5,
   candidates,
   copyFromRoster,
   impact,
@@ -3687,7 +3724,7 @@ export const agentComposer = {
 /**
  * Get last run result for draft workflow node
  */
-export const get69 = oc
+export const get70 = oc
   .route({
     description: 'Get last run result for draft workflow node',
     inputStructure: 'detailed',
@@ -3700,7 +3737,7 @@ export const get69 = oc
   .output(zGetAppsByAppIdWorkflowsDraftNodesByNodeIdLastRunResponse)
 
 export const lastRun = {
-  get: get69,
+  get: get70,
 }
 
 /**
@@ -3775,7 +3812,7 @@ export const delete11 = oc
 /**
  * Get variables for a specific node
  */
-export const get70 = oc
+export const get71 = oc
   .route({
     description: 'Get variables for a specific node',
     inputStructure: 'detailed',
@@ -3789,7 +3826,7 @@ export const get70 = oc
 
 export const variables = {
   delete: delete11,
-  get: get70,
+  get: get71,
 }
 
 export const byNodeId8 = {
@@ -3834,7 +3871,7 @@ export const run10 = {
 /**
  * Server-Sent Events stream of inspector deltas for a draft workflow run.
  */
-export const get71 = oc
+export const get72 = oc
   .route({
     description: 'Server-Sent Events stream of inspector deltas for a draft workflow run.',
     inputStructure: 'detailed',
@@ -3847,13 +3884,13 @@ export const get71 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsEventsResponse)
 
 export const events = {
-  get: get71,
+  get: get72,
 }
 
 /**
  * Full value for one declared output, including signed download URL for files.
  */
-export const get72 = oc
+export const get73 = oc
   .route({
     description: 'Full value for one declared output, including signed download URL for files.',
     inputStructure: 'detailed',
@@ -3870,7 +3907,7 @@ export const get72 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdByOutputNamePreviewResponse)
 
 export const preview5 = {
-  get: get72,
+  get: get73,
 }
 
 export const byOutputName = {
@@ -3880,7 +3917,7 @@ export const byOutputName = {
 /**
  * One node's declared outputs for a draft workflow run.
  */
-export const get73 = oc
+export const get74 = oc
   .route({
     description: "One node's declared outputs for a draft workflow run.",
     inputStructure: 'detailed',
@@ -3893,14 +3930,14 @@ export const get73 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsByNodeIdResponse)
 
 export const byNodeId9 = {
-  get: get73,
+  get: get74,
   byOutputName,
 }
 
 /**
  * Snapshot of every node's declared outputs for a draft workflow run.
  */
-export const get74 = oc
+export const get75 = oc
   .route({
     description: "Snapshot of every node's declared outputs for a draft workflow run.",
     inputStructure: 'detailed',
@@ -3913,7 +3950,7 @@ export const get74 = oc
   .output(zGetAppsByAppIdWorkflowsDraftRunsByRunIdNodeOutputsResponse)
 
 export const nodeOutputs = {
-  get: get74,
+  get: get75,
   events,
   byNodeId: byNodeId9,
 }
@@ -3929,7 +3966,7 @@ export const runs = {
 /**
  * Get system variables for workflow
  */
-export const get75 = oc
+export const get76 = oc
   .route({
     description: 'Get system variables for workflow',
     inputStructure: 'detailed',
@@ -3942,7 +3979,7 @@ export const get75 = oc
   .output(zGetAppsByAppIdWorkflowsDraftSystemVariablesResponse)
 
 export const systemVariables = {
-  get: get75,
+  get: get76,
 }
 
 /**
@@ -4007,7 +4044,7 @@ export const trigger2 = {
 /**
  * Reset a workflow variable to its default value
  */
-export const put5 = oc
+export const put6 = oc
   .route({
     description: 'Reset a workflow variable to its default value',
     inputStructure: 'detailed',
@@ -4020,7 +4057,7 @@ export const put5 = oc
   .output(zPutAppsByAppIdWorkflowsDraftVariablesByVariableIdResetResponse)
 
 export const reset = {
-  put: put5,
+  put: put6,
 }
 
 /**
@@ -4042,7 +4079,7 @@ export const delete12 = oc
 /**
  * Get a specific workflow variable
  */
-export const get76 = oc
+export const get77 = oc
   .route({
     description: 'Get a specific workflow variable',
     inputStructure: 'detailed',
@@ -4076,7 +4113,7 @@ export const patch2 = oc
 
 export const byVariableId = {
   delete: delete12,
-  get: get76,
+  get: get77,
   patch: patch2,
   reset,
 }
@@ -4102,7 +4139,7 @@ export const delete13 = oc
  *
  * Get draft workflow variables
  */
-export const get77 = oc
+export const get78 = oc
   .route({
     description: 'Get draft workflow variables',
     inputStructure: 'detailed',
@@ -4122,7 +4159,7 @@ export const get77 = oc
 
 export const variables2 = {
   delete: delete13,
-  get: get77,
+  get: get78,
   byVariableId,
 }
 
@@ -4131,7 +4168,7 @@ export const variables2 = {
  *
  * Get draft workflow for an application
  */
-export const get78 = oc
+export const get79 = oc
   .route({
     description: 'Get draft workflow for an application',
     inputStructure: 'detailed',
@@ -4168,7 +4205,7 @@ export const post60 = oc
   .output(zPostAppsByAppIdWorkflowsDraftResponse)
 
 export const draft2 = {
-  get: get78,
+  get: get79,
   post: post60,
   conversationVariables: conversationVariables2,
   environmentVariables,
@@ -4189,7 +4226,7 @@ export const draft2 = {
  *
  * Get published workflow for an application
  */
-export const get79 = oc
+export const get80 = oc
   .route({
     description: 'Get published workflow for an application',
     inputStructure: 'detailed',
@@ -4223,14 +4260,14 @@ export const post61 = oc
   .output(zPostAppsByAppIdWorkflowsPublishResponse)
 
 export const publish = {
-  get: get79,
+  get: get80,
   post: post61,
 }
 
 /**
  * Server-Sent Events stream of inspector deltas for a published workflow run.
  */
-export const get80 = oc
+export const get81 = oc
   .route({
     description: 'Server-Sent Events stream of inspector deltas for a published workflow run.',
     inputStructure: 'detailed',
@@ -4243,13 +4280,13 @@ export const get80 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsEventsResponse)
 
 export const events2 = {
-  get: get80,
+  get: get81,
 }
 
 /**
  * Full value for one declared output of a published run.
  */
-export const get81 = oc
+export const get82 = oc
   .route({
     description: 'Full value for one declared output of a published run.',
     inputStructure: 'detailed',
@@ -4270,7 +4307,7 @@ export const get81 = oc
   )
 
 export const preview6 = {
-  get: get81,
+  get: get82,
 }
 
 export const byOutputName2 = {
@@ -4280,7 +4317,7 @@ export const byOutputName2 = {
 /**
  * One node's declared outputs for a published workflow run.
  */
-export const get82 = oc
+export const get83 = oc
   .route({
     description: "One node's declared outputs for a published workflow run.",
     inputStructure: 'detailed',
@@ -4293,14 +4330,14 @@ export const get82 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsByNodeIdResponse)
 
 export const byNodeId10 = {
-  get: get82,
+  get: get83,
   byOutputName: byOutputName2,
 }
 
 /**
  * Snapshot of every node's declared outputs for a published workflow run.
  */
-export const get83 = oc
+export const get84 = oc
   .route({
     description: "Snapshot of every node's declared outputs for a published workflow run.",
     inputStructure: 'detailed',
@@ -4313,7 +4350,7 @@ export const get83 = oc
   .output(zGetAppsByAppIdWorkflowsPublishedRunsByRunIdNodeOutputsResponse)
 
 export const nodeOutputs2 = {
-  get: get83,
+  get: get84,
   events: events2,
   byNodeId: byNodeId10,
 }
@@ -4333,7 +4370,7 @@ export const published = {
 /**
  * Get webhook trigger for a node
  */
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4351,7 +4388,7 @@ export const get84 = oc
   .output(zGetAppsByAppIdWorkflowsTriggersWebhookResponse)
 
 export const webhook = {
-  get: get84,
+  get: get85,
 }
 
 export const triggers2 = {
@@ -4427,7 +4464,7 @@ export const byWorkflowId = {
  *
  * Get all published workflows for an application
  */
-export const get85 = oc
+export const get86 = oc
   .route({
     description: 'Get all published workflows for an application',
     inputStructure: 'detailed',
@@ -4446,7 +4483,7 @@ export const get85 = oc
   .output(zGetAppsByAppIdWorkflowsResponse)
 
 export const workflows3 = {
-  get: get85,
+  get: get86,
   defaultWorkflowBlockConfigs,
   draft: draft2,
   publish,
@@ -4479,7 +4516,7 @@ export const delete15 = oc
  *
  * Get application details
  */
-export const get86 = oc
+export const get87 = oc
   .route({
     description: 'Get application details',
     inputStructure: 'detailed',
@@ -4497,7 +4534,7 @@ export const get86 = oc
  *
  * Update application details
  */
-export const put6 = oc
+export const put7 = oc
   .route({
     description: 'Update application details',
     inputStructure: 'detailed',
@@ -4512,8 +4549,8 @@ export const put6 = oc
 
 export const byAppId2 = {
   delete: delete15,
-  get: get86,
-  put: put6,
+  get: get87,
+  put: put7,
   advancedChat,
   agent,
   annotationReply,
@@ -4535,6 +4572,7 @@ export const byAppId2 = {
   messages,
   modelConfig,
   name,
+  networkAccessGroup,
   publishToCreatorsPlatform,
   server,
   site,
@@ -4581,7 +4619,7 @@ export const byApiKeyId = {
  *
  * Get all API keys for an app
  */
-export const get87 = oc
+export const get88 = oc
   .route({
     description: 'Get all API keys for an app',
     inputStructure: 'detailed',
@@ -4614,7 +4652,7 @@ export const post63 = oc
   .output(zPostAppsByResourceIdApiKeysResponse)
 
 export const apiKeys = {
-  get: get87,
+  get: get88,
   post: post63,
   byApiKeyId,
 }
@@ -4628,7 +4666,7 @@ export const byResourceId = {
  *
  * Get list of applications with pagination and filtering
  */
-export const get88 = oc
+export const get89 = oc
   .route({
     description: 'Get list of applications with pagination and filtering',
     inputStructure: 'detailed',
@@ -4661,7 +4699,7 @@ export const post64 = oc
   .output(zPostAppsResponse)
 
 export const apps = {
-  get: get88,
+  get: get89,
   post: post64,
   imports,
   recent,
diff --git a/packages/contracts/generated/api/console/apps/types.gen.ts b/packages/contracts/generated/api/console/apps/types.gen.ts
index 0edb77f8ec8c89..b94f4f764163ac 100644
--- a/packages/contracts/generated/api/console/apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/apps/types.gen.ts
@@ -572,6 +572,22 @@ export type AppNamePayload = {
   name: string
 }
 
+export type AppNetworkAccessGroupResponse = {
+  app_id: string
+  binding: AppNetworkAccessGroupBindingResponse | null
+  entitled: boolean
+  tenant_id: string
+}
+
+export type AppNetworkAccessGroupUpdatePayload = {
+  expected_version: number
+  group_id: string | null
+}
+
+export type AppNetworkAccessGroupMutationResponse = {
+  binding: AppNetworkAccessGroupBindingResponse
+}
+
 export type RedirectUrlResponse = {
   redirect_url: string
 }
@@ -1631,6 +1647,17 @@ export type MessageFile = {
   url?: string | null
 }
 
+export type AppNetworkAccessGroupBindingResponse = {
+  app_id: string
+  created_at: string
+  group_id?: string | null
+  id: string
+  tenant_id: string
+  updated_at: string
+  updated_by_account_id?: string | null
+  version: number
+}
+
 export type AppMcpServerStatus = 'active' | 'inactive' | 'normal'
 
 export type AverageResponseTimeStatisticItem = {
@@ -4591,6 +4618,38 @@ export type PostAppsByAppIdNameResponses = {
 export type PostAppsByAppIdNameResponse =
   PostAppsByAppIdNameResponses[keyof PostAppsByAppIdNameResponses]
 
+export type GetAppsByAppIdNetworkAccessGroupData = {
+  body?: never
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/apps/{app_id}/network-access-group'
+}
+
+export type GetAppsByAppIdNetworkAccessGroupResponses = {
+  200: AppNetworkAccessGroupResponse
+}
+
+export type GetAppsByAppIdNetworkAccessGroupResponse =
+  GetAppsByAppIdNetworkAccessGroupResponses[keyof GetAppsByAppIdNetworkAccessGroupResponses]
+
+export type PutAppsByAppIdNetworkAccessGroupData = {
+  body: AppNetworkAccessGroupUpdatePayload
+  path: {
+    app_id: string
+  }
+  query?: never
+  url: '/apps/{app_id}/network-access-group'
+}
+
+export type PutAppsByAppIdNetworkAccessGroupResponses = {
+  200: AppNetworkAccessGroupMutationResponse
+}
+
+export type PutAppsByAppIdNetworkAccessGroupResponse =
+  PutAppsByAppIdNetworkAccessGroupResponses[keyof PutAppsByAppIdNetworkAccessGroupResponses]
+
 export type PostAppsByAppIdPublishToCreatorsPlatformData = {
   body?: never
   path: {
diff --git a/packages/contracts/generated/api/console/apps/zod.gen.ts b/packages/contracts/generated/api/console/apps/zod.gen.ts
index 91074f82e8beb4..299259af22cf71 100644
--- a/packages/contracts/generated/api/console/apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/apps/zod.gen.ts
@@ -346,6 +346,14 @@ export const zAppNamePayload = z.object({
   name: z.string().min(1),
 })
 
+/**
+ * AppNetworkAccessGroupUpdatePayload
+ */
+export const zAppNetworkAccessGroupUpdatePayload = z.object({
+  expected_version: z.int().gte(0),
+  group_id: z.uuid().nullable(),
+})
+
 /**
  * RedirectUrlResponse
  */
@@ -1326,6 +1334,37 @@ export const zMessageFile = z.object({
   url: z.string().nullish(),
 })
 
+/**
+ * AppNetworkAccessGroupBindingResponse
+ */
+export const zAppNetworkAccessGroupBindingResponse = z.object({
+  app_id: z.string(),
+  created_at: z.iso.datetime(),
+  group_id: z.string().nullish(),
+  id: z.string(),
+  tenant_id: z.string(),
+  updated_at: z.iso.datetime(),
+  updated_by_account_id: z.string().nullish(),
+  version: z.int().gte(1),
+})
+
+/**
+ * AppNetworkAccessGroupResponse
+ */
+export const zAppNetworkAccessGroupResponse = z.object({
+  app_id: z.string(),
+  binding: zAppNetworkAccessGroupBindingResponse.nullable(),
+  entitled: z.boolean(),
+  tenant_id: z.string(),
+})
+
+/**
+ * AppNetworkAccessGroupMutationResponse
+ */
+export const zAppNetworkAccessGroupMutationResponse = z.object({
+  binding: zAppNetworkAccessGroupBindingResponse,
+})
+
 /**
  * AppMCPServerStatus
  *
@@ -5145,6 +5184,26 @@ export const zPostAppsByAppIdNamePath = z.object({
  */
 export const zPostAppsByAppIdNameResponse = zAppDetail
 
+export const zGetAppsByAppIdNetworkAccessGroupPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * App network access group binding retrieved successfully
+ */
+export const zGetAppsByAppIdNetworkAccessGroupResponse = zAppNetworkAccessGroupResponse
+
+export const zPutAppsByAppIdNetworkAccessGroupBody = zAppNetworkAccessGroupUpdatePayload
+
+export const zPutAppsByAppIdNetworkAccessGroupPath = z.object({
+  app_id: z.uuid(),
+})
+
+/**
+ * App network access group binding updated successfully
+ */
+export const zPutAppsByAppIdNetworkAccessGroupResponse = zAppNetworkAccessGroupMutationResponse
+
 export const zPostAppsByAppIdPublishToCreatorsPlatformPath = z.object({
   app_id: z.uuid(),
 })
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 499b3ef6e05ef0..adbd62faa362ed 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -18,6 +18,9 @@ import {
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsPath,
   zDeleteWorkspacesCurrentModelProvidersByProviderModelsResponse,
+  zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
+  zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdQuery,
+  zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse,
   zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
   zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
   zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsBody,
@@ -75,7 +78,9 @@ import {
   zGetWorkspacesCurrentModelProvidersSummaryResponse,
   zGetWorkspacesCurrentModelsModelTypesByModelTypePath,
   zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse,
-  zGetWorkspacesCurrentNetworkAccessPolicyResponse,
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse,
+  zGetWorkspacesCurrentNetworkAccessGroupsResponse,
   zGetWorkspacesCurrentPermissionResponse,
   zGetWorkspacesCurrentPluginAssetQuery,
   zGetWorkspacesCurrentPluginAssetResponse,
@@ -282,6 +287,8 @@ import {
   zPostWorkspacesCurrentModelProvidersByProviderPreferredProviderTypeBody,
   zPostWorkspacesCurrentModelProvidersByProviderPreferredProviderTypePath,
   zPostWorkspacesCurrentModelProvidersByProviderPreferredProviderTypeResponse,
+  zPostWorkspacesCurrentNetworkAccessGroupsBody,
+  zPostWorkspacesCurrentNetworkAccessGroupsResponse,
   zPostWorkspacesCurrentPluginAutoUpgradeChangeBody,
   zPostWorkspacesCurrentPluginAutoUpgradeChangeResponse,
   zPostWorkspacesCurrentPluginAutoUpgradeExcludeBody,
@@ -397,8 +404,9 @@ import {
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsBody,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsPath,
   zPutWorkspacesCurrentModelProvidersByProviderModelsCredentialsResponse,
-  zPutWorkspacesCurrentNetworkAccessPolicyBody,
-  zPutWorkspacesCurrentNetworkAccessPolicyResponse,
+  zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdBody,
+  zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
+  zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath,
   zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse,
   zPutWorkspacesCurrentRbacAccessPolicyBindingsByBindingIdLockPath,
@@ -1586,38 +1594,89 @@ export const models2 = {
   modelTypes,
 }
 
+export const delete8 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'DELETE',
+    operationId: 'deleteWorkspacesCurrentNetworkAccessGroupsByGroupId',
+    path: '/workspaces/current/network-access-groups/{group_id}',
+    tags: ['console'],
+  })
+  .input(
+    z.object({
+      params: zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
+      query: zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdQuery,
+    }),
+  )
+  .output(zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse)
+
 export const get21 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
-    operationId: 'getWorkspacesCurrentNetworkAccessPolicy',
-    path: '/workspaces/current/network-access-policy',
+    operationId: 'getWorkspacesCurrentNetworkAccessGroupsByGroupId',
+    path: '/workspaces/current/network-access-groups/{group_id}',
     tags: ['console'],
   })
-  .output(zGetWorkspacesCurrentNetworkAccessPolicyResponse)
+  .input(z.object({ params: zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdPath }))
+  .output(zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse)
 
 export const put4 = oc
   .route({
     inputStructure: 'detailed',
     method: 'PUT',
-    operationId: 'putWorkspacesCurrentNetworkAccessPolicy',
-    path: '/workspaces/current/network-access-policy',
+    operationId: 'putWorkspacesCurrentNetworkAccessGroupsByGroupId',
+    path: '/workspaces/current/network-access-groups/{group_id}',
     tags: ['console'],
   })
-  .input(z.object({ body: zPutWorkspacesCurrentNetworkAccessPolicyBody }))
-  .output(zPutWorkspacesCurrentNetworkAccessPolicyResponse)
+  .input(
+    z.object({
+      body: zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdBody,
+      params: zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
+    }),
+  )
+  .output(zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse)
 
-export const networkAccessPolicy = {
+export const byGroupId = {
+  delete: delete8,
   get: get21,
   put: put4,
 }
 
+export const get22 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentNetworkAccessGroups',
+    path: '/workspaces/current/network-access-groups',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentNetworkAccessGroupsResponse)
+
+export const post26 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'POST',
+    operationId: 'postWorkspacesCurrentNetworkAccessGroups',
+    path: '/workspaces/current/network-access-groups',
+    successStatus: 201,
+    tags: ['console'],
+  })
+  .input(z.object({ body: zPostWorkspacesCurrentNetworkAccessGroupsBody }))
+  .output(zPostWorkspacesCurrentNetworkAccessGroupsResponse)
+
+export const networkAccessGroups = {
+  get: get22,
+  post: post26,
+  byGroupId,
+}
+
 /**
  * Get workspace permission settings
  *
  * Returns permission flags that control workspace features like member invitations and owner transfer.
  */
-export const get22 = oc
+export const get23 = oc
   .route({
     description:
       'Returns permission flags that control workspace features like member invitations and owner transfer.',
@@ -1631,10 +1690,10 @@ export const get22 = oc
   .output(zGetWorkspacesCurrentPermissionResponse)
 
 export const permission = {
-  get: get22,
+  get: get23,
 }
 
-export const get23 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1646,10 +1705,10 @@ export const get23 = oc
   .output(zGetWorkspacesCurrentPluginAssetResponse)
 
 export const asset = {
-  get: get23,
+  get: get24,
 }
 
-export const post26 = oc
+export const post27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1661,10 +1720,10 @@ export const post26 = oc
   .output(zPostWorkspacesCurrentPluginAutoUpgradeChangeResponse)
 
 export const change = {
-  post: post26,
+  post: post27,
 }
 
-export const post27 = oc
+export const post28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1676,10 +1735,10 @@ export const post27 = oc
   .output(zPostWorkspacesCurrentPluginAutoUpgradeExcludeResponse)
 
 export const exclude = {
-  post: post27,
+  post: post28,
 }
 
-export const get24 = oc
+export const get25 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1691,7 +1750,7 @@ export const get24 = oc
   .output(zGetWorkspacesCurrentPluginAutoUpgradeFetchResponse)
 
 export const fetch_ = {
-  get: get24,
+  get: get25,
 }
 
 export const autoUpgrade = {
@@ -1700,7 +1759,7 @@ export const autoUpgrade = {
   fetch: fetch_,
 }
 
-export const get25 = oc
+export const get26 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1711,10 +1770,10 @@ export const get25 = oc
   .output(zGetWorkspacesCurrentPluginDebuggingKeyResponse)
 
 export const debuggingKey = {
-  get: get25,
+  get: get26,
 }
 
-export const get26 = oc
+export const get27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1726,10 +1785,10 @@ export const get26 = oc
   .output(zGetWorkspacesCurrentPluginFetchManifestResponse)
 
 export const fetchManifest = {
-  get: get26,
+  get: get27,
 }
 
-export const get27 = oc
+export const get28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1741,10 +1800,10 @@ export const get27 = oc
   .output(zGetWorkspacesCurrentPluginIconResponse)
 
 export const icon = {
-  get: get27,
+  get: get28,
 }
 
-export const post28 = oc
+export const post29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1756,10 +1815,10 @@ export const post28 = oc
   .output(zPostWorkspacesCurrentPluginInstallGithubResponse)
 
 export const github = {
-  post: post28,
+  post: post29,
 }
 
-export const post29 = oc
+export const post30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1771,10 +1830,10 @@ export const post29 = oc
   .output(zPostWorkspacesCurrentPluginInstallMarketplaceResponse)
 
 export const marketplace = {
-  post: post29,
+  post: post30,
 }
 
-export const post30 = oc
+export const post31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1786,7 +1845,7 @@ export const post30 = oc
   .output(zPostWorkspacesCurrentPluginInstallPkgResponse)
 
 export const pkg = {
-  post: post30,
+  post: post31,
 }
 
 export const install = {
@@ -1795,7 +1854,7 @@ export const install = {
   pkg,
 }
 
-export const get28 = oc
+export const get29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1807,10 +1866,10 @@ export const get28 = oc
   .output(zGetWorkspacesCurrentPluginInstalledIdsResponse)
 
 export const installedIds = {
-  get: get28,
+  get: get29,
 }
 
-export const post31 = oc
+export const post32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1822,14 +1881,14 @@ export const post31 = oc
   .output(zPostWorkspacesCurrentPluginListInstallationsIdsResponse)
 
 export const ids = {
-  post: post31,
+  post: post32,
 }
 
 export const installations = {
   ids,
 }
 
-export const post32 = oc
+export const post33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1841,10 +1900,10 @@ export const post32 = oc
   .output(zPostWorkspacesCurrentPluginListLatestVersionsResponse)
 
 export const latestVersions = {
-  post: post32,
+  post: post33,
 }
 
-export const get29 = oc
+export const get30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1856,12 +1915,12 @@ export const get29 = oc
   .output(zGetWorkspacesCurrentPluginListResponse)
 
 export const list2 = {
-  get: get29,
+  get: get30,
   installations,
   latestVersions,
 }
 
-export const get30 = oc
+export const get31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1873,14 +1932,14 @@ export const get30 = oc
   .output(zGetWorkspacesCurrentPluginMarketplacePkgResponse)
 
 export const pkg2 = {
-  get: get30,
+  get: get31,
 }
 
 export const marketplace2 = {
   pkg: pkg2,
 }
 
-export const get31 = oc
+export const get32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1892,13 +1951,13 @@ export const get31 = oc
   .output(zGetWorkspacesCurrentPluginParametersDynamicOptionsResponse)
 
 export const dynamicOptions = {
-  get: get31,
+  get: get32,
 }
 
 /**
  * Fetch dynamic options using credentials directly (for edit mode)
  */
-export const post33 = oc
+export const post34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1913,7 +1972,7 @@ export const post33 = oc
   .output(zPostWorkspacesCurrentPluginParametersDynamicOptionsWithCredentialsResponse)
 
 export const dynamicOptionsWithCredentials = {
-  post: post33,
+  post: post34,
 }
 
 export const parameters = {
@@ -1921,7 +1980,7 @@ export const parameters = {
   dynamicOptionsWithCredentials,
 }
 
-export const post34 = oc
+export const post35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1933,10 +1992,10 @@ export const post34 = oc
   .output(zPostWorkspacesCurrentPluginPermissionChangeResponse)
 
 export const change2 = {
-  post: post34,
+  post: post35,
 }
 
-export const get32 = oc
+export const get33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1947,7 +2006,7 @@ export const get32 = oc
   .output(zGetWorkspacesCurrentPluginPermissionFetchResponse)
 
 export const fetch2 = {
-  get: get32,
+  get: get33,
 }
 
 export const permission2 = {
@@ -1955,7 +2014,7 @@ export const permission2 = {
   fetch: fetch2,
 }
 
-export const get33 = oc
+export const get34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1967,10 +2026,10 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentPluginReadmeResponse)
 
 export const readme = {
-  get: get33,
+  get: get34,
 }
 
-export const post35 = oc
+export const post36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1981,10 +2040,10 @@ export const post35 = oc
   .output(zPostWorkspacesCurrentPluginTasksDeleteAllResponse)
 
 export const deleteAll = {
-  post: post35,
+  post: post36,
 }
 
-export const post36 = oc
+export const post37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -1996,10 +2055,10 @@ export const post36 = oc
   .output(zPostWorkspacesCurrentPluginTasksByTaskIdDeleteByIdentifierResponse)
 
 export const byIdentifier = {
-  post: post36,
+  post: post37,
 }
 
-export const post37 = oc
+export const post38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2010,12 +2069,12 @@ export const post37 = oc
   .input(z.object({ params: zPostWorkspacesCurrentPluginTasksByTaskIdDeletePath }))
   .output(zPostWorkspacesCurrentPluginTasksByTaskIdDeleteResponse)
 
-export const delete8 = {
-  post: post37,
+export const delete9 = {
+  post: post38,
   byIdentifier,
 }
 
-export const get34 = oc
+export const get35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2027,11 +2086,11 @@ export const get34 = oc
   .output(zGetWorkspacesCurrentPluginTasksByTaskIdResponse)
 
 export const byTaskId = {
-  get: get34,
-  delete: delete8,
+  get: get35,
+  delete: delete9,
 }
 
-export const get35 = oc
+export const get36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2043,12 +2102,12 @@ export const get35 = oc
   .output(zGetWorkspacesCurrentPluginTasksResponse)
 
 export const tasks = {
-  get: get35,
+  get: get36,
   deleteAll,
   byTaskId,
 }
 
-export const post38 = oc
+export const post39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2060,10 +2119,10 @@ export const post38 = oc
   .output(zPostWorkspacesCurrentPluginUninstallResponse)
 
 export const uninstall = {
-  post: post38,
+  post: post39,
 }
 
-export const post39 = oc
+export const post40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2075,10 +2134,10 @@ export const post39 = oc
   .output(zPostWorkspacesCurrentPluginUpgradeGithubResponse)
 
 export const github2 = {
-  post: post39,
+  post: post40,
 }
 
-export const post40 = oc
+export const post41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2090,7 +2149,7 @@ export const post40 = oc
   .output(zPostWorkspacesCurrentPluginUpgradeMarketplaceResponse)
 
 export const marketplace3 = {
-  post: post40,
+  post: post41,
 }
 
 export const upgrade = {
@@ -2098,7 +2157,7 @@ export const upgrade = {
   marketplace: marketplace3,
 }
 
-export const post41 = oc
+export const post42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2109,10 +2168,10 @@ export const post41 = oc
   .output(zPostWorkspacesCurrentPluginUploadBundleResponse)
 
 export const bundle = {
-  post: post41,
+  post: post42,
 }
 
-export const post42 = oc
+export const post43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2124,10 +2183,10 @@ export const post42 = oc
   .output(zPostWorkspacesCurrentPluginUploadGithubResponse)
 
 export const github3 = {
-  post: post42,
+  post: post43,
 }
 
-export const post43 = oc
+export const post44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2139,7 +2198,7 @@ export const post43 = oc
   .output(zPostWorkspacesCurrentPluginUploadPkgResponse)
 
 export const pkg3 = {
-  post: post43,
+  post: post44,
 }
 
 export const upload = {
@@ -2148,7 +2207,7 @@ export const upload = {
   pkg: pkg3,
 }
 
-export const get36 = oc
+export const get37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2165,7 +2224,7 @@ export const get36 = oc
   .output(zGetWorkspacesCurrentPluginByCategoryListResponse)
 
 export const list3 = {
-  get: get36,
+  get: get37,
 }
 
 export const byCategory = {
@@ -2192,7 +2251,7 @@ export const plugin2 = {
   byCategory,
 }
 
-export const post44 = oc
+export const post45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2205,10 +2264,10 @@ export const post44 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesByPolicyIdCopyResponse)
 
 export const copy = {
-  post: post44,
+  post: post45,
 }
 
-export const delete9 = oc
+export const delete10 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2219,7 +2278,7 @@ export const delete9 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const get37 = oc
+export const get38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2242,13 +2301,13 @@ export const put5 = oc
   .output(zPutWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
 export const byPolicyId = {
-  delete: delete9,
-  get: get37,
+  delete: delete10,
+  get: get38,
   put: put5,
   copy,
 }
 
-export const get38 = oc
+export const get39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2258,7 +2317,7 @@ export const get38 = oc
   })
   .output(zGetWorkspacesCurrentRbacAccessPoliciesResponse)
 
-export const post45 = oc
+export const post46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2270,8 +2329,8 @@ export const post45 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
 
 export const accessPolicies = {
-  get: get38,
-  post: post45,
+  get: get39,
+  post: post46,
   byPolicyId,
 }
 
@@ -2314,7 +2373,7 @@ export const accessPolicyBindings = {
   byBindingId,
 }
 
-export const delete10 = oc
+export const delete11 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2330,7 +2389,7 @@ export const delete10 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get39 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2346,11 +2405,11 @@ export const get39 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings = {
-  delete: delete10,
-  get: get39,
+  delete: delete11,
+  get: get40,
 }
 
-export const get40 = oc
+export const get41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2366,7 +2425,7 @@ export const get40 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings = {
-  get: get40,
+  get: get41,
 }
 
 export const byPolicyId2 = {
@@ -2378,7 +2437,7 @@ export const accessPolicies2 = {
   byPolicyId: byPolicyId2,
 }
 
-export const get41 = oc
+export const get42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2395,10 +2454,10 @@ export const get41 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
 
 export const accessPolicy = {
-  get: get41,
+  get: get42,
 }
 
-export const get42 = oc
+export const get43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2415,7 +2474,7 @@ export const get42 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies = {
-  get: get42,
+  get: get43,
 }
 
 export const put8 = oc
@@ -2446,7 +2505,7 @@ export const users = {
   byTargetAccountId,
 }
 
-export const get43 = oc
+export const get44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2474,7 +2533,7 @@ export const put9 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
 export const whitelist = {
-  get: get43,
+  get: get44,
   put: put9,
 }
 
@@ -2490,7 +2549,7 @@ export const apps = {
   byAppId,
 }
 
-export const delete11 = oc
+export const delete12 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2510,7 +2569,7 @@ export const delete11 = oc
     zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
   )
 
-export const get44 = oc
+export const get45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2530,11 +2589,11 @@ export const get44 = oc
   )
 
 export const memberBindings2 = {
-  delete: delete11,
-  get: get44,
+  delete: delete12,
+  get: get45,
 }
 
-export const get45 = oc
+export const get46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2550,7 +2609,7 @@ export const get45 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings2 = {
-  get: get45,
+  get: get46,
 }
 
 export const byPolicyId3 = {
@@ -2562,7 +2621,7 @@ export const accessPolicies4 = {
   byPolicyId: byPolicyId3,
 }
 
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2579,10 +2638,10 @@ export const get46 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
 
 export const accessPolicy2 = {
-  get: get46,
+  get: get47,
 }
 
-export const get47 = oc
+export const get48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2599,7 +2658,7 @@ export const get47 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies2 = {
-  get: get47,
+  get: get48,
 }
 
 export const put10 = oc
@@ -2630,7 +2689,7 @@ export const users2 = {
   byTargetAccountId: byTargetAccountId2,
 }
 
-export const get48 = oc
+export const get49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2658,7 +2717,7 @@ export const put11 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
 export const whitelist2 = {
-  get: get48,
+  get: get49,
   put: put11,
 }
 
@@ -2674,7 +2733,7 @@ export const datasets = {
   byDatasetId,
 }
 
-export const get49 = oc
+export const get50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2702,7 +2761,7 @@ export const put12 = oc
   .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
 export const rbacRoles = {
-  get: get49,
+  get: get50,
   put: put12,
 }
 
@@ -2714,7 +2773,7 @@ export const members2 = {
   byMemberId: byMemberId2,
 }
 
-export const get50 = oc
+export const get51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2725,10 +2784,10 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
 
 export const myPermissions = {
-  get: get50,
+  get: get51,
 }
 
-export const get51 = oc
+export const get52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2739,10 +2798,10 @@ export const get51 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
 
 export const app = {
-  get: get51,
+  get: get52,
 }
 
-export const get52 = oc
+export const get53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2753,10 +2812,10 @@ export const get52 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
 
 export const dataset = {
-  get: get52,
+  get: get53,
 }
 
-export const get53 = oc
+export const get54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2767,7 +2826,7 @@ export const get53 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
 
 export const catalog = {
-  get: get53,
+  get: get54,
   app,
   dataset,
 }
@@ -2776,7 +2835,7 @@ export const rolePermissions = {
   catalog,
 }
 
-export const post46 = oc
+export const post47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2789,10 +2848,10 @@ export const post46 = oc
   .output(zPostWorkspacesCurrentRbacRolesByRoleIdCopyResponse)
 
 export const copy2 = {
-  post: post46,
+  post: post47,
 }
 
-export const get54 = oc
+export const get55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2804,10 +2863,10 @@ export const get54 = oc
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
 
 export const members3 = {
-  get: get54,
+  get: get55,
 }
 
-export const delete12 = oc
+export const delete13 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -2818,7 +2877,7 @@ export const delete12 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const get55 = oc
+export const get56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2841,14 +2900,14 @@ export const put13 = oc
   .output(zPutWorkspacesCurrentRbacRolesByRoleIdResponse)
 
 export const byRoleId = {
-  delete: delete12,
-  get: get55,
+  delete: delete13,
+  get: get56,
   put: put13,
   copy: copy2,
   members: members3,
 }
 
-export const get56 = oc
+export const get57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2858,7 +2917,7 @@ export const get56 = oc
   })
   .output(zGetWorkspacesCurrentRbacRolesResponse)
 
-export const post47 = oc
+export const post48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -2870,8 +2929,8 @@ export const post47 = oc
   .output(zPostWorkspacesCurrentRbacRolesResponse)
 
 export const roles = {
-  get: get56,
-  post: post47,
+  get: get57,
+  post: post48,
   byRoleId,
 }
 
@@ -2895,7 +2954,7 @@ export const bindings = {
   put: put14,
 }
 
-export const get57 = oc
+export const get58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2911,10 +2970,10 @@ export const get57 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings3 = {
-  get: get57,
+  get: get58,
 }
 
-export const get58 = oc
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2930,7 +2989,7 @@ export const get58 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings3 = {
-  get: get58,
+  get: get59,
 }
 
 export const byPolicyId4 = {
@@ -2943,7 +3002,7 @@ export const accessPolicies6 = {
   byPolicyId: byPolicyId4,
 }
 
-export const get59 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2954,7 +3013,7 @@ export const get59 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
 
 export const accessPolicy3 = {
-  get: get59,
+  get: get60,
 }
 
 export const apps2 = {
@@ -2982,7 +3041,7 @@ export const bindings2 = {
   put: put15,
 }
 
-export const get60 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2998,10 +3057,10 @@ export const get60 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings4 = {
-  get: get60,
+  get: get61,
 }
 
-export const get61 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3017,7 +3076,7 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings4 = {
-  get: get61,
+  get: get62,
 }
 
 export const byPolicyId5 = {
@@ -3030,7 +3089,7 @@ export const accessPolicies7 = {
   byPolicyId: byPolicyId5,
 }
 
-export const get62 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3041,7 +3100,7 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
 
 export const accessPolicy4 = {
-  get: get62,
+  get: get63,
 }
 
 export const datasets2 = {
@@ -3066,7 +3125,7 @@ export const rbac = {
   workspace,
 }
 
-export const get63 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3077,10 +3136,10 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentSummaryResponse)
 
 export const summary2 = {
-  get: get63,
+  get: get64,
 }
 
-export const get64 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3091,10 +3150,10 @@ export const get64 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get64,
+  get: get65,
 }
 
-export const post48 = oc
+export const post49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3106,10 +3165,10 @@ export const post48 = oc
   .output(zPostWorkspacesCurrentToolProviderApiAddResponse)
 
 export const add = {
-  post: post48,
+  post: post49,
 }
 
-export const post49 = oc
+export const post50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3120,11 +3179,11 @@ export const post49 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderApiDeleteBody }))
   .output(zPostWorkspacesCurrentToolProviderApiDeleteResponse)
 
-export const delete13 = {
-  post: post49,
+export const delete14 = {
+  post: post50,
 }
 
-export const get65 = oc
+export const get66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3135,11 +3194,11 @@ export const get65 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get66 = {
-  get: get65,
+export const get67 = {
+  get: get66,
 }
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3151,10 +3210,10 @@ export const get67 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get67,
+  get: get68,
 }
 
-export const post50 = oc
+export const post51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3166,10 +3225,10 @@ export const post50 = oc
   .output(zPostWorkspacesCurrentToolProviderApiSchemaResponse)
 
 export const schema = {
-  post: post50,
+  post: post51,
 }
 
-export const post51 = oc
+export const post52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3181,14 +3240,14 @@ export const post51 = oc
   .output(zPostWorkspacesCurrentToolProviderApiTestPreResponse)
 
 export const pre = {
-  post: post51,
+  post: post52,
 }
 
 export const test = {
   pre,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3200,10 +3259,10 @@ export const get68 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get68,
+  get: get69,
 }
 
-export const post52 = oc
+export const post53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3215,13 +3274,13 @@ export const post52 = oc
   .output(zPostWorkspacesCurrentToolProviderApiUpdateResponse)
 
 export const update2 = {
-  post: post52,
+  post: post53,
 }
 
 export const api = {
   add,
-  delete: delete13,
-  get: get66,
+  delete: delete14,
+  get: get67,
   remote,
   schema,
   test,
@@ -3229,7 +3288,7 @@ export const api = {
   update: update2,
 }
 
-export const post53 = oc
+export const post54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3246,10 +3305,10 @@ export const post53 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderAddResponse)
 
 export const add2 = {
-  post: post53,
+  post: post54,
 }
 
-export const get69 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3266,10 +3325,10 @@ export const get69 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get69,
+  get: get70,
 }
 
-export const get70 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3289,7 +3348,7 @@ export const get70 = oc
   )
 
 export const byCredentialType = {
-  get: get70,
+  get: get71,
 }
 
 export const schema2 = {
@@ -3301,7 +3360,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get71 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3318,10 +3377,10 @@ export const get71 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get71,
+  get: get72,
 }
 
-export const post54 = oc
+export const post55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3338,10 +3397,10 @@ export const post54 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderDefaultCredentialResponse)
 
 export const defaultCredential = {
-  post: post54,
+  post: post55,
 }
 
-export const post55 = oc
+export const post56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3357,11 +3416,11 @@ export const post55 = oc
   )
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderDeleteResponse)
 
-export const delete14 = {
-  post: post55,
+export const delete15 = {
+  post: post56,
 }
 
-export const get72 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3373,10 +3432,10 @@ export const get72 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get72,
+  get: get73,
 }
 
-export const get73 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3388,10 +3447,10 @@ export const get73 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get73,
+  get: get74,
 }
 
-export const get74 = oc
+export const get75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3405,10 +3464,10 @@ export const get74 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get74,
+  get: get75,
 }
 
-export const delete15 = oc
+export const delete16 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -3423,7 +3482,7 @@ export const delete15 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get75 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3436,7 +3495,7 @@ export const get75 = oc
   )
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const post56 = oc
+export const post57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3453,9 +3512,9 @@ export const post56 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
 export const customClient = {
-  delete: delete15,
-  get: get75,
-  post: post56,
+  delete: delete16,
+  get: get76,
+  post: post57,
 }
 
 export const oauth = {
@@ -3463,7 +3522,7 @@ export const oauth = {
   customClient,
 }
 
-export const get76 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3475,10 +3534,10 @@ export const get76 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get76,
+  get: get77,
 }
 
-export const post57 = oc
+export const post58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3495,7 +3554,7 @@ export const post57 = oc
   .output(zPostWorkspacesCurrentToolProviderBuiltinByProviderUpdateResponse)
 
 export const update3 = {
-  post: post57,
+  post: post58,
 }
 
 export const byProvider2 = {
@@ -3503,7 +3562,7 @@ export const byProvider2 = {
   credential,
   credentials: credentials3,
   defaultCredential,
-  delete: delete14,
+  delete: delete15,
   icon: icon2,
   info: info2,
   oauth,
@@ -3515,7 +3574,7 @@ export const builtin = {
   byProvider: byProvider2,
 }
 
-export const post58 = oc
+export const post59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3527,10 +3586,10 @@ export const post58 = oc
   .output(zPostWorkspacesCurrentToolProviderMcpAuthResponse)
 
 export const auth = {
-  post: post58,
+  post: post59,
 }
 
-export const get77 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3542,14 +3601,14 @@ export const get77 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get77,
+  get: get78,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get78 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3561,14 +3620,14 @@ export const get78 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get78,
+  get: get79,
 }
 
 export const update4 = {
   byProviderId: byProviderId2,
 }
 
-export const delete16 = oc
+export const delete17 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -3579,7 +3638,7 @@ export const delete16 = oc
   .input(z.object({ body: zDeleteWorkspacesCurrentToolProviderMcpBody }))
   .output(zDeleteWorkspacesCurrentToolProviderMcpResponse)
 
-export const post59 = oc
+export const post60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3602,15 +3661,15 @@ export const put16 = oc
   .output(zPutWorkspacesCurrentToolProviderMcpResponse)
 
 export const mcp = {
-  delete: delete16,
-  post: post59,
+  delete: delete17,
+  post: post60,
   put: put16,
   auth,
   tools: tools3,
   update: update4,
 }
 
-export const post60 = oc
+export const post61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3622,10 +3681,10 @@ export const post60 = oc
   .output(zPostWorkspacesCurrentToolProviderWorkflowCreateResponse)
 
 export const create2 = {
-  post: post60,
+  post: post61,
 }
 
-export const post61 = oc
+export const post62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3636,11 +3695,11 @@ export const post61 = oc
   .input(z.object({ body: zPostWorkspacesCurrentToolProviderWorkflowDeleteBody }))
   .output(zPostWorkspacesCurrentToolProviderWorkflowDeleteResponse)
 
-export const delete17 = {
-  post: post61,
+export const delete18 = {
+  post: post62,
 }
 
-export const get79 = oc
+export const get80 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3651,11 +3710,11 @@ export const get79 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get80 = {
-  get: get79,
+export const get81 = {
+  get: get80,
 }
 
-export const get81 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3667,10 +3726,10 @@ export const get81 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get81,
+  get: get82,
 }
 
-export const post62 = oc
+export const post63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3682,13 +3741,13 @@ export const post62 = oc
   .output(zPostWorkspacesCurrentToolProviderWorkflowUpdateResponse)
 
 export const update5 = {
-  post: post62,
+  post: post63,
 }
 
 export const workflow = {
   create: create2,
-  delete: delete17,
-  get: get80,
+  delete: delete18,
+  get: get81,
   tools: tools4,
   update: update5,
 }
@@ -3700,7 +3759,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get82 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3712,10 +3771,10 @@ export const get82 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get82,
+  get: get83,
 }
 
-export const get83 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3726,10 +3785,10 @@ export const get83 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get83,
+  get: get84,
 }
 
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3740,10 +3799,10 @@ export const get84 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get84,
+  get: get85,
 }
 
-export const get85 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3754,10 +3813,10 @@ export const get85 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get85,
+  get: get86,
 }
 
-export const get86 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3768,7 +3827,7 @@ export const get86 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get86,
+  get: get87,
 }
 
 export const tools5 = {
@@ -3778,7 +3837,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get87 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3790,13 +3849,13 @@ export const get87 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get87,
+  get: get88,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get88 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3809,13 +3868,13 @@ export const get88 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get88,
+  get: get89,
 }
 
 /**
  * Remove custom OAuth client configuration
  */
-export const delete18 = oc
+export const delete19 = oc
   .route({
     inputStructure: 'detailed',
     method: 'DELETE',
@@ -3830,7 +3889,7 @@ export const delete18 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get89 = oc
+export const get90 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3845,7 +3904,7 @@ export const get89 = oc
 /**
  * Configure custom OAuth client for a provider
  */
-export const post63 = oc
+export const post64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3863,9 +3922,9 @@ export const post63 = oc
   .output(zPostWorkspacesCurrentTriggerProviderByProviderOauthClientResponse)
 
 export const client = {
-  delete: delete18,
-  get: get89,
-  post: post63,
+  delete: delete19,
+  get: get90,
+  post: post64,
 }
 
 export const oauth2 = {
@@ -3875,7 +3934,7 @@ export const oauth2 = {
 /**
  * Build a subscription instance for a trigger provider
  */
-export const post64 = oc
+export const post65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3897,7 +3956,7 @@ export const post64 = oc
   )
 
 export const bySubscriptionBuilderId = {
-  post: post64,
+  post: post65,
 }
 
 export const build = {
@@ -3907,7 +3966,7 @@ export const build = {
 /**
  * Add a new subscription instance for a trigger provider
  */
-export const post65 = oc
+export const post66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3925,13 +3984,13 @@ export const post65 = oc
   .output(zPostWorkspacesCurrentTriggerProviderByProviderSubscriptionsBuilderCreateResponse)
 
 export const create3 = {
-  post: post65,
+  post: post66,
 }
 
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get90 = oc
+export const get91 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3952,7 +4011,7 @@ export const get90 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get90,
+  get: get91,
 }
 
 export const logs = {
@@ -3962,7 +4021,7 @@ export const logs = {
 /**
  * Update a subscription instance for a trigger provider
  */
-export const post66 = oc
+export const post67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -3984,7 +4043,7 @@ export const post66 = oc
   )
 
 export const bySubscriptionBuilderId3 = {
-  post: post66,
+  post: post67,
 }
 
 export const update6 = {
@@ -3994,7 +4053,7 @@ export const update6 = {
 /**
  * Verify and update a subscription instance for a trigger provider
  */
-export const post67 = oc
+export const post68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4016,7 +4075,7 @@ export const post67 = oc
   )
 
 export const bySubscriptionBuilderId4 = {
-  post: post67,
+  post: post68,
 }
 
 export const verifyAndUpdate = {
@@ -4026,7 +4085,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get91 = oc
+export const get92 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4047,7 +4106,7 @@ export const get91 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get91,
+  get: get92,
 }
 
 export const builder = {
@@ -4062,7 +4121,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get92 = oc
+export const get93 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4075,13 +4134,13 @@ export const get92 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get92,
+  get: get93,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get93 = oc
+export const get94 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4098,7 +4157,7 @@ export const get93 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get93,
+  get: get94,
 }
 
 export const oauth3 = {
@@ -4108,7 +4167,7 @@ export const oauth3 = {
 /**
  * Verify credentials for an existing subscription (edit mode only)
  */
-export const post68 = oc
+export const post69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4130,7 +4189,7 @@ export const post68 = oc
   )
 
 export const bySubscriptionId = {
-  post: post68,
+  post: post69,
 }
 
 export const verify = {
@@ -4154,7 +4213,7 @@ export const byProvider3 = {
 /**
  * Delete a subscription instance
  */
-export const post69 = oc
+export const post70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4170,14 +4229,14 @@ export const post69 = oc
   )
   .output(zPostWorkspacesCurrentTriggerProviderBySubscriptionIdSubscriptionsDeleteResponse)
 
-export const delete19 = {
-  post: post69,
+export const delete20 = {
+  post: post70,
 }
 
 /**
  * Update a subscription instance
  */
-export const post70 = oc
+export const post71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4195,11 +4254,11 @@ export const post70 = oc
   .output(zPostWorkspacesCurrentTriggerProviderBySubscriptionIdSubscriptionsUpdateResponse)
 
 export const update7 = {
-  post: post70,
+  post: post71,
 }
 
 export const subscriptions2 = {
-  delete: delete19,
+  delete: delete20,
   update: update7,
 }
 
@@ -4215,7 +4274,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get94 = oc
+export const get95 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4227,7 +4286,7 @@ export const get94 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get94,
+  get: get95,
 }
 
 export const current = {
@@ -4240,7 +4299,7 @@ export const current = {
   members,
   modelProviders,
   models: models2,
-  networkAccessPolicy,
+  networkAccessGroups,
   permission,
   plugin: plugin2,
   rbac,
@@ -4253,7 +4312,7 @@ export const current = {
   triggers,
 }
 
-export const post71 = oc
+export const post72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4266,14 +4325,14 @@ export const post71 = oc
   .output(zPostWorkspacesCustomConfigWebappLogoUploadResponse)
 
 export const upload2 = {
-  post: post71,
+  post: post72,
 }
 
 export const webappLogo = {
   upload: upload2,
 }
 
-export const get95 = oc
+export const get96 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4283,7 +4342,7 @@ export const get95 = oc
   })
   .output(zGetWorkspacesCustomConfigResponse)
 
-export const post72 = oc
+export const post73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4295,12 +4354,12 @@ export const post72 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  get: get95,
-  post: post72,
+  get: get96,
+  post: post73,
   webappLogo,
 }
 
-export const post73 = oc
+export const post74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4312,10 +4371,10 @@ export const post73 = oc
   .output(zPostWorkspacesInfoResponse)
 
 export const info4 = {
-  post: post73,
+  post: post74,
 }
 
-export const post74 = oc
+export const post75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'POST',
@@ -4327,10 +4386,10 @@ export const post74 = oc
   .output(zPostWorkspacesSwitchResponse)
 
 export const switch3 = {
-  post: post74,
+  post: post75,
 }
 
-export const get96 = oc
+export const get97 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4342,7 +4401,7 @@ export const get96 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get96,
+  get: get97,
 }
 
 export const byIconType = {
@@ -4361,7 +4420,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get97 = oc
+export const get98 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4372,7 +4431,7 @@ export const get97 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get97,
+  get: get98,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 417061a7caffb8..0922d0abc2d764 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -364,21 +364,33 @@ export type AvailableModelListResponse = {
   data: Array<ProviderWithModelsResponse>
 }
 
-export type NetworkAccessPolicyListResponse = {
+export type NetworkAccessGroupListResponse = {
   entitled: boolean
-  policies: Array<NetworkAccessPolicyResponse>
+  groups: Array<NetworkAccessGroupResponse>
   tenant_id: string
 }
 
-export type NetworkAccessPolicyPayload = {
+export type NetworkAccessGroupCreatePayload = {
   allowed_cidrs: Array<string>
-  expected_version: number
+  description?: string
   mode: 'disabled' | 'enforce' | 'shadow'
-  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
+  name: string
+}
+
+export type NetworkAccessGroupMutationResponse = {
+  group: NetworkAccessGroupResponse
+}
+
+export type NetworkAccessGroupDeleteResponse = {
+  deleted: boolean
 }
 
-export type NetworkAccessPolicyUpdateResponse = {
-  policy: NetworkAccessPolicyResponse
+export type NetworkAccessGroupUpdatePayload = {
+  allowed_cidrs: Array<string>
+  description?: string
+  expected_version: number
+  mode: 'disabled' | 'enforce' | 'shadow'
+  name: string
 }
 
 export type WorkspacePermissionResponse = {
@@ -1306,12 +1318,15 @@ export type ProviderWithModelsResponse = {
   tenant_id: string
 }
 
-export type NetworkAccessPolicyResponse = {
-  allowed_cidrs: Array<string>
-  created_at?: string | null
+export type NetworkAccessGroupResponse = {
+  allowed_cidrs?: Array<string>
+  created_at: string
+  description?: string
+  id: string
   mode: 'disabled' | 'enforce' | 'shadow'
-  scope: 'mcp' | 'plugin_trigger' | 'service_api' | 'workflow_webhook'
-  updated_at?: string | null
+  name: string
+  tenant_id: string
+  updated_at: string
   updated_by_account_id?: string | null
   version: number
 }
@@ -3526,33 +3541,83 @@ export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponses = {
 export type GetWorkspacesCurrentModelsModelTypesByModelTypeResponse =
   GetWorkspacesCurrentModelsModelTypesByModelTypeResponses[keyof GetWorkspacesCurrentModelsModelTypesByModelTypeResponses]
 
-export type GetWorkspacesCurrentNetworkAccessPolicyData = {
+export type GetWorkspacesCurrentNetworkAccessGroupsData = {
   body?: never
   path?: never
   query?: never
-  url: '/workspaces/current/network-access-policy'
+  url: '/workspaces/current/network-access-groups'
 }
 
-export type GetWorkspacesCurrentNetworkAccessPolicyResponses = {
-  200: NetworkAccessPolicyListResponse
+export type GetWorkspacesCurrentNetworkAccessGroupsResponses = {
+  200: NetworkAccessGroupListResponse
 }
 
-export type GetWorkspacesCurrentNetworkAccessPolicyResponse =
-  GetWorkspacesCurrentNetworkAccessPolicyResponses[keyof GetWorkspacesCurrentNetworkAccessPolicyResponses]
+export type GetWorkspacesCurrentNetworkAccessGroupsResponse =
+  GetWorkspacesCurrentNetworkAccessGroupsResponses[keyof GetWorkspacesCurrentNetworkAccessGroupsResponses]
 
-export type PutWorkspacesCurrentNetworkAccessPolicyData = {
-  body: NetworkAccessPolicyPayload
+export type PostWorkspacesCurrentNetworkAccessGroupsData = {
+  body: NetworkAccessGroupCreatePayload
   path?: never
   query?: never
-  url: '/workspaces/current/network-access-policy'
+  url: '/workspaces/current/network-access-groups'
+}
+
+export type PostWorkspacesCurrentNetworkAccessGroupsResponses = {
+  201: NetworkAccessGroupMutationResponse
+}
+
+export type PostWorkspacesCurrentNetworkAccessGroupsResponse =
+  PostWorkspacesCurrentNetworkAccessGroupsResponses[keyof PostWorkspacesCurrentNetworkAccessGroupsResponses]
+
+export type DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdData = {
+  body?: never
+  path: {
+    group_id: string
+  }
+  query: {
+    expected_version: number
+  }
+  url: '/workspaces/current/network-access-groups/{group_id}'
+}
+
+export type DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses = {
+  200: NetworkAccessGroupDeleteResponse
+}
+
+export type DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses[keyof DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses]
+
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdData = {
+  body?: never
+  path: {
+    group_id: string
+  }
+  query?: never
+  url: '/workspaces/current/network-access-groups/{group_id}'
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses = {
+  200: NetworkAccessGroupMutationResponse
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  GetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses[keyof GetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses]
+
+export type PutWorkspacesCurrentNetworkAccessGroupsByGroupIdData = {
+  body: NetworkAccessGroupUpdatePayload
+  path: {
+    group_id: string
+  }
+  query?: never
+  url: '/workspaces/current/network-access-groups/{group_id}'
 }
 
-export type PutWorkspacesCurrentNetworkAccessPolicyResponses = {
-  200: NetworkAccessPolicyUpdateResponse
+export type PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses = {
+  200: NetworkAccessGroupMutationResponse
 }
 
-export type PutWorkspacesCurrentNetworkAccessPolicyResponse =
-  PutWorkspacesCurrentNetworkAccessPolicyResponses[keyof PutWorkspacesCurrentNetworkAccessPolicyResponses]
+export type PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses[keyof PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses]
 
 export type GetWorkspacesCurrentPermissionData = {
   body?: never
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index 7f4c1e7f230364..0b2a2411b17988 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -248,13 +248,31 @@ export const zParserPreferredProviderType = z.object({
 })
 
 /**
- * NetworkAccessPolicyPayload
+ * NetworkAccessGroupCreatePayload
  */
-export const zNetworkAccessPolicyPayload = z.object({
+export const zNetworkAccessGroupCreatePayload = z.object({
   allowed_cidrs: z.array(z.string()).max(100),
-  expected_version: z.int().gte(0),
+  description: z.string().max(500).optional().default(''),
   mode: z.enum(['disabled', 'enforce', 'shadow']),
-  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
+  name: z.string().min(1).max(100),
+})
+
+/**
+ * NetworkAccessGroupDeleteResponse
+ */
+export const zNetworkAccessGroupDeleteResponse = z.object({
+  deleted: z.boolean(),
+})
+
+/**
+ * NetworkAccessGroupUpdatePayload
+ */
+export const zNetworkAccessGroupUpdatePayload = z.object({
+  allowed_cidrs: z.array(z.string()).max(100),
+  description: z.string().max(500).optional().default(''),
+  expected_version: z.int().gte(1),
+  mode: z.enum(['disabled', 'enforce', 'shadow']),
+  name: z.string().min(1).max(100),
 })
 
 /**
@@ -996,32 +1014,35 @@ export const zCredentialConfiguration = z.object({
 })
 
 /**
- * NetworkAccessPolicyResponse
+ * NetworkAccessGroupResponse
  */
-export const zNetworkAccessPolicyResponse = z.object({
-  allowed_cidrs: z.array(z.string()),
-  created_at: z.iso.datetime().nullish(),
+export const zNetworkAccessGroupResponse = z.object({
+  allowed_cidrs: z.array(z.string()).optional(),
+  created_at: z.iso.datetime(),
+  description: z.string().optional().default(''),
+  id: z.string(),
   mode: z.enum(['disabled', 'enforce', 'shadow']),
-  scope: z.enum(['mcp', 'plugin_trigger', 'service_api', 'workflow_webhook']),
-  updated_at: z.iso.datetime().nullish(),
+  name: z.string(),
+  tenant_id: z.string(),
+  updated_at: z.iso.datetime(),
   updated_by_account_id: z.string().nullish(),
-  version: z.int().gte(0),
+  version: z.int().gte(1),
 })
 
 /**
- * NetworkAccessPolicyListResponse
+ * NetworkAccessGroupListResponse
  */
-export const zNetworkAccessPolicyListResponse = z.object({
+export const zNetworkAccessGroupListResponse = z.object({
   entitled: z.boolean(),
-  policies: z.array(zNetworkAccessPolicyResponse),
+  groups: z.array(zNetworkAccessGroupResponse),
   tenant_id: z.string(),
 })
 
 /**
- * NetworkAccessPolicyUpdateResponse
+ * NetworkAccessGroupMutationResponse
  */
-export const zNetworkAccessPolicyUpdateResponse = z.object({
-  policy: zNetworkAccessPolicyResponse,
+export const zNetworkAccessGroupMutationResponse = z.object({
+  group: zNetworkAccessGroupResponse,
 })
 
 /**
@@ -4141,16 +4162,53 @@ export const zGetWorkspacesCurrentModelsModelTypesByModelTypePath = z.object({
 export const zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse = zAvailableModelListResponse
 
 /**
- * Workspace network access policies retrieved successfully
+ * Workspace network access groups retrieved successfully
+ */
+export const zGetWorkspacesCurrentNetworkAccessGroupsResponse = zNetworkAccessGroupListResponse
+
+export const zPostWorkspacesCurrentNetworkAccessGroupsBody = zNetworkAccessGroupCreatePayload
+
+/**
+ * Workspace network access group created successfully
  */
-export const zGetWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyListResponse
+export const zPostWorkspacesCurrentNetworkAccessGroupsResponse = zNetworkAccessGroupMutationResponse
+
+export const zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdPath = z.object({
+  group_id: z.uuid(),
+})
 
-export const zPutWorkspacesCurrentNetworkAccessPolicyBody = zNetworkAccessPolicyPayload
+export const zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdQuery = z.object({
+  expected_version: z.int().gte(1),
+})
+
+/**
+ * Workspace network access group deleted successfully
+ */
+export const zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  zNetworkAccessGroupDeleteResponse
+
+export const zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdPath = z.object({
+  group_id: z.uuid(),
+})
+
+/**
+ * Workspace network access group retrieved successfully
+ */
+export const zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  zNetworkAccessGroupMutationResponse
+
+export const zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdBody =
+  zNetworkAccessGroupUpdatePayload
+
+export const zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdPath = z.object({
+  group_id: z.uuid(),
+})
 
 /**
- * Workspace network access policy updated successfully
+ * Workspace network access group updated successfully
  */
-export const zPutWorkspacesCurrentNetworkAccessPolicyResponse = zNetworkAccessPolicyUpdateResponse
+export const zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
+  zNetworkAccessGroupMutationResponse
 
 /**
  * Success

From 5fad259ed1421815bbd836cccffeee40ddec18a4 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Fri, 21 Aug 2026 11:47:08 +0800
Subject: [PATCH 005/108] test: satisfy strict network access checks

---
 .../controllers/console/workspace/test_network_access_group.py  | 1 +
 .../services/test_network_access_group_billing_service.py       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 03842355b360ee..bf54a5dc978d6a 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -296,6 +296,7 @@ def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPE
 def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, expected_message: str) -> None:
     error = _translate_upstream_error(NetworkAccessGroupUpstreamError(409, reason))
     assert isinstance(error, Conflict)
+    assert error.description is not None
     assert expected_message in error.description
 
 
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
index e71e8e98916453..39d9c3ba0bf53b 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -26,7 +26,7 @@ def billing_config() -> Iterator[None]:
 def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
-        {"tenant_id": TENANT_ID, "entitled": True, "groups": []},
+        {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()},
         {"group": {"id": GROUP_ID}},
     ]
 

From 9347c0750ddc111cf5a85043db7ff84b90f74e35 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Mon, 24 Aug 2026 13:07:51 +0800
Subject: [PATCH 006/108] fix: clean app network binding after deletion

---
 api/services/billing_service.py               |  14 +++
 api/tasks/remove_app_and_related_data_task.py |  45 +++++++
 ...st_network_access_group_billing_service.py |  21 +++-
 .../test_remove_app_and_related_data_task.py  | 117 ++++++++++++++++++
 4 files changed, 196 insertions(+), 1 deletion(-)

diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index 0b0359a53d3582..ffc9103487741b 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -562,6 +562,20 @@ def update_app_network_access_group(
             },
         )
 
+    @classmethod
+    def cleanup_app_network_access_group_binding(cls, tenant_id: str, app_id: str) -> dict[str, Any]:
+        """Remove an App binding through the internal App lifecycle endpoint.
+
+        This must only be called by the post-commit App deletion task. Account
+        or workspace-member deletion does not own App bindings and must not use
+        this operation.
+        """
+
+        return cls._send_network_access_group_request(
+            "DELETE",
+            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group-binding",
+        )
+
     @classmethod
     def _send_network_access_group_request(
         cls,
diff --git a/api/tasks/remove_app_and_related_data_task.py b/api/tasks/remove_app_and_related_data_task.py
index f8af48e09908e3..52212131124fda 100644
--- a/api/tasks/remove_app_and_related_data_task.py
+++ b/api/tasks/remove_app_and_related_data_task.py
@@ -52,15 +52,60 @@
 )
 from repositories.factory import DifyAPIRepositoryFactory
 from services.api_token_service import ApiTokenCache
+from services.billing_service import BillingService
 
 logger = logging.getLogger(__name__)
 
+NETWORK_ACCESS_BINDING_CLEANUP_DELAY_SECONDS = 10
+NETWORK_ACCESS_BINDING_CLEANUP_RETRY_BASE_SECONDS = 15
+NETWORK_ACCESS_BINDING_CLEANUP_RETRY_MAX_SECONDS = 10 * 60
+
+
+def _network_access_binding_cleanup_retry_delay(retries: int) -> int:
+    exponent = min(max(retries, 0), 6)
+    return min(
+        NETWORK_ACCESS_BINDING_CLEANUP_RETRY_BASE_SECONDS * (2**exponent),
+        NETWORK_ACCESS_BINDING_CLEANUP_RETRY_MAX_SECONDS,
+    )
+
+
+@shared_task(queue="app_deletion", bind=True, max_retries=24)
+def cleanup_app_network_access_group_binding_task(self, tenant_id: str, app_id: str) -> None:
+    """Reliably remove a SaaS binding after its owning App was committed deleted."""
+
+    if dify_config.DEPLOYMENT_EDITION != DeploymentEdition.CLOUD:
+        return
+    try:
+        BillingService.cleanup_app_network_access_group_binding(tenant_id, app_id)
+    except Exception as e:
+        countdown = _network_access_binding_cleanup_retry_delay(self.request.retries)
+        logger.exception(
+            "Failed to clean up App network access group binding",
+            extra={"tenant_id": tenant_id, "app_id": app_id, "retry_countdown": countdown},
+        )
+        raise self.retry(exc=e, countdown=countdown)
+
+
+def _schedule_app_network_access_group_binding_cleanup(tenant_id: str, app_id: str) -> None:
+    """Schedule only from App lifecycle cleanup, never account/member deletion."""
+
+    if dify_config.DEPLOYMENT_EDITION != DeploymentEdition.CLOUD:
+        return
+    cleanup_app_network_access_group_binding_task.apply_async(
+        kwargs={"tenant_id": tenant_id, "app_id": app_id},
+        countdown=NETWORK_ACCESS_BINDING_CLEANUP_DELAY_SECONDS,
+    )
+
 
 @shared_task(queue="app_deletion", bind=True, max_retries=3)
 def remove_app_and_related_data_task(self, tenant_id: str, app_id: str):
     logger.info(click.style(f"Start deleting app and related data: {tenant_id}:{app_id}", fg="green"))
     start_at = time.perf_counter()
     try:
+        # AppService publishes this task after the App transaction commits.
+        # Schedule the independent high-retry SaaS cleanup before legacy local
+        # cleanup so a later local failure cannot strand the binding.
+        _schedule_app_network_access_group_binding_cleanup(tenant_id, app_id)
         # Delete related data
         _delete_app_model_configs(tenant_id, app_id)
         _delete_app_site(tenant_id, app_id)
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
index 39d9c3ba0bf53b..71c429ec2ed8ab 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -187,7 +187,26 @@ def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
     ]
 
 
-@pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500])
+@pytest.mark.usefixtures("billing_config")
+def test_app_lifecycle_cleanup_uses_internal_secret_endpoint() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {"deleted": True}
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        result = BillingService.cleanup_app_network_access_group_binding(TENANT_ID, APP_ID)
+
+    assert result == {"deleted": True}
+    request.assert_called_once_with(
+        "DELETE",
+        f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group-binding",
+        json=None,
+        params=None,
+        headers=HEADERS,
+        follow_redirects=True,
+    )
+
+
+@pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500, 503])
 def test_network_access_group_request_preserves_upstream_status(status_code: int) -> None:
     response = MagicMock(status_code=status_code)
     with (
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index 125e447a10e685..5f891b891e3c7c 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -14,6 +14,7 @@
 from models.agent import WorkflowAgentBindingType, WorkflowAgentNodeBinding
 from models.enums import CreatorUserRole, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowArchiveLog
+from services.billing_service import NetworkAccessGroupUpstreamError
 from tasks.remove_app_and_related_data_task import (
     _delete_app_stars,
     _delete_app_workflow_archive_logs,
@@ -118,6 +119,122 @@ def test_app_cleanup_removes_agent_bindings_before_workflows(monkeypatch: pytest
     delete_workflows.assert_called_once_with("tenant-1", "app-1")
 
 
+def test_cloud_app_cleanup_schedules_independent_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
+    apply_async = MagicMock()
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(
+        remove_app_task_module.cleanup_app_network_access_group_binding_task,
+        "apply_async",
+        apply_async,
+    )
+
+    remove_app_task_module._schedule_app_network_access_group_binding_cleanup("tenant-1", "app-1")
+
+    apply_async.assert_called_once_with(
+        kwargs={"tenant_id": "tenant-1", "app_id": "app-1"},
+        countdown=10,
+    )
+
+
+def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
+    apply_async = MagicMock()
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.COMMUNITY)
+    monkeypatch.setattr(
+        remove_app_task_module.cleanup_app_network_access_group_binding_task,
+        "apply_async",
+        apply_async,
+    )
+
+    remove_app_task_module._schedule_app_network_access_group_binding_cleanup("tenant-1", "app-1")
+
+    apply_async.assert_not_called()
+
+
+def test_independent_binding_cleanup_task_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
+    cleanup = MagicMock(return_value={"deleted": True})
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(
+        remove_app_task_module.BillingService,
+        "cleanup_app_network_access_group_binding",
+        cleanup,
+    )
+
+    remove_app_task_module.cleanup_app_network_access_group_binding_task.run(tenant_id="tenant-1", app_id="app-1")
+
+    cleanup.assert_called_once_with("tenant-1", "app-1")
+    assert remove_app_task_module.cleanup_app_network_access_group_binding_task.max_retries == 24
+
+
+def test_independent_binding_cleanup_task_retries_with_exponential_backoff(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_APP_STILL_EXISTS")
+    retry_error = RuntimeError("retry scheduled")
+    retry = MagicMock(side_effect=retry_error)
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(
+        remove_app_task_module.BillingService,
+        "cleanup_app_network_access_group_binding",
+        MagicMock(side_effect=upstream_error),
+    )
+    monkeypatch.setattr(remove_app_task_module.cleanup_app_network_access_group_binding_task, "retry", retry)
+
+    with pytest.raises(RuntimeError, match="retry scheduled"):
+        remove_app_task_module.cleanup_app_network_access_group_binding_task.run(tenant_id="tenant-1", app_id="app-1")
+
+    retry.assert_called_once_with(exc=upstream_error, countdown=15)
+    assert remove_app_task_module._network_access_binding_cleanup_retry_delay(5) == 480
+    assert remove_app_task_module._network_access_binding_cleanup_retry_delay(6) == 600
+    assert remove_app_task_module._network_access_binding_cleanup_retry_delay(24) == 600
+
+
+def test_parent_local_cleanup_failure_happens_after_binding_cleanup_is_scheduled(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    local_error = RuntimeError("local cleanup failed")
+    retry_error = RuntimeError("parent retry scheduled")
+    apply_async = MagicMock()
+    retry = MagicMock(side_effect=retry_error)
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(
+        remove_app_task_module.cleanup_app_network_access_group_binding_task,
+        "apply_async",
+        apply_async,
+    )
+    monkeypatch.setattr(remove_app_task_module, "_delete_app_model_configs", MagicMock(side_effect=local_error))
+    monkeypatch.setattr(remove_app_task_module.remove_app_and_related_data_task, "retry", retry)
+
+    with pytest.raises(RuntimeError, match="parent retry scheduled"):
+        remove_app_task_module.remove_app_and_related_data_task.run(tenant_id="tenant-1", app_id="app-1")
+
+    apply_async.assert_called_once_with(
+        kwargs={"tenant_id": "tenant-1", "app_id": "app-1"},
+        countdown=10,
+    )
+    retry.assert_called_once_with(exc=local_error, countdown=60)
+
+
+def test_parent_retries_before_local_cleanup_when_binding_schedule_fails(monkeypatch: pytest.MonkeyPatch) -> None:
+    broker_error = RuntimeError("broker unavailable")
+    retry_error = RuntimeError("parent retry scheduled")
+    retry = MagicMock(side_effect=retry_error)
+    first_local_cleanup = MagicMock()
+    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(
+        remove_app_task_module.cleanup_app_network_access_group_binding_task,
+        "apply_async",
+        MagicMock(side_effect=broker_error),
+    )
+    monkeypatch.setattr(remove_app_task_module, "_delete_app_model_configs", first_local_cleanup)
+    monkeypatch.setattr(remove_app_task_module.remove_app_and_related_data_task, "retry", retry)
+
+    with pytest.raises(RuntimeError, match="parent retry scheduled"):
+        remove_app_task_module.remove_app_and_related_data_task.run(tenant_id="tenant-1", app_id="app-1")
+
+    retry.assert_called_once_with(exc=broker_error, countdown=60)
+    first_local_cleanup.assert_not_called()
+
+
 class TestDeleteDraftVariablesBatch:
     def test_delete_draft_variables_batch_invalid_batch_size(self):
         """Test that invalid batch size raises ValueError."""

From e35de2d3aaa06f23faf9f2f8493555229222154b Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Mon, 24 Aug 2026 13:18:36 +0800
Subject: [PATCH 007/108] fix: align network access authorization with main

---
 .../console/workspace/network_access_group.py |  9 ++--
 api/services/billing_service.py               |  2 +-
 .../workspace/test_network_access_group.py    | 46 ++++++-------------
 3 files changed, 19 insertions(+), 38 deletions(-)

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index f22f6399f98292..39860e8cfa7524 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -17,11 +17,10 @@
     with_current_tenant_id,
     with_current_user,
 )
-from extensions.ext_database import db
 from fields.base import ResponseModel
 from libs.helper import dump_response
 from libs.login import login_required
-from models import Account, App
+from models import Account, App, TenantAccountRole
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
 
 NetworkAccessGroupMode = Literal["disabled", "shadow", "enforce"]
@@ -126,10 +125,8 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
 def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
     """Authorize management against the persisted current-workspace membership."""
 
-    try:
-        BillingService.is_tenant_owner_or_admin(current_user, session=db.session())
-    except ValueError as exc:
-        raise Forbidden("Only workspace owners and administrators can manage network access groups.") from exc
+    if not TenantAccountRole.is_privileged_role(current_user.current_role):
+        raise Forbidden("Only workspace owners and administrators can manage network access groups.")
 
 
 def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception:
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index 83e3d4226697fe..c5b7314f4f2b16 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -2,7 +2,7 @@
 import logging
 import os
 from collections.abc import Sequence
-from typing import Literal, NotRequired, TypedDict
+from typing import Any, Literal, NotRequired, TypedDict
 
 import httpx
 from pydantic import TypeAdapter, ValidationError
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index bf54a5dc978d6a..586a9e0f73671b 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -18,6 +18,7 @@
     NetworkAccessGroupUpdatePayload,
     _translate_upstream_error,
 )
+from models import TenantAccountRole
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
@@ -27,6 +28,10 @@
 BINDING_ID = "55555555-5555-4555-8555-555555555555"
 
 
+def _current_user(role: TenantAccountRole = TenantAccountRole.OWNER) -> SimpleNamespace:
+    return SimpleNamespace(id=ACCOUNT_ID, current_role=role)
+
+
 def _group_payload() -> dict[str, object]:
     return {
         "id": GROUP_ID,
@@ -59,17 +64,14 @@ def _binding_payload(*, group_id: str | None = GROUP_ID) -> dict[str, object]:
 def test_list_authorizes_and_forwards_tenant_and_actor() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     upstream_payload = {"tenantId": TENANT_ID, "entitled": True, "groups": [_group_payload()]}
 
     with (
-        patch("controllers.console.workspace.network_access_group.db") as db,
-        patch.object(BillingService, "is_tenant_owner_or_admin") as authorize,
         patch.object(BillingService, "list_network_access_groups", return_value=upstream_payload) as list_groups,
     ):
         result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
 
-    authorize.assert_called_once_with(current_user, session=db.session())
     list_groups.assert_called_once_with(TENANT_ID, ACCOUNT_ID)
     assert result["tenant_id"] == TENANT_ID
     assert result["groups"][0]["name"] == "Office network"
@@ -80,7 +82,7 @@ def test_list_authorizes_and_forwards_tenant_and_actor() -> None:
 def test_create_injects_actor_and_returns_created_contract() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.post)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     request_payload = NetworkAccessGroupCreatePayload(
         name="Office network",
         description="Reusable office egress addresses",
@@ -89,8 +91,6 @@ def test_create_injects_actor_and_returns_created_contract() -> None:
     )
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "create_network_access_group",
@@ -119,7 +119,7 @@ def test_create_injects_actor_and_returns_created_contract() -> None:
 def test_update_group_forwards_path_id_and_expected_version() -> None:
     api = CurrentWorkspaceNetworkAccessGroupApi()
     method = unwrap(api.put)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     request_payload = NetworkAccessGroupUpdatePayload(
         name="Office network",
         description="Updated",
@@ -129,8 +129,6 @@ def test_update_group_forwards_path_id_and_expected_version() -> None:
     )
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "update_network_access_group",
@@ -161,11 +159,9 @@ def test_update_group_forwards_path_id_and_expected_version() -> None:
 def test_delete_group_reads_expected_version_from_query_and_injects_actor() -> None:
     api = CurrentWorkspaceNetworkAccessGroupApi()
     method = unwrap(api.delete)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "delete_network_access_group",
@@ -192,13 +188,11 @@ def test_delete_group_reads_expected_version_from_query_and_injects_actor() -> N
 def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.get)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
     upstream_payload = {"tenantId": TENANT_ID, "appId": APP_ID, "entitled": True, "binding": None}
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "get_app_network_access_group",
@@ -220,13 +214,11 @@ def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> N
 def test_app_put_assigns_or_unassigns_group(group_id: str | None) -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.put)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
     request_payload = AppNetworkAccessGroupUpdatePayload(group_id=group_id, expected_version=2)
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "update_app_network_access_group",
@@ -255,11 +247,9 @@ def test_app_put_assigns_or_unassigns_group(group_id: str | None) -> None:
 def test_list_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user(TenantAccountRole.NORMAL)
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin", side_effect=ValueError("not privileged")),
         patch.object(BillingService, "list_network_access_groups") as list_groups,
         pytest.raises(Forbidden),
     ):
@@ -308,11 +298,9 @@ def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None
 def test_list_maps_invalid_upstream_contract_to_bad_gateway() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "list_network_access_groups",
@@ -326,14 +314,12 @@ def test_list_maps_invalid_upstream_contract_to_bad_gateway() -> None:
 def test_response_contract_accepts_protojson_omitted_empty_group_fields() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     group = _group_payload()
     group.pop("description")
     group.pop("allowedCidrs")
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "list_network_access_groups",
@@ -349,15 +335,13 @@ def test_response_contract_accepts_protojson_omitted_empty_group_fields() -> Non
 def test_binding_response_accepts_protojson_omitted_null_group_id() -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.put)
-    current_user = SimpleNamespace(id=ACCOUNT_ID)
+    current_user = _current_user()
     app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
     request_payload = AppNetworkAccessGroupUpdatePayload(group_id=None, expected_version=2)
     binding = _binding_payload(group_id=None)
     binding.pop("groupId")
 
     with (
-        patch("controllers.console.workspace.network_access_group.db"),
-        patch.object(BillingService, "is_tenant_owner_or_admin"),
         patch.object(
             BillingService,
             "update_app_network_access_group",

From c015442548943386f0e32065d6807bf8f3fdeabc Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 8 Sep 2026 13:31:04 +0800
Subject: [PATCH 008/108] feat(web): add Access Control paywall entry on Access
 Point

Show a PRO chip and upgrade popover for Cloud sandbox workspaces
on the Access Point page.
---
 .../app/access-point/__tests__/index.spec.tsx |  10 ++
 .../access-control/__tests__/index.spec.tsx   | 129 ++++++++++++++++++
 .../access-control/free-paywall.tsx           |  52 +++++++
 .../app/access-point/access-control/index.tsx |  58 ++++++++
 .../access-control/restricted-preview.tsx     |  43 ++++++
 web/app/components/app/access-point/index.tsx |   4 +-
 web/i18n/ar-TN/deployments.json               |   7 +
 web/i18n/de-DE/deployments.json               |   7 +
 web/i18n/en-US/deployments.json               |   7 +
 web/i18n/es-ES/deployments.json               |   7 +
 web/i18n/fa-IR/deployments.json               |   7 +
 web/i18n/fr-FR/deployments.json               |   7 +
 web/i18n/hi-IN/deployments.json               |   7 +
 web/i18n/id-ID/deployments.json               |   7 +
 web/i18n/it-IT/deployments.json               |   7 +
 web/i18n/ja-JP/deployments.json               |   7 +
 web/i18n/ko-KR/deployments.json               |   7 +
 web/i18n/lo-LA/deployments.json               |   7 +
 web/i18n/nl-NL/deployments.json               |   7 +
 web/i18n/pl-PL/deployments.json               |   7 +
 web/i18n/pt-BR/deployments.json               |   7 +
 web/i18n/ro-RO/deployments.json               |   7 +
 web/i18n/ru-RU/deployments.json               |   7 +
 web/i18n/sl-SI/deployments.json               |   7 +
 web/i18n/th-TH/deployments.json               |   7 +
 web/i18n/tr-TR/deployments.json               |   7 +
 web/i18n/uk-UA/deployments.json               |   7 +
 web/i18n/vi-VN/deployments.json               |   7 +
 web/i18n/zh-Hans/deployments.json             |   7 +
 web/i18n/zh-Hant/deployments.json             |   7 +
 30 files changed, 463 insertions(+), 1 deletion(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
 create mode 100644 web/app/components/app/access-point/access-control/free-paywall.tsx
 create mode 100644 web/app/components/app/access-point/access-control/index.tsx
 create mode 100644 web/app/components/app/access-point/access-control/restricted-preview.tsx

diff --git a/web/app/components/app/access-point/__tests__/index.spec.tsx b/web/app/components/app/access-point/__tests__/index.spec.tsx
index ee234efb99f4ce..e4abe18a30a5da 100644
--- a/web/app/components/app/access-point/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/index.spec.tsx
@@ -7,6 +7,7 @@ import userEvent from '@testing-library/user-event'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { consoleQuery } from '@/service/console'
 import { seedAccountProfileQuery } from '@/test/console/account-profile'
+import { seedSystemFeatures } from '@/test/console/query-data'
 import { QueryClientTestProvider } from '@/test/console/query-provider'
 import { render } from '@/test/console/render'
 import { createTestQueryClient } from '@/test/query-client'
@@ -107,6 +108,7 @@ const renderAccessPoint = ({
 } = {}) => {
   const queryClient = createTestQueryClient()
   seedAccountProfileQuery(queryClient, mockConsoleState.userProfile)
+  seedSystemFeatures(queryClient)
   const queryOptions =
     consoleQuery.enterprise.appDeploy.deploymentService.listAppEnvironments.queryOptions({
       input: {
@@ -139,6 +141,14 @@ describe('AccessPoint', () => {
     appPermissionKeys = [AppACLPermission.AccessPointView]
   })
 
+  it('does not show Access Control on community edition', () => {
+    renderAccessPoint()
+
+    expect(
+      screen.queryByRole('button', { name: /Access Control|studio\.accessControl\.entryLabel/ }),
+    ).not.toBeInTheDocument()
+  })
+
   it('renders Built-in and only in-use environments from the API', () => {
     renderAccessPoint()
 
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
new file mode 100644
index 00000000000000..197c6ebf07bc42
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -0,0 +1,129 @@
+import type { CloudPlan } from '@dify/contracts/api/console/features/types.gen'
+import { screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useModalContext } from '@/context/modal-context'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
+import { AccessControlEntry } from '..'
+
+const mockSetShowPricingModal = vi.fn()
+const accessControlTranslations = vi.hoisted(() => ({
+  'studio.accessControl.entryLabel': 'Access Control',
+  'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.',
+  'studio.accessControl.paywallTitle': 'Access Control',
+  'studio.accessControl.previewAppName': 'Code Companion',
+  'studio.accessControl.previewCaption':
+    "This app is only available on your organization's network.",
+  'studio.accessControl.proBadge': 'PRO',
+  'studio.accessControl.turnOn': 'Turn on Access Control',
+}))
+
+vi.mock('@/context/modal-context', () => ({
+  useModalContext: vi.fn(),
+  useModalContextSelector: vi.fn(),
+}))
+
+vi.mock('react-i18next', async () => {
+  const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  return createReactI18nextMock(accessControlTranslations)
+})
+
+const renderEntry = ({
+  plan,
+  deploymentEdition = 'CLOUD',
+}: {
+  plan?: CloudPlan
+  deploymentEdition?: 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
+} = {}) => {
+  return renderWithConsoleQuery(<AccessControlEntry />, {
+    systemFeatures: { deployment_edition: deploymentEdition },
+    features: plan
+      ? {
+          billing: {
+            subscription: { interval: 'month', plan },
+          },
+        }
+      : undefined,
+  })
+}
+
+const getChip = () => screen.getByRole('button', { name: /Access Control/ })
+
+describe('AccessControlEntry', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.mocked(useModalContext).mockReturnValue({
+      hasBlockingModalOpen: false,
+      setShowModerationSettingModal: vi.fn(),
+      setShowExternalDataToolModal: vi.fn(),
+      setShowPricingModal: mockSetShowPricingModal,
+      setShowAnnotationFullModal: vi.fn(),
+      setShowModelModal: vi.fn(),
+      setShowExternalKnowledgeAPIModal: vi.fn(),
+      setShowOpeningModal: vi.fn(),
+      setShowUpdatePluginModal: vi.fn(),
+    })
+  })
+
+  it('does not render on community edition', () => {
+    renderEntry({ deploymentEdition: 'COMMUNITY', plan: 'sandbox' })
+
+    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+  })
+
+  it('does not render on enterprise edition', () => {
+    renderEntry({ deploymentEdition: 'ENTERPRISE', plan: 'sandbox' })
+
+    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+  })
+
+  it.each(['professional', 'team'] as const)('does not render on Cloud %s', (plan) => {
+    renderEntry({ plan })
+
+    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+  })
+
+  it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
+    renderEntry({ plan: 'sandbox' })
+
+    const chip = getChip()
+    expect(chip).toBeInTheDocument()
+    expect(within(chip).getByText('PRO')).toBeInTheDocument()
+    expect(within(chip).queryByRole('button')).not.toBeInTheDocument()
+  })
+
+  it('opens the paywall popover from the chip and sends the user to pricing', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'sandbox' })
+
+    await user.click(getChip())
+
+    expect(screen.getByText('Restrict this app to IP addresses you trust.')).toBeInTheDocument()
+    expect(
+      screen.getByText("This app is only available on your organization's network."),
+    ).toBeInTheDocument()
+    expect(screen.getAllByText('PRO')).toHaveLength(2)
+
+    const turnOn = screen.getByRole('button', { name: 'Turn on Access Control' })
+    expect(turnOn).not.toHaveTextContent('PRO')
+    await user.click(turnOn)
+
+    expect(mockSetShowPricingModal).toHaveBeenCalledTimes(1)
+  })
+
+  it('closes the paywall on Escape without side effects', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'sandbox' })
+
+    await user.click(getChip())
+    expect(screen.getByText('Restrict this app to IP addresses you trust.')).toBeInTheDocument()
+
+    await user.keyboard('{Escape}')
+
+    await waitFor(() => {
+      expect(
+        screen.queryByText('Restrict this app to IP addresses you trust.'),
+      ).not.toBeInTheDocument()
+    })
+    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/free-paywall.tsx b/web/app/components/app/access-point/access-control/free-paywall.tsx
new file mode 100644
index 00000000000000..e60de9d6a6891f
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/free-paywall.tsx
@@ -0,0 +1,52 @@
+'use client'
+
+import { Button } from '@langgenius/dify-ui/button'
+import { PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
+import { useTranslation } from 'react-i18next'
+import { AccessControlRestrictedPreview } from './restricted-preview'
+
+type AccessControlFreePaywallProps = {
+  onTurnOn: () => void
+}
+
+export function AccessControlFreePaywall({ onTurnOn }: AccessControlFreePaywallProps) {
+  const { t } = useTranslation()
+  const title = t(($) => $['studio.accessControl.paywallTitle'], { ns: 'deployments' })
+  const turnOn = t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })
+  const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
+
+  return (
+    <div className="flex w-100 flex-col">
+      <div className="flex flex-col items-center gap-3 px-8 pt-4 pb-2">
+        <div className="flex flex-col items-center gap-1">
+          <PopoverTitle className="text-center system-xl-medium text-text-primary">
+            {title}
+          </PopoverTitle>
+          <PopoverDescription className="text-center system-xs-regular text-text-secondary">
+            {t(($) => $['studio.accessControl.paywallDescription'], { ns: 'deployments' })}
+          </PopoverDescription>
+        </div>
+        <AccessControlRestrictedPreview />
+      </div>
+      <div className="px-4 pt-2.5 pb-4">
+        <div className="relative">
+          <Button variant="primary" className="w-full" onClick={onTurnOn}>
+            {turnOn}
+          </Button>
+          <span
+            aria-hidden
+            className="pointer-events-none absolute top-1.75 right-1.75 inline-flex h-[18px] items-center overflow-hidden rounded-[5px] border-[0.5px] border-components-premium-badge-blue-stroke-stop-0 px-1 py-[3px] shadow-xs"
+            style={{
+              backgroundImage:
+                'linear-gradient(101.6deg, var(--color-components-premium-badge-blue-stroke-stop-0) 0%, var(--color-components-premium-badge-blue-text-stop-0) 105.58%), linear-gradient(90deg, #a0bdff, #a0bdff)',
+            }}
+          >
+            <span className="i-custom-public-common-sparkles-soft-accent flex h-3.5 w-3.5 items-center py-px pl-0.75" />
+            <span className="system-2xs-medium text-text-accent-light-mode-only">{pro}</span>
+            <span className="absolute top-0 right-1/2 i-custom-public-common-highlight h-4.5 w-12 translate-x-[20%] opacity-50" />
+          </span>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
new file mode 100644
index 00000000000000..e7904bb096214b
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -0,0 +1,58 @@
+'use client'
+
+import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { useQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
+import { useTranslation } from 'react-i18next'
+import PremiumBadge from '@/app/components/base/premium-badge'
+import { useModalContext } from '@/context/modal-context'
+import { deploymentEditionAtom } from '@/features/system-features/state'
+import { consoleQuery } from '@/service/console'
+import { AccessControlFreePaywall } from './free-paywall'
+
+type GtagHandler = (command: 'event', action: 'click_upgrade_btn', payload: { loc: string }) => void
+
+export function AccessControlEntry() {
+  const { t } = useTranslation()
+  const deploymentEdition = useAtomValue(deploymentEditionAtom)
+  const { data: plan } = useQuery(
+    consoleQuery.features.get.queryOptions({
+      enabled: deploymentEdition === 'CLOUD',
+      select: (data) => data.billing.subscription.plan,
+    }),
+  )
+  const { setShowPricingModal } = useModalContext()
+
+  if (deploymentEdition !== 'CLOUD' || plan !== 'sandbox') return null
+
+  const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
+  const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
+
+  const handleTurnOn = () => {
+    setShowPricingModal()
+    const gtag = (window as Window & { gtag?: GtagHandler }).gtag
+    if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
+  }
+
+  return (
+    <Popover>
+      <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid">
+        <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
+        <span className="system-sm-medium text-text-secondary">{label}</span>
+        <PremiumBadge size="s" color="blue">
+          <span
+            aria-hidden
+            className="i-custom-public-common-sparkles-soft flex h-3.5 w-3.5 items-center py-px pl-0.75 text-components-premium-badge-indigo-text-stop-0"
+          />
+          <span className="system-xs-medium">{pro}</span>
+        </PremiumBadge>
+      </PopoverTrigger>
+      <PopoverContent
+        placement="bottom-end"
+        className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px]"
+      >
+        <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+      </PopoverContent>
+    </Popover>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/restricted-preview.tsx b/web/app/components/app/access-point/access-control/restricted-preview.tsx
new file mode 100644
index 00000000000000..c830c1802ce008
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/restricted-preview.tsx
@@ -0,0 +1,43 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+
+export function AccessControlRestrictedPreview() {
+  const { t } = useTranslation()
+
+  return (
+    <div
+      aria-hidden="true"
+      className="flex h-50 w-full flex-col overflow-hidden rounded-lg border border-components-panel-border bg-background-default shadow-md"
+    >
+      <div className="flex h-6 items-center gap-1.75 border-b border-divider-subtle bg-background-body px-1">
+        <div className="flex items-center gap-1">
+          <span className="size-1.5 rounded-full bg-[#ff5f57]" />
+          <span className="size-1.5 rounded-full bg-[#febc2e]" />
+          <span className="size-1.5 rounded-full bg-[#28c840]" />
+        </div>
+        <div className="flex items-center gap-0.75">
+          <span className="flex size-3 items-center justify-center overflow-hidden rounded-sm border-[0.5px] border-divider-regular bg-components-icon-bg-teal-soft text-[7px] leading-none">
+            🤖
+          </span>
+          <span className="text-[6px] leading-2 text-text-secondary">
+            {t(($) => $['studio.accessControl.previewAppName'], { ns: 'deployments' })}
+          </span>
+        </div>
+      </div>
+      <div className="flex flex-1 flex-col bg-background-default-hover p-1">
+        <div className="flex flex-1 flex-col items-center justify-center gap-3 rounded bg-linear-to-t from-background-default/16 to-background-default">
+          <div className="relative size-9">
+            <span className="i-ri-global-line size-9 text-text-accent" />
+            <span className="absolute top-5 left-5.75 flex size-4 items-center justify-center rounded-full bg-background-default">
+              <span className="i-ri-information-2-fill size-4 text-text-accent" />
+            </span>
+          </div>
+          <p className="w-44 text-center system-2xs-regular text-text-primary">
+            {t(($) => $['studio.accessControl.previewCaption'], { ns: 'deployments' })}
+          </p>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index cda649d7c584e8..7a693f094db03a 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -18,6 +18,7 @@ import { workspacePermissionKeysAtom } from '@/context/permission-state'
 import { userProfileQueryOptions } from '@/features/account-profile/client'
 import { AppModeEnum } from '@/types/app'
 import { getAppACLCapabilities } from '@/utils/permission'
+import { AccessControlEntry } from './access-control'
 import { BuiltInAccessPoints } from './built-in-access-points'
 import { DeployedEnvironmentAccessPoints } from './deployed-environment-access-points'
 import {
@@ -70,10 +71,11 @@ function AccessPointContent({
     <main className="flex h-full min-h-0 flex-col bg-components-panel-bg">
       <header className="flex shrink-0 flex-col gap-3 px-6 pt-3 pb-2">
         <div className="flex flex-col gap-0.5">
-          <div className="flex h-6 items-center">
+          <div className="flex min-h-8 items-center justify-between gap-3">
             <h1 id="access-point-title" className="title-xl-semi-bold text-text-primary">
               {t(($) => $['appMenus.accessPoint'], { ns: 'common' })}
             </h1>
+            <AccessControlEntry />
           </div>
           <p className="system-xs-regular text-text-tertiary">
             {t(($) => $['studio.accessPoint.description'], { ns: 'deployments' })}
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 6951e5402b5a83..36f7828971125c 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
   "studio.accessPoint.embedIntoSite": "تضمين في الموقع",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index 5e8e411e2abc33..36cd854da8ca56 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
   "studio.accessPoint.embedIntoSite": "In Website einbetten",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index dbc046fb923a9f..add54fec723c72 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Not deployed",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Undeploying",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Integrate the app into your services over HTTP",
   "studio.accessPoint.description": "All the ways this app can be reached. Access points match the running version only.",
   "studio.accessPoint.embedIntoSite": "Embed Into Site",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index c106c952abd0e8..af4ee71d553435 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
   "studio.accessPoint.embedIntoSite": "Insertar en el sitio",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index a92a966c5ca2a6..f48f640dad2f98 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
   "studio.accessPoint.embedIntoSite": "جاسازی در سایت",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index f8944a8329f9fe..13518732df2b36 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
   "studio.accessPoint.embedIntoSite": "Intégrer au site",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 2ee9198915fca9..38834822638125 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
   "studio.accessPoint.embedIntoSite": "साइट में एम्बेड करें",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 7b1acc4817c688..d08ac1a0cad109 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
   "studio.accessPoint.embedIntoSite": "Sematkan ke situs",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index ce823dc8737d72..5c014d678adccf 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
   "studio.accessPoint.embedIntoSite": "Incorpora nel sito",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 8d2c18aca2181b..58cb3dc645b2e2 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未デプロイ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "アンデプロイ中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
+  "studio.accessControl.entryLabel": "アクセス制御",
+  "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
+  "studio.accessControl.paywallTitle": "アクセス制御",
+  "studio.accessControl.previewAppName": "コードコンパニオン",
+  "studio.accessControl.previewCaption": "このアプリは、組織のネットワーク上でのみ利用できます。",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "アクセス制御をオンにする",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
   "studio.accessPoint.embedIntoSite": "サイトに埋め込む",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index e7235629114d8e..8ed58ff22204e5 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
   "studio.accessPoint.embedIntoSite": "사이트에 임베드",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index e6fca869da320d..64f89ac803bf92 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ຍັງບໍ່ໄດ້ຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "ກຳລັງຖອນການຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ບໍ່ຮູ້ຈັກ",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
   "studio.accessPoint.embedIntoSite": "ຝັງໄວ້ໃນເວັບໄຊ",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index f41bf709f365ae..a7a6ebb1376b91 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
   "studio.accessPoint.embedIntoSite": "In site insluiten",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 0ba09b657c3448..058c2e3f2a6a26 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
   "studio.accessPoint.embedIntoSite": "Osadź w witrynie",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 8818f88bb72ed7..6c5c72f6cc908b 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
   "studio.accessPoint.embedIntoSite": "Incorporar ao site",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 22efe318f8fbe8..882dd859431ec2 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
   "studio.accessPoint.embedIntoSite": "Încorporează în site",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index a15eff066d2f02..f27ef5a7ab1ddb 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
   "studio.accessPoint.embedIntoSite": "Встроить на сайт",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 1a53ea271d3e59..7fc0994303dcce 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
   "studio.accessPoint.embedIntoSite": "Vdelaj v spletno mesto",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index d323d910baecad..859fd6dcffbbca 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
   "studio.accessPoint.embedIntoSite": "ฝังในเว็บไซต์",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 091192ed63a816..3ae695d3abb284 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
   "studio.accessPoint.embedIntoSite": "Siteye göm",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index e26ac378db5fb1..0c7fd802f464e1 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
   "studio.accessPoint.embedIntoSite": "Вбудувати на сайт",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index d870942fdef540..ff8218441333f5 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "Code Companion",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
   "studio.accessPoint.embedIntoSite": "Nhúng vào trang web",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index fe2ef3ad1ff0e9..d9f9d4bb0572dd 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下线中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "studio.accessControl.entryLabel": "访问控制",
+  "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
+  "studio.accessControl.paywallTitle": "访问控制",
+  "studio.accessControl.previewAppName": "代码助手",
+  "studio.accessControl.previewCaption": "此应用仅允许在组织网络中访问。",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
   "studio.accessPoint.description": "此应用的所有访问方式。访问点仅对应当前运行版本。",
   "studio.accessPoint.embedIntoSite": "嵌入网站",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 32d9da399bec16..97bd64423154ea 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -33,6 +33,13 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下線中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
+  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.previewAppName": "程式助手",
+  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",
   "studio.accessPoint.embedIntoSite": "嵌入網站",

From 3b9b9d4d4f3b4bffd5cd1d741a6dc18a006206a9 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 8 Sep 2026 15:44:56 +0800
Subject: [PATCH 009/108] feat(web): add Access Control L2 config panel on
 Access Point

Paid Cloud workspaces open a config popover to pick an IP policy and apply it to access points. Sandbox still uses the paywall. Settings gains an IP Policies destination for the empty-state exit.
---
 .../__tests__/config-panel.spec.tsx           | 195 ++++++++++++++++
 .../access-control/__tests__/draft.spec.ts    | 185 +++++++++++++++
 .../access-control/__tests__/index.spec.tsx   |  91 +++++++-
 .../access-control/config-panel.tsx           | 131 +++++++++++
 .../app/access-point/access-control/draft.ts  | 123 ++++++++++
 .../app/access-point/access-control/index.tsx | 109 ++++++++-
 .../access-control/policy-field.tsx           | 217 ++++++++++++++++++
 .../access-control/scope-list.tsx             | 104 +++++++++
 .../access-control/status-panel.tsx           | 164 +++++++++++++
 .../__tests__/constants.spec.ts               |   1 +
 .../account-setting/__tests__/index.spec.tsx  |   9 +
 .../header/account-setting/constants.ts       |   2 +
 .../header/account-setting/index.tsx          |  15 ++
 .../ip-policies-page/index.tsx                |  18 ++
 web/i18n/ar-TN/common.json                    |   1 +
 web/i18n/ar-TN/deployments.json               |  21 ++
 web/i18n/de-DE/common.json                    |   1 +
 web/i18n/de-DE/deployments.json               |  21 ++
 web/i18n/en-US/common.json                    |   1 +
 web/i18n/en-US/deployments.json               |  21 ++
 web/i18n/es-ES/common.json                    |   1 +
 web/i18n/es-ES/deployments.json               |  21 ++
 web/i18n/fa-IR/common.json                    |   1 +
 web/i18n/fa-IR/deployments.json               |  21 ++
 web/i18n/fr-FR/common.json                    |   1 +
 web/i18n/fr-FR/deployments.json               |  21 ++
 web/i18n/hi-IN/common.json                    |   1 +
 web/i18n/hi-IN/deployments.json               |  21 ++
 web/i18n/id-ID/common.json                    |   1 +
 web/i18n/id-ID/deployments.json               |  21 ++
 web/i18n/it-IT/common.json                    |   1 +
 web/i18n/it-IT/deployments.json               |  21 ++
 web/i18n/ja-JP/common.json                    |   1 +
 web/i18n/ja-JP/deployments.json               |  21 ++
 web/i18n/ko-KR/common.json                    |   1 +
 web/i18n/ko-KR/deployments.json               |  21 ++
 web/i18n/lo-LA/common.json                    |   1 +
 web/i18n/lo-LA/deployments.json               |  21 ++
 web/i18n/nl-NL/common.json                    |   1 +
 web/i18n/nl-NL/deployments.json               |  21 ++
 web/i18n/pl-PL/common.json                    |   1 +
 web/i18n/pl-PL/deployments.json               |  21 ++
 web/i18n/pt-BR/common.json                    |   1 +
 web/i18n/pt-BR/deployments.json               |  21 ++
 web/i18n/ro-RO/common.json                    |   1 +
 web/i18n/ro-RO/deployments.json               |  21 ++
 web/i18n/ru-RU/common.json                    |   1 +
 web/i18n/ru-RU/deployments.json               |  21 ++
 web/i18n/sl-SI/common.json                    |   1 +
 web/i18n/sl-SI/deployments.json               |  21 ++
 web/i18n/th-TH/common.json                    |   1 +
 web/i18n/th-TH/deployments.json               |  21 ++
 web/i18n/tr-TR/common.json                    |   1 +
 web/i18n/tr-TR/deployments.json               |  21 ++
 web/i18n/uk-UA/common.json                    |   1 +
 web/i18n/uk-UA/deployments.json               |  21 ++
 web/i18n/vi-VN/common.json                    |   1 +
 web/i18n/vi-VN/deployments.json               |  21 ++
 web/i18n/zh-Hans/common.json                  |   1 +
 web/i18n/zh-Hans/deployments.json             |  21 ++
 web/i18n/zh-Hant/common.json                  |   1 +
 web/i18n/zh-Hant/deployments.json             |  21 ++
 62 files changed, 1875 insertions(+), 17 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
 create mode 100644 web/app/components/app/access-point/access-control/config-panel.tsx
 create mode 100644 web/app/components/app/access-point/access-control/draft.ts
 create mode 100644 web/app/components/app/access-point/access-control/policy-field.tsx
 create mode 100644 web/app/components/app/access-point/access-control/scope-list.tsx
 create mode 100644 web/app/components/app/access-point/access-control/status-panel.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/index.tsx

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
new file mode 100644
index 00000000000000..80807b3982645b
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -0,0 +1,195 @@
+import type {
+  AccessControlDraft,
+  AccessControlPolicy,
+  AccessControlScopeAvailability,
+} from '../draft'
+import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useState } from 'react'
+import { render } from '@/test/console/render'
+import { AccessControlConfigPanel } from '../config-panel'
+import { createDefaultAccessControlDraft } from '../draft'
+
+const allScopesAvailable: AccessControlScopeAvailability = {
+  webApp: true,
+  serviceApi: true,
+  mcp: true,
+  trigger: true,
+}
+
+const policies: AccessControlPolicy[] = [
+  {
+    id: 'internal-network',
+    name: 'Internal Network',
+    addresses: ['203.0.113.42', '198.51.100.0/24', '192.0.2.1', '192.0.2.2'],
+  },
+  {
+    id: 'office-vpn',
+    name: 'Office VPN',
+    addresses: ['198.51.100.0/24'],
+  },
+]
+
+const translations = vi.hoisted(() => ({
+  'operation.cancel': 'Cancel',
+  'operation.save': 'Save',
+  'overview.apiInfo.title': 'Backend Service API',
+  'overview.appInfo.title': 'Web App',
+  'mcp.server.title': 'MCP Server',
+  'settings.ipPolicies': 'IP Policies',
+  'settings.trigger': 'Trigger',
+  'studio.accessControl.addressCount': '{{count}} addresses',
+  'studio.accessControl.applyTo': 'Apply to',
+  'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
+  'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
+  'studio.accessControl.entryLabel': 'Access Control',
+  'studio.accessControl.ipPolicy': 'IP Policy',
+  'studio.accessControl.lockoutWarning':
+    "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  'studio.accessControl.manageIpPolicies': 'Manage IP policies',
+  'studio.accessControl.notEnabled': 'Not enabled',
+  'studio.accessControl.policySummaryMany': 'Allows {{listed}} and {{count}} more addresses',
+  'studio.accessControl.policySummaryOne': 'Allows {{address}}',
+  'studio.accessControl.selectAccessPoint': 'Select at least one access point to protect.',
+  'studio.accessControl.selectPolicy': 'Select a policy',
+}))
+
+vi.mock('react-i18next', async () => {
+  const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  return createReactI18nextMock(translations)
+})
+
+function PanelHarness({
+  availability = allScopesAvailable,
+  currentIp,
+  initialDraft = createDefaultAccessControlDraft(),
+  onSave = vi.fn(),
+}: {
+  availability?: AccessControlScopeAvailability
+  currentIp?: string
+  initialDraft?: AccessControlDraft
+  onSave?: () => void
+}) {
+  const [draft, setDraft] = useState(initialDraft)
+  const onCancel = vi.fn()
+  const onCreatePolicy = vi.fn()
+  const onManagePolicies = vi.fn()
+
+  return (
+    <Popover open>
+      <PopoverTrigger>Access Control</PopoverTrigger>
+      <PopoverContent>
+        <AccessControlConfigPanel
+          draft={draft}
+          policies={policies}
+          currentIp={currentIp}
+          availability={availability}
+          onCancel={onCancel}
+          onCreatePolicy={onCreatePolicy}
+          onManagePolicies={onManagePolicies}
+          onDraftChange={setDraft}
+          onSave={onSave}
+        />
+      </PopoverContent>
+    </Popover>
+  )
+}
+
+describe('AccessControlConfigPanel', () => {
+  it('opens the policy select when policies exist and none is selected', async () => {
+    render(<PanelHarness />)
+
+    expect(await screen.findByRole('option', { name: /Internal Network/ })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+  })
+
+  it('enables save after a policy is selected', async () => {
+    const user = userEvent.setup()
+    const onSave = vi.fn()
+    render(<PanelHarness onSave={onSave} />)
+
+    await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
+
+    expect(
+      screen.getByText('Allows 203.0.113.42, 198.51.100.0/24 and 2 more addresses'),
+    ).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    expect(onSave).toHaveBeenCalledTimes(1)
+  })
+
+  it('warns and disables save when every protectable access point is off', async () => {
+    const user = userEvent.setup()
+    render(<PanelHarness />)
+
+    await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('switch', { name: 'Web App' }))
+    await user.click(screen.getByRole('switch', { name: 'Backend Service API' }))
+
+    expect(screen.getByText('Select at least one access point to protect.')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+
+  it('shows a lockout warning when the current IP is outside the selected policy', async () => {
+    const user = userEvent.setup()
+    render(<PanelHarness currentIp="203.0.113.42" />)
+
+    await user.click(await screen.findByRole('option', { name: /Office VPN/ }))
+
+    expect(
+      screen.getByText("Your IP (203.0.113.42) isn't in this policy. You may lose access."),
+    ).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+  })
+
+  it('marks an unavailable MCP server as not enabled', () => {
+    render(
+      <PanelHarness
+        initialDraft={{
+          ...createDefaultAccessControlDraft(),
+          selectedPolicyId: 'internal-network',
+        }}
+        availability={{ ...allScopesAvailable, mcp: false }}
+      />,
+    )
+
+    expect(screen.getByText('Not enabled')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+  })
+
+  it('disables MCP and Trigger for agent apps', () => {
+    render(
+      <PanelHarness
+        initialDraft={{
+          ...createDefaultAccessControlDraft(),
+          selectedPolicyId: 'internal-network',
+        }}
+        availability={{ webApp: true, serviceApi: true, mcp: false, trigger: false }}
+      />,
+    )
+
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
new file mode 100644
index 00000000000000..f4d202d5244d13
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -0,0 +1,185 @@
+import { AppModeEnum } from '@/types/app'
+import {
+  canSaveAccessControl,
+  createDefaultAccessControlDraft,
+  getAccessControlScopeAvailability,
+  getAccessControlScopeSupport,
+  policyIncludesIp,
+  splitPolicySummary,
+} from '../draft'
+
+const allScopesAvailable = {
+  webApp: true,
+  serviceApi: true,
+  mcp: true,
+  trigger: true,
+}
+
+const selectedDraft = {
+  ...createDefaultAccessControlDraft(),
+  selectedPolicyId: 'policy-1',
+}
+
+describe('canSaveAccessControl', () => {
+  it('disables save when no policy is selected', () => {
+    expect(
+      canSaveAccessControl({
+        draft: createDefaultAccessControlDraft(),
+        availability: { ...allScopesAvailable, trigger: false },
+      }),
+    ).toBe(false)
+  })
+
+  it('disables save when every protectable access point is off', () => {
+    expect(
+      canSaveAccessControl({
+        draft: {
+          selectedPolicyId: 'policy-1',
+          scopes: {
+            webApp: false,
+            serviceApi: false,
+            mcp: false,
+            trigger: true,
+          },
+        },
+        availability: { ...allScopesAvailable, trigger: false },
+      }),
+    ).toBe(false)
+  })
+
+  it('enables save when a policy is selected and at least one access point is on', () => {
+    expect(
+      canSaveAccessControl({
+        draft: selectedDraft,
+        availability: { ...allScopesAvailable, trigger: false },
+      }),
+    ).toBe(true)
+  })
+
+  it('counts an enabled trigger only when that access point is available', () => {
+    expect(
+      canSaveAccessControl({
+        draft: {
+          selectedPolicyId: 'policy-1',
+          scopes: {
+            webApp: false,
+            serviceApi: false,
+            mcp: false,
+            trigger: true,
+          },
+        },
+        availability: allScopesAvailable,
+      }),
+    ).toBe(true)
+  })
+
+  it('does not count an unavailable MCP server toward save', () => {
+    expect(
+      canSaveAccessControl({
+        draft: {
+          selectedPolicyId: 'policy-1',
+          scopes: {
+            webApp: false,
+            serviceApi: false,
+            mcp: true,
+            trigger: false,
+          },
+        },
+        availability: { ...allScopesAvailable, mcp: false, trigger: false },
+      }),
+    ).toBe(false)
+  })
+})
+
+describe('getAccessControlScopeSupport', () => {
+  it('lets workflow apps apply to every access point', () => {
+    expect(getAccessControlScopeSupport(AppModeEnum.WORKFLOW)).toEqual({
+      webApp: true,
+      serviceApi: true,
+      mcp: true,
+      trigger: true,
+    })
+  })
+
+  it('lets agent apps apply only to Web App and Backend Service API', () => {
+    expect(getAccessControlScopeSupport(AppModeEnum.AGENT)).toEqual({
+      webApp: true,
+      serviceApi: true,
+      mcp: false,
+      trigger: false,
+    })
+  })
+
+  it.each([
+    AppModeEnum.ADVANCED_CHAT,
+    AppModeEnum.CHAT,
+    AppModeEnum.COMPLETION,
+    AppModeEnum.AGENT_CHAT,
+  ])('does not let %s apps apply to Trigger', (mode) => {
+    expect(getAccessControlScopeSupport(mode)).toEqual({
+      webApp: true,
+      serviceApi: true,
+      mcp: true,
+      trigger: false,
+    })
+  })
+})
+
+describe('getAccessControlScopeAvailability', () => {
+  it('keeps workflow Trigger off until a published trigger node exists', () => {
+    expect(
+      getAccessControlScopeAvailability({
+        mode: AppModeEnum.WORKFLOW,
+        hasTriggerNode: false,
+        isUnpublished: false,
+      }).trigger,
+    ).toBe(false)
+    expect(
+      getAccessControlScopeAvailability({
+        mode: AppModeEnum.WORKFLOW,
+        hasTriggerNode: true,
+        isUnpublished: true,
+      }).trigger,
+    ).toBe(false)
+    expect(
+      getAccessControlScopeAvailability({
+        mode: AppModeEnum.WORKFLOW,
+        hasTriggerNode: true,
+        isUnpublished: false,
+      }).trigger,
+    ).toBe(true)
+  })
+})
+
+describe('splitPolicySummary', () => {
+  it('keeps one or two addresses listed', () => {
+    expect(splitPolicySummary(['203.0.113.42'])).toEqual({
+      listed: ['203.0.113.42'],
+      moreCount: 0,
+    })
+    expect(splitPolicySummary(['203.0.113.42', '198.51.100.0/24'])).toEqual({
+      listed: ['203.0.113.42', '198.51.100.0/24'],
+      moreCount: 0,
+    })
+  })
+
+  it('summarizes additional addresses after the first two', () => {
+    expect(
+      splitPolicySummary(['203.0.113.42', '198.51.100.0/24', '192.0.2.1', '192.0.2.2']),
+    ).toEqual({
+      listed: ['203.0.113.42', '198.51.100.0/24'],
+      moreCount: 2,
+    })
+  })
+})
+
+describe('policyIncludesIp', () => {
+  it('matches an exact address and a covering CIDR', () => {
+    expect(policyIncludesIp(['203.0.113.42', '198.51.100.0/24'], '203.0.113.42')).toBe(true)
+    expect(policyIncludesIp(['198.51.100.0/24'], '198.51.100.20')).toBe(true)
+  })
+
+  it('does not match an address outside the policy', () => {
+    expect(policyIncludesIp(['198.51.100.0/24'], '203.0.113.42')).toBe(false)
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 197c6ebf07bc42..5c6ab09626aa6b 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -6,8 +6,23 @@ import { renderWithConsoleQuery } from '@/test/console/query-data'
 import { AccessControlEntry } from '..'
 
 const mockSetShowPricingModal = vi.fn()
+const mockSetSettingsDestination = vi.fn()
 const accessControlTranslations = vi.hoisted(() => ({
+  'operation.cancel': 'Cancel',
+  'operation.save': 'Save',
+  'overview.apiInfo.title': 'Backend Service API',
+  'overview.appInfo.title': 'Web App',
+  'mcp.server.title': 'MCP Server',
+  'settings.trigger': 'Trigger',
+  'studio.accessControl.applyTo': 'Apply to',
+  'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
+  'studio.accessControl.createIpPolicy': 'Create an IP policy',
+  'studio.accessControl.emptyPoliciesDescription':
+    'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
+  'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
   'studio.accessControl.entryLabel': 'Access Control',
+  'studio.accessControl.ipPolicy': 'IP Policy',
+  'studio.accessControl.notEnabled': 'Not enabled',
   'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.',
   'studio.accessControl.paywallTitle': 'Access Control',
   'studio.accessControl.previewAppName': 'Code Companion',
@@ -22,6 +37,11 @@ vi.mock('@/context/modal-context', () => ({
   useModalContextSelector: vi.fn(),
 }))
 
+vi.mock('nuqs', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('nuqs')>()
+  return { ...actual, useQueryState: () => [null, mockSetSettingsDestination] }
+})
+
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
   return createReactI18nextMock(accessControlTranslations)
@@ -76,12 +96,6 @@ describe('AccessControlEntry', () => {
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
   })
 
-  it.each(['professional', 'team'] as const)('does not render on Cloud %s', (plan) => {
-    renderEntry({ plan })
-
-    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
-  })
-
   it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
     renderEntry({ plan: 'sandbox' })
 
@@ -91,6 +105,17 @@ describe('AccessControlEntry', () => {
     expect(within(chip).queryByRole('button')).not.toBeInTheDocument()
   })
 
+  it.each(['professional', 'team'] as const)(
+    'renders the Access Control chip without a PRO badge on Cloud %s',
+    (plan) => {
+      renderEntry({ plan })
+
+      const chip = getChip()
+      expect(chip).toBeInTheDocument()
+      expect(within(chip).queryByText('PRO')).not.toBeInTheDocument()
+    },
+  )
+
   it('opens the paywall popover from the chip and sends the user to pricing', async () => {
     const user = userEvent.setup()
     renderEntry({ plan: 'sandbox' })
@@ -126,4 +151,58 @@ describe('AccessControlEntry', () => {
     })
     expect(mockSetShowPricingModal).not.toHaveBeenCalled()
   })
+
+  it('opens the first-time config popover for paid workspaces without a back control', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+
+    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
+    expect(
+      screen.getByText(
+        'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
+      ),
+    ).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByText('Not enabled')).toBeInTheDocument()
+  })
+
+  it('sends paid users to Settings IP Policies from the empty-state exit', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+
+    expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
+    await waitFor(() => {
+      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+    })
+  })
+
+  it('closes the first-time config on Cancel without opening settings', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    await waitFor(() => {
+      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+    })
+    expect(mockSetSettingsDestination).not.toHaveBeenCalled()
+    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
new file mode 100644
index 00000000000000..27f3b0d797c5cf
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -0,0 +1,131 @@
+'use client'
+
+import type { FormEvent } from 'react'
+import type {
+  AccessControlDraft,
+  AccessControlPolicy,
+  AccessControlScopeAvailability,
+} from './draft'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
+import { IconButton } from '@langgenius/dify-ui/icon-button'
+import { PopoverTitle } from '@langgenius/dify-ui/popover'
+import { useTranslation } from 'react-i18next'
+import { canSaveAccessControl } from './draft'
+import { AccessControlPolicyField } from './policy-field'
+import { AccessControlScopeList } from './scope-list'
+
+type AccessControlConfigPanelProps = {
+  draft: AccessControlDraft
+  policies: readonly AccessControlPolicy[]
+  currentIp?: string
+  availability: AccessControlScopeAvailability
+  showBack?: boolean
+  onBack?: () => void
+  onCancel: () => void
+  onCreatePolicy: () => void
+  onManagePolicies: () => void
+  onDraftChange: (draft: AccessControlDraft) => void
+  onSave: () => void
+}
+
+export function AccessControlConfigPanel({
+  draft,
+  policies,
+  currentIp,
+  availability,
+  showBack = false,
+  onBack,
+  onCancel,
+  onCreatePolicy,
+  onManagePolicies,
+  onDraftChange,
+  onSave,
+}: AccessControlConfigPanelProps) {
+  const { t } = useTranslation()
+  const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
+  const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
+  const canSave = canSaveAccessControl({ draft, availability })
+
+  const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
+    event.preventDefault()
+    if (!canSave) return
+    onSave()
+  }
+
+  return (
+    <form className="flex w-100 flex-col" onSubmit={handleSubmit}>
+      <div
+        className={cn(
+          'flex items-center overflow-hidden pt-4 pr-4 pb-3',
+          showBack ? 'pl-2' : 'pl-4',
+        )}
+      >
+        <div className="flex w-full items-center gap-2 overflow-hidden">
+          {showBack && (
+            <IconButton
+              size="lg"
+              aria-label={t(($) => $['operation.back'], { ns: 'common' })}
+              onClick={onBack}
+            >
+              <span aria-hidden className="i-ri-arrow-left-s-line size-4" />
+            </IconButton>
+          )}
+          <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
+            {title}
+          </PopoverTitle>
+        </div>
+      </div>
+
+      <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
+        <Fieldset className="flex w-full flex-col gap-1">
+          <FieldsetLegend className="mb-0 py-0">
+            {t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })}
+          </FieldsetLegend>
+          <AccessControlPolicyField
+            policies={policies}
+            selectedPolicyId={draft.selectedPolicyId}
+            currentIp={currentIp}
+            onCreatePolicy={onCreatePolicy}
+            onManagePolicies={onManagePolicies}
+            onSelectPolicy={(policyId) => {
+              onDraftChange({ ...draft, selectedPolicyId: policyId })
+            }}
+          />
+        </Fieldset>
+
+        <Fieldset className={cn('flex w-full flex-col gap-1', !hasSelectedPolicy && 'opacity-40')}>
+          <FieldsetLegend className="mb-0 py-0">
+            {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
+          </FieldsetLegend>
+          <p className="system-xs-regular text-text-tertiary">
+            {hasSelectedPolicy
+              ? t(($) => $['studio.accessControl.applyToHelpSelected'], { ns: 'deployments' })
+              : t(($) => $['studio.accessControl.applyToHelp'], { ns: 'deployments' })}
+          </p>
+          <AccessControlScopeList
+            draft={draft}
+            disabled={!hasSelectedPolicy}
+            availability={availability}
+            onDraftChange={onDraftChange}
+          />
+          {hasSelectedPolicy && !canSave && (
+            <p className="system-xs-regular text-text-warning">
+              {t(($) => $['studio.accessControl.selectAccessPoint'], { ns: 'deployments' })}
+            </p>
+          )}
+        </Fieldset>
+
+        <div className="flex items-center justify-end gap-2 pt-5">
+          <Button type="button" variant="secondary" onClick={onCancel}>
+            {t(($) => $['operation.cancel'], { ns: 'common' })}
+          </Button>
+          <Button type="submit" variant="primary" disabled={!canSave}>
+            {t(($) => $['operation.save'], { ns: 'common' })}
+          </Button>
+        </div>
+      </div>
+    </form>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
new file mode 100644
index 00000000000000..c9eb0aac937e31
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -0,0 +1,123 @@
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import { AppModeEnum } from '@/types/app'
+
+export type AccessControlScopeAvailability = Record<AccessPoint, boolean>
+
+export type AccessControlPolicy = {
+  id: string
+  name: string
+  addresses: readonly string[]
+}
+
+export type AccessControlDraft = {
+  selectedPolicyId: string | null
+  scopes: Record<AccessPoint, boolean>
+}
+
+export const createDefaultAccessControlDraft = (): AccessControlDraft => ({
+  selectedPolicyId: null,
+  scopes: {
+    webApp: true,
+    serviceApi: true,
+    mcp: false,
+    trigger: false,
+  },
+})
+
+export function getAccessControlScopeSupport(
+  mode: AppModeEnum | undefined,
+): AccessControlScopeAvailability {
+  if (mode === AppModeEnum.AGENT) {
+    return { webApp: true, serviceApi: true, mcp: false, trigger: false }
+  }
+
+  if (mode === AppModeEnum.WORKFLOW) {
+    return { webApp: true, serviceApi: true, mcp: true, trigger: true }
+  }
+
+  return { webApp: true, serviceApi: true, mcp: true, trigger: false }
+}
+
+export function getAccessControlScopeAvailability({
+  mode,
+  hasTriggerNode,
+  isUnpublished,
+}: {
+  mode: AppModeEnum | undefined
+  hasTriggerNode: boolean
+  isUnpublished: boolean
+}): AccessControlScopeAvailability {
+  const support = getAccessControlScopeSupport(mode)
+
+  return {
+    ...support,
+    trigger: support.trigger && !isUnpublished && hasTriggerNode,
+  }
+}
+
+export function isProtectableAccessPoint(
+  scope: AccessPoint,
+  availability: AccessControlScopeAvailability,
+) {
+  return availability[scope]
+}
+
+export function canSaveAccessControl({
+  draft,
+  availability,
+}: {
+  draft: AccessControlDraft
+  availability: AccessControlScopeAvailability
+}) {
+  if (!draft.selectedPolicyId) return false
+
+  return ACCESS_POINT_ORDER.some((scope) => {
+    if (!isProtectableAccessPoint(scope, availability)) return false
+    return draft.scopes[scope]
+  })
+}
+
+export function splitPolicySummary(addresses: readonly string[]): {
+  listed: readonly string[]
+  moreCount: number
+} {
+  if (addresses.length <= 2) return { listed: addresses, moreCount: 0 }
+  return { listed: addresses.slice(0, 2), moreCount: addresses.length - 2 }
+}
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split('.')
+  if (parts.length !== 4) return null
+
+  let value = 0
+  for (const part of parts) {
+    if (!/^\d+$/.test(part)) return null
+    const octet = Number(part)
+    if (octet > 255) return null
+    value = (value << 8) + octet
+  }
+
+  return value >>> 0
+}
+
+function ipv4InCidr(ip: string, network: string, prefix: number): boolean {
+  const ipInt = ipv4ToInt(ip)
+  const networkInt = ipv4ToInt(network)
+  if (ipInt === null || networkInt === null) return false
+  if (prefix === 0) return true
+  const mask = prefix === 32 ? 0xffffffff : ~((1 << (32 - prefix)) - 1) >>> 0
+  return (ipInt & mask) === (networkInt & mask)
+}
+
+export function policyIncludesIp(addresses: readonly string[], ip: string): boolean {
+  return addresses.some((entry) => {
+    if (entry === ip) return true
+    const slash = entry.indexOf('/')
+    if (slash === -1) return false
+    const network = entry.slice(0, slash)
+    const prefix = Number(entry.slice(slash + 1))
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false
+    return ipv4InCidr(ip, network, prefix)
+  })
+}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index e7904bb096214b..8d67ea4e28ad78 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -1,17 +1,32 @@
 'use client'
 
+import type { AccessControlDraft } from './draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { useQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
+import { useQueryState } from 'nuqs'
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { useStore as useAppStore } from '@/app/components/app/store'
 import PremiumBadge from '@/app/components/base/premium-badge'
+import {
+  settingsQueryParamName,
+  settingsQueryParser,
+} from '@/app/components/header/account-setting/query-params'
 import { useModalContext } from '@/context/modal-context'
 import { deploymentEditionAtom } from '@/features/system-features/state'
 import { consoleQuery } from '@/service/console'
+import { useAppWorkflow } from '@/service/use-workflow'
+import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
+import { AccessControlConfigPanel } from './config-panel'
+import { createDefaultAccessControlDraft, getAccessControlScopeAvailability } from './draft'
 import { AccessControlFreePaywall } from './free-paywall'
+import { AccessControlStatusPanel } from './status-panel'
 
 type GtagHandler = (command: 'event', action: 'click_upgrade_btn', payload: { loc: string }) => void
 
+const isPaidCloudPlan = (plan: string | undefined) => plan === 'professional' || plan === 'team'
+
 export function AccessControlEntry() {
   const { t } = useTranslation()
   const deploymentEdition = useAtomValue(deploymentEditionAtom)
@@ -22,11 +37,29 @@ export function AccessControlEntry() {
     }),
   )
   const { setShowPricingModal } = useModalContext()
+  const [, setSettingsDestination] = useQueryState(settingsQueryParamName, settingsQueryParser)
+  const appInfo = useAppStore((state) => state.appDetail)
+  const isSandbox = plan === 'sandbox'
+  const isPaid = isPaidCloudPlan(plan)
+  const shouldFetchWorkflow = isPaid && Boolean(appInfo && isAdvancedApp(appInfo))
+  const { data: workflow } = useAppWorkflow(shouldFetchWorkflow && appInfo ? appInfo.id : '')
+  const [open, setOpen] = useState(false)
+  const [view, setView] = useState<'config' | 'status'>('config')
+  const [showBack, setShowBack] = useState(false)
+  const [draft, setDraft] = useState<AccessControlDraft>(createDefaultAccessControlDraft)
+  const [savedDraft, setSavedDraft] = useState<AccessControlDraft | null>(null)
 
-  if (deploymentEdition !== 'CLOUD' || plan !== 'sandbox') return null
+  if (deploymentEdition !== 'CLOUD' || (!isSandbox && !isPaid)) return null
 
   const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
+  const workflowState = appInfo ? getPublishedWorkflowState(appInfo, workflow) : undefined
+  const availability = getAccessControlScopeAvailability({
+    mode: appInfo?.mode,
+    hasTriggerNode: Boolean(workflowState?.hasTriggerNode),
+    isUnpublished: Boolean(workflowState?.isUnpublished),
+  })
+  const policies = [] as const
 
   const handleTurnOn = () => {
     setShowPricingModal()
@@ -34,24 +67,78 @@ export function AccessControlEntry() {
     if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
   }
 
+  const resetDraft = () => {
+    setDraft(savedDraft ?? createDefaultAccessControlDraft())
+  }
+
+  const handleCancel = () => {
+    resetDraft()
+    if (savedDraft) {
+      setView('status')
+      setShowBack(false)
+      return
+    }
+    setOpen(false)
+  }
+
+  const handleCreatePolicy = () => {
+    setOpen(false)
+    void setSettingsDestination('ip-policies')
+  }
+
+  const handleSave = () => {
+    setSavedDraft(draft)
+    setView('status')
+    setShowBack(false)
+  }
+
   return (
-    <Popover>
+    <Popover open={open} onOpenChange={setOpen}>
       <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid">
         <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
         <span className="system-sm-medium text-text-secondary">{label}</span>
-        <PremiumBadge size="s" color="blue">
-          <span
-            aria-hidden
-            className="i-custom-public-common-sparkles-soft flex h-3.5 w-3.5 items-center py-px pl-0.75 text-components-premium-badge-indigo-text-stop-0"
-          />
-          <span className="system-xs-medium">{pro}</span>
-        </PremiumBadge>
+        {isSandbox && (
+          <PremiumBadge size="s" color="blue">
+            <span
+              aria-hidden
+              className="i-custom-public-common-sparkles-soft flex h-3.5 w-3.5 items-center py-px pl-0.75 text-components-premium-badge-indigo-text-stop-0"
+            />
+            <span className="system-xs-medium">{pro}</span>
+          </PremiumBadge>
+        )}
       </PopoverTrigger>
       <PopoverContent
         placement="bottom-end"
-        className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px]"
+        className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
       >
-        <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+        {isSandbox ? (
+          <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+        ) : view === 'status' && savedDraft ? (
+          <AccessControlStatusPanel
+            draft={savedDraft}
+            policies={policies}
+            enabled
+            availability={availability}
+            onEdit={() => {
+              setDraft(savedDraft)
+              setShowBack(true)
+              setView('config')
+            }}
+          />
+        ) : (
+          <AccessControlConfigPanel
+            draft={draft}
+            policies={policies}
+            availability={availability}
+            showBack={showBack}
+            onBack={handleCancel}
+            onCancel={handleCancel}
+            onCreatePolicy={handleCreatePolicy}
+            onManagePolicies={handleCreatePolicy}
+            onDraftChange={setDraft}
+            onSave={handleSave}
+          />
+        )}
       </PopoverContent>
     </Popover>
   )
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
new file mode 100644
index 00000000000000..fd07e370cbbeec
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -0,0 +1,217 @@
+'use client'
+
+import type { AccessControlPolicy } from './draft'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { IconButton } from '@langgenius/dify-ui/icon-button'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectItemIndicator,
+  SelectItemText,
+  SelectSeparator,
+  SelectTrigger,
+  SelectValue,
+} from '@langgenius/dify-ui/select'
+import { useTranslation } from 'react-i18next'
+import { policyIncludesIp, splitPolicySummary } from './draft'
+
+const MANAGE_POLICIES_VALUE = '__manage-ip-policies__'
+
+type AccessControlPolicyFieldProps = {
+  policies: readonly AccessControlPolicy[]
+  selectedPolicyId: string | null
+  currentIp?: string
+  onCreatePolicy: () => void
+  onManagePolicies: () => void
+  onSelectPolicy: (policyId: string) => void
+}
+
+export function AccessControlPolicyField({
+  policies,
+  selectedPolicyId,
+  currentIp,
+  onCreatePolicy,
+  onManagePolicies,
+  onSelectPolicy,
+}: AccessControlPolicyFieldProps) {
+  const { t } = useTranslation()
+  const selectedPolicy = policies.find((policy) => policy.id === selectedPolicyId)
+  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.addresses) : undefined
+  const showLockout =
+    Boolean(selectedPolicy && currentIp) &&
+    selectedPolicy !== undefined &&
+    currentIp !== undefined &&
+    !policyIncludesIp(selectedPolicy.addresses, currentIp)
+  const selectLabel = t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })
+  const placeholder = t(($) => $['studio.accessControl.selectPolicy'], { ns: 'deployments' })
+
+  if (policies.length === 0) {
+    return (
+      <div className="flex w-full flex-col items-center gap-3 overflow-hidden rounded-lg border border-dashed border-divider-regular px-4 py-5">
+        <div className="flex w-full flex-col items-center gap-1 text-center">
+          <p className="w-full system-sm-medium text-text-secondary">
+            {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+          </p>
+          <p className="w-full system-xs-regular text-text-tertiary">
+            {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
+          </p>
+        </div>
+        <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
+          {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
+        </Button>
+      </div>
+    )
+  }
+
+  const policyOptions = (
+    <>
+      {policies.map((policy) => (
+        <SelectItem key={policy.id} value={policy.id}>
+          <SelectItemText className="min-w-0 flex-1 truncate">{policy.name}</SelectItemText>
+          <span className="shrink-0 system-xs-regular text-text-tertiary">
+            {t(($) => $['studio.accessControl.addressCount'], {
+              ns: 'deployments',
+              count: policy.addresses.length,
+            })}
+          </span>
+          <SelectItemIndicator />
+        </SelectItem>
+      ))}
+      <SelectSeparator />
+      <SelectItem value={MANAGE_POLICIES_VALUE}>
+        <SelectItemText>
+          {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
+        </SelectItemText>
+      </SelectItem>
+    </>
+  )
+
+  if (!selectedPolicy) {
+    return (
+      <div className="flex w-full flex-col gap-1">
+        <div className="flex w-full items-center gap-1">
+          <div
+            className={cn(
+              'flex h-8 w-full items-center gap-0.5 rounded-lg bg-components-input-bg-normal px-3 py-2 system-sm-regular',
+              'text-components-input-text-placeholder',
+            )}
+          >
+            <span className="min-w-0 grow truncate" title={placeholder}>
+              {placeholder}
+            </span>
+            <span
+              aria-hidden
+              className="i-ri-arrow-down-s-line size-4 shrink-0 text-text-quaternary"
+            />
+          </div>
+          <IconButton
+            size="lg"
+            aria-label={t(($) => $['settings.ipPolicies'], { ns: 'common' })}
+            onClick={onManagePolicies}
+          >
+            <span aria-hidden className="i-ri-equalizer-2-line size-4" />
+          </IconButton>
+        </div>
+        <div
+          role="listbox"
+          aria-label={selectLabel}
+          className="rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg p-1 shadow-xs"
+        >
+          {policies.map((policy) => (
+            <button
+              key={policy.id}
+              type="button"
+              role="option"
+              aria-selected={false}
+              className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+              onClick={() => onSelectPolicy(policy.id)}
+            >
+              <span className="min-w-0 flex-1 truncate px-1">{policy.name}</span>
+              <span className="shrink-0 system-xs-regular text-text-tertiary">
+                {t(($) => $['studio.accessControl.addressCount'], {
+                  ns: 'deployments',
+                  count: policy.addresses.length,
+                })}
+              </span>
+            </button>
+          ))}
+          <div className="my-1 h-px bg-divider-subtle" />
+          <button
+            type="button"
+            className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+            onClick={onManagePolicies}
+          >
+            <span className="px-1">
+              {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
+            </span>
+          </button>
+        </div>
+      </div>
+    )
+  }
+
+  return (
+    <>
+      <div className="flex w-full items-center gap-1">
+        <Select
+          value={selectedPolicyId}
+          onValueChange={(value) => {
+            if (value === MANAGE_POLICIES_VALUE) {
+              onManagePolicies()
+              return
+            }
+            if (value) onSelectPolicy(value)
+          }}
+        >
+          <SelectTrigger aria-label={selectLabel}>
+            <SelectValue placeholder={placeholder}>
+              {(value) => policies.find((policy) => policy.id === value)?.name ?? placeholder}
+            </SelectValue>
+          </SelectTrigger>
+          <SelectContent className="max-w-[var(--anchor-width)] min-w-[var(--anchor-width)]">
+            {policyOptions}
+          </SelectContent>
+        </Select>
+        <IconButton
+          size="lg"
+          aria-label={t(($) => $['settings.ipPolicies'], { ns: 'common' })}
+          onClick={onManagePolicies}
+        >
+          <span aria-hidden className="i-ri-equalizer-2-line size-4" />
+        </IconButton>
+      </div>
+      {summary && (
+        <p className="system-xs-regular text-text-tertiary">
+          {summary.listed.length === 0
+            ? t(($) => $['studio.accessControl.policySummaryNone'], { ns: 'deployments' })
+            : summary.listed.length === 1
+              ? t(($) => $['studio.accessControl.policySummaryOne'], {
+                  ns: 'deployments',
+                  address: summary.listed[0],
+                })
+              : summary.moreCount > 0
+                ? t(($) => $['studio.accessControl.policySummaryMany'], {
+                    ns: 'deployments',
+                    listed: summary.listed.join(', '),
+                    count: summary.moreCount,
+                  })
+                : t(($) => $['studio.accessControl.policySummaryTwo'], {
+                    ns: 'deployments',
+                    first: summary.listed[0],
+                    second: summary.listed[1],
+                  })}
+        </p>
+      )}
+      {showLockout && currentIp && (
+        <p className="system-xs-regular text-text-warning">
+          {t(($) => $['studio.accessControl.lockoutWarning'], {
+            ns: 'deployments',
+            ip: currentIp,
+          })}
+        </p>
+      )}
+    </>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/scope-list.tsx b/web/app/components/app/access-point/access-control/scope-list.tsx
new file mode 100644
index 00000000000000..d3039743aeed96
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/scope-list.tsx
@@ -0,0 +1,104 @@
+'use client'
+
+import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { cn } from '@langgenius/dify-ui/cn'
+import { Switch } from '@langgenius/dify-ui/switch'
+import { useTranslation } from 'react-i18next'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import AppIcon from '@/app/components/base/app-icon'
+
+const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
+  serviceApi: 'i-custom-vender-knowledge-api-aggregate',
+  mcp: 'i-custom-vender-integrations-mcp',
+  trigger: 'i-custom-vender-integrations-trigger',
+}
+
+type AccessControlScopeListProps = {
+  draft: AccessControlDraft
+  disabled: boolean
+  availability: AccessControlScopeAvailability
+  onDraftChange: (draft: AccessControlDraft) => void
+}
+
+export function AccessControlScopeList({
+  draft,
+  disabled,
+  availability,
+  onDraftChange,
+}: AccessControlScopeListProps) {
+  const { t } = useTranslation()
+  const appInfo = useAppStore((state) => state.appDetail)
+
+  const labels: Record<AccessPoint, string> = {
+    webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
+    serviceApi: t(($) => $['overview.apiInfo.title'], { ns: 'appOverview' }),
+    mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
+    trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
+  }
+
+  return (
+    <div className="flex w-full flex-col gap-0.5">
+      {ACCESS_POINT_ORDER.map((scope) => {
+        const unavailable = !availability[scope]
+        const label = labels[scope]
+
+        return (
+          <div key={scope} className="flex items-center gap-2 py-2">
+            {scope === 'webApp' ? (
+              <AppIcon
+                size="tiny"
+                decorative
+                iconType={appInfo?.icon_type}
+                icon={appInfo?.icon}
+                background={appInfo?.icon_background ?? undefined}
+                imageUrl={appInfo?.icon_url}
+                className="rounded-sm bg-util-colors-orange-orange-100"
+              />
+            ) : (
+              <span
+                className={cn(
+                  'flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg',
+                  unavailable && 'opacity-40',
+                )}
+              >
+                <span
+                  aria-hidden
+                  className={cn(SCOPE_ICONS[scope], 'size-3.5 text-text-tertiary')}
+                />
+              </span>
+            )}
+            <span
+              className={cn(
+                'system-sm-medium',
+                unavailable ? 'shrink-0 text-text-tertiary' : 'min-w-0 flex-1 text-text-secondary',
+              )}
+            >
+              {label}
+            </span>
+            {unavailable && (
+              <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
+                {t(($) => $['studio.accessControl.notEnabled'], { ns: 'deployments' })}
+              </span>
+            )}
+            <Switch
+              checked={unavailable ? false : draft.scopes[scope]}
+              disabled={disabled || unavailable}
+              aria-label={label}
+              onCheckedChange={(checked) => {
+                onDraftChange({
+                  ...draft,
+                  scopes: {
+                    ...draft.scopes,
+                    [scope]: checked,
+                  },
+                })
+              }}
+            />
+          </div>
+        )
+      })}
+    </div>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
new file mode 100644
index 00000000000000..df183b9d749b9e
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -0,0 +1,164 @@
+'use client'
+
+import type {
+  AccessControlDraft,
+  AccessControlPolicy,
+  AccessControlScopeAvailability,
+} from './draft'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { PopoverTitle } from '@langgenius/dify-ui/popover'
+import { Switch } from '@langgenius/dify-ui/switch'
+import { useTranslation } from 'react-i18next'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import AppIcon from '@/app/components/base/app-icon'
+import { isProtectableAccessPoint, splitPolicySummary } from './draft'
+
+const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
+  serviceApi: 'i-custom-vender-knowledge-api-aggregate',
+  mcp: 'i-custom-vender-integrations-mcp',
+  trigger: 'i-custom-vender-integrations-trigger',
+}
+
+type AccessControlStatusPanelProps = {
+  draft: AccessControlDraft
+  policies: readonly AccessControlPolicy[]
+  enabled: boolean
+  availability: AccessControlScopeAvailability
+  onEdit: () => void
+}
+
+export function AccessControlStatusPanel({
+  draft,
+  policies,
+  enabled,
+  availability,
+  onEdit,
+}: AccessControlStatusPanelProps) {
+  const { t } = useTranslation()
+  const appInfo = useAppStore((state) => state.appDetail)
+  const selectedPolicy = policies.find((policy) => policy.id === draft.selectedPolicyId)
+  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.addresses) : undefined
+  const labels: Record<AccessPoint, string> = {
+    webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
+    serviceApi: t(($) => $['overview.apiInfo.title'], { ns: 'appOverview' }),
+    mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
+    trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
+  }
+
+  return (
+    <div className="flex w-100 flex-col">
+      <div className="flex items-center justify-between gap-2 overflow-hidden px-4 pt-4 pb-3">
+        <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
+          {t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
+        </PopoverTitle>
+        <Button type="button" variant="ghost" size="small" onClick={onEdit}>
+          {t(($) => $['operation.edit'], { ns: 'common' })}
+        </Button>
+      </div>
+
+      <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
+        <div className="flex items-center justify-between gap-2">
+          <p className="system-md-medium text-text-primary">
+            {t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
+          </p>
+          <Switch
+            checked={enabled}
+            readOnly
+            aria-label={t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
+          />
+        </div>
+
+        {selectedPolicy && summary && (
+          <div className="flex flex-col gap-0.5">
+            <p className="system-sm-medium text-text-secondary">
+              {t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })}
+            </p>
+            <p className="system-sm-regular text-text-primary">{selectedPolicy.name}</p>
+            <p className="system-xs-regular text-text-tertiary">
+              {summary.listed.length === 0
+                ? t(($) => $['studio.accessControl.policySummaryNone'], { ns: 'deployments' })
+                : summary.listed.length === 1
+                  ? t(($) => $['studio.accessControl.policySummaryOne'], {
+                      ns: 'deployments',
+                      address: summary.listed[0],
+                    })
+                  : summary.moreCount > 0
+                    ? t(($) => $['studio.accessControl.policySummaryMany'], {
+                        ns: 'deployments',
+                        listed: summary.listed.join(', '),
+                        count: summary.moreCount,
+                      })
+                    : t(($) => $['studio.accessControl.policySummaryTwo'], {
+                        ns: 'deployments',
+                        first: summary.listed[0],
+                        second: summary.listed[1],
+                      })}
+            </p>
+          </div>
+        )}
+
+        <div className="flex flex-col gap-0.5">
+          <p className="system-sm-medium text-text-secondary">
+            {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
+          </p>
+          {ACCESS_POINT_ORDER.map((scope) => {
+            const unavailable = !isProtectableAccessPoint(scope, availability)
+            const excluded = !unavailable && !draft.scopes[scope]
+            const label = labels[scope]
+
+            return (
+              <div key={scope} className="flex items-center gap-2 py-2">
+                {scope === 'webApp' ? (
+                  <AppIcon
+                    size="tiny"
+                    decorative
+                    iconType={appInfo?.icon_type}
+                    icon={appInfo?.icon}
+                    background={appInfo?.icon_background ?? undefined}
+                    imageUrl={appInfo?.icon_url}
+                    className="rounded-sm bg-util-colors-orange-orange-100"
+                  />
+                ) : (
+                  <span
+                    className={cn(
+                      'flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg',
+                      (unavailable || excluded) && 'opacity-40',
+                    )}
+                  >
+                    <span
+                      aria-hidden
+                      className={cn(SCOPE_ICONS[scope], 'size-3.5 text-text-tertiary')}
+                    />
+                  </span>
+                )}
+                <span
+                  className={cn(
+                    'system-sm-medium',
+                    excluded || unavailable
+                      ? 'shrink-0 text-text-tertiary'
+                      : 'min-w-0 flex-1 text-text-secondary',
+                  )}
+                >
+                  {label}
+                </span>
+                {excluded && (
+                  <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
+                    {t(($) => $['studio.accessControl.excluded'], { ns: 'deployments' })}
+                  </span>
+                )}
+                {unavailable && (
+                  <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
+                    {t(($) => $['studio.accessControl.notEnabled'], { ns: 'deployments' })}
+                  </span>
+                )}
+              </div>
+            )
+          })}
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/header/account-setting/__tests__/constants.spec.ts b/web/app/components/header/account-setting/__tests__/constants.spec.ts
index aa21ac9e18bf8e..015db9ec3aacd3 100644
--- a/web/app/components/header/account-setting/__tests__/constants.spec.ts
+++ b/web/app/components/header/account-setting/__tests__/constants.spec.ts
@@ -7,6 +7,7 @@ import {
 describe('settingsQueryParser', () => {
   it.each([
     ['roles-and-permissions', 'roles-and-permissions'],
+    ['ip-policies', 'ip-policies'],
     ['preferences', 'preferences'],
     ['provider', 'provider'],
     ['mcp', 'mcp'],
diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index bfdebe8331c4c4..b117b174a518f7 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -552,6 +552,15 @@ describe('AccountSetting', () => {
   })
 
   describe('Tab Navigation', () => {
+    it('should open the IP Policies settings page', () => {
+      renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
+
+      expect(screen.getByRole('button', { name: 'common.settings.ipPolicies' })).toBeInTheDocument()
+      expect(
+        screen.getByText('deployments.studio.accessControl.emptyPoliciesTitle'),
+      ).toBeInTheDocument()
+    })
+
     it('should change active tab when clicking on menu item', () => {
       // Arrange
       renderAccountSetting({ onTabChange: mockOnTabChange })
diff --git a/web/app/components/header/account-setting/constants.ts b/web/app/components/header/account-setting/constants.ts
index 78e0ef3e95e9af..15a4821a680a33 100644
--- a/web/app/components/header/account-setting/constants.ts
+++ b/web/app/components/header/account-setting/constants.ts
@@ -1,5 +1,6 @@
 export const ACCOUNT_SETTING_TAB = {
   MEMBERS: 'members',
+  IP_POLICIES: 'ip-policies',
   ROLES_AND_PERMISSIONS: 'roles-and-permissions',
   PERMISSION_SET: 'permission-set',
   BILLING: 'billing',
@@ -12,6 +13,7 @@ export type AccountSettingTab = (typeof ACCOUNT_SETTING_TAB)[keyof typeof ACCOUN
 
 export const ACCOUNT_SETTING_TAB_VALUES = [
   ACCOUNT_SETTING_TAB.MEMBERS,
+  ACCOUNT_SETTING_TAB.IP_POLICIES,
   ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS,
   ACCOUNT_SETTING_TAB.PERMISSION_SET,
   ACCOUNT_SETTING_TAB.BILLING,
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 68cbb9933c8745..33ab1f4cbf6aa5 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -27,6 +27,7 @@ import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import { consoleQuery } from '@/service/console'
 import { hasPermission } from '@/utils/permission'
 import AccessRulesPage from './access-rules-page'
+import IpPoliciesPage from './ip-policies-page'
 import MembersPage from './members-page'
 import PermissionsPage from './permissions-page'
 import PreferencePage from './preference-page'
@@ -74,6 +75,11 @@ export default function AccountSetting({
   const canViewWorkflowLogArchives =
     systemFeatures.deployment_edition === 'CLOUD' && isCurrentWorkspaceManager
   const activeMenu = (() => {
+    if (
+      activeTab === ACCOUNT_SETTING_TAB.IP_POLICIES &&
+      systemFeatures.deployment_edition !== 'CLOUD'
+    )
+      return ACCOUNT_SETTING_TAB.MEMBERS
     if (activeTab === ACCOUNT_SETTING_TAB.BILLING && !canViewBilling)
       return ACCOUNT_SETTING_TAB.PREFERENCES
     if (activeTab === ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES && !canViewWorkflowLogArchives)
@@ -95,6 +101,12 @@ export default function AccountSetting({
       icon: <span className={cn('i-ri-group-2-line', iconClassName)} />,
       activeIcon: <span className={cn('i-ri-group-2-fill', iconClassName)} />,
     },
+    {
+      key: ACCOUNT_SETTING_TAB.IP_POLICIES,
+      name: t(($) => $['settings.ipPolicies'], { ns: 'common' }),
+      icon: <span className={cn('i-ri-shield-keyhole-line', iconClassName)} />,
+      activeIcon: <span className={cn('i-ri-shield-keyhole-fill', iconClassName)} />,
+    },
     {
       key: ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS,
       name: t(($) => $['settings.rolesAndPermissions'], { ns: 'common' }),
@@ -142,6 +154,8 @@ export default function AccountSetting({
     const visibleTabs: AccountSettingTab[] = []
 
     visibleTabs.push(ACCOUNT_SETTING_TAB.MEMBERS)
+    if (systemFeatures.deployment_edition === 'CLOUD')
+      visibleTabs.push(ACCOUNT_SETTING_TAB.IP_POLICIES)
 
     if (canManageWorkspaceRoles) {
       visibleTabs.push(ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS)
@@ -247,6 +261,7 @@ export default function AccountSetting({
                 </div>
                 <div className="max-w-full min-w-0 px-4 pt-6 sm:px-8">
                   {activeMenu === ACCOUNT_SETTING_TAB.MEMBERS && <MembersPage />}
+                  {activeMenu === ACCOUNT_SETTING_TAB.IP_POLICIES && <IpPoliciesPage />}
                   {activeMenu === ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS && (
                     <PermissionsPage containerRef={scrollContainerRef} />
                   )}
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
new file mode 100644
index 00000000000000..4adafc1ca57171
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -0,0 +1,18 @@
+'use client'
+
+import { useTranslation } from 'react-i18next'
+
+export default function IpPoliciesPage() {
+  const { t } = useTranslation()
+
+  return (
+    <div className="flex flex-col items-center gap-1 py-10 text-center">
+      <p className="system-sm-medium text-text-secondary">
+        {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+      </p>
+      <p className="max-w-md system-xs-regular text-text-tertiary">
+        {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
+      </p>
+    </div>
+  )
+}
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index cb58e11eacbb8c..974cd883965779 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "مصدر البيانات",
   "settings.extension": "Extension",
   "settings.integrations": "التكاملات",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 36f7828971125c..6967b45226f9ed 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 3eca0f3ce2fa75..8484f772532ef6 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Datenquelle",
   "settings.extension": "Extension",
   "settings.integrations": "Integrationen",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index 36cd854da8ca56..d8281bef9db2b2 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index f7f58407bab21e..6065af40b840fa 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Data Source",
   "settings.extension": "Extension",
   "settings.integrations": "Integrations",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index add54fec723c72..ad64f218d884f1 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Not deployed",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Undeploying",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Integrate the app into your services over HTTP",
   "studio.accessPoint.description": "All the ways this app can be reached. Access points match the running version only.",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 87bba9f08589ef..2404b986388404 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Fuente de Datos",
   "settings.extension": "Extension",
   "settings.integrations": "Integraciones",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index af4ee71d553435..d53482ed7d19cd 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 69c94939366a97..3ee10e59de2171 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "منبع داده",
   "settings.extension": "Extension",
   "settings.integrations": "ادغام‌ها",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index f48f640dad2f98..b633101ad7f932 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 4640a108c3aa13..576a5bf04791ff 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Source de Données",
   "settings.extension": "Extension",
   "settings.integrations": "Intégrations",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index 13518732df2b36..ffabe66308f0fe 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 275177d98f1408..6c8776292e77fe 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "डेटा स्रोत",
   "settings.extension": "Extension",
   "settings.integrations": "एकीकरण",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 38834822638125..059de2b575870f 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 586dc35e203cd3..a66f00497a1a2b 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Sumber Data",
   "settings.extension": "Extension",
   "settings.integrations": "Integrasi",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index d08ac1a0cad109..0397c16eb99d47 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index eab7932c4e470b..bc18e0f8949dfa 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Fonte Dati",
   "settings.extension": "Extension",
   "settings.integrations": "Integrazioni",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 5c014d678adccf..80e473a8fbee20 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 364681fcde23a2..ac6c3fc597a813 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "データソース",
   "settings.extension": "拡張機能",
   "settings.integrations": "統合",
+  "settings.ipPolicies": "IP ポリシー",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 58cb3dc645b2e2..eadccd20e22cd2 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未デプロイ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "アンデプロイ中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
+  "studio.accessControl.addressCount": "{{count}} 件のアドレス",
+  "studio.accessControl.applyTo": "適用先",
+  "studio.accessControl.applyToHelp": "保護するアクセスポイントを選択します。",
+  "studio.accessControl.applyToHelpSelected": "このポリシーで保護するアクセスポイントを選択します。",
+  "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
+  "studio.accessControl.emptyPoliciesDescription": "ポリシーは許可する IP アドレスの一覧です。作成してから、ここに戻って適用してください。",
+  "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
+  "studio.accessControl.excluded": "対象外",
+  "studio.accessControl.ipPolicy": "IP ポリシー",
+  "studio.accessControl.lockoutWarning": "あなたの IP（{{ip}}）はこのポリシーに含まれていません。アクセスできなくなる可能性があります。",
+  "studio.accessControl.manageIpPolicies": "IP ポリシーを管理",
+  "studio.accessControl.notEnabled": "未有効",
   "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
   "studio.accessControl.paywallTitle": "アクセス制御",
+  "studio.accessControl.policySummaryMany": "{{listed}} とさらに {{count}} 件のアドレスを許可",
+  "studio.accessControl.policySummaryNone": "許可するアドレスはありません",
+  "studio.accessControl.policySummaryOne": "{{address}} を許可",
+  "studio.accessControl.policySummaryTwo": "{{first}} と {{second}} を許可",
   "studio.accessControl.previewAppName": "コードコンパニオン",
   "studio.accessControl.previewCaption": "このアプリは、組織のネットワーク上でのみ利用できます。",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "IP アドレスで制限",
+  "studio.accessControl.saveAnyway": "保存する",
+  "studio.accessControl.saveWithoutOwnIp": "自分の IP を含めずに保存しますか？",
+  "studio.accessControl.selectAccessPoint": "保護するアクセスポイントを少なくとも 1 つ選択してください。",
+  "studio.accessControl.selectPolicy": "ポリシーを選択",
   "studio.accessControl.turnOn": "アクセス制御をオンにする",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 31dfd475da1484..f732e86b7af301 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "데이터 소스",
   "settings.extension": "Extension",
   "settings.integrations": "통합",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 8ed58ff22204e5..887b04e7958ed4 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index 55b0e58ecd2544..cb29d3a1f03aaa 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "ແຫຼ່ງຂໍ້ມູນ",
   "settings.extension": "ສ່ວນຂະຫຍາຍ",
   "settings.integrations": "ການເຊື່ອມຕໍ່",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 64f89ac803bf92..0b15582fa8253b 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ຍັງບໍ່ໄດ້ຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "ກຳລັງຖອນການຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ບໍ່ຮູ້ຈັກ",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 52fb04cec72de0..168e7b91ac2b46 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Data Source",
   "settings.extension": "Extension",
   "settings.integrations": "Integrations",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index a7a6ebb1376b91..8c20c4328289d4 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 9068c36ff1d168..e89d9ea79ea4f4 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Źródło danych",
   "settings.extension": "Extension",
   "settings.integrations": "Integracje",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 058c2e3f2a6a26..2608b5a3b61d6a 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index 2a603c397c5562..b73bbbc18f51de 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Fonte de dados",
   "settings.extension": "Extension",
   "settings.integrations": "Integrações",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 6c5c72f6cc908b..021ec3fa5eabba 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 18c8e7ac479937..9dfb86ca7fe519 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Sursă de date",
   "settings.extension": "Extension",
   "settings.integrations": "Integrări",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 882dd859431ec2..2ee19c830d37e8 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 2ed10ac7214a4e..9403297e621dfa 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Источник данных",
   "settings.extension": "Extension",
   "settings.integrations": "Интеграции",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index f27ef5a7ab1ddb..7e769e00386d76 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index b2d67f7400d4d5..1ab88849a8fd34 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Vir podatkov",
   "settings.extension": "Extension",
   "settings.integrations": "Integracije",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 7fc0994303dcce..9fca0190c102e7 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index ebe96553cb6e16..1174e5a458873f 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "แหล่งข้อมูล",
   "settings.extension": "Extension",
   "settings.integrations": "บูรณาการ",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 859fd6dcffbbca..aeb4dc29bb1e6e 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 1a979ec22ea5a4..07a1fd64e0bab1 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Veri Kaynağı",
   "settings.extension": "Extension",
   "settings.integrations": "Entegrasyonlar",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 3ae695d3abb284..9e7597e7a5caf7 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index a97f8aacce31d8..7f64da9664ea0b 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Джерело даних",
   "settings.extension": "Extension",
   "settings.integrations": "Інтеграції",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 0c7fd802f464e1..795d0116aade5e 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 300eb97cbbc1ee..7a1f224f56eb00 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "Nguồn dữ liệu",
   "settings.extension": "Extension",
   "settings.integrations": "Tích hợp",
+  "settings.ipPolicies": "IP Policies",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index ff8218441333f5..5fd4420a7304d4 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
+  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.applyTo": "Apply to",
+  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
+  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "Excluded",
+  "studio.accessControl.ipPolicy": "IP Policy",
+  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
+  "studio.accessControl.manageIpPolicies": "Manage IP policies",
+  "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryNone": "Allows no addresses",
+  "studio.accessControl.policySummaryOne": "Allows {{address}}",
+  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.saveAnyway": "Save anyway",
+  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
+  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
+  "studio.accessControl.selectPolicy": "Select a policy",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 26552a33ee8795..c0994496b573b6 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "数据来源",
   "settings.extension": "扩展",
   "settings.integrations": "集成",
+  "settings.ipPolicies": "IP 策略",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index d9f9d4bb0572dd..f8ff6a9170b1fd 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下线中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "studio.accessControl.addressCount": "{{count}} 个地址",
+  "studio.accessControl.applyTo": "应用于",
+  "studio.accessControl.applyToHelp": "选择要保护的访问点。",
+  "studio.accessControl.applyToHelpSelected": "选择此策略要保护的访问点。",
+  "studio.accessControl.createIpPolicy": "创建 IP 策略",
+  "studio.accessControl.emptyPoliciesDescription": "策略是允许访问的 IP 地址列表。先创建一条，再回到这里应用。",
+  "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.entryLabel": "访问控制",
+  "studio.accessControl.excluded": "未覆盖",
+  "studio.accessControl.ipPolicy": "IP 策略",
+  "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能会失去访问权限。",
+  "studio.accessControl.manageIpPolicies": "管理 IP 策略",
+  "studio.accessControl.notEnabled": "未启用",
   "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
   "studio.accessControl.paywallTitle": "访问控制",
+  "studio.accessControl.policySummaryMany": "允许 {{listed}} 以及另外 {{count}} 个地址",
+  "studio.accessControl.policySummaryNone": "未允许任何地址",
+  "studio.accessControl.policySummaryOne": "允许 {{address}}",
+  "studio.accessControl.policySummaryTwo": "允许 {{first}} 和 {{second}}",
   "studio.accessControl.previewAppName": "代码助手",
   "studio.accessControl.previewCaption": "此应用仅允许在组织网络中访问。",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "按 IP 地址限制",
+  "studio.accessControl.saveAnyway": "仍要保存",
+  "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情况下保存？",
+  "studio.accessControl.selectAccessPoint": "请至少选择一个要保护的访问点。",
+  "studio.accessControl.selectPolicy": "选择策略",
   "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
   "studio.accessPoint.description": "此应用的所有访问方式。访问点仅对应当前运行版本。",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 7b001d7afb5240..04beac4950952f 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -549,6 +549,7 @@
   "settings.dataSource": "資料來源",
   "settings.extension": "擴充",
   "settings.integrations": "集成",
+  "settings.ipPolicies": "IP 策略",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 97bd64423154ea..8e5298585efd81 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -33,12 +33,33 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下線中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
+  "studio.accessControl.addressCount": "{{count}} 個地址",
+  "studio.accessControl.applyTo": "套用至",
+  "studio.accessControl.applyToHelp": "選擇要保護的存取點。",
+  "studio.accessControl.applyToHelpSelected": "選擇此策略要保護的存取點。",
+  "studio.accessControl.createIpPolicy": "建立 IP 策略",
+  "studio.accessControl.emptyPoliciesDescription": "策略是允許存取的 IP 位址清單。先建立一條，再回到這裡套用。",
+  "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
   "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.excluded": "未涵蓋",
+  "studio.accessControl.ipPolicy": "IP 策略",
+  "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能會失去存取權限。",
+  "studio.accessControl.manageIpPolicies": "管理 IP 策略",
+  "studio.accessControl.notEnabled": "未啟用",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policySummaryMany": "允許 {{listed}} 以及另外 {{count}} 個地址",
+  "studio.accessControl.policySummaryNone": "未允許任何地址",
+  "studio.accessControl.policySummaryOne": "允許 {{address}}",
+  "studio.accessControl.policySummaryTwo": "允許 {{first}} 和 {{second}}",
   "studio.accessControl.previewAppName": "程式助手",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.restrictByIp": "依 IP 位址限制",
+  "studio.accessControl.saveAnyway": "仍要儲存",
+  "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情況下儲存？",
+  "studio.accessControl.selectAccessPoint": "請至少選擇一個要保護的存取點。",
+  "studio.accessControl.selectPolicy": "選擇策略",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",

From 69684a3d1a3702a122674d6a1b8fa01a1e3943a3 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 8 Sep 2026 17:28:56 +0800
Subject: [PATCH 010/108] feat(web): add Access Control chip states for paid
 first-open

Paid Cloud chips show Off, ON, n of m, or paused. Clicking Off opens L2; configured chips open L1. Sandbox still uses the PRO paywall.
---
 .../__tests__/chip-status.spec.ts             | 101 +++++++++++
 .../__tests__/config-panel.spec.tsx           |   1 +
 .../access-control/__tests__/index.spec.tsx   |   8 +-
 .../access-control/chip-affix.tsx             |  60 +++++++
 .../access-control/chip-status.ts             |  69 ++++++++
 .../app/access-point/access-control/draft.ts  |  12 +-
 .../app/access-point/access-control/index.tsx | 161 +++++++++++-------
 .../access-control/status-panel.tsx           |  83 ++++++++-
 web/i18n/ar-TN/deployments.json               |  14 ++
 web/i18n/de-DE/deployments.json               |  14 ++
 web/i18n/en-US/deployments.json               |  14 ++
 web/i18n/es-ES/deployments.json               |  14 ++
 web/i18n/fa-IR/deployments.json               |  14 ++
 web/i18n/fr-FR/deployments.json               |  14 ++
 web/i18n/hi-IN/deployments.json               |  14 ++
 web/i18n/id-ID/deployments.json               |  14 ++
 web/i18n/it-IT/deployments.json               |  14 ++
 web/i18n/ja-JP/deployments.json               |  14 ++
 web/i18n/ko-KR/deployments.json               |  14 ++
 web/i18n/lo-LA/deployments.json               |  14 ++
 web/i18n/nl-NL/deployments.json               |  14 ++
 web/i18n/pl-PL/deployments.json               |  14 ++
 web/i18n/pt-BR/deployments.json               |  14 ++
 web/i18n/ro-RO/deployments.json               |  14 ++
 web/i18n/ru-RU/deployments.json               |  14 ++
 web/i18n/sl-SI/deployments.json               |  14 ++
 web/i18n/th-TH/deployments.json               |  14 ++
 web/i18n/tr-TR/deployments.json               |  14 ++
 web/i18n/uk-UA/deployments.json               |  14 ++
 web/i18n/vi-VN/deployments.json               |  14 ++
 web/i18n/zh-Hans/deployments.json             |  14 ++
 web/i18n/zh-Hant/deployments.json             |  14 ++
 32 files changed, 760 insertions(+), 71 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
 create mode 100644 web/app/components/app/access-point/access-control/chip-affix.tsx
 create mode 100644 web/app/components/app/access-point/access-control/chip-status.ts

diff --git a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
new file mode 100644
index 00000000000000..8fabb749713e17
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
@@ -0,0 +1,101 @@
+import { getAccessControlChipState, getInServiceCoverage } from '../chip-status'
+
+const availability = {
+  webApp: true,
+  serviceApi: true,
+  mcp: true,
+  trigger: false,
+}
+
+const assignment = {
+  policyId: 'internal-network',
+  policyName: 'Internal Network',
+  scopes: {
+    webApp: true,
+    serviceApi: true,
+    mcp: true,
+    trigger: false,
+  },
+  enabled: true,
+}
+
+describe('getInServiceCoverage', () => {
+  it('ignores unavailable access points in the denominator', () => {
+    expect(
+      getInServiceCoverage(
+        { webApp: true, serviceApi: true, mcp: false, trigger: true },
+        availability,
+      ),
+    ).toEqual({ coveredCount: 2, inServiceCount: 3 })
+  })
+})
+
+describe('getAccessControlChipState', () => {
+  it('returns pro for Cloud sandbox', () => {
+    expect(
+      getAccessControlChipState({
+        plan: 'sandbox',
+        assignment,
+        availability,
+      }).kind,
+    ).toBe('pro')
+  })
+
+  it('returns off when the app has never been configured', () => {
+    expect(
+      getAccessControlChipState({
+        plan: 'professional',
+        assignment: null,
+        availability,
+      }),
+    ).toEqual({ kind: 'off', coveredCount: 0, inServiceCount: 0 })
+  })
+
+  it('returns paused when a saved policy is not enforcing', () => {
+    expect(
+      getAccessControlChipState({
+        plan: 'professional',
+        assignment: { ...assignment, enabled: false },
+        availability,
+      }),
+    ).toEqual({
+      kind: 'paused',
+      policyName: 'Internal Network',
+      coveredCount: 3,
+      inServiceCount: 3,
+    })
+  })
+
+  it('returns on when every in-service access point is covered', () => {
+    expect(
+      getAccessControlChipState({
+        plan: 'team',
+        assignment,
+        availability,
+      }),
+    ).toEqual({
+      kind: 'on',
+      policyName: 'Internal Network',
+      coveredCount: 3,
+      inServiceCount: 3,
+    })
+  })
+
+  it('returns partial when some in-service access points are excluded', () => {
+    expect(
+      getAccessControlChipState({
+        plan: 'professional',
+        assignment: {
+          ...assignment,
+          scopes: { ...assignment.scopes, mcp: false },
+        },
+        availability,
+      }),
+    ).toEqual({
+      kind: 'partial',
+      policyName: 'Internal Network',
+      coveredCount: 2,
+      inServiceCount: 3,
+    })
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index 80807b3982645b..a24e085e94d863 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -132,6 +132,7 @@ describe('AccessControlConfigPanel', () => {
     await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
     await user.click(screen.getByRole('switch', { name: 'Backend Service API' }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
 
     expect(screen.getByText('Select at least one access point to protect.')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 5c6ab09626aa6b..9502de6902e82e 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -20,6 +20,9 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.emptyPoliciesDescription':
     'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
   'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
+  'studio.accessControl.chipOff': 'Off',
+  'studio.accessControl.chipOn': 'ON',
+  'studio.accessControl.chipPartial': '{{n}} of {{m}}',
   'studio.accessControl.entryLabel': 'Access Control',
   'studio.accessControl.ipPolicy': 'IP Policy',
   'studio.accessControl.notEnabled': 'Not enabled',
@@ -29,6 +32,8 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.previewCaption':
     "This app is only available on your organization's network.",
   'studio.accessControl.proBadge': 'PRO',
+  'studio.accessControl.tooltipOff': 'Not set up',
+  'studio.accessControl.tooltipPro': 'Access control requires the Pro plan',
   'studio.accessControl.turnOn': 'Turn on Access Control',
 }))
 
@@ -106,12 +111,13 @@ describe('AccessControlEntry', () => {
   })
 
   it.each(['professional', 'team'] as const)(
-    'renders the Access Control chip without a PRO badge on Cloud %s',
+    'renders the unpaid-config Off chip on Cloud %s',
     (plan) => {
       renderEntry({ plan })
 
       const chip = getChip()
       expect(chip).toBeInTheDocument()
+      expect(within(chip).getByText('Off')).toBeInTheDocument()
       expect(within(chip).queryByText('PRO')).not.toBeInTheDocument()
     },
   )
diff --git a/web/app/components/app/access-point/access-control/chip-affix.tsx b/web/app/components/app/access-point/access-control/chip-affix.tsx
new file mode 100644
index 00000000000000..842f72ea1c1d3d
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/chip-affix.tsx
@@ -0,0 +1,60 @@
+'use client'
+
+import type { AccessControlChipKind } from './chip-status'
+import { StatusDot } from '@langgenius/dify-ui/status-dot'
+import { useTranslation } from 'react-i18next'
+import PremiumBadge from '@/app/components/base/premium-badge'
+
+type AccessControlChipAffixProps = {
+  kind: AccessControlChipKind
+  coveredCount: number
+  inServiceCount: number
+}
+
+export function AccessControlChipAffix({
+  kind,
+  coveredCount,
+  inServiceCount,
+}: AccessControlChipAffixProps) {
+  const { t } = useTranslation()
+
+  if (kind === 'pro') {
+    return (
+      <PremiumBadge size="s" color="blue">
+        <span
+          aria-hidden
+          className="i-custom-public-common-sparkles-soft flex h-3.5 w-3.5 items-center py-px pl-0.75 text-components-premium-badge-indigo-text-stop-0"
+        />
+        <span className="system-xs-medium">
+          {t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })}
+        </span>
+      </PremiumBadge>
+    )
+  }
+
+  const statusLabel =
+    kind === 'on'
+      ? t(($) => $['studio.accessControl.chipOn'], { ns: 'deployments' })
+      : kind === 'partial'
+        ? t(($) => $['studio.accessControl.chipPartial'], {
+            ns: 'deployments',
+            n: coveredCount,
+            m: inServiceCount,
+          })
+        : t(($) => $['studio.accessControl.chipOff'], { ns: 'deployments' })
+
+  return (
+    <>
+      <span aria-hidden className="h-3.5 w-px bg-divider-regular" />
+      <span className="flex items-center gap-1">
+        <span className="flex size-3 items-center justify-center">
+          <StatusDot
+            size="medium"
+            status={kind === 'off' ? 'disabled' : kind === 'paused' ? 'warning' : 'success'}
+          />
+        </span>
+        <span className="system-xs-semibold text-text-tertiary uppercase">{statusLabel}</span>
+      </span>
+    </>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/chip-status.ts b/web/app/components/app/access-point/access-control/chip-status.ts
new file mode 100644
index 00000000000000..afd3b87adb2626
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/chip-status.ts
@@ -0,0 +1,69 @@
+import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+
+export type AccessControlAssignment = {
+  policyId: string
+  policyName: string
+  scopes: AccessControlDraft['scopes']
+  enabled: boolean
+}
+
+export type AccessControlChipKind = 'pro' | 'off' | 'paused' | 'on' | 'partial'
+
+export type AccessControlChipState = {
+  kind: AccessControlChipKind
+  coveredCount: number
+  inServiceCount: number
+  policyName?: string
+}
+
+export function getInServiceCoverage(
+  scopes: Record<AccessPoint, boolean>,
+  availability: AccessControlScopeAvailability,
+) {
+  const inService = ACCESS_POINT_ORDER.filter((scope) => availability[scope])
+  const covered = inService.filter((scope) => scopes[scope])
+
+  return {
+    coveredCount: covered.length,
+    inServiceCount: inService.length,
+  }
+}
+
+export function getAccessControlChipState({
+  plan,
+  assignment,
+  availability,
+}: {
+  plan: string | undefined
+  assignment: AccessControlAssignment | null
+  availability: AccessControlScopeAvailability
+}): AccessControlChipState {
+  if (plan === 'sandbox') {
+    return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
+  }
+
+  if (!assignment) {
+    return { kind: 'off', coveredCount: 0, inServiceCount: 0 }
+  }
+
+  const coverage = getInServiceCoverage(assignment.scopes, availability)
+
+  if (!assignment.enabled) {
+    return {
+      kind: 'paused',
+      policyName: assignment.policyName,
+      ...coverage,
+    }
+  }
+
+  return {
+    kind:
+      coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
+        ? 'on'
+        : 'partial',
+    policyName: assignment.policyName,
+    ...coverage,
+  }
+}
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
index c9eb0aac937e31..4f2d266551da0c 100644
--- a/web/app/components/app/access-point/access-control/draft.ts
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -15,13 +15,15 @@ export type AccessControlDraft = {
   scopes: Record<AccessPoint, boolean>
 }
 
-export const createDefaultAccessControlDraft = (): AccessControlDraft => ({
+export const createDefaultAccessControlDraft = (
+  availability?: AccessControlScopeAvailability,
+): AccessControlDraft => ({
   selectedPolicyId: null,
   scopes: {
-    webApp: true,
-    serviceApi: true,
-    mcp: false,
-    trigger: false,
+    webApp: availability?.webApp ?? true,
+    serviceApi: availability?.serviceApi ?? true,
+    mcp: availability?.mcp ?? true,
+    trigger: availability?.trigger ?? false,
   },
 })
 
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 8d67ea4e28ad78..24fc1f99f0143d 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -1,14 +1,15 @@
 'use client'
 
-import type { AccessControlDraft } from './draft'
+import type { AccessControlAssignment } from './chip-status'
+import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
-import PremiumBadge from '@/app/components/base/premium-badge'
 import {
   settingsQueryParamName,
   settingsQueryParser,
@@ -18,6 +19,8 @@ import { deploymentEditionAtom } from '@/features/system-features/state'
 import { consoleQuery } from '@/service/console'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
+import { AccessControlChipAffix } from './chip-affix'
+import { getAccessControlChipState } from './chip-status'
 import { AccessControlConfigPanel } from './config-panel'
 import { createDefaultAccessControlDraft, getAccessControlScopeAvailability } from './draft'
 import { AccessControlFreePaywall } from './free-paywall'
@@ -44,22 +47,58 @@ export function AccessControlEntry() {
   const shouldFetchWorkflow = isPaid && Boolean(appInfo && isAdvancedApp(appInfo))
   const { data: workflow } = useAppWorkflow(shouldFetchWorkflow && appInfo ? appInfo.id : '')
   const [open, setOpen] = useState(false)
-  const [view, setView] = useState<'config' | 'status'>('config')
+  const [view, setView] = useState<'config' | 'status'>('status')
   const [showBack, setShowBack] = useState(false)
-  const [draft, setDraft] = useState<AccessControlDraft>(createDefaultAccessControlDraft)
+  const [draft, setDraft] = useState<AccessControlDraft | null>(null)
   const [savedDraft, setSavedDraft] = useState<AccessControlDraft | null>(null)
+  const [enabled, setEnabled] = useState(true)
 
   if (deploymentEdition !== 'CLOUD' || (!isSandbox && !isPaid)) return null
 
   const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
-  const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
   const workflowState = appInfo ? getPublishedWorkflowState(appInfo, workflow) : undefined
   const availability = getAccessControlScopeAvailability({
     mode: appInfo?.mode,
     hasTriggerNode: Boolean(workflowState?.hasTriggerNode),
     isUnpublished: Boolean(workflowState?.isUnpublished),
   })
-  const policies = [] as const
+  const policies: readonly AccessControlPolicy[] = []
+  const resolvedDraft = draft ?? savedDraft ?? createDefaultAccessControlDraft(availability)
+  const assignment: AccessControlAssignment | null = savedDraft?.selectedPolicyId
+    ? {
+        policyId: savedDraft.selectedPolicyId,
+        policyName:
+          policies.find((policy) => policy.id === savedDraft.selectedPolicyId)?.name ??
+          savedDraft.selectedPolicyId,
+        scopes: savedDraft.scopes,
+        enabled,
+      }
+    : null
+  const chip = getAccessControlChipState({ plan, assignment, availability })
+  const showPaywall = chip.kind === 'pro'
+  const showStatus = Boolean(assignment) && view === 'status'
+
+  const tooltip =
+    chip.kind === 'pro'
+      ? t(($) => $['studio.accessControl.tooltipPro'], { ns: 'deployments' })
+      : chip.kind === 'paused'
+        ? t(($) => $['studio.accessControl.tooltipPaused'], {
+            ns: 'deployments',
+            name: chip.policyName ?? '',
+          })
+        : chip.kind === 'on'
+          ? t(($) => $['studio.accessControl.tooltipOn'], {
+              ns: 'deployments',
+              name: chip.policyName ?? '',
+            })
+          : chip.kind === 'partial'
+            ? t(($) => $['studio.accessControl.tooltipPartial'], {
+                ns: 'deployments',
+                name: chip.policyName ?? '',
+                n: chip.coveredCount,
+                m: chip.inServiceCount,
+              })
+            : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
   const handleTurnOn = () => {
     setShowPricingModal()
@@ -67,13 +106,9 @@ export function AccessControlEntry() {
     if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
   }
 
-  const resetDraft = () => {
-    setDraft(savedDraft ?? createDefaultAccessControlDraft())
-  }
-
   const handleCancel = () => {
-    resetDraft()
-    if (savedDraft) {
+    setDraft(null)
+    if (assignment) {
       setView('status')
       setShowBack(false)
       return
@@ -87,59 +122,65 @@ export function AccessControlEntry() {
   }
 
   const handleSave = () => {
-    setSavedDraft(draft)
+    setSavedDraft(resolvedDraft)
+    setEnabled(true)
+    setDraft(null)
     setView('status')
     setShowBack(false)
   }
 
   return (
-    <Popover open={open} onOpenChange={setOpen}>
-      <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid">
-        <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
-        <span className="system-sm-medium text-text-secondary">{label}</span>
-        {isSandbox && (
-          <PremiumBadge size="s" color="blue">
-            <span
-              aria-hidden
-              className="i-custom-public-common-sparkles-soft flex h-3.5 w-3.5 items-center py-px pl-0.75 text-components-premium-badge-indigo-text-stop-0"
-            />
-            <span className="system-xs-medium">{pro}</span>
-          </PremiumBadge>
-        )}
-      </PopoverTrigger>
-      <PopoverContent
-        placement="bottom-end"
-        className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
-      >
-        {isSandbox ? (
-          <AccessControlFreePaywall onTurnOn={handleTurnOn} />
-        ) : view === 'status' && savedDraft ? (
-          <AccessControlStatusPanel
-            draft={savedDraft}
-            policies={policies}
-            enabled
-            availability={availability}
-            onEdit={() => {
-              setDraft(savedDraft)
-              setShowBack(true)
-              setView('config')
-            }}
+    <Tooltip>
+      <Popover open={open} onOpenChange={setOpen}>
+        <TooltipTrigger
+          render={
+            <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid" />
+          }
+        >
+          <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
+          <span className="system-sm-medium text-text-secondary">{label}</span>
+          <AccessControlChipAffix
+            kind={chip.kind}
+            coveredCount={chip.coveredCount}
+            inServiceCount={chip.inServiceCount}
           />
-        ) : (
-          <AccessControlConfigPanel
-            draft={draft}
-            policies={policies}
-            availability={availability}
-            showBack={showBack}
-            onBack={handleCancel}
-            onCancel={handleCancel}
-            onCreatePolicy={handleCreatePolicy}
-            onManagePolicies={handleCreatePolicy}
-            onDraftChange={setDraft}
-            onSave={handleSave}
-          />
-        )}
-      </PopoverContent>
-    </Popover>
+        </TooltipTrigger>
+        <PopoverContent
+          placement="bottom-end"
+          className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
+        >
+          {showPaywall ? (
+            <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+          ) : showStatus && savedDraft ? (
+            <AccessControlStatusPanel
+              draft={savedDraft}
+              policies={policies}
+              enabled={enabled}
+              availability={availability}
+              onEnabledChange={setEnabled}
+              onEdit={() => {
+                setDraft(savedDraft)
+                setShowBack(true)
+                setView('config')
+              }}
+            />
+          ) : (
+            <AccessControlConfigPanel
+              draft={resolvedDraft}
+              policies={policies}
+              availability={availability}
+              showBack={showBack}
+              onBack={handleCancel}
+              onCancel={handleCancel}
+              onCreatePolicy={handleCreatePolicy}
+              onManagePolicies={handleCreatePolicy}
+              onDraftChange={setDraft}
+              onSave={handleSave}
+            />
+          )}
+        </PopoverContent>
+      </Popover>
+      <TooltipContent>{tooltip}</TooltipContent>
+    </Tooltip>
   )
 }
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index df183b9d749b9e..e887c5f583a2fe 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -6,14 +6,25 @@ import type {
   AccessControlScopeAvailability,
 } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { PopoverTitle } from '@langgenius/dify-ui/popover'
 import { Switch } from '@langgenius/dify-ui/switch'
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
+import { getInServiceCoverage } from './chip-status'
 import { isProtectableAccessPoint, splitPolicySummary } from './draft'
 
 const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
@@ -28,6 +39,7 @@ type AccessControlStatusPanelProps = {
   enabled: boolean
   availability: AccessControlScopeAvailability
   onEdit: () => void
+  onEnabledChange: (enabled: boolean) => void
 }
 
 export function AccessControlStatusPanel({
@@ -36,23 +48,35 @@ export function AccessControlStatusPanel({
   enabled,
   availability,
   onEdit,
+  onEnabledChange,
 }: AccessControlStatusPanelProps) {
   const { t } = useTranslation()
   const appInfo = useAppStore((state) => state.appDetail)
+  const [confirmPause, setConfirmPause] = useState(false)
   const selectedPolicy = policies.find((policy) => policy.id === draft.selectedPolicyId)
   const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.addresses) : undefined
+  const coverage = getInServiceCoverage(draft.scopes, availability)
   const labels: Record<AccessPoint, string> = {
     webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
     serviceApi: t(($) => $['overview.apiInfo.title'], { ns: 'appOverview' }),
     mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
     trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
   }
+  const exposedNames = ACCESS_POINT_ORDER.filter(
+    (scope) => availability[scope] && draft.scopes[scope],
+  ).map((scope) => labels[scope])
+  const policyName = selectedPolicy?.name
 
   return (
     <div className="flex w-100 flex-col">
       <div className="flex items-center justify-between gap-2 overflow-hidden px-4 pt-4 pb-3">
         <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
-          {t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
+          {policyName
+            ? t(($) => $['studio.accessControl.restrictedTo'], {
+                ns: 'deployments',
+                name: policyName,
+              })
+            : t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
         </PopoverTitle>
         <Button type="button" variant="ghost" size="small" onClick={onEdit}>
           {t(($) => $['operation.edit'], { ns: 'common' })}
@@ -61,13 +85,33 @@ export function AccessControlStatusPanel({
 
       <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
         <div className="flex items-center justify-between gap-2">
-          <p className="system-md-medium text-text-primary">
-            {t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
-          </p>
+          <div className="flex min-w-0 flex-col gap-0.5">
+            <p className="system-md-medium text-text-primary">
+              {t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
+            </p>
+            <p className="system-xs-regular text-text-tertiary">
+              {coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
+                ? t(($) => $['studio.accessControl.protectingAll'], {
+                    ns: 'deployments',
+                    count: coverage.inServiceCount,
+                  })
+                : t(($) => $['studio.accessControl.protectingPartial'], {
+                    ns: 'deployments',
+                    n: coverage.coveredCount,
+                    m: coverage.inServiceCount,
+                  })}
+            </p>
+          </div>
           <Switch
             checked={enabled}
-            readOnly
             aria-label={t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
+            onCheckedChange={(next) => {
+              if (next) {
+                onEnabledChange(true)
+                return
+              }
+              setConfirmPause(true)
+            }}
           />
         </div>
 
@@ -159,6 +203,35 @@ export function AccessControlStatusPanel({
           })}
         </div>
       </div>
+
+      <AlertDialog open={confirmPause} onOpenChange={setConfirmPause}>
+        <AlertDialogContent className="w-100">
+          <div className="flex flex-col gap-2 p-6 pb-4">
+            <AlertDialogTitle className="title-xl-semi-bold text-text-primary">
+              {t(($) => $['studio.accessControl.turnOffTitle'], { ns: 'deployments' })}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="system-sm-regular text-text-secondary">
+              {t(($) => $['studio.accessControl.turnOffDescription'], {
+                ns: 'deployments',
+                points: exposedNames.join(', '),
+              })}
+            </AlertDialogDescription>
+          </div>
+          <AlertDialogActions>
+            <AlertDialogCancelButton variant="secondary">
+              {t(($) => $['operation.cancel'], { ns: 'common' })}
+            </AlertDialogCancelButton>
+            <AlertDialogConfirmButton
+              onClick={() => {
+                onEnabledChange(false)
+                setConfirmPause(false)
+              }}
+            >
+              {t(($) => $['studio.accessControl.turnOffConfirm'], { ns: 'deployments' })}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
     </div>
   )
 }
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 6967b45226f9ed..47a0077a600473 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index d8281bef9db2b2..e8aaa306986ab6 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index ad64f218d884f1..40c2e37a7d3c61 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Integrate the app into your services over HTTP",
   "studio.accessPoint.description": "All the ways this app can be reached. Access points match the running version only.",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index d53482ed7d19cd..1b491ba695fa92 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index b633101ad7f932..3da73b07904998 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index ffabe66308f0fe..876e0692c737c8 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 059de2b575870f..e65c5cc49ca364 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 0397c16eb99d47..bc2150db7414b1 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 80e473a8fbee20..06617769cf28cc 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index eadccd20e22cd2..8caa284e94c549 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "適用先",
   "studio.accessControl.applyToHelp": "保護するアクセスポイントを選択します。",
   "studio.accessControl.applyToHelpSelected": "このポリシーで保護するアクセスポイントを選択します。",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
   "studio.accessControl.emptyPoliciesDescription": "ポリシーは許可する IP アドレスの一覧です。作成してから、ここに戻って適用してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "コードコンパニオン",
   "studio.accessControl.previewCaption": "このアプリは、組織のネットワーク上でのみ利用できます。",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "稼働中のアクセスポイント {{count}} 件すべてを保護しています。",
+  "studio.accessControl.protectingPartial": "稼働中のアクセスポイント {{m}} 件中 {{n}} 件を保護しています。",
   "studio.accessControl.restrictByIp": "IP アドレスで制限",
+  "studio.accessControl.restrictedTo": "{{name}} に制限",
   "studio.accessControl.saveAnyway": "保存する",
   "studio.accessControl.saveWithoutOwnIp": "自分の IP を含めずに保存しますか？",
   "studio.accessControl.selectAccessPoint": "保護するアクセスポイントを少なくとも 1 つ選択してください。",
   "studio.accessControl.selectPolicy": "ポリシーを選択",
+  "studio.accessControl.tooltipOff": "未設定",
+  "studio.accessControl.tooltipOn": "{{name}}、すべてのアクセスポイント",
+  "studio.accessControl.tooltipPartial": "{{name}}、{{n}} / {{m}} のアクセスポイント",
+  "studio.accessControl.tooltipPaused": "一時停止 — {{name}} は設定済みですが適用されていません",
+  "studio.accessControl.tooltipPro": "アクセス制御には Pro プランが必要です",
+  "studio.accessControl.turnOffConfirm": "オフにする",
+  "studio.accessControl.turnOffDescription": "{{points}} は任意の IP から到達できるようになります。",
+  "studio.accessControl.turnOffTitle": "アクセス制御をオフにしますか？",
   "studio.accessControl.turnOn": "アクセス制御をオンにする",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 887b04e7958ed4..565a340e7a5833 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 0b15582fa8253b..14ff57cefa7a0b 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 8c20c4328289d4..352fb5e69d87a1 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 2608b5a3b61d6a..2d1e134e80a678 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 021ec3fa5eabba..2d80b823e9b166 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 2ee19c830d37e8..41ee3dbd032c60 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index 7e769e00386d76..edb87e9bd767b4 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 9fca0190c102e7..8c73bb434a07ec 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index aeb4dc29bb1e6e..78313160ac624a 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 9e7597e7a5caf7..3704c873ee6d6f 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 795d0116aade5e..eac5c4b1ed883a 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 5fd4420a7304d4..3080f70f9996d3 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points to protect.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "Code Companion",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
+  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
+  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.tooltipOff": "Not set up",
+  "studio.accessControl.tooltipOn": "{{name}}, all access points",
+  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.turnOffConfirm": "Turn off",
+  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
+  "studio.accessControl.turnOffTitle": "Turn off access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index f8ff6a9170b1fd..7b8a36b31b546e 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "应用于",
   "studio.accessControl.applyToHelp": "选择要保护的访问点。",
   "studio.accessControl.applyToHelpSelected": "选择此策略要保护的访问点。",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "创建 IP 策略",
   "studio.accessControl.emptyPoliciesDescription": "策略是允许访问的 IP 地址列表。先创建一条，再回到这里应用。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "代码助手",
   "studio.accessControl.previewCaption": "此应用仅允许在组织网络中访问。",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个在服务中的访问点。",
+  "studio.accessControl.protectingPartial": "正在保护 {{n}} / {{m}} 个在服务中的访问点。",
   "studio.accessControl.restrictByIp": "按 IP 地址限制",
+  "studio.accessControl.restrictedTo": "已限制为 {{name}}",
   "studio.accessControl.saveAnyway": "仍要保存",
   "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情况下保存？",
   "studio.accessControl.selectAccessPoint": "请至少选择一个要保护的访问点。",
   "studio.accessControl.selectPolicy": "选择策略",
+  "studio.accessControl.tooltipOff": "尚未配置",
+  "studio.accessControl.tooltipOn": "{{name}}，覆盖全部访问点",
+  "studio.accessControl.tooltipPartial": "{{name}}，{{n}} / {{m}} 个访问点",
+  "studio.accessControl.tooltipPaused": "已暂停 — {{name}} 已配置但未生效",
+  "studio.accessControl.tooltipPro": "访问控制需要 Pro 套餐",
+  "studio.accessControl.turnOffConfirm": "关闭",
+  "studio.accessControl.turnOffDescription": "{{points}} 将可被任意 IP 访问。",
+  "studio.accessControl.turnOffTitle": "关闭访问控制？",
   "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
   "studio.accessPoint.description": "此应用的所有访问方式。访问点仅对应当前运行版本。",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 8e5298585efd81..f865016900c01a 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -37,6 +37,9 @@
   "studio.accessControl.applyTo": "套用至",
   "studio.accessControl.applyToHelp": "選擇要保護的存取點。",
   "studio.accessControl.applyToHelpSelected": "選擇此策略要保護的存取點。",
+  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "建立 IP 策略",
   "studio.accessControl.emptyPoliciesDescription": "策略是允許存取的 IP 位址清單。先建立一條，再回到這裡套用。",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
@@ -55,11 +58,22 @@
   "studio.accessControl.previewAppName": "程式助手",
   "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
   "studio.accessControl.proBadge": "PRO",
+  "studio.accessControl.protectingAll": "正在保護全部 {{count}} 個服務中的存取點。",
+  "studio.accessControl.protectingPartial": "正在保護 {{n}} / {{m}} 個服務中的存取點。",
   "studio.accessControl.restrictByIp": "依 IP 位址限制",
+  "studio.accessControl.restrictedTo": "已限制為 {{name}}",
   "studio.accessControl.saveAnyway": "仍要儲存",
   "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情況下儲存？",
   "studio.accessControl.selectAccessPoint": "請至少選擇一個要保護的存取點。",
   "studio.accessControl.selectPolicy": "選擇策略",
+  "studio.accessControl.tooltipOff": "尚未設定",
+  "studio.accessControl.tooltipOn": "{{name}}，涵蓋全部存取點",
+  "studio.accessControl.tooltipPartial": "{{name}}，{{n}} / {{m}} 個存取點",
+  "studio.accessControl.tooltipPaused": "已暫停 — {{name}} 已設定但未生效",
+  "studio.accessControl.tooltipPro": "存取控制需要 Pro 方案",
+  "studio.accessControl.turnOffConfirm": "關閉",
+  "studio.accessControl.turnOffDescription": "{{points}} 將可被任意 IP 存取。",
+  "studio.accessControl.turnOffTitle": "關閉存取控制？",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",

From 7e886303c8896ada9be012c414932d9288d41238 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Wed, 9 Sep 2026 13:47:11 +0800
Subject: [PATCH 011/108] feat(web): add Settings IP Policy create dialog

Add the New IP Policy dialog and empty list host. Allowlist rows validate IPv4, IPv6, and CIDR live, and Create stays disabled until the name and at least one valid entry are filled.
---
 .../ip-policies-page/__tests__/index.spec.tsx |  43 ++++++
 .../__tests__/policy-dialog.spec.tsx          | 113 ++++++++++++++
 .../__tests__/validate-ip-entry.spec.ts       |  88 +++++++++++
 .../ip-policies-page/allowlist-field.tsx      | 142 ++++++++++++++++++
 .../ip-policies-page/allowlist-row.ts         |   8 +
 .../ip-policies-page/index.tsx                |  36 ++++-
 .../ip-policies-page/policy-dialog.tsx        | 118 +++++++++++++++
 .../ip-policies-page/validate-ip-entry.ts     | 117 +++++++++++++++
 web/i18n/ar-TN/common.json                    |  20 +++
 web/i18n/de-DE/common.json                    |  20 +++
 web/i18n/en-US/common.json                    |  20 +++
 web/i18n/es-ES/common.json                    |  20 +++
 web/i18n/fa-IR/common.json                    |  20 +++
 web/i18n/fr-FR/common.json                    |  20 +++
 web/i18n/hi-IN/common.json                    |  20 +++
 web/i18n/id-ID/common.json                    |  20 +++
 web/i18n/it-IT/common.json                    |  20 +++
 web/i18n/ja-JP/common.json                    |  20 +++
 web/i18n/ko-KR/common.json                    |  20 +++
 web/i18n/lo-LA/common.json                    |  20 +++
 web/i18n/nl-NL/common.json                    |  20 +++
 web/i18n/pl-PL/common.json                    |  20 +++
 web/i18n/pt-BR/common.json                    |  20 +++
 web/i18n/ro-RO/common.json                    |  20 +++
 web/i18n/ru-RU/common.json                    |  20 +++
 web/i18n/sl-SI/common.json                    |  20 +++
 web/i18n/th-TH/common.json                    |  20 +++
 web/i18n/tr-TR/common.json                    |  20 +++
 web/i18n/uk-UA/common.json                    |  20 +++
 web/i18n/vi-VN/common.json                    |  20 +++
 web/i18n/zh-Hans/common.json                  |  20 +++
 web/i18n/zh-Hant/common.json                  |  20 +++
 32 files changed, 1138 insertions(+), 7 deletions(-)
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/allowlist-row.ts
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
new file mode 100644
index 00000000000000..6ca76bf5378d5d
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -0,0 +1,43 @@
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { render } from '@/test/console/render'
+import IpPoliciesPage from '..'
+
+const translations = vi.hoisted(() => ({
+  'operation.cancel': 'Cancel',
+  'operation.close': 'Close',
+  'settings.ipPolicies': 'IP Policies',
+  'settings.ipPoliciesDescription':
+    'Reusable rules that control which IP addresses or ranges can access your apps',
+  'settings.ipPolicyAddEntry': 'Add',
+  'settings.ipPolicyAllowlist': 'Allowlist',
+  'settings.ipPolicyAllowlistHelp':
+    'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
+  'settings.ipPolicyCreate': 'Create',
+  'settings.ipPolicyDialogDescription':
+    'Specify which IP addresses or ranges can access your apps.',
+  'settings.ipPolicyName': 'Name',
+  'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
+  'settings.ipPolicyNewTitle': 'New IP Policy',
+  'settings.ipPolicyRemoveEntry': 'Remove entry',
+  'studio.accessControl.emptyPoliciesDescription':
+    'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
+  'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
+}))
+
+vi.mock('react-i18next', async () => {
+  const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  return createReactI18nextMock(translations)
+})
+
+describe('IpPoliciesPage', () => {
+  it('opens the new policy dialog from Add', async () => {
+    const user = userEvent.setup()
+    render(<IpPoliciesPage />)
+
+    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Add' }))
+    expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+  })
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
new file mode 100644
index 00000000000000..a1388915e35a57
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -0,0 +1,113 @@
+import { screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useState } from 'react'
+import { render } from '@/test/console/render'
+import { IpPolicyDialog } from '../policy-dialog'
+
+const translations = vi.hoisted(() => ({
+  'operation.cancel': 'Cancel',
+  'operation.close': 'Close',
+  'operation.save': 'Save',
+  'settings.ipPolicyAddCurrentIp': 'Add it',
+  'settings.ipPolicyAddEntry': 'Add',
+  'settings.ipPolicyAllowlist': 'Allowlist',
+  'settings.ipPolicyAllowlistHelp':
+    'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
+  'settings.ipPolicyCreate': 'Create',
+  'settings.ipPolicyCurrentIp': 'Your current IP is {{ip}}',
+  'settings.ipPolicyDialogDescription':
+    'Specify which IP addresses or ranges can access your apps.',
+  'settings.ipPolicyEntryOctetRange': 'Each octet must be 0–255',
+  'settings.ipPolicyName': 'Name',
+  'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
+  'settings.ipPolicyNewTitle': 'New IP Policy',
+  'settings.ipPolicyRemoveEntry': 'Remove entry',
+}))
+
+vi.mock('react-i18next', async () => {
+  const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  return createReactI18nextMock(translations)
+})
+
+function DialogHarness({
+  currentIp,
+  onSubmit = vi.fn(),
+}: {
+  currentIp?: string
+  onSubmit?: (payload: { name: string; addresses: string[] }) => void
+}) {
+  const [open, setOpen] = useState(true)
+  return (
+    <IpPolicyDialog
+      mode="create"
+      open={open}
+      currentIp={currentIp}
+      onOpenChange={setOpen}
+      onSubmit={onSubmit}
+    />
+  )
+}
+
+describe('IpPolicyDialog', () => {
+  it('keeps Create disabled until the name and a valid entry are filled', async () => {
+    const user = userEvent.setup()
+    render(<DialogHarness />)
+
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+
+    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Internal Network')
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+    expect(screen.getByRole('button', { name: 'Create' })).toBeEnabled()
+  })
+
+  it('shows a live error and keeps Create disabled for an invalid octet', async () => {
+    const user = userEvent.setup()
+    render(<DialogHarness />)
+
+    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Internal Network')
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '203.0.113.999')
+
+    expect(screen.getByText('Each octet must be 0–255')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+  })
+
+  it('keeps a single empty row when the last entry is removed', async () => {
+    const user = userEvent.setup()
+    render(<DialogHarness />)
+
+    await user.click(screen.getByRole('button', { name: 'Remove entry' }))
+
+    expect(screen.getByPlaceholderText('10.0.0.0/8')).toHaveValue('')
+    expect(screen.getAllByRole('button', { name: 'Remove entry' })).toHaveLength(1)
+  })
+
+  it('adds the current IP into the first empty row', async () => {
+    const user = userEvent.setup()
+    render(<DialogHarness currentIp="203.0.113.42" />)
+
+    expect(screen.getByText('Your current IP is 203.0.113.42')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Add it' }))
+    expect(screen.getByPlaceholderText('10.0.0.0/8')).toHaveValue('203.0.113.42')
+  })
+
+  it('submits trimmed name and addresses', async () => {
+    const user = userEvent.setup()
+    const onSubmit = vi.fn()
+    render(<DialogHarness onSubmit={onSubmit} />)
+
+    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Internal Network')
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+    await user.click(screen.getByRole('button', { name: 'Add' }))
+    const rows = screen.getAllByPlaceholderText('10.0.0.0/8')
+    expect(rows).toHaveLength(2)
+    await user.type(rows[1] as HTMLElement, '203.0.113.42')
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+
+    expect(onSubmit).toHaveBeenCalledWith({
+      name: 'Internal Network',
+      addresses: ['10.0.0.0/8', '203.0.113.42'],
+    })
+  })
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
new file mode 100644
index 00000000000000..80740c18f725f2
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
@@ -0,0 +1,88 @@
+import { canSubmitIpPolicy, collectIpAddresses, validateIpEntry } from '../validate-ip-entry'
+
+describe('validateIpEntry', () => {
+  it('treats blank input as empty, not invalid', () => {
+    expect(validateIpEntry('')).toEqual({ kind: 'empty' })
+    expect(validateIpEntry('   ')).toEqual({ kind: 'empty' })
+  })
+
+  it('accepts IPv4 addresses, IPv6 addresses, and CIDR ranges', () => {
+    expect(validateIpEntry('10.0.0.0/8')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('203.0.113.42')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('0.0.0.0/0')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('2001:db8:1f4a:2c::5')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('3fff:100::/32')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('::1')).toEqual({ kind: 'valid' })
+    expect(validateIpEntry('2001:db8::1')).toEqual({ kind: 'valid' })
+  })
+
+  it('rejects more than one slash', () => {
+    expect(validateIpEntry('10.0.0.0/8/16')).toEqual({
+      kind: 'invalid',
+      code: 'multipleSlashes',
+    })
+  })
+
+  it('rejects IPv4 leading zeros', () => {
+    expect(validateIpEntry('192.168.01.1')).toEqual({ kind: 'invalid', code: 'leadingZeros' })
+  })
+
+  it('rejects IPv4 octets outside 0–255', () => {
+    expect(validateIpEntry('256.100.50.25')).toEqual({ kind: 'invalid', code: 'octetRange' })
+    expect(validateIpEntry('203.0.113.999')).toEqual({ kind: 'invalid', code: 'octetRange' })
+  })
+
+  it('rejects a non-numeric prefix length', () => {
+    expect(validateIpEntry('10.0.0.0/ab')).toEqual({ kind: 'invalid', code: 'prefixNotNumber' })
+    expect(validateIpEntry('2001:db8::/x')).toEqual({ kind: 'invalid', code: 'prefixNotNumber' })
+  })
+
+  it('rejects prefix lengths outside the address family range', () => {
+    expect(validateIpEntry('192.168.1.0/33')).toEqual({
+      kind: 'invalid',
+      code: 'prefixRange',
+      max: 32,
+    })
+    expect(validateIpEntry('3fff:100::/129')).toEqual({
+      kind: 'invalid',
+      code: 'prefixRange',
+      max: 128,
+    })
+  })
+
+  it('rejects invalid IPv6 addresses', () => {
+    expect(validateIpEntry('gggg::1')).toEqual({ kind: 'invalid', code: 'invalidIpv6' })
+    expect(validateIpEntry('2001:db8:::1')).toEqual({ kind: 'invalid', code: 'invalidIpv6' })
+  })
+
+  it('rejects ranges, wildcards, and hostnames', () => {
+    expect(validateIpEntry('192.168.1.1 - 192.168.1.50')).toEqual({
+      kind: 'invalid',
+      code: 'unsupported',
+    })
+    expect(validateIpEntry('10.0.0.*')).toEqual({ kind: 'invalid', code: 'unsupported' })
+    expect(validateIpEntry('office.example.com')).toEqual({ kind: 'invalid', code: 'unsupported' })
+  })
+})
+
+describe('canSubmitIpPolicy', () => {
+  it('requires a name and at least one valid entry', () => {
+    expect(canSubmitIpPolicy('', ['10.0.0.0/8'])).toBe(false)
+    expect(canSubmitIpPolicy('Office', [''])).toBe(false)
+    expect(canSubmitIpPolicy('Office', ['10.0.0.0/8'])).toBe(true)
+    expect(canSubmitIpPolicy('Office', ['10.0.0.0/8', ''])).toBe(true)
+  })
+
+  it('blocks submit when any non-empty entry is invalid', () => {
+    expect(canSubmitIpPolicy('Office', ['10.0.0.0/8', '203.0.113.999'])).toBe(false)
+  })
+})
+
+describe('collectIpAddresses', () => {
+  it('drops blank rows', () => {
+    expect(collectIpAddresses([' 10.0.0.0/8 ', '', '203.0.113.42'])).toEqual([
+      '10.0.0.0/8',
+      '203.0.113.42',
+    ])
+  })
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
new file mode 100644
index 00000000000000..374a734812bfe6
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
@@ -0,0 +1,142 @@
+'use client'
+
+import type { AllowlistRow } from './allowlist-row'
+import type { IpEntryErrorCode } from './validate-ip-entry'
+import { Button } from '@langgenius/dify-ui/button'
+import { Field, FieldDescription, FieldError, FieldLabel } from '@langgenius/dify-ui/field'
+import { IconButton } from '@langgenius/dify-ui/icon-button'
+import { Input } from '@langgenius/dify-ui/input'
+import { useTranslation } from 'react-i18next'
+import { createAllowlistRow } from './allowlist-row'
+import { validateIpEntry } from './validate-ip-entry'
+
+type AllowlistFieldProps = {
+  entries: AllowlistRow[]
+  currentIp?: string
+  onEntriesChange: (entries: AllowlistRow[]) => void
+}
+
+export function AllowlistField({ entries, currentIp, onEntriesChange }: AllowlistFieldProps) {
+  const { t } = useTranslation()
+
+  const errorMessage = (code: IpEntryErrorCode, max?: 32 | 128) => {
+    switch (code) {
+      case 'multipleSlashes':
+        return t(($) => $['settings.ipPolicyEntryMultipleSlashes'], { ns: 'common' })
+      case 'leadingZeros':
+        return t(($) => $['settings.ipPolicyEntryLeadingZeros'], { ns: 'common' })
+      case 'octetRange':
+        return t(($) => $['settings.ipPolicyEntryOctetRange'], { ns: 'common' })
+      case 'prefixNotNumber':
+        return t(($) => $['settings.ipPolicyEntryPrefixNotNumber'], { ns: 'common' })
+      case 'prefixRange':
+        return t(($) => $['settings.ipPolicyEntryPrefixRange'], { ns: 'common', max })
+      case 'invalidIpv6':
+        return t(($) => $['settings.ipPolicyEntryInvalidIpv6'], { ns: 'common' })
+      default:
+        return t(($) => $['settings.ipPolicyEntryUnsupported'], { ns: 'common' })
+    }
+  }
+
+  const updateEntry = (id: string, value: string) => {
+    onEntriesChange(entries.map((entry) => (entry.id === id ? { ...entry, value } : entry)))
+  }
+
+  const removeEntry = (id: string) => {
+    if (entries.length === 1) {
+      const row = entries[0]
+      if (!row) return
+      onEntriesChange([{ ...row, value: '' }])
+      return
+    }
+    onEntriesChange(entries.filter((entry) => entry.id !== id))
+  }
+
+  const addCurrentIp = () => {
+    if (!currentIp) return
+    if (entries.some((entry) => entry.value.trim() === currentIp)) return
+    const emptyRow = entries.find((entry) => entry.value.trim() === '')
+    if (emptyRow) {
+      updateEntry(emptyRow.id, currentIp)
+      return
+    }
+    onEntriesChange([...entries, createAllowlistRow(currentIp)])
+  }
+
+  return (
+    <Field className="flex flex-col gap-3">
+      <div className="flex flex-col gap-1">
+        <FieldLabel>{t(($) => $['settings.ipPolicyAllowlist'], { ns: 'common' })}</FieldLabel>
+        <FieldDescription>
+          {t(($) => $['settings.ipPolicyAllowlistHelp'], { ns: 'common' })}
+        </FieldDescription>
+      </div>
+
+      <div className="flex flex-col gap-2">
+        {entries.map((entry) => {
+          const result = validateIpEntry(entry.value)
+          const invalid = result.kind === 'invalid'
+
+          return (
+            <Field key={entry.id} invalid={invalid} className="flex flex-col gap-1.5">
+              <div className="flex items-center gap-2">
+                <div className="relative min-w-0 flex-1">
+                  <Input
+                    value={entry.value}
+                    placeholder="10.0.0.0/8"
+                    aria-label={t(($) => $['settings.ipPolicyAllowlist'], { ns: 'common' })}
+                    className={invalid ? 'pr-8' : undefined}
+                    onChange={(event) => updateEntry(entry.id, event.currentTarget.value)}
+                  />
+                  {invalid && (
+                    <span
+                      aria-hidden
+                      className="pointer-events-none absolute inset-e-2.5 top-1/2 i-ri-error-warning-line size-4 -translate-y-1/2 text-text-destructive"
+                    />
+                  )}
+                </div>
+                <IconButton
+                  type="button"
+                  size="lg"
+                  aria-label={t(($) => $['settings.ipPolicyRemoveEntry'], { ns: 'common' })}
+                  onClick={() => removeEntry(entry.id)}
+                >
+                  <span aria-hidden className="i-ri-delete-bin-line size-4" />
+                </IconButton>
+              </div>
+              {invalid && (
+                <FieldError match className="text-text-destructive-secondary">
+                  {errorMessage(result.code, result.max)}
+                </FieldError>
+              )}
+            </Field>
+          )
+        })}
+      </div>
+
+      <Button
+        type="button"
+        variant="secondary"
+        size="small"
+        className="self-start"
+        onClick={() => onEntriesChange([...entries, createAllowlistRow()])}
+      >
+        <span aria-hidden className="i-ri-add-line size-4" />
+        {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
+      </Button>
+
+      {currentIp && (
+        <p className="flex flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
+          <span>{t(($) => $['settings.ipPolicyCurrentIp'], { ns: 'common', ip: currentIp })}</span>
+          <button
+            type="button"
+            className="system-xs-medium text-text-accent outline-hidden hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+            onClick={addCurrentIp}
+          >
+            {t(($) => $['settings.ipPolicyAddCurrentIp'], { ns: 'common' })}
+          </button>
+        </p>
+      )}
+    </Field>
+  )
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/allowlist-row.ts b/web/app/components/header/account-setting/ip-policies-page/allowlist-row.ts
new file mode 100644
index 00000000000000..1fd9dbee6dc7e6
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/allowlist-row.ts
@@ -0,0 +1,8 @@
+export type AllowlistRow = {
+  id: string
+  value: string
+}
+
+export function createAllowlistRow(value = ''): AllowlistRow {
+  return { id: crypto.randomUUID(), value }
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 4adafc1ca57171..2f9a62ae7ff375 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -1,18 +1,40 @@
 'use client'
 
+import { Button } from '@langgenius/dify-ui/button'
+import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { IpPolicyDialog } from './policy-dialog'
 
 export default function IpPoliciesPage() {
   const { t } = useTranslation()
+  const [dialogOpen, setDialogOpen] = useState(false)
 
   return (
-    <div className="flex flex-col items-center gap-1 py-10 text-center">
-      <p className="system-sm-medium text-text-secondary">
-        {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
-      </p>
-      <p className="max-w-md system-xs-regular text-text-tertiary">
-        {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
-      </p>
+    <div className="flex flex-col gap-4">
+      <div className="flex items-start justify-between gap-4">
+        <div className="flex min-w-0 flex-col gap-1">
+          <h2 className="title-2xl-semi-bold text-text-primary">
+            {t(($) => $['settings.ipPolicies'], { ns: 'common' })}
+          </h2>
+          <p className="system-sm-regular text-text-tertiary">
+            {t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })}
+          </p>
+        </div>
+        <Button variant="primary" size="small" onClick={() => setDialogOpen(true)}>
+          {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
+        </Button>
+      </div>
+
+      <div className="flex flex-col items-center gap-1 py-10 text-center">
+        <p className="system-sm-medium text-text-secondary">
+          {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+        </p>
+        <p className="max-w-md system-xs-regular text-text-tertiary">
+          {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
+        </p>
+      </div>
+
+      {dialogOpen && <IpPolicyDialog mode="create" open onOpenChange={setDialogOpen} />}
     </div>
   )
 }
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
new file mode 100644
index 00000000000000..db0a0c3dd683b2
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -0,0 +1,118 @@
+'use client'
+
+import { Button } from '@langgenius/dify-ui/button'
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogTitle,
+} from '@langgenius/dify-ui/dialog'
+import { Field, FieldLabel } from '@langgenius/dify-ui/field'
+import { IconButton } from '@langgenius/dify-ui/icon-button'
+import { Input } from '@langgenius/dify-ui/input'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import { AllowlistField } from './allowlist-field'
+import { createAllowlistRow } from './allowlist-row'
+import { canSubmitIpPolicy, collectIpAddresses } from './validate-ip-entry'
+
+export type IpPolicyDialogSubmit = {
+  name: string
+  addresses: string[]
+}
+
+type IpPolicyDialogProps = {
+  open: boolean
+  mode: 'create' | 'edit'
+  currentIp?: string
+  initialName?: string
+  initialEntries?: readonly string[]
+  onOpenChange: (open: boolean) => void
+  onSubmit?: (payload: IpPolicyDialogSubmit) => void
+}
+
+export function IpPolicyDialog({
+  open,
+  mode,
+  currentIp,
+  initialName = '',
+  initialEntries,
+  onOpenChange,
+  onSubmit,
+}: IpPolicyDialogProps) {
+  const { t } = useTranslation()
+  const [name, setName] = useState(initialName)
+  const [entries, setEntries] = useState(() =>
+    initialEntries && initialEntries.length > 0
+      ? initialEntries.map((value) => createAllowlistRow(value))
+      : [createAllowlistRow()],
+  )
+
+  const entryValues = entries.map((entry) => entry.value)
+  const canSubmit = canSubmitIpPolicy(name, entryValues)
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent backdropProps={{ forceRender: true }} className="flex w-120 flex-col gap-6">
+        <div className="flex items-start gap-4">
+          <div className="flex min-w-0 flex-1 flex-col gap-1">
+            <DialogTitle className="title-2xl-semi-bold text-text-primary">
+              {mode === 'edit'
+                ? t(($) => $['settings.ipPolicyEditTitle'], { ns: 'common' })
+                : t(($) => $['settings.ipPolicyNewTitle'], { ns: 'common' })}
+            </DialogTitle>
+            <DialogDescription className="system-sm-regular text-text-tertiary">
+              {t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
+            </DialogDescription>
+          </div>
+          <DialogClose
+            render={
+              <IconButton
+                type="button"
+                size="lg"
+                aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+              >
+                <span aria-hidden className="i-ri-close-line size-4" />
+              </IconButton>
+            }
+          />
+        </div>
+
+        <form
+          className="flex flex-col gap-6"
+          onSubmit={(event) => {
+            event.preventDefault()
+            if (!canSubmit) return
+            onSubmit?.({
+              name: name.trim(),
+              addresses: collectIpAddresses(entryValues),
+            })
+          }}
+        >
+          <Field className="flex flex-col gap-3">
+            <FieldLabel>{t(($) => $['settings.ipPolicyName'], { ns: 'common' })}</FieldLabel>
+            <Input
+              value={name}
+              placeholder={t(($) => $['settings.ipPolicyNamePlaceholder'], { ns: 'common' })}
+              onChange={(event) => setName(event.currentTarget.value)}
+            />
+          </Field>
+
+          <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
+
+          <div className="flex items-center justify-end gap-2 pt-2">
+            <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
+              {t(($) => $['operation.cancel'], { ns: 'common' })}
+            </Button>
+            <Button type="submit" variant="primary" disabled={!canSubmit}>
+              {mode === 'edit'
+                ? t(($) => $['operation.save'], { ns: 'common' })
+                : t(($) => $['settings.ipPolicyCreate'], { ns: 'common' })}
+            </Button>
+          </div>
+        </form>
+      </DialogContent>
+    </Dialog>
+  )
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
new file mode 100644
index 00000000000000..c1421076974a7a
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -0,0 +1,117 @@
+export type IpEntryErrorCode =
+  | 'multipleSlashes'
+  | 'leadingZeros'
+  | 'octetRange'
+  | 'prefixNotNumber'
+  | 'prefixRange'
+  | 'invalidIpv6'
+  | 'unsupported'
+
+export type IpEntryValidation =
+  | { kind: 'empty' }
+  | { kind: 'valid' }
+  | { kind: 'invalid'; code: IpEntryErrorCode; max?: 32 | 128 }
+
+function isHexGroup(group: string) {
+  return /^[0-9a-f]{1,4}$/i.test(group)
+}
+
+function parsePrefix(prefix: string): { kind: 'ok'; value: number } | { kind: 'notNumber' } {
+  if (!/^\d+$/.test(prefix)) return { kind: 'notNumber' }
+  return { kind: 'ok', value: Number(prefix) }
+}
+
+function parseIpv4(address: string): 'valid' | 'leadingZeros' | 'octetRange' | 'unsupported' {
+  const parts = address.split('.')
+  if (parts.length !== 4) return 'unsupported'
+
+  for (const part of parts) {
+    if (part === '') return 'unsupported'
+    if (!/^\d+$/.test(part)) return 'unsupported'
+    if (part.length > 1 && part.startsWith('0')) return 'leadingZeros'
+    const octet = Number(part)
+    if (octet > 255) return 'octetRange'
+  }
+
+  return 'valid'
+}
+
+function parseIpv6(address: string): boolean {
+  if (address.includes('.')) return false
+
+  const sides = address.split('::')
+  if (sides.length > 2) return false
+
+  if (sides.length === 2) {
+    const leftSide = sides[0] ?? ''
+    const rightSide = sides[1] ?? ''
+    const left = leftSide === '' ? [] : leftSide.split(':')
+    const right = rightSide === '' ? [] : rightSide.split(':')
+    if (left.some((group) => !isHexGroup(group)) || right.some((group) => !isHexGroup(group)))
+      return false
+    return left.length + right.length < 8
+  }
+
+  const groups = address.split(':')
+  return groups.length === 8 && groups.every(isHexGroup)
+}
+
+export function validateIpEntry(raw: string): IpEntryValidation {
+  const value = raw.trim()
+  if (value === '') return { kind: 'empty' }
+
+  const slashCount = (value.match(/\//g) ?? []).length
+  if (slashCount > 1) return { kind: 'invalid', code: 'multipleSlashes' }
+
+  const slashIndex = value.indexOf('/')
+  const address = slashIndex === -1 ? value : value.slice(0, slashIndex)
+  const prefix = slashIndex === -1 ? undefined : value.slice(slashIndex + 1)
+
+  if (address.includes(':')) {
+    if (prefix !== undefined) {
+      const parsed = parsePrefix(prefix)
+      if (parsed.kind === 'notNumber') return { kind: 'invalid', code: 'prefixNotNumber' }
+      if (parsed.value < 0 || parsed.value > 128)
+        return { kind: 'invalid', code: 'prefixRange', max: 128 }
+    }
+    if (!parseIpv6(address)) return { kind: 'invalid', code: 'invalidIpv6' }
+    return { kind: 'valid' }
+  }
+
+  if (address.includes('.')) {
+    const ipv4 = parseIpv4(address)
+    if (ipv4 === 'leadingZeros') return { kind: 'invalid', code: 'leadingZeros' }
+    if (ipv4 === 'octetRange') return { kind: 'invalid', code: 'octetRange' }
+    if (ipv4 === 'unsupported') return { kind: 'invalid', code: 'unsupported' }
+    if (prefix !== undefined) {
+      const parsed = parsePrefix(prefix)
+      if (parsed.kind === 'notNumber') return { kind: 'invalid', code: 'prefixNotNumber' }
+      if (parsed.value < 0 || parsed.value > 32)
+        return { kind: 'invalid', code: 'prefixRange', max: 32 }
+    }
+    return { kind: 'valid' }
+  }
+
+  if (prefix !== undefined) {
+    const parsed = parsePrefix(prefix)
+    if (parsed.kind === 'notNumber') return { kind: 'invalid', code: 'prefixNotNumber' }
+  }
+
+  return { kind: 'invalid', code: 'unsupported' }
+}
+
+export function canSubmitIpPolicy(name: string, entries: readonly string[]) {
+  if (name.trim() === '') return false
+
+  const trimmed = entries.map((entry) => entry.trim())
+  if (trimmed.every((entry) => entry === '')) return false
+
+  return trimmed.every((entry) => {
+    const result = validateIpEntry(entry)
+    return result.kind === 'empty' || result.kind === 'valid'
+  })
+}
+
+export function collectIpAddresses(entries: readonly string[]) {
+  return entries.map((entry) => entry.trim()).filter((entry) => entry.length > 0)
+}
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index 974cd883965779..3d5b5a13e6c20f 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "التكاملات",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 8484f772532ef6..6fd316a31882f6 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrationen",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 6065af40b840fa..7c2804eec8b2da 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrations",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 2404b986388404..6aab6fad4ee681 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integraciones",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 3ee10e59de2171..cdfa0e1211c787 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "ادغام‌ها",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 576a5bf04791ff..f2770a89b9c477 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Intégrations",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 6c8776292e77fe..5630c67ec4cbd0 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "एकीकरण",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index a66f00497a1a2b..b86411709bae44 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrasi",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index bc18e0f8949dfa..799c52939a924e 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrazioni",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index ac6c3fc597a813..5d1c6f6917d9ca 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "拡張機能",
   "settings.integrations": "統合",
   "settings.ipPolicies": "IP ポリシー",
+  "settings.ipPoliciesDescription": "アクセスを許可する IP アドレスまたは範囲を制御する、再利用可能なルール",
+  "settings.ipPolicyAddCurrentIp": "追加する",
+  "settings.ipPolicyAddEntry": "追加",
+  "settings.ipPolicyAllowlist": "許可リスト",
+  "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
+  "settings.ipPolicyCreate": "作成",
+  "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
+  "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
+  "settings.ipPolicyEditTitle": "IP ポリシーを編集",
+  "settings.ipPolicyEntryInvalidIpv6": "有効な IPv6 アドレスではありません",
+  "settings.ipPolicyEntryLeadingZeros": "先頭のゼロは使用できません",
+  "settings.ipPolicyEntryMultipleSlashes": "「/」は 1 つだけ使用できます",
+  "settings.ipPolicyEntryOctetRange": "各オクテットは 0〜255 の範囲で指定してください",
+  "settings.ipPolicyEntryPrefixNotNumber": "プレフィックス長は数値で指定してください",
+  "settings.ipPolicyEntryPrefixRange": "プレフィックス長は 0〜{{max}} の範囲で指定してください",
+  "settings.ipPolicyEntryUnsupported": "IPv4 / IPv6 アドレスと CIDR 範囲のみサポートしています",
+  "settings.ipPolicyName": "名前",
+  "settings.ipPolicyNamePlaceholder": "例：社内ネットワーク",
+  "settings.ipPolicyNewTitle": "IP ポリシーを作成",
+  "settings.ipPolicyRemoveEntry": "エントリを削除",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index f732e86b7af301..8cc41adcaebf0c 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "통합",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index cb29d3a1f03aaa..be1cafc61f8850 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "ສ່ວນຂະຫຍາຍ",
   "settings.integrations": "ການເຊື່ອມຕໍ່",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 168e7b91ac2b46..c2dee83d9fb289 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrations",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index e89d9ea79ea4f4..4ac76a130335e3 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integracje",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index b73bbbc18f51de..17d2e4b1ecf8b9 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrações",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 9dfb86ca7fe519..2180c8f8521f52 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integrări",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 9403297e621dfa..0a96812530d031 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Интеграции",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 1ab88849a8fd34..02813334ac5c63 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Integracije",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 1174e5a458873f..0f6bb0adbc766a 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "บูรณาการ",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 07a1fd64e0bab1..7956af6c956cc2 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Entegrasyonlar",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index 7f64da9664ea0b..a04efebf8ff416 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Інтеграції",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 7a1f224f56eb00..e2840a3a4338a7 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "Extension",
   "settings.integrations": "Tích hợp",
   "settings.ipPolicies": "IP Policies",
+  "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPolicyAddCurrentIp": "Add it",
+  "settings.ipPolicyAddEntry": "Add",
+  "settings.ipPolicyAllowlist": "Allowlist",
+  "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCreate": "Create",
+  "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
+  "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
+  "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
+  "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
+  "settings.ipPolicyEntryOctetRange": "Each octet must be 0–255",
+  "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
+  "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
+  "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
+  "settings.ipPolicyNewTitle": "New IP Policy",
+  "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index c0994496b573b6..3459b396f6e6bb 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "扩展",
   "settings.integrations": "集成",
   "settings.ipPolicies": "IP 策略",
+  "settings.ipPoliciesDescription": "可复用的规则，用于控制允许访问的 IP 地址或网段",
+  "settings.ipPolicyAddCurrentIp": "添加",
+  "settings.ipPolicyAddEntry": "添加",
+  "settings.ipPolicyAllowlist": "允许列表",
+  "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
+  "settings.ipPolicyCreate": "创建",
+  "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
+  "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
+  "settings.ipPolicyEditTitle": "编辑 IP 策略",
+  "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 地址",
+  "settings.ipPolicyEntryLeadingZeros": "不允许前导零",
+  "settings.ipPolicyEntryMultipleSlashes": "只能包含一个“/”",
+  "settings.ipPolicyEntryOctetRange": "每段数值必须在 0–255 之间",
+  "settings.ipPolicyEntryPrefixNotNumber": "前缀长度必须为数字",
+  "settings.ipPolicyEntryPrefixRange": "前缀长度必须在 0–{{max}} 之间",
+  "settings.ipPolicyEntryUnsupported": "仅支持 IPv4 / IPv6 地址和 CIDR 网段",
+  "settings.ipPolicyName": "名称",
+  "settings.ipPolicyNamePlaceholder": "例：内部网络",
+  "settings.ipPolicyNewTitle": "新建 IP 策略",
+  "settings.ipPolicyRemoveEntry": "删除条目",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 04beac4950952f..4db680682bf995 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -550,6 +550,26 @@
   "settings.extension": "擴充",
   "settings.integrations": "集成",
   "settings.ipPolicies": "IP 策略",
+  "settings.ipPoliciesDescription": "可重用的規則，用來控制允許存取的 IP 位址或網段",
+  "settings.ipPolicyAddCurrentIp": "加入",
+  "settings.ipPolicyAddEntry": "新增",
+  "settings.ipPolicyAllowlist": "允許清單",
+  "settings.ipPolicyAllowlistHelp": "支援單一地址（203.0.113.42）或 CIDR 網段（10.0.0.0/8），IPv4 與 IPv6 皆可。",
+  "settings.ipPolicyCreate": "建立",
+  "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
+  "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
+  "settings.ipPolicyEditTitle": "編輯 IP 策略",
+  "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 位址",
+  "settings.ipPolicyEntryLeadingZeros": "不允許前導零",
+  "settings.ipPolicyEntryMultipleSlashes": "只能包含一個“/”",
+  "settings.ipPolicyEntryOctetRange": "每段數值必須在 0–255 之間",
+  "settings.ipPolicyEntryPrefixNotNumber": "前置碼長度必須為數字",
+  "settings.ipPolicyEntryPrefixRange": "前置碼長度必須在 0–{{max}} 之間",
+  "settings.ipPolicyEntryUnsupported": "僅支援 IPv4 / IPv6 位址和 CIDR 網段",
+  "settings.ipPolicyName": "名稱",
+  "settings.ipPolicyNamePlaceholder": "例：內部網路",
+  "settings.ipPolicyNewTitle": "新增 IP 策略",
+  "settings.ipPolicyRemoveEntry": "刪除條目",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",

From 72af960c3039ebb657ff3566ccd55205b12326f8 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Wed, 9 Sep 2026 13:55:43 +0800
Subject: [PATCH 012/108] fix(web): keep IP Policy dialog corners round when
 allowlist scrolls

Clip overflow on the dialog shell and scroll only the allowlist rows so the scrollbar no longer squares the rounded corners.
---
 .../ip-policies-page/allowlist-field.tsx            | 10 +++++-----
 .../ip-policies-page/policy-dialog.tsx              | 13 ++++++++-----
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
index 374a734812bfe6..e712ba6648a583 100644
--- a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
@@ -64,15 +64,15 @@ export function AllowlistField({ entries, currentIp, onEntriesChange }: Allowlis
   }
 
   return (
-    <Field className="flex flex-col gap-3">
-      <div className="flex flex-col gap-1">
+    <Field className="flex min-h-0 flex-1 flex-col gap-3">
+      <div className="flex shrink-0 flex-col gap-1">
         <FieldLabel>{t(($) => $['settings.ipPolicyAllowlist'], { ns: 'common' })}</FieldLabel>
         <FieldDescription>
           {t(($) => $['settings.ipPolicyAllowlistHelp'], { ns: 'common' })}
         </FieldDescription>
       </div>
 
-      <div className="flex flex-col gap-2">
+      <div className="flex min-h-0 flex-1 flex-col gap-2 overflow-y-auto">
         {entries.map((entry) => {
           const result = validateIpEntry(entry.value)
           const invalid = result.kind === 'invalid'
@@ -118,7 +118,7 @@ export function AllowlistField({ entries, currentIp, onEntriesChange }: Allowlis
         type="button"
         variant="secondary"
         size="small"
-        className="self-start"
+        className="shrink-0 self-start"
         onClick={() => onEntriesChange([...entries, createAllowlistRow()])}
       >
         <span aria-hidden className="i-ri-add-line size-4" />
@@ -126,7 +126,7 @@ export function AllowlistField({ entries, currentIp, onEntriesChange }: Allowlis
       </Button>
 
       {currentIp && (
-        <p className="flex flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
+        <p className="flex shrink-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
           <span>{t(($) => $['settings.ipPolicyCurrentIp'], { ns: 'common', ip: currentIp })}</span>
           <button
             type="button"
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index db0a0c3dd683b2..8bacd3a0b721b1 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -54,8 +54,11 @@ export function IpPolicyDialog({
 
   return (
     <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent backdropProps={{ forceRender: true }} className="flex w-120 flex-col gap-6">
-        <div className="flex items-start gap-4">
+      <DialogContent
+        backdropProps={{ forceRender: true }}
+        className="flex max-h-[80dvh] w-120 flex-col gap-6 overflow-hidden"
+      >
+        <div className="flex shrink-0 items-start gap-4">
           <div className="flex min-w-0 flex-1 flex-col gap-1">
             <DialogTitle className="title-2xl-semi-bold text-text-primary">
               {mode === 'edit'
@@ -80,7 +83,7 @@ export function IpPolicyDialog({
         </div>
 
         <form
-          className="flex flex-col gap-6"
+          className="flex min-h-0 flex-1 flex-col gap-6"
           onSubmit={(event) => {
             event.preventDefault()
             if (!canSubmit) return
@@ -90,7 +93,7 @@ export function IpPolicyDialog({
             })
           }}
         >
-          <Field className="flex flex-col gap-3">
+          <Field className="flex shrink-0 flex-col gap-3">
             <FieldLabel>{t(($) => $['settings.ipPolicyName'], { ns: 'common' })}</FieldLabel>
             <Input
               value={name}
@@ -101,7 +104,7 @@ export function IpPolicyDialog({
 
           <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
 
-          <div className="flex items-center justify-end gap-2 pt-2">
+          <div className="flex shrink-0 items-center justify-end gap-2 pt-2">
             <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </Button>

From 7e3ceaba82c99f32862dad39c0e52e9962ad7215 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 15:41:26 +0800
Subject: [PATCH 013/108] feat: align network access BFF with app policies

---
 .../console/workspace/network_access_group.py | 136 ++++++++-
 api/controllers/console/wraps.py              |  21 +-
 api/openapi/markdown/console-openapi.md       |  24 +-
 api/services/billing_service.py               |  12 +-
 api/services/network_access_group_service.py  |  74 +++++
 .../workspace/test_network_access_group.py    | 286 ++++++++++++++++--
 ...st_network_access_group_billing_service.py |  52 +++-
 .../generated/api/console/apps/types.gen.ts   |   6 +
 .../generated/api/console/apps/zod.gen.ts     |   6 +
 .../api/console/workspaces/types.gen.ts       |  16 +-
 .../api/console/workspaces/zod.gen.ts         |  83 ++---
 11 files changed, 605 insertions(+), 111 deletions(-)
 create mode 100644 api/services/network_access_group_service.py

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 39860e8cfa7524..eb294fc74c17ff 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -1,9 +1,9 @@
 from datetime import datetime
-from typing import Literal
+from typing import Literal, Self
 from uuid import UUID
 
 from flask_restx import Resource
-from pydantic import AliasChoices, BaseModel, Field, ValidationError
+from pydantic import AliasChoices, BaseModel, Field, ValidationError, model_validator
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
 
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
@@ -11,6 +11,8 @@
 from controllers.console.app.wraps import get_app_model
 from controllers.console.wraps import (
     account_initialization_required,
+    cloud_edition_billing_paid_plan_required,
+    is_cloud_edition_billing_paid_plan,
     model_validate,
     only_edition_cloud,
     setup_required,
@@ -20,17 +22,25 @@
 from fields.base import ResponseModel
 from libs.helper import dump_response
 from libs.login import login_required
-from models import Account, App, TenantAccountRole
+from models import Account, App, AppMode, TenantAccountRole
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+from services.network_access_group_service import NetworkAccessGroupService
 
-NetworkAccessGroupMode = Literal["disabled", "shadow", "enforce"]
+NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
+
+_ACCESS_POINTS_BY_APP_MODE: dict[AppMode, tuple[NetworkAccessPoint, ...]] = {
+    AppMode.WORKFLOW: ("webapp", "service_api", "mcp", "trigger"),
+    AppMode.ADVANCED_CHAT: ("webapp", "service_api", "mcp"),
+    AppMode.CHAT: ("webapp", "service_api", "mcp"),
+    AppMode.COMPLETION: ("webapp", "service_api", "mcp"),
+    AppMode.AGENT_CHAT: ("webapp", "service_api"),
+}
 
 
 class NetworkAccessGroupCreatePayload(BaseModel):
     name: str = Field(min_length=1, max_length=100)
     description: str = Field(default="", max_length=500)
-    mode: NetworkAccessGroupMode
-    allowed_cidrs: list[str] = Field(max_length=100)
+    allowed_cidrs: list[str] = Field(min_length=1, max_length=100)
 
 
 class NetworkAccessGroupUpdatePayload(NetworkAccessGroupCreatePayload):
@@ -42,21 +52,51 @@ class NetworkAccessGroupDeleteQuery(BaseModel):
 
 
 class AppNetworkAccessGroupUpdatePayload(BaseModel):
-    group_id: UUID | None
+    enabled: bool
+    group_id: UUID | None = Field(
+        validation_alias=AliasChoices("group_id", "groupId", "policy_id", "policyId"),
+    )
+    access_points: list[NetworkAccessPoint] = Field(
+        max_length=4,
+        validation_alias=AliasChoices("access_points", "accessPoints"),
+    )
     expected_version: int = Field(ge=0)
 
+    @model_validator(mode="after")
+    def validate_enabled_configuration(self) -> Self:
+        if len(set(self.access_points)) != len(self.access_points):
+            raise ValueError("access_points must not contain duplicates")
+        if self.enabled and self.group_id is None:
+            raise ValueError("group_id is required when network access control is enabled")
+        if self.enabled and not self.access_points:
+            raise ValueError("access_points must not be empty when network access control is enabled")
+        return self
+
+
+class NetworkAccessGroupAppResponse(ResponseModel):
+    id: str
+    name: str
+    icon: str | None = None
+    icon_type: str | None = None
+    icon_background: str | None = None
+
 
 class NetworkAccessGroupResponse(ResponseModel):
     id: str
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
     name: str
     description: str = ""
-    mode: NetworkAccessGroupMode
     allowed_cidrs: list[str] = Field(
-        default_factory=list,
+        min_length=1,
+        max_length=100,
         validation_alias=AliasChoices("allowed_cidrs", "allowedCidrs"),
     )
     version: int = Field(ge=1)
+    used_by_count: int = Field(ge=0, validation_alias=AliasChoices("used_by_count", "usedByCount"))
+    app_ids: list[str] = Field(
+        validation_alias=AliasChoices("app_ids", "appIds", "used_by_app_ids", "usedByAppIds"),
+    )
+    apps: list[NetworkAccessGroupAppResponse]
     updated_by_account_id: str | None = Field(
         default=None,
         validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
@@ -83,7 +123,15 @@ class AppNetworkAccessGroupBindingResponse(ResponseModel):
     id: str
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
     app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
-    group_id: str | None = Field(default=None, validation_alias=AliasChoices("group_id", "groupId"))
+    enabled: bool
+    group_id: str | None = Field(
+        default=None,
+        validation_alias=AliasChoices("group_id", "groupId", "policy_id", "policyId"),
+    )
+    access_points: list[NetworkAccessPoint] = Field(
+        max_length=4,
+        validation_alias=AliasChoices("access_points", "accessPoints"),
+    )
     version: int = Field(ge=1)
     updated_by_account_id: str | None = Field(
         default=None,
@@ -92,16 +140,28 @@ class AppNetworkAccessGroupBindingResponse(ResponseModel):
     created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
     updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
 
+    @model_validator(mode="after")
+    def validate_enabled_configuration(self) -> Self:
+        if len(set(self.access_points)) != len(self.access_points):
+            raise ValueError("access_points must not contain duplicates")
+        if self.enabled and self.group_id is None:
+            raise ValueError("group_id is required when network access control is enabled")
+        if self.enabled and not self.access_points:
+            raise ValueError("access_points must not be empty when network access control is enabled")
+        return self
+
 
 class AppNetworkAccessGroupResponse(ResponseModel):
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
     app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
     entitled: bool
+    available_access_points: list[NetworkAccessPoint]
     binding: AppNetworkAccessGroupBindingResponse | None
 
 
 class AppNetworkAccessGroupMutationResponse(ResponseModel):
     binding: AppNetworkAccessGroupBindingResponse
+    available_access_points: list[NetworkAccessPoint]
 
 
 register_schema_models(
@@ -112,6 +172,7 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
 )
 register_response_schema_models(
     console_ns,
+    NetworkAccessGroupAppResponse,
     NetworkAccessGroupResponse,
     NetworkAccessGroupListResponse,
     NetworkAccessGroupMutationResponse,
@@ -122,6 +183,39 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
 )
 
 
+def _available_access_points(app_model: App) -> list[NetworkAccessPoint]:
+    app_mode = app_model.mode if isinstance(app_model.mode, AppMode) else AppMode.value_of(str(app_model.mode))
+    available = _ACCESS_POINTS_BY_APP_MODE.get(app_mode)
+    if available is None:
+        raise BadRequest(f"Network access control is not supported for app mode '{app_mode.value}'.")
+    return list(available)
+
+
+def _validate_app_access_points(
+    requested: list[NetworkAccessPoint],
+    available: list[NetworkAccessPoint],
+) -> None:
+    unsupported = sorted(set(requested).difference(available))
+    if unsupported:
+        raise BadRequest(f"Unsupported access points for this app: {', '.join(unsupported)}.")
+
+
+def _effective_entitlement(tenant_id: str, upstream_entitled: object) -> bool:
+    return bool(upstream_entitled) and is_cloud_edition_billing_paid_plan(tenant_id)
+
+
+def _normalize_app_binding_defaults(payload: dict) -> None:
+    """Materialize ProtoJSON defaults so the Console response stays stable."""
+
+    payload.setdefault("binding", None)
+    binding = payload.get("binding")
+    if not isinstance(binding, dict):
+        return
+    binding.setdefault("enabled", False)
+    if "access_points" not in binding and "accessPoints" not in binding:
+        binding["access_points"] = []
+
+
 def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
     """Authorize management against the persisted current-workspace membership."""
 
@@ -145,7 +239,6 @@ def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception
             "NETWORK_ACCESS_VERSION_CONFLICT": "The network access resource changed. Refresh it and try again.",
             "NETWORK_ACCESS_GROUP_NAME_CONFLICT": "A network access group with this name already exists.",
             "NETWORK_ACCESS_GROUP_LIMIT": "This workspace has reached the network access group limit.",
-            "NETWORK_ACCESS_GROUP_BOUND": ("Unassign this network access group from every app before deleting it."),
         }
         return Conflict(message_by_reason.get(exc.reason or "", "The network access resource is in conflict."))
     if exc.status_code >= 500:
@@ -179,6 +272,8 @@ def get(self, current_tenant_id: str, current_user: Account):
             payload = BillingService.list_network_access_groups(current_tenant_id, current_user.id)
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        payload["entitled"] = _effective_entitlement(current_tenant_id, payload.get("entitled"))
+        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
         return _serialize_response(NetworkAccessGroupListResponse, payload)
 
     @console_ns.expect(console_ns.models[NetworkAccessGroupCreatePayload.__name__])
@@ -191,6 +286,7 @@ def get(self, current_tenant_id: str, current_user: Account):
     @login_required
     @account_initialization_required
     @only_edition_cloud
+    @cloud_edition_billing_paid_plan_required
     @with_current_user
     @with_current_tenant_id
     @model_validate(NetworkAccessGroupCreatePayload)
@@ -206,12 +302,12 @@ def post(
                 current_tenant_id,
                 name=req_data.name,
                 description=req_data.description,
-                mode=req_data.mode,
                 allowed_cidrs=req_data.allowed_cidrs,
                 actor_account_id=current_user.id,
             )
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
         return _serialize_response(NetworkAccessGroupMutationResponse, payload), 201
 
 
@@ -234,6 +330,7 @@ def get(self, current_tenant_id: str, current_user: Account, group_id: UUID):
             payload = BillingService.get_network_access_group(current_tenant_id, str(group_id), current_user.id)
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
         return _serialize_response(NetworkAccessGroupMutationResponse, payload)
 
     @console_ns.expect(console_ns.models[NetworkAccessGroupUpdatePayload.__name__])
@@ -246,6 +343,7 @@ def get(self, current_tenant_id: str, current_user: Account, group_id: UUID):
     @login_required
     @account_initialization_required
     @only_edition_cloud
+    @cloud_edition_billing_paid_plan_required
     @with_current_user
     @with_current_tenant_id
     @model_validate(NetworkAccessGroupUpdatePayload)
@@ -263,13 +361,13 @@ def put(
                 str(group_id),
                 name=req_data.name,
                 description=req_data.description,
-                mode=req_data.mode,
                 allowed_cidrs=req_data.allowed_cidrs,
                 expected_version=req_data.expected_version,
                 actor_account_id=current_user.id,
             )
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
         return _serialize_response(NetworkAccessGroupMutationResponse, payload)
 
     @console_ns.doc(params=query_params_from_model(NetworkAccessGroupDeleteQuery))
@@ -282,6 +380,7 @@ def put(
     @login_required
     @account_initialization_required
     @only_edition_cloud
+    @cloud_edition_billing_paid_plan_required
     @with_current_user
     @with_current_tenant_id
     @model_validate(NetworkAccessGroupDeleteQuery)
@@ -321,6 +420,7 @@ class AppNetworkAccessGroupApi(Resource):
     @get_app_model
     def get(self, current_tenant_id: str, current_user: Account, app_model: App):
         _ensure_workspace_admin_or_owner(current_user)
+        available_access_points = _available_access_points(app_model)
         try:
             payload = BillingService.get_app_network_access_group(
                 current_tenant_id,
@@ -329,6 +429,9 @@ def get(self, current_tenant_id: str, current_user: Account, app_model: App):
             )
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        _normalize_app_binding_defaults(payload)
+        payload["entitled"] = _effective_entitlement(current_tenant_id, payload.get("entitled"))
+        payload["available_access_points"] = available_access_points
         return _serialize_response(AppNetworkAccessGroupResponse, payload)
 
     @console_ns.expect(console_ns.models[AppNetworkAccessGroupUpdatePayload.__name__])
@@ -341,6 +444,7 @@ def get(self, current_tenant_id: str, current_user: Account, app_model: App):
     @login_required
     @account_initialization_required
     @only_edition_cloud
+    @cloud_edition_billing_paid_plan_required
     @with_current_user
     @with_current_tenant_id
     @get_app_model
@@ -353,14 +457,20 @@ def put(
         app_model: App,
     ):
         _ensure_workspace_admin_or_owner(current_user)
+        available_access_points = _available_access_points(app_model)
+        _validate_app_access_points(req_data.access_points, available_access_points)
         try:
             payload = BillingService.update_app_network_access_group(
                 current_tenant_id,
                 str(app_model.id),
+                enabled=req_data.enabled,
                 group_id=str(req_data.group_id) if req_data.group_id is not None else None,
+                access_points=list(req_data.access_points),
                 expected_version=req_data.expected_version,
                 actor_account_id=current_user.id,
             )
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
+        _normalize_app_binding_defaults(payload)
+        payload["available_access_points"] = available_access_points
         return _serialize_response(AppNetworkAccessGroupMutationResponse, payload)
diff --git a/api/controllers/console/wraps.py b/api/controllers/console/wraps.py
index 8e353c6c980664..f279a70f2ed362 100644
--- a/api/controllers/console/wraps.py
+++ b/api/controllers/console/wraps.py
@@ -159,15 +159,26 @@ def decorated(*args: P.args, **kwargs: P.kwargs):
     return decorated
 
 
+def is_cloud_edition_billing_paid_plan(tenant_id: str) -> bool:
+    """Return whether a Cloud workspace has a paid subscription.
+
+    Keep this predicate shared with the mutation decorator so read endpoints can
+    expose an entitlement flag without rejecting Sandbox workspaces that need to
+    render an upgrade state.
+    """
+
+    billing_info = BillingService.get_info(tenant_id, exclude_vector_space=True)
+    return billing_info["enabled"] and billing_info["subscription"]["plan"] in (
+        CloudPlan.PROFESSIONAL,
+        CloudPlan.TEAM,
+    )
+
+
 def cloud_edition_billing_paid_plan_required[**P, R](view: Callable[P, R]) -> Callable[P, R]:
     @wraps(view)
     def decorated(*args: P.args, **kwargs: P.kwargs):
         _, current_tenant_id = current_account_with_tenant()
-        billing_info = BillingService.get_info(current_tenant_id, exclude_vector_space=True)
-        if not billing_info["enabled"] or billing_info["subscription"]["plan"] not in (
-            CloudPlan.PROFESSIONAL,
-            CloudPlan.TEAM,
-        ):
+        if not is_cloud_edition_billing_paid_plan(current_tenant_id):
             abort(403, "This feature requires a paid plan.")
         return view(*args, **kwargs)
 
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index ee8dedb1ebe1e1..ed560ec41f4214 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -15329,8 +15329,10 @@ AppMCPServer Status Enum
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
 | app_id | string |  | Yes |
 | created_at | dateTime |  | Yes |
+| enabled | boolean |  | Yes |
 | group_id | string |  | No |
 | id | string |  | Yes |
 | tenant_id | string |  | Yes |
@@ -15342,6 +15344,7 @@ AppMCPServer Status Enum
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| available_access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
 | binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
 
 #### AppNetworkAccessGroupResponse
@@ -15349,6 +15352,7 @@ AppMCPServer Status Enum
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | app_id | string |  | Yes |
+| available_access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
 | binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
 | entitled | boolean |  | Yes |
 | tenant_id | string |  | Yes |
@@ -15357,6 +15361,8 @@ AppMCPServer Status Enum
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
+| enabled | boolean |  | Yes |
 | expected_version | integer |  | Yes |
 | group_id | string |  | Yes |
 
@@ -19254,13 +19260,22 @@ Model with provider entity.
 | dataset | [ResourcePermissionSnapshot](#resourcepermissionsnapshot) |  | No |
 | workspace | [WorkspacePermissionSnapshot](#workspacepermissionsnapshot) |  | No |
 
+#### NetworkAccessGroupAppResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| icon | string |  | No |
+| icon_background | string |  | No |
+| icon_type | string |  | No |
+| id | string |  | Yes |
+| name | string |  | Yes |
+
 #### NetworkAccessGroupCreatePayload
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
 | allowed_cidrs | [ string ] |  | Yes |
 | description | string |  | No |
-| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
 | name | string |  | Yes |
 
 #### NetworkAccessGroupDeleteResponse
@@ -19287,15 +19302,17 @@ Model with provider entity.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
-| allowed_cidrs | [ string ] |  | No |
+| allowed_cidrs | [ string ] |  | Yes |
+| app_ids | [ string ] |  | Yes |
+| apps | [ [NetworkAccessGroupAppResponse](#networkaccessgroupappresponse) ] |  | Yes |
 | created_at | dateTime |  | Yes |
 | description | string |  | No |
 | id | string |  | Yes |
-| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
 | name | string |  | Yes |
 | tenant_id | string |  | Yes |
 | updated_at | dateTime |  | Yes |
 | updated_by_account_id | string |  | No |
+| used_by_count | integer |  | Yes |
 | version | integer |  | Yes |
 
 #### NetworkAccessGroupUpdatePayload
@@ -19305,7 +19322,6 @@ Model with provider entity.
 | allowed_cidrs | [ string ] |  | Yes |
 | description | string |  | No |
 | expected_version | integer |  | Yes |
-| mode | string, <br>**Available values:** "disabled", "enforce", "shadow" | *Enum:* `"disabled"`, `"enforce"`, `"shadow"` | Yes |
 | name | string |  | Yes |
 
 #### NewAppResponse
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index c5b7314f4f2b16..43a58acc525c65 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -450,7 +450,6 @@ def create_network_access_group(
         *,
         name: str,
         description: str,
-        mode: str,
         allowed_cidrs: list[str],
         actor_account_id: str,
     ) -> dict[str, Any]:
@@ -462,7 +461,6 @@ def create_network_access_group(
             payload_json={
                 "name": name,
                 "description": description,
-                "mode": mode,
                 "allowed_cidrs": allowed_cidrs,
                 "actor_account_id": actor_account_id,
             },
@@ -491,7 +489,6 @@ def update_network_access_group(
         *,
         name: str,
         description: str,
-        mode: str,
         allowed_cidrs: list[str],
         expected_version: int,
         actor_account_id: str,
@@ -504,7 +501,6 @@ def update_network_access_group(
             payload_json={
                 "name": name,
                 "description": description,
-                "mode": mode,
                 "allowed_cidrs": allowed_cidrs,
                 "expected_version": expected_version,
                 "actor_account_id": actor_account_id,
@@ -520,7 +516,7 @@ def delete_network_access_group(
         expected_version: int,
         actor_account_id: str,
     ) -> dict[str, Any]:
-        """Delete an unbound reusable group using optimistic concurrency control."""
+        """Delete a reusable group using optimistic concurrency control."""
 
         return cls._send_network_access_group_request(
             "DELETE",
@@ -552,17 +548,21 @@ def update_app_network_access_group(
         tenant_id: str,
         app_id: str,
         *,
+        enabled: bool,
         group_id: str | None,
+        access_points: list[str],
         expected_version: int,
         actor_account_id: str,
     ) -> dict[str, Any]:
-        """Assign or unassign one reusable group from a tenant-scoped app."""
+        """Atomically replace one tenant-scoped App's complete network access configuration."""
 
         return cls._send_network_access_group_request(
             "PUT",
             f"/tenants/{tenant_id}/apps/{app_id}/network-access-group",
             payload_json={
+                "enabled": enabled,
                 "group_id": group_id,
+                "access_points": access_points,
                 "expected_version": expected_version,
                 "actor_account_id": actor_account_id,
             },
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
new file mode 100644
index 00000000000000..02c3685a37a118
--- /dev/null
+++ b/api/services/network_access_group_service.py
@@ -0,0 +1,74 @@
+from typing import Any
+
+from sqlalchemy import select
+
+from extensions.ext_database import db
+from models import App
+
+
+class NetworkAccessGroupService:
+    """Dify-side orchestration for SaaS network access group responses."""
+
+    @staticmethod
+    def enrich_app_references(
+        payload: dict[str, Any],
+        tenant_id: str,
+    ) -> dict[str, Any]:
+        """Attach tenant-scoped App display metadata to one or more group payloads."""
+
+        raw_groups: list[object] = []
+        if isinstance(payload.get("group"), dict):
+            raw_groups.append(payload["group"])
+        if isinstance(payload.get("groups"), list):
+            raw_groups.extend(payload["groups"])
+
+        groups = [group for group in raw_groups if isinstance(group, dict)]
+        for group in groups:
+            raw_app_ids = (
+                group.get("used_by_app_ids")
+                or group.get("usedByAppIds")
+                or group.get("app_ids")
+                or group.get("appIds")
+                or []
+            )
+            group["app_ids"] = list(raw_app_ids) if isinstance(raw_app_ids, list) else raw_app_ids
+            raw_count = group.get("used_by_count")
+            if raw_count is None:
+                raw_count = group.get("usedByCount")
+            if raw_count is None:
+                raw_count = len(raw_app_ids) if isinstance(raw_app_ids, list) else 0
+            group["used_by_count"] = raw_count
+
+        app_ids = {
+            str(app_id)
+            for group in groups
+            if isinstance(group["app_ids"], list)
+            for app_id in group["app_ids"]
+            if app_id
+        }
+        if not app_ids:
+            for group in groups:
+                group["apps"] = []
+            return payload
+
+        app_models = db.session.scalars(
+            select(App).where(
+                App.tenant_id == tenant_id,
+                App.id.in_(app_ids),
+                App.status == "normal",
+            )
+        ).all()
+        apps_by_id = {
+            str(app.id): {
+                "id": str(app.id),
+                "name": app.name,
+                "icon": app.icon,
+                "icon_type": getattr(app.icon_type, "value", app.icon_type) if app.icon_type is not None else None,
+                "icon_background": app.icon_background,
+            }
+            for app in app_models
+        }
+        for group in groups:
+            group_app_ids = group["app_ids"] if isinstance(group["app_ids"], list) else []
+            group["apps"] = [apps_by_id[str(app_id)] for app_id in group_app_ids if str(app_id) in apps_by_id]
+        return payload
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 586a9e0f73671b..42e09bbe5036af 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -1,7 +1,9 @@
+from collections.abc import Iterator
 from datetime import UTC, datetime
 from inspect import unwrap
 from types import SimpleNamespace
-from unittest.mock import patch
+from typing import cast
+from unittest.mock import MagicMock, patch
 from uuid import UUID
 
 import pytest
@@ -16,10 +18,13 @@
     NetworkAccessGroupCreatePayload,
     NetworkAccessGroupDeleteQuery,
     NetworkAccessGroupUpdatePayload,
+    _available_access_points,
+    _effective_entitlement,
     _translate_upstream_error,
 )
-from models import TenantAccountRole
+from models import App, AppMode, TenantAccountRole
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+from services.network_access_group_service import NetworkAccessGroupService
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
 ACCOUNT_ID = "22222222-2222-4222-8222-222222222222"
@@ -32,14 +37,25 @@ def _current_user(role: TenantAccountRole = TenantAccountRole.OWNER) -> SimpleNa
     return SimpleNamespace(id=ACCOUNT_ID, current_role=role)
 
 
-def _group_payload() -> dict[str, object]:
+@pytest.fixture(autouse=True)
+def paid_entitlement() -> Iterator[None]:
+    with patch(
+        "controllers.console.workspace.network_access_group._effective_entitlement",
+        side_effect=lambda _tenant_id, upstream: bool(upstream),
+    ):
+        yield
+
+
+def _group_payload(*, app_ids: list[str] | None = None) -> dict[str, object]:
+    app_ids = app_ids or []
     return {
         "id": GROUP_ID,
         "tenantId": TENANT_ID,
         "name": "Office network",
         "description": "Reusable office egress addresses",
-        "mode": "enforce",
         "allowedCidrs": ["203.0.113.7/32"],
+        "usedByCount": len(app_ids),
+        "usedByAppIds": app_ids,
         # ProtoJSON represents int64 values as strings and timestamps as RFC 3339.
         "version": "2",
         "updatedByAccountId": ACCOUNT_ID,
@@ -48,12 +64,19 @@ def _group_payload() -> dict[str, object]:
     }
 
 
-def _binding_payload(*, group_id: str | None = GROUP_ID) -> dict[str, object]:
+def _binding_payload(
+    *,
+    enabled: bool = True,
+    group_id: str | None = GROUP_ID,
+    access_points: list[str] | None = None,
+) -> dict[str, object]:
     return {
         "id": BINDING_ID,
         "tenantId": TENANT_ID,
         "appId": APP_ID,
+        "enabled": enabled,
         "groupId": group_id,
+        "accessPoints": ["webapp", "service_api"] if access_points is None else access_points,
         "version": "3",
         "updatedByAccountId": ACCOUNT_ID,
         "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
@@ -76,6 +99,9 @@ def test_list_authorizes_and_forwards_tenant_and_actor() -> None:
     assert result["tenant_id"] == TENANT_ID
     assert result["groups"][0]["name"] == "Office network"
     assert result["groups"][0]["version"] == 2
+    assert result["groups"][0]["used_by_count"] == 0
+    assert result["groups"][0]["app_ids"] == []
+    assert result["groups"][0]["apps"] == []
     assert result["groups"][0]["updated_at"] == "2026-08-21T00:00:00Z"
 
 
@@ -86,7 +112,6 @@ def test_create_injects_actor_and_returns_created_contract() -> None:
     request_payload = NetworkAccessGroupCreatePayload(
         name="Office network",
         description="Reusable office egress addresses",
-        mode="enforce",
         allowed_cidrs=["203.0.113.7/32"],
     )
 
@@ -108,7 +133,6 @@ def test_create_injects_actor_and_returns_created_contract() -> None:
         TENANT_ID,
         name="Office network",
         description="Reusable office egress addresses",
-        mode="enforce",
         allowed_cidrs=["203.0.113.7/32"],
         actor_account_id=ACCOUNT_ID,
     )
@@ -123,7 +147,6 @@ def test_update_group_forwards_path_id_and_expected_version() -> None:
     request_payload = NetworkAccessGroupUpdatePayload(
         name="Office network",
         description="Updated",
-        mode="shadow",
         allowed_cidrs=["203.0.113.0/24"],
         expected_version=1,
     )
@@ -148,7 +171,6 @@ def test_update_group_forwards_path_id_and_expected_version() -> None:
         GROUP_ID,
         name="Office network",
         description="Updated",
-        mode="shadow",
         allowed_cidrs=["203.0.113.0/24"],
         expected_version=1,
         actor_account_id=ACCOUNT_ID,
@@ -189,8 +211,8 @@ def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> N
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.get)
     current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
-    upstream_payload = {"tenantId": TENANT_ID, "appId": APP_ID, "entitled": True, "binding": None}
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
+    upstream_payload = {"tenantId": TENANT_ID, "appId": APP_ID, "entitled": True}
 
     with (
         patch.object(
@@ -208,21 +230,27 @@ def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> N
 
     get_binding.assert_called_once_with(TENANT_ID, APP_ID, ACCOUNT_ID)
     assert result["binding"] is None
+    assert result["available_access_points"] == ["webapp", "service_api", "mcp"]
 
 
-@pytest.mark.parametrize("group_id", [GROUP_ID, None])
-def test_app_put_assigns_or_unassigns_group(group_id: str | None) -> None:
+@pytest.mark.parametrize("enabled", [True, False])
+def test_app_put_atomically_saves_enabled_group_and_access_points(enabled: bool) -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.put)
     current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
-    request_payload = AppNetworkAccessGroupUpdatePayload(group_id=group_id, expected_version=2)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
+    request_payload = AppNetworkAccessGroupUpdatePayload(
+        enabled=enabled,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
+        expected_version=2,
+    )
 
     with (
         patch.object(
             BillingService,
             "update_app_network_access_group",
-            return_value={"binding": _binding_payload(group_id=group_id)},
+            return_value={"binding": _binding_payload(enabled=enabled)},
         ) as update_binding,
     ):
         result = method(
@@ -236,12 +264,17 @@ def test_app_put_assigns_or_unassigns_group(group_id: str | None) -> None:
     update_binding.assert_called_once_with(
         TENANT_ID,
         APP_ID,
-        group_id=group_id,
+        enabled=enabled,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
         expected_version=2,
         actor_account_id=ACCOUNT_ID,
     )
-    assert result["binding"]["group_id"] == group_id
+    assert result["binding"]["enabled"] is enabled
+    assert result["binding"]["group_id"] == GROUP_ID
+    assert result["binding"]["access_points"] == ["webapp", "service_api"]
     assert result["binding"]["version"] == 3
+    assert result["available_access_points"] == ["webapp", "service_api", "mcp"]
 
 
 def test_list_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
@@ -280,7 +313,6 @@ def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPE
         ("NETWORK_ACCESS_VERSION_CONFLICT", "changed"),
         ("NETWORK_ACCESS_GROUP_NAME_CONFLICT", "already exists"),
         ("NETWORK_ACCESS_GROUP_LIMIT", "reached"),
-        ("NETWORK_ACCESS_GROUP_BOUND", "Unassign"),
     ],
 )
 def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, expected_message: str) -> None:
@@ -304,20 +336,21 @@ def test_list_maps_invalid_upstream_contract_to_bad_gateway() -> None:
         patch.object(
             BillingService,
             "list_network_access_groups",
-            return_value={"tenant_id": TENANT_ID, "entitled": True, "groups": [{"mode": "disabled"}]},
+            return_value={"tenant_id": TENANT_ID, "entitled": True, "groups": [{"allowed_cidrs": []}]},
         ),
         pytest.raises(BadGateway),
     ):
         method(api, current_tenant_id=TENANT_ID, current_user=current_user)
 
 
-def test_response_contract_accepts_protojson_omitted_empty_group_fields() -> None:
+def test_response_contract_accepts_protojson_omitted_optional_group_fields() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)
     current_user = _current_user()
     group = _group_payload()
     group.pop("description")
-    group.pop("allowedCidrs")
+    group.pop("usedByAppIds")
+    group.pop("usedByCount")
 
     with (
         patch.object(
@@ -329,17 +362,26 @@ def test_response_contract_accepts_protojson_omitted_empty_group_fields() -> Non
         result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
 
     assert result["groups"][0]["description"] == ""
-    assert result["groups"][0]["allowed_cidrs"] == []
+    assert result["groups"][0]["allowed_cidrs"] == ["203.0.113.7/32"]
+    assert result["groups"][0]["app_ids"] == []
+    assert result["groups"][0]["used_by_count"] == 0
 
 
-def test_binding_response_accepts_protojson_omitted_null_group_id() -> None:
+def test_binding_response_materializes_protojson_omitted_disabled_defaults() -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.put)
     current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID)
-    request_payload = AppNetworkAccessGroupUpdatePayload(group_id=None, expected_version=2)
-    binding = _binding_payload(group_id=None)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
+    request_payload = AppNetworkAccessGroupUpdatePayload(
+        enabled=False,
+        group_id=None,
+        access_points=[],
+        expected_version=2,
+    )
+    binding = _binding_payload(enabled=False, group_id=None, access_points=[])
     binding.pop("groupId")
+    binding.pop("enabled")
+    binding.pop("accessPoints")
 
     with (
         patch.object(
@@ -357,14 +399,41 @@ def test_binding_response_accepts_protojson_omitted_null_group_id() -> None:
         )
 
     assert result["binding"]["group_id"] is None
+    assert result["binding"]["enabled"] is False
+    assert result["binding"]["access_points"] == []
+
+
+def test_binding_response_accepts_policy_id_alias() -> None:
+    api = AppNetworkAccessGroupApi()
+    method = unwrap(api.put)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
+    request_payload = AppNetworkAccessGroupUpdatePayload(
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp"],
+        expected_version=2,
+    )
+    binding = _binding_payload(access_points=["webapp"])
+    binding["policyId"] = binding.pop("groupId")
+
+    with patch.object(BillingService, "update_app_network_access_group", return_value={"binding": binding}):
+        result = method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=_current_user(),
+            app_model=app_model,
+        )
+
+    assert result["binding"]["group_id"] == GROUP_ID
 
 
 @pytest.mark.parametrize(
     "payload",
     [
-        {"name": "", "description": "", "mode": "disabled", "allowed_cidrs": []},
-        {"name": "group", "description": "", "mode": "unknown", "allowed_cidrs": []},
-        {"name": "group", "description": "", "mode": "disabled", "allowed_cidrs": ["127.0.0.1"] * 101},
+        {"name": "", "description": "", "allowed_cidrs": []},
+        {"name": "group", "description": "", "allowed_cidrs": []},
+        {"name": "group", "description": "", "allowed_cidrs": ["127.0.0.1"] * 101},
     ],
 )
 def test_create_payload_contract_rejects_invalid_shapes(payload: dict[str, object]) -> None:
@@ -374,4 +443,159 @@ def test_create_payload_contract_rejects_invalid_shapes(payload: dict[str, objec
 
 def test_binding_payload_rejects_invalid_group_id_and_version() -> None:
     with pytest.raises(ValidationError):
-        AppNetworkAccessGroupUpdatePayload.model_validate({"group_id": "not-a-uuid", "expected_version": -1})
+        AppNetworkAccessGroupUpdatePayload.model_validate(
+            {
+                "enabled": True,
+                "group_id": "not-a-uuid",
+                "access_points": ["webapp"],
+                "expected_version": -1,
+            }
+        )
+
+
+@pytest.mark.parametrize(
+    ("app_mode", "expected"),
+    [
+        (AppMode.WORKFLOW, ["webapp", "service_api", "mcp", "trigger"]),
+        (AppMode.ADVANCED_CHAT, ["webapp", "service_api", "mcp"]),
+        (AppMode.CHAT, ["webapp", "service_api", "mcp"]),
+        (AppMode.COMPLETION, ["webapp", "service_api", "mcp"]),
+        (AppMode.AGENT_CHAT, ["webapp", "service_api"]),
+    ],
+)
+def test_available_access_points_are_derived_from_app_mode(app_mode: AppMode, expected: list[str]) -> None:
+    app_model = SimpleNamespace(mode=app_mode)
+
+    assert _available_access_points(cast(App, app_model)) == expected
+
+
+@pytest.mark.parametrize("app_mode", [AppMode.AGENT, AppMode.CHANNEL, AppMode.RAG_PIPELINE])
+def test_unsupported_app_modes_are_rejected(app_mode: AppMode) -> None:
+    with pytest.raises(BadRequest, match="not supported"):
+        _available_access_points(cast(App, SimpleNamespace(mode=app_mode)))
+
+
+def test_app_put_rejects_access_point_not_available_for_mode_before_upstream_call() -> None:
+    api = AppNetworkAccessGroupApi()
+    method = unwrap(api.put)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.AGENT_CHAT)
+    request_payload = AppNetworkAccessGroupUpdatePayload(
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp", "mcp"],
+        expected_version=1,
+    )
+
+    with (
+        patch.object(BillingService, "update_app_network_access_group") as update_binding,
+        pytest.raises(BadRequest, match="mcp"),
+    ):
+        method(
+            api,
+            req_data=request_payload,
+            current_tenant_id=TENANT_ID,
+            current_user=_current_user(),
+            app_model=app_model,
+        )
+
+    update_binding.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        {"enabled": True, "group_id": None, "access_points": ["webapp"], "expected_version": 0},
+        {"enabled": True, "group_id": GROUP_ID, "access_points": [], "expected_version": 0},
+        {
+            "enabled": True,
+            "group_id": GROUP_ID,
+            "access_points": ["webapp", "webapp"],
+            "expected_version": 0,
+        },
+        {"enabled": True, "group_id": GROUP_ID, "access_points": ["unknown"], "expected_version": 0},
+    ],
+)
+def test_enabled_app_config_rejects_incomplete_or_invalid_access_points(payload: dict[str, object]) -> None:
+    with pytest.raises(ValidationError):
+        AppNetworkAccessGroupUpdatePayload.model_validate(payload)
+
+
+def test_app_config_accepts_policy_id_alias_and_disabled_draft() -> None:
+    payload = AppNetworkAccessGroupUpdatePayload.model_validate(
+        {
+            "enabled": False,
+            "policy_id": GROUP_ID,
+            "accessPoints": ["webapp", "service_api"],
+            "expected_version": 3,
+        }
+    )
+
+    assert str(payload.group_id) == GROUP_ID
+    assert payload.access_points == ["webapp", "service_api"]
+
+
+def test_group_responses_are_enriched_with_tenant_scoped_app_metadata() -> None:
+    app_id_2 = "66666666-6666-4666-8666-666666666666"
+    payload = {
+        "group": _group_payload(app_ids=[APP_ID, app_id_2]),
+    }
+    payload["group"].pop("usedByCount")
+    app = SimpleNamespace(
+        id=APP_ID,
+        name="Customer support",
+        icon="robot",
+        icon_type=SimpleNamespace(value="emoji"),
+        icon_background="#FFFFFF",
+    )
+    db_mock = MagicMock()
+    db_mock.session.scalars.return_value.all.return_value = [app]
+
+    with patch("services.network_access_group_service.db", db_mock):
+        result = NetworkAccessGroupService.enrich_app_references(payload, TENANT_ID)
+
+    assert result["group"]["apps"] == [
+        {
+            "id": APP_ID,
+            "name": "Customer support",
+            "icon": "robot",
+            "icon_type": "emoji",
+            "icon_background": "#FFFFFF",
+        }
+    ]
+    assert result["group"]["app_ids"] == [APP_ID, app_id_2]
+    assert result["group"]["used_by_count"] == 2
+    db_mock.session.scalars.assert_called_once()
+
+
+def test_sandbox_read_returns_not_entitled_for_upgrade_state() -> None:
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
+    method = unwrap(api.get)
+    upstream_payload: dict[str, object] = {
+        "tenantId": TENANT_ID,
+        "entitled": True,
+        "groups": list[object](),
+    }
+
+    with (
+        patch.object(BillingService, "list_network_access_groups", return_value=upstream_payload),
+        patch("controllers.console.workspace.network_access_group._effective_entitlement", return_value=False),
+    ):
+        result = method(api, current_tenant_id=TENANT_ID, current_user=_current_user())
+
+    assert result["entitled"] is False
+
+
+@pytest.mark.parametrize(
+    ("upstream_entitled", "paid_plan", "expected"),
+    [(True, True, True), (False, True, False), (True, False, False)],
+)
+def test_effective_entitlement_requires_rollout_and_paid_plan(
+    upstream_entitled: bool,
+    paid_plan: bool,
+    expected: bool,
+) -> None:
+    with patch(
+        "controllers.console.workspace.network_access_group.is_cloud_edition_billing_paid_plan",
+        return_value=paid_plan,
+    ):
+        assert _effective_entitlement(TENANT_ID, upstream_entitled) is expected
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
index 71c429ec2ed8ab..d24297efe09870 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -70,7 +70,6 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
             TENANT_ID,
             name="Office",
             description="Office egress",
-            mode="enforce",
             allowed_cidrs=["203.0.113.7/32"],
             actor_account_id=ACCOUNT_ID,
         )
@@ -79,7 +78,6 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
             GROUP_ID,
             name="Office",
             description="Updated office egress",
-            mode="shadow",
             allowed_cidrs=["203.0.113.0/24"],
             expected_version=1,
             actor_account_id=ACCOUNT_ID,
@@ -98,7 +96,6 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
             json={
                 "name": "Office",
                 "description": "Office egress",
-                "mode": "enforce",
                 "allowed_cidrs": ["203.0.113.7/32"],
                 "actor_account_id": ACCOUNT_ID,
             },
@@ -112,7 +109,6 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
             json={
                 "name": "Office",
                 "description": "Updated office egress",
-                "mode": "shadow",
                 "allowed_cidrs": ["203.0.113.0/24"],
                 "expected_version": 1,
                 "actor_account_id": ACCOUNT_ID,
@@ -133,12 +129,28 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
 
 
 @pytest.mark.usefixtures("billing_config")
-def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
+def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
-        {"binding": {"app_id": APP_ID, "group_id": GROUP_ID, "version": "1"}},
-        {"binding": {"app_id": APP_ID, "group_id": None, "version": "2"}},
+        {
+            "binding": {
+                "app_id": APP_ID,
+                "enabled": True,
+                "group_id": GROUP_ID,
+                "access_points": ["webapp", "service_api"],
+                "version": "1",
+            }
+        },
+        {
+            "binding": {
+                "app_id": APP_ID,
+                "enabled": False,
+                "group_id": GROUP_ID,
+                "access_points": ["webapp", "service_api"],
+                "version": "2",
+            }
+        },
     ]
 
     with patch("services.billing_service._http_client.request", return_value=response) as request:
@@ -146,14 +158,18 @@ def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
         BillingService.update_app_network_access_group(
             TENANT_ID,
             APP_ID,
+            enabled=True,
             group_id=GROUP_ID,
+            access_points=["webapp", "service_api"],
             expected_version=0,
             actor_account_id=ACCOUNT_ID,
         )
         BillingService.update_app_network_access_group(
             TENANT_ID,
             APP_ID,
-            group_id=None,
+            enabled=False,
+            group_id=GROUP_ID,
+            access_points=["webapp", "service_api"],
             expected_version=1,
             actor_account_id=ACCOUNT_ID,
         )
@@ -171,7 +187,13 @@ def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
         call(
             "PUT",
             endpoint,
-            json={"group_id": GROUP_ID, "expected_version": 0, "actor_account_id": ACCOUNT_ID},
+            json={
+                "enabled": True,
+                "group_id": GROUP_ID,
+                "access_points": ["webapp", "service_api"],
+                "expected_version": 0,
+                "actor_account_id": ACCOUNT_ID,
+            },
             params=None,
             headers=HEADERS,
             follow_redirects=True,
@@ -179,7 +201,13 @@ def test_app_binding_read_and_write_use_tenant_and_app_path() -> None:
         call(
             "PUT",
             endpoint,
-            json={"group_id": None, "expected_version": 1, "actor_account_id": ACCOUNT_ID},
+            json={
+                "enabled": False,
+                "group_id": GROUP_ID,
+                "access_points": ["webapp", "service_api"],
+                "expected_version": 1,
+                "actor_account_id": ACCOUNT_ID,
+            },
             params=None,
             headers=HEADERS,
             follow_redirects=True,
@@ -220,7 +248,7 @@ def test_network_access_group_request_preserves_upstream_status(status_code: int
 
 def test_network_access_group_request_preserves_whitelisted_upstream_reason() -> None:
     response = MagicMock(status_code=httpx.codes.CONFLICT)
-    response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_GROUP_BOUND", "message": "internal"}
+    response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_VERSION_CONFLICT", "message": "internal"}
     with (
         patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
@@ -228,7 +256,7 @@ def test_network_access_group_request_preserves_whitelisted_upstream_reason() ->
         BillingService._send_network_access_group_request("DELETE", "/groups/id")
 
     assert exc_info.value.status_code == httpx.codes.CONFLICT
-    assert exc_info.value.reason == "NETWORK_ACCESS_GROUP_BOUND"
+    assert exc_info.value.reason == "NETWORK_ACCESS_VERSION_CONFLICT"
 
 
 def test_network_access_group_request_maps_transport_failure_to_service_unavailable() -> None:
diff --git a/packages/contracts/generated/api/console/apps/types.gen.ts b/packages/contracts/generated/api/console/apps/types.gen.ts
index b94f4f764163ac..95c089f6390b00 100644
--- a/packages/contracts/generated/api/console/apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/apps/types.gen.ts
@@ -574,17 +574,21 @@ export type AppNamePayload = {
 
 export type AppNetworkAccessGroupResponse = {
   app_id: string
+  available_access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
   binding: AppNetworkAccessGroupBindingResponse | null
   entitled: boolean
   tenant_id: string
 }
 
 export type AppNetworkAccessGroupUpdatePayload = {
+  access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
+  enabled: boolean
   expected_version: number
   group_id: string | null
 }
 
 export type AppNetworkAccessGroupMutationResponse = {
+  available_access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
   binding: AppNetworkAccessGroupBindingResponse
 }
 
@@ -1648,8 +1652,10 @@ export type MessageFile = {
 }
 
 export type AppNetworkAccessGroupBindingResponse = {
+  access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
   app_id: string
   created_at: string
+  enabled: boolean
   group_id?: string | null
   id: string
   tenant_id: string
diff --git a/packages/contracts/generated/api/console/apps/zod.gen.ts b/packages/contracts/generated/api/console/apps/zod.gen.ts
index 299259af22cf71..9346323cad0d2e 100644
--- a/packages/contracts/generated/api/console/apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/apps/zod.gen.ts
@@ -350,6 +350,8 @@ export const zAppNamePayload = z.object({
  * AppNetworkAccessGroupUpdatePayload
  */
 export const zAppNetworkAccessGroupUpdatePayload = z.object({
+  access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])).max(4),
+  enabled: z.boolean(),
   expected_version: z.int().gte(0),
   group_id: z.uuid().nullable(),
 })
@@ -1338,8 +1340,10 @@ export const zMessageFile = z.object({
  * AppNetworkAccessGroupBindingResponse
  */
 export const zAppNetworkAccessGroupBindingResponse = z.object({
+  access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])).max(4),
   app_id: z.string(),
   created_at: z.iso.datetime(),
+  enabled: z.boolean(),
   group_id: z.string().nullish(),
   id: z.string(),
   tenant_id: z.string(),
@@ -1353,6 +1357,7 @@ export const zAppNetworkAccessGroupBindingResponse = z.object({
  */
 export const zAppNetworkAccessGroupResponse = z.object({
   app_id: z.string(),
+  available_access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])),
   binding: zAppNetworkAccessGroupBindingResponse.nullable(),
   entitled: z.boolean(),
   tenant_id: z.string(),
@@ -1362,6 +1367,7 @@ export const zAppNetworkAccessGroupResponse = z.object({
  * AppNetworkAccessGroupMutationResponse
  */
 export const zAppNetworkAccessGroupMutationResponse = z.object({
+  available_access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])),
   binding: zAppNetworkAccessGroupBindingResponse,
 })
 
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 0922d0abc2d764..449a17de4b8ad0 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -373,7 +373,6 @@ export type NetworkAccessGroupListResponse = {
 export type NetworkAccessGroupCreatePayload = {
   allowed_cidrs: Array<string>
   description?: string
-  mode: 'disabled' | 'enforce' | 'shadow'
   name: string
 }
 
@@ -389,7 +388,6 @@ export type NetworkAccessGroupUpdatePayload = {
   allowed_cidrs: Array<string>
   description?: string
   expected_version: number
-  mode: 'disabled' | 'enforce' | 'shadow'
   name: string
 }
 
@@ -1319,15 +1317,17 @@ export type ProviderWithModelsResponse = {
 }
 
 export type NetworkAccessGroupResponse = {
-  allowed_cidrs?: Array<string>
+  allowed_cidrs: Array<string>
+  app_ids: Array<string>
+  apps: Array<NetworkAccessGroupAppResponse>
   created_at: string
   description?: string
   id: string
-  mode: 'disabled' | 'enforce' | 'shadow'
   name: string
   tenant_id: string
   updated_at: string
   updated_by_account_id?: string | null
+  used_by_count: number
   version: number
 }
 
@@ -1916,6 +1916,14 @@ export type ProviderModelWithStatusEntity = {
 
 export type CustomConfigurationStatus = 'active' | 'no-configure'
 
+export type NetworkAccessGroupAppResponse = {
+  icon?: string | null
+  icon_background?: string | null
+  icon_type?: string | null
+  id: string
+  name: string
+}
+
 export type TenantPluginAutoUpgradeStrategySetting = 'disabled' | 'fix_only' | 'latest'
 
 export type TenantPluginAutoUpgradeMode = 'all' | 'exclude' | 'partial'
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index 0b2a2411b17988..0104a3f94113e5 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -251,9 +251,8 @@ export const zParserPreferredProviderType = z.object({
  * NetworkAccessGroupCreatePayload
  */
 export const zNetworkAccessGroupCreatePayload = z.object({
-  allowed_cidrs: z.array(z.string()).max(100),
+  allowed_cidrs: z.array(z.string()).min(1).max(100),
   description: z.string().max(500).optional().default(''),
-  mode: z.enum(['disabled', 'enforce', 'shadow']),
   name: z.string().min(1).max(100),
 })
 
@@ -268,10 +267,9 @@ export const zNetworkAccessGroupDeleteResponse = z.object({
  * NetworkAccessGroupUpdatePayload
  */
 export const zNetworkAccessGroupUpdatePayload = z.object({
-  allowed_cidrs: z.array(z.string()).max(100),
+  allowed_cidrs: z.array(z.string()).min(1).max(100),
   description: z.string().max(500).optional().default(''),
   expected_version: z.int().gte(1),
-  mode: z.enum(['disabled', 'enforce', 'shadow']),
   name: z.string().min(1).max(100),
 })
 
@@ -1013,38 +1011,6 @@ export const zCredentialConfiguration = z.object({
   credential_name: z.string(),
 })
 
-/**
- * NetworkAccessGroupResponse
- */
-export const zNetworkAccessGroupResponse = z.object({
-  allowed_cidrs: z.array(z.string()).optional(),
-  created_at: z.iso.datetime(),
-  description: z.string().optional().default(''),
-  id: z.string(),
-  mode: z.enum(['disabled', 'enforce', 'shadow']),
-  name: z.string(),
-  tenant_id: z.string(),
-  updated_at: z.iso.datetime(),
-  updated_by_account_id: z.string().nullish(),
-  version: z.int().gte(1),
-})
-
-/**
- * NetworkAccessGroupListResponse
- */
-export const zNetworkAccessGroupListResponse = z.object({
-  entitled: z.boolean(),
-  groups: z.array(zNetworkAccessGroupResponse),
-  tenant_id: z.string(),
-})
-
-/**
- * NetworkAccessGroupMutationResponse
- */
-export const zNetworkAccessGroupMutationResponse = z.object({
-  group: zNetworkAccessGroupResponse,
-})
-
 /**
  * TenantPluginAutoUpgradeCategory
  */
@@ -1975,6 +1941,51 @@ export const zModelProviderSummaryListResponse = z.object({
   plugins: z.record(z.string(), zModelProviderPluginSummaryResponse),
 })
 
+/**
+ * NetworkAccessGroupAppResponse
+ */
+export const zNetworkAccessGroupAppResponse = z.object({
+  icon: z.string().nullish(),
+  icon_background: z.string().nullish(),
+  icon_type: z.string().nullish(),
+  id: z.string(),
+  name: z.string(),
+})
+
+/**
+ * NetworkAccessGroupResponse
+ */
+export const zNetworkAccessGroupResponse = z.object({
+  allowed_cidrs: z.array(z.string()).min(1).max(100),
+  app_ids: z.array(z.string()),
+  apps: z.array(zNetworkAccessGroupAppResponse),
+  created_at: z.iso.datetime(),
+  description: z.string().optional().default(''),
+  id: z.string(),
+  name: z.string(),
+  tenant_id: z.string(),
+  updated_at: z.iso.datetime(),
+  updated_by_account_id: z.string().nullish(),
+  used_by_count: z.int().gte(0),
+  version: z.int().gte(1),
+})
+
+/**
+ * NetworkAccessGroupListResponse
+ */
+export const zNetworkAccessGroupListResponse = z.object({
+  entitled: z.boolean(),
+  groups: z.array(zNetworkAccessGroupResponse),
+  tenant_id: z.string(),
+})
+
+/**
+ * NetworkAccessGroupMutationResponse
+ */
+export const zNetworkAccessGroupMutationResponse = z.object({
+  group: zNetworkAccessGroupResponse,
+})
+
 /**
  * TenantPluginAutoUpgradeStrategySetting
  */

From c0bd8641395728f381fbbc49c2ae491872094e93 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 16:31:13 +0800
Subject: [PATCH 014/108] fix: harden network access policy compatibility

---
 .../console/workspace/network_access_group.py |  3 ++-
 api/controllers/console/wraps.py              | 16 +++++++++---
 api/services/network_access_group_service.py  | 24 ++++++++++++------
 .../controllers/console/test_wraps.py         | 25 +++++++++++++++++++
 .../workspace/test_network_access_group.py    | 21 +++++++++++++---
 5 files changed, 75 insertions(+), 14 deletions(-)

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index eb294fc74c17ff..ab23dc0fbed666 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -33,7 +33,8 @@
     AppMode.ADVANCED_CHAT: ("webapp", "service_api", "mcp"),
     AppMode.CHAT: ("webapp", "service_api", "mcp"),
     AppMode.COMPLETION: ("webapp", "service_api", "mcp"),
-    AppMode.AGENT_CHAT: ("webapp", "service_api"),
+    AppMode.AGENT_CHAT: ("webapp", "service_api", "mcp"),
+    AppMode.AGENT: ("webapp", "service_api"),
 }
 
 
diff --git a/api/controllers/console/wraps.py b/api/controllers/console/wraps.py
index f279a70f2ed362..152c4949895c17 100644
--- a/api/controllers/console/wraps.py
+++ b/api/controllers/console/wraps.py
@@ -5,10 +5,11 @@
 from functools import wraps
 from typing import Any, Concatenate, Protocol, cast, overload
 
+import httpx
 from flask import abort, request
 from pydantic import BaseModel, ValidationError
 from sqlalchemy import select
-from werkzeug.exceptions import Forbidden, UnprocessableEntity
+from werkzeug.exceptions import Forbidden, ServiceUnavailable, UnprocessableEntity
 
 from configs import dify_config
 from controllers.common.wraps import (
@@ -27,7 +28,7 @@
 from models.account import AccountStatus
 from models.dataset import RateLimitLog
 from models.model import DifySetup
-from services.billing_service import BillingService
+from services.billing_service import BillingService, _BillingHTTPStatusError
 from services.entities.feature_entities import LicenseStatus
 from services.feature_service import FeatureService
 from services.operation_service import OperationService, UtmInfo
@@ -167,7 +168,16 @@ def is_cloud_edition_billing_paid_plan(tenant_id: str) -> bool:
     render an upgrade state.
     """
 
-    billing_info = BillingService.get_info(tenant_id, exclude_vector_space=True)
+    try:
+        billing_info = BillingService.get_info(tenant_id, exclude_vector_space=True)
+    except (
+        _BillingHTTPStatusError,
+        httpx.RequestError,
+        json.JSONDecodeError,
+        UnicodeDecodeError,
+        ValidationError,
+    ) as exc:
+        raise ServiceUnavailable("Billing entitlement is temporarily unavailable.") from exc
     return billing_info["enabled"] and billing_info["subscription"]["plan"] in (
         CloudPlan.PROFESSIONAL,
         CloudPlan.TEAM,
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 02c3685a37a118..59e6c5652cd667 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -1,10 +1,14 @@
+import logging
 from typing import Any
 
 from sqlalchemy import select
+from sqlalchemy.exc import SQLAlchemyError
 
 from extensions.ext_database import db
 from models import App
 
+logger = logging.getLogger(__name__)
+
 
 class NetworkAccessGroupService:
     """Dify-side orchestration for SaaS network access group responses."""
@@ -51,13 +55,19 @@ def enrich_app_references(
                 group["apps"] = []
             return payload
 
-        app_models = db.session.scalars(
-            select(App).where(
-                App.tenant_id == tenant_id,
-                App.id.in_(app_ids),
-                App.status == "normal",
-            )
-        ).all()
+        try:
+            app_models = db.session.scalars(
+                select(App).where(
+                    App.tenant_id == tenant_id,
+                    App.id.in_(app_ids),
+                    App.status == "normal",
+                )
+            ).all()
+        except SQLAlchemyError:
+            logger.exception("Failed to enrich network access Policy App references", extra={"tenant_id": tenant_id})
+            for group in groups:
+                group["apps"] = []
+            return payload
         apps_by_id = {
             str(app.id): {
                 "id": str(app.id),
diff --git a/api/tests/unit_tests/controllers/console/test_wraps.py b/api/tests/unit_tests/controllers/console/test_wraps.py
index 188e5884526fd6..eaa655231aad1b 100644
--- a/api/tests/unit_tests/controllers/console/test_wraps.py
+++ b/api/tests/unit_tests/controllers/console/test_wraps.py
@@ -2,6 +2,7 @@
 from typing import override
 from unittest.mock import MagicMock, patch
 
+import httpx
 import pytest
 from flask import Flask, request
 from flask_login import LoginManager, UserMixin
@@ -776,6 +777,30 @@ def paid_view():
         assert exc_info.value.code == 403
         assert "requires a paid plan" in str(exc_info.value.description)
 
+    def test_should_return_service_unavailable_when_billing_lookup_fails(self):
+        app = create_app_with_login()
+
+        @cloud_edition_billing_paid_plan_required
+        def paid_view():
+            return "paid_success"
+
+        with app.test_request_context():
+            with (
+                patch(
+                    "controllers.console.wraps.current_account_with_tenant",
+                    return_value=(MockUser("test_user"), "tenant123"),
+                ),
+                patch(
+                    "controllers.console.wraps.BillingService.get_info",
+                    side_effect=httpx.ConnectError("billing unavailable"),
+                ),
+                pytest.raises(HTTPException) as exc_info,
+            ):
+                paid_view()
+
+        assert exc_info.value.code == 503
+        assert "temporarily unavailable" in str(exc_info.value.description)
+
 
 class TestBillingResourceLimits:
     """Test billing resource limit decorators"""
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 42e09bbe5036af..74e74a2ca6b489 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -8,6 +8,7 @@
 
 import pytest
 from pydantic import ValidationError
+from sqlalchemy.exc import SQLAlchemyError
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
 
 from controllers.console.workspace.network_access_group import (
@@ -460,7 +461,8 @@ def test_binding_payload_rejects_invalid_group_id_and_version() -> None:
         (AppMode.ADVANCED_CHAT, ["webapp", "service_api", "mcp"]),
         (AppMode.CHAT, ["webapp", "service_api", "mcp"]),
         (AppMode.COMPLETION, ["webapp", "service_api", "mcp"]),
-        (AppMode.AGENT_CHAT, ["webapp", "service_api"]),
+        (AppMode.AGENT_CHAT, ["webapp", "service_api", "mcp"]),
+        (AppMode.AGENT, ["webapp", "service_api"]),
     ],
 )
 def test_available_access_points_are_derived_from_app_mode(app_mode: AppMode, expected: list[str]) -> None:
@@ -469,7 +471,7 @@ def test_available_access_points_are_derived_from_app_mode(app_mode: AppMode, ex
     assert _available_access_points(cast(App, app_model)) == expected
 
 
-@pytest.mark.parametrize("app_mode", [AppMode.AGENT, AppMode.CHANNEL, AppMode.RAG_PIPELINE])
+@pytest.mark.parametrize("app_mode", [AppMode.CHANNEL, AppMode.RAG_PIPELINE])
 def test_unsupported_app_modes_are_rejected(app_mode: AppMode) -> None:
     with pytest.raises(BadRequest, match="not supported"):
         _available_access_points(cast(App, SimpleNamespace(mode=app_mode)))
@@ -478,7 +480,7 @@ def test_unsupported_app_modes_are_rejected(app_mode: AppMode) -> None:
 def test_app_put_rejects_access_point_not_available_for_mode_before_upstream_call() -> None:
     api = AppNetworkAccessGroupApi()
     method = unwrap(api.put)
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.AGENT_CHAT)
+    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.AGENT)
     request_payload = AppNetworkAccessGroupUpdatePayload(
         enabled=True,
         group_id=GROUP_ID,
@@ -567,6 +569,19 @@ def test_group_responses_are_enriched_with_tenant_scoped_app_metadata() -> None:
     db_mock.session.scalars.assert_called_once()
 
 
+def test_group_app_enrichment_degrades_to_ids_when_core_database_is_unavailable() -> None:
+    payload = {"group": _group_payload(app_ids=[APP_ID])}
+    db_mock = MagicMock()
+    db_mock.session.scalars.side_effect = SQLAlchemyError("database unavailable")
+
+    with patch("services.network_access_group_service.db", db_mock):
+        result = NetworkAccessGroupService.enrich_app_references(payload, TENANT_ID)
+
+    assert result["group"]["app_ids"] == [APP_ID]
+    assert result["group"]["used_by_count"] == 1
+    assert result["group"]["apps"] == []
+
+
 def test_sandbox_read_returns_not_entitled_for_upgrade_state() -> None:
     api = CurrentWorkspaceNetworkAccessGroupsApi()
     method = unwrap(api.get)

From 49b8284345b372b527a13488980a657ebab2d719 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 16:34:35 +0800
Subject: [PATCH 015/108] fix: normalize app access points by mode

---
 .../console/workspace/network_access_group.py    | 15 +++++++++++++++
 .../workspace/test_network_access_group.py       | 16 ++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index ab23dc0fbed666..1922a67327b29d 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -217,6 +217,19 @@ def _normalize_app_binding_defaults(payload: dict) -> None:
         binding["access_points"] = []
 
 
+def _limit_binding_access_points(payload: dict, available: list[NetworkAccessPoint]) -> None:
+    """Hide stale scopes which are not real access points for the current App mode."""
+
+    binding = payload.get("binding")
+    if not isinstance(binding, dict):
+        return
+    raw_access_points = binding.get("access_points", binding.get("accessPoints", []))
+    if not isinstance(raw_access_points, list):
+        return
+    binding["access_points"] = [access_point for access_point in raw_access_points if access_point in available]
+    binding.pop("accessPoints", None)
+
+
 def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
     """Authorize management against the persisted current-workspace membership."""
 
@@ -431,6 +444,7 @@ def get(self, current_tenant_id: str, current_user: Account, app_model: App):
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
         _normalize_app_binding_defaults(payload)
+        _limit_binding_access_points(payload, available_access_points)
         payload["entitled"] = _effective_entitlement(current_tenant_id, payload.get("entitled"))
         payload["available_access_points"] = available_access_points
         return _serialize_response(AppNetworkAccessGroupResponse, payload)
@@ -473,5 +487,6 @@ def put(
         except NetworkAccessGroupUpstreamError as exc:
             raise _translate_upstream_error(exc) from exc
         _normalize_app_binding_defaults(payload)
+        _limit_binding_access_points(payload, available_access_points)
         payload["available_access_points"] = available_access_points
         return _serialize_response(AppNetworkAccessGroupMutationResponse, payload)
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 74e74a2ca6b489..62b6ab93a2dcb9 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -21,6 +21,7 @@
     NetworkAccessGroupUpdatePayload,
     _available_access_points,
     _effective_entitlement,
+    _limit_binding_access_points,
     _translate_upstream_error,
 )
 from models import App, AppMode, TenantAccountRole
@@ -429,6 +430,21 @@ def test_binding_response_accepts_policy_id_alias() -> None:
     assert result["binding"]["group_id"] == GROUP_ID
 
 
+def test_binding_response_hides_scopes_not_available_for_current_app_mode() -> None:
+    payload = {
+        "binding": _binding_payload(
+            enabled=True,
+            group_id=GROUP_ID,
+            access_points=["webapp", "service_api", "mcp", "trigger"],
+        )
+    }
+
+    _limit_binding_access_points(payload, ["webapp", "service_api"])
+
+    assert payload["binding"]["access_points"] == ["webapp", "service_api"]
+    assert "accessPoints" not in payload["binding"]
+
+
 @pytest.mark.parametrize(
     "payload",
     [

From 5ec3f43bb76df853525a5814afdaf4d75f404644 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 16:46:02 +0800
Subject: [PATCH 016/108] fix: align paid plan entitlement contract

---
 api/controllers/console/wraps.py                       | 2 +-
 api/tests/unit_tests/controllers/console/test_wraps.py | 9 +++------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/api/controllers/console/wraps.py b/api/controllers/console/wraps.py
index 152c4949895c17..4c1c0cb7c65212 100644
--- a/api/controllers/console/wraps.py
+++ b/api/controllers/console/wraps.py
@@ -178,7 +178,7 @@ def is_cloud_edition_billing_paid_plan(tenant_id: str) -> bool:
         ValidationError,
     ) as exc:
         raise ServiceUnavailable("Billing entitlement is temporarily unavailable.") from exc
-    return billing_info["enabled"] and billing_info["subscription"]["plan"] in (
+    return billing_info["subscription"]["plan"] in (
         CloudPlan.PROFESSIONAL,
         CloudPlan.TEAM,
     )
diff --git a/api/tests/unit_tests/controllers/console/test_wraps.py b/api/tests/unit_tests/controllers/console/test_wraps.py
index eaa655231aad1b..3479c09ce701a8 100644
--- a/api/tests/unit_tests/controllers/console/test_wraps.py
+++ b/api/tests/unit_tests/controllers/console/test_wraps.py
@@ -751,18 +751,15 @@ def paid_view():
         assert result == "paid_success"
         get_info.assert_called_once_with("tenant123", exclude_vector_space=True)
 
-    @pytest.mark.parametrize(
-        ("enabled", "plan"),
-        [(False, "professional"), (True, "sandbox"), (True, "unknown")],
-    )
-    def test_should_reject_non_paid_plan(self, enabled: bool, plan: str):
+    @pytest.mark.parametrize("plan", ["sandbox", "unknown"])
+    def test_should_reject_non_paid_plan(self, plan: str):
         app = create_app_with_login()
 
         @cloud_edition_billing_paid_plan_required
         def paid_view():
             return "paid_success"
 
-        billing_info = {"enabled": enabled, "subscription": {"plan": plan}}
+        billing_info = {"enabled": True, "subscription": {"plan": plan}}
         with app.test_request_context():
             with (
                 patch(

From 1d9862b0739ce21f002d98900a246648821e8b8f Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 17:41:39 +0800
Subject: [PATCH 017/108] fix: separate network access API URL

---
 api/configs/feature/__init__.py               |  6 ++
 api/services/billing_service.py               |  4 +-
 ...st_network_access_group_billing_service.py | 62 +++++++++++++++++++
 3 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/api/configs/feature/__init__.py b/api/configs/feature/__init__.py
index c3f1be5d045c25..ad35f07b6f9c38 100644
--- a/api/configs/feature/__init__.py
+++ b/api/configs/feature/__init__.py
@@ -410,6 +410,12 @@ class EndpointConfig(BaseSettings):
 
     TRIGGER_URL: str = Field(description="Template url for triggers", default="http://localhost:5001")
 
+    NETWORK_ACCESS_API_URL: str = Field(
+        description="Optional internal SaaS API base URL for network access policy requests; "
+        "falls back to BILLING_API_URL",
+        default="",
+    )
+
 
 class FileAccessConfig(BaseSettings):
     """
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index 43a58acc525c65..82bb9fed8b917d 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -9,6 +9,7 @@
 from tenacity import retry, retry_if_exception_type, stop_before_delay, wait_fixed
 from werkzeug.exceptions import InternalServerError
 
+from configs import dify_config
 from core.helper.http_client_pooling import get_pooled_http_client
 from enums import CloudPlan
 from extensions.ext_redis import redis_client
@@ -638,9 +639,10 @@ def _send_network_access_group_http_request(
         params: dict[str, Any] | None = None,
     ) -> httpx.Response:
         headers = {"Content-Type": "application/json", "Billing-Api-Secret-Key": cls.secret_key}
+        network_access_base_url = dify_config.NETWORK_ACCESS_API_URL.strip() or cls.base_url
         return _http_client.request(
             method,
-            f"{cls.base_url}{endpoint}",
+            f"{network_access_base_url.rstrip('/')}{endpoint}",
             json=payload_json,
             params=params,
             headers=headers,
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
index d24297efe09870..d2c95ae0ae22f1 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -4,6 +4,7 @@
 import httpx
 import pytest
 
+from configs import dify_config
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
@@ -18,10 +19,71 @@ def billing_config() -> Iterator[None]:
     with (
         patch.object(BillingService, "base_url", "https://billing.internal/v1"),
         patch.object(BillingService, "secret_key", "test-secret"),
+        patch.object(dify_config, "NETWORK_ACCESS_API_URL", ""),
     ):
         yield
 
 
+@pytest.mark.usefixtures("billing_config")
+def test_network_access_requests_use_independent_api_url_when_configured() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": []}
+
+    with (
+        patch.object(dify_config, "NETWORK_ACCESS_API_URL", "https://saas.internal/v1/"),
+        patch("services.billing_service._http_client.request", return_value=response) as request,
+    ):
+        BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
+
+    request.assert_called_once_with(
+        "GET",
+        f"https://saas.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+        json=None,
+        params={"actor_account_id": ACCOUNT_ID},
+        headers=HEADERS,
+        follow_redirects=True,
+    )
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_network_access_requests_fall_back_to_billing_api_url_at_request_time() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": []}
+
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
+        BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
+
+    request.assert_called_once_with(
+        "GET",
+        f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+        json=None,
+        params={"actor_account_id": ACCOUNT_ID},
+        headers=HEADERS,
+        follow_redirects=True,
+    )
+
+
+@pytest.mark.usefixtures("billing_config")
+def test_subscription_requests_keep_using_billing_api_url() -> None:
+    response = MagicMock(status_code=httpx.codes.OK)
+    response.json.return_value = {"subscription": {"plan": "professional"}}
+
+    with (
+        patch.object(dify_config, "NETWORK_ACCESS_API_URL", "https://saas.internal/v1"),
+        patch("services.billing_service._http_client.request", return_value=response) as request,
+    ):
+        BillingService._send_request("GET", "/subscription/info", params={"tenant_id": TENANT_ID})
+
+    request.assert_called_once_with(
+        "GET",
+        "https://billing.internal/v1/subscription/info",
+        json=None,
+        params={"tenant_id": TENANT_ID},
+        headers=HEADERS,
+        follow_redirects=True,
+    )
+
+
 @pytest.mark.usefixtures("billing_config")
 def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
     response = MagicMock(status_code=httpx.codes.OK)

From 1c3d5fce9e752f8d81e955865b30721a1d716c61 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 18:27:53 +0800
Subject: [PATCH 018/108] fix: avoid dynamic icon type lookup

---
 api/services/network_access_group_service.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 59e6c5652cd667..dcbe2e8908639c 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -73,7 +73,7 @@ def enrich_app_references(
                 "id": str(app.id),
                 "name": app.name,
                 "icon": app.icon,
-                "icon_type": getattr(app.icon_type, "value", app.icon_type) if app.icon_type is not None else None,
+                "icon_type": app.icon_type.value if app.icon_type is not None else None,
                 "icon_background": app.icon_background,
             }
             for app in app_models

From 4f82c193bc61b3de6928015b2c13c71220735a53 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 9 Sep 2026 18:42:01 +0800
Subject: [PATCH 019/108] test: use validated config overrides

---
 ...st_network_access_group_billing_service.py | 25 ++++++++-----------
 .../test_remove_app_and_related_data_task.py  | 12 ++++-----
 2 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
index e4bdf9763cbabf..c034f21904df60 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_billing_service.py
@@ -1,10 +1,9 @@
-from collections.abc import Iterator
+from collections.abc import Callable, Iterator
 from unittest.mock import MagicMock, call, patch
 
 import httpx
 import pytest
 
-from configs import dify_config
 from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
@@ -15,24 +14,24 @@
 
 
 @pytest.fixture
-def billing_config() -> Iterator[None]:
+def billing_config(config_overrides: Callable[..., None]) -> Iterator[None]:
+    config_overrides(NETWORK_ACCESS_API_URL="")
     with (
         patch.object(BillingService, "base_url", "https://billing.internal/v1"),
         patch.object(BillingService, "secret_key", "test-secret"),
-        patch.object(dify_config, "NETWORK_ACCESS_API_URL", ""),
     ):
         yield
 
 
 @pytest.mark.usefixtures("billing_config")
-def test_network_access_requests_use_independent_api_url_when_configured() -> None:
+def test_network_access_requests_use_independent_api_url_when_configured(
+    config_overrides: Callable[..., None],
+) -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
 
-    with (
-        patch.object(dify_config, "NETWORK_ACCESS_API_URL", "https://saas.internal/v1/"),
-        patch("services.billing_service._http_client.request", return_value=response) as request,
-    ):
+    config_overrides(NETWORK_ACCESS_API_URL="https://saas.internal/v1/")
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
         BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
 
     request.assert_called_once_with(
@@ -64,14 +63,12 @@ def test_network_access_requests_fall_back_to_billing_api_url_at_request_time()
 
 
 @pytest.mark.usefixtures("billing_config")
-def test_subscription_requests_keep_using_billing_api_url() -> None:
+def test_subscription_requests_keep_using_billing_api_url(config_overrides: Callable[..., None]) -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"subscription": {"plan": "professional"}}
 
-    with (
-        patch.object(dify_config, "NETWORK_ACCESS_API_URL", "https://saas.internal/v1"),
-        patch("services.billing_service._http_client.request", return_value=response) as request,
-    ):
+    config_overrides(NETWORK_ACCESS_API_URL="https://saas.internal/v1")
+    with patch("services.billing_service._http_client.request", return_value=response) as request:
         BillingService._send_request("GET", "/subscription/info", params={"tenant_id": TENANT_ID})
 
     request.assert_called_once_with(
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index 2da72e3833adab..e489c0598c5292 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -122,7 +122,7 @@ def test_app_cleanup_removes_agent_bindings_before_workflows(monkeypatch: pytest
 
 def test_cloud_app_cleanup_schedules_independent_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
     apply_async = MagicMock()
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
     monkeypatch.setattr(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
@@ -139,7 +139,7 @@ def test_cloud_app_cleanup_schedules_independent_binding_cleanup(monkeypatch: py
 
 def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
     apply_async = MagicMock()
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.COMMUNITY)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.COMMUNITY)
     monkeypatch.setattr(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
@@ -153,7 +153,7 @@ def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: py
 
 def test_independent_binding_cleanup_task_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
     cleanup = MagicMock(return_value={"deleted": True})
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
     monkeypatch.setattr(
         remove_app_task_module.BillingService,
         "cleanup_app_network_access_group_binding",
@@ -172,7 +172,7 @@ def test_independent_binding_cleanup_task_retries_with_exponential_backoff(
     upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_APP_STILL_EXISTS")
     retry_error = RuntimeError("retry scheduled")
     retry = MagicMock(side_effect=retry_error)
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
     monkeypatch.setattr(
         remove_app_task_module.BillingService,
         "cleanup_app_network_access_group_binding",
@@ -196,7 +196,7 @@ def test_parent_local_cleanup_failure_happens_after_binding_cleanup_is_scheduled
     retry_error = RuntimeError("parent retry scheduled")
     apply_async = MagicMock()
     retry = MagicMock(side_effect=retry_error)
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
     monkeypatch.setattr(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
@@ -220,7 +220,7 @@ def test_parent_retries_before_local_cleanup_when_binding_schedule_fails(monkeyp
     retry_error = RuntimeError("parent retry scheduled")
     retry = MagicMock(side_effect=retry_error)
     first_local_cleanup = MagicMock()
-    monkeypatch.setattr(remove_app_task_module.dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
     monkeypatch.setattr(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",

From e8b965a3c3dc9b52f7ade7d56191ed4d71ece818 Mon Sep 17 00:00:00 2001
From: hjlarry <hjlarry@163.com>
Date: Thu, 10 Sep 2026 14:25:38 +0800
Subject: [PATCH 020/108] refactor: migrate network access group APIs

---
 api/.importlinter                             |  15 +
 .../console/workspace/network_access_group.py | 284 +++------
 api/extensions/ext_application_services.py    |  17 +
 .../network_access_group_repository.py        |  76 +++
 .../workspace_query_repository.py             |   9 +
 api/services/billing_service.py               | 225 -------
 api/services/network_access_group_gateway.py  | 235 ++++++++
 api/services/network_access_group_service.py  | 366 ++++++++++-
 api/tasks/remove_app_and_related_data_task.py |  10 +-
 .../workspace/test_network_access_group.py    | 570 +++++-------------
 .../test_ext_application_services.py          |  24 +
 .../test_network_access_group_repository.py   | 169 ++++++
 .../test_workspace_query_repository.py        |  58 ++
 ...y => test_network_access_group_gateway.py} | 274 +++++----
 .../test_network_access_group_service.py      | 444 ++++++++++++++
 .../test_remove_app_and_related_data_task.py  |  42 +-
 16 files changed, 1836 insertions(+), 982 deletions(-)
 create mode 100644 api/repositories/network_access_group_repository.py
 create mode 100644 api/services/network_access_group_gateway.py
 create mode 100644 api/tests/unit_tests/repositories/test_network_access_group_repository.py
 create mode 100644 api/tests/unit_tests/repositories/test_workspace_query_repository.py
 rename api/tests/unit_tests/services/{test_network_access_group_billing_service.py => test_network_access_group_gateway.py} (54%)
 create mode 100644 api/tests/unit_tests/services/test_network_access_group_service.py

diff --git a/api/.importlinter b/api/.importlinter
index d9796d56504ba8..9a0005a5703062 100644
--- a/api/.importlinter
+++ b/api/.importlinter
@@ -171,6 +171,21 @@ forbidden_modules =
     sqlalchemy
     werkzeug
 
+[importlinter:contract:network-access-group-service-boundary]
+name = Network access group application service is framework and persistence neutral
+type = forbidden
+source_modules =
+    services.network_access_group_service
+forbidden_modules =
+    configs
+    controllers
+    extensions
+    flask
+    models
+    repositories
+    sqlalchemy
+    werkzeug
+
 [importlinter:contract:init-validation-service-boundary]
 name = Initialization validation application service is framework and persistence neutral
 type = forbidden
diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 1922a67327b29d..6d5ba151c52614 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -1,5 +1,5 @@
 from datetime import datetime
-from typing import Literal, Self
+from typing import Any, Self
 from uuid import UUID
 
 from flask_restx import Resource
@@ -8,34 +8,24 @@
 
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
-from controllers.console.app.wraps import get_app_model
-from controllers.console.wraps import (
-    account_initialization_required,
-    cloud_edition_billing_paid_plan_required,
-    is_cloud_edition_billing_paid_plan,
-    model_validate,
-    only_edition_cloud,
-    setup_required,
-    with_current_tenant_id,
-    with_current_user,
-)
+from controllers.console.app.error import AppNotFoundError
+from controllers.console.flask_admission import console_account_admission
+from controllers.console.wraps import cloud_edition_billing_paid_plan_required, model_validate
+from enums import DeploymentEdition
+from extensions.ext_application_services import application_services
 from fields.base import ResponseModel
 from libs.helper import dump_response
-from libs.login import login_required
-from models import Account, App, AppMode, TenantAccountRole
-from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
-from services.network_access_group_service import NetworkAccessGroupService
-
-NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
-
-_ACCESS_POINTS_BY_APP_MODE: dict[AppMode, tuple[NetworkAccessPoint, ...]] = {
-    AppMode.WORKFLOW: ("webapp", "service_api", "mcp", "trigger"),
-    AppMode.ADVANCED_CHAT: ("webapp", "service_api", "mcp"),
-    AppMode.CHAT: ("webapp", "service_api", "mcp"),
-    AppMode.COMPLETION: ("webapp", "service_api", "mcp"),
-    AppMode.AGENT_CHAT: ("webapp", "service_api", "mcp"),
-    AppMode.AGENT: ("webapp", "service_api"),
-}
+from machinery.context import RequestContext
+from services.network_access_group_service import (
+    NetworkAccessGroupAccessDeniedError,
+    NetworkAccessGroupAppNotFoundError,
+    NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupError,
+    NetworkAccessGroupUnsupportedAccessPointsError,
+    NetworkAccessGroupUnsupportedAppModeError,
+    NetworkAccessGroupUpstreamError,
+    NetworkAccessPoint,
+)
 
 
 class NetworkAccessGroupCreatePayload(BaseModel):
@@ -184,59 +174,6 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
 )
 
 
-def _available_access_points(app_model: App) -> list[NetworkAccessPoint]:
-    app_mode = app_model.mode if isinstance(app_model.mode, AppMode) else AppMode.value_of(str(app_model.mode))
-    available = _ACCESS_POINTS_BY_APP_MODE.get(app_mode)
-    if available is None:
-        raise BadRequest(f"Network access control is not supported for app mode '{app_mode.value}'.")
-    return list(available)
-
-
-def _validate_app_access_points(
-    requested: list[NetworkAccessPoint],
-    available: list[NetworkAccessPoint],
-) -> None:
-    unsupported = sorted(set(requested).difference(available))
-    if unsupported:
-        raise BadRequest(f"Unsupported access points for this app: {', '.join(unsupported)}.")
-
-
-def _effective_entitlement(tenant_id: str, upstream_entitled: object) -> bool:
-    return bool(upstream_entitled) and is_cloud_edition_billing_paid_plan(tenant_id)
-
-
-def _normalize_app_binding_defaults(payload: dict) -> None:
-    """Materialize ProtoJSON defaults so the Console response stays stable."""
-
-    payload.setdefault("binding", None)
-    binding = payload.get("binding")
-    if not isinstance(binding, dict):
-        return
-    binding.setdefault("enabled", False)
-    if "access_points" not in binding and "accessPoints" not in binding:
-        binding["access_points"] = []
-
-
-def _limit_binding_access_points(payload: dict, available: list[NetworkAccessPoint]) -> None:
-    """Hide stale scopes which are not real access points for the current App mode."""
-
-    binding = payload.get("binding")
-    if not isinstance(binding, dict):
-        return
-    raw_access_points = binding.get("access_points", binding.get("accessPoints", []))
-    if not isinstance(raw_access_points, list):
-        return
-    binding["access_points"] = [access_point for access_point in raw_access_points if access_point in available]
-    binding.pop("accessPoints", None)
-
-
-def _ensure_workspace_admin_or_owner(current_user: Account) -> None:
-    """Authorize management against the persisted current-workspace membership."""
-
-    if not TenantAccountRole.is_privileged_role(current_user.current_role):
-        raise Forbidden("Only workspace owners and administrators can manage network access groups.")
-
-
 def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception:
     if exc.reason == "INVALID_SECRET_KEY":
         return ServiceUnavailable("Network access group service authentication failed.")
@@ -260,7 +197,23 @@ def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception
     return BadGateway("Unexpected response from the network access group service.")
 
 
-def _serialize_response(response_model: type[ResponseModel], payload: dict):
+def _translate_service_error(exc: NetworkAccessGroupError) -> Exception:
+    if isinstance(exc, NetworkAccessGroupUpstreamError):
+        return _translate_upstream_error(exc)
+    if isinstance(exc, NetworkAccessGroupAccessDeniedError):
+        return Forbidden("Only workspace owners and administrators can manage network access groups.")
+    if isinstance(exc, NetworkAccessGroupEntitlementUnavailableError):
+        return ServiceUnavailable("Billing entitlement is temporarily unavailable.")
+    if isinstance(exc, NetworkAccessGroupAppNotFoundError):
+        return AppNotFoundError()
+    if isinstance(exc, NetworkAccessGroupUnsupportedAppModeError):
+        return BadRequest(f"Network access control is not supported for app mode '{exc.app_mode}'.")
+    if isinstance(exc, NetworkAccessGroupUnsupportedAccessPointsError):
+        return BadRequest(f"Unsupported access points for this app: {', '.join(exc.access_points)}.")
+    raise TypeError(f"Unsupported network access group error: {type(exc).__name__}")
+
+
+def _serialize_response(response_model: type[ResponseModel], payload: dict[str, Any]) -> dict[str, Any]:
     try:
         return dump_response(response_model, payload)
     except ValidationError as exc:
@@ -274,20 +227,12 @@ class CurrentWorkspaceNetworkAccessGroupsApi(Resource):
         "Workspace network access groups retrieved successfully",
         console_ns.models[NetworkAccessGroupListResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account):
-        _ensure_workspace_admin_or_owner(current_user)
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
+    def get(self, request_context: RequestContext) -> dict[str, Any]:
         try:
-            payload = BillingService.list_network_access_groups(current_tenant_id, current_user.id)
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        payload["entitled"] = _effective_entitlement(current_tenant_id, payload.get("entitled"))
-        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
+            payload = application_services().network_access_groups.list_groups(request_context)
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(NetworkAccessGroupListResponse, payload)
 
     @console_ns.expect(console_ns.models[NetworkAccessGroupCreatePayload.__name__])
@@ -296,32 +241,23 @@ def get(self, current_tenant_id: str, current_user: Account):
         "Workspace network access group created successfully",
         console_ns.models[NetworkAccessGroupMutationResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
     @cloud_edition_billing_paid_plan_required
-    @with_current_user
-    @with_current_tenant_id
     @model_validate(NetworkAccessGroupCreatePayload)
     def post(
         self,
         req_data: NetworkAccessGroupCreatePayload,
-        current_tenant_id: str,
-        current_user: Account,
-    ):
-        _ensure_workspace_admin_or_owner(current_user)
+        request_context: RequestContext,
+    ) -> tuple[dict[str, Any], int]:
         try:
-            payload = BillingService.create_network_access_group(
-                current_tenant_id,
+            payload = application_services().network_access_groups.create_group(
+                request_context,
                 name=req_data.name,
                 description=req_data.description,
                 allowed_cidrs=req_data.allowed_cidrs,
-                actor_account_id=current_user.id,
             )
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(NetworkAccessGroupMutationResponse, payload), 201
 
 
@@ -332,19 +268,15 @@ class CurrentWorkspaceNetworkAccessGroupApi(Resource):
         "Workspace network access group retrieved successfully",
         console_ns.models[NetworkAccessGroupMutationResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    def get(self, current_tenant_id: str, current_user: Account, group_id: UUID):
-        _ensure_workspace_admin_or_owner(current_user)
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
+    def get(self, request_context: RequestContext, group_id: UUID) -> dict[str, Any]:
         try:
-            payload = BillingService.get_network_access_group(current_tenant_id, str(group_id), current_user.id)
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
+            payload = application_services().network_access_groups.get_group(
+                request_context,
+                group_id=str(group_id),
+            )
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(NetworkAccessGroupMutationResponse, payload)
 
     @console_ns.expect(console_ns.models[NetworkAccessGroupUpdatePayload.__name__])
@@ -353,35 +285,26 @@ def get(self, current_tenant_id: str, current_user: Account, group_id: UUID):
         "Workspace network access group updated successfully",
         console_ns.models[NetworkAccessGroupMutationResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
     @cloud_edition_billing_paid_plan_required
-    @with_current_user
-    @with_current_tenant_id
     @model_validate(NetworkAccessGroupUpdatePayload)
     def put(
         self,
         req_data: NetworkAccessGroupUpdatePayload,
-        current_tenant_id: str,
-        current_user: Account,
+        request_context: RequestContext,
         group_id: UUID,
-    ):
-        _ensure_workspace_admin_or_owner(current_user)
+    ) -> dict[str, Any]:
         try:
-            payload = BillingService.update_network_access_group(
-                current_tenant_id,
-                str(group_id),
+            payload = application_services().network_access_groups.update_group(
+                request_context,
+                group_id=str(group_id),
                 name=req_data.name,
                 description=req_data.description,
                 allowed_cidrs=req_data.allowed_cidrs,
                 expected_version=req_data.expected_version,
-                actor_account_id=current_user.id,
             )
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        NetworkAccessGroupService.enrich_app_references(payload, current_tenant_id)
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(NetworkAccessGroupMutationResponse, payload)
 
     @console_ns.doc(params=query_params_from_model(NetworkAccessGroupDeleteQuery))
@@ -390,31 +313,23 @@ def put(
         "Workspace network access group deleted successfully",
         console_ns.models[NetworkAccessGroupDeleteResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
     @cloud_edition_billing_paid_plan_required
-    @with_current_user
-    @with_current_tenant_id
     @model_validate(NetworkAccessGroupDeleteQuery)
     def delete(
         self,
         req_data: NetworkAccessGroupDeleteQuery,
-        current_tenant_id: str,
-        current_user: Account,
+        request_context: RequestContext,
         group_id: UUID,
-    ):
-        _ensure_workspace_admin_or_owner(current_user)
+    ) -> dict[str, Any]:
         try:
-            payload = BillingService.delete_network_access_group(
-                current_tenant_id,
-                str(group_id),
+            payload = application_services().network_access_groups.delete_group(
+                request_context,
+                group_id=str(group_id),
                 expected_version=req_data.expected_version,
-                actor_account_id=current_user.id,
             )
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(NetworkAccessGroupDeleteResponse, payload)
 
 
@@ -425,28 +340,15 @@ class AppNetworkAccessGroupApi(Resource):
         "App network access group binding retrieved successfully",
         console_ns.models[AppNetworkAccessGroupResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
-    @with_current_user
-    @with_current_tenant_id
-    @get_app_model
-    def get(self, current_tenant_id: str, current_user: Account, app_model: App):
-        _ensure_workspace_admin_or_owner(current_user)
-        available_access_points = _available_access_points(app_model)
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
+    def get(self, request_context: RequestContext, app_id: UUID) -> dict[str, Any]:
         try:
-            payload = BillingService.get_app_network_access_group(
-                current_tenant_id,
-                str(app_model.id),
-                current_user.id,
+            payload = application_services().network_access_groups.get_app_binding(
+                request_context,
+                app_id=str(app_id),
             )
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        _normalize_app_binding_defaults(payload)
-        _limit_binding_access_points(payload, available_access_points)
-        payload["entitled"] = _effective_entitlement(current_tenant_id, payload.get("entitled"))
-        payload["available_access_points"] = available_access_points
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(AppNetworkAccessGroupResponse, payload)
 
     @console_ns.expect(console_ns.models[AppNetworkAccessGroupUpdatePayload.__name__])
@@ -455,38 +357,24 @@ def get(self, current_tenant_id: str, current_user: Account, app_model: App):
         "App network access group binding updated successfully",
         console_ns.models[AppNetworkAccessGroupMutationResponse.__name__],
     )
-    @setup_required
-    @login_required
-    @account_initialization_required
-    @only_edition_cloud
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
     @cloud_edition_billing_paid_plan_required
-    @with_current_user
-    @with_current_tenant_id
-    @get_app_model
     @model_validate(AppNetworkAccessGroupUpdatePayload)
     def put(
         self,
         req_data: AppNetworkAccessGroupUpdatePayload,
-        current_tenant_id: str,
-        current_user: Account,
-        app_model: App,
-    ):
-        _ensure_workspace_admin_or_owner(current_user)
-        available_access_points = _available_access_points(app_model)
-        _validate_app_access_points(req_data.access_points, available_access_points)
+        request_context: RequestContext,
+        app_id: UUID,
+    ) -> dict[str, Any]:
         try:
-            payload = BillingService.update_app_network_access_group(
-                current_tenant_id,
-                str(app_model.id),
+            payload = application_services().network_access_groups.update_app_binding(
+                request_context,
+                app_id=str(app_id),
                 enabled=req_data.enabled,
                 group_id=str(req_data.group_id) if req_data.group_id is not None else None,
                 access_points=list(req_data.access_points),
                 expected_version=req_data.expected_version,
-                actor_account_id=current_user.id,
             )
-        except NetworkAccessGroupUpstreamError as exc:
-            raise _translate_upstream_error(exc) from exc
-        _normalize_app_binding_defaults(payload)
-        _limit_binding_access_points(payload, available_access_points)
-        payload["available_access_points"] = available_access_points
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
         return _serialize_response(AppNetworkAccessGroupMutationResponse, payload)
diff --git a/api/extensions/ext_application_services.py b/api/extensions/ext_application_services.py
index 07aa6edc21e1db..e0099f82171715 100644
--- a/api/extensions/ext_application_services.py
+++ b/api/extensions/ext_application_services.py
@@ -50,6 +50,7 @@
 from repositories.human_input_file_upload_repository import SQLAlchemyHumanInputFileUploadRepository
 from repositories.installation_state_repository import InstallationStateRepository
 from repositories.message_file_preview_repository import MessageFilePreviewQueryRepository
+from repositories.network_access_group_repository import SQLAlchemyNetworkAccessGroupAppRepository
 from repositories.oauth_access_token_repository import SQLAlchemyOAuthAccessTokenRepository
 from repositories.oauth_server_repository import RedisOAuthServerTokenRepository, SQLAlchemyOAuthServerRepository
 from repositories.plugin_file_upload_repository import SQLAlchemyPluginFileUploadOwnerRepository
@@ -163,6 +164,11 @@
 from services.init_validation_service import InitValidationService
 from services.inner_mail_service import InnerMailService
 from services.message_file_preview_service import MessageFilePreviewService
+from services.network_access_group_gateway import (
+    BillingNetworkAccessGroupEntitlementGateway,
+    NetworkAccessGroupGateway,
+)
+from services.network_access_group_service import NetworkAccessGroupService
 from services.notification_gateway import BillingNotificationGateway
 from services.notification_service import NotificationService
 from services.notion_data_source_gateway import NotionDataSourceGateway
@@ -278,6 +284,7 @@ class ApplicationServices:
     oauth_server: OAuthServerService
     init_validation: InitValidationService
     notifications: NotificationService
+    network_access_groups: NetworkAccessGroupService
     step_by_step_tour: StepByStepTourService
     partner_tenant_bindings: PartnerTenantBindingService
     recommended_app_queries: RecommendedAppQueryService
@@ -696,6 +703,16 @@ def build_application_services(
         notifications=NotificationService(
             notifications=BillingNotificationGateway(),
         ),
+        network_access_groups=NetworkAccessGroupService(
+            control_plane=NetworkAccessGroupGateway(
+                base_url=dify_config.NETWORK_ACCESS_API_URL,
+                fallback_base_url=BillingService.base_url,
+                secret_key=BillingService.secret_key,
+            ),
+            apps=SQLAlchemyNetworkAccessGroupAppRepository(session_factory=database_client),
+            memberships=workspace_query_repository,
+            entitlement=BillingNetworkAccessGroupEntitlementGateway(),
+        ),
         step_by_step_tour=StepByStepTourService(
             accounts=accounts,
             states=SQLAlchemyStepByStepTourStateRepository(session_factory=database_client),
diff --git a/api/repositories/network_access_group_repository.py b/api/repositories/network_access_group_repository.py
new file mode 100644
index 00000000000000..942b7987307bcc
--- /dev/null
+++ b/api/repositories/network_access_group_repository.py
@@ -0,0 +1,76 @@
+"""SQLAlchemy read repository for network access group App projections."""
+
+from collections.abc import Sequence
+from typing import override
+
+from sqlalchemy import select
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.orm import Session, sessionmaker
+
+from models import App
+from models.agent import AgentScope
+from services.network_access_group_service import (
+    NetworkAccessGroupAppQuery,
+    NetworkAccessGroupAppQueryError,
+    NetworkAccessGroupAppRecord,
+)
+
+
+class SQLAlchemyNetworkAccessGroupAppRepository(NetworkAccessGroupAppQuery):
+    def __init__(self, *, session_factory: sessionmaker[Session]) -> None:
+        self._session_factory = session_factory
+
+    @override
+    def get_manageable_app(self, *, workspace_id: str, app_id: str) -> NetworkAccessGroupAppRecord | None:
+        try:
+            with self._session_factory() as session:
+                app = session.scalar(
+                    select(App)
+                    .where(
+                        App.id == app_id,
+                        App.tenant_id == workspace_id,
+                        App.status == "normal",
+                    )
+                    .limit(1)
+                )
+                if app is None:
+                    return None
+                binding = app.agent_app_binding_with_session(session=session, include_archived=True)
+                if binding is not None and binding.scope == AgentScope.WORKFLOW_ONLY:
+                    return None
+                return self._to_record(app)
+        except SQLAlchemyError as exc:
+            raise NetworkAccessGroupAppQueryError from exc
+
+    @override
+    def list_apps(
+        self,
+        *,
+        workspace_id: str,
+        app_ids: Sequence[str],
+    ) -> tuple[NetworkAccessGroupAppRecord, ...]:
+        if not app_ids:
+            return ()
+        try:
+            with self._session_factory() as session:
+                apps = session.scalars(
+                    select(App).where(
+                        App.tenant_id == workspace_id,
+                        App.id.in_(app_ids),
+                        App.status == "normal",
+                    )
+                ).all()
+                return tuple(self._to_record(app) for app in apps)
+        except SQLAlchemyError as exc:
+            raise NetworkAccessGroupAppQueryError from exc
+
+    @staticmethod
+    def _to_record(app: App) -> NetworkAccessGroupAppRecord:
+        return NetworkAccessGroupAppRecord(
+            id=str(app.id),
+            mode=app.mode.value,
+            name=app.name,
+            icon=app.icon,
+            icon_type=app.icon_type.value if app.icon_type is not None else None,
+            icon_background=app.icon_background,
+        )
diff --git a/api/repositories/workspace_query_repository.py b/api/repositories/workspace_query_repository.py
index 8e83d158c478dc..f31af9c7acd46d 100644
--- a/api/repositories/workspace_query_repository.py
+++ b/api/repositories/workspace_query_repository.py
@@ -58,6 +58,15 @@ def list_ids_for_account(self, account_id: str) -> tuple[str, ...]:
         with self._session_factory() as session:
             return tuple(session.scalars(stmt).all())
 
+    def get_role_for_account(self, *, workspace_id: str, account_id: str) -> str | None:
+        stmt = select(TenantAccountJoin.role).where(
+            TenantAccountJoin.tenant_id == workspace_id,
+            TenantAccountJoin.account_id == account_id,
+        )
+        with self._session_factory() as session:
+            role = session.scalar(stmt)
+            return role.value if role is not None else None
+
     @override
     def list_account_access_workspaces(self, account_id: str) -> tuple[AccountWorkspaceSnapshot, ...]:
         """List every membership for the OpenAPI account identity response.
diff --git a/api/services/billing_service.py b/api/services/billing_service.py
index 79cdc89df5ff2e..c16f5b5142cf35 100644
--- a/api/services/billing_service.py
+++ b/api/services/billing_service.py
@@ -10,7 +10,6 @@
 from typing_extensions import deprecated
 from werkzeug.exceptions import InternalServerError
 
-from configs import dify_config
 from core.helper.http_client_pooling import get_pooled_http_client
 from enums import CloudPlan
 from extensions.ext_redis import redis_client
@@ -216,15 +215,6 @@ class DismissNotificationDict(TypedDict):
     success: bool
 
 
-class NetworkAccessGroupUpstreamError(Exception):
-    """Failure returned by the SaaS network-access-group control plane."""
-
-    def __init__(self, status_code: int, reason: str | None = None):
-        self.status_code = status_code
-        self.reason = reason
-        super().__init__(f"network access group upstream returned HTTP {status_code}")
-
-
 class BillingService:
     base_url = os.environ.get("BILLING_API_URL", "BILLING_API_URL")
     quota_base_url = os.environ.get("BILLING_QUOTA_API_URL") or base_url
@@ -443,221 +433,6 @@ def get_tenant_feature_plan_usage(cls, tenant_id: str, feature_key: str):
         params = {"tenant_id": tenant_id, "feature_key": feature_key}
         return cls._send_request("GET", "/billing/tenant_feature_plan/usage", params=params)
 
-    @classmethod
-    def list_network_access_groups(cls, tenant_id: str, actor_account_id: str) -> dict[str, Any]:
-        """List the reusable network access groups owned by one workspace."""
-
-        return cls._send_network_access_group_request(
-            "GET",
-            f"/tenants/{tenant_id}/network-access-groups",
-            params={"actor_account_id": actor_account_id},
-        )
-
-    @classmethod
-    def create_network_access_group(
-        cls,
-        tenant_id: str,
-        *,
-        name: str,
-        description: str,
-        allowed_cidrs: list[str],
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Create a reusable group; the Console BFF injects the authenticated actor."""
-
-        return cls._send_network_access_group_request(
-            "POST",
-            f"/tenants/{tenant_id}/network-access-groups",
-            payload_json={
-                "name": name,
-                "description": description,
-                "allowed_cidrs": allowed_cidrs,
-                "actor_account_id": actor_account_id,
-            },
-        )
-
-    @classmethod
-    def get_network_access_group(
-        cls,
-        tenant_id: str,
-        group_id: str,
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Fetch one reusable group scoped to its owning workspace."""
-
-        return cls._send_network_access_group_request(
-            "GET",
-            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
-            params={"actor_account_id": actor_account_id},
-        )
-
-    @classmethod
-    def update_network_access_group(
-        cls,
-        tenant_id: str,
-        group_id: str,
-        *,
-        name: str,
-        description: str,
-        allowed_cidrs: list[str],
-        expected_version: int,
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Replace a reusable group using optimistic concurrency control."""
-
-        return cls._send_network_access_group_request(
-            "PUT",
-            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
-            payload_json={
-                "name": name,
-                "description": description,
-                "allowed_cidrs": allowed_cidrs,
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
-        )
-
-    @classmethod
-    def delete_network_access_group(
-        cls,
-        tenant_id: str,
-        group_id: str,
-        *,
-        expected_version: int,
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Delete a reusable group using optimistic concurrency control."""
-
-        return cls._send_network_access_group_request(
-            "DELETE",
-            f"/tenants/{tenant_id}/network-access-groups/{group_id}",
-            params={
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
-        )
-
-    @classmethod
-    def get_app_network_access_group(
-        cls,
-        tenant_id: str,
-        app_id: str,
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Fetch the reusable group currently assigned to one tenant-scoped app."""
-
-        return cls._send_network_access_group_request(
-            "GET",
-            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group",
-            params={"actor_account_id": actor_account_id},
-        )
-
-    @classmethod
-    def update_app_network_access_group(
-        cls,
-        tenant_id: str,
-        app_id: str,
-        *,
-        enabled: bool,
-        group_id: str | None,
-        access_points: list[str],
-        expected_version: int,
-        actor_account_id: str,
-    ) -> dict[str, Any]:
-        """Atomically replace one tenant-scoped App's complete network access configuration."""
-
-        return cls._send_network_access_group_request(
-            "PUT",
-            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group",
-            payload_json={
-                "enabled": enabled,
-                "group_id": group_id,
-                "access_points": access_points,
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
-        )
-
-    @classmethod
-    def cleanup_app_network_access_group_binding(cls, tenant_id: str, app_id: str) -> dict[str, Any]:
-        """Remove an App binding through the internal App lifecycle endpoint.
-
-        This must only be called by the post-commit App deletion task. Account
-        or workspace-member deletion does not own App bindings and must not use
-        this operation.
-        """
-
-        return cls._send_network_access_group_request(
-            "DELETE",
-            f"/tenants/{tenant_id}/apps/{app_id}/network-access-group-binding",
-        )
-
-    @classmethod
-    def _send_network_access_group_request(
-        cls,
-        method: Literal["GET", "POST", "PUT", "DELETE"],
-        endpoint: str,
-        *,
-        payload_json: dict[str, Any] | None = None,
-        params: dict[str, Any] | None = None,
-    ) -> dict[str, Any]:
-        """Call the SaaS group API while preserving its status for the Console boundary."""
-
-        try:
-            response = cls._send_network_access_group_http_request(
-                method,
-                endpoint,
-                payload_json=payload_json,
-                params=params,
-            )
-        except httpx.RequestError as exc:
-            raise NetworkAccessGroupUpstreamError(httpx.codes.SERVICE_UNAVAILABLE) from exc
-
-        if response.status_code not in (httpx.codes.OK, httpx.codes.CREATED):
-            reason = None
-            try:
-                error_payload = response.json()
-                if isinstance(error_payload, dict) and isinstance(error_payload.get("reason"), str):
-                    reason = error_payload["reason"]
-            except (json.JSONDecodeError, TypeError, ValueError):
-                pass
-            raise NetworkAccessGroupUpstreamError(response.status_code, reason)
-
-        try:
-            payload = response.json()
-        except (json.JSONDecodeError, TypeError, ValueError) as exc:
-            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY) from exc
-
-        if not isinstance(payload, dict):
-            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY)
-        return payload
-
-    @classmethod
-    @retry(
-        wait=wait_fixed(2),
-        stop=stop_before_delay(10),
-        retry=retry_if_exception_type(httpx.RequestError),
-        reraise=True,
-    )
-    def _send_network_access_group_http_request(
-        cls,
-        method: Literal["GET", "POST", "PUT", "DELETE"],
-        endpoint: str,
-        *,
-        payload_json: dict[str, Any] | None = None,
-        params: dict[str, Any] | None = None,
-    ) -> httpx.Response:
-        headers = {"Content-Type": "application/json", "Billing-Api-Secret-Key": cls.secret_key}
-        network_access_base_url = dify_config.NETWORK_ACCESS_API_URL.strip() or cls.base_url
-        return _http_client.request(
-            method,
-            f"{network_access_base_url.rstrip('/')}{endpoint}",
-            json=payload_json,
-            params=params,
-            headers=headers,
-            follow_redirects=True,
-        )
-
     @classmethod
     def _send_quota_request(
         cls, method: Literal["GET", "POST", "DELETE", "PUT"], endpoint: str, json=None, params=None
diff --git a/api/services/network_access_group_gateway.py b/api/services/network_access_group_gateway.py
new file mode 100644
index 00000000000000..af45b25e3fbb36
--- /dev/null
+++ b/api/services/network_access_group_gateway.py
@@ -0,0 +1,235 @@
+"""HTTP and Billing adapters used by the network access group service."""
+
+import json
+from typing import Any, Literal, override
+
+import httpx
+from pydantic import ValidationError
+from tenacity import retry, retry_if_exception_type, stop_before_delay, wait_fixed
+
+from core.helper.http_client_pooling import get_pooled_http_client
+from enums import CloudPlan
+from services.billing_service import BillingService, _BillingHTTPStatusError
+from services.network_access_group_service import (
+    NetworkAccessGroupControlPlane,
+    NetworkAccessGroupEntitlement,
+    NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupUpstreamError,
+)
+
+_http_client: httpx.Client = get_pooled_http_client(
+    "network-access-group:default",
+    lambda: httpx.Client(
+        timeout=httpx.Timeout(30.0, connect=5.0),
+        limits=httpx.Limits(max_keepalive_connections=50, max_connections=100),
+    ),
+)
+
+
+class NetworkAccessGroupGateway(NetworkAccessGroupControlPlane):
+    def __init__(
+        self,
+        *,
+        base_url: str,
+        fallback_base_url: str,
+        secret_key: str,
+        http_client: httpx.Client = _http_client,
+    ) -> None:
+        self._base_url = base_url.strip() or fallback_base_url
+        self._secret_key = secret_key
+        self._http_client = http_client
+
+    @override
+    def list_groups(self, workspace_id: str, actor_account_id: str) -> dict[str, Any]:
+        return self._send_request(
+            "GET",
+            f"/tenants/{workspace_id}/network-access-groups",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @override
+    def create_group(
+        self,
+        workspace_id: str,
+        *,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        return self._send_request(
+            "POST",
+            f"/tenants/{workspace_id}/network-access-groups",
+            payload_json={
+                "name": name,
+                "description": description,
+                "allowed_cidrs": allowed_cidrs,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @override
+    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> dict[str, Any]:
+        return self._send_request(
+            "GET",
+            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @override
+    def update_group(
+        self,
+        workspace_id: str,
+        group_id: str,
+        *,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        return self._send_request(
+            "PUT",
+            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+            payload_json={
+                "name": name,
+                "description": description,
+                "allowed_cidrs": allowed_cidrs,
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @override
+    def delete_group(
+        self,
+        workspace_id: str,
+        group_id: str,
+        *,
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        return self._send_request(
+            "DELETE",
+            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+            params={
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @override
+    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> dict[str, Any]:
+        return self._send_request(
+            "GET",
+            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
+            params={"actor_account_id": actor_account_id},
+        )
+
+    @override
+    def update_app_binding(
+        self,
+        workspace_id: str,
+        app_id: str,
+        *,
+        enabled: bool,
+        group_id: str | None,
+        access_points: list[str],
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]:
+        return self._send_request(
+            "PUT",
+            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
+            payload_json={
+                "enabled": enabled,
+                "group_id": group_id,
+                "access_points": access_points,
+                "expected_version": expected_version,
+                "actor_account_id": actor_account_id,
+            },
+        )
+
+    @override
+    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> dict[str, Any]:
+        return self._send_request(
+            "DELETE",
+            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group-binding",
+        )
+
+    def _send_request(
+        self,
+        method: Literal["GET", "POST", "PUT", "DELETE"],
+        endpoint: str,
+        *,
+        payload_json: dict[str, Any] | None = None,
+        params: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
+        try:
+            response = self._send_http_request(
+                method,
+                endpoint,
+                payload_json=payload_json,
+                params=params,
+            )
+        except httpx.RequestError as exc:
+            raise NetworkAccessGroupUpstreamError(httpx.codes.SERVICE_UNAVAILABLE) from exc
+
+        if response.status_code not in (httpx.codes.OK, httpx.codes.CREATED):
+            reason = None
+            try:
+                error_payload = response.json()
+                if isinstance(error_payload, dict) and isinstance(error_payload.get("reason"), str):
+                    reason = error_payload["reason"]
+            except (json.JSONDecodeError, TypeError, ValueError):
+                pass
+            raise NetworkAccessGroupUpstreamError(response.status_code, reason)
+
+        try:
+            payload = response.json()
+        except (json.JSONDecodeError, TypeError, ValueError) as exc:
+            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY) from exc
+
+        if not isinstance(payload, dict):
+            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY)
+        return payload
+
+    @retry(
+        wait=wait_fixed(2),
+        stop=stop_before_delay(10),
+        retry=retry_if_exception_type(httpx.RequestError),
+        reraise=True,
+    )
+    def _send_http_request(
+        self,
+        method: Literal["GET", "POST", "PUT", "DELETE"],
+        endpoint: str,
+        *,
+        payload_json: dict[str, Any] | None = None,
+        params: dict[str, Any] | None = None,
+    ) -> httpx.Response:
+        headers = {"Content-Type": "application/json", "Billing-Api-Secret-Key": self._secret_key}
+        return self._http_client.request(
+            method,
+            f"{self._base_url.rstrip('/')}{endpoint}",
+            json=payload_json,
+            params=params,
+            headers=headers,
+            follow_redirects=True,
+        )
+
+
+class BillingNetworkAccessGroupEntitlementGateway(NetworkAccessGroupEntitlement):
+    @override
+    def is_paid_plan(self, workspace_id: str) -> bool:
+        try:
+            billing_info = BillingService.get_info(workspace_id, exclude_vector_space=True)
+        except (
+            httpx.RequestError,
+            json.JSONDecodeError,
+            UnicodeDecodeError,
+            ValidationError,
+            _BillingHTTPStatusError,
+        ) as exc:
+            raise NetworkAccessGroupEntitlementUnavailableError from exc
+        return billing_info["subscription"]["plan"] in (CloudPlan.PROFESSIONAL, CloudPlan.TEAM)
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index dcbe2e8908639c..48e28585afa0a3 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -1,23 +1,345 @@
-import logging
-from typing import Any
+"""Application service for workspace network access groups."""
 
-from sqlalchemy import select
-from sqlalchemy.exc import SQLAlchemyError
+import logging
+from collections.abc import Sequence
+from typing import Any, Literal, NamedTuple, Protocol
 
-from extensions.ext_database import db
-from models import App
+from machinery.context import RequestContext
 
 logger = logging.getLogger(__name__)
 
+NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
+
+_ACCESS_POINTS_BY_APP_MODE: dict[str, tuple[NetworkAccessPoint, ...]] = {
+    "workflow": ("webapp", "service_api", "mcp", "trigger"),
+    "advanced-chat": ("webapp", "service_api", "mcp"),
+    "chat": ("webapp", "service_api", "mcp"),
+    "completion": ("webapp", "service_api", "mcp"),
+    "agent-chat": ("webapp", "service_api", "mcp"),
+    "agent": ("webapp", "service_api"),
+}
+
+
+class NetworkAccessGroupError(Exception):
+    """Expected network access group use-case failure."""
+
+
+class NetworkAccessGroupUpstreamError(NetworkAccessGroupError):
+    """Failure returned by the network-access control plane."""
+
+    def __init__(self, status_code: int, reason: str | None = None) -> None:
+        self.status_code = status_code
+        self.reason = reason
+        super().__init__(f"network access group upstream returned HTTP {status_code}")
+
+
+class NetworkAccessGroupAccessDeniedError(NetworkAccessGroupError):
+    """The actor is not a persisted owner or administrator of the workspace."""
+
+
+class NetworkAccessGroupEntitlementUnavailableError(NetworkAccessGroupError):
+    """The workspace plan could not be resolved."""
+
+
+class NetworkAccessGroupAppNotFoundError(NetworkAccessGroupError):
+    """The tenant-scoped App does not exist or is not manageable."""
+
+
+class NetworkAccessGroupUnsupportedAppModeError(NetworkAccessGroupError):
+    def __init__(self, app_mode: str) -> None:
+        self.app_mode = app_mode
+        super().__init__(f"network access control is not supported for app mode {app_mode!r}")
+
+
+class NetworkAccessGroupUnsupportedAccessPointsError(NetworkAccessGroupError):
+    def __init__(self, access_points: Sequence[str]) -> None:
+        self.access_points = tuple(access_points)
+        super().__init__(f"unsupported app access points: {', '.join(self.access_points)}")
+
+
+class NetworkAccessGroupAppQueryError(Exception):
+    """The local App read model could not be queried."""
+
+
+class NetworkAccessGroupAppRecord(NamedTuple):
+    id: str
+    mode: str
+    name: str
+    icon: str | None
+    icon_type: str | None
+    icon_background: str | None
+
+
+class NetworkAccessGroupAppQuery(Protocol):
+    def get_manageable_app(self, *, workspace_id: str, app_id: str) -> NetworkAccessGroupAppRecord | None: ...
+
+    def list_apps(
+        self,
+        *,
+        workspace_id: str,
+        app_ids: Sequence[str],
+    ) -> Sequence[NetworkAccessGroupAppRecord]: ...
+
+
+class WorkspaceMembershipRoleQuery(Protocol):
+    def get_role_for_account(self, *, workspace_id: str, account_id: str) -> str | None: ...
+
+
+class NetworkAccessGroupEntitlement(Protocol):
+    def is_paid_plan(self, workspace_id: str) -> bool: ...
+
+
+class NetworkAccessGroupControlPlane(Protocol):
+    def list_groups(self, workspace_id: str, actor_account_id: str) -> dict[str, Any]: ...
+
+    def create_group(
+        self,
+        workspace_id: str,
+        *,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+        actor_account_id: str,
+    ) -> dict[str, Any]: ...
+
+    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> dict[str, Any]: ...
+
+    def update_group(
+        self,
+        workspace_id: str,
+        group_id: str,
+        *,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]: ...
+
+    def delete_group(
+        self,
+        workspace_id: str,
+        group_id: str,
+        *,
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]: ...
+
+    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> dict[str, Any]: ...
+
+    def update_app_binding(
+        self,
+        workspace_id: str,
+        app_id: str,
+        *,
+        enabled: bool,
+        group_id: str | None,
+        access_points: list[str],
+        expected_version: int,
+        actor_account_id: str,
+    ) -> dict[str, Any]: ...
+
+    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> dict[str, Any]: ...
+
 
 class NetworkAccessGroupService:
-    """Dify-side orchestration for SaaS network access group responses."""
+    def __init__(
+        self,
+        *,
+        control_plane: NetworkAccessGroupControlPlane,
+        apps: NetworkAccessGroupAppQuery,
+        memberships: WorkspaceMembershipRoleQuery,
+        entitlement: NetworkAccessGroupEntitlement,
+    ) -> None:
+        self._control_plane = control_plane
+        self._apps = apps
+        self._memberships = memberships
+        self._entitlement = entitlement
+
+    def list_groups(self, context: RequestContext) -> dict[str, Any]:
+        self._ensure_workspace_admin_or_owner(context)
+        payload = self._control_plane.list_groups(context.active_workspace_id, context.account_id)
+        payload["entitled"] = self._effective_entitlement(
+            context.active_workspace_id,
+            payload.get("entitled"),
+        )
+        return self._enrich_app_references(payload, context.active_workspace_id)
+
+    def create_group(
+        self,
+        context: RequestContext,
+        *,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+    ) -> dict[str, Any]:
+        self._ensure_workspace_admin_or_owner(context)
+        payload = self._control_plane.create_group(
+            context.active_workspace_id,
+            name=name,
+            description=description,
+            allowed_cidrs=allowed_cidrs,
+            actor_account_id=context.account_id,
+        )
+        return self._enrich_app_references(payload, context.active_workspace_id)
+
+    def get_group(self, context: RequestContext, *, group_id: str) -> dict[str, Any]:
+        self._ensure_workspace_admin_or_owner(context)
+        payload = self._control_plane.get_group(
+            context.active_workspace_id,
+            group_id,
+            context.account_id,
+        )
+        return self._enrich_app_references(payload, context.active_workspace_id)
+
+    def update_group(
+        self,
+        context: RequestContext,
+        *,
+        group_id: str,
+        name: str,
+        description: str,
+        allowed_cidrs: list[str],
+        expected_version: int,
+    ) -> dict[str, Any]:
+        self._ensure_workspace_admin_or_owner(context)
+        payload = self._control_plane.update_group(
+            context.active_workspace_id,
+            group_id,
+            name=name,
+            description=description,
+            allowed_cidrs=allowed_cidrs,
+            expected_version=expected_version,
+            actor_account_id=context.account_id,
+        )
+        return self._enrich_app_references(payload, context.active_workspace_id)
+
+    def delete_group(
+        self,
+        context: RequestContext,
+        *,
+        group_id: str,
+        expected_version: int,
+    ) -> dict[str, Any]:
+        self._ensure_workspace_admin_or_owner(context)
+        return self._control_plane.delete_group(
+            context.active_workspace_id,
+            group_id,
+            expected_version=expected_version,
+            actor_account_id=context.account_id,
+        )
+
+    def get_app_binding(self, context: RequestContext, *, app_id: str) -> dict[str, Any]:
+        app = self._get_manageable_app(context.active_workspace_id, app_id)
+        self._ensure_workspace_admin_or_owner(context)
+        available_access_points = self._available_access_points(app.mode)
+        payload = self._control_plane.get_app_binding(
+            context.active_workspace_id,
+            app.id,
+            context.account_id,
+        )
+        self._normalize_app_binding_defaults(payload)
+        self._limit_binding_access_points(payload, available_access_points)
+        payload["entitled"] = self._effective_entitlement(
+            context.active_workspace_id,
+            payload.get("entitled"),
+        )
+        payload["available_access_points"] = available_access_points
+        return payload
+
+    def update_app_binding(
+        self,
+        context: RequestContext,
+        *,
+        app_id: str,
+        enabled: bool,
+        group_id: str | None,
+        access_points: list[NetworkAccessPoint],
+        expected_version: int,
+    ) -> dict[str, Any]:
+        app = self._get_manageable_app(context.active_workspace_id, app_id)
+        self._ensure_workspace_admin_or_owner(context)
+        available_access_points = self._available_access_points(app.mode)
+        self._validate_app_access_points(access_points, available_access_points)
+        payload = self._control_plane.update_app_binding(
+            context.active_workspace_id,
+            app.id,
+            enabled=enabled,
+            group_id=group_id,
+            access_points=list(access_points),
+            expected_version=expected_version,
+            actor_account_id=context.account_id,
+        )
+        self._normalize_app_binding_defaults(payload)
+        self._limit_binding_access_points(payload, available_access_points)
+        payload["available_access_points"] = available_access_points
+        return payload
+
+    def cleanup_app_binding(self, *, workspace_id: str, app_id: str) -> dict[str, Any]:
+        return self._control_plane.cleanup_app_binding(workspace_id, app_id)
+
+    def _ensure_workspace_admin_or_owner(self, context: RequestContext) -> None:
+        role = self._memberships.get_role_for_account(
+            workspace_id=context.active_workspace_id,
+            account_id=context.account_id,
+        )
+        if role not in {"owner", "admin"}:
+            raise NetworkAccessGroupAccessDeniedError
+
+    def _effective_entitlement(self, workspace_id: str, upstream_entitled: object) -> bool:
+        return bool(upstream_entitled) and self._entitlement.is_paid_plan(workspace_id)
+
+    def _get_manageable_app(self, workspace_id: str, app_id: str) -> NetworkAccessGroupAppRecord:
+        app = self._apps.get_manageable_app(workspace_id=workspace_id, app_id=app_id)
+        if app is None:
+            raise NetworkAccessGroupAppNotFoundError
+        return app
+
+    @staticmethod
+    def _available_access_points(app_mode: str) -> list[NetworkAccessPoint]:
+        available = _ACCESS_POINTS_BY_APP_MODE.get(app_mode)
+        if available is None:
+            raise NetworkAccessGroupUnsupportedAppModeError(app_mode)
+        return list(available)
+
+    @staticmethod
+    def _validate_app_access_points(
+        requested: Sequence[NetworkAccessPoint],
+        available: Sequence[NetworkAccessPoint],
+    ) -> None:
+        unsupported = sorted(set(requested).difference(available))
+        if unsupported:
+            raise NetworkAccessGroupUnsupportedAccessPointsError(unsupported)
 
     @staticmethod
-    def enrich_app_references(
+    def _normalize_app_binding_defaults(payload: dict[str, Any]) -> None:
+        """Materialize ProtoJSON defaults so the Console response stays stable."""
+
+        payload.setdefault("binding", None)
+        binding = payload.get("binding")
+        if not isinstance(binding, dict):
+            return
+        binding.setdefault("enabled", False)
+        if "access_points" not in binding and "accessPoints" not in binding:
+            binding["access_points"] = []
+
+    @staticmethod
+    def _limit_binding_access_points(
         payload: dict[str, Any],
-        tenant_id: str,
-    ) -> dict[str, Any]:
+        available: Sequence[NetworkAccessPoint],
+    ) -> None:
+        """Hide stale scopes which are not real access points for the current App mode."""
+
+        binding = payload.get("binding")
+        if not isinstance(binding, dict):
+            return
+        raw_access_points = binding.get("access_points", binding.get("accessPoints", []))
+        if not isinstance(raw_access_points, list):
+            return
+        binding["access_points"] = [access_point for access_point in raw_access_points if access_point in available]
+        binding.pop("accessPoints", None)
+
+    def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) -> dict[str, Any]:
         """Attach tenant-scoped App display metadata to one or more group payloads."""
 
         raw_groups: list[object] = []
@@ -56,27 +378,25 @@ def enrich_app_references(
             return payload
 
         try:
-            app_models = db.session.scalars(
-                select(App).where(
-                    App.tenant_id == tenant_id,
-                    App.id.in_(app_ids),
-                    App.status == "normal",
-                )
-            ).all()
-        except SQLAlchemyError:
-            logger.exception("Failed to enrich network access Policy App references", extra={"tenant_id": tenant_id})
+            app_records = self._apps.list_apps(workspace_id=workspace_id, app_ids=tuple(app_ids))
+        except NetworkAccessGroupAppQueryError:
+            logger.exception(
+                "Failed to enrich network access group App references",
+                extra={"workspace_id": workspace_id},
+            )
             for group in groups:
                 group["apps"] = []
             return payload
+
         apps_by_id = {
-            str(app.id): {
-                "id": str(app.id),
+            app.id: {
+                "id": app.id,
                 "name": app.name,
                 "icon": app.icon,
-                "icon_type": app.icon_type.value if app.icon_type is not None else None,
+                "icon_type": app.icon_type,
                 "icon_background": app.icon_background,
             }
-            for app in app_models
+            for app in app_records
         }
         for group in groups:
             group_app_ids = group["app_ids"] if isinstance(group["app_ids"], list) else []
diff --git a/api/tasks/remove_app_and_related_data_task.py b/api/tasks/remove_app_and_related_data_task.py
index 52212131124fda..40b6f70b48152d 100644
--- a/api/tasks/remove_app_and_related_data_task.py
+++ b/api/tasks/remove_app_and_related_data_task.py
@@ -52,7 +52,6 @@
 )
 from repositories.factory import DifyAPIRepositoryFactory
 from services.api_token_service import ApiTokenCache
-from services.billing_service import BillingService
 
 logger = logging.getLogger(__name__)
 
@@ -76,7 +75,14 @@ def cleanup_app_network_access_group_binding_task(self, tenant_id: str, app_id:
     if dify_config.DEPLOYMENT_EDITION != DeploymentEdition.CLOUD:
         return
     try:
-        BillingService.cleanup_app_network_access_group_binding(tenant_id, app_id)
+        # Import lazily because AppService imports this task module while the
+        # application-service composition root imports AppService dependencies.
+        from extensions.ext_application_services import application_services
+
+        application_services().network_access_groups.cleanup_app_binding(
+            workspace_id=tenant_id,
+            app_id=app_id,
+        )
     except Exception as e:
         countdown = _network_access_binding_cleanup_retry_delay(self.request.retries)
         logger.exception(
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 62b6ab93a2dcb9..1b50ad3bf15a56 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -1,16 +1,17 @@
-from collections.abc import Iterator
+from collections.abc import Callable, Generator
+from contextlib import contextmanager
 from datetime import UTC, datetime
 from inspect import unwrap
 from types import SimpleNamespace
-from typing import cast
 from unittest.mock import MagicMock, patch
 from uuid import UUID
 
 import pytest
+from flask import Flask
 from pydantic import ValidationError
-from sqlalchemy.exc import SQLAlchemyError
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
 
+from controllers.console.app.error import AppNotFoundError
 from controllers.console.workspace.network_access_group import (
     AppNetworkAccessGroupApi,
     AppNetworkAccessGroupUpdatePayload,
@@ -19,14 +20,19 @@
     NetworkAccessGroupCreatePayload,
     NetworkAccessGroupDeleteQuery,
     NetworkAccessGroupUpdatePayload,
-    _available_access_points,
-    _effective_entitlement,
-    _limit_binding_access_points,
+    _translate_service_error,
     _translate_upstream_error,
 )
-from models import App, AppMode, TenantAccountRole
-from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
-from services.network_access_group_service import NetworkAccessGroupService
+from machinery.context import RequestContext
+from services.network_access_group_service import (
+    NetworkAccessGroupAccessDeniedError,
+    NetworkAccessGroupAppNotFoundError,
+    NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupError,
+    NetworkAccessGroupUnsupportedAccessPointsError,
+    NetworkAccessGroupUnsupportedAppModeError,
+    NetworkAccessGroupUpstreamError,
+)
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
 ACCOUNT_ID = "22222222-2222-4222-8222-222222222222"
@@ -35,15 +41,20 @@
 BINDING_ID = "55555555-5555-4555-8555-555555555555"
 
 
-def _current_user(role: TenantAccountRole = TenantAccountRole.OWNER) -> SimpleNamespace:
-    return SimpleNamespace(id=ACCOUNT_ID, current_role=role)
+def _request_context() -> RequestContext:
+    return RequestContext(
+        request_id="request-id",
+        trace_id=None,
+        account_id=ACCOUNT_ID,
+        active_workspace_id=TENANT_ID,
+    )
 
 
-@pytest.fixture(autouse=True)
-def paid_entitlement() -> Iterator[None]:
+@contextmanager
+def _application_services(service: MagicMock) -> Generator[None]:
     with patch(
-        "controllers.console.workspace.network_access_group._effective_entitlement",
-        side_effect=lambda _tenant_id, upstream: bool(upstream),
+        "controllers.console.workspace.network_access_group.application_services",
+        return_value=SimpleNamespace(network_access_groups=service),
     ):
         yield
 
@@ -58,7 +69,7 @@ def _group_payload(*, app_ids: list[str] | None = None) -> dict[str, object]:
         "allowedCidrs": ["203.0.113.7/32"],
         "usedByCount": len(app_ids),
         "usedByAppIds": app_ids,
-        # ProtoJSON represents int64 values as strings and timestamps as RFC 3339.
+        "apps": [],
         "version": "2",
         "updatedByAccountId": ACCOUNT_ID,
         "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
@@ -86,211 +97,135 @@ def _binding_payload(
     }
 
 
-def test_list_authorizes_and_forwards_tenant_and_actor() -> None:
+def test_list_forwards_request_context_and_serializes_response() -> None:
+    service = MagicMock()
+    service.list_groups.return_value = {
+        "tenantId": TENANT_ID,
+        "entitled": True,
+        "groups": [_group_payload()],
+    }
     api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.get)
-    current_user = _current_user()
-    upstream_payload = {"tenantId": TENANT_ID, "entitled": True, "groups": [_group_payload()]}
 
-    with (
-        patch.object(BillingService, "list_network_access_groups", return_value=upstream_payload) as list_groups,
-    ):
-        result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
+    with _application_services(service):
+        result = unwrap(api.get)(api, request_context=_request_context())
 
-    list_groups.assert_called_once_with(TENANT_ID, ACCOUNT_ID)
+    service.list_groups.assert_called_once_with(_request_context())
     assert result["tenant_id"] == TENANT_ID
-    assert result["groups"][0]["name"] == "Office network"
     assert result["groups"][0]["version"] == 2
-    assert result["groups"][0]["used_by_count"] == 0
-    assert result["groups"][0]["app_ids"] == []
-    assert result["groups"][0]["apps"] == []
     assert result["groups"][0]["updated_at"] == "2026-08-21T00:00:00Z"
 
 
-def test_create_injects_actor_and_returns_created_contract() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.post)
-    current_user = _current_user()
+def test_create_forwards_payload_and_returns_201() -> None:
+    service = MagicMock()
+    service.create_group.return_value = {"group": _group_payload()}
     request_payload = NetworkAccessGroupCreatePayload(
         name="Office network",
         description="Reusable office egress addresses",
         allowed_cidrs=["203.0.113.7/32"],
     )
+    api = CurrentWorkspaceNetworkAccessGroupsApi()
 
-    with (
-        patch.object(
-            BillingService,
-            "create_network_access_group",
-            return_value={"group": _group_payload()},
-        ) as create_group,
-    ):
-        body, status = method(
+    with _application_services(service):
+        body, status = unwrap(api.post)(
             api,
             req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
+            request_context=_request_context(),
         )
 
-    create_group.assert_called_once_with(
-        TENANT_ID,
+    service.create_group.assert_called_once_with(
+        _request_context(),
         name="Office network",
         description="Reusable office egress addresses",
         allowed_cidrs=["203.0.113.7/32"],
-        actor_account_id=ACCOUNT_ID,
     )
     assert status == 201
     assert body["group"]["id"] == GROUP_ID
 
 
-def test_update_group_forwards_path_id_and_expected_version() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupApi()
-    method = unwrap(api.put)
-    current_user = _current_user()
-    request_payload = NetworkAccessGroupUpdatePayload(
+def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
+    service = MagicMock()
+    service.get_group.return_value = {"group": _group_payload()}
+    service.update_group.return_value = {"group": _group_payload()}
+    service.delete_group.return_value = {"deleted": True}
+    update_payload = NetworkAccessGroupUpdatePayload(
         name="Office network",
         description="Updated",
         allowed_cidrs=["203.0.113.0/24"],
         expected_version=1,
     )
+    api = CurrentWorkspaceNetworkAccessGroupApi()
 
-    with (
-        patch.object(
-            BillingService,
-            "update_network_access_group",
-            return_value={"group": _group_payload()},
-        ) as update_group,
-    ):
-        result = method(
+    with _application_services(service):
+        get_result = unwrap(api.get)(api, request_context=_request_context(), group_id=UUID(GROUP_ID))
+        update_result = unwrap(api.put)(
             api,
-            req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
+            req_data=update_payload,
+            request_context=_request_context(),
             group_id=UUID(GROUP_ID),
         )
-
-    update_group.assert_called_once_with(
-        TENANT_ID,
-        GROUP_ID,
-        name="Office network",
-        description="Updated",
-        allowed_cidrs=["203.0.113.0/24"],
-        expected_version=1,
-        actor_account_id=ACCOUNT_ID,
-    )
-    assert result["group"]["version"] == 2
-
-
-def test_delete_group_reads_expected_version_from_query_and_injects_actor() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupApi()
-    method = unwrap(api.delete)
-    current_user = _current_user()
-
-    with (
-        patch.object(
-            BillingService,
-            "delete_network_access_group",
-            return_value={"deleted": True},
-        ) as delete_group,
-    ):
-        result = method(
+        delete_result = unwrap(api.delete)(
             api,
             req_data=NetworkAccessGroupDeleteQuery(expected_version=2),
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
+            request_context=_request_context(),
             group_id=UUID(GROUP_ID),
         )
 
-    delete_group.assert_called_once_with(
-        TENANT_ID,
-        GROUP_ID,
-        expected_version=2,
-        actor_account_id=ACCOUNT_ID,
+    service.get_group.assert_called_once_with(_request_context(), group_id=GROUP_ID)
+    service.update_group.assert_called_once_with(
+        _request_context(),
+        group_id=GROUP_ID,
+        name="Office network",
+        description="Updated",
+        allowed_cidrs=["203.0.113.0/24"],
+        expected_version=1,
     )
-    assert result == {"deleted": True}
-
-
-def test_app_get_forwards_tenant_scoped_app_and_supports_unbound_response() -> None:
-    api = AppNetworkAccessGroupApi()
-    method = unwrap(api.get)
-    current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
-    upstream_payload = {"tenantId": TENANT_ID, "appId": APP_ID, "entitled": True}
+    service.delete_group.assert_called_once_with(_request_context(), group_id=GROUP_ID, expected_version=2)
+    assert get_result["group"]["id"] == GROUP_ID
+    assert update_result["group"]["version"] == 2
+    assert delete_result == {"deleted": True}
 
-    with (
-        patch.object(
-            BillingService,
-            "get_app_network_access_group",
-            return_value=upstream_payload,
-        ) as get_binding,
-    ):
-        result = method(
-            api,
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
-            app_model=app_model,
-        )
 
-    get_binding.assert_called_once_with(TENANT_ID, APP_ID, ACCOUNT_ID)
-    assert result["binding"] is None
-    assert result["available_access_points"] == ["webapp", "service_api", "mcp"]
-
-
-@pytest.mark.parametrize("enabled", [True, False])
-def test_app_put_atomically_saves_enabled_group_and_access_points(enabled: bool) -> None:
-    api = AppNetworkAccessGroupApi()
-    method = unwrap(api.put)
-    current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
+def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
+    service = MagicMock()
+    service.get_app_binding.return_value = {
+        "tenantId": TENANT_ID,
+        "appId": APP_ID,
+        "entitled": True,
+        "available_access_points": ["webapp", "service_api", "mcp"],
+        "binding": None,
+    }
+    service.update_app_binding.return_value = {
+        "binding": _binding_payload(),
+        "available_access_points": ["webapp", "service_api", "mcp"],
+    }
     request_payload = AppNetworkAccessGroupUpdatePayload(
-        enabled=enabled,
+        enabled=True,
         group_id=GROUP_ID,
         access_points=["webapp", "service_api"],
         expected_version=2,
     )
+    api = AppNetworkAccessGroupApi()
 
-    with (
-        patch.object(
-            BillingService,
-            "update_app_network_access_group",
-            return_value={"binding": _binding_payload(enabled=enabled)},
-        ) as update_binding,
-    ):
-        result = method(
+    with _application_services(service):
+        get_result = unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
+        put_result = unwrap(api.put)(
             api,
             req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
-            app_model=app_model,
+            request_context=_request_context(),
+            app_id=UUID(APP_ID),
         )
 
-    update_binding.assert_called_once_with(
-        TENANT_ID,
-        APP_ID,
-        enabled=enabled,
+    service.get_app_binding.assert_called_once_with(_request_context(), app_id=APP_ID)
+    service.update_app_binding.assert_called_once_with(
+        _request_context(),
+        app_id=APP_ID,
+        enabled=True,
         group_id=GROUP_ID,
         access_points=["webapp", "service_api"],
         expected_version=2,
-        actor_account_id=ACCOUNT_ID,
     )
-    assert result["binding"]["enabled"] is enabled
-    assert result["binding"]["group_id"] == GROUP_ID
-    assert result["binding"]["access_points"] == ["webapp", "service_api"]
-    assert result["binding"]["version"] == 3
-    assert result["available_access_points"] == ["webapp", "service_api", "mcp"]
-
-
-def test_list_rejects_non_privileged_workspace_member_before_upstream_call() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.get)
-    current_user = _current_user(TenantAccountRole.NORMAL)
-
-    with (
-        patch.object(BillingService, "list_network_access_groups") as list_groups,
-        pytest.raises(Forbidden),
-    ):
-        method(api, current_tenant_id=TENANT_ID, current_user=current_user)
-
-    list_groups.assert_not_called()
+    assert get_result["binding"] is None
+    assert put_result["binding"]["version"] == 3
 
 
 @pytest.mark.parametrize(
@@ -325,124 +260,88 @@ def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, ex
 
 
 def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None:
-    error = _translate_upstream_error(NetworkAccessGroupUpstreamError(400, "INVALID_SECRET_KEY"))
-    assert isinstance(error, ServiceUnavailable)
-
-
-def test_list_maps_invalid_upstream_contract_to_bad_gateway() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.get)
-    current_user = _current_user()
-
-    with (
-        patch.object(
-            BillingService,
-            "list_network_access_groups",
-            return_value={"tenant_id": TENANT_ID, "entitled": True, "groups": [{"allowed_cidrs": []}]},
-        ),
-        pytest.raises(BadGateway),
-    ):
-        method(api, current_tenant_id=TENANT_ID, current_user=current_user)
-
-
-def test_response_contract_accepts_protojson_omitted_optional_group_fields() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.get)
-    current_user = _current_user()
-    group = _group_payload()
-    group.pop("description")
-    group.pop("usedByAppIds")
-    group.pop("usedByCount")
+    assert isinstance(
+        _translate_upstream_error(NetworkAccessGroupUpstreamError(400, "INVALID_SECRET_KEY")),
+        ServiceUnavailable,
+    )
 
-    with (
-        patch.object(
-            BillingService,
-            "list_network_access_groups",
-            return_value={"tenantId": TENANT_ID, "entitled": True, "groups": [group]},
-        ),
-    ):
-        result = method(api, current_tenant_id=TENANT_ID, current_user=current_user)
 
-    assert result["groups"][0]["description"] == ""
-    assert result["groups"][0]["allowed_cidrs"] == ["203.0.113.7/32"]
-    assert result["groups"][0]["app_ids"] == []
-    assert result["groups"][0]["used_by_count"] == 0
+@pytest.mark.parametrize(
+    ("service_error", "expected_exception", "expected_message"),
+    [
+        (NetworkAccessGroupAccessDeniedError(), Forbidden, "owners and administrators"),
+        (NetworkAccessGroupEntitlementUnavailableError(), ServiceUnavailable, "temporarily unavailable"),
+        (NetworkAccessGroupAppNotFoundError(), AppNotFoundError, "not found"),
+        (NetworkAccessGroupUnsupportedAppModeError("channel"), BadRequest, "channel"),
+        (NetworkAccessGroupUnsupportedAccessPointsError(["trigger"]), BadRequest, "trigger"),
+    ],
+)
+def test_application_error_mapping(
+    service_error: NetworkAccessGroupError,
+    expected_exception: type[HTTPException],
+    expected_message: str,
+) -> None:
+    error = _translate_service_error(service_error)
+    assert isinstance(error, expected_exception)
+    assert error.description is not None
+    assert expected_message in error.description.lower()
 
 
-def test_binding_response_materializes_protojson_omitted_disabled_defaults() -> None:
-    api = AppNetworkAccessGroupApi()
-    method = unwrap(api.put)
-    current_user = _current_user()
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
-    request_payload = AppNetworkAccessGroupUpdatePayload(
-        enabled=False,
-        group_id=None,
-        access_points=[],
-        expected_version=2,
-    )
-    binding = _binding_payload(enabled=False, group_id=None, access_points=[])
-    binding.pop("groupId")
-    binding.pop("enabled")
-    binding.pop("accessPoints")
+@pytest.mark.parametrize(
+    "mutation",
+    [
+        CurrentWorkspaceNetworkAccessGroupsApi.post,
+        CurrentWorkspaceNetworkAccessGroupApi.put,
+        CurrentWorkspaceNetworkAccessGroupApi.delete,
+        AppNetworkAccessGroupApi.put,
+    ],
+)
+def test_mutation_paid_plan_admission_precedes_payload_validation(mutation: Callable[..., object]) -> None:
+    app = Flask(__name__)
+    paid_plan_wrapper = unwrap(mutation, stop=lambda candidate: candidate is not mutation)
 
     with (
-        patch.object(
-            BillingService,
-            "update_app_network_access_group",
-            return_value={"binding": binding},
+        app.test_request_context(json={"name": "", "description": "", "allowed_cidrs": []}),
+        patch(
+            "controllers.console.wraps.current_account_with_tenant",
+            return_value=(object(), TENANT_ID),
         ),
+        patch(
+            "controllers.console.wraps.is_cloud_edition_billing_paid_plan",
+            return_value=False,
+        ) as is_paid_plan,
+        pytest.raises(HTTPException) as exc_info,
     ):
-        result = method(
-            api,
-            req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=current_user,
-            app_model=app_model,
-        )
+        paid_plan_wrapper(object())
 
-    assert result["binding"]["group_id"] is None
-    assert result["binding"]["enabled"] is False
-    assert result["binding"]["access_points"] == []
+    assert exc_info.value.code == 403
+    is_paid_plan.assert_called_once_with(TENANT_ID)
 
 
-def test_binding_response_accepts_policy_id_alias() -> None:
-    api = AppNetworkAccessGroupApi()
-    method = unwrap(api.put)
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.CHAT)
-    request_payload = AppNetworkAccessGroupUpdatePayload(
-        enabled=True,
-        group_id=GROUP_ID,
-        access_points=["webapp"],
-        expected_version=2,
-    )
-    binding = _binding_payload(access_points=["webapp"])
-    binding["policyId"] = binding.pop("groupId")
+def test_controller_maps_service_error_before_serialization() -> None:
+    service = MagicMock()
+    service.list_groups.side_effect = NetworkAccessGroupAccessDeniedError
 
-    with patch.object(BillingService, "update_app_network_access_group", return_value={"binding": binding}):
-        result = method(
-            api,
-            req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=_current_user(),
-            app_model=app_model,
+    with _application_services(service), pytest.raises(Forbidden, match="owners and administrators"):
+        unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
+            CurrentWorkspaceNetworkAccessGroupsApi(),
+            request_context=_request_context(),
         )
 
-    assert result["binding"]["group_id"] == GROUP_ID
 
-
-def test_binding_response_hides_scopes_not_available_for_current_app_mode() -> None:
-    payload = {
-        "binding": _binding_payload(
-            enabled=True,
-            group_id=GROUP_ID,
-            access_points=["webapp", "service_api", "mcp", "trigger"],
-        )
+def test_invalid_service_response_is_bad_gateway() -> None:
+    service = MagicMock()
+    service.list_groups.return_value = {
+        "tenant_id": TENANT_ID,
+        "entitled": True,
+        "groups": [{"allowed_cidrs": list[str]()}],
     }
 
-    _limit_binding_access_points(payload, ["webapp", "service_api"])
-
-    assert payload["binding"]["access_points"] == ["webapp", "service_api"]
-    assert "accessPoints" not in payload["binding"]
+    with _application_services(service), pytest.raises(BadGateway):
+        unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
+            CurrentWorkspaceNetworkAccessGroupsApi(),
+            request_context=_request_context(),
+        )
 
 
 @pytest.mark.parametrize(
@@ -458,67 +357,6 @@ def test_create_payload_contract_rejects_invalid_shapes(payload: dict[str, objec
         NetworkAccessGroupCreatePayload.model_validate(payload)
 
 
-def test_binding_payload_rejects_invalid_group_id_and_version() -> None:
-    with pytest.raises(ValidationError):
-        AppNetworkAccessGroupUpdatePayload.model_validate(
-            {
-                "enabled": True,
-                "group_id": "not-a-uuid",
-                "access_points": ["webapp"],
-                "expected_version": -1,
-            }
-        )
-
-
-@pytest.mark.parametrize(
-    ("app_mode", "expected"),
-    [
-        (AppMode.WORKFLOW, ["webapp", "service_api", "mcp", "trigger"]),
-        (AppMode.ADVANCED_CHAT, ["webapp", "service_api", "mcp"]),
-        (AppMode.CHAT, ["webapp", "service_api", "mcp"]),
-        (AppMode.COMPLETION, ["webapp", "service_api", "mcp"]),
-        (AppMode.AGENT_CHAT, ["webapp", "service_api", "mcp"]),
-        (AppMode.AGENT, ["webapp", "service_api"]),
-    ],
-)
-def test_available_access_points_are_derived_from_app_mode(app_mode: AppMode, expected: list[str]) -> None:
-    app_model = SimpleNamespace(mode=app_mode)
-
-    assert _available_access_points(cast(App, app_model)) == expected
-
-
-@pytest.mark.parametrize("app_mode", [AppMode.CHANNEL, AppMode.RAG_PIPELINE])
-def test_unsupported_app_modes_are_rejected(app_mode: AppMode) -> None:
-    with pytest.raises(BadRequest, match="not supported"):
-        _available_access_points(cast(App, SimpleNamespace(mode=app_mode)))
-
-
-def test_app_put_rejects_access_point_not_available_for_mode_before_upstream_call() -> None:
-    api = AppNetworkAccessGroupApi()
-    method = unwrap(api.put)
-    app_model = SimpleNamespace(id=UUID(APP_ID), tenant_id=TENANT_ID, mode=AppMode.AGENT)
-    request_payload = AppNetworkAccessGroupUpdatePayload(
-        enabled=True,
-        group_id=GROUP_ID,
-        access_points=["webapp", "mcp"],
-        expected_version=1,
-    )
-
-    with (
-        patch.object(BillingService, "update_app_network_access_group") as update_binding,
-        pytest.raises(BadRequest, match="mcp"),
-    ):
-        method(
-            api,
-            req_data=request_payload,
-            current_tenant_id=TENANT_ID,
-            current_user=_current_user(),
-            app_model=app_model,
-        )
-
-    update_binding.assert_not_called()
-
-
 @pytest.mark.parametrize(
     "payload",
     [
@@ -550,83 +388,3 @@ def test_app_config_accepts_policy_id_alias_and_disabled_draft() -> None:
 
     assert str(payload.group_id) == GROUP_ID
     assert payload.access_points == ["webapp", "service_api"]
-
-
-def test_group_responses_are_enriched_with_tenant_scoped_app_metadata() -> None:
-    app_id_2 = "66666666-6666-4666-8666-666666666666"
-    payload = {
-        "group": _group_payload(app_ids=[APP_ID, app_id_2]),
-    }
-    payload["group"].pop("usedByCount")
-    app = SimpleNamespace(
-        id=APP_ID,
-        name="Customer support",
-        icon="robot",
-        icon_type=SimpleNamespace(value="emoji"),
-        icon_background="#FFFFFF",
-    )
-    db_mock = MagicMock()
-    db_mock.session.scalars.return_value.all.return_value = [app]
-
-    with patch("services.network_access_group_service.db", db_mock):
-        result = NetworkAccessGroupService.enrich_app_references(payload, TENANT_ID)
-
-    assert result["group"]["apps"] == [
-        {
-            "id": APP_ID,
-            "name": "Customer support",
-            "icon": "robot",
-            "icon_type": "emoji",
-            "icon_background": "#FFFFFF",
-        }
-    ]
-    assert result["group"]["app_ids"] == [APP_ID, app_id_2]
-    assert result["group"]["used_by_count"] == 2
-    db_mock.session.scalars.assert_called_once()
-
-
-def test_group_app_enrichment_degrades_to_ids_when_core_database_is_unavailable() -> None:
-    payload = {"group": _group_payload(app_ids=[APP_ID])}
-    db_mock = MagicMock()
-    db_mock.session.scalars.side_effect = SQLAlchemyError("database unavailable")
-
-    with patch("services.network_access_group_service.db", db_mock):
-        result = NetworkAccessGroupService.enrich_app_references(payload, TENANT_ID)
-
-    assert result["group"]["app_ids"] == [APP_ID]
-    assert result["group"]["used_by_count"] == 1
-    assert result["group"]["apps"] == []
-
-
-def test_sandbox_read_returns_not_entitled_for_upgrade_state() -> None:
-    api = CurrentWorkspaceNetworkAccessGroupsApi()
-    method = unwrap(api.get)
-    upstream_payload: dict[str, object] = {
-        "tenantId": TENANT_ID,
-        "entitled": True,
-        "groups": list[object](),
-    }
-
-    with (
-        patch.object(BillingService, "list_network_access_groups", return_value=upstream_payload),
-        patch("controllers.console.workspace.network_access_group._effective_entitlement", return_value=False),
-    ):
-        result = method(api, current_tenant_id=TENANT_ID, current_user=_current_user())
-
-    assert result["entitled"] is False
-
-
-@pytest.mark.parametrize(
-    ("upstream_entitled", "paid_plan", "expected"),
-    [(True, True, True), (False, True, False), (True, False, False)],
-)
-def test_effective_entitlement_requires_rollout_and_paid_plan(
-    upstream_entitled: bool,
-    paid_plan: bool,
-    expected: bool,
-) -> None:
-    with patch(
-        "controllers.console.workspace.network_access_group.is_cloud_edition_billing_paid_plan",
-        return_value=paid_plan,
-    ):
-        assert _effective_entitlement(TENANT_ID, upstream_entitled) is expected
diff --git a/api/tests/unit_tests/extensions/test_ext_application_services.py b/api/tests/unit_tests/extensions/test_ext_application_services.py
index df115b908bf0f7..11ce08b16344c3 100644
--- a/api/tests/unit_tests/extensions/test_ext_application_services.py
+++ b/api/tests/unit_tests/extensions/test_ext_application_services.py
@@ -34,6 +34,7 @@
 from repositories.app_tracing_config_repository import SQLAlchemyAppTracingConfigRepository
 from repositories.human_input_file_upload_repository import SQLAlchemyHumanInputFileUploadRepository
 from repositories.message_file_preview_repository import MessageFilePreviewQueryRepository
+from repositories.network_access_group_repository import SQLAlchemyNetworkAccessGroupAppRepository
 from repositories.plugin_file_upload_repository import SQLAlchemyPluginFileUploadOwnerRepository
 from repositories.sqlalchemy_api_workflow_run_repository import DifyAPISQLAlchemyWorkflowRunRepository
 from repositories.upload_file_delivery_repository import UploadFileDeliveryQueryRepository
@@ -76,6 +77,11 @@
 from services.human_input_file_upload_service import HumanInputFileUploadService
 from services.init_validation_service import InvalidInitializationPasswordError
 from services.message_file_preview_service import MessageFilePreviewService
+from services.network_access_group_gateway import (
+    BillingNetworkAccessGroupEntitlementGateway,
+    NetworkAccessGroupGateway,
+)
+from services.network_access_group_service import NetworkAccessGroupService
 from services.partner_tenant_binding_service import PartnerTenantBindingService
 from services.plugin_file_upload_gateway import ToolFilePluginUploadGateway
 from services.plugin_file_upload_service import PluginFileUploadService
@@ -479,6 +485,24 @@ def test_build_application_services_wires_billing_service(
     sync_partner_tenants_bindings.assert_called_once_with("account-1", "partner-key", "click-1")
 
 
+def test_build_application_services_wires_network_access_group_boundary(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
+    services = ext_application_services.build_application_services(
+        database_client=sqlite_session_factory,
+        deployment_edition=DeploymentEdition.CLOUD,
+        initialization_password="",
+        redis=MagicMock(spec=RedisClientWrapper),
+    )
+
+    network_access_groups = services.network_access_groups
+    assert isinstance(network_access_groups, NetworkAccessGroupService)
+    assert isinstance(network_access_groups._control_plane, NetworkAccessGroupGateway)
+    assert isinstance(network_access_groups._apps, SQLAlchemyNetworkAccessGroupAppRepository)
+    assert network_access_groups._apps._session_factory is sqlite_session_factory
+    assert isinstance(network_access_groups._entitlement, BillingNetworkAccessGroupEntitlementGateway)
+
+
 def test_build_application_services_wires_compliance_downloads(
     sqlite_session_factory: sessionmaker[Session],
 ) -> None:
diff --git a/api/tests/unit_tests/repositories/test_network_access_group_repository.py b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
new file mode 100644
index 00000000000000..49ce7a0fa7c087
--- /dev/null
+++ b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
@@ -0,0 +1,169 @@
+from unittest.mock import MagicMock
+
+import pytest
+from sqlalchemy import text
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.orm import Session, sessionmaker
+
+from models.agent import Agent, AgentScope, AgentSource, AgentStatus
+from models.model import App, AppMode, IconType
+from repositories.network_access_group_repository import SQLAlchemyNetworkAccessGroupAppRepository
+from services.network_access_group_service import NetworkAccessGroupAppQueryError, NetworkAccessGroupAppRecord
+
+_WORKSPACE_ID = "11111111-1111-1111-1111-111111111111"
+_OTHER_WORKSPACE_ID = "22222222-2222-2222-2222-222222222222"
+_APP_ID = "33333333-3333-3333-3333-333333333333"
+_OTHER_APP_ID = "44444444-4444-4444-4444-444444444444"
+_DISABLED_APP_ID = "55555555-5555-5555-5555-555555555555"
+_UNREQUESTED_APP_ID = "66666666-6666-6666-6666-666666666666"
+
+
+def _app(
+    app_id: str,
+    *,
+    workspace_id: str = _WORKSPACE_ID,
+    mode: AppMode = AppMode.WORKFLOW,
+) -> App:
+    return App(
+        id=app_id,
+        tenant_id=workspace_id,
+        name=f"App {app_id}",
+        description="",
+        mode=mode,
+        icon_type=IconType.EMOJI,
+        icon="robot",
+        icon_background="#ffffff",
+        enable_site=True,
+        enable_api=True,
+    )
+
+
+def _repository(session_factory: sessionmaker[Session]) -> SQLAlchemyNetworkAccessGroupAppRepository:
+    return SQLAlchemyNetworkAccessGroupAppRepository(session_factory=session_factory)
+
+
+def test_get_manageable_app_returns_detached_projection_and_enforces_workspace_and_status_scope(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
+    with sqlite_session_factory() as session:
+        session.add_all(
+            [
+                _app(_APP_ID),
+                _app(_OTHER_APP_ID, workspace_id=_OTHER_WORKSPACE_ID),
+                _app(_DISABLED_APP_ID),
+            ]
+        )
+        session.commit()
+        session.execute(
+            text("UPDATE apps SET status = 'disabled' WHERE id = :app_id"),
+            {"app_id": _DISABLED_APP_ID},
+        )
+        session.commit()
+
+    repository = _repository(sqlite_session_factory)
+
+    result = repository.get_manageable_app(workspace_id=_WORKSPACE_ID, app_id=_APP_ID)
+
+    assert result == NetworkAccessGroupAppRecord(
+        id=_APP_ID,
+        mode=AppMode.WORKFLOW.value,
+        name=f"App {_APP_ID}",
+        icon="robot",
+        icon_type=IconType.EMOJI.value,
+        icon_background="#ffffff",
+    )
+    assert repository.get_manageable_app(workspace_id=_OTHER_WORKSPACE_ID, app_id=_APP_ID) is None
+    assert repository.get_manageable_app(workspace_id=_WORKSPACE_ID, app_id=_OTHER_APP_ID) is None
+    assert repository.get_manageable_app(workspace_id=_WORKSPACE_ID, app_id=_DISABLED_APP_ID) is None
+    assert repository.get_manageable_app(workspace_id=_WORKSPACE_ID, app_id=_UNREQUESTED_APP_ID) is None
+
+
+def test_list_apps_returns_only_normal_apps_in_the_requested_workspace(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
+    with sqlite_session_factory() as session:
+        session.add_all(
+            [
+                _app(_APP_ID),
+                _app(_OTHER_APP_ID, workspace_id=_OTHER_WORKSPACE_ID),
+                _app(_DISABLED_APP_ID),
+                _app(_UNREQUESTED_APP_ID),
+            ]
+        )
+        session.commit()
+        session.execute(
+            text("UPDATE apps SET status = 'disabled' WHERE id = :app_id"),
+            {"app_id": _DISABLED_APP_ID},
+        )
+        session.commit()
+
+    result = _repository(sqlite_session_factory).list_apps(
+        workspace_id=_WORKSPACE_ID,
+        app_ids=[_APP_ID, _OTHER_APP_ID, _DISABLED_APP_ID],
+    )
+
+    assert result == (
+        NetworkAccessGroupAppRecord(
+            id=_APP_ID,
+            mode=AppMode.WORKFLOW.value,
+            name=f"App {_APP_ID}",
+            icon="robot",
+            icon_type=IconType.EMOJI.value,
+            icon_background="#ffffff",
+        ),
+    )
+
+
+@pytest.mark.parametrize(
+    ("scope", "source", "status", "expected_visible"),
+    [
+        (AgentScope.WORKFLOW_ONLY, AgentSource.WORKFLOW, AgentStatus.ACTIVE, False),
+        (AgentScope.WORKFLOW_ONLY, AgentSource.WORKFLOW, AgentStatus.ARCHIVED, False),
+        (AgentScope.ROSTER, AgentSource.AGENT_APP, AgentStatus.ACTIVE, True),
+    ],
+)
+def test_get_manageable_app_applies_agent_scope_and_lifecycle_visibility(
+    sqlite_session_factory: sessionmaker[Session],
+    scope: AgentScope,
+    source: AgentSource,
+    status: AgentStatus,
+    expected_visible: bool,
+) -> None:
+    app = _app(_APP_ID, mode=AppMode.AGENT)
+    with sqlite_session_factory() as session:
+        session.add_all(
+            [
+                app,
+                Agent(
+                    id="77777777-7777-7777-7777-777777777777",
+                    tenant_id=_WORKSPACE_ID,
+                    name="Bound agent",
+                    description="",
+                    role="",
+                    scope=scope,
+                    source=source,
+                    status=status,
+                    app_id=app.id if scope == AgentScope.ROSTER else "88888888-8888-8888-8888-888888888888",
+                    backing_app_id=app.id if scope == AgentScope.WORKFLOW_ONLY else None,
+                    workflow_id=("99999999-9999-9999-9999-999999999999" if scope == AgentScope.WORKFLOW_ONLY else None),
+                    workflow_node_id="agent-node" if scope == AgentScope.WORKFLOW_ONLY else None,
+                ),
+            ]
+        )
+        session.commit()
+
+    result = _repository(sqlite_session_factory).get_manageable_app(
+        workspace_id=_WORKSPACE_ID,
+        app_id=_APP_ID,
+    )
+
+    assert (result is not None) is expected_visible
+
+
+def test_list_apps_maps_database_failures_to_query_error() -> None:
+    session_factory = MagicMock()
+    session = session_factory.return_value.__enter__.return_value
+    session.scalars.side_effect = SQLAlchemyError("database unavailable")
+
+    with pytest.raises(NetworkAccessGroupAppQueryError):
+        _repository(session_factory).list_apps(workspace_id=_WORKSPACE_ID, app_ids=[_APP_ID])
diff --git a/api/tests/unit_tests/repositories/test_workspace_query_repository.py b/api/tests/unit_tests/repositories/test_workspace_query_repository.py
new file mode 100644
index 00000000000000..6ab368049af678
--- /dev/null
+++ b/api/tests/unit_tests/repositories/test_workspace_query_repository.py
@@ -0,0 +1,58 @@
+from sqlalchemy.orm import Session, sessionmaker
+
+from models.account import Account, Tenant, TenantAccountJoin, TenantAccountRole
+from repositories.workspace_query_repository import WorkspaceQueryRepository
+
+_WORKSPACE_ID = "11111111-1111-1111-1111-111111111111"
+_OTHER_WORKSPACE_ID = "22222222-2222-2222-2222-222222222222"
+_OWNER_ID = "33333333-3333-3333-3333-333333333333"
+_ADMIN_ID = "44444444-4444-4444-4444-444444444444"
+_OTHER_WORKSPACE_ACCOUNT_ID = "55555555-5555-5555-5555-555555555555"
+
+
+def _account(account_id: str) -> Account:
+    account = Account(name=f"Account {account_id}", email=f"{account_id}@example.com")
+    account.id = account_id
+    return account
+
+
+def test_get_role_for_account_is_scoped_by_workspace_and_account(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
+    workspace = Tenant(name="Workspace")
+    workspace.id = _WORKSPACE_ID
+    other_workspace = Tenant(name="Other workspace")
+    other_workspace.id = _OTHER_WORKSPACE_ID
+    with sqlite_session_factory() as session:
+        session.add_all(
+            [
+                workspace,
+                other_workspace,
+                _account(_OWNER_ID),
+                _account(_ADMIN_ID),
+                _account(_OTHER_WORKSPACE_ACCOUNT_ID),
+                TenantAccountJoin(
+                    tenant_id=_WORKSPACE_ID,
+                    account_id=_OWNER_ID,
+                    role=TenantAccountRole.OWNER,
+                ),
+                TenantAccountJoin(
+                    tenant_id=_WORKSPACE_ID,
+                    account_id=_ADMIN_ID,
+                    role=TenantAccountRole.ADMIN,
+                ),
+                TenantAccountJoin(
+                    tenant_id=_OTHER_WORKSPACE_ID,
+                    account_id=_OTHER_WORKSPACE_ACCOUNT_ID,
+                    role=TenantAccountRole.OWNER,
+                ),
+            ]
+        )
+        session.commit()
+
+    repository = WorkspaceQueryRepository(sqlite_session_factory)
+
+    assert repository.get_role_for_account(workspace_id=_WORKSPACE_ID, account_id=_OWNER_ID) == "owner"
+    assert repository.get_role_for_account(workspace_id=_WORKSPACE_ID, account_id=_ADMIN_ID) == "admin"
+    assert repository.get_role_for_account(workspace_id=_WORKSPACE_ID, account_id="missing-account") is None
+    assert repository.get_role_for_account(workspace_id=_WORKSPACE_ID, account_id=_OTHER_WORKSPACE_ACCOUNT_ID) is None
diff --git a/api/tests/unit_tests/services/test_network_access_group_billing_service.py b/api/tests/unit_tests/services/test_network_access_group_gateway.py
similarity index 54%
rename from api/tests/unit_tests/services/test_network_access_group_billing_service.py
rename to api/tests/unit_tests/services/test_network_access_group_gateway.py
index c034f21904df60..9036672893812c 100644
--- a/api/tests/unit_tests/services/test_network_access_group_billing_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_gateway.py
@@ -1,10 +1,18 @@
-from collections.abc import Callable, Iterator
 from unittest.mock import MagicMock, call, patch
 
 import httpx
 import pytest
 
-from services.billing_service import BillingService, NetworkAccessGroupUpstreamError
+from enums import CloudPlan
+from services.billing_service import _BillingHTTPStatusError
+from services.network_access_group_gateway import (
+    BillingNetworkAccessGroupEntitlementGateway,
+    NetworkAccessGroupGateway,
+)
+from services.network_access_group_service import (
+    NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupUpstreamError,
+)
 
 TENANT_ID = "11111111-1111-4111-8111-111111111111"
 ACCOUNT_ID = "22222222-2222-4222-8222-222222222222"
@@ -13,30 +21,30 @@
 HEADERS = {"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"}
 
 
-@pytest.fixture
-def billing_config(config_overrides: Callable[..., None]) -> Iterator[None]:
-    config_overrides(NETWORK_ACCESS_API_URL="")
-    with (
-        patch.object(BillingService, "base_url", "https://billing.internal/v1"),
-        patch.object(BillingService, "secret_key", "test-secret"),
-    ):
-        yield
+def _gateway(*, base_url: str = "https://network-access.internal/v1/") -> tuple[NetworkAccessGroupGateway, MagicMock]:
+    http_client = MagicMock(spec=httpx.Client)
+    return (
+        NetworkAccessGroupGateway(
+            base_url=base_url,
+            fallback_base_url="https://billing.internal/v1",
+            secret_key="test-secret",
+            http_client=http_client,
+        ),
+        http_client,
+    )
 
 
-@pytest.mark.usefixtures("billing_config")
-def test_network_access_requests_use_independent_api_url_when_configured(
-    config_overrides: Callable[..., None],
-) -> None:
+def test_network_access_requests_use_independent_api_url_when_configured() -> None:
+    gateway, http_client = _gateway()
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
+    http_client.request.return_value = response
 
-    config_overrides(NETWORK_ACCESS_API_URL="https://saas.internal/v1/")
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
+    gateway.list_groups(TENANT_ID, ACCOUNT_ID)
 
-    request.assert_called_once_with(
+    http_client.request.assert_called_once_with(
         "GET",
-        f"https://saas.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+        f"https://network-access.internal/v1/tenants/{TENANT_ID}/network-access-groups",
         json=None,
         params={"actor_account_id": ACCOUNT_ID},
         headers=HEADERS,
@@ -44,15 +52,15 @@ def test_network_access_requests_use_independent_api_url_when_configured(
     )
 
 
-@pytest.mark.usefixtures("billing_config")
-def test_network_access_requests_fall_back_to_billing_api_url_at_request_time() -> None:
+def test_network_access_requests_fall_back_to_billing_api_url() -> None:
+    gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
+    http_client.request.return_value = response
 
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
+    gateway.list_groups(TENANT_ID, ACCOUNT_ID)
 
-    request.assert_called_once_with(
+    http_client.request.assert_called_once_with(
         "GET",
         f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
         json=None,
@@ -62,40 +70,21 @@ def test_network_access_requests_fall_back_to_billing_api_url_at_request_time()
     )
 
 
-@pytest.mark.usefixtures("billing_config")
-def test_subscription_requests_keep_using_billing_api_url(config_overrides: Callable[..., None]) -> None:
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {"subscription": {"plan": "professional"}}
-
-    config_overrides(NETWORK_ACCESS_API_URL="https://saas.internal/v1")
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        BillingService._send_request("GET", "/subscription/info", params={"tenant_id": TENANT_ID})
-
-    request.assert_called_once_with(
-        "GET",
-        "https://billing.internal/v1/subscription/info",
-        json=None,
-        params={"tenant_id": TENANT_ID},
-        headers=HEADERS,
-        follow_redirects=True,
-    )
-
-
-@pytest.mark.usefixtures("billing_config")
 def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
+    gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()},
         {"group": {"id": GROUP_ID}},
     ]
+    http_client.request.return_value = response
 
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        list_result = BillingService.list_network_access_groups(TENANT_ID, ACCOUNT_ID)
-        item_result = BillingService.get_network_access_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
+    list_result = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
+    item_result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
     assert list_result["groups"] == []
     assert item_result["group"]["id"] == GROUP_ID
-    assert request.call_args_list == [
+    assert http_client.request.call_args_list == [
         call(
             "GET",
             f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
@@ -115,40 +104,40 @@ def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
     ]
 
 
-@pytest.mark.usefixtures("billing_config")
 def test_group_mutations_inject_actor_and_use_expected_version() -> None:
+    gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"group": {"id": GROUP_ID, "version": "1"}},
         {"group": {"id": GROUP_ID, "version": "2"}},
         {"deleted": True},
     ]
+    http_client.request.return_value = response
+
+    gateway.create_group(
+        TENANT_ID,
+        name="Office",
+        description="Office egress",
+        allowed_cidrs=["203.0.113.7/32"],
+        actor_account_id=ACCOUNT_ID,
+    )
+    gateway.update_group(
+        TENANT_ID,
+        GROUP_ID,
+        name="Office",
+        description="Updated office egress",
+        allowed_cidrs=["203.0.113.0/24"],
+        expected_version=1,
+        actor_account_id=ACCOUNT_ID,
+    )
+    gateway.delete_group(
+        TENANT_ID,
+        GROUP_ID,
+        expected_version=2,
+        actor_account_id=ACCOUNT_ID,
+    )
 
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        BillingService.create_network_access_group(
-            TENANT_ID,
-            name="Office",
-            description="Office egress",
-            allowed_cidrs=["203.0.113.7/32"],
-            actor_account_id=ACCOUNT_ID,
-        )
-        BillingService.update_network_access_group(
-            TENANT_ID,
-            GROUP_ID,
-            name="Office",
-            description="Updated office egress",
-            allowed_cidrs=["203.0.113.0/24"],
-            expected_version=1,
-            actor_account_id=ACCOUNT_ID,
-        )
-        BillingService.delete_network_access_group(
-            TENANT_ID,
-            GROUP_ID,
-            expected_version=2,
-            actor_account_id=ACCOUNT_ID,
-        )
-
-    assert request.call_args_list == [
+    assert http_client.request.call_args_list == [
         call(
             "POST",
             f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
@@ -187,8 +176,8 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
     ]
 
 
-@pytest.mark.usefixtures("billing_config")
 def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
+    gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
@@ -211,30 +200,30 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
             }
         },
     ]
-
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        BillingService.get_app_network_access_group(TENANT_ID, APP_ID, ACCOUNT_ID)
-        BillingService.update_app_network_access_group(
-            TENANT_ID,
-            APP_ID,
-            enabled=True,
-            group_id=GROUP_ID,
-            access_points=["webapp", "service_api"],
-            expected_version=0,
-            actor_account_id=ACCOUNT_ID,
-        )
-        BillingService.update_app_network_access_group(
-            TENANT_ID,
-            APP_ID,
-            enabled=False,
-            group_id=GROUP_ID,
-            access_points=["webapp", "service_api"],
-            expected_version=1,
-            actor_account_id=ACCOUNT_ID,
-        )
+    http_client.request.return_value = response
+
+    gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+    gateway.update_app_binding(
+        TENANT_ID,
+        APP_ID,
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
+        expected_version=0,
+        actor_account_id=ACCOUNT_ID,
+    )
+    gateway.update_app_binding(
+        TENANT_ID,
+        APP_ID,
+        enabled=False,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
+        expected_version=1,
+        actor_account_id=ACCOUNT_ID,
+    )
 
     endpoint = f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group"
-    assert request.call_args_list == [
+    assert http_client.request.call_args_list == [
         call(
             "GET",
             endpoint,
@@ -274,16 +263,16 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
     ]
 
 
-@pytest.mark.usefixtures("billing_config")
 def test_app_lifecycle_cleanup_uses_internal_secret_endpoint() -> None:
+    gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"deleted": True}
+    http_client.request.return_value = response
 
-    with patch("services.billing_service._http_client.request", return_value=response) as request:
-        result = BillingService.cleanup_app_network_access_group_binding(TENANT_ID, APP_ID)
+    result = gateway.cleanup_app_binding(TENANT_ID, APP_ID)
 
     assert result == {"deleted": True}
-    request.assert_called_once_with(
+    http_client.request.assert_called_once_with(
         "DELETE",
         f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group-binding",
         json=None,
@@ -295,51 +284,112 @@ def test_app_lifecycle_cleanup_uses_internal_secret_endpoint() -> None:
 
 @pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500, 503])
 def test_network_access_group_request_preserves_upstream_status(status_code: int) -> None:
+    gateway, _ = _gateway()
     response = MagicMock(status_code=status_code)
     with (
-        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
     ):
-        BillingService._send_network_access_group_request("GET", "/groups")
+        gateway._send_request("GET", "/groups")
 
     assert exc_info.value.status_code == status_code
 
 
-def test_network_access_group_request_preserves_whitelisted_upstream_reason() -> None:
+def test_network_access_group_request_preserves_upstream_reason() -> None:
+    gateway, _ = _gateway()
     response = MagicMock(status_code=httpx.codes.CONFLICT)
     response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_VERSION_CONFLICT", "message": "internal"}
     with (
-        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
     ):
-        BillingService._send_network_access_group_request("DELETE", "/groups/id")
+        gateway._send_request("DELETE", "/groups/id")
 
     assert exc_info.value.status_code == httpx.codes.CONFLICT
     assert exc_info.value.reason == "NETWORK_ACCESS_VERSION_CONFLICT"
 
 
 def test_network_access_group_request_maps_transport_failure_to_service_unavailable() -> None:
-    request = httpx.Request("GET", "https://billing.internal/v1/groups")
+    gateway, _ = _gateway()
+    request = httpx.Request("GET", "https://network-access.internal/v1/groups")
     with (
         patch.object(
-            BillingService,
-            "_send_network_access_group_http_request",
+            gateway,
+            "_send_http_request",
             side_effect=httpx.ConnectError("unavailable", request=request),
         ),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
     ):
-        BillingService._send_network_access_group_request("GET", "/groups")
+        gateway._send_request("GET", "/groups")
 
     assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
 
 
 def test_network_access_group_request_rejects_non_object_response() -> None:
+    gateway, _ = _gateway()
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = list[object]()
     with (
-        patch.object(BillingService, "_send_network_access_group_http_request", return_value=response),
+        patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
     ):
-        BillingService._send_network_access_group_request("GET", "/groups")
+        gateway._send_request("GET", "/groups")
 
     assert exc_info.value.status_code == httpx.codes.BAD_GATEWAY
+
+
+@pytest.mark.parametrize("plan", [CloudPlan.PROFESSIONAL, CloudPlan.TEAM])
+def test_billing_entitlement_gateway_accepts_paid_plans(plan: CloudPlan) -> None:
+    gateway = BillingNetworkAccessGroupEntitlementGateway()
+    with patch(
+        "services.network_access_group_gateway.BillingService.get_info",
+        return_value={"subscription": {"plan": plan}},
+    ) as get_info:
+        assert gateway.is_paid_plan(TENANT_ID) is True
+
+    get_info.assert_called_once_with(TENANT_ID, exclude_vector_space=True)
+
+
+def test_billing_entitlement_gateway_rejects_unpaid_plan() -> None:
+    gateway = BillingNetworkAccessGroupEntitlementGateway()
+    with patch(
+        "services.network_access_group_gateway.BillingService.get_info",
+        return_value={"subscription": {"plan": CloudPlan.SANDBOX}},
+    ):
+        assert gateway.is_paid_plan(TENANT_ID) is False
+
+
+def test_billing_entitlement_gateway_maps_unavailable_billing_service() -> None:
+    gateway = BillingNetworkAccessGroupEntitlementGateway()
+    with (
+        patch(
+            "services.network_access_group_gateway.BillingService.get_info",
+            side_effect=httpx.ConnectError("unavailable"),
+        ),
+        pytest.raises(NetworkAccessGroupEntitlementUnavailableError),
+    ):
+        gateway.is_paid_plan(TENANT_ID)
+
+
+def test_billing_entitlement_gateway_maps_billing_http_status_error() -> None:
+    gateway = BillingNetworkAccessGroupEntitlementGateway()
+    with (
+        patch(
+            "services.network_access_group_gateway.BillingService.get_info",
+            side_effect=_BillingHTTPStatusError("unavailable", 503),
+        ),
+        pytest.raises(NetworkAccessGroupEntitlementUnavailableError),
+    ):
+        gateway.is_paid_plan(TENANT_ID)
+
+
+def test_billing_entitlement_gateway_does_not_mask_unexpected_value_error() -> None:
+    gateway = BillingNetworkAccessGroupEntitlementGateway()
+    with (
+        patch(
+            "services.network_access_group_gateway.BillingService.get_info",
+            side_effect=ValueError("programming error"),
+        ),
+        pytest.raises(ValueError, match="programming error"),
+    ):
+        gateway.is_paid_plan(TENANT_ID)
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
new file mode 100644
index 00000000000000..2e4a948cd1a7c7
--- /dev/null
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -0,0 +1,444 @@
+from collections.abc import Callable
+from typing import NamedTuple
+from unittest.mock import MagicMock, create_autospec
+
+import pytest
+
+from machinery.context import RequestContext
+from services.network_access_group_service import (
+    NetworkAccessGroupAccessDeniedError,
+    NetworkAccessGroupAppNotFoundError,
+    NetworkAccessGroupAppQuery,
+    NetworkAccessGroupAppQueryError,
+    NetworkAccessGroupAppRecord,
+    NetworkAccessGroupControlPlane,
+    NetworkAccessGroupEntitlement,
+    NetworkAccessGroupService,
+    NetworkAccessGroupUnsupportedAccessPointsError,
+    NetworkAccessGroupUnsupportedAppModeError,
+    WorkspaceMembershipRoleQuery,
+)
+
+WORKSPACE_ID = "workspace-1"
+ACCOUNT_ID = "account-1"
+APP_ID = "app-1"
+GROUP_ID = "group-1"
+
+
+class _Harness(NamedTuple):
+    service: NetworkAccessGroupService
+    control_plane: MagicMock
+    apps: MagicMock
+    memberships: MagicMock
+    entitlement: MagicMock
+
+
+def _context() -> RequestContext:
+    return RequestContext(
+        request_id="request-1",
+        trace_id=None,
+        account_id=ACCOUNT_ID,
+        active_workspace_id=WORKSPACE_ID,
+    )
+
+
+def _app(*, app_id: str = APP_ID, mode: str = "workflow", name: str = "App") -> NetworkAccessGroupAppRecord:
+    return NetworkAccessGroupAppRecord(
+        id=app_id,
+        mode=mode,
+        name=name,
+        icon=f"{app_id}.png",
+        icon_type="image",
+        icon_background="#FFFFFF",
+    )
+
+
+def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "workflow") -> _Harness:
+    control_plane = create_autospec(NetworkAccessGroupControlPlane, instance=True, spec_set=True)
+    apps = create_autospec(NetworkAccessGroupAppQuery, instance=True, spec_set=True)
+    memberships = create_autospec(WorkspaceMembershipRoleQuery, instance=True, spec_set=True)
+    entitlement = create_autospec(NetworkAccessGroupEntitlement, instance=True, spec_set=True)
+    memberships.get_role_for_account.return_value = role
+    entitlement.is_paid_plan.return_value = paid
+    apps.get_manageable_app.return_value = _app(mode=app_mode)
+    return _Harness(
+        service=NetworkAccessGroupService(
+            control_plane=control_plane,
+            apps=apps,
+            memberships=memberships,
+            entitlement=entitlement,
+        ),
+        control_plane=control_plane,
+        apps=apps,
+        memberships=memberships,
+        entitlement=entitlement,
+    )
+
+
+@pytest.mark.parametrize("role", ["normal", None])
+def test_reads_reject_non_privileged_persisted_roles_before_control_plane(role: str | None) -> None:
+    harness = _harness(role=role)
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        harness.service.list_groups(_context())
+
+    harness.memberships.get_role_for_account.assert_called_once_with(
+        workspace_id=WORKSPACE_ID,
+        account_id=ACCOUNT_ID,
+    )
+    assert harness.control_plane.method_calls == []
+
+
+Mutation = Callable[[NetworkAccessGroupService, RequestContext], object]
+
+
+@pytest.mark.parametrize(
+    "mutation",
+    [
+        pytest.param(
+            lambda service, context: service.create_group(
+                context,
+                name="Office",
+                description="Office network",
+                allowed_cidrs=["203.0.113.0/24"],
+            ),
+            id="create-group",
+        ),
+        pytest.param(
+            lambda service, context: service.update_group(
+                context,
+                group_id=GROUP_ID,
+                name="Office",
+                description="Office network",
+                allowed_cidrs=["203.0.113.0/24"],
+                expected_version=1,
+            ),
+            id="update-group",
+        ),
+        pytest.param(
+            lambda service, context: service.delete_group(
+                context,
+                group_id=GROUP_ID,
+                expected_version=1,
+            ),
+            id="delete-group",
+        ),
+        pytest.param(
+            lambda service, context: service.update_app_binding(
+                context,
+                app_id=APP_ID,
+                enabled=True,
+                group_id=GROUP_ID,
+                access_points=["webapp"],
+                expected_version=1,
+            ),
+            id="update-app-binding",
+        ),
+    ],
+)
+@pytest.mark.parametrize("role", ["normal", None])
+def test_mutations_reject_non_privileged_persisted_roles_before_control_plane(
+    role: str | None,
+    mutation: Mutation,
+) -> None:
+    harness = _harness(role=role)
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        mutation(harness.service, _context())
+
+    harness.memberships.get_role_for_account.assert_called_once_with(
+        workspace_id=WORKSPACE_ID,
+        account_id=ACCOUNT_ID,
+    )
+    assert harness.control_plane.method_calls == []
+
+
+@pytest.mark.parametrize("role", ["owner", "admin"])
+def test_reads_allow_persisted_owner_and_admin(role: str) -> None:
+    harness = _harness(role=role)
+    harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
+
+    harness.service.list_groups(_context())
+
+    harness.control_plane.list_groups.assert_called_once_with(WORKSPACE_ID, ACCOUNT_ID)
+
+
+def test_mutation_does_not_repeat_http_paid_plan_admission() -> None:
+    harness = _harness()
+    harness.control_plane.create_group.return_value = {"group": {"id": GROUP_ID}}
+
+    harness.service.create_group(
+        _context(),
+        name="Office",
+        description="Office network",
+        allowed_cidrs=["203.0.113.0/24"],
+    )
+
+    harness.entitlement.is_paid_plan.assert_not_called()
+
+
+def test_public_use_cases_forward_workspace_actor_and_request_parameters() -> None:
+    harness = _harness()
+    harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
+    harness.control_plane.create_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.update_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.delete_group.return_value = {"deleted": True}
+    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
+    harness.control_plane.update_app_binding.return_value = dict[str, object](binding=None)
+    context = _context()
+
+    harness.service.list_groups(context)
+    harness.service.create_group(
+        context,
+        name="Office",
+        description="Office network",
+        allowed_cidrs=["203.0.113.0/24"],
+    )
+    harness.service.get_group(context, group_id=GROUP_ID)
+    harness.service.update_group(
+        context,
+        group_id=GROUP_ID,
+        name="Office v2",
+        description="Updated network",
+        allowed_cidrs=["203.0.113.7/32"],
+        expected_version=2,
+    )
+    harness.service.delete_group(context, group_id=GROUP_ID, expected_version=3)
+    harness.service.get_app_binding(context, app_id=APP_ID)
+    harness.service.update_app_binding(
+        context,
+        app_id=APP_ID,
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
+        expected_version=4,
+    )
+
+    harness.control_plane.list_groups.assert_called_once_with(WORKSPACE_ID, ACCOUNT_ID)
+    harness.control_plane.create_group.assert_called_once_with(
+        WORKSPACE_ID,
+        name="Office",
+        description="Office network",
+        allowed_cidrs=["203.0.113.0/24"],
+        actor_account_id=ACCOUNT_ID,
+    )
+    harness.control_plane.get_group.assert_called_once_with(WORKSPACE_ID, GROUP_ID, ACCOUNT_ID)
+    harness.control_plane.update_group.assert_called_once_with(
+        WORKSPACE_ID,
+        GROUP_ID,
+        name="Office v2",
+        description="Updated network",
+        allowed_cidrs=["203.0.113.7/32"],
+        expected_version=2,
+        actor_account_id=ACCOUNT_ID,
+    )
+    harness.control_plane.delete_group.assert_called_once_with(
+        WORKSPACE_ID,
+        GROUP_ID,
+        expected_version=3,
+        actor_account_id=ACCOUNT_ID,
+    )
+    harness.control_plane.get_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.update_app_binding.assert_called_once_with(
+        WORKSPACE_ID,
+        APP_ID,
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp", "service_api"],
+        expected_version=4,
+        actor_account_id=ACCOUNT_ID,
+    )
+
+
+def test_cleanup_app_binding_forwards_without_console_admission() -> None:
+    harness = _harness()
+    harness.control_plane.cleanup_app_binding.return_value = {"deleted": True}
+
+    result = harness.service.cleanup_app_binding(workspace_id=WORKSPACE_ID, app_id=APP_ID)
+
+    assert result == {"deleted": True}
+    harness.control_plane.cleanup_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID)
+    harness.memberships.get_role_for_account.assert_not_called()
+    harness.entitlement.is_paid_plan.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("upstream_entitled", "paid", "expected"),
+    [
+        (False, False, False),
+        (False, True, False),
+        (True, False, False),
+        (True, True, True),
+    ],
+)
+def test_list_effective_entitlement_requires_both_sources(
+    upstream_entitled: bool,
+    paid: bool,
+    expected: bool,
+) -> None:
+    harness = _harness(paid=paid)
+    harness.control_plane.list_groups.return_value = {
+        "entitled": upstream_entitled,
+        "groups": list[object](),
+    }
+
+    result = harness.service.list_groups(_context())
+
+    assert result["entitled"] is expected
+
+
+@pytest.mark.parametrize(
+    ("mode", "available_access_points"),
+    [
+        ("workflow", ["webapp", "service_api", "mcp", "trigger"]),
+        ("advanced-chat", ["webapp", "service_api", "mcp"]),
+        ("chat", ["webapp", "service_api", "mcp"]),
+        ("completion", ["webapp", "service_api", "mcp"]),
+        ("agent-chat", ["webapp", "service_api", "mcp"]),
+        ("agent", ["webapp", "service_api"]),
+    ],
+)
+def test_app_binding_reports_access_points_for_each_supported_mode(
+    mode: str,
+    available_access_points: list[str],
+) -> None:
+    harness = _harness(app_mode=mode)
+    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
+
+    result = harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    assert result["available_access_points"] == available_access_points
+
+
+def test_app_binding_rejects_unsupported_app_mode_before_control_plane() -> None:
+    harness = _harness(app_mode="site")
+
+    with pytest.raises(NetworkAccessGroupUnsupportedAppModeError, match="'site'"):
+        harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_app_binding_rejects_missing_or_inaccessible_app_before_control_plane() -> None:
+    harness = _harness()
+    harness.apps.get_manageable_app.return_value = None
+
+    with pytest.raises(NetworkAccessGroupAppNotFoundError):
+        harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
+    harness.memberships.get_role_for_account.assert_not_called()
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_update_app_binding_rejects_missing_or_inaccessible_app_before_control_plane() -> None:
+    harness = _harness()
+    harness.apps.get_manageable_app.return_value = None
+
+    with pytest.raises(NetworkAccessGroupAppNotFoundError):
+        harness.service.update_app_binding(
+            _context(),
+            app_id=APP_ID,
+            enabled=True,
+            group_id=GROUP_ID,
+            access_points=["webapp"],
+            expected_version=1,
+        )
+
+    harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
+    harness.memberships.get_role_for_account.assert_not_called()
+    harness.control_plane.update_app_binding.assert_not_called()
+
+
+def test_update_app_binding_rejects_access_points_not_supported_by_mode() -> None:
+    harness = _harness(app_mode="agent")
+
+    with pytest.raises(NetworkAccessGroupUnsupportedAccessPointsError) as exc_info:
+        harness.service.update_app_binding(
+            _context(),
+            app_id=APP_ID,
+            enabled=True,
+            group_id=GROUP_ID,
+            access_points=["trigger", "mcp"],
+            expected_version=1,
+        )
+
+    assert exc_info.value.access_points == ("mcp", "trigger")
+    harness.control_plane.update_app_binding.assert_not_called()
+
+
+def test_app_binding_materializes_protojson_defaults() -> None:
+    harness = _harness(app_mode="chat")
+    harness.control_plane.get_app_binding.return_value = {
+        "entitled": True,
+        "binding": dict[str, object](),
+    }
+
+    result = harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    assert result["binding"] == {"enabled": False, "access_points": []}
+
+
+def test_app_binding_normalizes_camel_case_and_filters_stale_access_points() -> None:
+    harness = _harness(app_mode="chat")
+    harness.control_plane.get_app_binding.return_value = {
+        "entitled": True,
+        "binding": {"enabled": True, "accessPoints": ["webapp", "trigger", "mcp"]},
+    }
+
+    result = harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    assert result["binding"] == {"enabled": True, "access_points": ["webapp", "mcp"]}
+
+
+def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
+    harness = _harness()
+    harness.control_plane.list_groups.return_value = {
+        "entitled": True,
+        "groups": [
+            {
+                "id": "group-1",
+                "usedByAppIds": ["app-2", "missing-app", "app-1"],
+                "usedByCount": "3",
+            },
+            {"id": "group-2", "app_ids": ["app-1"]},
+        ],
+    }
+    harness.apps.list_apps.return_value = [
+        _app(app_id="app-1", name="One"),
+        _app(app_id="app-2", name="Two"),
+    ]
+
+    result = harness.service.list_groups(_context())
+
+    groups = result["groups"]
+    assert groups[0]["app_ids"] == ["app-2", "missing-app", "app-1"]
+    assert groups[0]["used_by_count"] == "3"
+    assert [app["id"] for app in groups[0]["apps"]] == ["app-2", "app-1"]
+    assert groups[1]["used_by_count"] == 1
+    assert groups[1]["apps"] == [
+        {
+            "id": "app-1",
+            "name": "One",
+            "icon": "app-1.png",
+            "icon_type": "image",
+            "icon_background": "#FFFFFF",
+        }
+    ]
+    call_kwargs = harness.apps.list_apps.call_args.kwargs
+    assert call_kwargs["workspace_id"] == WORKSPACE_ID
+    assert set(call_kwargs["app_ids"]) == {"app-1", "app-2", "missing-app"}
+
+
+def test_app_query_failure_degrades_group_enrichment_to_empty_apps() -> None:
+    harness = _harness()
+    harness.control_plane.get_group.return_value = {
+        "group": {"id": GROUP_ID, "used_by_app_ids": [APP_ID], "used_by_count": 1}
+    }
+    harness.apps.list_apps.side_effect = NetworkAccessGroupAppQueryError
+
+    result = harness.service.get_group(_context(), group_id=GROUP_ID)
+
+    assert result["group"]["app_ids"] == [APP_ID]
+    assert result["group"]["apps"] == []
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index e489c0598c5292..30e6568407ee9b 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -1,5 +1,6 @@
 import logging
 from datetime import UTC, datetime
+from types import SimpleNamespace
 from unittest.mock import MagicMock, call, patch
 from uuid import uuid4
 
@@ -14,7 +15,7 @@
 from models.agent import WorkflowAgentBindingType, WorkflowAgentNodeBinding
 from models.enums import CreatorUserRole, WorkflowRunTriggeredFrom
 from models.workflow import WorkflowArchiveLog
-from services.billing_service import NetworkAccessGroupUpstreamError
+from services.network_access_group_service import NetworkAccessGroupUpstreamError
 from tasks.remove_app_and_related_data_task import (
     _delete_app_stars,
     _delete_app_workflow_archive_logs,
@@ -152,17 +153,20 @@ def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: py
 
 
 def test_independent_binding_cleanup_task_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
-    cleanup = MagicMock(return_value={"deleted": True})
+    service = MagicMock()
+    service.cleanup_app_binding.return_value = {"deleted": True}
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(
-        remove_app_task_module.BillingService,
-        "cleanup_app_network_access_group_binding",
-        cleanup,
-    )
 
-    remove_app_task_module.cleanup_app_network_access_group_binding_task.run(tenant_id="tenant-1", app_id="app-1")
+    with patch(
+        "extensions.ext_application_services.application_services",
+        return_value=SimpleNamespace(network_access_groups=service),
+    ):
+        remove_app_task_module.cleanup_app_network_access_group_binding_task.run(
+            tenant_id="tenant-1",
+            app_id="app-1",
+        )
 
-    cleanup.assert_called_once_with("tenant-1", "app-1")
+    service.cleanup_app_binding.assert_called_once_with(workspace_id="tenant-1", app_id="app-1")
     assert remove_app_task_module.cleanup_app_network_access_group_binding_task.max_retries == 24
 
 
@@ -172,16 +176,22 @@ def test_independent_binding_cleanup_task_retries_with_exponential_backoff(
     upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_APP_STILL_EXISTS")
     retry_error = RuntimeError("retry scheduled")
     retry = MagicMock(side_effect=retry_error)
+    service = MagicMock()
+    service.cleanup_app_binding.side_effect = upstream_error
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(
-        remove_app_task_module.BillingService,
-        "cleanup_app_network_access_group_binding",
-        MagicMock(side_effect=upstream_error),
-    )
     monkeypatch.setattr(remove_app_task_module.cleanup_app_network_access_group_binding_task, "retry", retry)
 
-    with pytest.raises(RuntimeError, match="retry scheduled"):
-        remove_app_task_module.cleanup_app_network_access_group_binding_task.run(tenant_id="tenant-1", app_id="app-1")
+    with (
+        patch(
+            "extensions.ext_application_services.application_services",
+            return_value=SimpleNamespace(network_access_groups=service),
+        ),
+        pytest.raises(RuntimeError, match="retry scheduled"),
+    ):
+        remove_app_task_module.cleanup_app_network_access_group_binding_task.run(
+            tenant_id="tenant-1",
+            app_id="app-1",
+        )
 
     retry.assert_called_once_with(exc=upstream_error, countdown=15)
     assert remove_app_task_module._network_access_binding_cleanup_retry_delay(5) == 480

From f6a7e64dbdc38476ca5b0c9789c791c3877ff653 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 10 Sep 2026 17:33:59 +0800
Subject: [PATCH 021/108] feat(web): persist Access Control through network
 access groups

Keep Studio Access Control as a draft until Save, including the master
switch. Show referenced apps when editing or deleting an IP policy, and
bind workspace policies to apps through the console network access APIs.
---
 .../app/access-point/__tests__/index.spec.tsx |   2 +
 .../__tests__/chip-status.spec.ts             |  24 +-
 .../__tests__/config-panel.spec.tsx           |   8 +-
 .../access-control/__tests__/draft.spec.ts    |  29 ++-
 .../access-control/__tests__/index.spec.tsx   | 141 +++++++++--
 .../__tests__/network-access.spec.ts          | 106 ++++++++
 .../access-control/chip-status.ts             |   9 +-
 .../access-control/config-panel.tsx           |  12 +-
 .../app/access-point/access-control/draft.ts  |  80 ++----
 .../app/access-point/access-control/index.tsx | 230 ++++++++++++++----
 .../access-control/network-access.ts          | 109 +++++++++
 .../access-control/policy-field.tsx           |  13 +-
 .../access-control/status-panel.tsx           |  48 +++-
 .../account-setting/__tests__/index.spec.tsx  |  21 +-
 .../header/account-setting/index.tsx          |  10 +-
 .../ip-policies-page/__tests__/index.spec.tsx | 133 +++++++++-
 .../__tests__/policy-dialog.spec.tsx          |   4 +-
 .../__tests__/validate-ip-entry.spec.ts       |  42 +++-
 .../ip-policies-page/index.tsx                | 160 +++++++++++-
 .../ip-policies-page/policy-dialog.tsx        |  37 ++-
 .../ip-policies-page/policy-item.tsx          | 153 ++++++++++++
 .../ip-policies-page/referenced-apps.tsx      |  56 +++++
 .../ip-policies-page/validate-ip-entry.ts     |  68 +++++-
 web/i18n/ar-TN/common.json                    |   8 +
 web/i18n/de-DE/common.json                    |   8 +
 web/i18n/en-US/common.json                    |   8 +
 web/i18n/es-ES/common.json                    |   8 +
 web/i18n/fa-IR/common.json                    |   8 +
 web/i18n/fr-FR/common.json                    |   8 +
 web/i18n/hi-IN/common.json                    |   8 +
 web/i18n/id-ID/common.json                    |   8 +
 web/i18n/it-IT/common.json                    |   8 +
 web/i18n/ja-JP/common.json                    |   8 +
 web/i18n/ko-KR/common.json                    |   8 +
 web/i18n/lo-LA/common.json                    |   8 +
 web/i18n/nl-NL/common.json                    |   8 +
 web/i18n/pl-PL/common.json                    |   8 +
 web/i18n/pt-BR/common.json                    |   8 +
 web/i18n/ro-RO/common.json                    |   8 +
 web/i18n/ru-RU/common.json                    |   8 +
 web/i18n/sl-SI/common.json                    |   8 +
 web/i18n/th-TH/common.json                    |   8 +
 web/i18n/tr-TR/common.json                    |   8 +
 web/i18n/uk-UA/common.json                    |   8 +
 web/i18n/vi-VN/common.json                    |   8 +
 web/i18n/zh-Hans/common.json                  |   8 +
 web/i18n/zh-Hant/common.json                  |   8 +
 web/service/console/query-policies.ts         |  49 ++++
 web/test/console/network-access.ts            |  66 +++++
 49 files changed, 1617 insertions(+), 185 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
 create mode 100644 web/app/components/app/access-point/access-control/network-access.ts
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
 create mode 100644 web/test/console/network-access.ts

diff --git a/web/app/components/app/access-point/__tests__/index.spec.tsx b/web/app/components/app/access-point/__tests__/index.spec.tsx
index e4abe18a30a5da..c2fdb7b9c9b461 100644
--- a/web/app/components/app/access-point/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/index.spec.tsx
@@ -7,6 +7,7 @@ import userEvent from '@testing-library/user-event'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { consoleQuery } from '@/service/console'
 import { seedAccountProfileQuery } from '@/test/console/account-profile'
+import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
 import { seedSystemFeatures } from '@/test/console/query-data'
 import { QueryClientTestProvider } from '@/test/console/query-provider'
 import { render } from '@/test/console/render'
@@ -108,6 +109,7 @@ const renderAccessPoint = ({
 } = {}) => {
   const queryClient = createTestQueryClient()
   seedAccountProfileQuery(queryClient, mockConsoleState.userProfile)
+  seedCurrentWorkspaceQuery(queryClient)
   seedSystemFeatures(queryClient)
   const queryOptions =
     consoleQuery.enterprise.appDeploy.deploymentService.listAppEnvironments.queryOptions({
diff --git a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
index 8fabb749713e17..8b0bb0ce6daaae 100644
--- a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
@@ -31,20 +31,30 @@ describe('getInServiceCoverage', () => {
 })
 
 describe('getAccessControlChipState', () => {
-  it('returns pro for Cloud sandbox', () => {
+  it('returns pro when the workspace is not entitled and has no assignment', () => {
     expect(
       getAccessControlChipState({
-        plan: 'sandbox',
-        assignment,
+        entitled: false,
+        assignment: null,
         availability,
       }).kind,
     ).toBe('pro')
   })
 
+  it('keeps the saved assignment visible when the workspace is not entitled', () => {
+    expect(
+      getAccessControlChipState({
+        entitled: false,
+        assignment,
+        availability,
+      }).kind,
+    ).toBe('on')
+  })
+
   it('returns off when the app has never been configured', () => {
     expect(
       getAccessControlChipState({
-        plan: 'professional',
+        entitled: true,
         assignment: null,
         availability,
       }),
@@ -54,7 +64,7 @@ describe('getAccessControlChipState', () => {
   it('returns paused when a saved policy is not enforcing', () => {
     expect(
       getAccessControlChipState({
-        plan: 'professional',
+        entitled: true,
         assignment: { ...assignment, enabled: false },
         availability,
       }),
@@ -69,7 +79,7 @@ describe('getAccessControlChipState', () => {
   it('returns on when every in-service access point is covered', () => {
     expect(
       getAccessControlChipState({
-        plan: 'team',
+        entitled: true,
         assignment,
         availability,
       }),
@@ -84,7 +94,7 @@ describe('getAccessControlChipState', () => {
   it('returns partial when some in-service access points are excluded', () => {
     expect(
       getAccessControlChipState({
-        plan: 'professional',
+        entitled: true,
         assignment: {
           ...assignment,
           scopes: { ...assignment.scopes, mcp: false },
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index a24e085e94d863..3f210e7edbb2b5 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -22,12 +22,12 @@ const policies: AccessControlPolicy[] = [
   {
     id: 'internal-network',
     name: 'Internal Network',
-    addresses: ['203.0.113.42', '198.51.100.0/24', '192.0.2.1', '192.0.2.2'],
+    allowed_cidrs: ['203.0.113.42/32', '198.51.100.0/24', '192.0.2.1/32', '192.0.2.2/32'],
   },
   {
     id: 'office-vpn',
     name: 'Office VPN',
-    addresses: ['198.51.100.0/24'],
+    allowed_cidrs: ['198.51.100.0/24'],
   },
 ]
 
@@ -113,7 +113,7 @@ describe('AccessControlConfigPanel', () => {
     await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
 
     expect(
-      screen.getByText('Allows 203.0.113.42, 198.51.100.0/24 and 2 more addresses'),
+      screen.getByText('Allows 203.0.113.42/32, 198.51.100.0/24 and 2 more addresses'),
     ).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
     expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
@@ -156,6 +156,7 @@ describe('AccessControlConfigPanel', () => {
         initialDraft={{
           ...createDefaultAccessControlDraft(),
           selectedPolicyId: 'internal-network',
+          enabled: true,
         }}
         availability={{ ...allScopesAvailable, mcp: false }}
       />,
@@ -174,6 +175,7 @@ describe('AccessControlConfigPanel', () => {
         initialDraft={{
           ...createDefaultAccessControlDraft(),
           selectedPolicyId: 'internal-network',
+          enabled: true,
         }}
         availability={{ webApp: true, serviceApi: true, mcp: false, trigger: false }}
       />,
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
index f4d202d5244d13..cbf7652361d862 100644
--- a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -1,11 +1,13 @@
+import {
+  policyIncludesIp,
+  splitPolicySummary,
+} from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 import { AppModeEnum } from '@/types/app'
 import {
   canSaveAccessControl,
   createDefaultAccessControlDraft,
   getAccessControlScopeAvailability,
   getAccessControlScopeSupport,
-  policyIncludesIp,
-  splitPolicySummary,
 } from '../draft'
 
 const allScopesAvailable = {
@@ -35,6 +37,7 @@ describe('canSaveAccessControl', () => {
       canSaveAccessControl({
         draft: {
           selectedPolicyId: 'policy-1',
+          enabled: true,
           scopes: {
             webApp: false,
             serviceApi: false,
@@ -61,6 +64,7 @@ describe('canSaveAccessControl', () => {
       canSaveAccessControl({
         draft: {
           selectedPolicyId: 'policy-1',
+          enabled: true,
           scopes: {
             webApp: false,
             serviceApi: false,
@@ -78,6 +82,7 @@ describe('canSaveAccessControl', () => {
       canSaveAccessControl({
         draft: {
           selectedPolicyId: 'policy-1',
+          enabled: true,
           scopes: {
             webApp: false,
             serviceApi: false,
@@ -89,6 +94,26 @@ describe('canSaveAccessControl', () => {
       }),
     ).toBe(false)
   })
+
+  it('disables save when the draft matches the saved baseline', () => {
+    expect(
+      canSaveAccessControl({
+        draft: selectedDraft,
+        availability: { ...allScopesAvailable, trigger: false },
+        baseline: selectedDraft,
+      }),
+    ).toBe(false)
+  })
+
+  it('allows saving a pause when a policy is already selected', () => {
+    expect(
+      canSaveAccessControl({
+        draft: { ...selectedDraft, enabled: false },
+        availability: { ...allScopesAvailable, trigger: false },
+        baseline: selectedDraft,
+      }),
+    ).toBe(true)
+  })
 })
 
 describe('getAccessControlScopeSupport', () => {
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 9502de6902e82e..12f9950c63d5a6 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -1,11 +1,17 @@
+import type { AppNetworkAccessGroupBindingResponse } from '@dify/contracts/api/console/apps/types.gen'
 import type { CloudPlan } from '@dify/contracts/api/console/features/types.gen'
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import { screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { useModalContext } from '@/context/modal-context'
-import { renderWithConsoleQuery } from '@/test/console/query-data'
+import {
+  createNetworkAccessGroupFixture,
+  seedAppNetworkAccessGroup,
+  seedNetworkAccessGroups,
+} from '@/test/console/network-access'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
 import { AccessControlEntry } from '..'
 
-const mockSetShowPricingModal = vi.fn()
+const mockSetPricing = vi.fn()
 const mockSetSettingsDestination = vi.fn()
 const accessControlTranslations = vi.hoisted(() => ({
   'operation.cancel': 'Cancel',
@@ -35,16 +41,35 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.tooltipOff': 'Not set up',
   'studio.accessControl.tooltipPro': 'Access control requires the Pro plan',
   'studio.accessControl.turnOn': 'Turn on Access Control',
+  'studio.accessControl.restrictByIp': 'Restrict by IP address',
+  'studio.accessControl.restrictedTo': 'Restricted to {{name}}',
+  'studio.accessControl.protectingAll': 'Protecting all {{count}} access points in service.',
+  'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
+  'operation.edit': 'Edit',
+  'studio.accessControl.turnOffTitle': 'Turn off access control?',
+  'studio.accessControl.turnOffDescription': '{{points}} will be reachable from any IP.',
+  'studio.accessControl.turnOffConfirm': 'Turn off',
 }))
 
-vi.mock('@/context/modal-context', () => ({
-  useModalContext: vi.fn(),
-  useModalContextSelector: vi.fn(),
+vi.mock('@/app/components/app/store', () => ({
+  useStore: (selector: (state: { appDetail: { id: string; mode: string } }) => unknown) =>
+    selector({
+      appDetail: {
+        id: 'app-1',
+        mode: 'chat',
+      },
+    }),
 }))
 
 vi.mock('nuqs', async (importOriginal) => {
   const actual = await importOriginal<typeof import('nuqs')>()
-  return { ...actual, useQueryState: () => [null, mockSetSettingsDestination] }
+  return {
+    ...actual,
+    useQueryState: (name: string) => {
+      if (name === 'pricing') return [null, mockSetPricing]
+      return [null, mockSetSettingsDestination]
+    },
+  }
 })
 
 vi.mock('react-i18next', async () => {
@@ -55,11 +80,21 @@ vi.mock('react-i18next', async () => {
 const renderEntry = ({
   plan,
   deploymentEdition = 'CLOUD',
+  groups = [],
+  binding = null,
 }: {
   plan?: CloudPlan
   deploymentEdition?: 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
+  groups?: NetworkAccessGroupResponse[]
+  binding?: AppNetworkAccessGroupBindingResponse | null
 } = {}) => {
+  const queryClient = createConsoleQueryClient()
+  const entitled = plan === 'professional' || plan === 'team'
+  seedNetworkAccessGroups(queryClient, { entitled, groups })
+  seedAppNetworkAccessGroup(queryClient, 'app-1', { entitled, binding })
+
   return renderWithConsoleQuery(<AccessControlEntry />, {
+    queryClient,
     systemFeatures: { deployment_edition: deploymentEdition },
     features: plan
       ? {
@@ -76,17 +111,6 @@ const getChip = () => screen.getByRole('button', { name: /Access Control/ })
 describe('AccessControlEntry', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    vi.mocked(useModalContext).mockReturnValue({
-      hasBlockingModalOpen: false,
-      setShowModerationSettingModal: vi.fn(),
-      setShowExternalDataToolModal: vi.fn(),
-      setShowPricingModal: mockSetShowPricingModal,
-      setShowAnnotationFullModal: vi.fn(),
-      setShowModelModal: vi.fn(),
-      setShowExternalKnowledgeAPIModal: vi.fn(),
-      setShowOpeningModal: vi.fn(),
-      setShowUpdatePluginModal: vi.fn(),
-    })
   })
 
   it('does not render on community edition', () => {
@@ -101,6 +125,31 @@ describe('AccessControlEntry', () => {
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
   })
 
+  it('shows a saved assignment on Cloud sandbox instead of hiding it behind the paywall', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'sandbox',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Turn on Access Control' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+  })
+
   it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
     renderEntry({ plan: 'sandbox' })
 
@@ -138,7 +187,7 @@ describe('AccessControlEntry', () => {
     expect(turnOn).not.toHaveTextContent('PRO')
     await user.click(turnOn)
 
-    expect(mockSetShowPricingModal).toHaveBeenCalledTimes(1)
+    expect(mockSetPricing).toHaveBeenCalledWith('open')
   })
 
   it('closes the paywall on Escape without side effects', async () => {
@@ -155,7 +204,7 @@ describe('AccessControlEntry', () => {
         screen.queryByText('Restrict this app to IP addresses you trust.'),
       ).not.toBeInTheDocument()
     })
-    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+    expect(mockSetPricing).not.toHaveBeenCalled()
   })
 
   it('opens the first-time config popover for paid workspaces without a back control', async () => {
@@ -209,6 +258,56 @@ describe('AccessControlEntry', () => {
       expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
     })
     expect(mockSetSettingsDestination).not.toHaveBeenCalled()
-    expect(mockSetShowPricingModal).not.toHaveBeenCalled()
+    expect(mockSetPricing).not.toHaveBeenCalled()
+  })
+
+  it('shows the saved binding status for a paid workspace', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+  })
+
+  it('keeps the saved chip state until a turned-off draft is saved', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    await user.click(screen.getByRole('button', { name: 'Turn off' }))
+
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
   })
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
new file mode 100644
index 00000000000000..9856b34c8439ac
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
@@ -0,0 +1,106 @@
+import {
+  accessPointsFromScopes,
+  availabilityFromAccessPoints,
+  draftFromBinding,
+  getNetworkAccessErrorStatus,
+  scopesFromAccessPoints,
+  toApiAccessPoint,
+  toUiAccessPoint,
+} from '../network-access'
+
+const allAvailable = {
+  webApp: true,
+  serviceApi: true,
+  mcp: true,
+  trigger: true,
+}
+
+describe('network access mappers', () => {
+  it('maps UI access points to the Console contract', () => {
+    expect(toApiAccessPoint('webApp')).toBe('webapp')
+    expect(toApiAccessPoint('serviceApi')).toBe('service_api')
+    expect(toUiAccessPoint('webapp')).toBe('webApp')
+    expect(toUiAccessPoint('service_api')).toBe('serviceApi')
+  })
+
+  it('builds availability from the server access-point matrix', () => {
+    expect(availabilityFromAccessPoints(['webapp', 'service_api', 'mcp'], true)).toEqual({
+      webApp: true,
+      serviceApi: true,
+      mcp: true,
+      trigger: false,
+    })
+    expect(
+      availabilityFromAccessPoints(['webapp', 'service_api', 'mcp', 'trigger'], false),
+    ).toEqual({
+      webApp: true,
+      serviceApi: true,
+      mcp: true,
+      trigger: false,
+    })
+  })
+
+  it('reads HTTP status from Response and nested response objects', () => {
+    expect(getNetworkAccessErrorStatus(new Response(null, { status: 409 }))).toBe(409)
+    expect(getNetworkAccessErrorStatus({ response: { status: 409 } })).toBe(409)
+  })
+
+  it('builds scopes from selected API access points and available ones', () => {
+    expect(scopesFromAccessPoints(['webapp', 'mcp'], allAvailable)).toEqual({
+      webApp: true,
+      serviceApi: false,
+      mcp: true,
+      trigger: false,
+    })
+  })
+
+  it('omits unavailable scopes when assembling a PUT payload', () => {
+    expect(
+      accessPointsFromScopes(
+        { webApp: true, serviceApi: true, mcp: true, trigger: true },
+        { ...allAvailable, trigger: false },
+      ),
+    ).toEqual(['webapp', 'service_api', 'mcp'])
+  })
+
+  it('creates an empty draft when the app has no binding', () => {
+    expect(draftFromBinding(null, allAvailable)).toEqual({
+      selectedPolicyId: null,
+      enabled: true,
+      scopes: {
+        webApp: true,
+        serviceApi: true,
+        mcp: true,
+        trigger: true,
+      },
+    })
+  })
+
+  it('hydrates a draft from a bound group', () => {
+    expect(
+      draftFromBinding(
+        {
+          id: 'binding-1',
+          tenant_id: 'workspace-1',
+          app_id: 'app-1',
+          enabled: true,
+          group_id: 'group-1',
+          access_points: ['webapp', 'service_api'],
+          version: 3,
+          created_at: '2026-01-01T00:00:00Z',
+          updated_at: '2026-01-01T00:00:00Z',
+        },
+        allAvailable,
+      ),
+    ).toEqual({
+      selectedPolicyId: 'group-1',
+      enabled: true,
+      scopes: {
+        webApp: true,
+        serviceApi: true,
+        mcp: false,
+        trigger: false,
+      },
+    })
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/chip-status.ts b/web/app/components/app/access-point/access-control/chip-status.ts
index afd3b87adb2626..557c050fe2d958 100644
--- a/web/app/components/app/access-point/access-control/chip-status.ts
+++ b/web/app/components/app/access-point/access-control/chip-status.ts
@@ -32,19 +32,16 @@ export function getInServiceCoverage(
 }
 
 export function getAccessControlChipState({
-  plan,
+  entitled,
   assignment,
   availability,
 }: {
-  plan: string | undefined
+  entitled?: boolean
   assignment: AccessControlAssignment | null
   availability: AccessControlScopeAvailability
 }): AccessControlChipState {
-  if (plan === 'sandbox') {
-    return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
-  }
-
   if (!assignment) {
+    if (entitled === false) return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
     return { kind: 'off', coveredCount: 0, inServiceCount: 0 }
   }
 
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 27f3b0d797c5cf..9ae1ac637d8c1f 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -12,7 +12,7 @@ import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { PopoverTitle } from '@langgenius/dify-ui/popover'
 import { useTranslation } from 'react-i18next'
-import { canSaveAccessControl } from './draft'
+import { canSaveAccessControl, hasSelectedProtectableAccessPoint } from './draft'
 import { AccessControlPolicyField } from './policy-field'
 import { AccessControlScopeList } from './scope-list'
 
@@ -21,7 +21,9 @@ type AccessControlConfigPanelProps = {
   policies: readonly AccessControlPolicy[]
   currentIp?: string
   availability: AccessControlScopeAvailability
+  baseline?: AccessControlDraft
   showBack?: boolean
+  saving?: boolean
   onBack?: () => void
   onCancel: () => void
   onCreatePolicy: () => void
@@ -35,7 +37,9 @@ export function AccessControlConfigPanel({
   policies,
   currentIp,
   availability,
+  baseline,
   showBack = false,
+  saving = false,
   onBack,
   onCancel,
   onCreatePolicy,
@@ -46,7 +50,7 @@ export function AccessControlConfigPanel({
   const { t } = useTranslation()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
-  const canSave = canSaveAccessControl({ draft, availability })
+  const canSave = canSaveAccessControl({ draft, availability, baseline })
 
   const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
     event.preventDefault()
@@ -110,7 +114,7 @@ export function AccessControlConfigPanel({
             availability={availability}
             onDraftChange={onDraftChange}
           />
-          {hasSelectedPolicy && !canSave && (
+          {hasSelectedPolicy && !hasSelectedProtectableAccessPoint(draft, availability) && (
             <p className="system-xs-regular text-text-warning">
               {t(($) => $['studio.accessControl.selectAccessPoint'], { ns: 'deployments' })}
             </p>
@@ -121,7 +125,7 @@ export function AccessControlConfigPanel({
           <Button type="button" variant="secondary" onClick={onCancel}>
             {t(($) => $['operation.cancel'], { ns: 'common' })}
           </Button>
-          <Button type="submit" variant="primary" disabled={!canSave}>
+          <Button type="submit" variant="primary" disabled={!canSave || saving} loading={saving}>
             {t(($) => $['operation.save'], { ns: 'common' })}
           </Button>
         </div>
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
index 4f2d266551da0c..947f4b6119ca5f 100644
--- a/web/app/components/app/access-point/access-control/draft.ts
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -1,24 +1,23 @@
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { AppModeEnum } from '@/types/app'
 
 export type AccessControlScopeAvailability = Record<AccessPoint, boolean>
 
-export type AccessControlPolicy = {
-  id: string
-  name: string
-  addresses: readonly string[]
-}
+export type AccessControlPolicy = Pick<NetworkAccessGroupResponse, 'id' | 'name' | 'allowed_cidrs'>
 
 export type AccessControlDraft = {
   selectedPolicyId: string | null
   scopes: Record<AccessPoint, boolean>
+  enabled: boolean
 }
 
 export const createDefaultAccessControlDraft = (
   availability?: AccessControlScopeAvailability,
 ): AccessControlDraft => ({
   selectedPolicyId: null,
+  enabled: true,
   scopes: {
     webApp: availability?.webApp ?? true,
     serviceApi: availability?.serviceApi ?? true,
@@ -65,61 +64,34 @@ export function isProtectableAccessPoint(
   return availability[scope]
 }
 
+export function isAccessControlDraftEqual(left: AccessControlDraft, right: AccessControlDraft) {
+  if (left.selectedPolicyId !== right.selectedPolicyId) return false
+  if (left.enabled !== right.enabled) return false
+
+  return ACCESS_POINT_ORDER.every((scope) => left.scopes[scope] === right.scopes[scope])
+}
+
+export function hasSelectedProtectableAccessPoint(
+  draft: AccessControlDraft,
+  availability: AccessControlScopeAvailability,
+) {
+  return ACCESS_POINT_ORDER.some((scope) => {
+    if (!isProtectableAccessPoint(scope, availability)) return false
+    return draft.scopes[scope]
+  })
+}
+
 export function canSaveAccessControl({
   draft,
   availability,
+  baseline,
 }: {
   draft: AccessControlDraft
   availability: AccessControlScopeAvailability
+  baseline?: AccessControlDraft
 }) {
+  if (baseline && isAccessControlDraftEqual(draft, baseline)) return false
+  if (!draft.enabled) return Boolean(draft.selectedPolicyId)
   if (!draft.selectedPolicyId) return false
-
-  return ACCESS_POINT_ORDER.some((scope) => {
-    if (!isProtectableAccessPoint(scope, availability)) return false
-    return draft.scopes[scope]
-  })
-}
-
-export function splitPolicySummary(addresses: readonly string[]): {
-  listed: readonly string[]
-  moreCount: number
-} {
-  if (addresses.length <= 2) return { listed: addresses, moreCount: 0 }
-  return { listed: addresses.slice(0, 2), moreCount: addresses.length - 2 }
-}
-
-function ipv4ToInt(ip: string): number | null {
-  const parts = ip.split('.')
-  if (parts.length !== 4) return null
-
-  let value = 0
-  for (const part of parts) {
-    if (!/^\d+$/.test(part)) return null
-    const octet = Number(part)
-    if (octet > 255) return null
-    value = (value << 8) + octet
-  }
-
-  return value >>> 0
-}
-
-function ipv4InCidr(ip: string, network: string, prefix: number): boolean {
-  const ipInt = ipv4ToInt(ip)
-  const networkInt = ipv4ToInt(network)
-  if (ipInt === null || networkInt === null) return false
-  if (prefix === 0) return true
-  const mask = prefix === 32 ? 0xffffffff : ~((1 << (32 - prefix)) - 1) >>> 0
-  return (ipInt & mask) === (networkInt & mask)
-}
-
-export function policyIncludesIp(addresses: readonly string[], ip: string): boolean {
-  return addresses.some((entry) => {
-    if (entry === ip) return true
-    const slash = entry.indexOf('/')
-    if (slash === -1) return false
-    const network = entry.slice(0, slash)
-    const prefix = Number(entry.slice(slash + 1))
-    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false
-    return ipv4InCidr(ip, network, prefix)
-  })
+  return hasSelectedProtectableAccessPoint(draft, availability)
 }
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 24fc1f99f0143d..11853025437772 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -1,20 +1,24 @@
 'use client'
 
 import type { AccessControlAssignment } from './chip-status'
-import type { AccessControlDraft, AccessControlPolicy } from './draft'
+import type { AccessControlDraft } from './draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { useQuery } from '@tanstack/react-query'
+import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
+import {
+  pricingQueryParamName,
+  pricingQueryParser,
+} from '@/app/components/billing/pricing/query-params'
 import {
   settingsQueryParamName,
   settingsQueryParser,
 } from '@/app/components/header/account-setting/query-params'
-import { useModalContext } from '@/context/modal-context'
+import { isCurrentWorkspaceManagerAtom } from '@/context/workspace-state'
 import { deploymentEditionAtom } from '@/features/system-features/state'
 import { consoleQuery } from '@/service/console'
 import { useAppWorkflow } from '@/service/use-workflow'
@@ -22,61 +26,111 @@ import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
 import { AccessControlChipAffix } from './chip-affix'
 import { getAccessControlChipState } from './chip-status'
 import { AccessControlConfigPanel } from './config-panel'
-import { createDefaultAccessControlDraft, getAccessControlScopeAvailability } from './draft'
+import {
+  canSaveAccessControl,
+  getAccessControlScopeAvailability,
+  isAccessControlDraftEqual,
+} from './draft'
 import { AccessControlFreePaywall } from './free-paywall'
+import {
+  accessPointsFromScopes,
+  availabilityFromAccessPoints,
+  draftFromBinding,
+  getNetworkAccessErrorStatus,
+  scopesFromAccessPoints,
+} from './network-access'
 import { AccessControlStatusPanel } from './status-panel'
 
 type GtagHandler = (command: 'event', action: 'click_upgrade_btn', payload: { loc: string }) => void
 
-const isPaidCloudPlan = (plan: string | undefined) => plan === 'professional' || plan === 'team'
-
 export function AccessControlEntry() {
   const { t } = useTranslation()
+  const queryClient = useQueryClient()
   const deploymentEdition = useAtomValue(deploymentEditionAtom)
-  const { data: plan } = useQuery(
-    consoleQuery.features.get.queryOptions({
-      enabled: deploymentEdition === 'CLOUD',
-      select: (data) => data.billing.subscription.plan,
-    }),
+  const isManager = useAtomValue(isCurrentWorkspaceManagerAtom)
+  const [_pricing, setPricing] = useQueryState(pricingQueryParamName, pricingQueryParser)
+  const [_settingsDestination, setSettingsDestination] = useQueryState(
+    settingsQueryParamName,
+    settingsQueryParser,
   )
-  const { setShowPricingModal } = useModalContext()
-  const [, setSettingsDestination] = useQueryState(settingsQueryParamName, settingsQueryParser)
   const appInfo = useAppStore((state) => state.appDetail)
-  const isSandbox = plan === 'sandbox'
-  const isPaid = isPaidCloudPlan(plan)
-  const shouldFetchWorkflow = isPaid && Boolean(appInfo && isAdvancedApp(appInfo))
-  const { data: workflow } = useAppWorkflow(shouldFetchWorkflow && appInfo ? appInfo.id : '')
+  const appId = appInfo?.id
+  const canFetchNetworkAccess = deploymentEdition === 'CLOUD' && isManager
+  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo))
+  const { data: workflow } = useAppWorkflow(
+    shouldFetchWorkflow && canFetchNetworkAccess && appInfo ? appInfo.id : '',
+  )
+  const groupsQuery = useQuery(
+    consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions({
+      enabled: canFetchNetworkAccess,
+      retry: false,
+    }),
+  )
+  const bindingQuery = useQuery(
+    consoleQuery.apps.byAppId.networkAccessGroup.get.queryOptions({
+      input: appId ? { params: { app_id: appId } } : skipToken,
+      context: { silent: true },
+      retry: false,
+      enabled: canFetchNetworkAccess && Boolean(appId),
+    }),
+  )
+  const updateBinding = useMutation(
+    consoleQuery.apps.byAppId.networkAccessGroup.put.mutationOptions(),
+  )
   const [open, setOpen] = useState(false)
   const [view, setView] = useState<'config' | 'status'>('status')
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
-  const [savedDraft, setSavedDraft] = useState<AccessControlDraft | null>(null)
-  const [enabled, setEnabled] = useState(true)
 
-  if (deploymentEdition !== 'CLOUD' || (!isSandbox && !isPaid)) return null
+  const bindingErrorStatus = getNetworkAccessErrorStatus(bindingQuery.error)
+  const hideForUnsupportedApp =
+    canFetchNetworkAccess &&
+    Boolean(appId) &&
+    (bindingErrorStatus === 400 || bindingErrorStatus === 403 || bindingErrorStatus === 404)
+
+  if (deploymentEdition !== 'CLOUD' || !isManager) return null
+  if (hideForUnsupportedApp) return null
+  if (groupsQuery.isPending || (appId && bindingQuery.isPending)) return null
 
   const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const workflowState = appInfo ? getPublishedWorkflowState(appInfo, workflow) : undefined
-  const availability = getAccessControlScopeAvailability({
+  const triggerAvailable = getAccessControlScopeAvailability({
     mode: appInfo?.mode,
     hasTriggerNode: Boolean(workflowState?.hasTriggerNode),
     isUnpublished: Boolean(workflowState?.isUnpublished),
-  })
-  const policies: readonly AccessControlPolicy[] = []
-  const resolvedDraft = draft ?? savedDraft ?? createDefaultAccessControlDraft(availability)
-  const assignment: AccessControlAssignment | null = savedDraft?.selectedPolicyId
+  }).trigger
+  const availability = availabilityFromAccessPoints(
+    bindingQuery.data?.available_access_points ?? [],
+    triggerAvailable,
+  )
+  const groups = groupsQuery.data?.groups ?? []
+  const binding = bindingQuery.data?.binding
+  const policies = groups.map((group) => ({
+    id: group.id,
+    name: group.name,
+    allowed_cidrs: group.allowed_cidrs,
+  }))
+  const baseline = draftFromBinding(binding, availability)
+  const resolvedDraft = draft ?? baseline
+  const assignment: AccessControlAssignment | null = binding?.group_id
     ? {
-        policyId: savedDraft.selectedPolicyId,
-        policyName:
-          policies.find((policy) => policy.id === savedDraft.selectedPolicyId)?.name ??
-          savedDraft.selectedPolicyId,
-        scopes: savedDraft.scopes,
-        enabled,
+        policyId: binding.group_id,
+        policyName: groups.find((group) => group.id === binding.group_id)?.name ?? binding.group_id,
+        scopes: scopesFromAccessPoints(binding.access_points, availability),
+        enabled: binding.enabled,
       }
     : null
-  const chip = getAccessControlChipState({ plan, assignment, availability })
+  const entitled = bindingQuery.data?.entitled ?? groupsQuery.data?.entitled
+  const canMutate = entitled === true
+  const dirty = !isAccessControlDraftEqual(resolvedDraft, baseline)
+  const canSave = canSaveAccessControl({
+    draft: resolvedDraft,
+    availability,
+    baseline,
+  })
+  const chip = getAccessControlChipState({ entitled, assignment, availability })
   const showPaywall = chip.kind === 'pro'
-  const showStatus = Boolean(assignment) && view === 'status'
+  const showStatus = Boolean(assignment) && (view === 'status' || !canMutate)
 
   const tooltip =
     chip.kind === 'pro'
@@ -101,37 +155,109 @@ export function AccessControlEntry() {
             : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
   const handleTurnOn = () => {
-    setShowPricingModal()
+    void setPricing('open')
     const gtag = (window as Window & { gtag?: GtagHandler }).gtag
     if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
   }
 
   const handleCancel = () => {
     setDraft(null)
+    setShowBack(false)
     if (assignment) {
       setView('status')
-      setShowBack(false)
       return
     }
     setOpen(false)
   }
 
+  const handleBack = () => {
+    setShowBack(false)
+    setView('status')
+  }
+
   const handleCreatePolicy = () => {
     setOpen(false)
     void setSettingsDestination('ip-policies')
   }
 
+  const persistBinding = (
+    {
+      enabled,
+      groupId,
+      accessPoints,
+    }: {
+      enabled: boolean
+      groupId: string | null
+      accessPoints: ReturnType<typeof accessPointsFromScopes>
+    },
+    onSuccess?: () => void,
+  ) => {
+    if (!appId) return
+
+    updateBinding.mutate(
+      {
+        params: { app_id: appId },
+        body: {
+          enabled,
+          group_id: groupId,
+          access_points: accessPoints,
+          expected_version: binding?.version ?? 0,
+        },
+      },
+      {
+        onSuccess,
+        onError: (error) => {
+          if (getNetworkAccessErrorStatus(error) !== 409) return
+          void queryClient.invalidateQueries({
+            queryKey: consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
+              input: { params: { app_id: appId } },
+            }),
+          })
+          void queryClient.invalidateQueries({
+            queryKey: consoleQuery.workspaces.current.networkAccessGroups.get.queryKey(),
+          })
+        },
+      },
+    )
+  }
+
   const handleSave = () => {
-    setSavedDraft(resolvedDraft)
-    setEnabled(true)
-    setDraft(null)
-    setView('status')
-    setShowBack(false)
+    if (!canMutate || !canSave || !resolvedDraft.selectedPolicyId) return
+
+    persistBinding(
+      {
+        enabled: resolvedDraft.enabled,
+        groupId: resolvedDraft.selectedPolicyId,
+        accessPoints: accessPointsFromScopes(resolvedDraft.scopes, availability),
+      },
+      () => {
+        setDraft(null)
+        setView('status')
+        setShowBack(false)
+      },
+    )
+  }
+
+  const handleEnabledChange = (enabled: boolean) => {
+    if (!canMutate) return
+    setDraft({ ...resolvedDraft, enabled })
   }
 
   return (
     <Tooltip>
-      <Popover open={open} onOpenChange={setOpen}>
+      <Popover
+        open={open}
+        onOpenChange={(nextOpen) => {
+          setOpen(nextOpen)
+          if (!nextOpen) {
+            setDraft(null)
+            setShowBack(false)
+            return
+          }
+          setView(assignment || !canMutate ? 'status' : 'config')
+          setShowBack(false)
+        }}
+      >
         <TooltipTrigger
           render={
             <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid" />
@@ -151,15 +277,23 @@ export function AccessControlEntry() {
         >
           {showPaywall ? (
             <AccessControlFreePaywall onTurnOn={handleTurnOn} />
-          ) : showStatus && savedDraft ? (
+          ) : showStatus && assignment ? (
             <AccessControlStatusPanel
-              draft={savedDraft}
+              draft={resolvedDraft}
               policies={policies}
-              enabled={enabled}
+              enabled={resolvedDraft.enabled}
               availability={availability}
-              onEnabledChange={setEnabled}
+              updating={updateBinding.isPending}
+              dirty={dirty}
+              canSave={canSave}
+              readOnly={!canMutate}
+              onUpgrade={handleTurnOn}
+              onEnabledChange={handleEnabledChange}
+              onCancel={handleCancel}
+              onSave={handleSave}
               onEdit={() => {
-                setDraft(savedDraft)
+                if (!canMutate) return
+                setDraft(resolvedDraft)
                 setShowBack(true)
                 setView('config')
               }}
@@ -169,8 +303,10 @@ export function AccessControlEntry() {
               draft={resolvedDraft}
               policies={policies}
               availability={availability}
+              baseline={baseline}
               showBack={showBack}
-              onBack={handleCancel}
+              saving={updateBinding.isPending}
+              onBack={handleBack}
               onCancel={handleCancel}
               onCreatePolicy={handleCreatePolicy}
               onManagePolicies={handleCreatePolicy}
diff --git a/web/app/components/app/access-point/access-control/network-access.ts b/web/app/components/app/access-point/access-control/network-access.ts
new file mode 100644
index 00000000000000..df273ca56d670a
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/network-access.ts
@@ -0,0 +1,109 @@
+import type {
+  AppNetworkAccessGroupBindingResponse,
+  AppNetworkAccessGroupResponse,
+} from '@dify/contracts/api/console/apps/types.gen'
+import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import { createDefaultAccessControlDraft } from './draft'
+
+export type NetworkAccessPoint = AppNetworkAccessGroupResponse['available_access_points'][number]
+
+const ACCESS_POINT_TO_API = {
+  webApp: 'webapp',
+  serviceApi: 'service_api',
+  mcp: 'mcp',
+  trigger: 'trigger',
+} as const satisfies Record<AccessPoint, NetworkAccessPoint>
+
+const API_TO_ACCESS_POINT = {
+  webapp: 'webApp',
+  service_api: 'serviceApi',
+  mcp: 'mcp',
+  trigger: 'trigger',
+} as const satisfies Record<NetworkAccessPoint, AccessPoint>
+
+export function toApiAccessPoint(accessPoint: AccessPoint): NetworkAccessPoint {
+  return ACCESS_POINT_TO_API[accessPoint]
+}
+
+export function toUiAccessPoint(accessPoint: NetworkAccessPoint): AccessPoint {
+  return API_TO_ACCESS_POINT[accessPoint]
+}
+
+export function availabilityFromAccessPoints(
+  availableAccessPoints: readonly string[],
+  triggerAvailable: boolean,
+): AccessControlScopeAvailability {
+  const allowed = new Set(
+    availableAccessPoints.flatMap((accessPoint) => {
+      if (accessPoint in API_TO_ACCESS_POINT)
+        return [API_TO_ACCESS_POINT[accessPoint as NetworkAccessPoint]]
+      return []
+    }),
+  )
+
+  return {
+    webApp: allowed.has('webApp'),
+    serviceApi: allowed.has('serviceApi'),
+    mcp: allowed.has('mcp'),
+    trigger: allowed.has('trigger') && triggerAvailable,
+  }
+}
+
+export function getNetworkAccessErrorStatus(error: unknown): number | undefined {
+  if (error instanceof Response) return error.status
+  if (typeof error === 'object' && error !== null) {
+    if ('status' in error && typeof error.status === 'number') return error.status
+    if (
+      'response' in error &&
+      typeof error.response === 'object' &&
+      error.response !== null &&
+      'status' in error.response &&
+      typeof error.response.status === 'number'
+    )
+      return error.response.status
+  }
+}
+
+export function scopesFromAccessPoints(
+  accessPoints: readonly string[],
+  availability: AccessControlScopeAvailability,
+): AccessControlDraft['scopes'] {
+  const selected = new Set(
+    accessPoints.flatMap((accessPoint) => {
+      if (accessPoint in API_TO_ACCESS_POINT)
+        return [API_TO_ACCESS_POINT[accessPoint as NetworkAccessPoint]]
+      return []
+    }),
+  )
+
+  return {
+    webApp: availability.webApp && selected.has('webApp'),
+    serviceApi: availability.serviceApi && selected.has('serviceApi'),
+    mcp: availability.mcp && selected.has('mcp'),
+    trigger: availability.trigger && selected.has('trigger'),
+  }
+}
+
+export function accessPointsFromScopes(
+  scopes: AccessControlDraft['scopes'],
+  availability: AccessControlScopeAvailability,
+): NetworkAccessPoint[] {
+  return ACCESS_POINT_ORDER.filter(
+    (accessPoint) => availability[accessPoint] && scopes[accessPoint],
+  ).map(toApiAccessPoint)
+}
+
+export function draftFromBinding(
+  binding: AppNetworkAccessGroupBindingResponse | null | undefined,
+  availability: AccessControlScopeAvailability,
+): AccessControlDraft {
+  if (!binding?.group_id) return createDefaultAccessControlDraft(availability)
+
+  return {
+    selectedPolicyId: binding.group_id,
+    enabled: binding.enabled,
+    scopes: scopesFromAccessPoints(binding.access_points, availability),
+  }
+}
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index fd07e370cbbeec..f1dfe8feb29497 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -15,7 +15,10 @@ import {
   SelectValue,
 } from '@langgenius/dify-ui/select'
 import { useTranslation } from 'react-i18next'
-import { policyIncludesIp, splitPolicySummary } from './draft'
+import {
+  policyIncludesIp,
+  splitPolicySummary,
+} from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 
 const MANAGE_POLICIES_VALUE = '__manage-ip-policies__'
 
@@ -38,12 +41,12 @@ export function AccessControlPolicyField({
 }: AccessControlPolicyFieldProps) {
   const { t } = useTranslation()
   const selectedPolicy = policies.find((policy) => policy.id === selectedPolicyId)
-  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.addresses) : undefined
+  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.allowed_cidrs) : undefined
   const showLockout =
     Boolean(selectedPolicy && currentIp) &&
     selectedPolicy !== undefined &&
     currentIp !== undefined &&
-    !policyIncludesIp(selectedPolicy.addresses, currentIp)
+    !policyIncludesIp(selectedPolicy.allowed_cidrs, currentIp)
   const selectLabel = t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })
   const placeholder = t(($) => $['studio.accessControl.selectPolicy'], { ns: 'deployments' })
 
@@ -73,7 +76,7 @@ export function AccessControlPolicyField({
           <span className="shrink-0 system-xs-regular text-text-tertiary">
             {t(($) => $['studio.accessControl.addressCount'], {
               ns: 'deployments',
-              count: policy.addresses.length,
+              count: policy.allowed_cidrs.length,
             })}
           </span>
           <SelectItemIndicator />
@@ -132,7 +135,7 @@ export function AccessControlPolicyField({
               <span className="shrink-0 system-xs-regular text-text-tertiary">
                 {t(($) => $['studio.accessControl.addressCount'], {
                   ns: 'deployments',
-                  count: policy.addresses.length,
+                  count: policy.allowed_cidrs.length,
                 })}
               </span>
             </button>
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index e887c5f583a2fe..c439fa1ea6e7e2 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -24,8 +24,9 @@ import { useTranslation } from 'react-i18next'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
+import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 import { getInServiceCoverage } from './chip-status'
-import { isProtectableAccessPoint, splitPolicySummary } from './draft'
+import { isProtectableAccessPoint } from './draft'
 
 const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
   serviceApi: 'i-custom-vender-knowledge-api-aggregate',
@@ -39,6 +40,13 @@ type AccessControlStatusPanelProps = {
   enabled: boolean
   availability: AccessControlScopeAvailability
   onEdit: () => void
+  updating?: boolean
+  dirty?: boolean
+  canSave?: boolean
+  readOnly?: boolean
+  onUpgrade?: () => void
+  onCancel?: () => void
+  onSave?: () => void
   onEnabledChange: (enabled: boolean) => void
 }
 
@@ -48,13 +56,20 @@ export function AccessControlStatusPanel({
   enabled,
   availability,
   onEdit,
+  updating = false,
+  dirty = false,
+  canSave = false,
+  readOnly = false,
+  onUpgrade,
+  onCancel,
+  onSave,
   onEnabledChange,
 }: AccessControlStatusPanelProps) {
   const { t } = useTranslation()
   const appInfo = useAppStore((state) => state.appDetail)
   const [confirmPause, setConfirmPause] = useState(false)
   const selectedPolicy = policies.find((policy) => policy.id === draft.selectedPolicyId)
-  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.addresses) : undefined
+  const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.allowed_cidrs) : undefined
   const coverage = getInServiceCoverage(draft.scopes, availability)
   const labels: Record<AccessPoint, string> = {
     webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
@@ -78,9 +93,15 @@ export function AccessControlStatusPanel({
               })
             : t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
         </PopoverTitle>
-        <Button type="button" variant="ghost" size="small" onClick={onEdit}>
-          {t(($) => $['operation.edit'], { ns: 'common' })}
-        </Button>
+        {readOnly ? (
+          <Button type="button" variant="ghost" size="small" onClick={onUpgrade}>
+            {t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })}
+          </Button>
+        ) : (
+          <Button type="button" variant="ghost" size="small" onClick={onEdit}>
+            {t(($) => $['operation.edit'], { ns: 'common' })}
+          </Button>
+        )}
       </div>
 
       <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
@@ -104,6 +125,7 @@ export function AccessControlStatusPanel({
           </div>
           <Switch
             checked={enabled}
+            disabled={updating || readOnly}
             aria-label={t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
             onCheckedChange={(next) => {
               if (next) {
@@ -202,6 +224,22 @@ export function AccessControlStatusPanel({
             )
           })}
         </div>
+        {dirty && !readOnly && (
+          <div className="flex items-center justify-end gap-2 pt-5">
+            <Button type="button" variant="secondary" onClick={onCancel}>
+              {t(($) => $['operation.cancel'], { ns: 'common' })}
+            </Button>
+            <Button
+              type="button"
+              variant="primary"
+              disabled={!canSave || updating}
+              loading={updating}
+              onClick={onSave}
+            >
+              {t(($) => $['operation.save'], { ns: 'common' })}
+            </Button>
+          </div>
+        )}
       </div>
 
       <AlertDialog open={confirmPause} onOpenChange={setConfirmPause}>
diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index f3a1470822cc8b..fffc93383b6b39 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -5,7 +5,8 @@ import userEvent from '@testing-library/user-event'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { useState } from 'react'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
-import { renderWithConsoleQuery } from '@/test/console/query-data'
+import { seedNetworkAccessGroups } from '@/test/console/network-access'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
 import { ACCOUNT_SETTING_TAB } from '../constants'
 import AccountSetting from '../index'
 
@@ -189,11 +190,15 @@ describe('AccountSetting', () => {
       )
     }
 
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { entitled: false, groups: [] })
+
     return renderWithConsoleQuery(
       <NuqsTestingAdapter>
         <StatefulAccountSetting />
       </NuqsTestingAdapter>,
       {
+        queryClient,
         features: {
           billing: { subscription: { plan: 'sandbox' } },
           can_replace_logo: canReplaceLogo,
@@ -566,6 +571,20 @@ describe('AccountSetting', () => {
       ).toBeInTheDocument()
     })
 
+    it('should hide IP Policies for workspace members', () => {
+      mockConsoleState.current = {
+        ...baseConsoleState,
+        isCurrentWorkspaceManager: false,
+        isCurrentWorkspaceOwner: false,
+      }
+
+      renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
+
+      expect(
+        screen.queryByRole('button', { name: 'common.settings.ipPolicies' }),
+      ).not.toBeInTheDocument()
+    })
+
     it('should change active tab when clicking on menu item', () => {
       // Arrange
       renderAccountSetting({ onTabChange: mockOnTabChange })
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 33ab1f4cbf6aa5..083a4a8ee446bc 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -74,11 +74,10 @@ export default function AccountSetting({
     systemFeatures.deployment_edition === 'CLOUD' && !isCurrentWorkspaceDatasetOperator
   const canViewWorkflowLogArchives =
     systemFeatures.deployment_edition === 'CLOUD' && isCurrentWorkspaceManager
+  const canViewIpPolicies =
+    systemFeatures.deployment_edition === 'CLOUD' && isCurrentWorkspaceManager
   const activeMenu = (() => {
-    if (
-      activeTab === ACCOUNT_SETTING_TAB.IP_POLICIES &&
-      systemFeatures.deployment_edition !== 'CLOUD'
-    )
+    if (activeTab === ACCOUNT_SETTING_TAB.IP_POLICIES && !canViewIpPolicies)
       return ACCOUNT_SETTING_TAB.MEMBERS
     if (activeTab === ACCOUNT_SETTING_TAB.BILLING && !canViewBilling)
       return ACCOUNT_SETTING_TAB.PREFERENCES
@@ -154,8 +153,7 @@ export default function AccountSetting({
     const visibleTabs: AccountSettingTab[] = []
 
     visibleTabs.push(ACCOUNT_SETTING_TAB.MEMBERS)
-    if (systemFeatures.deployment_edition === 'CLOUD')
-      visibleTabs.push(ACCOUNT_SETTING_TAB.IP_POLICIES)
+    if (canViewIpPolicies) visibleTabs.push(ACCOUNT_SETTING_TAB.IP_POLICIES)
 
     if (canManageWorkspaceRoles) {
       visibleTabs.push(ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS)
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 6ca76bf5378d5d..8494d37e601843 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -1,11 +1,18 @@
-import { screen } from '@testing-library/react'
+import { screen, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
-import { render } from '@/test/console/render'
+import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import {
+  createNetworkAccessGroupFixture,
+  seedNetworkAccessGroups,
+} from '@/test/console/network-access'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
 import IpPoliciesPage from '..'
 
 const translations = vi.hoisted(() => ({
   'operation.cancel': 'Cancel',
   'operation.close': 'Close',
+  'operation.delete': 'Delete',
+  'operation.edit': 'Edit',
   'settings.ipPolicies': 'IP Policies',
   'settings.ipPoliciesDescription':
     'Reusable rules that control which IP addresses or ranges can access your apps',
@@ -14,8 +21,15 @@ const translations = vi.hoisted(() => ({
   'settings.ipPolicyAllowlistHelp':
     'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
   'settings.ipPolicyCreate': 'Create',
+  'settings.ipPolicyDeleteBound': 'This policy is in use',
+  'settings.ipPolicyDeleteBoundDescription':
+    '{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
+  'settings.ipPolicyDeleteConfirm': 'Delete “{{name}}”?',
+  'settings.ipPolicyEditUsedBy':
+    'This policy is used by {{count}} apps. Saving updates the allowlist for all of them.',
   'settings.ipPolicyDialogDescription':
     'Specify which IP addresses or ranges can access your apps.',
+  'settings.ipPolicyEditTitle': 'Edit IP Policy',
   'settings.ipPolicyName': 'Name',
   'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
   'settings.ipPolicyNewTitle': 'New IP Policy',
@@ -23,6 +37,7 @@ const translations = vi.hoisted(() => ({
   'studio.accessControl.emptyPoliciesDescription':
     'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
   'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
+  'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
 }))
 
 vi.mock('react-i18next', async () => {
@@ -33,11 +48,123 @@ vi.mock('react-i18next', async () => {
 describe('IpPoliciesPage', () => {
   it('opens the new policy dialog from Add', async () => {
     const user = userEvent.setup()
-    render(<IpPoliciesPage />)
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient },
+    )
 
     expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
     await user.click(screen.getByRole('button', { name: 'Add' }))
     expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
   })
+
+  it('lists existing policies and opens edit from the row', async () => {
+    const user = userEvent.setup()
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, {
+      entitled: true,
+      groups: [createNetworkAccessGroupFixture()],
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient },
+    )
+
+    expect(screen.getByText('Internal Network')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(screen.getByRole('heading', { name: 'Edit IP Policy' })).toBeInTheDocument()
+    expect(screen.getByDisplayValue('Internal Network')).toBeInTheDocument()
+  })
+
+  it('warns that editing a used policy updates every referencing app', async () => {
+    const user = userEvent.setup()
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, {
+      entitled: true,
+      groups: [
+        createNetworkAccessGroupFixture({
+          used_by_count: 2,
+          app_ids: ['app-a', 'app-b'],
+          apps: [
+            {
+              id: 'app-a',
+              name: 'Support Bot',
+              icon: null,
+              icon_type: null,
+              icon_background: null,
+            },
+            { id: 'app-b', name: 'Helpdesk', icon: null, icon_type: null, icon_background: null },
+          ],
+        }),
+      ],
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient },
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(
+      screen.getByText(
+        'This policy is used by 2 apps. Saving updates the allowlist for all of them.',
+      ),
+    ).toBeInTheDocument()
+    expect(screen.getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
+      'href',
+      '/app/app-a/overview',
+    )
+  })
+
+  it('lets the user delete a referenced policy after confirming the impact', async () => {
+    const user = userEvent.setup()
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, {
+      entitled: true,
+      groups: [
+        createNetworkAccessGroupFixture({
+          used_by_count: 2,
+          app_ids: ['app-a', 'app-b'],
+          apps: [
+            {
+              id: 'app-a',
+              name: 'Support Bot',
+              icon: null,
+              icon_type: null,
+              icon_background: null,
+            },
+            { id: 'app-b', name: 'Helpdesk', icon: null, icon_type: null, icon_background: null },
+          ],
+        }),
+      ],
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient },
+    )
+
+    await user.click(screen.getAllByRole('button', { name: 'Delete' })[0] as HTMLElement)
+    expect(screen.getByRole('heading', { name: 'Delete “Internal Network”?' })).toBeInTheDocument()
+    expect(
+      screen.getByText(
+        'Internal Network is applied to 2 apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
+      ),
+    ).toBeInTheDocument()
+    const dialog = screen.getByRole('alertdialog')
+    expect(within(dialog).getByRole('button', { name: 'Delete' })).toBeEnabled()
+    expect(within(dialog).getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
+      'href',
+      '/app/app-a/overview',
+    )
+  })
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
index a1388915e35a57..d139e3a0a1bf9a 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -34,7 +34,7 @@ function DialogHarness({
   onSubmit = vi.fn(),
 }: {
   currentIp?: string
-  onSubmit?: (payload: { name: string; addresses: string[] }) => void
+  onSubmit?: (payload: { name: string; allowed_cidrs: string[] }) => void
 }) {
   const [open, setOpen] = useState(true)
   return (
@@ -107,7 +107,7 @@ describe('IpPolicyDialog', () => {
 
     expect(onSubmit).toHaveBeenCalledWith({
       name: 'Internal Network',
-      addresses: ['10.0.0.0/8', '203.0.113.42'],
+      allowed_cidrs: ['10.0.0.0/8', '203.0.113.42/32'],
     })
   })
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
index 80740c18f725f2..7013432893bdbc 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
@@ -1,4 +1,12 @@
-import { canSubmitIpPolicy, collectIpAddresses, validateIpEntry } from '../validate-ip-entry'
+import {
+  canSubmitIpPolicy,
+  collectAllowedCidrs,
+  collectIpAddresses,
+  IP_POLICY_CIDR_MAX_COUNT,
+  IP_POLICY_NAME_MAX_LENGTH,
+  toAllowedCidr,
+  validateIpEntry,
+} from '../validate-ip-entry'
 
 describe('validateIpEntry', () => {
   it('treats blank input as empty, not invalid', () => {
@@ -86,3 +94,35 @@ describe('collectIpAddresses', () => {
     ])
   })
 })
+
+describe('toAllowedCidr', () => {
+  it('appends /32 to bare IPv4 addresses and /128 to bare IPv6 addresses', () => {
+    expect(toAllowedCidr('203.0.113.42')).toBe('203.0.113.42/32')
+    expect(toAllowedCidr('::1')).toBe('::1/128')
+    expect(toAllowedCidr('10.0.0.0/8')).toBe('10.0.0.0/8')
+  })
+})
+
+describe('collectAllowedCidrs', () => {
+  it('normalizes submitted entries to CIDR notation', () => {
+    expect(collectAllowedCidrs([' 203.0.113.42 ', '', '10.0.0.0/8'])).toEqual([
+      '203.0.113.42/32',
+      '10.0.0.0/8',
+    ])
+  })
+})
+
+describe('canSubmitIpPolicy limits', () => {
+  it('rejects names longer than the API maximum', () => {
+    expect(canSubmitIpPolicy('n'.repeat(IP_POLICY_NAME_MAX_LENGTH + 1), ['10.0.0.0/8'])).toBe(false)
+    expect(canSubmitIpPolicy('n'.repeat(IP_POLICY_NAME_MAX_LENGTH), ['10.0.0.0/8'])).toBe(true)
+  })
+
+  it('rejects more CIDRs than the API maximum', () => {
+    const cidrs = Array.from(
+      { length: IP_POLICY_CIDR_MAX_COUNT + 1 },
+      (_, index) => `10.0.0.${index}`,
+    )
+    expect(canSubmitIpPolicy('Office', cidrs)).toBe(false)
+  })
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 2f9a62ae7ff375..7b8fe20e3cc2f1 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -1,13 +1,82 @@
 'use client'
 
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import { Button } from '@langgenius/dify-ui/button'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useQueryState } from 'nuqs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { getNetworkAccessErrorStatus } from '@/app/components/app/access-point/access-control/network-access'
+import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
+import {
+  pricingQueryParamName,
+  pricingQueryParser,
+} from '@/app/components/billing/pricing/query-params'
+import { consoleQuery } from '@/service/console'
 import { IpPolicyDialog } from './policy-dialog'
+import { PolicyItem } from './policy-item'
+
+type DialogState = { mode: 'create' } | { mode: 'edit'; group: NetworkAccessGroupResponse } | null
+
+function IpPoliciesListSkeleton() {
+  const { t } = useTranslation()
+
+  return (
+    <div role="status" aria-label={t(($) => $.loading, { ns: 'common' })} className="space-y-2">
+      {Array.from({ length: 2 }, (_, index) => (
+        <div
+          key={index}
+          className="rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg p-4 shadow-xs"
+        >
+          <SkeletonContainer className="h-14">
+            <SkeletonRow>
+              <div className="flex flex-1 flex-col gap-1">
+                <SkeletonRectangle className="h-4 w-1/3 animate-pulse" />
+                <SkeletonRectangle className="h-3 w-1/2 animate-pulse" />
+              </div>
+            </SkeletonRow>
+          </SkeletonContainer>
+        </div>
+      ))}
+    </div>
+  )
+}
 
 export default function IpPoliciesPage() {
   const { t } = useTranslation()
-  const [dialogOpen, setDialogOpen] = useState(false)
+  const queryClient = useQueryClient()
+  const [_pricing, setPricing] = useQueryState(pricingQueryParamName, pricingQueryParser)
+  const groupsQuery = consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions({
+    retry: false,
+  })
+  const { data, isPending, isError } = useQuery(groupsQuery)
+  const createGroup = useMutation(
+    consoleQuery.workspaces.current.networkAccessGroups.post.mutationOptions(),
+  )
+  const updateGroup = useMutation(
+    consoleQuery.workspaces.current.networkAccessGroups.byGroupId.put.mutationOptions(),
+  )
+  const [dialogState, setDialogState] = useState<DialogState>(null)
+  const groups = data?.groups ?? []
+  const entitled = data?.entitled === true
+  const editingGroup = dialogState?.mode === 'edit' ? dialogState.group : null
+  const isSaving = createGroup.isPending || updateGroup.isPending
+
+  const refreshGroupsAfterConflict = async (groupId?: string) => {
+    const refreshed = await queryClient.fetchQuery(groupsQuery)
+    if (!groupId) return
+    const nextGroup = refreshed.groups.find((group) => group.id === groupId)
+    setDialogState(nextGroup ? { mode: 'edit', group: nextGroup } : null)
+  }
+
+  const handleOpenCreate = () => {
+    if (isError) return
+    if (!entitled) {
+      void setPricing('open')
+      return
+    }
+    setDialogState({ mode: 'create' })
+  }
 
   return (
     <div className="flex flex-col gap-4">
@@ -20,21 +89,92 @@ export default function IpPoliciesPage() {
             {t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })}
           </p>
         </div>
-        <Button variant="primary" size="small" onClick={() => setDialogOpen(true)}>
+        <Button variant="primary" size="small" onClick={handleOpenCreate}>
           {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
         </Button>
       </div>
 
-      <div className="flex flex-col items-center gap-1 py-10 text-center">
-        <p className="system-sm-medium text-text-secondary">
-          {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
-        </p>
-        <p className="max-w-md system-xs-regular text-text-tertiary">
-          {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
+      {isPending && <IpPoliciesListSkeleton />}
+      {!isPending && isError && (
+        <p className="py-10 text-center system-sm-regular text-text-tertiary">
+          {t(($) => $['common.loadFailed'], { ns: 'deployments' })}
         </p>
-      </div>
+      )}
+
+      {!isPending && !isError && groups.length === 0 && (
+        <div className="flex flex-col items-center gap-1 py-10 text-center">
+          <p className="system-sm-medium text-text-secondary">
+            {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+          </p>
+          <p className="max-w-md system-xs-regular text-text-tertiary">
+            {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
+          </p>
+        </div>
+      )}
+
+      {!isPending && groups.length > 0 && (
+        <div className="flex flex-col gap-2">
+          {groups.map((group) => (
+            <PolicyItem
+              key={group.id}
+              group={group}
+              canMutate={entitled}
+              onEdit={(nextGroup) => setDialogState({ mode: 'edit', group: nextGroup })}
+            />
+          ))}
+        </div>
+      )}
+
+      {dialogState && (
+        <IpPolicyDialog
+          mode={dialogState.mode}
+          open
+          initialName={editingGroup?.name}
+          initialEntries={editingGroup?.allowed_cidrs}
+          usedByCount={editingGroup?.used_by_count}
+          referencedApps={editingGroup?.apps}
+          isPending={isSaving}
+          onOpenChange={(open) => {
+            if (!open) setDialogState(null)
+          }}
+          onSubmit={(payload) => {
+            if (editingGroup) {
+              updateGroup.mutate(
+                {
+                  params: { group_id: editingGroup.id },
+                  body: {
+                    name: payload.name,
+                    description: editingGroup.description ?? '',
+                    allowed_cidrs: payload.allowed_cidrs,
+                    expected_version: editingGroup.version,
+                  },
+                },
+                {
+                  onSuccess: () => setDialogState(null),
+                  onError: (error) => {
+                    if (getNetworkAccessErrorStatus(error) !== 409) return
+                    void refreshGroupsAfterConflict(editingGroup.id)
+                  },
+                },
+              )
+              return
+            }
 
-      {dialogOpen && <IpPolicyDialog mode="create" open onOpenChange={setDialogOpen} />}
+            createGroup.mutate(
+              {
+                body: {
+                  name: payload.name,
+                  description: '',
+                  allowed_cidrs: payload.allowed_cidrs,
+                },
+              },
+              {
+                onSuccess: () => setDialogState(null),
+              },
+            )
+          }}
+        />
+      )}
     </div>
   )
 }
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 8bacd3a0b721b1..7252f3afd65064 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import { Button } from '@langgenius/dify-ui/button'
 import {
   Dialog,
@@ -15,11 +16,16 @@ import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { AllowlistField } from './allowlist-field'
 import { createAllowlistRow } from './allowlist-row'
-import { canSubmitIpPolicy, collectIpAddresses } from './validate-ip-entry'
+import { PolicyReferencedApps } from './referenced-apps'
+import {
+  canSubmitIpPolicy,
+  collectAllowedCidrs,
+  IP_POLICY_NAME_MAX_LENGTH,
+} from './validate-ip-entry'
 
 export type IpPolicyDialogSubmit = {
   name: string
-  addresses: string[]
+  allowed_cidrs: string[]
 }
 
 type IpPolicyDialogProps = {
@@ -28,6 +34,9 @@ type IpPolicyDialogProps = {
   currentIp?: string
   initialName?: string
   initialEntries?: readonly string[]
+  usedByCount?: number
+  referencedApps?: NetworkAccessGroupResponse['apps']
+  isPending?: boolean
   onOpenChange: (open: boolean) => void
   onSubmit?: (payload: IpPolicyDialogSubmit) => void
 }
@@ -38,6 +47,9 @@ export function IpPolicyDialog({
   currentIp,
   initialName = '',
   initialEntries,
+  usedByCount = 0,
+  referencedApps = [],
+  isPending = false,
   onOpenChange,
   onSubmit,
 }: IpPolicyDialogProps) {
@@ -68,6 +80,17 @@ export function IpPolicyDialog({
             <DialogDescription className="system-sm-regular text-text-tertiary">
               {t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
             </DialogDescription>
+            {mode === 'edit' && usedByCount > 0 && (
+              <div className="flex flex-col gap-1.5">
+                <p className="system-xs-regular text-text-warning">
+                  {t(($) => $['settings.ipPolicyEditUsedBy'], {
+                    ns: 'common',
+                    count: usedByCount,
+                  })}
+                </p>
+                <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
+              </div>
+            )}
           </div>
           <DialogClose
             render={
@@ -89,7 +112,7 @@ export function IpPolicyDialog({
             if (!canSubmit) return
             onSubmit?.({
               name: name.trim(),
-              addresses: collectIpAddresses(entryValues),
+              allowed_cidrs: collectAllowedCidrs(entryValues),
             })
           }}
         >
@@ -97,6 +120,7 @@ export function IpPolicyDialog({
             <FieldLabel>{t(($) => $['settings.ipPolicyName'], { ns: 'common' })}</FieldLabel>
             <Input
               value={name}
+              maxLength={IP_POLICY_NAME_MAX_LENGTH}
               placeholder={t(($) => $['settings.ipPolicyNamePlaceholder'], { ns: 'common' })}
               onChange={(event) => setName(event.currentTarget.value)}
             />
@@ -108,7 +132,12 @@ export function IpPolicyDialog({
             <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </Button>
-            <Button type="submit" variant="primary" disabled={!canSubmit}>
+            <Button
+              type="submit"
+              variant="primary"
+              disabled={!canSubmit || isPending}
+              loading={isPending}
+            >
               {mode === 'edit'
                 ? t(($) => $['operation.save'], { ns: 'common' })
                 : t(($) => $['settings.ipPolicyCreate'], { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
new file mode 100644
index 00000000000000..5794366f9eb3c9
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -0,0 +1,153 @@
+'use client'
+
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
+import type { AppIconType } from '@/types/app'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
+import { Button } from '@langgenius/dify-ui/button'
+import { useMutation } from '@tanstack/react-query'
+import { useState } from 'react'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+import { consoleQuery } from '@/service/console'
+import { PolicyReferencedApps } from './referenced-apps'
+import { splitPolicySummary } from './validate-ip-entry'
+
+function toAppIconType(iconType: string | null | undefined): AppIconType | undefined {
+  if (iconType === 'image' || iconType === 'emoji' || iconType === 'link') return iconType
+}
+
+type PolicyItemProps = {
+  group: NetworkAccessGroupResponse
+  canMutate: boolean
+  onEdit: (group: NetworkAccessGroupResponse) => void
+}
+
+export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
+  const { t } = useTranslation()
+  const [confirmDelete, setConfirmDelete] = useState(false)
+  const deleteGroup = useMutation(
+    consoleQuery.workspaces.current.networkAccessGroups.byGroupId.delete.mutationOptions(),
+  )
+  const summary = splitPolicySummary(group.allowed_cidrs)
+  const isBound = group.used_by_count > 0
+  const usedByNames = group.apps.map((app) => app.name).filter(Boolean)
+
+  const handleDelete = () => {
+    if (!canMutate) return
+
+    deleteGroup.mutate(
+      {
+        params: { group_id: group.id },
+        query: { expected_version: group.version },
+      },
+      {
+        onSuccess: () => {
+          setConfirmDelete(false)
+        },
+      },
+    )
+  }
+
+  return (
+    <div className="group flex items-center rounded-xl border-[0.5px] border-transparent bg-components-input-bg-normal px-4 py-3 focus-within:border-components-input-border-active focus-within:shadow-xs hover:border-components-input-border-active hover:shadow-xs">
+      <div className="min-w-0 flex-1">
+        <p className="truncate system-sm-medium text-text-secondary">{group.name}</p>
+        <p className="truncate system-xs-regular text-text-tertiary">
+          {summary.listed.length === 0
+            ? t(($) => $['studio.accessControl.policySummaryNone'], { ns: 'deployments' })
+            : summary.listed.length === 1
+              ? t(($) => $['studio.accessControl.policySummaryOne'], {
+                  ns: 'deployments',
+                  address: summary.listed[0],
+                })
+              : summary.moreCount > 0
+                ? t(($) => $['studio.accessControl.policySummaryMany'], {
+                    ns: 'deployments',
+                    listed: summary.listed.join(', '),
+                    count: summary.moreCount,
+                  })
+                : t(($) => $['studio.accessControl.policySummaryTwo'], {
+                    ns: 'deployments',
+                    first: summary.listed[0],
+                    second: summary.listed[1],
+                  })}
+        </p>
+        {isBound && (
+          <div className="mt-1.5 flex min-w-0 items-center gap-1.5">
+            <div className="flex items-center -space-x-1">
+              {group.apps.slice(0, 3).map((app) => (
+                <AppIcon
+                  key={app.id}
+                  size="xs"
+                  decorative
+                  iconType={toAppIconType(app.icon_type)}
+                  icon={app.icon ?? undefined}
+                  background={app.icon_background}
+                  className="rounded-sm ring-1 ring-components-panel-bg"
+                />
+              ))}
+            </div>
+            <p className="min-w-0 truncate system-xs-regular text-text-tertiary">
+              {usedByNames.length > 0
+                ? usedByNames.join(', ')
+                : t(($) => $['settings.ipPolicyUsedBy'], {
+                    ns: 'common',
+                    count: group.used_by_count,
+                  })}
+            </p>
+          </div>
+        )}
+      </div>
+      <div className="pointer-events-none flex shrink-0 items-center gap-1 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
+        <Button disabled={!canMutate} onClick={() => canMutate && onEdit(group)}>
+          <span className="i-ri-edit-line size-4" aria-hidden="true" />
+          {t(($) => $['operation.edit'], { ns: 'common' })}
+        </Button>
+        <Button disabled={!canMutate} onClick={() => canMutate && setConfirmDelete(true)}>
+          <span className="i-ri-delete-bin-line size-4" aria-hidden="true" />
+          {t(($) => $['operation.delete'], { ns: 'common' })}
+        </Button>
+      </div>
+      <AlertDialog open={confirmDelete} onOpenChange={setConfirmDelete}>
+        <AlertDialogContent backdropProps={{ forceRender: true }} className="w-100">
+          <div className="flex flex-col gap-2 p-6 pb-4">
+            <AlertDialogTitle className="title-xl-semi-bold text-text-primary">
+              {t(($) => $['settings.ipPolicyDeleteConfirm'], { ns: 'common', name: group.name })}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="system-sm-regular text-text-secondary">
+              {isBound
+                ? t(($) => $['settings.ipPolicyDeleteBoundDescription'], {
+                    ns: 'common',
+                    name: group.name,
+                    count: group.used_by_count,
+                  })
+                : t(($) => $['settings.ipPolicyDeleteDescription'], { ns: 'common' })}
+            </AlertDialogDescription>
+            {isBound && (
+              <PolicyReferencedApps apps={group.apps} usedByCount={group.used_by_count} />
+            )}
+          </div>
+          <AlertDialogActions>
+            <AlertDialogCancelButton variant="secondary">
+              {t(($) => $['operation.cancel'], { ns: 'common' })}
+            </AlertDialogCancelButton>
+            <AlertDialogConfirmButton
+              disabled={!canMutate || deleteGroup.isPending}
+              onClick={handleDelete}
+            >
+              {t(($) => $['operation.delete'], { ns: 'common' })}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
+    </div>
+  )
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
new file mode 100644
index 00000000000000..393fc30ce726e1
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
@@ -0,0 +1,56 @@
+'use client'
+
+import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
+import type { AppIconType } from '@/types/app'
+import { useTranslation } from 'react-i18next'
+import AppIcon from '@/app/components/base/app-icon'
+
+type PolicyReferencedAppsProps = {
+  apps: NetworkAccessGroupResponse['apps']
+  usedByCount: number
+}
+
+function toAppIconType(iconType: string | null | undefined): AppIconType | undefined {
+  if (iconType === 'image' || iconType === 'emoji' || iconType === 'link') return iconType
+}
+
+export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedAppsProps) {
+  const { t } = useTranslation()
+
+  if (apps.length === 0) {
+    if (usedByCount <= 0) return null
+
+    return (
+      <p className="system-xs-regular text-text-tertiary">
+        {t(($) => $['settings.ipPolicyUsedBy'], { ns: 'common', count: usedByCount })}
+      </p>
+    )
+  }
+
+  return (
+    <ul className="flex flex-col gap-1">
+      {apps.map((app) => (
+        <li key={app.id}>
+          <a
+            href={`/app/${app.id}/overview`}
+            target="_blank"
+            rel="noreferrer"
+            className="flex min-w-0 items-center gap-1.5 rounded-md py-0.5 pr-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+          >
+            <AppIcon
+              size="xs"
+              decorative
+              iconType={toAppIconType(app.icon_type)}
+              icon={app.icon ?? undefined}
+              background={app.icon_background}
+              className="rounded-sm"
+            />
+            <span className="min-w-0 truncate system-xs-medium text-text-secondary">
+              {app.name}
+            </span>
+          </a>
+        </li>
+      ))}
+    </ul>
+  )
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
index c1421076974a7a..fdcc592e01384e 100644
--- a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -100,13 +100,17 @@ export function validateIpEntry(raw: string): IpEntryValidation {
   return { kind: 'invalid', code: 'unsupported' }
 }
 
+export const IP_POLICY_NAME_MAX_LENGTH = 100
+export const IP_POLICY_CIDR_MAX_COUNT = 100
+
 export function canSubmitIpPolicy(name: string, entries: readonly string[]) {
-  if (name.trim() === '') return false
+  const trimmedName = name.trim()
+  if (trimmedName === '' || trimmedName.length > IP_POLICY_NAME_MAX_LENGTH) return false
 
-  const trimmed = entries.map((entry) => entry.trim())
-  if (trimmed.every((entry) => entry === '')) return false
+  const cidrs = collectAllowedCidrs(entries)
+  if (cidrs.length === 0 || cidrs.length > IP_POLICY_CIDR_MAX_COUNT) return false
 
-  return trimmed.every((entry) => {
+  return entries.every((entry) => {
     const result = validateIpEntry(entry)
     return result.kind === 'empty' || result.kind === 'valid'
   })
@@ -115,3 +119,59 @@ export function canSubmitIpPolicy(name: string, entries: readonly string[]) {
 export function collectIpAddresses(entries: readonly string[]) {
   return entries.map((entry) => entry.trim()).filter((entry) => entry.length > 0)
 }
+
+export function toAllowedCidr(entry: string): string {
+  const value = entry.trim()
+  if (value.includes('/')) return value
+  if (value.includes(':')) return `${value}/128`
+  return `${value}/32`
+}
+
+export function collectAllowedCidrs(entries: readonly string[]) {
+  return collectIpAddresses(entries).map(toAllowedCidr)
+}
+
+export function splitPolicySummary(addresses: readonly string[]): {
+  listed: readonly string[]
+  moreCount: number
+} {
+  if (addresses.length <= 2) return { listed: addresses, moreCount: 0 }
+  return { listed: addresses.slice(0, 2), moreCount: addresses.length - 2 }
+}
+
+function ipv4ToInt(ip: string): number | null {
+  const parts = ip.split('.')
+  if (parts.length !== 4) return null
+
+  let value = 0
+  for (const part of parts) {
+    if (!/^\d+$/.test(part)) return null
+    const octet = Number(part)
+    if (octet > 255) return null
+    value = (value << 8) + octet
+  }
+
+  return value >>> 0
+}
+
+function ipv4InCidr(ip: string, network: string, prefix: number): boolean {
+  const ipInt = ipv4ToInt(ip)
+  const networkInt = ipv4ToInt(network)
+  if (ipInt === null || networkInt === null) return false
+  if (prefix === 0) return true
+  const mask = prefix === 32 ? 0xffffffff : ~((1 << (32 - prefix)) - 1) >>> 0
+  return (ipInt & mask) === (networkInt & mask)
+}
+
+export function policyIncludesIp(addresses: readonly string[], ip: string): boolean {
+  return addresses.some((entry) => {
+    const cidr = toAllowedCidr(entry)
+    const slash = cidr.indexOf('/')
+    const network = slash === -1 ? cidr : cidr.slice(0, slash)
+    const prefix = slash === -1 ? (cidr.includes(':') ? 128 : 32) : Number(cidr.slice(slash + 1))
+    if (network.includes(':')) return cidr === ip || network === ip
+    if (entry === ip || network === ip) return true
+    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false
+    return ipv4InCidr(ip, network, prefix)
+  })
+}
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index eb69b5b0f3d4aa..225a74aece1a25 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 93e26661f2650d..8b721a7f967370 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index a84a4053562ca2..932b712f7bdd81 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index dd812a3bd8a207..0ab3427d1a9913 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 55b82ede36f090..2ac2b021d6db73 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index b1d03a9d0df354..86d86bfc5df567 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index e2c1ddaef0688d..ef9c34a809d8b2 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 3a0597bcd97a35..af066ebe2a3e0f 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 25998000dcac27..8d0e5ebe688f83 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index c0c24bc0f4cd03..71704aff0594e6 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "追加",
   "settings.ipPolicyAllowlist": "許可リスト",
   "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "有効な IPv6 アドレスではありません",
   "settings.ipPolicyEntryLeadingZeros": "先頭のゼロは使用できません",
   "settings.ipPolicyEntryMultipleSlashes": "「/」は 1 つだけ使用できます",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "プレフィックス長は 0〜{{max}} の範囲で指定してください",
   "settings.ipPolicyEntryUnsupported": "IPv4 / IPv6 アドレスと CIDR 範囲のみサポートしています",
   "settings.ipPolicyName": "名前",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "例：社内ネットワーク",
   "settings.ipPolicyNewTitle": "IP ポリシーを作成",
   "settings.ipPolicyRemoveEntry": "エントリを削除",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 6a9d56f621fc1b..9e7abc4a677004 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index e85c7682040893..f9e03d739aebf3 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index ddfa6f7a06b1d7..cfd81d2f6e46ee 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 0a3cefee6ab174..7822b7536fd23e 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index 48605759e59191..e973dbef156761 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 8ee85634fb2d04..c35dd659b59a66 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 1c67818d8dcbf4..0620d6b6d2822d 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index c7cd538bde3077..c16b0e8a1571ee 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index fab0bd659d810e..93ac7b9fd6e2fd 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 915ea0f93b926c..f475cd6d6f85e7 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index dcc10ec7e33a02..a43b6addf0a876 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 443789e55d5569..9e1fdfe365c4c5 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
+  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyDeleteBound": "This policy is in use",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
+  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyName": "Name",
+  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
+  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 722123cc88519f..541985f5d38aa3 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "添加",
   "settings.ipPolicyAllowlist": "允许列表",
   "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
+  "settings.ipPolicyCidrMax": "一条策略最多包含 {{max}} 个地址",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
+  "settings.ipPolicyDeleteBound": "该策略正在使用中",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} 已应用到 {{count}} 个应用。删除后这些应用将不再受 IP 限制，可从任意 IP 访问。其他登录与应用权限不变。",
+  "settings.ipPolicyDeleteConfirm": "删除“{{name}}”？",
+  "settings.ipPolicyDeleteDescription": "此操作无法撤销。",
   "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
+  "settings.ipPolicyEditUsedBy": "该策略已被 {{count}} 个应用使用。保存后会更新所有这些应用的允许列表。",
   "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 地址",
   "settings.ipPolicyEntryLeadingZeros": "不允许前导零",
   "settings.ipPolicyEntryMultipleSlashes": "只能包含一个“/”",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "前缀长度必须在 0–{{max}} 之间",
   "settings.ipPolicyEntryUnsupported": "仅支持 IPv4 / IPv6 地址和 CIDR 网段",
   "settings.ipPolicyName": "名称",
+  "settings.ipPolicyNameMax": "名称不能超过 {{max}} 个字符",
   "settings.ipPolicyNamePlaceholder": "例：内部网络",
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
+  "settings.ipPolicyUsedBy": "已被 {{count}} 个应用使用",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 0b68172b5f9851..14765e508930d3 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -563,10 +563,16 @@
   "settings.ipPolicyAddEntry": "新增",
   "settings.ipPolicyAllowlist": "允許清單",
   "settings.ipPolicyAllowlistHelp": "支援單一地址（203.0.113.42）或 CIDR 網段（10.0.0.0/8），IPv4 與 IPv6 皆可。",
+  "settings.ipPolicyCidrMax": "一條策略最多包含 {{max}} 個地址",
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
+  "settings.ipPolicyDeleteBound": "該策略正在使用中",
+  "settings.ipPolicyDeleteBoundDescription": "{{name}} 已套用到 {{count}} 個應用。刪除後這些應用將不再受 IP 限制，可從任意 IP 存取。其他登入與應用權限不變。",
+  "settings.ipPolicyDeleteConfirm": "刪除「{{name}}」？",
+  "settings.ipPolicyDeleteDescription": "此操作無法復原。",
   "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
+  "settings.ipPolicyEditUsedBy": "該策略已被 {{count}} 個應用使用。儲存後會更新所有這些應用的允許清單。",
   "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 位址",
   "settings.ipPolicyEntryLeadingZeros": "不允許前導零",
   "settings.ipPolicyEntryMultipleSlashes": "只能包含一個“/”",
@@ -575,9 +581,11 @@
   "settings.ipPolicyEntryPrefixRange": "前置碼長度必須在 0–{{max}} 之間",
   "settings.ipPolicyEntryUnsupported": "僅支援 IPv4 / IPv6 位址和 CIDR 網段",
   "settings.ipPolicyName": "名稱",
+  "settings.ipPolicyNameMax": "名稱不能超過 {{max}} 個字元",
   "settings.ipPolicyNamePlaceholder": "例：內部網路",
   "settings.ipPolicyNewTitle": "新增 IP 策略",
   "settings.ipPolicyRemoveEntry": "刪除條目",
+  "settings.ipPolicyUsedBy": "已被 {{count}} 個應用使用",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",
diff --git a/web/service/console/query-policies.ts b/web/service/console/query-policies.ts
index 48f35dc0e72613..35b41dd1bb06c9 100644
--- a/web/service/console/query-policies.ts
+++ b/web/service/console/query-policies.ts
@@ -15,6 +15,34 @@ export function createConsoleQuery(consoleClient: ConsoleClient) {
     experimental_defaults: {
       workspaces: {
         current: {
+          networkAccessGroups: {
+            post: {
+              mutationOptions: {
+                onSettled: (_data, error, _variables, _result, context) => {
+                  if (error) return
+                  return invalidateNetworkAccessGroupQueries(consoleQuery, context.client)
+                },
+              },
+            },
+            byGroupId: {
+              put: {
+                mutationOptions: {
+                  onSettled: (_data, error, _variables, _result, context) => {
+                    if (error) return
+                    return invalidateNetworkAccessGroupQueries(consoleQuery, context.client)
+                  },
+                },
+              },
+              delete: {
+                mutationOptions: {
+                  onSettled: (_data, error, _variables, _result, context) => {
+                    if (error) return
+                    return invalidateNetworkAccessGroupQueries(consoleQuery, context.client)
+                  },
+                },
+              },
+            },
+          },
           rbac: {
             accessPolicies: {
               post: {
@@ -208,6 +236,16 @@ export function createConsoleQuery(consoleClient: ConsoleClient) {
         },
         byAppId: {
           // Shared invalidation uses onSettled so feature-owned onSuccess callbacks can coexist.
+          networkAccessGroup: {
+            put: {
+              mutationOptions: {
+                onSettled: (_data, error, _variables, _result, context) => {
+                  if (error) return
+                  return invalidateNetworkAccessGroupQueries(consoleQuery, context.client)
+                },
+              },
+            },
+          },
           apiEnable: {
             post: {
               mutationOptions: {
@@ -1242,6 +1280,17 @@ function invalidateQueryKeys(client: QueryClient, queryKeys: QueryKey[]) {
   return Promise.all(queryKeys.map((queryKey) => client.invalidateQueries({ queryKey })))
 }
 
+function invalidateNetworkAccessGroupQueries(
+  query: RouterUtils<ConsoleClient>,
+  client: QueryClient,
+) {
+  return invalidateQueryKeys(client, [
+    query.workspaces.current.networkAccessGroups.get.key(),
+    query.workspaces.current.networkAccessGroups.byGroupId.key(),
+    query.apps.byAppId.networkAccessGroup.key(),
+  ])
+}
+
 function invalidateAccessPolicyQueries(query: RouterUtils<ConsoleClient>, client: QueryClient) {
   return invalidateQueryKeys(client, [
     query.workspaces.current.rbac.key(),
diff --git a/web/test/console/network-access.ts b/web/test/console/network-access.ts
new file mode 100644
index 00000000000000..3c125e0c0eaed3
--- /dev/null
+++ b/web/test/console/network-access.ts
@@ -0,0 +1,66 @@
+import type { AppNetworkAccessGroupResponse } from '@dify/contracts/api/console/apps/types.gen'
+import type {
+  NetworkAccessGroupListResponse,
+  NetworkAccessGroupResponse,
+} from '@dify/contracts/api/console/workspaces/types.gen'
+import type { QueryClient } from '@tanstack/react-query'
+import { consoleQuery } from '@/service/console'
+
+export function createNetworkAccessGroupFixture(
+  overrides: Partial<NetworkAccessGroupResponse> = {},
+): NetworkAccessGroupResponse {
+  return {
+    id: 'group-1',
+    tenant_id: 'workspace-1',
+    name: 'Internal Network',
+    description: '',
+    allowed_cidrs: ['203.0.113.42/32', '198.51.100.0/24'],
+    app_ids: [],
+    apps: [],
+    used_by_count: 0,
+    version: 1,
+    created_at: '2026-01-01T00:00:00Z',
+    updated_at: '2026-01-01T00:00:00Z',
+    updated_by_account_id: null,
+    ...overrides,
+  }
+}
+
+export function seedNetworkAccessGroups(
+  queryClient: QueryClient,
+  overrides: Partial<NetworkAccessGroupListResponse> = {},
+): NetworkAccessGroupListResponse {
+  const data: NetworkAccessGroupListResponse = {
+    tenant_id: 'workspace-1',
+    entitled: true,
+    groups: [],
+    ...overrides,
+  }
+  queryClient.setQueryData(
+    consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions().queryKey,
+    data as never,
+  )
+  return data
+}
+
+export function seedAppNetworkAccessGroup(
+  queryClient: QueryClient,
+  appId: string,
+  overrides: Partial<AppNetworkAccessGroupResponse> = {},
+): AppNetworkAccessGroupResponse {
+  const data: AppNetworkAccessGroupResponse = {
+    tenant_id: 'workspace-1',
+    app_id: appId,
+    entitled: true,
+    available_access_points: ['webapp', 'service_api', 'mcp'],
+    binding: null,
+    ...overrides,
+  }
+  queryClient.setQueryData(
+    consoleQuery.apps.byAppId.networkAccessGroup.get.queryOptions({
+      input: { params: { app_id: appId } },
+    }).queryKey,
+    data,
+  )
+  return data
+}

From 225a04c2bf7c8e9bed349823ce54571de4b05b83 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 10 Sep 2026 18:02:58 +0800
Subject: [PATCH 022/108] test(web): cover IP Policy create posting to network
 access groups

The create dialog used to swallow submit when onSubmit was omitted.
Keep a page-level assertion that Create sends the console POST.
---
 .../ip-policies-page/__tests__/index.spec.tsx | 48 ++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 8494d37e601843..a06dfc8f3070cb 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -1,4 +1,4 @@
-import { screen, within } from '@testing-library/react'
+import { screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import {
@@ -63,6 +63,52 @@ describe('IpPoliciesPage', () => {
     expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
   })
 
+  it('posts a new policy when Create is clicked', async () => {
+    const user = userEvent.setup()
+    const created = createNetworkAccessGroupFixture({ name: 'Office' })
+    const posted: Array<{ method: string; url: string; body: unknown }> = []
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      const bodyText =
+        request.method === 'GET' || request.method === 'HEAD' ? '' : await request.text()
+      posted.push({
+        method: request.method,
+        url: request.url,
+        body: bodyText ? JSON.parse(bodyText) : null,
+      })
+      return new Response(JSON.stringify({ group: created, entitled: true }), {
+        status: 201,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient },
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Add' }))
+    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+    expect(screen.getByRole('button', { name: 'Create' })).toBeEnabled()
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(posted).toContainEqual({
+        method: 'POST',
+        url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups',
+        body: {
+          name: 'Office',
+          description: '',
+          allowed_cidrs: ['10.0.0.0/8'],
+        },
+      })
+    })
+  })
+
   it('lists existing policies and opens edit from the row', async () => {
     const user = userEvent.setup()
     const queryClient = createConsoleQueryClient()

From d9a90756362d51e3f83dbfc00b60693b2ad18d2d Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 10 Sep 2026 18:36:10 +0800
Subject: [PATCH 023/108] fix(web): match IP Policy Used by chips to Figma

Move Used by into the edit dialog body as a labeled field of app chips
with icon, name, and an external-link arrow.
---
 .../ip-policies-page/__tests__/index.spec.tsx | 10 +++------
 .../ip-policies-page/policy-dialog.tsx        | 22 +++++++++----------
 .../ip-policies-page/referenced-apps.tsx      | 16 ++++++++------
 web/i18n/ar-TN/common.json                    |  1 +
 web/i18n/de-DE/common.json                    |  1 +
 web/i18n/en-US/common.json                    |  1 +
 web/i18n/es-ES/common.json                    |  1 +
 web/i18n/fa-IR/common.json                    |  1 +
 web/i18n/fr-FR/common.json                    |  1 +
 web/i18n/hi-IN/common.json                    |  1 +
 web/i18n/id-ID/common.json                    |  1 +
 web/i18n/it-IT/common.json                    |  1 +
 web/i18n/ja-JP/common.json                    |  1 +
 web/i18n/ko-KR/common.json                    |  1 +
 web/i18n/lo-LA/common.json                    |  1 +
 web/i18n/nl-NL/common.json                    |  1 +
 web/i18n/pl-PL/common.json                    |  1 +
 web/i18n/pt-BR/common.json                    |  1 +
 web/i18n/ro-RO/common.json                    |  1 +
 web/i18n/ru-RU/common.json                    |  1 +
 web/i18n/sl-SI/common.json                    |  1 +
 web/i18n/th-TH/common.json                    |  1 +
 web/i18n/tr-TR/common.json                    |  1 +
 web/i18n/uk-UA/common.json                    |  1 +
 web/i18n/vi-VN/common.json                    |  1 +
 web/i18n/zh-Hans/common.json                  |  1 +
 web/i18n/zh-Hant/common.json                  |  1 +
 27 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index a06dfc8f3070cb..1582334b77f844 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -25,8 +25,7 @@ const translations = vi.hoisted(() => ({
   'settings.ipPolicyDeleteBoundDescription':
     '{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
   'settings.ipPolicyDeleteConfirm': 'Delete “{{name}}”?',
-  'settings.ipPolicyEditUsedBy':
-    'This policy is used by {{count}} apps. Saving updates the allowlist for all of them.',
+  'settings.ipPolicyUsedByLabel': 'Used by',
   'settings.ipPolicyDialogDescription':
     'Specify which IP addresses or ranges can access your apps.',
   'settings.ipPolicyEditTitle': 'Edit IP Policy',
@@ -159,15 +158,12 @@ describe('IpPoliciesPage', () => {
     )
 
     await user.click(screen.getByRole('button', { name: 'Edit' }))
-    expect(
-      screen.getByText(
-        'This policy is used by 2 apps. Saving updates the allowlist for all of them.',
-      ),
-    ).toBeInTheDocument()
+    expect(screen.getByText('Used by')).toBeInTheDocument()
     expect(screen.getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
       'href',
       '/app/app-a/overview',
     )
+    expect(screen.getByRole('link', { name: 'Support Bot' })).toHaveAttribute('target', '_blank')
   })
 
   it('lets the user delete a referenced policy after confirming the impact', async () => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 7252f3afd65064..ab794d9cfb01ff 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -80,17 +80,6 @@ export function IpPolicyDialog({
             <DialogDescription className="system-sm-regular text-text-tertiary">
               {t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
             </DialogDescription>
-            {mode === 'edit' && usedByCount > 0 && (
-              <div className="flex flex-col gap-1.5">
-                <p className="system-xs-regular text-text-warning">
-                  {t(($) => $['settings.ipPolicyEditUsedBy'], {
-                    ns: 'common',
-                    count: usedByCount,
-                  })}
-                </p>
-                <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
-              </div>
-            )}
           </div>
           <DialogClose
             render={
@@ -106,7 +95,7 @@ export function IpPolicyDialog({
         </div>
 
         <form
-          className="flex min-h-0 flex-1 flex-col gap-6"
+          className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto"
           onSubmit={(event) => {
             event.preventDefault()
             if (!canSubmit) return
@@ -128,6 +117,15 @@ export function IpPolicyDialog({
 
           <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
 
+          {mode === 'edit' && usedByCount > 0 && (
+            <Field className="flex shrink-0 flex-col gap-3">
+              <FieldLabel>
+                {t(($) => $['settings.ipPolicyUsedByLabel'], { ns: 'common' })}
+              </FieldLabel>
+              <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
+            </Field>
+          )}
+
           <div className="flex shrink-0 items-center justify-end gap-2 pt-2">
             <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
               {t(($) => $['operation.cancel'], { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
index 393fc30ce726e1..6b4ba9edefa886 100644
--- a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
@@ -21,21 +21,21 @@ export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedApps
     if (usedByCount <= 0) return null
 
     return (
-      <p className="system-xs-regular text-text-tertiary">
+      <p className="system-sm-regular text-text-tertiary">
         {t(($) => $['settings.ipPolicyUsedBy'], { ns: 'common', count: usedByCount })}
       </p>
     )
   }
 
   return (
-    <ul className="flex flex-col gap-1">
+    <ul className="flex flex-wrap content-start items-start gap-2">
       {apps.map((app) => (
         <li key={app.id}>
           <a
             href={`/app/${app.id}/overview`}
             target="_blank"
             rel="noreferrer"
-            className="flex min-w-0 items-center gap-1.5 rounded-md py-0.5 pr-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+            className="flex min-h-7 items-center gap-1.5 rounded-md border border-components-panel-border-subtle bg-background-default py-1 pr-1.5 pl-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
           >
             <AppIcon
               size="xs"
@@ -43,11 +43,13 @@ export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedApps
               iconType={toAppIconType(app.icon_type)}
               icon={app.icon ?? undefined}
               background={app.icon_background}
-              className="rounded-sm"
+              className="size-5 rounded-sm"
+            />
+            <span className="system-sm-medium whitespace-nowrap text-text-primary">{app.name}</span>
+            <span
+              aria-hidden
+              className="i-ri-arrow-right-up-line size-3.5 shrink-0 text-text-tertiary"
             />
-            <span className="min-w-0 truncate system-xs-medium text-text-secondary">
-              {app.name}
-            </span>
           </a>
         </li>
       ))}
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index 225a74aece1a25..179e74268ee9bb 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "مستخدم بواسطة",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 8b721a7f967370..ffee75e285adcd 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Verwendet von",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 932b712f7bdd81..0e437023f1c4e8 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Used by",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 0ab3427d1a9913..e7c83ff0400110 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Usado por",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 2ac2b021d6db73..021c24ea8728bf 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "استفاده‌شده توسط",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 86d86bfc5df567..7d965129040f50 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Utilisé par",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index ef9c34a809d8b2..cfa064d2f9885f 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "इनके द्वारा उपयोग",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index af066ebe2a3e0f..0fdd18650d8973 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Digunakan oleh",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 8d0e5ebe688f83..0c94e9cb72e0d6 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Usato da",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 71704aff0594e6..20a6d2709fc9c7 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "IP ポリシーを作成",
   "settings.ipPolicyRemoveEntry": "エントリを削除",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "使用中",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 9e7abc4a677004..c48653de962ba9 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "사용 중",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index f9e03d739aebf3..76d146a8cbbb78 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "ຖືກໃຊ້ໂດຍ",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index cfd81d2f6e46ee..5a15050ab6ad58 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Gebruikt door",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 7822b7536fd23e..5228d7ff9f2a0e 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Używane przez",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index e973dbef156761..ad96f2a9417cc6 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Usado por",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index c35dd659b59a66..6a2e05f37f5ac6 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Folosit de",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 0620d6b6d2822d..634a86e1f2c813 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Используется",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index c16b0e8a1571ee..782488ba15ac74 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Uporablja",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 93ac7b9fd6e2fd..f5285c94745a50 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "ถูกใช้โดย",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index f475cd6d6f85e7..8380b77fe8e0d7 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Kullanan",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index a43b6addf0a876..b91aee1673e3b1 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Використовується",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 9e1fdfe365c4c5..513fac82cd04c8 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedByLabel": "Được dùng bởi",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 541985f5d38aa3..6945458b49a9a6 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
   "settings.ipPolicyUsedBy": "已被 {{count}} 个应用使用",
+  "settings.ipPolicyUsedByLabel": "被用于",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 14765e508930d3..133df2a28e18a0 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -586,6 +586,7 @@
   "settings.ipPolicyNewTitle": "新增 IP 策略",
   "settings.ipPolicyRemoveEntry": "刪除條目",
   "settings.ipPolicyUsedBy": "已被 {{count}} 個應用使用",
+  "settings.ipPolicyUsedByLabel": "被用於",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",

From f918053db3762bb3cf8ee8e404a78edb50e28916 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 10 Sep 2026 23:07:21 +0800
Subject: [PATCH 024/108] fix(web): restyle Settings IP Policies list as a
 table

Match the Figma list: name, IP entry count, enforcing apps, relative
updated time, and a row menu for edit and delete.
---
 .../ip-policies-page/__tests__/index.spec.tsx |  22 ++-
 .../ip-policies-page/index.tsx                |  48 ++++--
 .../ip-policies-page/policy-item.tsx          | 148 ++++++++++--------
 web/i18n/ar-TN/common.json                    |   7 +
 web/i18n/de-DE/common.json                    |   7 +
 web/i18n/en-US/common.json                    |   7 +
 web/i18n/es-ES/common.json                    |   7 +
 web/i18n/fa-IR/common.json                    |   7 +
 web/i18n/fr-FR/common.json                    |   7 +
 web/i18n/hi-IN/common.json                    |   7 +
 web/i18n/id-ID/common.json                    |   7 +
 web/i18n/it-IT/common.json                    |   7 +
 web/i18n/ja-JP/common.json                    |   7 +
 web/i18n/ko-KR/common.json                    |   7 +
 web/i18n/lo-LA/common.json                    |   7 +
 web/i18n/nl-NL/common.json                    |   7 +
 web/i18n/pl-PL/common.json                    |   7 +
 web/i18n/pt-BR/common.json                    |   7 +
 web/i18n/ro-RO/common.json                    |   7 +
 web/i18n/ru-RU/common.json                    |   7 +
 web/i18n/sl-SI/common.json                    |   7 +
 web/i18n/th-TH/common.json                    |   7 +
 web/i18n/tr-TR/common.json                    |   7 +
 web/i18n/uk-UA/common.json                    |   7 +
 web/i18n/vi-VN/common.json                    |   7 +
 web/i18n/zh-Hans/common.json                  |   7 +
 web/i18n/zh-Hant/common.json                  |   7 +
 27 files changed, 304 insertions(+), 82 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 1582334b77f844..9fc8014774657e 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -13,6 +13,7 @@ const translations = vi.hoisted(() => ({
   'operation.close': 'Close',
   'operation.delete': 'Delete',
   'operation.edit': 'Edit',
+  'operation.moreActionsFor': 'More actions for {{name}}',
   'settings.ipPolicies': 'IP Policies',
   'settings.ipPoliciesDescription':
     'Reusable rules that control which IP addresses or ranges can access your apps',
@@ -20,7 +21,14 @@ const translations = vi.hoisted(() => ({
   'settings.ipPolicyAllowlist': 'Allowlist',
   'settings.ipPolicyAllowlistHelp':
     'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
+  'settings.ipPolicyColumnEnforcing': 'Enforcing',
+  'settings.ipPolicyColumnIpEntries': 'IP entries',
+  'settings.ipPolicyColumnName': 'Name',
+  'settings.ipPolicyColumnUpdatedAt': 'Updated at',
   'settings.ipPolicyCreate': 'Create',
+  'settings.ipPolicyEnforcingMany': '{{count}} apps',
+  'settings.ipPolicyEnforcingNone': '0 apps',
+  'settings.ipPolicyEnforcingOne': '1 app',
   'settings.ipPolicyDeleteBound': 'This policy is in use',
   'settings.ipPolicyDeleteBoundDescription':
     '{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
@@ -123,7 +131,13 @@ describe('IpPoliciesPage', () => {
     )
 
     expect(screen.getByText('Internal Network')).toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(screen.getByText('Name')).toBeInTheDocument()
+    expect(screen.getByText('IP entries')).toBeInTheDocument()
+    expect(screen.getByText('Enforcing')).toBeInTheDocument()
+    expect(screen.getByText('2')).toBeInTheDocument()
+    expect(screen.getByText('0 apps')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+    await user.click(screen.getByRole('menuitem', { name: 'Edit' }))
     expect(screen.getByRole('heading', { name: 'Edit IP Policy' })).toBeInTheDocument()
     expect(screen.getByDisplayValue('Internal Network')).toBeInTheDocument()
   })
@@ -157,7 +171,8 @@ describe('IpPoliciesPage', () => {
       { queryClient },
     )
 
-    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+    await user.click(screen.getByRole('menuitem', { name: 'Edit' }))
     expect(screen.getByText('Used by')).toBeInTheDocument()
     expect(screen.getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
       'href',
@@ -195,7 +210,8 @@ describe('IpPoliciesPage', () => {
       { queryClient },
     )
 
-    await user.click(screen.getAllByRole('button', { name: 'Delete' })[0] as HTMLElement)
+    await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+    await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
     expect(screen.getByRole('heading', { name: 'Delete “Internal Network”?' })).toBeInTheDocument()
     expect(
       screen.getByText(
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 7b8fe20e3cc2f1..072ad56b5c60ab 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -14,7 +14,15 @@ import {
 } from '@/app/components/billing/pricing/query-params'
 import { consoleQuery } from '@/service/console'
 import { IpPolicyDialog } from './policy-dialog'
-import { PolicyItem } from './policy-item'
+import {
+  policyActionsColClassName,
+  policyEnforcingColClassName,
+  policyIpEntriesColClassName,
+  PolicyItem,
+  policyNameColClassName,
+  policyRowClassName,
+  policyUpdatedColClassName,
+} from './policy-item'
 
 type DialogState = { mode: 'create' } | { mode: 'edit'; group: NetworkAccessGroupResponse } | null
 
@@ -22,20 +30,18 @@ function IpPoliciesListSkeleton() {
   const { t } = useTranslation()
 
   return (
-    <div role="status" aria-label={t(($) => $.loading, { ns: 'common' })} className="space-y-2">
+    <div role="status" aria-label={t(($) => $.loading, { ns: 'common' })}>
       {Array.from({ length: 2 }, (_, index) => (
-        <div
-          key={index}
-          className="rounded-xl border-[0.5px] border-components-card-border bg-components-card-bg p-4 shadow-xs"
-        >
-          <SkeletonContainer className="h-14">
+        <div key={index} className={`${policyRowClassName} border-b border-divider-subtle py-3`}>
+          <SkeletonContainer className="h-4 min-w-0 flex-1">
             <SkeletonRow>
-              <div className="flex flex-1 flex-col gap-1">
-                <SkeletonRectangle className="h-4 w-1/3 animate-pulse" />
-                <SkeletonRectangle className="h-3 w-1/2 animate-pulse" />
-              </div>
+              <SkeletonRectangle className="h-4 w-1/2 animate-pulse" />
             </SkeletonRow>
           </SkeletonContainer>
+          <SkeletonRectangle className={`${policyIpEntriesColClassName} h-4 animate-pulse`} />
+          <SkeletonRectangle className={`${policyEnforcingColClassName} h-4 animate-pulse`} />
+          <SkeletonRectangle className={`${policyUpdatedColClassName} h-4 animate-pulse`} />
+          <div className={policyActionsColClassName} />
         </div>
       ))}
     </div>
@@ -90,6 +96,7 @@ export default function IpPoliciesPage() {
           </p>
         </div>
         <Button variant="primary" size="small" onClick={handleOpenCreate}>
+          <span aria-hidden className="i-ri-add-line size-4" />
           {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
         </Button>
       </div>
@@ -113,7 +120,24 @@ export default function IpPoliciesPage() {
       )}
 
       {!isPending && groups.length > 0 && (
-        <div className="flex flex-col gap-2">
+        <div className="min-w-0">
+          <div
+            className={`${policyRowClassName} border-b border-divider-subtle py-2 system-xs-medium-uppercase text-text-tertiary`}
+          >
+            <div className={policyNameColClassName}>
+              {t(($) => $['settings.ipPolicyColumnName'], { ns: 'common' })}
+            </div>
+            <div className={policyIpEntriesColClassName}>
+              {t(($) => $['settings.ipPolicyColumnIpEntries'], { ns: 'common' })}
+            </div>
+            <div className={policyEnforcingColClassName}>
+              {t(($) => $['settings.ipPolicyColumnEnforcing'], { ns: 'common' })}
+            </div>
+            <div className={policyUpdatedColClassName}>
+              {t(($) => $['settings.ipPolicyColumnUpdatedAt'], { ns: 'common' })}
+            </div>
+            <div className={policyActionsColClassName} />
+          </div>
           {groups.map((group) => (
             <PolicyItem
               key={group.id}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 5794366f9eb3c9..a87da162e545c7 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -1,7 +1,6 @@
 'use client'
 
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
-import type { AppIconType } from '@/types/app'
 import {
   AlertDialog,
   AlertDialogActions,
@@ -11,18 +10,27 @@ import {
   AlertDialogDescription,
   AlertDialogTitle,
 } from '@langgenius/dify-ui/alert-dialog'
-import { Button } from '@langgenius/dify-ui/button'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuSeparator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import AppIcon from '@/app/components/base/app-icon'
+import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { consoleQuery } from '@/service/console'
 import { PolicyReferencedApps } from './referenced-apps'
-import { splitPolicySummary } from './validate-ip-entry'
 
-function toAppIconType(iconType: string | null | undefined): AppIconType | undefined {
-  if (iconType === 'image' || iconType === 'emoji' || iconType === 'link') return iconType
-}
+export const policyRowClassName = 'flex items-center pl-3 pr-1'
+export const policyNameColClassName = 'min-w-0 flex-1 truncate'
+export const policyIpEntriesColClassName = 'w-30 shrink-0'
+export const policyEnforcingColClassName = 'w-32 shrink-0'
+export const policyUpdatedColClassName = 'w-52 shrink-0'
+export const policyActionsColClassName = 'flex w-8 shrink-0 items-center justify-center'
 
 type PolicyItemProps = {
   group: NetworkAccessGroupResponse
@@ -32,13 +40,22 @@ type PolicyItemProps = {
 
 export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
   const { t } = useTranslation()
+  const { formatTimeFromNow } = useFormatTimeFromNow()
+  const [menuOpen, setMenuOpen] = useState(false)
   const [confirmDelete, setConfirmDelete] = useState(false)
   const deleteGroup = useMutation(
     consoleQuery.workspaces.current.networkAccessGroups.byGroupId.delete.mutationOptions(),
   )
-  const summary = splitPolicySummary(group.allowed_cidrs)
   const isBound = group.used_by_count > 0
-  const usedByNames = group.apps.map((app) => app.name).filter(Boolean)
+  const enforcingLabel =
+    group.used_by_count <= 0
+      ? t(($) => $['settings.ipPolicyEnforcingNone'], { ns: 'common' })
+      : group.used_by_count === 1
+        ? t(($) => $['settings.ipPolicyEnforcingOne'], { ns: 'common' })
+        : t(($) => $['settings.ipPolicyEnforcingMany'], {
+            ns: 'common',
+            count: group.used_by_count,
+          })
 
   const handleDelete = () => {
     if (!canMutate) return
@@ -57,64 +74,61 @@ export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
   }
 
   return (
-    <div className="group flex items-center rounded-xl border-[0.5px] border-transparent bg-components-input-bg-normal px-4 py-3 focus-within:border-components-input-border-active focus-within:shadow-xs hover:border-components-input-border-active hover:shadow-xs">
-      <div className="min-w-0 flex-1">
-        <p className="truncate system-sm-medium text-text-secondary">{group.name}</p>
-        <p className="truncate system-xs-regular text-text-tertiary">
-          {summary.listed.length === 0
-            ? t(($) => $['studio.accessControl.policySummaryNone'], { ns: 'deployments' })
-            : summary.listed.length === 1
-              ? t(($) => $['studio.accessControl.policySummaryOne'], {
-                  ns: 'deployments',
-                  address: summary.listed[0],
-                })
-              : summary.moreCount > 0
-                ? t(($) => $['studio.accessControl.policySummaryMany'], {
-                    ns: 'deployments',
-                    listed: summary.listed.join(', '),
-                    count: summary.moreCount,
-                  })
-                : t(($) => $['studio.accessControl.policySummaryTwo'], {
-                    ns: 'deployments',
-                    first: summary.listed[0],
-                    second: summary.listed[1],
-                  })}
-        </p>
-        {isBound && (
-          <div className="mt-1.5 flex min-w-0 items-center gap-1.5">
-            <div className="flex items-center -space-x-1">
-              {group.apps.slice(0, 3).map((app) => (
-                <AppIcon
-                  key={app.id}
-                  size="xs"
-                  decorative
-                  iconType={toAppIconType(app.icon_type)}
-                  icon={app.icon ?? undefined}
-                  background={app.icon_background}
-                  className="rounded-sm ring-1 ring-components-panel-bg"
-                />
-              ))}
-            </div>
-            <p className="min-w-0 truncate system-xs-regular text-text-tertiary">
-              {usedByNames.length > 0
-                ? usedByNames.join(', ')
-                : t(($) => $['settings.ipPolicyUsedBy'], {
-                    ns: 'common',
-                    count: group.used_by_count,
-                  })}
-            </p>
-          </div>
-        )}
-      </div>
-      <div className="pointer-events-none flex shrink-0 items-center gap-1 opacity-0 transition-opacity group-focus-within:pointer-events-auto group-focus-within:opacity-100 group-hover:pointer-events-auto group-hover:opacity-100">
-        <Button disabled={!canMutate} onClick={() => canMutate && onEdit(group)}>
-          <span className="i-ri-edit-line size-4" aria-hidden="true" />
-          {t(($) => $['operation.edit'], { ns: 'common' })}
-        </Button>
-        <Button disabled={!canMutate} onClick={() => canMutate && setConfirmDelete(true)}>
-          <span className="i-ri-delete-bin-line size-4" aria-hidden="true" />
-          {t(($) => $['operation.delete'], { ns: 'common' })}
-        </Button>
+    <div className={`${policyRowClassName} border-b border-divider-subtle py-3`}>
+      <p className={`${policyNameColClassName} system-sm-medium text-text-secondary`}>
+        {group.name}
+      </p>
+      <p className={`${policyIpEntriesColClassName} system-sm-regular text-text-tertiary`}>
+        {group.allowed_cidrs.length}
+      </p>
+      <p className={`${policyEnforcingColClassName} system-sm-regular text-text-tertiary`}>
+        {enforcingLabel}
+      </p>
+      <p className={`${policyUpdatedColClassName} system-sm-regular text-text-tertiary`}>
+        {formatTimeFromNow(Date.parse(group.updated_at))}
+      </p>
+      <div className={policyActionsColClassName}>
+        <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>
+          <DropdownMenuTrigger
+            render={
+              <IconButton
+                size="md"
+                aria-label={t(($) => $['operation.moreActionsFor'], {
+                  ns: 'common',
+                  name: group.name,
+                })}
+                className="data-popup-open:bg-state-base-hover"
+              >
+                <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
+              </IconButton>
+            }
+          />
+          <DropdownMenuContent placement="bottom-end" sideOffset={4} className="min-w-35">
+            <DropdownMenuItem
+              disabled={!canMutate}
+              className="system-sm-semibold text-text-secondary"
+              onClick={() => {
+                if (!canMutate) return
+                onEdit(group)
+              }}
+            >
+              {t(($) => $['operation.edit'], { ns: 'common' })}
+            </DropdownMenuItem>
+            <DropdownMenuSeparator />
+            <DropdownMenuItem
+              disabled={!canMutate}
+              variant="destructive"
+              className="system-sm-semibold"
+              onClick={() => {
+                if (!canMutate) return
+                setConfirmDelete(true)
+                setMenuOpen(false)
+              }}
+            >
+              {t(($) => $['operation.delete'], { ns: 'common' })}
+            </DropdownMenuItem>
+          </DropdownMenuContent>
+        </DropdownMenu>
       </div>
       <AlertDialog open={confirmDelete} onOpenChange={setConfirmDelete}>
         <AlertDialogContent backdropProps={{ forceRender: true }} className="w-100">
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index 179e74268ee9bb..6dedf5fed9b3eb 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "ساري",
+  "settings.ipPolicyColumnIpEntries": "إدخالات IP",
+  "settings.ipPolicyColumnName": "الاسم",
+  "settings.ipPolicyColumnUpdatedAt": "آخر تحديث",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} تطبيقات",
+  "settings.ipPolicyEnforcingNone": "0 تطبيقات",
+  "settings.ipPolicyEnforcingOne": "تطبيق واحد",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index ffee75e285adcd..1dc71f753c4e9c 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Aktiv",
+  "settings.ipPolicyColumnIpEntries": "IP-Einträge",
+  "settings.ipPolicyColumnName": "Name",
+  "settings.ipPolicyColumnUpdatedAt": "Aktualisiert",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} Apps",
+  "settings.ipPolicyEnforcingNone": "0 Apps",
+  "settings.ipPolicyEnforcingOne": "1 App",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 0e437023f1c4e8..449aa9927f0b6c 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Enforcing",
+  "settings.ipPolicyColumnIpEntries": "IP entries",
+  "settings.ipPolicyColumnName": "Name",
+  "settings.ipPolicyColumnUpdatedAt": "Updated at",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} apps",
+  "settings.ipPolicyEnforcingNone": "0 apps",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index e7c83ff0400110..62472fd194b3d4 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "En vigor",
+  "settings.ipPolicyColumnIpEntries": "Entradas IP",
+  "settings.ipPolicyColumnName": "Nombre",
+  "settings.ipPolicyColumnUpdatedAt": "Actualizado",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} apps",
+  "settings.ipPolicyEnforcingNone": "0 apps",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 021c24ea8728bf..da7113012485bf 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "در حال اعمال",
+  "settings.ipPolicyColumnIpEntries": "ورودی‌های IP",
+  "settings.ipPolicyColumnName": "نام",
+  "settings.ipPolicyColumnUpdatedAt": "به‌روزرسانی",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} برنامه",
+  "settings.ipPolicyEnforcingNone": "۰ برنامه",
+  "settings.ipPolicyEnforcingOne": "۱ برنامه",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 7d965129040f50..e4d1e07f4958b7 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "En vigueur",
+  "settings.ipPolicyColumnIpEntries": "Entrées IP",
+  "settings.ipPolicyColumnName": "Nom",
+  "settings.ipPolicyColumnUpdatedAt": "Mis à jour",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} apps",
+  "settings.ipPolicyEnforcingNone": "0 app",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index cfa064d2f9885f..b9293da3e8a2f2 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "लागू",
+  "settings.ipPolicyColumnIpEntries": "IP प्रविष्टियाँ",
+  "settings.ipPolicyColumnName": "नाम",
+  "settings.ipPolicyColumnUpdatedAt": "अपडेट किया गया",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} ऐप",
+  "settings.ipPolicyEnforcingNone": "0 ऐप",
+  "settings.ipPolicyEnforcingOne": "1 ऐप",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 0fdd18650d8973..9cc3eaeee7c142 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Berlaku",
+  "settings.ipPolicyColumnIpEntries": "Entri IP",
+  "settings.ipPolicyColumnName": "Nama",
+  "settings.ipPolicyColumnUpdatedAt": "Diperbarui",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} aplikasi",
+  "settings.ipPolicyEnforcingNone": "0 aplikasi",
+  "settings.ipPolicyEnforcingOne": "1 aplikasi",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 0c94e9cb72e0d6..46de63d041c247 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "In vigore",
+  "settings.ipPolicyColumnIpEntries": "Voci IP",
+  "settings.ipPolicyColumnName": "Nome",
+  "settings.ipPolicyColumnUpdatedAt": "Aggiornato",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} app",
+  "settings.ipPolicyEnforcingNone": "0 app",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 20a6d2709fc9c7..7117cf812ee652 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "許可リスト",
   "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "適用中",
+  "settings.ipPolicyColumnIpEntries": "IP エントリ",
+  "settings.ipPolicyColumnName": "名前",
+  "settings.ipPolicyColumnUpdatedAt": "更新日時",
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} 件のアプリ",
+  "settings.ipPolicyEnforcingNone": "0 件のアプリ",
+  "settings.ipPolicyEnforcingOne": "1 件のアプリ",
   "settings.ipPolicyEntryInvalidIpv6": "有効な IPv6 アドレスではありません",
   "settings.ipPolicyEntryLeadingZeros": "先頭のゼロは使用できません",
   "settings.ipPolicyEntryMultipleSlashes": "「/」は 1 つだけ使用できます",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index c48653de962ba9..52cc46289c1213 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "적용 중",
+  "settings.ipPolicyColumnIpEntries": "IP 항목",
+  "settings.ipPolicyColumnName": "이름",
+  "settings.ipPolicyColumnUpdatedAt": "업데이트",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "앱 {{count}}개",
+  "settings.ipPolicyEnforcingNone": "앱 0개",
+  "settings.ipPolicyEnforcingOne": "앱 1개",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index 76d146a8cbbb78..aee97f3f3c6ce9 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "ກຳລັງນຳໃຊ້",
+  "settings.ipPolicyColumnIpEntries": "ລາຍການ IP",
+  "settings.ipPolicyColumnName": "ຊື່",
+  "settings.ipPolicyColumnUpdatedAt": "ອັບເດດ",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} ແອັບ",
+  "settings.ipPolicyEnforcingNone": "0 ແອັບ",
+  "settings.ipPolicyEnforcingOne": "1 ແອັບ",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 5a15050ab6ad58..7fa4620816be8b 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Actief",
+  "settings.ipPolicyColumnIpEntries": "IP-vermeldingen",
+  "settings.ipPolicyColumnName": "Naam",
+  "settings.ipPolicyColumnUpdatedAt": "Bijgewerkt",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} apps",
+  "settings.ipPolicyEnforcingNone": "0 apps",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 5228d7ff9f2a0e..b54b7a7616bb8a 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Wymuszane",
+  "settings.ipPolicyColumnIpEntries": "Wpisy IP",
+  "settings.ipPolicyColumnName": "Nazwa",
+  "settings.ipPolicyColumnUpdatedAt": "Zaktualizowano",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} aplikacji",
+  "settings.ipPolicyEnforcingNone": "0 aplikacji",
+  "settings.ipPolicyEnforcingOne": "1 aplikacja",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index ad96f2a9417cc6..4b511f33fcb670 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Em vigor",
+  "settings.ipPolicyColumnIpEntries": "Entradas de IP",
+  "settings.ipPolicyColumnName": "Nome",
+  "settings.ipPolicyColumnUpdatedAt": "Atualizado em",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} apps",
+  "settings.ipPolicyEnforcingNone": "0 apps",
+  "settings.ipPolicyEnforcingOne": "1 app",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 6a2e05f37f5ac6..f19b579cfe36c6 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "În vigoare",
+  "settings.ipPolicyColumnIpEntries": "Intrări IP",
+  "settings.ipPolicyColumnName": "Nume",
+  "settings.ipPolicyColumnUpdatedAt": "Actualizat",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} aplicații",
+  "settings.ipPolicyEnforcingNone": "0 aplicații",
+  "settings.ipPolicyEnforcingOne": "1 aplicație",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 634a86e1f2c813..c5273e3d403448 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Применяется",
+  "settings.ipPolicyColumnIpEntries": "IP-записи",
+  "settings.ipPolicyColumnName": "Название",
+  "settings.ipPolicyColumnUpdatedAt": "Обновлено",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} приложений",
+  "settings.ipPolicyEnforcingNone": "0 приложений",
+  "settings.ipPolicyEnforcingOne": "1 приложение",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 782488ba15ac74..3b39912ceb2e55 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "V veljavi",
+  "settings.ipPolicyColumnIpEntries": "IP vnosi",
+  "settings.ipPolicyColumnName": "Ime",
+  "settings.ipPolicyColumnUpdatedAt": "Posodobljeno",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} aplikacij",
+  "settings.ipPolicyEnforcingNone": "0 aplikacij",
+  "settings.ipPolicyEnforcingOne": "1 aplikacija",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index f5285c94745a50..7a169f5a2bb012 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "กำลังบังคับใช้",
+  "settings.ipPolicyColumnIpEntries": "รายการ IP",
+  "settings.ipPolicyColumnName": "ชื่อ",
+  "settings.ipPolicyColumnUpdatedAt": "อัปเดตเมื่อ",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} แอป",
+  "settings.ipPolicyEnforcingNone": "0 แอป",
+  "settings.ipPolicyEnforcingOne": "1 แอป",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 8380b77fe8e0d7..7bebb32a8458ad 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Uygulanıyor",
+  "settings.ipPolicyColumnIpEntries": "IP kayıtları",
+  "settings.ipPolicyColumnName": "Ad",
+  "settings.ipPolicyColumnUpdatedAt": "Güncellendi",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} uygulama",
+  "settings.ipPolicyEnforcingNone": "0 uygulama",
+  "settings.ipPolicyEnforcingOne": "1 uygulama",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index b91aee1673e3b1..7c8fa144e44912 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Застосовується",
+  "settings.ipPolicyColumnIpEntries": "IP-записи",
+  "settings.ipPolicyColumnName": "Назва",
+  "settings.ipPolicyColumnUpdatedAt": "Оновлено",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} застосунків",
+  "settings.ipPolicyEnforcingNone": "0 застосунків",
+  "settings.ipPolicyEnforcingOne": "1 застосунок",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 513fac82cd04c8..a6e00910968026 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
+  "settings.ipPolicyColumnEnforcing": "Đang áp dụng",
+  "settings.ipPolicyColumnIpEntries": "Mục IP",
+  "settings.ipPolicyColumnName": "Tên",
+  "settings.ipPolicyColumnUpdatedAt": "Cập nhật",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEnforcingMany": "{{count}} ứng dụng",
+  "settings.ipPolicyEnforcingNone": "0 ứng dụng",
+  "settings.ipPolicyEnforcingOne": "1 ứng dụng",
   "settings.ipPolicyEntryInvalidIpv6": "Not a valid IPv6 address",
   "settings.ipPolicyEntryLeadingZeros": "Leading zeros are not allowed",
   "settings.ipPolicyEntryMultipleSlashes": "Only one “/” is allowed",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 6945458b49a9a6..0496196501e43f 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "允许列表",
   "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
   "settings.ipPolicyCidrMax": "一条策略最多包含 {{max}} 个地址",
+  "settings.ipPolicyColumnEnforcing": "生效中",
+  "settings.ipPolicyColumnIpEntries": "IP 条目",
+  "settings.ipPolicyColumnName": "名称",
+  "settings.ipPolicyColumnUpdatedAt": "更新时间",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "该策略正在使用中",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
   "settings.ipPolicyEditUsedBy": "该策略已被 {{count}} 个应用使用。保存后会更新所有这些应用的允许列表。",
+  "settings.ipPolicyEnforcingMany": "{{count}} 个应用",
+  "settings.ipPolicyEnforcingNone": "0 个应用",
+  "settings.ipPolicyEnforcingOne": "1 个应用",
   "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 地址",
   "settings.ipPolicyEntryLeadingZeros": "不允许前导零",
   "settings.ipPolicyEntryMultipleSlashes": "只能包含一个“/”",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 133df2a28e18a0..cf77466fd3ac69 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -564,6 +564,10 @@
   "settings.ipPolicyAllowlist": "允許清單",
   "settings.ipPolicyAllowlistHelp": "支援單一地址（203.0.113.42）或 CIDR 網段（10.0.0.0/8），IPv4 與 IPv6 皆可。",
   "settings.ipPolicyCidrMax": "一條策略最多包含 {{max}} 個地址",
+  "settings.ipPolicyColumnEnforcing": "生效中",
+  "settings.ipPolicyColumnIpEntries": "IP 項目",
+  "settings.ipPolicyColumnName": "名稱",
+  "settings.ipPolicyColumnUpdatedAt": "更新時間",
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "該策略正在使用中",
@@ -573,6 +577,9 @@
   "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
   "settings.ipPolicyEditUsedBy": "該策略已被 {{count}} 個應用使用。儲存後會更新所有這些應用的允許清單。",
+  "settings.ipPolicyEnforcingMany": "{{count}} 個應用",
+  "settings.ipPolicyEnforcingNone": "0 個應用",
+  "settings.ipPolicyEnforcingOne": "1 個應用",
   "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 位址",
   "settings.ipPolicyEntryLeadingZeros": "不允許前導零",
   "settings.ipPolicyEntryMultipleSlashes": "只能包含一個“/”",

From 9e985c21120dc54988e1203f647cffb81b236fb0 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Fri, 11 Sep 2026 17:01:55 +0800
Subject: [PATCH 025/108] fix: complete network access control backend
 contracts

---
 api/.env.example                              |   7 +
 api/configs/feature/__init__.py               |   7 +
 .../console/workspace/network_access_group.py |  62 ++-
 api/core/network_access/__init__.py           |   1 +
 api/core/network_access/client_ip.py          |  95 ++++
 api/openapi/markdown/console-openapi.md       |  26 ++
 .../network_access_group_repository.py        |  65 ++-
 api/services/network_access_group_service.py  | 144 +++++-
 .../workspace/test_network_access_group.py    | 108 ++++-
 .../core/network_access/test_client_ip.py     | 108 +++++
 .../test_network_access_group_repository.py   |  81 +++-
 .../test_network_access_group_service.py      | 306 ++++++++++++-
 docker/envs/core-services/api.env.example     |   5 +
 .../generated/api/console/apps/types.gen.ts   |   2 +
 .../generated/api/console/apps/zod.gen.ts     |   2 +
 .../api/console/workspaces/orpc.gen.ts        | 414 +++++++++---------
 .../api/console/workspaces/types.gen.ts       |  25 ++
 .../api/console/workspaces/zod.gen.ts         |  22 +
 .../ip-policies-page/__tests__/index.spec.tsx |  20 +-
 web/test/console/network-access.ts            |   2 +
 20 files changed, 1272 insertions(+), 230 deletions(-)
 create mode 100644 api/core/network_access/__init__.py
 create mode 100644 api/core/network_access/client_ip.py
 create mode 100644 api/tests/unit_tests/core/network_access/test_client_ip.py

diff --git a/api/.env.example b/api/.env.example
index 0bf7b9493ac542..6643de8f9acfaa 100644
--- a/api/.env.example
+++ b/api/.env.example
@@ -11,6 +11,13 @@ PYTHONIOENCODING=utf-8
 
 # Console API base URL
 CONSOLE_API_URL=http://localhost:5001
+
+# Optional internal SaaS policy API; defaults to BILLING_API_URL when empty.
+NETWORK_ACCESS_API_URL=
+# Current-IP preview only. Comma-separated CIDRs, e.g. 172.18.0.0/16.
+# Required for Cloud IP previews. Match Gateway's proxy boundary; never trust caller
+# headers unless the edge sanitizes XFF or appends its verified socket peer.
+NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=
 CONSOLE_WEB_URL=http://localhost:3000
 
 # Service API base URL
diff --git a/api/configs/feature/__init__.py b/api/configs/feature/__init__.py
index aea9e7fcb4b6e3..2b2ca69b27ac22 100644
--- a/api/configs/feature/__init__.py
+++ b/api/configs/feature/__init__.py
@@ -416,6 +416,13 @@ class EndpointConfig(BaseSettings):
         default="",
     )
 
+    NETWORK_ACCESS_TRUSTED_PROXY_CIDRS: str = Field(
+        description="Comma-separated trusted proxy CIDRs for network-access current-IP previews. "
+        "Only verified socket peers may supply X-Forwarded-For; empty disables Cloud IP previews. "
+        "Match the Gateway trust boundary and sanitize or append the client IP at the edge.",
+        default="",
+    )
+
 
 class FileAccessConfig(BaseSettings):
     """
diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 6d5ba151c52614..19204fa0105adf 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -2,15 +2,18 @@
 from typing import Any, Self
 from uuid import UUID
 
+from flask import Response, after_this_request, request
 from flask_restx import Resource
 from pydantic import AliasChoices, BaseModel, Field, ValidationError, model_validator
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, NotFound, ServiceUnavailable
 
+from configs import dify_config
 from controllers.common.schema import query_params_from_model, register_response_schema_models, register_schema_models
 from controllers.console import console_ns
 from controllers.console.app.error import AppNotFoundError
 from controllers.console.flask_admission import console_account_admission
 from controllers.console.wraps import cloud_edition_billing_paid_plan_required, model_validate
+from core.network_access.client_ip import NetworkAccessClientIPUnavailableError, resolve_network_access_client_ip
 from enums import DeploymentEdition
 from extensions.ext_application_services import application_services
 from fields.base import ResponseModel
@@ -21,6 +24,7 @@
     NetworkAccessGroupAppNotFoundError,
     NetworkAccessGroupEntitlementUnavailableError,
     NetworkAccessGroupError,
+    NetworkAccessGroupInvalidPolicyError,
     NetworkAccessGroupUnsupportedAccessPointsError,
     NetworkAccessGroupUnsupportedAppModeError,
     NetworkAccessGroupUpstreamError,
@@ -70,6 +74,8 @@ class NetworkAccessGroupAppResponse(ResponseModel):
     icon: str | None = None
     icon_type: str | None = None
     icon_background: str | None = None
+    mode: str
+    bound_agent_id: str | None = None
 
 
 class NetworkAccessGroupResponse(ResponseModel):
@@ -84,6 +90,7 @@ class NetworkAccessGroupResponse(ResponseModel):
     )
     version: int = Field(ge=1)
     used_by_count: int = Field(ge=0, validation_alias=AliasChoices("used_by_count", "usedByCount"))
+    enforcing_count: int = Field(ge=0, validation_alias=AliasChoices("enforcing_count", "enforcingCount"))
     app_ids: list[str] = Field(
         validation_alias=AliasChoices("app_ids", "appIds", "used_by_app_ids", "usedByAppIds"),
     )
@@ -95,6 +102,12 @@ class NetworkAccessGroupResponse(ResponseModel):
     created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
     updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
 
+    @model_validator(mode="after")
+    def validate_enforcing_count(self) -> Self:
+        if self.enforcing_count > self.used_by_count:
+            raise ValueError("enforcing_count must not exceed used_by_count")
+        return self
+
 
 class NetworkAccessGroupListResponse(ResponseModel):
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
@@ -110,6 +123,12 @@ class NetworkAccessGroupDeleteResponse(ResponseModel):
     deleted: bool
 
 
+class NetworkAccessGroupCurrentIPCheckResponse(ResponseModel):
+    client_ip: str
+    allowed: bool
+    policy_version: int = Field(ge=1)
+
+
 class AppNetworkAccessGroupBindingResponse(ResponseModel):
     id: str
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
@@ -146,12 +165,14 @@ class AppNetworkAccessGroupResponse(ResponseModel):
     tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
     app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
     entitled: bool
+    effective_enabled: bool = Field(validation_alias=AliasChoices("effective_enabled", "effectiveEnabled"))
     available_access_points: list[NetworkAccessPoint]
     binding: AppNetworkAccessGroupBindingResponse | None
 
 
 class AppNetworkAccessGroupMutationResponse(ResponseModel):
     binding: AppNetworkAccessGroupBindingResponse
+    effective_enabled: bool = Field(validation_alias=AliasChoices("effective_enabled", "effectiveEnabled"))
     available_access_points: list[NetworkAccessPoint]
 
 
@@ -168,6 +189,7 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
     NetworkAccessGroupListResponse,
     NetworkAccessGroupMutationResponse,
     NetworkAccessGroupDeleteResponse,
+    NetworkAccessGroupCurrentIPCheckResponse,
     AppNetworkAccessGroupBindingResponse,
     AppNetworkAccessGroupResponse,
     AppNetworkAccessGroupMutationResponse,
@@ -201,7 +223,7 @@ def _translate_service_error(exc: NetworkAccessGroupError) -> Exception:
     if isinstance(exc, NetworkAccessGroupUpstreamError):
         return _translate_upstream_error(exc)
     if isinstance(exc, NetworkAccessGroupAccessDeniedError):
-        return Forbidden("Only workspace owners and administrators can manage network access groups.")
+        return Forbidden("Your workspace role does not allow this network access operation.")
     if isinstance(exc, NetworkAccessGroupEntitlementUnavailableError):
         return ServiceUnavailable("Billing entitlement is temporarily unavailable.")
     if isinstance(exc, NetworkAccessGroupAppNotFoundError):
@@ -210,6 +232,8 @@ def _translate_service_error(exc: NetworkAccessGroupError) -> Exception:
         return BadRequest(f"Network access control is not supported for app mode '{exc.app_mode}'.")
     if isinstance(exc, NetworkAccessGroupUnsupportedAccessPointsError):
         return BadRequest(f"Unsupported access points for this app: {', '.join(exc.access_points)}.")
+    if isinstance(exc, NetworkAccessGroupInvalidPolicyError):
+        return ServiceUnavailable("Network access policy cannot be evaluated.")
     raise TypeError(f"Unsupported network access group error: {type(exc).__name__}")
 
 
@@ -220,6 +244,15 @@ def _serialize_response(response_model: type[ResponseModel], payload: dict[str,
         raise BadGateway("Invalid response from the network access group service.") from exc
 
 
+def _resolve_current_network_access_client_ip() -> str:
+    trusted_proxy_cidrs = dify_config.NETWORK_ACCESS_TRUSTED_PROXY_CIDRS
+    if not trusted_proxy_cidrs.strip():
+        # This Cloud-only UI must never label an internal Docker/ALB socket peer
+        # as the user's address when deployment trust configuration is missing.
+        raise NetworkAccessClientIPUnavailableError("network access trusted proxies are not configured")
+    return resolve_network_access_client_ip(request.environ, trusted_proxy_cidrs)
+
+
 @console_ns.route("/workspaces/current/network-access-groups")
 class CurrentWorkspaceNetworkAccessGroupsApi(Resource):
     @console_ns.response(
@@ -333,6 +366,33 @@ def delete(
         return _serialize_response(NetworkAccessGroupDeleteResponse, payload)
 
 
+@console_ns.route("/workspaces/current/network-access-groups/<uuid:group_id>/check-current-ip")
+class CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi(Resource):
+    @console_ns.response(
+        200,
+        "Current client IP checked against the workspace network access group",
+        console_ns.models[NetworkAccessGroupCurrentIPCheckResponse.__name__],
+    )
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
+    def get(self, request_context: RequestContext, group_id: UUID) -> dict[str, Any]:
+        @after_this_request
+        def disable_client_ip_response_cache(response: Response) -> Response:
+            response.headers["Cache-Control"] = "no-store"
+            return response
+
+        try:
+            payload = application_services().network_access_groups.check_current_ip(
+                request_context,
+                group_id=str(group_id),
+                client_ip_supplier=_resolve_current_network_access_client_ip,
+            )
+        except NetworkAccessClientIPUnavailableError as exc:
+            raise ServiceUnavailable("Current client IP is unavailable.") from exc
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupCurrentIPCheckResponse, payload)
+
+
 @console_ns.route("/apps/<uuid:app_id>/network-access-group")
 class AppNetworkAccessGroupApi(Resource):
     @console_ns.response(
diff --git a/api/core/network_access/__init__.py b/api/core/network_access/__init__.py
new file mode 100644
index 00000000000000..2aedd5c9338e68
--- /dev/null
+++ b/api/core/network_access/__init__.py
@@ -0,0 +1 @@
+"""Network-access policy helpers shared by the Console control plane."""
diff --git a/api/core/network_access/client_ip.py b/api/core/network_access/client_ip.py
new file mode 100644
index 00000000000000..b706e42a098a15
--- /dev/null
+++ b/api/core/network_access/client_ip.py
@@ -0,0 +1,95 @@
+"""Resolve a preview IP from a verified immediate peer and a strict proxy chain.
+
+This is intentionally independent of the historical login-IP helper. Deployers
+must configure the same trusted proxy boundary as the data-plane Gateway. An
+edge proxy must sanitize X-Forwarded-For or append its verified immediate peer;
+an untrusted caller cannot choose its IP merely by supplying forwarding headers.
+"""
+
+import ipaddress
+from collections.abc import Mapping
+from functools import lru_cache
+
+type IPAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
+type IPNetwork = ipaddress.IPv4Network | ipaddress.IPv6Network
+
+MAX_PROXY_HOPS = 32
+MAX_FORWARDED_HEADER_LENGTH = 2048
+
+
+class NetworkAccessClientIPUnavailableError(ValueError):
+    """A reliable current client address cannot be determined."""
+
+
+def _address(value: object) -> IPAddress:
+    if not isinstance(value, str) or not value.strip() or "%" in value:
+        raise NetworkAccessClientIPUnavailableError("current client IP is unavailable")
+    try:
+        address = ipaddress.ip_address(value.strip())
+    except ValueError as exc:
+        raise NetworkAccessClientIPUnavailableError("current client IP is unavailable") from exc
+    if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped is not None:
+        return address.ipv4_mapped
+    return address
+
+
+@lru_cache(maxsize=16)
+def _trusted_networks(config: str) -> tuple[IPNetwork, ...]:
+    if not config.strip():
+        return ()
+    entries = config.split(",")
+    if len(entries) > 256:
+        raise NetworkAccessClientIPUnavailableError("invalid network-access proxy configuration")
+    networks: list[IPNetwork] = []
+    for entry in entries:
+        try:
+            # Prefixes are explicit; reject host bits, scoped addresses and
+            # empty entries rather than broadening a malformed trust boundary.
+            if not entry.strip() or "%" in entry or "/" not in entry:
+                raise ValueError("expected a proxy CIDR")
+            network = ipaddress.ip_network(entry.strip(), strict=True)
+            if isinstance(network, ipaddress.IPv6Network) and network.network_address.ipv4_mapped is not None:
+                if network.prefixlen < 96:
+                    raise ValueError("invalid mapped proxy CIDR")
+                network = ipaddress.IPv4Network((network.network_address.ipv4_mapped, network.prefixlen - 96))
+        except ValueError as exc:
+            raise NetworkAccessClientIPUnavailableError("invalid network-access proxy configuration") from exc
+        networks.append(network)
+    return tuple(networks)
+
+
+def resolve_network_access_client_ip(environ: Mapping[str, object], trusted_proxy_cidrs: str) -> str:
+    """Return the first non-trusted hop, never a browser-supplied IP argument.
+
+    If the actual socket peer is not trusted (including an empty trust list),
+    ignore all forwarding headers. If it is trusted, require a complete, bounded
+    XFF chain and strip trusted hops from the right. Invalid or all-trusted chains
+    are unavailable rather than silently returning a proxy's address. Preserve
+    the original peer when Werkzeug ProxyFix has rewritten REMOTE_ADDR.
+    """
+    original = environ.get("werkzeug.proxy_fix.orig")
+    if original is not None:
+        if not isinstance(original, Mapping):
+            raise NetworkAccessClientIPUnavailableError("current client IP is unavailable")
+        peer_value = original.get("REMOTE_ADDR")
+    else:
+        peer_value = environ.get("REMOTE_ADDR")
+    peer = _address(peer_value)
+    networks = _trusted_networks(trusted_proxy_cidrs)
+
+    def trusted(address: IPAddress) -> bool:
+        return any(address.version == network.version and address in network for network in networks)
+
+    if not trusted(peer):
+        return str(peer)
+    header = environ.get("HTTP_X_FORWARDED_FOR")
+    if not isinstance(header, str) or len(header) > MAX_FORWARDED_HEADER_LENGTH:
+        raise NetworkAccessClientIPUnavailableError("current client IP is unavailable")
+    values = header.split(",")
+    if len(values) > MAX_PROXY_HOPS:
+        raise NetworkAccessClientIPUnavailableError("current client IP is unavailable")
+    chain = [_address(value) for value in values]
+    for address in reversed(chain):
+        if not trusted(address):
+            return str(address)
+    raise NetworkAccessClientIPUnavailableError("current client IP is unavailable")
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index c888afe0f5a351..f629458521d8ee 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -10817,6 +10817,19 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 200 | Workspace network access group updated successfully | **application/json**: [NetworkAccessGroupMutationResponse](#networkaccessgroupmutationresponse)<br> |
 
+### [GET] /workspaces/current/network-access-groups/{group_id}/check-current-ip
+#### Parameters
+
+| Name | Located in | Description | Required | Schema |
+| ---- | ---------- | ----------- | -------- | ------ |
+| group_id | path |  | Yes | string (uuid) |
+
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Current client IP checked against the workspace network access group | **application/json**: [NetworkAccessGroupCurrentIPCheckResponse](#networkaccessgroupcurrentipcheckresponse)<br> |
+
 ### [GET] /workspaces/current/permission
 **Get workspace permission settings**
 
@@ -16019,6 +16032,7 @@ AppMCPServer Status Enum
 | ---- | ---- | ----------- | -------- |
 | available_access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
 | binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
+| effective_enabled | boolean |  | Yes |
 
 #### AppNetworkAccessGroupResponse
 
@@ -16027,6 +16041,7 @@ AppMCPServer Status Enum
 | app_id | string |  | Yes |
 | available_access_points | [ string, <br>**Available values:** "mcp", "service_api", "trigger", "webapp" ] |  | Yes |
 | binding | [AppNetworkAccessGroupBindingResponse](#appnetworkaccessgroupbindingresponse) |  | Yes |
+| effective_enabled | boolean |  | Yes |
 | entitled | boolean |  | Yes |
 | tenant_id | string |  | Yes |
 
@@ -19948,10 +19963,12 @@ Model with provider entity.
 
 | Name | Type | Description | Required |
 | ---- | ---- | ----------- | -------- |
+| bound_agent_id | string |  | No |
 | icon | string |  | No |
 | icon_background | string |  | No |
 | icon_type | string |  | No |
 | id | string |  | Yes |
+| mode | string |  | Yes |
 | name | string |  | Yes |
 
 #### NetworkAccessGroupCreatePayload
@@ -19962,6 +19979,14 @@ Model with provider entity.
 | description | string |  | No |
 | name | string |  | Yes |
 
+#### NetworkAccessGroupCurrentIPCheckResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| allowed | boolean |  | Yes |
+| client_ip | string |  | Yes |
+| policy_version | integer |  | Yes |
+
 #### NetworkAccessGroupDeleteResponse
 
 | Name | Type | Description | Required |
@@ -19991,6 +20016,7 @@ Model with provider entity.
 | apps | [ [NetworkAccessGroupAppResponse](#networkaccessgroupappresponse) ] |  | Yes |
 | created_at | dateTime |  | Yes |
 | description | string |  | No |
+| enforcing_count | integer |  | Yes |
 | id | string |  | Yes |
 | name | string |  | Yes |
 | tenant_id | string |  | Yes |
diff --git a/api/repositories/network_access_group_repository.py b/api/repositories/network_access_group_repository.py
index 942b7987307bcc..f94b6f3bef9b1a 100644
--- a/api/repositories/network_access_group_repository.py
+++ b/api/repositories/network_access_group_repository.py
@@ -3,12 +3,12 @@
 from collections.abc import Sequence
 from typing import override
 
-from sqlalchemy import select
+from sqlalchemy import and_, or_, select
 from sqlalchemy.exc import SQLAlchemyError
 from sqlalchemy.orm import Session, sessionmaker
 
 from models import App
-from models.agent import AgentScope
+from models.agent import APP_BACKED_AGENT_SOURCES, Agent, AgentScope, AgentStatus
 from services.network_access_group_service import (
     NetworkAccessGroupAppQuery,
     NetworkAccessGroupAppQueryError,
@@ -38,7 +38,14 @@ def get_manageable_app(self, *, workspace_id: str, app_id: str) -> NetworkAccess
                 binding = app.agent_app_binding_with_session(session=session, include_archived=True)
                 if binding is not None and binding.scope == AgentScope.WORKFLOW_ONLY:
                     return None
-                return self._to_record(app)
+                bound_agent_id = (
+                    str(binding.id)
+                    if binding is not None
+                    and binding.scope == AgentScope.ROSTER
+                    and binding.status == AgentStatus.ACTIVE
+                    else None
+                )
+                return self._to_record(app, bound_agent_id=bound_agent_id)
         except SQLAlchemyError as exc:
             raise NetworkAccessGroupAppQueryError from exc
 
@@ -53,19 +60,56 @@ def list_apps(
             return ()
         try:
             with self._session_factory() as session:
-                apps = session.scalars(
-                    select(App).where(
-                        App.tenant_id == workspace_id,
-                        App.id.in_(app_ids),
-                        App.status == "normal",
+                apps = tuple(
+                    session.scalars(
+                        select(App).where(
+                            App.tenant_id == workspace_id,
+                            App.id.in_(app_ids),
+                            App.status == "normal",
+                        )
+                    ).all()
+                )
+                if not apps:
+                    return ()
+
+                resolved_app_ids = tuple(app.id for app in apps)
+                agent_bindings = session.execute(
+                    select(Agent.id, Agent.app_id, Agent.backing_app_id, Agent.scope).where(
+                        Agent.tenant_id == workspace_id,
+                        or_(
+                            and_(
+                                Agent.scope == AgentScope.ROSTER,
+                                Agent.status == AgentStatus.ACTIVE,
+                                Agent.source.in_(APP_BACKED_AGENT_SOURCES),
+                                Agent.app_id.in_(resolved_app_ids),
+                            ),
+                            and_(
+                                Agent.scope == AgentScope.WORKFLOW_ONLY,
+                                Agent.backing_app_id.in_(resolved_app_ids),
+                            ),
+                        ),
                     )
                 ).all()
-                return tuple(self._to_record(app) for app in apps)
+                hidden_app_ids = {
+                    backing_app_id
+                    for _agent_id, _app_id, backing_app_id, scope in agent_bindings
+                    if scope == AgentScope.WORKFLOW_ONLY and backing_app_id is not None
+                }
+                bound_agent_ids = {
+                    app_id: str(agent_id)
+                    for agent_id, app_id, _backing_app_id, scope in agent_bindings
+                    if scope == AgentScope.ROSTER and app_id is not None
+                }
+                return tuple(
+                    self._to_record(app, bound_agent_id=bound_agent_ids.get(app.id))
+                    for app in apps
+                    if app.id not in hidden_app_ids
+                )
         except SQLAlchemyError as exc:
             raise NetworkAccessGroupAppQueryError from exc
 
     @staticmethod
-    def _to_record(app: App) -> NetworkAccessGroupAppRecord:
+    def _to_record(app: App, *, bound_agent_id: str | None = None) -> NetworkAccessGroupAppRecord:
         return NetworkAccessGroupAppRecord(
             id=str(app.id),
             mode=app.mode.value,
@@ -73,4 +117,5 @@ def _to_record(app: App) -> NetworkAccessGroupAppRecord:
             icon=app.icon,
             icon_type=app.icon_type.value if app.icon_type is not None else None,
             icon_background=app.icon_background,
+            bound_agent_id=bound_agent_id,
         )
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 48e28585afa0a3..d692b90d779040 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -1,7 +1,8 @@
 """Application service for workspace network access groups."""
 
+import ipaddress
 import logging
-from collections.abc import Sequence
+from collections.abc import Callable, Sequence
 from typing import Any, Literal, NamedTuple, Protocol
 
 from machinery.context import RequestContext
@@ -10,6 +11,10 @@
 
 NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
 
+_POLICY_READ_ROLES = frozenset({"owner", "admin", "editor"})
+_POLICY_WRITE_ROLES = frozenset({"owner", "admin"})
+_APP_BINDING_ROLES = _POLICY_READ_ROLES
+
 _ACCESS_POINTS_BY_APP_MODE: dict[str, tuple[NetworkAccessPoint, ...]] = {
     "workflow": ("webapp", "service_api", "mcp", "trigger"),
     "advanced-chat": ("webapp", "service_api", "mcp"),
@@ -34,7 +39,7 @@ def __init__(self, status_code: int, reason: str | None = None) -> None:
 
 
 class NetworkAccessGroupAccessDeniedError(NetworkAccessGroupError):
-    """The actor is not a persisted owner or administrator of the workspace."""
+    """The actor's persisted workspace role does not allow the operation."""
 
 
 class NetworkAccessGroupEntitlementUnavailableError(NetworkAccessGroupError):
@@ -57,6 +62,10 @@ def __init__(self, access_points: Sequence[str]) -> None:
         super().__init__(f"unsupported app access points: {', '.join(self.access_points)}")
 
 
+class NetworkAccessGroupInvalidPolicyError(NetworkAccessGroupError):
+    """The control plane returned a policy that cannot be evaluated safely."""
+
+
 class NetworkAccessGroupAppQueryError(Exception):
     """The local App read model could not be queried."""
 
@@ -68,6 +77,7 @@ class NetworkAccessGroupAppRecord(NamedTuple):
     icon: str | None
     icon_type: str | None
     icon_background: str | None
+    bound_agent_id: str | None = None
 
 
 class NetworkAccessGroupAppQuery(Protocol):
@@ -157,7 +167,7 @@ def __init__(
         self._entitlement = entitlement
 
     def list_groups(self, context: RequestContext) -> dict[str, Any]:
-        self._ensure_workspace_admin_or_owner(context)
+        self._ensure_workspace_role(context, _POLICY_READ_ROLES)
         payload = self._control_plane.list_groups(context.active_workspace_id, context.account_id)
         payload["entitled"] = self._effective_entitlement(
             context.active_workspace_id,
@@ -173,7 +183,7 @@ def create_group(
         description: str,
         allowed_cidrs: list[str],
     ) -> dict[str, Any]:
-        self._ensure_workspace_admin_or_owner(context)
+        self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
         payload = self._control_plane.create_group(
             context.active_workspace_id,
             name=name,
@@ -184,7 +194,7 @@ def create_group(
         return self._enrich_app_references(payload, context.active_workspace_id)
 
     def get_group(self, context: RequestContext, *, group_id: str) -> dict[str, Any]:
-        self._ensure_workspace_admin_or_owner(context)
+        self._ensure_workspace_role(context, _POLICY_READ_ROLES)
         payload = self._control_plane.get_group(
             context.active_workspace_id,
             group_id,
@@ -202,7 +212,7 @@ def update_group(
         allowed_cidrs: list[str],
         expected_version: int,
     ) -> dict[str, Any]:
-        self._ensure_workspace_admin_or_owner(context)
+        self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
         payload = self._control_plane.update_group(
             context.active_workspace_id,
             group_id,
@@ -221,7 +231,7 @@ def delete_group(
         group_id: str,
         expected_version: int,
     ) -> dict[str, Any]:
-        self._ensure_workspace_admin_or_owner(context)
+        self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
         return self._control_plane.delete_group(
             context.active_workspace_id,
             group_id,
@@ -230,8 +240,8 @@ def delete_group(
         )
 
     def get_app_binding(self, context: RequestContext, *, app_id: str) -> dict[str, Any]:
+        self._ensure_workspace_role(context, _APP_BINDING_ROLES)
         app = self._get_manageable_app(context.active_workspace_id, app_id)
-        self._ensure_workspace_admin_or_owner(context)
         available_access_points = self._available_access_points(app.mode)
         payload = self._control_plane.get_app_binding(
             context.active_workspace_id,
@@ -245,6 +255,7 @@ def get_app_binding(self, context: RequestContext, *, app_id: str) -> dict[str,
             payload.get("entitled"),
         )
         payload["available_access_points"] = available_access_points
+        self._finalize_effective_enabled(payload, entitled=payload["entitled"])
         return payload
 
     def update_app_binding(
@@ -257,8 +268,8 @@ def update_app_binding(
         access_points: list[NetworkAccessPoint],
         expected_version: int,
     ) -> dict[str, Any]:
+        self._ensure_workspace_role(context, _APP_BINDING_ROLES)
         app = self._get_manageable_app(context.active_workspace_id, app_id)
-        self._ensure_workspace_admin_or_owner(context)
         available_access_points = self._available_access_points(app.mode)
         self._validate_app_access_points(access_points, available_access_points)
         payload = self._control_plane.update_app_binding(
@@ -273,17 +284,63 @@ def update_app_binding(
         self._normalize_app_binding_defaults(payload)
         self._limit_binding_access_points(payload, available_access_points)
         payload["available_access_points"] = available_access_points
+        self._finalize_effective_enabled(payload)
         return payload
 
+    def check_current_ip(
+        self,
+        context: RequestContext,
+        *,
+        group_id: str,
+        client_ip_supplier: Callable[[], str],
+    ) -> dict[str, Any]:
+        """Evaluate the request's trusted client IP against one tenant policy.
+
+        The supplier is deliberately lazy: persisted workspace authorization and
+        tenant-scoped policy resolution both complete before request IP metadata
+        is read or returned.
+        """
+
+        self._ensure_workspace_role(context, _POLICY_READ_ROLES)
+        payload = self._control_plane.get_group(
+            context.active_workspace_id,
+            group_id,
+            context.account_id,
+        )
+        group = payload.get("group")
+        if not isinstance(group, dict):
+            raise NetworkAccessGroupInvalidPolicyError
+
+        raw_cidrs = group.get("allowed_cidrs", group.get("allowedCidrs"))
+        raw_version = group.get("version")
+        if not isinstance(raw_cidrs, list):
+            raise NetworkAccessGroupInvalidPolicyError
+        if isinstance(raw_version, bool) or not isinstance(raw_version, (int, str)):
+            raise NetworkAccessGroupInvalidPolicyError
+        try:
+            policy_version = int(raw_version)
+        except (TypeError, ValueError) as exc:
+            raise NetworkAccessGroupInvalidPolicyError from exc
+        if policy_version < 1:
+            raise NetworkAccessGroupInvalidPolicyError
+
+        client_ip = client_ip_supplier()
+        allowed = self._policy_allows_client_ip(raw_cidrs, client_ip)
+        return {
+            "client_ip": client_ip,
+            "allowed": allowed,
+            "policy_version": policy_version,
+        }
+
     def cleanup_app_binding(self, *, workspace_id: str, app_id: str) -> dict[str, Any]:
         return self._control_plane.cleanup_app_binding(workspace_id, app_id)
 
-    def _ensure_workspace_admin_or_owner(self, context: RequestContext) -> None:
+    def _ensure_workspace_role(self, context: RequestContext, allowed_roles: frozenset[str]) -> None:
         role = self._memberships.get_role_for_account(
             workspace_id=context.active_workspace_id,
             account_id=context.account_id,
         )
-        if role not in {"owner", "admin"}:
+        if role not in allowed_roles:
             raise NetworkAccessGroupAccessDeniedError
 
     def _effective_entitlement(self, workspace_id: str, upstream_entitled: object) -> bool:
@@ -315,6 +372,10 @@ def _validate_app_access_points(
     def _normalize_app_binding_defaults(payload: dict[str, Any]) -> None:
         """Materialize ProtoJSON defaults so the Console response stays stable."""
 
+        if "effective_enabled" not in payload:
+            payload["effective_enabled"] = payload.pop("effectiveEnabled", False)
+        else:
+            payload.pop("effectiveEnabled", None)
         payload.setdefault("binding", None)
         binding = payload.get("binding")
         if not isinstance(binding, dict):
@@ -339,6 +400,58 @@ def _limit_binding_access_points(
         binding["access_points"] = [access_point for access_point in raw_access_points if access_point in available]
         binding.pop("accessPoints", None)
 
+    @staticmethod
+    def _finalize_effective_enabled(payload: dict[str, Any], *, entitled: object = True) -> None:
+        binding = payload.get("binding")
+        if not isinstance(binding, dict):
+            payload["effective_enabled"] = False
+            return
+        group_id = binding.get("group_id", binding.get("groupId"))
+        access_points = binding.get("access_points", binding.get("accessPoints", []))
+        payload["effective_enabled"] = bool(
+            payload.get("effective_enabled")
+            and entitled
+            and binding.get("enabled")
+            and group_id
+            and isinstance(access_points, list)
+            and access_points
+        )
+
+    @staticmethod
+    def _policy_allows_client_ip(raw_cidrs: Sequence[object], client_ip: str) -> bool:
+        if not raw_cidrs or "%" in client_ip:
+            raise NetworkAccessGroupInvalidPolicyError
+        try:
+            address = NetworkAccessGroupService._normalize_ip_address(ipaddress.ip_address(client_ip))
+            networks = [NetworkAccessGroupService._normalize_ip_network(raw_cidr) for raw_cidr in raw_cidrs]
+        except (TypeError, ValueError) as exc:
+            raise NetworkAccessGroupInvalidPolicyError from exc
+        return any(address.version == network.version and address in network for network in networks)
+
+    @staticmethod
+    def _normalize_ip_address(
+        address: ipaddress.IPv4Address | ipaddress.IPv6Address,
+    ) -> ipaddress.IPv4Address | ipaddress.IPv6Address:
+        if isinstance(address, ipaddress.IPv6Address) and address.ipv4_mapped is not None:
+            return address.ipv4_mapped
+        return address
+
+    @staticmethod
+    def _normalize_ip_network(raw_cidr: object) -> ipaddress.IPv4Network | ipaddress.IPv6Network:
+        if not isinstance(raw_cidr, str) or "%" in raw_cidr:
+            raise TypeError("policy CIDR must be a string")
+        address_value, separator, prefix_value = raw_cidr.partition("/")
+        if not separator:
+            raise ValueError("policy CIDR must include a prefix length")
+        original_address = ipaddress.ip_address(address_value)
+        network = ipaddress.ip_network(raw_cidr, strict=False)
+        if not isinstance(original_address, ipaddress.IPv6Address) or original_address.ipv4_mapped is None:
+            return network
+        prefix_length = int(prefix_value)
+        if prefix_length < 96:
+            raise ValueError("IPv4-mapped IPv6 policy prefixes must be at least /96")
+        return ipaddress.IPv4Network((original_address.ipv4_mapped, prefix_length - 96), strict=False)
+
     def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) -> dict[str, Any]:
         """Attach tenant-scoped App display metadata to one or more group payloads."""
 
@@ -364,6 +477,13 @@ def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) ->
             if raw_count is None:
                 raw_count = len(raw_app_ids) if isinstance(raw_app_ids, list) else 0
             group["used_by_count"] = raw_count
+            raw_enforcing_count = group.get("enforcing_count")
+            if raw_enforcing_count is None:
+                raw_enforcing_count = group.get("enforcingCount")
+            group["enforcing_count"] = (
+                0 if payload.get("entitled") is False or raw_enforcing_count is None else raw_enforcing_count
+            )
+            group.pop("enforcingCount", None)
 
         app_ids = {
             str(app_id)
@@ -395,6 +515,8 @@ def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) ->
                 "icon": app.icon,
                 "icon_type": app.icon_type,
                 "icon_background": app.icon_background,
+                "mode": app.mode,
+                "bound_agent_id": app.bound_agent_id,
             }
             for app in app_records
         }
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 1b50ad3bf15a56..92b762860888e4 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -16,6 +16,7 @@
     AppNetworkAccessGroupApi,
     AppNetworkAccessGroupUpdatePayload,
     CurrentWorkspaceNetworkAccessGroupApi,
+    CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi,
     CurrentWorkspaceNetworkAccessGroupsApi,
     NetworkAccessGroupCreatePayload,
     NetworkAccessGroupDeleteQuery,
@@ -23,12 +24,14 @@
     _translate_service_error,
     _translate_upstream_error,
 )
+from core.network_access.client_ip import NetworkAccessClientIPUnavailableError
 from machinery.context import RequestContext
 from services.network_access_group_service import (
     NetworkAccessGroupAccessDeniedError,
     NetworkAccessGroupAppNotFoundError,
     NetworkAccessGroupEntitlementUnavailableError,
     NetworkAccessGroupError,
+    NetworkAccessGroupInvalidPolicyError,
     NetworkAccessGroupUnsupportedAccessPointsError,
     NetworkAccessGroupUnsupportedAppModeError,
     NetworkAccessGroupUpstreamError,
@@ -68,6 +71,7 @@ def _group_payload(*, app_ids: list[str] | None = None) -> dict[str, object]:
         "description": "Reusable office egress addresses",
         "allowedCidrs": ["203.0.113.7/32"],
         "usedByCount": len(app_ids),
+        "enforcingCount": 0,
         "usedByAppIds": app_ids,
         "apps": [],
         "version": "2",
@@ -191,11 +195,13 @@ def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
         "tenantId": TENANT_ID,
         "appId": APP_ID,
         "entitled": True,
+        "effectiveEnabled": False,
         "available_access_points": ["webapp", "service_api", "mcp"],
         "binding": None,
     }
     service.update_app_binding.return_value = {
         "binding": _binding_payload(),
+        "effectiveEnabled": True,
         "available_access_points": ["webapp", "service_api", "mcp"],
     }
     request_payload = AppNetworkAccessGroupUpdatePayload(
@@ -225,7 +231,9 @@ def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
         expected_version=2,
     )
     assert get_result["binding"] is None
+    assert get_result["effective_enabled"] is False
     assert put_result["binding"]["version"] == 3
+    assert put_result["effective_enabled"] is True
 
 
 @pytest.mark.parametrize(
@@ -269,11 +277,12 @@ def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None
 @pytest.mark.parametrize(
     ("service_error", "expected_exception", "expected_message"),
     [
-        (NetworkAccessGroupAccessDeniedError(), Forbidden, "owners and administrators"),
+        (NetworkAccessGroupAccessDeniedError(), Forbidden, "workspace role"),
         (NetworkAccessGroupEntitlementUnavailableError(), ServiceUnavailable, "temporarily unavailable"),
         (NetworkAccessGroupAppNotFoundError(), AppNotFoundError, "not found"),
         (NetworkAccessGroupUnsupportedAppModeError("channel"), BadRequest, "channel"),
         (NetworkAccessGroupUnsupportedAccessPointsError(["trigger"]), BadRequest, "trigger"),
+        (NetworkAccessGroupInvalidPolicyError(), ServiceUnavailable, "cannot be evaluated"),
     ],
 )
 def test_application_error_mapping(
@@ -322,7 +331,7 @@ def test_controller_maps_service_error_before_serialization() -> None:
     service = MagicMock()
     service.list_groups.side_effect = NetworkAccessGroupAccessDeniedError
 
-    with _application_services(service), pytest.raises(Forbidden, match="owners and administrators"):
+    with _application_services(service), pytest.raises(Forbidden, match="workspace role"):
         unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
             CurrentWorkspaceNetworkAccessGroupsApi(),
             request_context=_request_context(),
@@ -388,3 +397,98 @@ def test_app_config_accepts_policy_id_alias_and_disabled_draft() -> None:
 
     assert str(payload.group_id) == GROUP_ID
     assert payload.access_points == ["webapp", "service_api"]
+
+
+def test_current_ip_check_uses_trusted_resolver_after_service_admission_and_disables_caching(
+    config_overrides: Callable[..., None],
+) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
+
+    def check_current_ip(_context, *, group_id, client_ip_supplier):
+        assert group_id == GROUP_ID
+        return {"client_ip": client_ip_supplier(), "allowed": True, "policy_version": 4}
+
+    service.check_current_ip.side_effect = check_current_ip
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
+
+    with (
+        app.test_request_context(
+            headers={"X-Forwarded-For": "203.0.113.7"},
+            environ_base={"REMOTE_ADDR": "172.18.0.3"},
+        ),
+        _application_services(service),
+        patch(
+            "controllers.console.workspace.network_access_group.resolve_network_access_client_ip",
+            return_value="203.0.113.7",
+        ) as resolve_client_ip,
+    ):
+        result = unwrap(api.get)(api, request_context=_request_context(), group_id=UUID(GROUP_ID))
+        response = app.process_response(app.make_response(result))
+
+    assert result == {"client_ip": "203.0.113.7", "allowed": True, "policy_version": 4}
+    assert response.headers["Cache-Control"] == "no-store"
+    assert resolve_client_ip.call_args.args[1] == "172.18.0.0/16"
+
+
+def test_current_ip_check_maps_unavailable_client_ip_to_503(config_overrides: Callable[..., None]) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
+    service.check_current_ip.side_effect = lambda _context, *, group_id, client_ip_supplier: (
+        client_ip_supplier() if group_id == GROUP_ID else None
+    )
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
+
+    with (
+        app.test_request_context(environ_base={"REMOTE_ADDR": "172.18.0.3"}),
+        _application_services(service),
+        patch(
+            "controllers.console.workspace.network_access_group.resolve_network_access_client_ip",
+            side_effect=NetworkAccessClientIPUnavailableError,
+        ),
+        pytest.raises(ServiceUnavailable, match="Current client IP is unavailable"),
+    ):
+        unwrap(api.get)(api, request_context=_request_context(), group_id=UUID(GROUP_ID))
+
+
+def test_current_ip_check_fails_closed_when_trusted_proxy_config_is_empty(
+    config_overrides: Callable[..., None],
+) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="")
+    service.check_current_ip.side_effect = lambda _context, *, group_id, client_ip_supplier: (
+        client_ip_supplier() if group_id == GROUP_ID else None
+    )
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
+
+    with (
+        app.test_request_context(environ_base={"REMOTE_ADDR": "172.18.0.3"}),
+        _application_services(service),
+        patch(
+            "controllers.console.workspace.network_access_group.resolve_network_access_client_ip"
+        ) as resolve_client_ip,
+        pytest.raises(ServiceUnavailable, match="Current client IP is unavailable"),
+    ):
+        unwrap(api.get)(api, request_context=_request_context(), group_id=UUID(GROUP_ID))
+
+    resolve_client_ip.assert_not_called()
+
+
+def test_group_response_rejects_enforcing_count_greater_than_used_by_count() -> None:
+    service = MagicMock()
+    group = _group_payload(app_ids=[APP_ID])
+    group["enforcingCount"] = 2
+    service.list_groups.return_value = {
+        "tenantId": TENANT_ID,
+        "entitled": True,
+        "groups": [group],
+    }
+
+    with _application_services(service), pytest.raises(BadGateway, match="Invalid response"):
+        unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
+            CurrentWorkspaceNetworkAccessGroupsApi(),
+            request_context=_request_context(),
+        )
diff --git a/api/tests/unit_tests/core/network_access/test_client_ip.py b/api/tests/unit_tests/core/network_access/test_client_ip.py
new file mode 100644
index 00000000000000..f10f812eacf850
--- /dev/null
+++ b/api/tests/unit_tests/core/network_access/test_client_ip.py
@@ -0,0 +1,108 @@
+import pytest
+
+from core.network_access.client_ip import NetworkAccessClientIPUnavailableError, resolve_network_access_client_ip
+
+TRUSTED = "172.18.0.0/16,10.0.0.0/8,2400:cb00::/32"
+
+
+@pytest.mark.parametrize("config", ["", TRUSTED])
+def test_untrusted_socket_ignores_all_forwarding_headers(config: str):
+    assert (
+        resolve_network_access_client_ip(
+            {
+                "REMOTE_ADDR": "203.0.113.42",
+                "HTTP_X_FORWARDED_FOR": "192.0.2.1, invalid",
+                "HTTP_CF_CONNECTING_IP": "192.0.2.1",
+                "HTTP_X_REAL_IP": "192.0.2.1",
+            },
+            config,
+        )
+        == "203.0.113.42"
+    )
+
+
+@pytest.mark.parametrize(
+    ("header", "expected"),
+    [
+        ("203.0.113.42", "203.0.113.42"),
+        ("192.0.2.1, 203.0.113.42, 10.2.3.4", "203.0.113.42"),
+        ("2001:db8::1234, 2400:cb00::1, 10.2.3.4", "2001:db8::1234"),
+        ("::ffff:203.0.113.42, ::ffff:10.2.3.4", "203.0.113.42"),
+        (" 2001:0db8:0:0::1234 , 10.2.3.4 ", "2001:db8::1234"),
+    ],
+)
+def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: str):
+    assert (
+        resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED)
+        == expected
+    )
+
+
+@pytest.mark.parametrize(
+    "header",
+    [
+        None,
+        "",
+        "203.0.113.42,",
+        ",203.0.113.42",
+        "unknown",
+        "203.0.113.42:443",
+        "[2001:db8::1]",
+        "fe80::1%eth0",
+        "192.0.2.1,invalid",
+        "10.1.2.3",
+        "192.0.2.1," * 33,
+        "x" * 2049,
+    ],
+)
+def test_trusted_peer_rejects_missing_invalid_or_all_trusted_chains(header: object):
+    with pytest.raises(NetworkAccessClientIPUnavailableError):
+        resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED)
+
+
+@pytest.mark.parametrize("peer", [None, "", "unknown", "[::1]", "203.0.113.42:5000", "fe80::1%eth0", 1])
+def test_invalid_socket_peer_is_unavailable(peer: object):
+    with pytest.raises(NetworkAccessClientIPUnavailableError):
+        resolve_network_access_client_ip({"REMOTE_ADDR": peer}, TRUSTED)
+
+
+def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted():
+    environ = {
+        "REMOTE_ADDR": "172.18.0.2",
+        "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "203.0.113.42"},
+        "HTTP_X_FORWARDED_FOR": "192.0.2.1",
+    }
+    assert resolve_network_access_client_ip(environ, TRUSTED) == "203.0.113.42"
+
+
+def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite():
+    environ = {
+        "REMOTE_ADDR": "192.0.2.1",
+        "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "172.18.0.2"},
+        "HTTP_X_FORWARDED_FOR": "192.0.2.1, 203.0.113.42",
+    }
+    assert resolve_network_access_client_ip(environ, TRUSTED) == "203.0.113.42"
+
+
+@pytest.mark.parametrize("original", ["invalid", {}, {"REMOTE_ADDR": None}])
+def test_malformed_proxy_fix_original_is_unavailable(original: object):
+    with pytest.raises(NetworkAccessClientIPUnavailableError):
+        resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42", "werkzeug.proxy_fix.orig": original}, TRUSTED)
+
+
+@pytest.mark.parametrize(
+    "config", ["not-a-cidr", "172.18.0.1/16", "172.18.0.0/16,", "fe80::%eth0/64", "10.0.0.0/8," * 257]
+)
+def test_invalid_proxy_configuration_is_unavailable(config: str):
+    with pytest.raises(NetworkAccessClientIPUnavailableError):
+        resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42"}, config)
+
+
+def test_mapped_socket_and_proxy_cidr_match_ipv4():
+    assert (
+        resolve_network_access_client_ip(
+            {"REMOTE_ADDR": "::ffff:172.18.0.2", "HTTP_X_FORWARDED_FOR": "::ffff:203.0.113.42"},
+            "::ffff:172.18.0.0/112",
+        )
+        == "203.0.113.42"
+    )
diff --git a/api/tests/unit_tests/repositories/test_network_access_group_repository.py b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
index 49ce7a0fa7c087..59b1f3e92a8705 100644
--- a/api/tests/unit_tests/repositories/test_network_access_group_repository.py
+++ b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
@@ -1,7 +1,7 @@
 from unittest.mock import MagicMock
 
 import pytest
-from sqlalchemy import text
+from sqlalchemy import event, text
 from sqlalchemy.exc import SQLAlchemyError
 from sqlalchemy.orm import Session, sessionmaker
 
@@ -158,6 +158,85 @@ def test_get_manageable_app_applies_agent_scope_and_lifecycle_visibility(
     )
 
     assert (result is not None) is expected_visible
+    if result is not None:
+        assert result.bound_agent_id == "77777777-7777-7777-7777-777777777777"
+
+
+def test_list_apps_batch_loads_agent_routes_and_excludes_hidden_workflow_backing_apps(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
+    agent_app_id = _APP_ID
+    second_agent_app_id = _UNREQUESTED_APP_ID
+    hidden_app_id = _DISABLED_APP_ID
+    with sqlite_session_factory() as session:
+        session.add_all(
+            [
+                _app(agent_app_id, mode=AppMode.AGENT),
+                _app(second_agent_app_id, mode=AppMode.AGENT),
+                _app(hidden_app_id, mode=AppMode.AGENT),
+                Agent(
+                    id="77777777-7777-7777-7777-777777777777",
+                    tenant_id=_WORKSPACE_ID,
+                    name="First roster agent",
+                    description="",
+                    role="",
+                    scope=AgentScope.ROSTER,
+                    source=AgentSource.AGENT_APP,
+                    status=AgentStatus.ACTIVE,
+                    app_id=agent_app_id,
+                    backing_app_id=agent_app_id,
+                ),
+                Agent(
+                    id="88888888-8888-8888-8888-888888888888",
+                    tenant_id=_WORKSPACE_ID,
+                    name="Second roster agent",
+                    description="",
+                    role="",
+                    scope=AgentScope.ROSTER,
+                    source=AgentSource.IMPORTED,
+                    status=AgentStatus.ACTIVE,
+                    app_id=second_agent_app_id,
+                    backing_app_id=second_agent_app_id,
+                ),
+                Agent(
+                    id="99999999-9999-9999-9999-999999999999",
+                    tenant_id=_WORKSPACE_ID,
+                    name="Workflow-only agent",
+                    description="",
+                    role="",
+                    scope=AgentScope.WORKFLOW_ONLY,
+                    source=AgentSource.WORKFLOW,
+                    status=AgentStatus.ACTIVE,
+                    app_id=_OTHER_APP_ID,
+                    backing_app_id=hidden_app_id,
+                    workflow_id="aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
+                    workflow_node_id="agent-node",
+                ),
+            ]
+        )
+        session.commit()
+        engine = session.get_bind()
+
+    agent_selects: list[str] = []
+
+    def record_agent_select(_conn, _cursor, statement, _parameters, _context, _executemany) -> None:
+        if "FROM agents" in statement:
+            agent_selects.append(statement)
+
+    event.listen(engine, "before_cursor_execute", record_agent_select)
+    try:
+        result = _repository(sqlite_session_factory).list_apps(
+            workspace_id=_WORKSPACE_ID,
+            app_ids=[agent_app_id, second_agent_app_id, hidden_app_id],
+        )
+    finally:
+        event.remove(engine, "before_cursor_execute", record_agent_select)
+
+    assert [(app.id, app.bound_agent_id) for app in result] == [
+        (agent_app_id, "77777777-7777-7777-7777-777777777777"),
+        (second_agent_app_id, "88888888-8888-8888-8888-888888888888"),
+    ]
+    assert len(agent_selects) == 1
 
 
 def test_list_apps_maps_database_failures_to_query_error() -> None:
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 2e4a948cd1a7c7..6b93bcf59e0573 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -13,9 +13,11 @@
     NetworkAccessGroupAppRecord,
     NetworkAccessGroupControlPlane,
     NetworkAccessGroupEntitlement,
+    NetworkAccessGroupInvalidPolicyError,
     NetworkAccessGroupService,
     NetworkAccessGroupUnsupportedAccessPointsError,
     NetworkAccessGroupUnsupportedAppModeError,
+    NetworkAccessGroupUpstreamError,
     WorkspaceMembershipRoleQuery,
 )
 
@@ -42,7 +44,13 @@ def _context() -> RequestContext:
     )
 
 
-def _app(*, app_id: str = APP_ID, mode: str = "workflow", name: str = "App") -> NetworkAccessGroupAppRecord:
+def _app(
+    *,
+    app_id: str = APP_ID,
+    mode: str = "workflow",
+    name: str = "App",
+    bound_agent_id: str | None = None,
+) -> NetworkAccessGroupAppRecord:
     return NetworkAccessGroupAppRecord(
         id=app_id,
         mode=mode,
@@ -50,6 +58,7 @@ def _app(*, app_id: str = APP_ID, mode: str = "workflow", name: str = "App") ->
         icon=f"{app_id}.png",
         icon_type="image",
         icon_background="#FFFFFF",
+        bound_agent_id=bound_agent_id,
     )
 
 
@@ -153,14 +162,111 @@ def test_mutations_reject_non_privileged_persisted_roles_before_control_plane(
     assert harness.control_plane.method_calls == []
 
 
-@pytest.mark.parametrize("role", ["owner", "admin"])
-def test_reads_allow_persisted_owner_and_admin(role: str) -> None:
+@pytest.mark.parametrize("role", ["owner", "admin", "editor"])
+def test_policy_reads_allow_persisted_owner_admin_and_editor(role: str) -> None:
     harness = _harness(role=role)
     harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
+    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
 
     harness.service.list_groups(_context())
+    harness.service.get_group(_context(), group_id=GROUP_ID)
 
     harness.control_plane.list_groups.assert_called_once_with(WORKSPACE_ID, ACCOUNT_ID)
+    harness.control_plane.get_group.assert_called_once_with(WORKSPACE_ID, GROUP_ID, ACCOUNT_ID)
+
+
+@pytest.mark.parametrize(
+    "mutation",
+    [
+        pytest.param(
+            lambda service, context: service.create_group(
+                context,
+                name="Office",
+                description="Office network",
+                allowed_cidrs=["203.0.113.0/24"],
+            ),
+            id="create-group",
+        ),
+        pytest.param(
+            lambda service, context: service.update_group(
+                context,
+                group_id=GROUP_ID,
+                name="Office",
+                description="Office network",
+                allowed_cidrs=["203.0.113.0/24"],
+                expected_version=1,
+            ),
+            id="update-group",
+        ),
+        pytest.param(
+            lambda service, context: service.delete_group(
+                context,
+                group_id=GROUP_ID,
+                expected_version=1,
+            ),
+            id="delete-group",
+        ),
+    ],
+)
+def test_policy_mutations_reject_editor_before_control_plane(mutation: Mutation) -> None:
+    harness = _harness(role="editor")
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        mutation(harness.service, _context())
+
+    assert harness.control_plane.method_calls == []
+
+
+def test_app_binding_get_and_put_allow_editor() -> None:
+    harness = _harness(role="editor")
+    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
+    harness.control_plane.update_app_binding.return_value = {
+        "effective_enabled": True,
+        "binding": {"enabled": True, "group_id": GROUP_ID, "access_points": ["webapp"]},
+    }
+
+    harness.service.get_app_binding(_context(), app_id=APP_ID)
+    harness.service.update_app_binding(
+        _context(),
+        app_id=APP_ID,
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp"],
+        expected_version=1,
+    )
+
+    harness.control_plane.get_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.update_app_binding.assert_called_once()
+
+
+@pytest.mark.parametrize(
+    "operation",
+    [
+        pytest.param(
+            lambda service, context: service.get_app_binding(context, app_id=APP_ID),
+            id="get",
+        ),
+        pytest.param(
+            lambda service, context: service.update_app_binding(
+                context,
+                app_id=APP_ID,
+                enabled=True,
+                group_id=GROUP_ID,
+                access_points=["webapp"],
+                expected_version=1,
+            ),
+            id="put",
+        ),
+    ],
+)
+def test_app_binding_rejects_normal_role_before_app_lookup(operation: Mutation) -> None:
+    harness = _harness(role="normal")
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        operation(harness.service, _context())
+
+    harness.apps.get_manageable_app.assert_not_called()
+    assert harness.control_plane.method_calls == []
 
 
 def test_mutation_does_not_repeat_http_paid_plan_admission() -> None:
@@ -328,7 +434,10 @@ def test_app_binding_rejects_missing_or_inaccessible_app_before_control_plane()
         harness.service.get_app_binding(_context(), app_id=APP_ID)
 
     harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
-    harness.memberships.get_role_for_account.assert_not_called()
+    harness.memberships.get_role_for_account.assert_called_once_with(
+        workspace_id=WORKSPACE_ID,
+        account_id=ACCOUNT_ID,
+    )
     harness.control_plane.get_app_binding.assert_not_called()
 
 
@@ -347,7 +456,10 @@ def test_update_app_binding_rejects_missing_or_inaccessible_app_before_control_p
         )
 
     harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
-    harness.memberships.get_role_for_account.assert_not_called()
+    harness.memberships.get_role_for_account.assert_called_once_with(
+        workspace_id=WORKSPACE_ID,
+        account_id=ACCOUNT_ID,
+    )
     harness.control_plane.update_app_binding.assert_not_called()
 
 
@@ -378,6 +490,7 @@ def test_app_binding_materializes_protojson_defaults() -> None:
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
     assert result["binding"] == {"enabled": False, "access_points": []}
+    assert result["effective_enabled"] is False
 
 
 def test_app_binding_normalizes_camel_case_and_filters_stale_access_points() -> None:
@@ -390,6 +503,7 @@ def test_app_binding_normalizes_camel_case_and_filters_stale_access_points() ->
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
     assert result["binding"] == {"enabled": True, "access_points": ["webapp", "mcp"]}
+    assert result["effective_enabled"] is False
 
 
 def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
@@ -424,6 +538,8 @@ def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
             "icon": "app-1.png",
             "icon_type": "image",
             "icon_background": "#FFFFFF",
+            "mode": "workflow",
+            "bound_agent_id": None,
         }
     ]
     call_kwargs = harness.apps.list_apps.call_args.kwargs
@@ -442,3 +558,183 @@ def test_app_query_failure_degrades_group_enrichment_to_empty_apps() -> None:
 
     assert result["group"]["app_ids"] == [APP_ID]
     assert result["group"]["apps"] == []
+
+
+@pytest.mark.parametrize(("paid", "expected"), [(True, True), (False, False)])
+def test_app_effective_enabled_is_bounded_by_final_entitlement(paid: bool, expected: bool) -> None:
+    harness = _harness(paid=paid, app_mode="chat")
+    harness.control_plane.get_app_binding.return_value = {
+        "entitled": True,
+        "effectiveEnabled": True,
+        "binding": {
+            "enabled": True,
+            "groupId": GROUP_ID,
+            "accessPoints": ["webapp", "service_api"],
+        },
+    }
+
+    result = harness.service.get_app_binding(_context(), app_id=APP_ID)
+
+    assert result["effective_enabled"] is expected
+    assert result["binding"]["enabled"] is True
+
+
+def test_app_effective_enabled_does_not_reenable_an_incomplete_filtered_binding() -> None:
+    harness = _harness(app_mode="agent")
+    harness.control_plane.update_app_binding.return_value = {
+        "effectiveEnabled": True,
+        "binding": {
+            "enabled": True,
+            "groupId": GROUP_ID,
+            "accessPoints": ["mcp"],
+        },
+    }
+
+    result = harness.service.update_app_binding(
+        _context(),
+        app_id=APP_ID,
+        enabled=False,
+        group_id=GROUP_ID,
+        access_points=[],
+        expected_version=1,
+    )
+
+    assert result["binding"]["enabled"] is True
+    assert result["binding"]["access_points"] == []
+    assert result["effective_enabled"] is False
+
+
+@pytest.mark.parametrize(("paid", "expected"), [(True, 2), (False, 0)])
+def test_group_enforcing_count_is_normalized_and_bounded_by_final_entitlement(
+    paid: bool,
+    expected: int,
+) -> None:
+    harness = _harness(paid=paid)
+    harness.control_plane.list_groups.return_value = {
+        "entitled": True,
+        "groups": [{"id": GROUP_ID, "enforcingCount": 2, "usedByCount": 3}],
+    }
+
+    result = harness.service.list_groups(_context())
+
+    assert result["groups"][0]["enforcing_count"] == expected
+
+
+def test_group_enforcing_count_materializes_omitted_protojson_zero() -> None:
+    harness = _harness()
+    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
+
+    result = harness.service.get_group(_context(), group_id=GROUP_ID)
+
+    assert result["group"]["enforcing_count"] == 0
+
+
+def test_group_enrichment_includes_agent_routing_metadata() -> None:
+    harness = _harness()
+    harness.control_plane.get_group.return_value = {
+        "group": {"id": GROUP_ID, "used_by_app_ids": [APP_ID], "used_by_count": 1}
+    }
+    harness.apps.list_apps.return_value = [_app(app_id=APP_ID, mode="agent", name="Agent", bound_agent_id="agent-1")]
+
+    result = harness.service.get_group(_context(), group_id=GROUP_ID)
+
+    assert result["group"]["apps"] == [
+        {
+            "id": APP_ID,
+            "name": "Agent",
+            "icon": f"{APP_ID}.png",
+            "icon_type": "image",
+            "icon_background": "#FFFFFF",
+            "mode": "agent",
+            "bound_agent_id": "agent-1",
+        }
+    ]
+
+
+def test_current_ip_check_authorizes_and_loads_tenant_policy_before_reading_ip() -> None:
+    harness = _harness(role="editor")
+    order: list[str] = []
+    harness.memberships.get_role_for_account.side_effect = lambda **_kwargs: order.append("role") or "editor"
+    harness.control_plane.get_group.side_effect = lambda *_args: (
+        order.append("policy") or {"group": {"version": "7", "allowedCidrs": ["2001:db8::/32"]}}
+    )
+
+    result = harness.service.check_current_ip(
+        _context(),
+        group_id=GROUP_ID,
+        client_ip_supplier=lambda: order.append("ip") or "2001:db8::42",
+    )
+
+    assert order == ["role", "policy", "ip"]
+    assert result == {"client_ip": "2001:db8::42", "allowed": True, "policy_version": 7}
+
+
+def test_current_ip_check_rejects_role_before_policy_or_ip_lookup() -> None:
+    harness = _harness(role="normal")
+    supplier = MagicMock(return_value="203.0.113.7")
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=supplier)
+
+    harness.control_plane.get_group.assert_not_called()
+    supplier.assert_not_called()
+
+
+def test_current_ip_check_does_not_read_ip_when_tenant_scoped_policy_lookup_fails() -> None:
+    harness = _harness(role="admin")
+    harness.control_plane.get_group.side_effect = NetworkAccessGroupUpstreamError(404)
+    supplier = MagicMock(return_value="203.0.113.7")
+
+    with pytest.raises(NetworkAccessGroupUpstreamError):
+        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=supplier)
+
+    supplier.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("allowed_cidrs", "client_ip", "expected"),
+    [
+        (["203.0.113.0/24"], "::ffff:203.0.113.7", True),
+        (["::ffff:203.0.113.0/120"], "203.0.113.7", True),
+        (["2001:db8::/32"], "2001:db8:1::1", True),
+        (["2001:db8::/48"], "2001:db9::1", False),
+    ],
+)
+def test_current_ip_check_matches_ipv4_ipv6_and_mapped_addresses_consistently(
+    allowed_cidrs: list[str],
+    client_ip: str,
+    expected: bool,
+) -> None:
+    harness = _harness()
+    harness.control_plane.get_group.return_value = {"group": {"version": 1, "allowed_cidrs": allowed_cidrs}}
+
+    result = harness.service.check_current_ip(
+        _context(),
+        group_id=GROUP_ID,
+        client_ip_supplier=lambda: client_ip,
+    )
+
+    assert result["allowed"] is expected
+
+
+@pytest.mark.parametrize(
+    "allowed_cidrs",
+    [
+        [],
+        ["0.0.0.0/0", "not-a-cidr"],
+        ["fe80::1%eth0/128"],
+        ["::ffff:0:0/80"],
+    ],
+)
+def test_current_ip_check_rejects_malformed_policy_without_short_circuiting(
+    allowed_cidrs: list[str],
+) -> None:
+    harness = _harness()
+    harness.control_plane.get_group.return_value = {"group": {"version": 1, "allowed_cidrs": allowed_cidrs}}
+
+    with pytest.raises(NetworkAccessGroupInvalidPolicyError):
+        harness.service.check_current_ip(
+            _context(),
+            group_id=GROUP_ID,
+            client_ip_supplier=lambda: "203.0.113.7",
+        )
diff --git a/docker/envs/core-services/api.env.example b/docker/envs/core-services/api.env.example
index 9e97522e395dc8..649d3f1641c1c3 100644
--- a/docker/envs/core-services/api.env.example
+++ b/docker/envs/core-services/api.env.example
@@ -3,6 +3,11 @@
 # ------------------------------
 
 MODE=api
+# Optional SaaS network-policy control plane and current-IP preview trust.
+NETWORK_ACCESS_API_URL=
+# Comma-separated proxy CIDRs; empty disables Cloud IP previews. The edge
+# must sanitize/append XFF and the trust boundary must match Gateway.
+NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=
 SENTRY_DSN=
 SENTRY_TRACES_SAMPLE_RATE=1.0
 SENTRY_PROFILES_SAMPLE_RATE=1.0
diff --git a/packages/contracts/generated/api/console/apps/types.gen.ts b/packages/contracts/generated/api/console/apps/types.gen.ts
index 55525959eaecf5..1b171fcbf6d0c5 100644
--- a/packages/contracts/generated/api/console/apps/types.gen.ts
+++ b/packages/contracts/generated/api/console/apps/types.gen.ts
@@ -576,6 +576,7 @@ export type AppNetworkAccessGroupResponse = {
   app_id: string
   available_access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
   binding: AppNetworkAccessGroupBindingResponse | null
+  effective_enabled: boolean
   entitled: boolean
   tenant_id: string
 }
@@ -590,6 +591,7 @@ export type AppNetworkAccessGroupUpdatePayload = {
 export type AppNetworkAccessGroupMutationResponse = {
   available_access_points: Array<'mcp' | 'service_api' | 'trigger' | 'webapp'>
   binding: AppNetworkAccessGroupBindingResponse
+  effective_enabled: boolean
 }
 
 export type RedirectUrlResponse = {
diff --git a/packages/contracts/generated/api/console/apps/zod.gen.ts b/packages/contracts/generated/api/console/apps/zod.gen.ts
index e168b3ba360735..ec3c5cda36c466 100644
--- a/packages/contracts/generated/api/console/apps/zod.gen.ts
+++ b/packages/contracts/generated/api/console/apps/zod.gen.ts
@@ -1329,6 +1329,7 @@ export const zAppNetworkAccessGroupResponse = z.object({
   app_id: z.string(),
   available_access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])),
   binding: zAppNetworkAccessGroupBindingResponse.nullable(),
+  effective_enabled: z.boolean(),
   entitled: z.boolean(),
   tenant_id: z.string(),
 })
@@ -1339,6 +1340,7 @@ export const zAppNetworkAccessGroupResponse = z.object({
 export const zAppNetworkAccessGroupMutationResponse = z.object({
   available_access_points: z.array(z.enum(['mcp', 'service_api', 'trigger', 'webapp'])),
   binding: zAppNetworkAccessGroupBindingResponse,
+  effective_enabled: z.boolean(),
 })
 
 /**
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 8af7030a7fa010..20779120424fd2 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -88,6 +88,8 @@ import {
   zGetWorkspacesCurrentModelProvidersSummaryResponse,
   zGetWorkspacesCurrentModelsModelTypesByModelTypePath,
   zGetWorkspacesCurrentModelsModelTypesByModelTypeResponse,
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpPath,
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse,
   zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
   zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse,
   zGetWorkspacesCurrentNetworkAccessGroupsResponse,
@@ -1736,6 +1738,21 @@ export const models2 = {
   modelTypes,
 }
 
+export const get22 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIp',
+    path: '/workspaces/current/network-access-groups/{group_id}/check-current-ip',
+    tags: ['console'],
+  })
+  .input(z.object({ params: zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpPath }))
+  .output(zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse)
+
+export const checkCurrentIp = {
+  get: get22,
+}
+
 export const delete8 = oc
   .route({
     inputStructure: 'detailed',
@@ -1752,7 +1769,7 @@ export const delete8 = oc
   )
   .output(zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse)
 
-export const get22 = oc
+export const get23 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1781,11 +1798,12 @@ export const put5 = oc
 
 export const byGroupId = {
   delete: delete8,
-  get: get22,
+  get: get23,
   put: put5,
+  checkCurrentIp,
 }
 
-export const get23 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1808,7 +1826,7 @@ export const post26 = oc
   .output(zPostWorkspacesCurrentNetworkAccessGroupsResponse)
 
 export const networkAccessGroups = {
-  get: get23,
+  get: get24,
   post: post26,
   byGroupId,
 }
@@ -1818,7 +1836,7 @@ export const networkAccessGroups = {
  *
  * Returns permission flags that control workspace features like member invitations and owner transfer.
  */
-export const get24 = oc
+export const get25 = oc
   .route({
     description:
       'Returns permission flags that control workspace features like member invitations and owner transfer.',
@@ -1832,10 +1850,10 @@ export const get24 = oc
   .output(zGetWorkspacesCurrentPermissionResponse)
 
 export const permission = {
-  get: get24,
+  get: get25,
 }
 
-export const get25 = oc
+export const get26 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1847,7 +1865,7 @@ export const get25 = oc
   .output(zGetWorkspacesCurrentPluginAssetResponse)
 
 export const asset = {
-  get: get25,
+  get: get26,
 }
 
 export const post27 = oc
@@ -1880,7 +1898,7 @@ export const exclude = {
   post: post28,
 }
 
-export const get26 = oc
+export const get27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1892,7 +1910,7 @@ export const get26 = oc
   .output(zGetWorkspacesCurrentPluginAutoUpgradeFetchResponse)
 
 export const fetch_ = {
-  get: get26,
+  get: get27,
 }
 
 export const autoUpgrade = {
@@ -1901,7 +1919,7 @@ export const autoUpgrade = {
   fetch: fetch_,
 }
 
-export const get27 = oc
+export const get28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1912,10 +1930,10 @@ export const get27 = oc
   .output(zGetWorkspacesCurrentPluginDebuggingKeyResponse)
 
 export const debuggingKey = {
-  get: get27,
+  get: get28,
 }
 
-export const get28 = oc
+export const get29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1927,10 +1945,10 @@ export const get28 = oc
   .output(zGetWorkspacesCurrentPluginFetchManifestResponse)
 
 export const fetchManifest = {
-  get: get28,
+  get: get29,
 }
 
-export const get29 = oc
+export const get30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1942,7 +1960,7 @@ export const get29 = oc
   .output(zGetWorkspacesCurrentPluginIconResponse)
 
 export const icon = {
-  get: get29,
+  get: get30,
 }
 
 export const post29 = oc
@@ -1996,7 +2014,7 @@ export const install = {
   pkg,
 }
 
-export const get30 = oc
+export const get31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2008,7 +2026,7 @@ export const get30 = oc
   .output(zGetWorkspacesCurrentPluginInstalledIdsResponse)
 
 export const installedIds = {
-  get: get30,
+  get: get31,
 }
 
 export const post32 = oc
@@ -2045,7 +2063,7 @@ export const latestVersions = {
   post: post33,
 }
 
-export const get31 = oc
+export const get32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2057,12 +2075,12 @@ export const get31 = oc
   .output(zGetWorkspacesCurrentPluginListResponse)
 
 export const list2 = {
-  get: get31,
+  get: get32,
   installations,
   latestVersions,
 }
 
-export const get32 = oc
+export const get33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2074,14 +2092,14 @@ export const get32 = oc
   .output(zGetWorkspacesCurrentPluginMarketplacePkgResponse)
 
 export const pkg2 = {
-  get: get32,
+  get: get33,
 }
 
 export const marketplace2 = {
   pkg: pkg2,
 }
 
-export const get33 = oc
+export const get34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2093,7 +2111,7 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentPluginParametersDynamicOptionsResponse)
 
 export const dynamicOptions = {
-  get: get33,
+  get: get34,
 }
 
 /**
@@ -2137,7 +2155,7 @@ export const change2 = {
   post: post35,
 }
 
-export const get34 = oc
+export const get35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2148,7 +2166,7 @@ export const get34 = oc
   .output(zGetWorkspacesCurrentPluginPermissionFetchResponse)
 
 export const fetch2 = {
-  get: get34,
+  get: get35,
 }
 
 export const permission2 = {
@@ -2156,7 +2174,7 @@ export const permission2 = {
   fetch: fetch2,
 }
 
-export const get35 = oc
+export const get36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2168,7 +2186,7 @@ export const get35 = oc
   .output(zGetWorkspacesCurrentPluginReadmeResponse)
 
 export const readme = {
-  get: get35,
+  get: get36,
 }
 
 export const post36 = oc
@@ -2216,7 +2234,7 @@ export const delete9 = {
   byIdentifier,
 }
 
-export const get36 = oc
+export const get37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2228,11 +2246,11 @@ export const get36 = oc
   .output(zGetWorkspacesCurrentPluginTasksByTaskIdResponse)
 
 export const byTaskId = {
-  get: get36,
+  get: get37,
   delete: delete9,
 }
 
-export const get37 = oc
+export const get38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2244,7 +2262,7 @@ export const get37 = oc
   .output(zGetWorkspacesCurrentPluginTasksResponse)
 
 export const tasks = {
-  get: get37,
+  get: get38,
   deleteAll,
   byTaskId,
 }
@@ -2349,7 +2367,7 @@ export const upload = {
   pkg: pkg3,
 }
 
-export const get38 = oc
+export const get39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2366,7 +2384,7 @@ export const get38 = oc
   .output(zGetWorkspacesCurrentPluginByCategoryListResponse)
 
 export const list3 = {
-  get: get38,
+  get: get39,
 }
 
 export const byCategory = {
@@ -2419,7 +2437,7 @@ export const delete10 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const get39 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2448,12 +2466,12 @@ export const put6 = oc
 
 export const byPolicyId = {
   delete: delete10,
-  get: get39,
+  get: get40,
   put: put6,
   copy,
 }
 
-export const get40 = oc
+export const get41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2476,7 +2494,7 @@ export const post46 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
 
 export const accessPolicies = {
-  get: get40,
+  get: get41,
   post: post46,
   byPolicyId,
 }
@@ -2536,7 +2554,7 @@ export const delete11 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAgentsByAgentIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get41 = oc
+export const get42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2553,10 +2571,10 @@ export const get41 = oc
 
 export const memberBindings = {
   delete: delete11,
-  get: get41,
+  get: get42,
 }
 
-export const get42 = oc
+export const get43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2572,7 +2590,7 @@ export const get42 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings = {
-  get: get42,
+  get: get43,
 }
 
 export const byPolicyId2 = {
@@ -2584,7 +2602,7 @@ export const accessPolicies2 = {
   byPolicyId: byPolicyId2,
 }
 
-export const get43 = oc
+export const get44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2601,10 +2619,10 @@ export const get43 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdAccessPolicyResponse)
 
 export const accessPolicy = {
-  get: get43,
+  get: get44,
 }
 
-export const get44 = oc
+export const get45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2621,7 +2639,7 @@ export const get44 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies = {
-  get: get44,
+  get: get45,
 }
 
 export const put9 = oc
@@ -2652,7 +2670,7 @@ export const users = {
   byTargetAccountId,
 }
 
-export const get45 = oc
+export const get46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2680,11 +2698,11 @@ export const put10 = oc
   .output(zPutWorkspacesCurrentRbacAgentsByAgentIdWhitelistResponse)
 
 export const whitelist = {
-  get: get45,
+  get: get46,
   put: put10,
 }
 
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2696,7 +2714,7 @@ export const get46 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdWhitelistConfigResponse)
 
 export const whitelistConfig = {
-  get: get46,
+  get: get47,
 }
 
 export const byAgentId2 = {
@@ -2728,7 +2746,7 @@ export const delete12 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get47 = oc
+export const get48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2745,10 +2763,10 @@ export const get47 = oc
 
 export const memberBindings2 = {
   delete: delete12,
-  get: get47,
+  get: get48,
 }
 
-export const get48 = oc
+export const get49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2764,7 +2782,7 @@ export const get48 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings2 = {
-  get: get48,
+  get: get49,
 }
 
 export const byPolicyId3 = {
@@ -2776,7 +2794,7 @@ export const accessPolicies4 = {
   byPolicyId: byPolicyId3,
 }
 
-export const get49 = oc
+export const get50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2793,10 +2811,10 @@ export const get49 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
 
 export const accessPolicy2 = {
-  get: get49,
+  get: get50,
 }
 
-export const get50 = oc
+export const get51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2813,7 +2831,7 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies2 = {
-  get: get50,
+  get: get51,
 }
 
 export const put11 = oc
@@ -2844,7 +2862,7 @@ export const users2 = {
   byTargetAccountId: byTargetAccountId2,
 }
 
-export const get51 = oc
+export const get52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2872,11 +2890,11 @@ export const put12 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
 export const whitelist2 = {
-  get: get51,
+  get: get52,
   put: put12,
 }
 
-export const get52 = oc
+export const get53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2888,7 +2906,7 @@ export const get52 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdWhitelistConfigResponse)
 
 export const whitelistConfig2 = {
-  get: get52,
+  get: get53,
 }
 
 export const byAppId = {
@@ -2924,7 +2942,7 @@ export const delete13 = oc
     zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
   )
 
-export const get53 = oc
+export const get54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2945,10 +2963,10 @@ export const get53 = oc
 
 export const memberBindings3 = {
   delete: delete13,
-  get: get53,
+  get: get54,
 }
 
-export const get54 = oc
+export const get55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2964,7 +2982,7 @@ export const get54 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings3 = {
-  get: get54,
+  get: get55,
 }
 
 export const byPolicyId4 = {
@@ -2976,7 +2994,7 @@ export const accessPolicies6 = {
   byPolicyId: byPolicyId4,
 }
 
-export const get55 = oc
+export const get56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2993,10 +3011,10 @@ export const get55 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
 
 export const accessPolicy3 = {
-  get: get55,
+  get: get56,
 }
 
-export const get56 = oc
+export const get57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3013,7 +3031,7 @@ export const get56 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies3 = {
-  get: get56,
+  get: get57,
 }
 
 export const put13 = oc
@@ -3044,7 +3062,7 @@ export const users3 = {
   byTargetAccountId: byTargetAccountId3,
 }
 
-export const get57 = oc
+export const get58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3072,11 +3090,11 @@ export const put14 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
 export const whitelist3 = {
-  get: get57,
+  get: get58,
   put: put14,
 }
 
-export const get58 = oc
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3088,7 +3106,7 @@ export const get58 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistConfigResponse)
 
 export const whitelistConfig3 = {
-  get: get58,
+  get: get59,
 }
 
 export const byDatasetId = {
@@ -3104,7 +3122,7 @@ export const datasets = {
   byDatasetId,
 }
 
-export const get59 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3132,7 +3150,7 @@ export const put15 = oc
   .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
 export const rbacRoles = {
-  get: get59,
+  get: get60,
   put: put15,
 }
 
@@ -3144,7 +3162,7 @@ export const members2 = {
   byMemberId: byMemberId2,
 }
 
-export const get60 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3155,10 +3173,10 @@ export const get60 = oc
   .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
 
 export const myPermissions = {
-  get: get60,
+  get: get61,
 }
 
-export const get61 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3169,10 +3187,10 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAgentResponse)
 
 export const agent = {
-  get: get61,
+  get: get62,
 }
 
-export const get62 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3183,10 +3201,10 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
 
 export const app = {
-  get: get62,
+  get: get63,
 }
 
-export const get63 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3197,10 +3215,10 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
 
 export const dataset = {
-  get: get63,
+  get: get64,
 }
 
-export const get64 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3211,7 +3229,7 @@ export const get64 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
 
 export const catalog = {
-  get: get64,
+  get: get65,
   agent,
   app,
   dataset,
@@ -3236,7 +3254,7 @@ export const copy2 = {
   post: post47,
 }
 
-export const get65 = oc
+export const get66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3248,7 +3266,7 @@ export const get65 = oc
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
 
 export const members3 = {
-  get: get65,
+  get: get66,
 }
 
 export const delete14 = oc
@@ -3262,7 +3280,7 @@ export const delete14 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const get66 = oc
+export const get67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3286,13 +3304,13 @@ export const put16 = oc
 
 export const byRoleId = {
   delete: delete14,
-  get: get66,
+  get: get67,
   put: put16,
   copy: copy2,
   members: members3,
 }
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3313,7 +3331,7 @@ export const post48 = oc
   .output(zPostWorkspacesCurrentRbacRolesResponse)
 
 export const roles = {
-  get: get67,
+  get: get68,
   post: post48,
   byRoleId,
 }
@@ -3338,7 +3356,7 @@ export const bindings = {
   put: put17,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3354,10 +3372,10 @@ export const get68 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings4 = {
-  get: get68,
+  get: get69,
 }
 
-export const get69 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3373,7 +3391,7 @@ export const get69 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings4 = {
-  get: get69,
+  get: get70,
 }
 
 export const byPolicyId5 = {
@@ -3386,7 +3404,7 @@ export const accessPolicies8 = {
   byPolicyId: byPolicyId5,
 }
 
-export const get70 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3397,7 +3415,7 @@ export const get70 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPolicyResponse)
 
 export const accessPolicy4 = {
-  get: get70,
+  get: get71,
 }
 
 export const agents3 = {
@@ -3425,7 +3443,7 @@ export const bindings2 = {
   put: put18,
 }
 
-export const get71 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3441,10 +3459,10 @@ export const get71 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings5 = {
-  get: get71,
+  get: get72,
 }
 
-export const get72 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3460,7 +3478,7 @@ export const get72 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings5 = {
-  get: get72,
+  get: get73,
 }
 
 export const byPolicyId6 = {
@@ -3473,7 +3491,7 @@ export const accessPolicies9 = {
   byPolicyId: byPolicyId6,
 }
 
-export const get73 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3484,7 +3502,7 @@ export const get73 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
 
 export const accessPolicy5 = {
-  get: get73,
+  get: get74,
 }
 
 export const apps2 = {
@@ -3512,7 +3530,7 @@ export const bindings3 = {
   put: put19,
 }
 
-export const get74 = oc
+export const get75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3528,10 +3546,10 @@ export const get74 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings6 = {
-  get: get74,
+  get: get75,
 }
 
-export const get75 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3547,7 +3565,7 @@ export const get75 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings6 = {
-  get: get75,
+  get: get76,
 }
 
 export const byPolicyId7 = {
@@ -3560,7 +3578,7 @@ export const accessPolicies10 = {
   byPolicyId: byPolicyId7,
 }
 
-export const get76 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3571,7 +3589,7 @@ export const get76 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
 
 export const accessPolicy6 = {
-  get: get76,
+  get: get77,
 }
 
 export const datasets2 = {
@@ -3637,7 +3655,7 @@ export const import_ = {
   post: post50,
 }
 
-export const get77 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3648,7 +3666,7 @@ export const get77 = oc
   .output(zGetWorkspacesCurrentSkillsTagsResponse)
 
 export const tags = {
-  get: get77,
+  get: get78,
 }
 
 export const post51 = oc
@@ -3691,7 +3709,7 @@ export const duplicate = {
   post: post52,
 }
 
-export const get78 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3703,7 +3721,7 @@ export const get78 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdExportResponse)
 
 export const export2 = {
-  get: get78,
+  get: get79,
 }
 
 export const post53 = oc
@@ -3726,7 +3744,7 @@ export const check = {
   post: post53,
 }
 
-export const get79 = oc
+export const get80 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3743,10 +3761,10 @@ export const get79 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdFilesContentResponse)
 
 export const content = {
-  get: get79,
+  get: get80,
 }
 
-export const get80 = oc
+export const get81 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3763,7 +3781,7 @@ export const get80 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse)
 
 export const preview = {
-  get: get80,
+  get: get81,
 }
 
 export const patch5 = oc
@@ -3826,7 +3844,7 @@ export const publish = {
   post: post54,
 }
 
-export const get81 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3838,7 +3856,7 @@ export const get81 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdReferencesResponse)
 
 export const references = {
-  get: get81,
+  get: get82,
 }
 
 export const post55 = oc
@@ -3872,7 +3890,7 @@ export const delete15 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath }))
   .output(zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse)
 
-export const get82 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3901,11 +3919,11 @@ export const patch6 = oc
 
 export const byVersionId = {
   delete: delete15,
-  get: get82,
+  get: get83,
   patch: patch6,
 }
 
-export const get83 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3917,7 +3935,7 @@ export const get83 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdVersionsResponse)
 
 export const versions = {
-  get: get83,
+  get: get84,
   byVersionId,
 }
 
@@ -3937,7 +3955,7 @@ export const delete16 = oc
   )
   .output(zDeleteWorkspacesCurrentSkillsBySkillIdResponse)
 
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3966,7 +3984,7 @@ export const patch7 = oc
 
 export const bySkillId = {
   delete: delete16,
-  get: get84,
+  get: get85,
   patch: patch7,
   assist,
   duplicate,
@@ -3978,7 +3996,7 @@ export const bySkillId = {
   versions,
 }
 
-export const get85 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4002,7 +4020,7 @@ export const post56 = oc
   .output(zPostWorkspacesCurrentSkillsResponse)
 
 export const skills2 = {
-  get: get85,
+  get: get86,
   post: post56,
   files,
   import: import_,
@@ -4010,7 +4028,7 @@ export const skills2 = {
   bySkillId,
 }
 
-export const get86 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4021,10 +4039,10 @@ export const get86 = oc
   .output(zGetWorkspacesCurrentSummaryResponse)
 
 export const summary2 = {
-  get: get86,
+  get: get87,
 }
 
-export const get87 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4035,7 +4053,7 @@ export const get87 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get87,
+  get: get88,
 }
 
 export const post57 = oc
@@ -4068,7 +4086,7 @@ export const delete17 = {
   post: post58,
 }
 
-export const get88 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4079,11 +4097,11 @@ export const get88 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get89 = {
-  get: get88,
+export const get90 = {
+  get: get89,
 }
 
-export const get90 = oc
+export const get91 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4095,7 +4113,7 @@ export const get90 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get90,
+  get: get91,
 }
 
 export const post59 = oc
@@ -4132,7 +4150,7 @@ export const test = {
   pre,
 }
 
-export const get91 = oc
+export const get92 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4144,7 +4162,7 @@ export const get91 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get91,
+  get: get92,
 }
 
 export const post61 = oc
@@ -4165,7 +4183,7 @@ export const update2 = {
 export const api = {
   add,
   delete: delete17,
-  get: get89,
+  get: get90,
   remote,
   schema,
   test,
@@ -4193,7 +4211,7 @@ export const add2 = {
   post: post62,
 }
 
-export const get92 = oc
+export const get93 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4210,10 +4228,10 @@ export const get92 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get92,
+  get: get93,
 }
 
-export const get93 = oc
+export const get94 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4233,7 +4251,7 @@ export const get93 = oc
   )
 
 export const byCredentialType = {
-  get: get93,
+  get: get94,
 }
 
 export const schema2 = {
@@ -4245,7 +4263,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get94 = oc
+export const get95 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4262,7 +4280,7 @@ export const get94 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get94,
+  get: get95,
 }
 
 export const post63 = oc
@@ -4305,7 +4323,7 @@ export const delete18 = {
   post: post64,
 }
 
-export const get95 = oc
+export const get96 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4317,10 +4335,10 @@ export const get95 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get95,
+  get: get96,
 }
 
-export const get96 = oc
+export const get97 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4332,10 +4350,10 @@ export const get96 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get96,
+  get: get97,
 }
 
-export const get97 = oc
+export const get98 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4349,7 +4367,7 @@ export const get97 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get97,
+  get: get98,
 }
 
 export const delete19 = oc
@@ -4367,7 +4385,7 @@ export const delete19 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get98 = oc
+export const get99 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4398,7 +4416,7 @@ export const post65 = oc
 
 export const customClient = {
   delete: delete19,
-  get: get98,
+  get: get99,
   post: post65,
 }
 
@@ -4407,7 +4425,7 @@ export const oauth = {
   customClient,
 }
 
-export const get99 = oc
+export const get100 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4419,7 +4437,7 @@ export const get99 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get99,
+  get: get100,
 }
 
 export const post66 = oc
@@ -4474,7 +4492,7 @@ export const auth = {
   post: post67,
 }
 
-export const get100 = oc
+export const get101 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4486,14 +4504,14 @@ export const get100 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get100,
+  get: get101,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get101 = oc
+export const get102 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4505,7 +4523,7 @@ export const get101 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get101,
+  get: get102,
 }
 
 export const update4 = {
@@ -4584,7 +4602,7 @@ export const delete21 = {
   post: post70,
 }
 
-export const get102 = oc
+export const get103 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4595,11 +4613,11 @@ export const get102 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get103 = {
-  get: get102,
+export const get104 = {
+  get: get103,
 }
 
-export const get104 = oc
+export const get105 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4611,7 +4629,7 @@ export const get104 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get104,
+  get: get105,
 }
 
 export const post71 = oc
@@ -4632,7 +4650,7 @@ export const update5 = {
 export const workflow = {
   create: create2,
   delete: delete21,
-  get: get103,
+  get: get104,
   tools: tools4,
   update: update5,
 }
@@ -4644,7 +4662,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get105 = oc
+export const get106 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4656,10 +4674,10 @@ export const get105 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get105,
+  get: get106,
 }
 
-export const get106 = oc
+export const get107 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4670,10 +4688,10 @@ export const get106 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get106,
+  get: get107,
 }
 
-export const get107 = oc
+export const get108 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4684,10 +4702,10 @@ export const get107 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get107,
+  get: get108,
 }
 
-export const get108 = oc
+export const get109 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4698,10 +4716,10 @@ export const get108 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get108,
+  get: get109,
 }
 
-export const get109 = oc
+export const get110 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4712,7 +4730,7 @@ export const get109 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get109,
+  get: get110,
 }
 
 export const tools5 = {
@@ -4722,7 +4740,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get110 = oc
+export const get111 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4734,13 +4752,13 @@ export const get110 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get110,
+  get: get111,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get111 = oc
+export const get112 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4753,7 +4771,7 @@ export const get111 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get111,
+  get: get112,
 }
 
 /**
@@ -4774,7 +4792,7 @@ export const delete22 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get112 = oc
+export const get113 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4808,7 +4826,7 @@ export const post72 = oc
 
 export const client = {
   delete: delete22,
-  get: get112,
+  get: get113,
   post: post72,
 }
 
@@ -4875,7 +4893,7 @@ export const create3 = {
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get113 = oc
+export const get114 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4896,7 +4914,7 @@ export const get113 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get113,
+  get: get114,
 }
 
 export const logs = {
@@ -4970,7 +4988,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get114 = oc
+export const get115 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4991,7 +5009,7 @@ export const get114 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get114,
+  get: get115,
 }
 
 export const builder = {
@@ -5006,7 +5024,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get115 = oc
+export const get116 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5019,13 +5037,13 @@ export const get115 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get115,
+  get: get116,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get116 = oc
+export const get117 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5042,7 +5060,7 @@ export const get116 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get116,
+  get: get117,
 }
 
 export const oauth3 = {
@@ -5159,7 +5177,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get117 = oc
+export const get118 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5171,7 +5189,7 @@ export const get117 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get117,
+  get: get118,
 }
 
 export const current = {
@@ -5219,7 +5237,7 @@ export const webappLogo = {
   upload: upload3,
 }
 
-export const get118 = oc
+export const get119 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5241,7 +5259,7 @@ export const post81 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  get: get118,
+  get: get119,
   post: post81,
   webappLogo,
 }
@@ -5276,7 +5294,7 @@ export const switch3 = {
   post: post83,
 }
 
-export const get119 = oc
+export const get120 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5288,7 +5306,7 @@ export const get119 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get119,
+  get: get120,
 }
 
 export const byIconType = {
@@ -5307,7 +5325,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get120 = oc
+export const get121 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5318,7 +5336,7 @@ export const get120 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get120,
+  get: get121,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index 369370f63e0e50..c332d99398de7b 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -401,6 +401,12 @@ export type NetworkAccessGroupUpdatePayload = {
   name: string
 }
 
+export type NetworkAccessGroupCurrentIpCheckResponse = {
+  allowed: boolean
+  client_ip: string
+  policy_version: number
+}
+
 export type WorkspacePermissionResponse = {
   allow_member_invite: boolean
   allow_owner_transfer: boolean
@@ -1538,6 +1544,7 @@ export type NetworkAccessGroupResponse = {
   apps: Array<NetworkAccessGroupAppResponse>
   created_at: string
   description?: string
+  enforcing_count: number
   id: string
   name: string
   tenant_id: string
@@ -2238,10 +2245,12 @@ export type ProviderModelWithStatusEntity = {
 export type CustomConfigurationStatus = 'active' | 'no-configure'
 
 export type NetworkAccessGroupAppResponse = {
+  bound_agent_id?: string | null
   icon?: string | null
   icon_background?: string | null
   icon_type?: string | null
   id: string
+  mode: string
   name: string
 }
 
@@ -3989,6 +3998,22 @@ export type PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses = {
 export type PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
   PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses[keyof PutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponses]
 
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpData = {
+  body?: never
+  path: {
+    group_id: string
+  }
+  query?: never
+  url: '/workspaces/current/network-access-groups/{group_id}/check-current-ip'
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponses = {
+  200: NetworkAccessGroupCurrentIpCheckResponse
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse =
+  GetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponses[keyof GetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponses]
+
 export type GetWorkspacesCurrentPermissionData = {
   body?: never
   path?: never
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index 5763871f480b94..53b4a896f21d77 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -280,6 +280,15 @@ export const zNetworkAccessGroupUpdatePayload = z.object({
   name: z.string().min(1).max(100),
 })
 
+/**
+ * NetworkAccessGroupCurrentIPCheckResponse
+ */
+export const zNetworkAccessGroupCurrentIpCheckResponse = z.object({
+  allowed: z.boolean(),
+  client_ip: z.string(),
+  policy_version: z.int().gte(1),
+})
+
 /**
  * WorkspacePermissionResponse
  */
@@ -2335,10 +2344,12 @@ export const zModelProviderSummaryListResponse = z.object({
  * NetworkAccessGroupAppResponse
  */
 export const zNetworkAccessGroupAppResponse = z.object({
+  bound_agent_id: z.string().nullish(),
   icon: z.string().nullish(),
   icon_background: z.string().nullish(),
   icon_type: z.string().nullish(),
   id: z.string(),
+  mode: z.string(),
   name: z.string(),
 })
 
@@ -2351,6 +2362,7 @@ export const zNetworkAccessGroupResponse = z.object({
   apps: z.array(zNetworkAccessGroupAppResponse),
   created_at: z.iso.datetime(),
   description: z.string().optional().default(''),
+  enforcing_count: z.int().gte(0),
   id: z.string(),
   name: z.string(),
   tenant_id: z.string(),
@@ -4695,6 +4707,16 @@ export const zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdPath = z.object({
 export const zPutWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse =
   zNetworkAccessGroupMutationResponse
 
+export const zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpPath = z.object({
+  group_id: z.uuid(),
+})
+
+/**
+ * Current client IP checked against the workspace network access group
+ */
+export const zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse =
+  zNetworkAccessGroupCurrentIpCheckResponse
+
 /**
  * Success
  */
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 9fc8014774657e..a57e5418f94d2f 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -155,11 +155,19 @@ describe('IpPoliciesPage', () => {
             {
               id: 'app-a',
               name: 'Support Bot',
+              mode: 'chat',
+              icon: null,
+              icon_type: null,
+              icon_background: null,
+            },
+            {
+              id: 'app-b',
+              name: 'Helpdesk',
+              mode: 'chat',
               icon: null,
               icon_type: null,
               icon_background: null,
             },
-            { id: 'app-b', name: 'Helpdesk', icon: null, icon_type: null, icon_background: null },
           ],
         }),
       ],
@@ -194,11 +202,19 @@ describe('IpPoliciesPage', () => {
             {
               id: 'app-a',
               name: 'Support Bot',
+              mode: 'chat',
+              icon: null,
+              icon_type: null,
+              icon_background: null,
+            },
+            {
+              id: 'app-b',
+              name: 'Helpdesk',
+              mode: 'chat',
               icon: null,
               icon_type: null,
               icon_background: null,
             },
-            { id: 'app-b', name: 'Helpdesk', icon: null, icon_type: null, icon_background: null },
           ],
         }),
       ],
diff --git a/web/test/console/network-access.ts b/web/test/console/network-access.ts
index 3c125e0c0eaed3..a611e14b28493f 100644
--- a/web/test/console/network-access.ts
+++ b/web/test/console/network-access.ts
@@ -18,6 +18,7 @@ export function createNetworkAccessGroupFixture(
     app_ids: [],
     apps: [],
     used_by_count: 0,
+    enforcing_count: 0,
     version: 1,
     created_at: '2026-01-01T00:00:00Z',
     updated_at: '2026-01-01T00:00:00Z',
@@ -52,6 +53,7 @@ export function seedAppNetworkAccessGroup(
     tenant_id: 'workspace-1',
     app_id: appId,
     entitled: true,
+    effective_enabled: false,
     available_access_points: ['webapp', 'service_api', 'mcp'],
     binding: null,
     ...overrides,

From d2de3fe533d5ee66c765e0725eb15e2170acccf4 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Fri, 11 Sep 2026 17:13:32 +0800
Subject: [PATCH 026/108] chore: satisfy network access CI style checks

---
 .../workspace/test_network_access_group.py     |  7 ++++++-
 .../core/network_access/test_client_ip.py      | 18 +++++++++---------
 .../test_network_access_group_repository.py    |  2 +-
 .../ip-policies-page/policy-dialog.tsx         |  2 +-
 4 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 92b762860888e4..436ea98740f0f2 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -406,7 +406,12 @@ def test_current_ip_check_uses_trusted_resolver_after_service_admission_and_disa
     service = MagicMock()
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
 
-    def check_current_ip(_context, *, group_id, client_ip_supplier):
+    def check_current_ip(
+        _context: RequestContext,
+        *,
+        group_id: str,
+        client_ip_supplier: Callable[[], str],
+    ) -> dict[str, object]:
         assert group_id == GROUP_ID
         return {"client_ip": client_ip_supplier(), "allowed": True, "policy_version": 4}
 
diff --git a/api/tests/unit_tests/core/network_access/test_client_ip.py b/api/tests/unit_tests/core/network_access/test_client_ip.py
index f10f812eacf850..b876f5b0a82de4 100644
--- a/api/tests/unit_tests/core/network_access/test_client_ip.py
+++ b/api/tests/unit_tests/core/network_access/test_client_ip.py
@@ -6,7 +6,7 @@
 
 
 @pytest.mark.parametrize("config", ["", TRUSTED])
-def test_untrusted_socket_ignores_all_forwarding_headers(config: str):
+def test_untrusted_socket_ignores_all_forwarding_headers(config: str) -> None:
     assert (
         resolve_network_access_client_ip(
             {
@@ -31,7 +31,7 @@ def test_untrusted_socket_ignores_all_forwarding_headers(config: str):
         (" 2001:0db8:0:0::1234 , 10.2.3.4 ", "2001:db8::1234"),
     ],
 )
-def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: str):
+def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected: str) -> None:
     assert (
         resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED)
         == expected
@@ -55,18 +55,18 @@ def test_trusted_chain_strips_only_rightmost_trusted_hops(header: str, expected:
         "x" * 2049,
     ],
 )
-def test_trusted_peer_rejects_missing_invalid_or_all_trusted_chains(header: object):
+def test_trusted_peer_rejects_missing_invalid_or_all_trusted_chains(header: object) -> None:
     with pytest.raises(NetworkAccessClientIPUnavailableError):
         resolve_network_access_client_ip({"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": header}, TRUSTED)
 
 
 @pytest.mark.parametrize("peer", [None, "", "unknown", "[::1]", "203.0.113.42:5000", "fe80::1%eth0", 1])
-def test_invalid_socket_peer_is_unavailable(peer: object):
+def test_invalid_socket_peer_is_unavailable(peer: object) -> None:
     with pytest.raises(NetworkAccessClientIPUnavailableError):
         resolve_network_access_client_ip({"REMOTE_ADDR": peer}, TRUSTED)
 
 
-def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted():
+def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted() -> None:
     environ = {
         "REMOTE_ADDR": "172.18.0.2",
         "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "203.0.113.42"},
@@ -75,7 +75,7 @@ def test_proxy_fix_cannot_make_untrusted_origin_appear_trusted():
     assert resolve_network_access_client_ip(environ, TRUSTED) == "203.0.113.42"
 
 
-def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite():
+def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite() -> None:
     environ = {
         "REMOTE_ADDR": "192.0.2.1",
         "werkzeug.proxy_fix.orig": {"REMOTE_ADDR": "172.18.0.2"},
@@ -85,7 +85,7 @@ def test_proxy_fix_preserves_trusted_socket_even_after_remote_addr_rewrite():
 
 
 @pytest.mark.parametrize("original", ["invalid", {}, {"REMOTE_ADDR": None}])
-def test_malformed_proxy_fix_original_is_unavailable(original: object):
+def test_malformed_proxy_fix_original_is_unavailable(original: object) -> None:
     with pytest.raises(NetworkAccessClientIPUnavailableError):
         resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42", "werkzeug.proxy_fix.orig": original}, TRUSTED)
 
@@ -93,12 +93,12 @@ def test_malformed_proxy_fix_original_is_unavailable(original: object):
 @pytest.mark.parametrize(
     "config", ["not-a-cidr", "172.18.0.1/16", "172.18.0.0/16,", "fe80::%eth0/64", "10.0.0.0/8," * 257]
 )
-def test_invalid_proxy_configuration_is_unavailable(config: str):
+def test_invalid_proxy_configuration_is_unavailable(config: str) -> None:
     with pytest.raises(NetworkAccessClientIPUnavailableError):
         resolve_network_access_client_ip({"REMOTE_ADDR": "203.0.113.42"}, config)
 
 
-def test_mapped_socket_and_proxy_cidr_match_ipv4():
+def test_mapped_socket_and_proxy_cidr_match_ipv4() -> None:
     assert (
         resolve_network_access_client_ip(
             {"REMOTE_ADDR": "::ffff:172.18.0.2", "HTTP_X_FORWARDED_FOR": "::ffff:203.0.113.42"},
diff --git a/api/tests/unit_tests/repositories/test_network_access_group_repository.py b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
index 59b1f3e92a8705..0e62ebf17b5bc0 100644
--- a/api/tests/unit_tests/repositories/test_network_access_group_repository.py
+++ b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
@@ -219,7 +219,7 @@ def test_list_apps_batch_loads_agent_routes_and_excludes_hidden_workflow_backing
 
     agent_selects: list[str] = []
 
-    def record_agent_select(_conn, _cursor, statement, _parameters, _context, _executemany) -> None:
+    def record_agent_select(_conn, _cursor, statement: str, _parameters, _context, _executemany) -> None:
         if "FROM agents" in statement:
             agent_selects.append(statement)
 
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index ab794d9cfb01ff..1db4de9ad53d2c 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -23,7 +23,7 @@ import {
   IP_POLICY_NAME_MAX_LENGTH,
 } from './validate-ip-entry'
 
-export type IpPolicyDialogSubmit = {
+type IpPolicyDialogSubmit = {
   name: string
   allowed_cidrs: string[]
 }

From 7c95008ab7f9c2a29b3b121f2e79350d31dd7724 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Fri, 11 Sep 2026 17:16:32 +0800
Subject: [PATCH 027/108] refactor: reuse network access point conversion

---
 .../app/access-point/access-control/network-access.ts         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/network-access.ts b/web/app/components/app/access-point/access-control/network-access.ts
index df273ca56d670a..7331cbdb779037 100644
--- a/web/app/components/app/access-point/access-control/network-access.ts
+++ b/web/app/components/app/access-point/access-control/network-access.ts
@@ -38,7 +38,7 @@ export function availabilityFromAccessPoints(
   const allowed = new Set(
     availableAccessPoints.flatMap((accessPoint) => {
       if (accessPoint in API_TO_ACCESS_POINT)
-        return [API_TO_ACCESS_POINT[accessPoint as NetworkAccessPoint]]
+        return [toUiAccessPoint(accessPoint as NetworkAccessPoint)]
       return []
     }),
   )
@@ -73,7 +73,7 @@ export function scopesFromAccessPoints(
   const selected = new Set(
     accessPoints.flatMap((accessPoint) => {
       if (accessPoint in API_TO_ACCESS_POINT)
-        return [API_TO_ACCESS_POINT[accessPoint as NetworkAccessPoint]]
+        return [toUiAccessPoint(accessPoint as NetworkAccessPoint)]
       return []
     }),
   )

From 1fdbbf479a40461a3cc9f2042f50412d0fc0b445 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Fri, 11 Sep 2026 19:03:02 +0800
Subject: [PATCH 028/108] fix(web): create IP policies in-place and keep
 apply-to independent

Open the New IP Policy dialog from Access Control instead of full Settings.
Keep all four apply-to toggles selectable, drop Not enabled coupling with
app-supported surfaces, and still persist only backend-accepted access points.
---
 .../__tests__/chip-status.spec.ts             |  40 +--
 .../__tests__/config-panel.spec.tsx           |  78 ++----
 .../access-control/__tests__/draft.spec.ts    | 107 +-------
 .../access-control/__tests__/index.spec.tsx   | 118 ++++++++-
 .../__tests__/network-access.spec.ts          |  78 +++---
 .../access-control/chip-status.ts             |  21 +-
 .../access-control/config-panel.tsx           |  28 +--
 .../app/access-point/access-control/draft.ts  |  70 +-----
 .../app/access-point/access-control/index.tsx | 237 ++++++++++--------
 .../access-control/network-access.ts          |  48 ++--
 .../access-control/scope-list.tsx             |  36 +--
 .../access-control/status-panel.tsx           |  31 +--
 12 files changed, 383 insertions(+), 509 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
index 8b0bb0ce6daaae..d9d35ac7d01e75 100644
--- a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
@@ -1,12 +1,5 @@
 import { getAccessControlChipState, getInServiceCoverage } from '../chip-status'
 
-const availability = {
-  webApp: true,
-  serviceApi: true,
-  mcp: true,
-  trigger: false,
-}
-
 const assignment = {
   policyId: 'internal-network',
   policyName: 'Internal Network',
@@ -14,19 +7,16 @@ const assignment = {
     webApp: true,
     serviceApi: true,
     mcp: true,
-    trigger: false,
+    trigger: true,
   },
   enabled: true,
 }
 
 describe('getInServiceCoverage', () => {
-  it('ignores unavailable access points in the denominator', () => {
+  it('counts selected access points against every configured access point', () => {
     expect(
-      getInServiceCoverage(
-        { webApp: true, serviceApi: true, mcp: false, trigger: true },
-        availability,
-      ),
-    ).toEqual({ coveredCount: 2, inServiceCount: 3 })
+      getInServiceCoverage({ webApp: true, serviceApi: true, mcp: false, trigger: true }),
+    ).toEqual({ coveredCount: 3, inServiceCount: 4 })
   })
 })
 
@@ -36,7 +26,6 @@ describe('getAccessControlChipState', () => {
       getAccessControlChipState({
         entitled: false,
         assignment: null,
-        availability,
       }).kind,
     ).toBe('pro')
   })
@@ -46,7 +35,6 @@ describe('getAccessControlChipState', () => {
       getAccessControlChipState({
         entitled: false,
         assignment,
-        availability,
       }).kind,
     ).toBe('on')
   })
@@ -56,7 +44,6 @@ describe('getAccessControlChipState', () => {
       getAccessControlChipState({
         entitled: true,
         assignment: null,
-        availability,
       }),
     ).toEqual({ kind: 'off', coveredCount: 0, inServiceCount: 0 })
   })
@@ -66,32 +53,30 @@ describe('getAccessControlChipState', () => {
       getAccessControlChipState({
         entitled: true,
         assignment: { ...assignment, enabled: false },
-        availability,
       }),
     ).toEqual({
       kind: 'paused',
       policyName: 'Internal Network',
-      coveredCount: 3,
-      inServiceCount: 3,
+      coveredCount: 4,
+      inServiceCount: 4,
     })
   })
 
-  it('returns on when every in-service access point is covered', () => {
+  it('returns on when every access point is covered', () => {
     expect(
       getAccessControlChipState({
         entitled: true,
         assignment,
-        availability,
       }),
     ).toEqual({
       kind: 'on',
       policyName: 'Internal Network',
-      coveredCount: 3,
-      inServiceCount: 3,
+      coveredCount: 4,
+      inServiceCount: 4,
     })
   })
 
-  it('returns partial when some in-service access points are excluded', () => {
+  it('returns partial when some access points are excluded', () => {
     expect(
       getAccessControlChipState({
         entitled: true,
@@ -99,13 +84,12 @@ describe('getAccessControlChipState', () => {
           ...assignment,
           scopes: { ...assignment.scopes, mcp: false },
         },
-        availability,
       }),
     ).toEqual({
       kind: 'partial',
       policyName: 'Internal Network',
-      coveredCount: 2,
-      inServiceCount: 3,
+      coveredCount: 3,
+      inServiceCount: 4,
     })
   })
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index 3f210e7edbb2b5..30195b987e4ad7 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -1,8 +1,4 @@
-import type {
-  AccessControlDraft,
-  AccessControlPolicy,
-  AccessControlScopeAvailability,
-} from '../draft'
+import type { AccessControlDraft, AccessControlPolicy } from '../draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
@@ -11,13 +7,6 @@ import { render } from '@/test/console/render'
 import { AccessControlConfigPanel } from '../config-panel'
 import { createDefaultAccessControlDraft } from '../draft'
 
-const allScopesAvailable: AccessControlScopeAvailability = {
-  webApp: true,
-  serviceApi: true,
-  mcp: true,
-  trigger: true,
-}
-
 const policies: AccessControlPolicy[] = [
   {
     id: 'internal-network',
@@ -48,7 +37,6 @@ const translations = vi.hoisted(() => ({
   'studio.accessControl.lockoutWarning':
     "Your IP ({{ip}}) isn't in this policy. You may lose access.",
   'studio.accessControl.manageIpPolicies': 'Manage IP policies',
-  'studio.accessControl.notEnabled': 'Not enabled',
   'studio.accessControl.policySummaryMany': 'Allows {{listed}} and {{count}} more addresses',
   'studio.accessControl.policySummaryOne': 'Allows {{address}}',
   'studio.accessControl.selectAccessPoint': 'Select at least one access point to protect.',
@@ -61,12 +49,10 @@ vi.mock('react-i18next', async () => {
 })
 
 function PanelHarness({
-  availability = allScopesAvailable,
   currentIp,
   initialDraft = createDefaultAccessControlDraft(),
   onSave = vi.fn(),
 }: {
-  availability?: AccessControlScopeAvailability
   currentIp?: string
   initialDraft?: AccessControlDraft
   onSave?: () => void
@@ -84,7 +70,6 @@ function PanelHarness({
           draft={draft}
           policies={policies}
           currentIp={currentIp}
-          availability={availability}
           onCancel={onCancel}
           onCreatePolicy={onCreatePolicy}
           onManagePolicies={onManagePolicies}
@@ -102,7 +87,22 @@ describe('AccessControlConfigPanel', () => {
 
     expect(await screen.findByRole('option', { name: /Internal Network/ })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
-    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
   })
 
   it('enables save after a policy is selected', async () => {
@@ -125,7 +125,7 @@ describe('AccessControlConfigPanel', () => {
     expect(onSave).toHaveBeenCalledTimes(1)
   })
 
-  it('warns and disables save when every protectable access point is off', async () => {
+  it('warns and disables save when every access point is off', async () => {
     const user = userEvent.setup()
     render(<PanelHarness />)
 
@@ -133,6 +133,7 @@ describe('AccessControlConfigPanel', () => {
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
     await user.click(screen.getByRole('switch', { name: 'Backend Service API' }))
     await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
 
     expect(screen.getByText('Select at least one access point to protect.')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
@@ -150,26 +151,8 @@ describe('AccessControlConfigPanel', () => {
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
   })
 
-  it('marks an unavailable MCP server as not enabled', () => {
-    render(
-      <PanelHarness
-        initialDraft={{
-          ...createDefaultAccessControlDraft(),
-          selectedPolicyId: 'internal-network',
-          enabled: true,
-        }}
-        availability={{ ...allScopesAvailable, mcp: false }}
-      />,
-    )
-
-    expect(screen.getByText('Not enabled')).toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-  })
-
-  it('disables MCP and Trigger for agent apps', () => {
+  it('lets the user turn any access point off without a Not enabled label', async () => {
+    const user = userEvent.setup()
     render(
       <PanelHarness
         initialDraft={{
@@ -177,22 +160,13 @@ describe('AccessControlConfigPanel', () => {
           selectedPolicyId: 'internal-network',
           enabled: true,
         }}
-        availability={{ webApp: true, serviceApi: true, mcp: false, trigger: false }}
       />,
     )
 
-    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.queryByText('Not enabled')).not.toBeInTheDocument()
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
+    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
   })
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
index cbf7652361d862..3510c0d5e9f7b9 100644
--- a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -2,20 +2,7 @@ import {
   policyIncludesIp,
   splitPolicySummary,
 } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
-import { AppModeEnum } from '@/types/app'
-import {
-  canSaveAccessControl,
-  createDefaultAccessControlDraft,
-  getAccessControlScopeAvailability,
-  getAccessControlScopeSupport,
-} from '../draft'
-
-const allScopesAvailable = {
-  webApp: true,
-  serviceApi: true,
-  mcp: true,
-  trigger: true,
-}
+import { canSaveAccessControl, createDefaultAccessControlDraft } from '../draft'
 
 const selectedDraft = {
   ...createDefaultAccessControlDraft(),
@@ -24,15 +11,10 @@ const selectedDraft = {
 
 describe('canSaveAccessControl', () => {
   it('disables save when no policy is selected', () => {
-    expect(
-      canSaveAccessControl({
-        draft: createDefaultAccessControlDraft(),
-        availability: { ...allScopesAvailable, trigger: false },
-      }),
-    ).toBe(false)
+    expect(canSaveAccessControl({ draft: createDefaultAccessControlDraft() })).toBe(false)
   })
 
-  it('disables save when every protectable access point is off', () => {
+  it('disables save when every access point is off', () => {
     expect(
       canSaveAccessControl({
         draft: {
@@ -42,24 +24,18 @@ describe('canSaveAccessControl', () => {
             webApp: false,
             serviceApi: false,
             mcp: false,
-            trigger: true,
+            trigger: false,
           },
         },
-        availability: { ...allScopesAvailable, trigger: false },
       }),
     ).toBe(false)
   })
 
   it('enables save when a policy is selected and at least one access point is on', () => {
-    expect(
-      canSaveAccessControl({
-        draft: selectedDraft,
-        availability: { ...allScopesAvailable, trigger: false },
-      }),
-    ).toBe(true)
+    expect(canSaveAccessControl({ draft: selectedDraft })).toBe(true)
   })
 
-  it('counts an enabled trigger only when that access point is available', () => {
+  it('counts trigger as a selectable access point', () => {
     expect(
       canSaveAccessControl({
         draft: {
@@ -72,12 +48,11 @@ describe('canSaveAccessControl', () => {
             trigger: true,
           },
         },
-        availability: allScopesAvailable,
       }),
     ).toBe(true)
   })
 
-  it('does not count an unavailable MCP server toward save', () => {
+  it('does not enable save when none of the selected access points can be persisted', () => {
     expect(
       canSaveAccessControl({
         draft: {
@@ -86,11 +61,11 @@ describe('canSaveAccessControl', () => {
           scopes: {
             webApp: false,
             serviceApi: false,
-            mcp: true,
-            trigger: false,
+            mcp: false,
+            trigger: true,
           },
         },
-        availability: { ...allScopesAvailable, mcp: false, trigger: false },
+        persistableAccessPoints: [],
       }),
     ).toBe(false)
   })
@@ -99,7 +74,6 @@ describe('canSaveAccessControl', () => {
     expect(
       canSaveAccessControl({
         draft: selectedDraft,
-        availability: { ...allScopesAvailable, trigger: false },
         baseline: selectedDraft,
       }),
     ).toBe(false)
@@ -109,73 +83,12 @@ describe('canSaveAccessControl', () => {
     expect(
       canSaveAccessControl({
         draft: { ...selectedDraft, enabled: false },
-        availability: { ...allScopesAvailable, trigger: false },
         baseline: selectedDraft,
       }),
     ).toBe(true)
   })
 })
 
-describe('getAccessControlScopeSupport', () => {
-  it('lets workflow apps apply to every access point', () => {
-    expect(getAccessControlScopeSupport(AppModeEnum.WORKFLOW)).toEqual({
-      webApp: true,
-      serviceApi: true,
-      mcp: true,
-      trigger: true,
-    })
-  })
-
-  it('lets agent apps apply only to Web App and Backend Service API', () => {
-    expect(getAccessControlScopeSupport(AppModeEnum.AGENT)).toEqual({
-      webApp: true,
-      serviceApi: true,
-      mcp: false,
-      trigger: false,
-    })
-  })
-
-  it.each([
-    AppModeEnum.ADVANCED_CHAT,
-    AppModeEnum.CHAT,
-    AppModeEnum.COMPLETION,
-    AppModeEnum.AGENT_CHAT,
-  ])('does not let %s apps apply to Trigger', (mode) => {
-    expect(getAccessControlScopeSupport(mode)).toEqual({
-      webApp: true,
-      serviceApi: true,
-      mcp: true,
-      trigger: false,
-    })
-  })
-})
-
-describe('getAccessControlScopeAvailability', () => {
-  it('keeps workflow Trigger off until a published trigger node exists', () => {
-    expect(
-      getAccessControlScopeAvailability({
-        mode: AppModeEnum.WORKFLOW,
-        hasTriggerNode: false,
-        isUnpublished: false,
-      }).trigger,
-    ).toBe(false)
-    expect(
-      getAccessControlScopeAvailability({
-        mode: AppModeEnum.WORKFLOW,
-        hasTriggerNode: true,
-        isUnpublished: true,
-      }).trigger,
-    ).toBe(false)
-    expect(
-      getAccessControlScopeAvailability({
-        mode: AppModeEnum.WORKFLOW,
-        hasTriggerNode: true,
-        isUnpublished: false,
-      }).trigger,
-    ).toBe(true)
-  })
-})
-
 describe('splitPolicySummary', () => {
   it('keeps one or two addresses listed', () => {
     expect(splitPolicySummary(['203.0.113.42'])).toEqual({
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 12f9950c63d5a6..cee1e530a801b0 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -15,13 +15,28 @@ const mockSetPricing = vi.fn()
 const mockSetSettingsDestination = vi.fn()
 const accessControlTranslations = vi.hoisted(() => ({
   'operation.cancel': 'Cancel',
+  'operation.close': 'Close',
   'operation.save': 'Save',
   'overview.apiInfo.title': 'Backend Service API',
   'overview.appInfo.title': 'Web App',
   'mcp.server.title': 'MCP Server',
+  'settings.ipPolicies': 'IP Policies',
+  'settings.ipPolicyAddEntry': 'Add',
+  'settings.ipPolicyAllowlist': 'Allowlist',
+  'settings.ipPolicyAllowlistHelp':
+    'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
+  'settings.ipPolicyCreate': 'Create',
+  'settings.ipPolicyDialogDescription':
+    'Specify which IP addresses or ranges can access your apps.',
+  'settings.ipPolicyName': 'Name',
+  'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
+  'settings.ipPolicyNewTitle': 'New IP Policy',
+  'settings.ipPolicyRemoveEntry': 'Remove entry',
   'settings.trigger': 'Trigger',
+  'studio.accessControl.addressCount': '{{count}} addresses',
   'studio.accessControl.applyTo': 'Apply to',
   'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
+  'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
   'studio.accessControl.createIpPolicy': 'Create an IP policy',
   'studio.accessControl.emptyPoliciesDescription':
     'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
@@ -31,19 +46,24 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.chipPartial': '{{n}} of {{m}}',
   'studio.accessControl.entryLabel': 'Access Control',
   'studio.accessControl.ipPolicy': 'IP Policy',
+  'studio.accessControl.manageIpPolicies': 'Manage IP policies',
   'studio.accessControl.notEnabled': 'Not enabled',
   'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.',
   'studio.accessControl.paywallTitle': 'Access Control',
+  'studio.accessControl.policySummaryOne': 'Allows {{address}}',
   'studio.accessControl.previewAppName': 'Code Companion',
   'studio.accessControl.previewCaption':
     "This app is only available on your organization's network.",
   'studio.accessControl.proBadge': 'PRO',
+  'studio.accessControl.selectPolicy': 'Select a policy',
   'studio.accessControl.tooltipOff': 'Not set up',
   'studio.accessControl.tooltipPro': 'Access control requires the Pro plan',
   'studio.accessControl.turnOn': 'Turn on Access Control',
   'studio.accessControl.restrictByIp': 'Restrict by IP address',
   'studio.accessControl.restrictedTo': 'Restricted to {{name}}',
+  'studio.accessControl.excluded': 'Excluded',
   'studio.accessControl.protectingAll': 'Protecting all {{count}} access points in service.',
+  'studio.accessControl.protectingPartial': 'Protecting {{n}} of {{m}} access points in service.',
   'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
   'operation.edit': 'Edit',
   'studio.accessControl.turnOffTitle': 'Turn off access control?',
@@ -143,7 +163,7 @@ describe('AccessControlEntry', () => {
       },
     })
 
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Turn on Access Control' })).toBeInTheDocument()
@@ -221,30 +241,106 @@ describe('AccessControlEntry', () => {
     ).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
-    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
-    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
       'aria-disabled',
       'true',
     )
-    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
       'aria-disabled',
       'true',
     )
-    expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
-    expect(screen.getByText('Not enabled')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+    expect(screen.queryByText('Not enabled')).not.toBeInTheDocument()
   })
 
-  it('sends paid users to Settings IP Policies from the empty-state exit', async () => {
+  it('opens the new policy dialog from the empty-state create action', async () => {
     const user = userEvent.setup()
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
     await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
 
-    expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
+    expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
+    expect(mockSetSettingsDestination).not.toHaveBeenCalled()
+  })
+
+  it('returns to the empty-state config after canceling the new policy dialog', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+    await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Cancel' }))
+
     await waitFor(() => {
-      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+      expect(screen.queryByRole('heading', { name: 'New IP Policy' })).not.toBeInTheDocument()
     })
+    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
+    expect(mockSetSettingsDestination).not.toHaveBeenCalled()
+  })
+
+  it('posts a new policy from the empty-state dialog without opening Settings', async () => {
+    const user = userEvent.setup()
+    const created = createNetworkAccessGroupFixture({
+      id: 'group-office',
+      name: 'Office',
+      allowed_cidrs: ['10.0.0.0/8'],
+    })
+    const posted: Array<{ method: string; url: string; body: unknown }> = []
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      const bodyText =
+        request.method === 'GET' || request.method === 'HEAD' ? '' : await request.text()
+      posted.push({
+        method: request.method,
+        url: request.url,
+        body: bodyText ? JSON.parse(bodyText) : null,
+      })
+      return new Response(JSON.stringify({ group: created }), {
+        status: 201,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(posted).toContainEqual({
+        method: 'POST',
+        url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups',
+        body: {
+          name: 'Office',
+          description: '',
+          allowed_cidrs: ['10.0.0.0/8'],
+        },
+      })
+    })
+    expect(mockSetSettingsDestination).not.toHaveBeenCalled()
+  })
+
+  it('sends paid users to Settings IP Policies from manage', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Manage IP policies' }))
+
+    expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
   })
 
   it('closes the first-time config on Cancel without opening settings', async () => {
@@ -279,7 +375,7 @@ describe('AccessControlEntry', () => {
       },
     })
 
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
     expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
@@ -308,6 +404,6 @@ describe('AccessControlEntry', () => {
     await user.click(screen.getByRole('button', { name: 'Turn off' }))
 
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
   })
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
index 9856b34c8439ac..63c51d27717d6b 100644
--- a/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
@@ -1,6 +1,5 @@
 import {
   accessPointsFromScopes,
-  availabilityFromAccessPoints,
   draftFromBinding,
   getNetworkAccessErrorStatus,
   scopesFromAccessPoints,
@@ -8,13 +7,6 @@ import {
   toUiAccessPoint,
 } from '../network-access'
 
-const allAvailable = {
-  webApp: true,
-  serviceApi: true,
-  mcp: true,
-  trigger: true,
-}
-
 describe('network access mappers', () => {
   it('maps UI access points to the Console contract', () => {
     expect(toApiAccessPoint('webApp')).toBe('webapp')
@@ -23,30 +15,13 @@ describe('network access mappers', () => {
     expect(toUiAccessPoint('service_api')).toBe('serviceApi')
   })
 
-  it('builds availability from the server access-point matrix', () => {
-    expect(availabilityFromAccessPoints(['webapp', 'service_api', 'mcp'], true)).toEqual({
-      webApp: true,
-      serviceApi: true,
-      mcp: true,
-      trigger: false,
-    })
-    expect(
-      availabilityFromAccessPoints(['webapp', 'service_api', 'mcp', 'trigger'], false),
-    ).toEqual({
-      webApp: true,
-      serviceApi: true,
-      mcp: true,
-      trigger: false,
-    })
-  })
-
   it('reads HTTP status from Response and nested response objects', () => {
     expect(getNetworkAccessErrorStatus(new Response(null, { status: 409 }))).toBe(409)
     expect(getNetworkAccessErrorStatus({ response: { status: 409 } })).toBe(409)
   })
 
-  it('builds scopes from selected API access points and available ones', () => {
-    expect(scopesFromAccessPoints(['webapp', 'mcp'], allAvailable)).toEqual({
+  it('builds scopes from selected API access points', () => {
+    expect(scopesFromAccessPoints(['webapp', 'mcp'])).toEqual({
       webApp: true,
       serviceApi: false,
       mcp: true,
@@ -54,17 +29,33 @@ describe('network access mappers', () => {
     })
   })
 
-  it('omits unavailable scopes when assembling a PUT payload', () => {
+  it('includes every selected access point in the PUT payload', () => {
+    expect(
+      accessPointsFromScopes({
+        webApp: true,
+        serviceApi: true,
+        mcp: true,
+        trigger: true,
+      }),
+    ).toEqual(['webapp', 'service_api', 'mcp', 'trigger'])
+  })
+
+  it('omits selected access points the backend does not accept for this app', () => {
     expect(
       accessPointsFromScopes(
-        { webApp: true, serviceApi: true, mcp: true, trigger: true },
-        { ...allAvailable, trigger: false },
+        {
+          webApp: true,
+          serviceApi: true,
+          mcp: true,
+          trigger: true,
+        },
+        ['webapp', 'service_api', 'mcp'],
       ),
     ).toEqual(['webapp', 'service_api', 'mcp'])
   })
 
   it('creates an empty draft when the app has no binding', () => {
-    expect(draftFromBinding(null, allAvailable)).toEqual({
+    expect(draftFromBinding(null)).toEqual({
       selectedPolicyId: null,
       enabled: true,
       scopes: {
@@ -78,20 +69,17 @@ describe('network access mappers', () => {
 
   it('hydrates a draft from a bound group', () => {
     expect(
-      draftFromBinding(
-        {
-          id: 'binding-1',
-          tenant_id: 'workspace-1',
-          app_id: 'app-1',
-          enabled: true,
-          group_id: 'group-1',
-          access_points: ['webapp', 'service_api'],
-          version: 3,
-          created_at: '2026-01-01T00:00:00Z',
-          updated_at: '2026-01-01T00:00:00Z',
-        },
-        allAvailable,
-      ),
+      draftFromBinding({
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api'],
+        version: 3,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      }),
     ).toEqual({
       selectedPolicyId: 'group-1',
       enabled: true,
diff --git a/web/app/components/app/access-point/access-control/chip-status.ts b/web/app/components/app/access-point/access-control/chip-status.ts
index 557c050fe2d958..8833d78767e5a5 100644
--- a/web/app/components/app/access-point/access-control/chip-status.ts
+++ b/web/app/components/app/access-point/access-control/chip-status.ts
@@ -1,4 +1,4 @@
-import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessControlDraft } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 
@@ -18,34 +18,28 @@ export type AccessControlChipState = {
   policyName?: string
 }
 
-export function getInServiceCoverage(
-  scopes: Record<AccessPoint, boolean>,
-  availability: AccessControlScopeAvailability,
-) {
-  const inService = ACCESS_POINT_ORDER.filter((scope) => availability[scope])
-  const covered = inService.filter((scope) => scopes[scope])
+export function getInServiceCoverage(scopes: Record<AccessPoint, boolean>) {
+  const covered = ACCESS_POINT_ORDER.filter((scope) => scopes[scope])
 
   return {
     coveredCount: covered.length,
-    inServiceCount: inService.length,
+    inServiceCount: ACCESS_POINT_ORDER.length,
   }
 }
 
 export function getAccessControlChipState({
   entitled,
   assignment,
-  availability,
 }: {
   entitled?: boolean
   assignment: AccessControlAssignment | null
-  availability: AccessControlScopeAvailability
 }): AccessControlChipState {
   if (!assignment) {
     if (entitled === false) return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
     return { kind: 'off', coveredCount: 0, inServiceCount: 0 }
   }
 
-  const coverage = getInServiceCoverage(assignment.scopes, availability)
+  const coverage = getInServiceCoverage(assignment.scopes)
 
   if (!assignment.enabled) {
     return {
@@ -56,10 +50,7 @@ export function getAccessControlChipState({
   }
 
   return {
-    kind:
-      coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
-        ? 'on'
-        : 'partial',
+    kind: coverage.coveredCount === coverage.inServiceCount ? 'on' : 'partial',
     policyName: assignment.policyName,
     ...coverage,
   }
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 9ae1ac637d8c1f..b4c00ee2bcd49e 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -1,18 +1,14 @@
 'use client'
 
 import type { FormEvent } from 'react'
-import type {
-  AccessControlDraft,
-  AccessControlPolicy,
-  AccessControlScopeAvailability,
-} from './draft'
+import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { PopoverTitle } from '@langgenius/dify-ui/popover'
 import { useTranslation } from 'react-i18next'
-import { canSaveAccessControl, hasSelectedProtectableAccessPoint } from './draft'
+import { canSaveAccessControl, hasSelectedAccessPoint } from './draft'
 import { AccessControlPolicyField } from './policy-field'
 import { AccessControlScopeList } from './scope-list'
 
@@ -20,7 +16,7 @@ type AccessControlConfigPanelProps = {
   draft: AccessControlDraft
   policies: readonly AccessControlPolicy[]
   currentIp?: string
-  availability: AccessControlScopeAvailability
+  persistableAccessPoints?: readonly string[]
   baseline?: AccessControlDraft
   showBack?: boolean
   saving?: boolean
@@ -36,7 +32,7 @@ export function AccessControlConfigPanel({
   draft,
   policies,
   currentIp,
-  availability,
+  persistableAccessPoints,
   baseline,
   showBack = false,
   saving = false,
@@ -50,7 +46,10 @@ export function AccessControlConfigPanel({
   const { t } = useTranslation()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
-  const canSave = canSaveAccessControl({ draft, availability, baseline })
+  const hasPersistableSelection = persistableAccessPoints
+    ? persistableAccessPoints.length > 0
+    : hasSelectedAccessPoint(draft)
+  const canSave = canSaveAccessControl({ draft, baseline, persistableAccessPoints })
 
   const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
     event.preventDefault()
@@ -99,7 +98,7 @@ export function AccessControlConfigPanel({
           />
         </Fieldset>
 
-        <Fieldset className={cn('flex w-full flex-col gap-1', !hasSelectedPolicy && 'opacity-40')}>
+        <Fieldset className="flex w-full flex-col gap-1">
           <FieldsetLegend className="mb-0 py-0">
             {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
           </FieldsetLegend>
@@ -108,13 +107,8 @@ export function AccessControlConfigPanel({
               ? t(($) => $['studio.accessControl.applyToHelpSelected'], { ns: 'deployments' })
               : t(($) => $['studio.accessControl.applyToHelp'], { ns: 'deployments' })}
           </p>
-          <AccessControlScopeList
-            draft={draft}
-            disabled={!hasSelectedPolicy}
-            availability={availability}
-            onDraftChange={onDraftChange}
-          />
-          {hasSelectedPolicy && !hasSelectedProtectableAccessPoint(draft, availability) && (
+          <AccessControlScopeList draft={draft} onDraftChange={onDraftChange} />
+          {hasSelectedPolicy && draft.enabled && !hasPersistableSelection && (
             <p className="system-xs-regular text-text-warning">
               {t(($) => $['studio.accessControl.selectAccessPoint'], { ns: 'deployments' })}
             </p>
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
index 947f4b6119ca5f..a9bde917d5d467 100644
--- a/web/app/components/app/access-point/access-control/draft.ts
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -1,9 +1,6 @@
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
-import { AppModeEnum } from '@/types/app'
-
-export type AccessControlScopeAvailability = Record<AccessPoint, boolean>
 
 export type AccessControlPolicy = Pick<NetworkAccessGroupResponse, 'id' | 'name' | 'allowed_cidrs'>
 
@@ -13,57 +10,17 @@ export type AccessControlDraft = {
   enabled: boolean
 }
 
-export const createDefaultAccessControlDraft = (
-  availability?: AccessControlScopeAvailability,
-): AccessControlDraft => ({
+export const createDefaultAccessControlDraft = (): AccessControlDraft => ({
   selectedPolicyId: null,
   enabled: true,
   scopes: {
-    webApp: availability?.webApp ?? true,
-    serviceApi: availability?.serviceApi ?? true,
-    mcp: availability?.mcp ?? true,
-    trigger: availability?.trigger ?? false,
+    webApp: true,
+    serviceApi: true,
+    mcp: true,
+    trigger: true,
   },
 })
 
-export function getAccessControlScopeSupport(
-  mode: AppModeEnum | undefined,
-): AccessControlScopeAvailability {
-  if (mode === AppModeEnum.AGENT) {
-    return { webApp: true, serviceApi: true, mcp: false, trigger: false }
-  }
-
-  if (mode === AppModeEnum.WORKFLOW) {
-    return { webApp: true, serviceApi: true, mcp: true, trigger: true }
-  }
-
-  return { webApp: true, serviceApi: true, mcp: true, trigger: false }
-}
-
-export function getAccessControlScopeAvailability({
-  mode,
-  hasTriggerNode,
-  isUnpublished,
-}: {
-  mode: AppModeEnum | undefined
-  hasTriggerNode: boolean
-  isUnpublished: boolean
-}): AccessControlScopeAvailability {
-  const support = getAccessControlScopeSupport(mode)
-
-  return {
-    ...support,
-    trigger: support.trigger && !isUnpublished && hasTriggerNode,
-  }
-}
-
-export function isProtectableAccessPoint(
-  scope: AccessPoint,
-  availability: AccessControlScopeAvailability,
-) {
-  return availability[scope]
-}
-
 export function isAccessControlDraftEqual(left: AccessControlDraft, right: AccessControlDraft) {
   if (left.selectedPolicyId !== right.selectedPolicyId) return false
   if (left.enabled !== right.enabled) return false
@@ -71,27 +28,22 @@ export function isAccessControlDraftEqual(left: AccessControlDraft, right: Acces
   return ACCESS_POINT_ORDER.every((scope) => left.scopes[scope] === right.scopes[scope])
 }
 
-export function hasSelectedProtectableAccessPoint(
-  draft: AccessControlDraft,
-  availability: AccessControlScopeAvailability,
-) {
-  return ACCESS_POINT_ORDER.some((scope) => {
-    if (!isProtectableAccessPoint(scope, availability)) return false
-    return draft.scopes[scope]
-  })
+export function hasSelectedAccessPoint(draft: AccessControlDraft) {
+  return ACCESS_POINT_ORDER.some((scope) => draft.scopes[scope])
 }
 
 export function canSaveAccessControl({
   draft,
-  availability,
   baseline,
+  persistableAccessPoints,
 }: {
   draft: AccessControlDraft
-  availability: AccessControlScopeAvailability
   baseline?: AccessControlDraft
+  persistableAccessPoints?: readonly string[]
 }) {
   if (baseline && isAccessControlDraftEqual(draft, baseline)) return false
   if (!draft.enabled) return Boolean(draft.selectedPolicyId)
   if (!draft.selectedPolicyId) return false
-  return hasSelectedProtectableAccessPoint(draft, availability)
+  if (persistableAccessPoints) return persistableAccessPoints.length > 0
+  return hasSelectedAccessPoint(draft)
 }
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 11853025437772..b15b2a2fb6843a 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -14,6 +14,7 @@ import {
   pricingQueryParamName,
   pricingQueryParser,
 } from '@/app/components/billing/pricing/query-params'
+import { IpPolicyDialog } from '@/app/components/header/account-setting/ip-policies-page/policy-dialog'
 import {
   settingsQueryParamName,
   settingsQueryParser,
@@ -21,20 +22,13 @@ import {
 import { isCurrentWorkspaceManagerAtom } from '@/context/workspace-state'
 import { deploymentEditionAtom } from '@/features/system-features/state'
 import { consoleQuery } from '@/service/console'
-import { useAppWorkflow } from '@/service/use-workflow'
-import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
 import { AccessControlChipAffix } from './chip-affix'
 import { getAccessControlChipState } from './chip-status'
 import { AccessControlConfigPanel } from './config-panel'
-import {
-  canSaveAccessControl,
-  getAccessControlScopeAvailability,
-  isAccessControlDraftEqual,
-} from './draft'
+import { canSaveAccessControl, isAccessControlDraftEqual } from './draft'
 import { AccessControlFreePaywall } from './free-paywall'
 import {
   accessPointsFromScopes,
-  availabilityFromAccessPoints,
   draftFromBinding,
   getNetworkAccessErrorStatus,
   scopesFromAccessPoints,
@@ -56,10 +50,6 @@ export function AccessControlEntry() {
   const appInfo = useAppStore((state) => state.appDetail)
   const appId = appInfo?.id
   const canFetchNetworkAccess = deploymentEdition === 'CLOUD' && isManager
-  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo))
-  const { data: workflow } = useAppWorkflow(
-    shouldFetchWorkflow && canFetchNetworkAccess && appInfo ? appInfo.id : '',
-  )
   const groupsQuery = useQuery(
     consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions({
       enabled: canFetchNetworkAccess,
@@ -77,10 +67,14 @@ export function AccessControlEntry() {
   const updateBinding = useMutation(
     consoleQuery.apps.byAppId.networkAccessGroup.put.mutationOptions(),
   )
+  const createGroup = useMutation(
+    consoleQuery.workspaces.current.networkAccessGroups.post.mutationOptions(),
+  )
   const [open, setOpen] = useState(false)
   const [view, setView] = useState<'config' | 'status'>('status')
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
+  const [createPolicyOpen, setCreatePolicyOpen] = useState(false)
 
   const bindingErrorStatus = getNetworkAccessErrorStatus(bindingQuery.error)
   const hideForUnsupportedApp =
@@ -93,16 +87,6 @@ export function AccessControlEntry() {
   if (groupsQuery.isPending || (appId && bindingQuery.isPending)) return null
 
   const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
-  const workflowState = appInfo ? getPublishedWorkflowState(appInfo, workflow) : undefined
-  const triggerAvailable = getAccessControlScopeAvailability({
-    mode: appInfo?.mode,
-    hasTriggerNode: Boolean(workflowState?.hasTriggerNode),
-    isUnpublished: Boolean(workflowState?.isUnpublished),
-  }).trigger
-  const availability = availabilityFromAccessPoints(
-    bindingQuery.data?.available_access_points ?? [],
-    triggerAvailable,
-  )
   const groups = groupsQuery.data?.groups ?? []
   const binding = bindingQuery.data?.binding
   const policies = groups.map((group) => ({
@@ -110,25 +94,29 @@ export function AccessControlEntry() {
     name: group.name,
     allowed_cidrs: group.allowed_cidrs,
   }))
-  const baseline = draftFromBinding(binding, availability)
+  const baseline = draftFromBinding(binding)
   const resolvedDraft = draft ?? baseline
   const assignment: AccessControlAssignment | null = binding?.group_id
     ? {
         policyId: binding.group_id,
         policyName: groups.find((group) => group.id === binding.group_id)?.name ?? binding.group_id,
-        scopes: scopesFromAccessPoints(binding.access_points, availability),
+        scopes: scopesFromAccessPoints(binding.access_points),
         enabled: binding.enabled,
       }
     : null
   const entitled = bindingQuery.data?.entitled ?? groupsQuery.data?.entitled
   const canMutate = entitled === true
   const dirty = !isAccessControlDraftEqual(resolvedDraft, baseline)
+  const persistableAccessPoints = accessPointsFromScopes(
+    resolvedDraft.scopes,
+    bindingQuery.data?.available_access_points,
+  )
   const canSave = canSaveAccessControl({
     draft: resolvedDraft,
-    availability,
     baseline,
+    persistableAccessPoints,
   })
-  const chip = getAccessControlChipState({ entitled, assignment, availability })
+  const chip = getAccessControlChipState({ entitled, assignment })
   const showPaywall = chip.kind === 'pro'
   const showStatus = Boolean(assignment) && (view === 'status' || !canMutate)
 
@@ -176,10 +164,21 @@ export function AccessControlEntry() {
   }
 
   const handleCreatePolicy = () => {
+    setOpen(false)
+    setCreatePolicyOpen(true)
+  }
+
+  const handleManagePolicies = () => {
     setOpen(false)
     void setSettingsDestination('ip-policies')
   }
 
+  const handlePolicyDialogOpenChange = (nextOpen: boolean) => {
+    if (nextOpen) return
+    setCreatePolicyOpen(false)
+    setOpen(true)
+  }
+
   const persistBinding = (
     {
       enabled,
@@ -228,7 +227,7 @@ export function AccessControlEntry() {
       {
         enabled: resolvedDraft.enabled,
         groupId: resolvedDraft.selectedPolicyId,
-        accessPoints: accessPointsFromScopes(resolvedDraft.scopes, availability),
+        accessPoints: persistableAccessPoints,
       },
       () => {
         setDraft(null)
@@ -244,79 +243,121 @@ export function AccessControlEntry() {
   }
 
   return (
-    <Tooltip>
-      <Popover
-        open={open}
-        onOpenChange={(nextOpen) => {
-          setOpen(nextOpen)
-          if (!nextOpen) {
-            setDraft(null)
+    <>
+      <Tooltip>
+        <Popover
+          open={open}
+          onOpenChange={(nextOpen) => {
+            setOpen(nextOpen)
+            if (!nextOpen) {
+              setDraft(null)
+              setShowBack(false)
+              return
+            }
+            setView(assignment || !canMutate ? 'status' : 'config')
             setShowBack(false)
-            return
-          }
-          setView(assignment || !canMutate ? 'status' : 'config')
-          setShowBack(false)
-        }}
-      >
-        <TooltipTrigger
-          render={
-            <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid" />
-          }
-        >
-          <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
-          <span className="system-sm-medium text-text-secondary">{label}</span>
-          <AccessControlChipAffix
-            kind={chip.kind}
-            coveredCount={chip.coveredCount}
-            inServiceCount={chip.inServiceCount}
-          />
-        </TooltipTrigger>
-        <PopoverContent
-          placement="bottom-end"
-          className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
+          }}
         >
-          {showPaywall ? (
-            <AccessControlFreePaywall onTurnOn={handleTurnOn} />
-          ) : showStatus && assignment ? (
-            <AccessControlStatusPanel
-              draft={resolvedDraft}
-              policies={policies}
-              enabled={resolvedDraft.enabled}
-              availability={availability}
-              updating={updateBinding.isPending}
-              dirty={dirty}
-              canSave={canSave}
-              readOnly={!canMutate}
-              onUpgrade={handleTurnOn}
-              onEnabledChange={handleEnabledChange}
-              onCancel={handleCancel}
-              onSave={handleSave}
-              onEdit={() => {
-                if (!canMutate) return
-                setDraft(resolvedDraft)
-                setShowBack(true)
-                setView('config')
-              }}
-            />
-          ) : (
-            <AccessControlConfigPanel
-              draft={resolvedDraft}
-              policies={policies}
-              availability={availability}
-              baseline={baseline}
-              showBack={showBack}
-              saving={updateBinding.isPending}
-              onBack={handleBack}
-              onCancel={handleCancel}
-              onCreatePolicy={handleCreatePolicy}
-              onManagePolicies={handleCreatePolicy}
-              onDraftChange={setDraft}
-              onSave={handleSave}
+          <TooltipTrigger
+            render={
+              <PopoverTrigger className="flex h-8 shrink-0 items-center gap-1.5 rounded-md border-[0.5px] border-divider-deep px-2.5 shadow-xs outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid" />
+            }
+          >
+            <span aria-hidden className="i-ri-shield-keyhole-line size-4 text-text-secondary" />
+            <span className="system-sm-medium text-text-secondary">{label}</span>
+            <AccessControlChipAffix
+              kind={chip.kind}
+              coveredCount={chip.coveredCount}
+              inServiceCount={chip.inServiceCount}
             />
-          )}
-        </PopoverContent>
-      </Popover>
-      <TooltipContent>{tooltip}</TooltipContent>
-    </Tooltip>
+          </TooltipTrigger>
+          <PopoverContent
+            placement="bottom-end"
+            className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
+          >
+            {showPaywall ? (
+              <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+            ) : showStatus && assignment ? (
+              <AccessControlStatusPanel
+                draft={resolvedDraft}
+                policies={policies}
+                enabled={resolvedDraft.enabled}
+                updating={updateBinding.isPending}
+                dirty={dirty}
+                canSave={canSave}
+                readOnly={!canMutate}
+                onUpgrade={handleTurnOn}
+                onEnabledChange={handleEnabledChange}
+                onCancel={handleCancel}
+                onSave={handleSave}
+                onEdit={() => {
+                  if (!canMutate) return
+                  setDraft(resolvedDraft)
+                  setShowBack(true)
+                  setView('config')
+                }}
+              />
+            ) : (
+              <AccessControlConfigPanel
+                draft={resolvedDraft}
+                policies={policies}
+                persistableAccessPoints={persistableAccessPoints}
+                baseline={baseline}
+                showBack={showBack}
+                saving={updateBinding.isPending}
+                onBack={handleBack}
+                onCancel={handleCancel}
+                onCreatePolicy={handleCreatePolicy}
+                onManagePolicies={handleManagePolicies}
+                onDraftChange={setDraft}
+                onSave={handleSave}
+              />
+            )}
+          </PopoverContent>
+        </Popover>
+        <TooltipContent>{tooltip}</TooltipContent>
+      </Tooltip>
+      {createPolicyOpen && (
+        <IpPolicyDialog
+          mode="create"
+          open
+          isPending={createGroup.isPending}
+          onOpenChange={handlePolicyDialogOpenChange}
+          onSubmit={(payload) => {
+            createGroup.mutate(
+              {
+                body: {
+                  name: payload.name,
+                  description: '',
+                  allowed_cidrs: payload.allowed_cidrs,
+                },
+              },
+              {
+                onSuccess: (data) => {
+                  queryClient.setQueryData(
+                    consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions().queryKey,
+                    (current) => {
+                      if (!current) return current
+                      if (current.groups.some((group) => group.id === data.group.id)) return current
+                      return {
+                        ...current,
+                        groups: [...current.groups, data.group],
+                      }
+                    },
+                  )
+                  setDraft({
+                    ...resolvedDraft,
+                    selectedPolicyId: data.group.id,
+                  })
+                  setCreatePolicyOpen(false)
+                  setView('config')
+                  setOpen(true)
+                },
+              },
+            )
+          }}
+        />
+      )}
+    </>
   )
 }
diff --git a/web/app/components/app/access-point/access-control/network-access.ts b/web/app/components/app/access-point/access-control/network-access.ts
index 7331cbdb779037..ceb7d6f9f091d8 100644
--- a/web/app/components/app/access-point/access-control/network-access.ts
+++ b/web/app/components/app/access-point/access-control/network-access.ts
@@ -2,7 +2,7 @@ import type {
   AppNetworkAccessGroupBindingResponse,
   AppNetworkAccessGroupResponse,
 } from '@dify/contracts/api/console/apps/types.gen'
-import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessControlDraft } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { createDefaultAccessControlDraft } from './draft'
@@ -31,26 +31,6 @@ export function toUiAccessPoint(accessPoint: NetworkAccessPoint): AccessPoint {
   return API_TO_ACCESS_POINT[accessPoint]
 }
 
-export function availabilityFromAccessPoints(
-  availableAccessPoints: readonly string[],
-  triggerAvailable: boolean,
-): AccessControlScopeAvailability {
-  const allowed = new Set(
-    availableAccessPoints.flatMap((accessPoint) => {
-      if (accessPoint in API_TO_ACCESS_POINT)
-        return [toUiAccessPoint(accessPoint as NetworkAccessPoint)]
-      return []
-    }),
-  )
-
-  return {
-    webApp: allowed.has('webApp'),
-    serviceApi: allowed.has('serviceApi'),
-    mcp: allowed.has('mcp'),
-    trigger: allowed.has('trigger') && triggerAvailable,
-  }
-}
-
 export function getNetworkAccessErrorStatus(error: unknown): number | undefined {
   if (error instanceof Response) return error.status
   if (typeof error === 'object' && error !== null) {
@@ -68,7 +48,6 @@ export function getNetworkAccessErrorStatus(error: unknown): number | undefined
 
 export function scopesFromAccessPoints(
   accessPoints: readonly string[],
-  availability: AccessControlScopeAvailability,
 ): AccessControlDraft['scopes'] {
   const selected = new Set(
     accessPoints.flatMap((accessPoint) => {
@@ -79,31 +58,34 @@ export function scopesFromAccessPoints(
   )
 
   return {
-    webApp: availability.webApp && selected.has('webApp'),
-    serviceApi: availability.serviceApi && selected.has('serviceApi'),
-    mcp: availability.mcp && selected.has('mcp'),
-    trigger: availability.trigger && selected.has('trigger'),
+    webApp: selected.has('webApp'),
+    serviceApi: selected.has('serviceApi'),
+    mcp: selected.has('mcp'),
+    trigger: selected.has('trigger'),
   }
 }
 
 export function accessPointsFromScopes(
   scopes: AccessControlDraft['scopes'],
-  availability: AccessControlScopeAvailability,
+  availableAccessPoints?: readonly string[],
 ): NetworkAccessPoint[] {
-  return ACCESS_POINT_ORDER.filter(
-    (accessPoint) => availability[accessPoint] && scopes[accessPoint],
-  ).map(toApiAccessPoint)
+  const allowed = availableAccessPoints ? new Set(availableAccessPoints) : null
+
+  return ACCESS_POINT_ORDER.filter((accessPoint) => {
+    if (!scopes[accessPoint]) return false
+    if (!allowed) return true
+    return allowed.has(toApiAccessPoint(accessPoint))
+  }).map(toApiAccessPoint)
 }
 
 export function draftFromBinding(
   binding: AppNetworkAccessGroupBindingResponse | null | undefined,
-  availability: AccessControlScopeAvailability,
 ): AccessControlDraft {
-  if (!binding?.group_id) return createDefaultAccessControlDraft(availability)
+  if (!binding?.group_id) return createDefaultAccessControlDraft()
 
   return {
     selectedPolicyId: binding.group_id,
     enabled: binding.enabled,
-    scopes: scopesFromAccessPoints(binding.access_points, availability),
+    scopes: scopesFromAccessPoints(binding.access_points),
   }
 }
diff --git a/web/app/components/app/access-point/access-control/scope-list.tsx b/web/app/components/app/access-point/access-control/scope-list.tsx
index d3039743aeed96..044c24f9030189 100644
--- a/web/app/components/app/access-point/access-control/scope-list.tsx
+++ b/web/app/components/app/access-point/access-control/scope-list.tsx
@@ -1,6 +1,6 @@
 'use client'
 
-import type { AccessControlDraft, AccessControlScopeAvailability } from './draft'
+import type { AccessControlDraft } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Switch } from '@langgenius/dify-ui/switch'
@@ -17,17 +17,10 @@ const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
 
 type AccessControlScopeListProps = {
   draft: AccessControlDraft
-  disabled: boolean
-  availability: AccessControlScopeAvailability
   onDraftChange: (draft: AccessControlDraft) => void
 }
 
-export function AccessControlScopeList({
-  draft,
-  disabled,
-  availability,
-  onDraftChange,
-}: AccessControlScopeListProps) {
+export function AccessControlScopeList({ draft, onDraftChange }: AccessControlScopeListProps) {
   const { t } = useTranslation()
   const appInfo = useAppStore((state) => state.appDetail)
 
@@ -41,7 +34,6 @@ export function AccessControlScopeList({
   return (
     <div className="flex w-full flex-col gap-0.5">
       {ACCESS_POINT_ORDER.map((scope) => {
-        const unavailable = !availability[scope]
         const label = labels[scope]
 
         return (
@@ -57,34 +49,16 @@ export function AccessControlScopeList({
                 className="rounded-sm bg-util-colors-orange-orange-100"
               />
             ) : (
-              <span
-                className={cn(
-                  'flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg',
-                  unavailable && 'opacity-40',
-                )}
-              >
+              <span className="flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg">
                 <span
                   aria-hidden
                   className={cn(SCOPE_ICONS[scope], 'size-3.5 text-text-tertiary')}
                 />
               </span>
             )}
-            <span
-              className={cn(
-                'system-sm-medium',
-                unavailable ? 'shrink-0 text-text-tertiary' : 'min-w-0 flex-1 text-text-secondary',
-              )}
-            >
-              {label}
-            </span>
-            {unavailable && (
-              <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
-                {t(($) => $['studio.accessControl.notEnabled'], { ns: 'deployments' })}
-              </span>
-            )}
+            <span className="min-w-0 flex-1 system-sm-medium text-text-secondary">{label}</span>
             <Switch
-              checked={unavailable ? false : draft.scopes[scope]}
-              disabled={disabled || unavailable}
+              checked={draft.scopes[scope]}
               aria-label={label}
               onCheckedChange={(checked) => {
                 onDraftChange({
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index c439fa1ea6e7e2..79eefa2f1759fd 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -1,10 +1,6 @@
 'use client'
 
-import type {
-  AccessControlDraft,
-  AccessControlPolicy,
-  AccessControlScopeAvailability,
-} from './draft'
+import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import {
   AlertDialog,
@@ -26,7 +22,6 @@ import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
 import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 import { getInServiceCoverage } from './chip-status'
-import { isProtectableAccessPoint } from './draft'
 
 const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
   serviceApi: 'i-custom-vender-knowledge-api-aggregate',
@@ -38,7 +33,6 @@ type AccessControlStatusPanelProps = {
   draft: AccessControlDraft
   policies: readonly AccessControlPolicy[]
   enabled: boolean
-  availability: AccessControlScopeAvailability
   onEdit: () => void
   updating?: boolean
   dirty?: boolean
@@ -54,7 +48,6 @@ export function AccessControlStatusPanel({
   draft,
   policies,
   enabled,
-  availability,
   onEdit,
   updating = false,
   dirty = false,
@@ -70,16 +63,16 @@ export function AccessControlStatusPanel({
   const [confirmPause, setConfirmPause] = useState(false)
   const selectedPolicy = policies.find((policy) => policy.id === draft.selectedPolicyId)
   const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.allowed_cidrs) : undefined
-  const coverage = getInServiceCoverage(draft.scopes, availability)
+  const coverage = getInServiceCoverage(draft.scopes)
   const labels: Record<AccessPoint, string> = {
     webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
     serviceApi: t(($) => $['overview.apiInfo.title'], { ns: 'appOverview' }),
     mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
     trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
   }
-  const exposedNames = ACCESS_POINT_ORDER.filter(
-    (scope) => availability[scope] && draft.scopes[scope],
-  ).map((scope) => labels[scope])
+  const exposedNames = ACCESS_POINT_ORDER.filter((scope) => draft.scopes[scope]).map(
+    (scope) => labels[scope],
+  )
   const policyName = selectedPolicy?.name
 
   return (
@@ -171,8 +164,7 @@ export function AccessControlStatusPanel({
             {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
           </p>
           {ACCESS_POINT_ORDER.map((scope) => {
-            const unavailable = !isProtectableAccessPoint(scope, availability)
-            const excluded = !unavailable && !draft.scopes[scope]
+            const excluded = !draft.scopes[scope]
             const label = labels[scope]
 
             return (
@@ -191,7 +183,7 @@ export function AccessControlStatusPanel({
                   <span
                     className={cn(
                       'flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg',
-                      (unavailable || excluded) && 'opacity-40',
+                      excluded && 'opacity-40',
                     )}
                   >
                     <span
@@ -203,9 +195,7 @@ export function AccessControlStatusPanel({
                 <span
                   className={cn(
                     'system-sm-medium',
-                    excluded || unavailable
-                      ? 'shrink-0 text-text-tertiary'
-                      : 'min-w-0 flex-1 text-text-secondary',
+                    excluded ? 'shrink-0 text-text-tertiary' : 'min-w-0 flex-1 text-text-secondary',
                   )}
                 >
                   {label}
@@ -215,11 +205,6 @@ export function AccessControlStatusPanel({
                     {t(($) => $['studio.accessControl.excluded'], { ns: 'deployments' })}
                   </span>
                 )}
-                {unavailable && (
-                  <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
-                    {t(($) => $['studio.accessControl.notEnabled'], { ns: 'deployments' })}
-                  </span>
-                )}
               </div>
             )
           })}

From 96ea949d3e6e73603ba92f81da317413b51b11b5 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Fri, 11 Sep 2026 19:32:46 +0800
Subject: [PATCH 029/108] fix(web): drop come-back copy from IP policy empty
 states

Create now opens the New IP Policy dialog in place, so the empty-state
prompt to create a policy and come back no longer applies. Keep the title
until PRD finalizes replacement copy.
---
 .../access-control/__tests__/index.spec.tsx           |  6 ++----
 .../app/access-point/access-control/policy-field.tsx  | 11 +++--------
 .../ip-policies-page/__tests__/index.spec.tsx         |  2 --
 .../header/account-setting/ip-policies-page/index.tsx |  5 +----
 web/i18n/ar-TN/deployments.json                       |  1 -
 web/i18n/de-DE/deployments.json                       |  1 -
 web/i18n/en-US/deployments.json                       |  1 -
 web/i18n/es-ES/deployments.json                       |  1 -
 web/i18n/fa-IR/deployments.json                       |  1 -
 web/i18n/fr-FR/deployments.json                       |  1 -
 web/i18n/hi-IN/deployments.json                       |  1 -
 web/i18n/id-ID/deployments.json                       |  1 -
 web/i18n/it-IT/deployments.json                       |  1 -
 web/i18n/ja-JP/deployments.json                       |  1 -
 web/i18n/ko-KR/deployments.json                       |  1 -
 web/i18n/lo-LA/deployments.json                       |  1 -
 web/i18n/nl-NL/deployments.json                       |  1 -
 web/i18n/pl-PL/deployments.json                       |  1 -
 web/i18n/pt-BR/deployments.json                       |  1 -
 web/i18n/ro-RO/deployments.json                       |  1 -
 web/i18n/ru-RU/deployments.json                       |  1 -
 web/i18n/sl-SI/deployments.json                       |  1 -
 web/i18n/th-TH/deployments.json                       |  1 -
 web/i18n/tr-TR/deployments.json                       |  1 -
 web/i18n/uk-UA/deployments.json                       |  1 -
 web/i18n/vi-VN/deployments.json                       |  1 -
 web/i18n/zh-Hans/deployments.json                     |  1 -
 web/i18n/zh-Hant/deployments.json                     |  1 -
 28 files changed, 6 insertions(+), 42 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index cee1e530a801b0..84bb45a8f1daa2 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -38,8 +38,6 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
   'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
   'studio.accessControl.createIpPolicy': 'Create an IP policy',
-  'studio.accessControl.emptyPoliciesDescription':
-    'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
   'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
   'studio.accessControl.chipOff': 'Off',
   'studio.accessControl.chipOn': 'ON',
@@ -235,10 +233,10 @@ describe('AccessControlEntry', () => {
 
     expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
     expect(
-      screen.getByText(
+      screen.queryByText(
         'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
       ),
-    ).toBeInTheDocument()
+    ).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
     expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index f1dfe8feb29497..e423382fe803b0 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -53,14 +53,9 @@ export function AccessControlPolicyField({
   if (policies.length === 0) {
     return (
       <div className="flex w-full flex-col items-center gap-3 overflow-hidden rounded-lg border border-dashed border-divider-regular px-4 py-5">
-        <div className="flex w-full flex-col items-center gap-1 text-center">
-          <p className="w-full system-sm-medium text-text-secondary">
-            {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
-          </p>
-          <p className="w-full system-xs-regular text-text-tertiary">
-            {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
-          </p>
-        </div>
+        <p className="w-full text-center system-sm-medium text-text-secondary">
+          {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+        </p>
         <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
           {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
         </Button>
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index a57e5418f94d2f..cc20e736d53d99 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -41,8 +41,6 @@ const translations = vi.hoisted(() => ({
   'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
   'settings.ipPolicyNewTitle': 'New IP Policy',
   'settings.ipPolicyRemoveEntry': 'Remove entry',
-  'studio.accessControl.emptyPoliciesDescription':
-    'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
   'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
   'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
 }))
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 072ad56b5c60ab..939d10cb7735e3 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -109,13 +109,10 @@ export default function IpPoliciesPage() {
       )}
 
       {!isPending && !isError && groups.length === 0 && (
-        <div className="flex flex-col items-center gap-1 py-10 text-center">
+        <div className="flex flex-col items-center py-10 text-center">
           <p className="system-sm-medium text-text-secondary">
             {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
           </p>
-          <p className="max-w-md system-xs-regular text-text-tertiary">
-            {t(($) => $['studio.accessControl.emptyPoliciesDescription'], { ns: 'deployments' })}
-          </p>
         </div>
       )}
 
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 47a0077a600473..50edb101fdf980 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index e8aaa306986ab6..7f3003ed5dd6e2 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index 40c2e37a7d3c61..725869b4f215ee 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 1b491ba695fa92..3246ab04d5c681 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index 3da73b07904998..bd35fd9d722064 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index 876e0692c737c8..e58b7f0fb15b15 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index e65c5cc49ca364..3686632ede5436 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index bc2150db7414b1..191d134875348f 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 06617769cf28cc..b645ac4c180ba2 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 8caa284e94c549..07c2a94bf6bf95 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
-  "studio.accessControl.emptyPoliciesDescription": "ポリシーは許可する IP アドレスの一覧です。作成してから、ここに戻って適用してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
   "studio.accessControl.excluded": "対象外",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 565a340e7a5833..b9e5bca46c9ad8 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 14ff57cefa7a0b..16a358398c0c46 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 352fb5e69d87a1..84ebae52841b75 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 2d1e134e80a678..909d9c54606c57 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 2d80b823e9b166..2cac09e728fb86 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 41ee3dbd032c60..070a4707b4e752 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index edb87e9bd767b4..a2c027fc2d9ecd 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 8c73bb434a07ec..111b1a91f1e707 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 78313160ac624a..0f904b9aba25ce 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 3704c873ee6d6f..d669c9f8f7a627 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index eac5c4b1ed883a..bff0384f39fc7c 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 3080f70f9996d3..beb093511394bb 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
-  "studio.accessControl.emptyPoliciesDescription": "A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 7b8a36b31b546e..8fb78539e289a0 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "创建 IP 策略",
-  "studio.accessControl.emptyPoliciesDescription": "策略是允许访问的 IP 地址列表。先创建一条，再回到这里应用。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.entryLabel": "访问控制",
   "studio.accessControl.excluded": "未覆盖",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index f865016900c01a..54fa828cbf4cd4 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -41,7 +41,6 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "建立 IP 策略",
-  "studio.accessControl.emptyPoliciesDescription": "策略是允許存取的 IP 位址清單。先建立一條，再回到這裡套用。",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "未涵蓋",

From 5ef488e3b068234ce5b3769abf8014c189cf6029 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Fri, 11 Sep 2026 20:07:21 +0800
Subject: [PATCH 030/108] feat(web): restore Access Control drafts and add
 downgrade resume paywall

Keep dirty drafts across Esc/outside close and reopen the edit layer.
After a plan downgrade, show the Figma resume popover for a saved assignment.
---
 .../access-control/__tests__/index.spec.tsx   | 236 +++++++++++++++++-
 .../access-control/downgrade-panel.tsx        | 118 +++++++++
 .../app/access-point/access-control/index.tsx |  25 +-
 web/i18n/ar-TN/deployments.json               |   4 +
 web/i18n/de-DE/deployments.json               |   4 +
 web/i18n/en-US/deployments.json               |   4 +
 web/i18n/es-ES/deployments.json               |   4 +
 web/i18n/fa-IR/deployments.json               |   4 +
 web/i18n/fr-FR/deployments.json               |   4 +
 web/i18n/hi-IN/deployments.json               |   4 +
 web/i18n/id-ID/deployments.json               |   4 +
 web/i18n/it-IT/deployments.json               |   4 +
 web/i18n/ja-JP/deployments.json               |   4 +
 web/i18n/ko-KR/deployments.json               |   4 +
 web/i18n/lo-LA/deployments.json               |   4 +
 web/i18n/nl-NL/deployments.json               |   4 +
 web/i18n/pl-PL/deployments.json               |   4 +
 web/i18n/pt-BR/deployments.json               |   4 +
 web/i18n/ro-RO/deployments.json               |   4 +
 web/i18n/ru-RU/deployments.json               |   4 +
 web/i18n/sl-SI/deployments.json               |   4 +
 web/i18n/th-TH/deployments.json               |   4 +
 web/i18n/tr-TR/deployments.json               |   4 +
 web/i18n/uk-UA/deployments.json               |   4 +
 web/i18n/vi-VN/deployments.json               |   4 +
 web/i18n/zh-Hans/deployments.json             |   4 +
 web/i18n/zh-Hant/deployments.json             |   4 +
 27 files changed, 465 insertions(+), 10 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/downgrade-panel.tsx

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 84bb45a8f1daa2..8b1436c1d8d240 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -14,6 +14,7 @@ import { AccessControlEntry } from '..'
 const mockSetPricing = vi.fn()
 const mockSetSettingsDestination = vi.fn()
 const accessControlTranslations = vi.hoisted(() => ({
+  'operation.back': 'Back',
   'operation.cancel': 'Cancel',
   'operation.close': 'Close',
   'operation.save': 'Save',
@@ -38,6 +39,8 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
   'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
   'studio.accessControl.createIpPolicy': 'Create an IP policy',
+  'studio.accessControl.downgradeDescription': 'Access control needs the Pro plan.',
+  'studio.accessControl.downgradeTitle': 'This app is no longer protected',
   'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
   'studio.accessControl.chipOff': 'Off',
   'studio.accessControl.chipOn': 'ON',
@@ -53,6 +56,8 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.previewCaption':
     "This app is only available on your organization's network.",
   'studio.accessControl.proBadge': 'PRO',
+  'studio.accessControl.protectsCoverage': 'Protects {{n}} of {{m}} access points',
+  'studio.accessControl.readyToResume': 'Ready to resume',
   'studio.accessControl.selectPolicy': 'Select a policy',
   'studio.accessControl.tooltipOff': 'Not set up',
   'studio.accessControl.tooltipPro': 'Access control requires the Pro plan',
@@ -143,7 +148,7 @@ describe('AccessControlEntry', () => {
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
   })
 
-  it('shows a saved assignment on Cloud sandbox instead of hiding it behind the paywall', async () => {
+  it('shows a resume paywall for a saved assignment on Cloud sandbox', async () => {
     const user = userEvent.setup()
     renderEntry({
       plan: 'sandbox',
@@ -163,9 +168,17 @@ describe('AccessControlEntry', () => {
 
     expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
     await user.click(getChip())
-    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Turn on Access Control' })).toBeInTheDocument()
+    expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
+    expect(screen.getByText('Access control needs the Pro plan.')).toBeInTheDocument()
+    expect(screen.getByText('Ready to resume')).toBeInTheDocument()
+    expect(screen.getByText('Internal Network')).toBeInTheDocument()
+    expect(screen.getByText('Protects 3 of 4 access points')).toBeInTheDocument()
+    expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('switch', { name: 'Restrict by IP address' })).not.toBeInTheDocument()
+
+    await user.click(screen.getByRole('button', { name: 'Turn on Access Control' }))
+    expect(mockSetPricing).toHaveBeenCalledWith('open')
   })
 
   it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
@@ -404,4 +417,221 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
     expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
   })
+
+  it('discards an unsaved first-time draft on Cancel', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    await waitFor(() => {
+      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+    })
+
+    await user.click(getChip())
+    expect(screen.getByRole('switch', { name: 'Trigger' })).toBeChecked()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+
+  it('restores an unsaved first-time draft after Escape', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional' })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+    })
+
+    await user.click(getChip())
+    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+    expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+
+  it('restores an unsaved edit after Escape and keeps the saved chip', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+    })
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+
+    await user.click(getChip())
+    expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+    expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+  })
+
+  it('discards an unsaved edit on Cancel', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
+    })
+
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
+  })
+
+  it('discards an unsaved edit on Back', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    await user.click(screen.getByRole('button', { name: 'Back' }))
+
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
+    })
+
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
+  })
+
+  it('does not restore a clean edit session after Escape', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+    })
+
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
+  })
+
+  it('reopens the edit layer after dismissing a paused draft with Escape', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'service_api', 'mcp'],
+        version: 2,
+        created_at: '2026-01-01T00:00:00Z',
+        updated_at: '2026-01-01T00:00:00Z',
+      },
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    await user.click(screen.getByRole('button', { name: 'Turn off' }))
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+
+    await user.keyboard('{Escape}')
+    await waitFor(() => {
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+    })
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+
+    await user.click(getChip())
+    expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+  })
 })
diff --git a/web/app/components/app/access-point/access-control/downgrade-panel.tsx b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
new file mode 100644
index 00000000000000..b948f97666061b
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
@@ -0,0 +1,118 @@
+'use client'
+
+import type { AccessControlAssignment } from './chip-status'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import { Button } from '@langgenius/dify-ui/button'
+import { cn } from '@langgenius/dify-ui/cn'
+import { PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
+import { useTranslation } from 'react-i18next'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import AppIcon from '@/app/components/base/app-icon'
+import { getInServiceCoverage } from './chip-status'
+
+const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
+  serviceApi: 'i-custom-vender-knowledge-api-aggregate',
+  mcp: 'i-custom-vender-integrations-mcp',
+  trigger: 'i-custom-vender-integrations-trigger',
+}
+
+type AccessControlDowngradePanelProps = {
+  assignment: AccessControlAssignment
+  onTurnOn: () => void
+}
+
+export function AccessControlDowngradePanel({
+  assignment,
+  onTurnOn,
+}: AccessControlDowngradePanelProps) {
+  const { t } = useTranslation()
+  const appInfo = useAppStore((state) => state.appDetail)
+  const coverage = getInServiceCoverage(assignment.scopes)
+  const protectedScopes = ACCESS_POINT_ORDER.filter((scope) => assignment.scopes[scope])
+  const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
+  const turnOn = t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })
+  const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
+
+  return (
+    <div className="flex w-100 flex-col">
+      <div className="overflow-hidden border-b border-divider-subtle px-4 pt-4 pb-3">
+        <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
+          {title}
+        </PopoverTitle>
+      </div>
+      <div className="flex flex-col gap-4 overflow-hidden px-4 pt-2 pb-4">
+        <div className="flex flex-col gap-1">
+          <p className="system-md-semibold text-text-warning">
+            {t(($) => $['studio.accessControl.downgradeTitle'], { ns: 'deployments' })}
+          </p>
+          <PopoverDescription className="system-xs-regular text-text-tertiary">
+            {t(($) => $['studio.accessControl.downgradeDescription'], { ns: 'deployments' })}
+          </PopoverDescription>
+        </div>
+        <div className="flex flex-col gap-3 rounded-xl bg-background-section-burn p-3">
+          <div className="flex flex-col gap-1.5">
+            <p className="system-xs-regular text-text-tertiary">
+              {t(($) => $['studio.accessControl.readyToResume'], { ns: 'deployments' })}
+            </p>
+            <p className="system-sm-medium text-text-primary">{assignment.policyName}</p>
+            <div className="flex items-center gap-2">
+              <div className="flex items-start gap-1">
+                {protectedScopes.map((scope) =>
+                  scope === 'webApp' ? (
+                    <AppIcon
+                      key={scope}
+                      size="tiny"
+                      decorative
+                      iconType={appInfo?.icon_type}
+                      icon={appInfo?.icon}
+                      background={appInfo?.icon_background ?? undefined}
+                      imageUrl={appInfo?.icon_url}
+                      className="rounded-sm bg-util-colors-orange-orange-100"
+                    />
+                  ) : (
+                    <span
+                      key={scope}
+                      className="flex size-6 shrink-0 items-center justify-center rounded-sm border-[0.5px] border-divider-regular bg-components-panel-bg"
+                    >
+                      <span
+                        aria-hidden
+                        className={cn(SCOPE_ICONS[scope], 'size-3.5 text-text-tertiary')}
+                      />
+                    </span>
+                  ),
+                )}
+              </div>
+              <p className="min-w-0 flex-1 system-xs-regular text-text-tertiary">
+                {t(($) => $['studio.accessControl.protectsCoverage'], {
+                  ns: 'deployments',
+                  n: coverage.coveredCount,
+                  m: coverage.inServiceCount,
+                })}
+              </p>
+            </div>
+          </div>
+          <div className="relative">
+            <Button variant="primary" className="w-full" onClick={onTurnOn}>
+              {turnOn}
+            </Button>
+            <span
+              aria-hidden
+              className="pointer-events-none absolute top-1.75 right-2 inline-flex h-[18px] items-center gap-px overflow-hidden rounded-[5px] border-[0.5px] border-components-premium-badge-blue-stroke-stop-0 px-1 py-[3px] shadow-xs"
+              style={{
+                backgroundImage:
+                  'linear-gradient(101.6deg, var(--color-components-premium-badge-blue-stroke-stop-0) 0%, var(--color-components-premium-badge-blue-text-stop-0) 105.58%), linear-gradient(90deg, #a0bdff, #a0bdff)',
+              }}
+            >
+              <span className="i-custom-public-common-sparkles-soft-accent flex size-3 items-center py-px pl-px" />
+              <span className="px-0.5 system-2xs-medium text-text-accent-light-mode-only">
+                {pro}
+              </span>
+              <span className="absolute top-0 right-1/2 i-custom-public-common-highlight h-4.5 w-12 translate-x-[20%] opacity-50" />
+            </span>
+          </div>
+        </div>
+      </div>
+    </div>
+  )
+}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index b15b2a2fb6843a..a4ed26725baab5 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -25,6 +25,7 @@ import { consoleQuery } from '@/service/console'
 import { AccessControlChipAffix } from './chip-affix'
 import { getAccessControlChipState } from './chip-status'
 import { AccessControlConfigPanel } from './config-panel'
+import { AccessControlDowngradePanel } from './downgrade-panel'
 import { canSaveAccessControl, isAccessControlDraftEqual } from './draft'
 import { AccessControlFreePaywall } from './free-paywall'
 import {
@@ -118,7 +119,8 @@ export function AccessControlEntry() {
   })
   const chip = getAccessControlChipState({ entitled, assignment })
   const showPaywall = chip.kind === 'pro'
-  const showStatus = Boolean(assignment) && (view === 'status' || !canMutate)
+  const showDowngrade = Boolean(assignment) && !canMutate
+  const showStatus = Boolean(assignment) && canMutate && view === 'status'
 
   const tooltip =
     chip.kind === 'pro'
@@ -148,9 +150,13 @@ export function AccessControlEntry() {
     if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
   }
 
-  const handleCancel = () => {
+  const discardDraft = () => {
     setDraft(null)
     setShowBack(false)
+  }
+
+  const handleCancel = () => {
+    discardDraft()
     if (assignment) {
       setView('status')
       return
@@ -159,7 +165,7 @@ export function AccessControlEntry() {
   }
 
   const handleBack = () => {
-    setShowBack(false)
+    discardDraft()
     setView('status')
   }
 
@@ -230,9 +236,8 @@ export function AccessControlEntry() {
         accessPoints: persistableAccessPoints,
       },
       () => {
-        setDraft(null)
+        discardDraft()
         setView('status')
-        setShowBack(false)
       },
     )
   }
@@ -250,8 +255,12 @@ export function AccessControlEntry() {
           onOpenChange={(nextOpen) => {
             setOpen(nextOpen)
             if (!nextOpen) {
-              setDraft(null)
-              setShowBack(false)
+              if (!dirty) discardDraft()
+              return
+            }
+            if (dirty) {
+              setView('config')
+              setShowBack(Boolean(assignment) && canMutate)
               return
             }
             setView(assignment || !canMutate ? 'status' : 'config')
@@ -277,6 +286,8 @@ export function AccessControlEntry() {
           >
             {showPaywall ? (
               <AccessControlFreePaywall onTurnOn={handleTurnOn} />
+            ) : showDowngrade && assignment ? (
+              <AccessControlDowngradePanel assignment={assignment} onTurnOn={handleTurnOn} />
             ) : showStatus && assignment ? (
               <AccessControlStatusPanel
                 draft={resolvedDraft}
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 50edb101fdf980..ad2ff201b6366b 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index 7f3003ed5dd6e2..c5bac7fc530fa5 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index 725869b4f215ee..c3989be72470f1 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 3246ab04d5c681..6624fe93722306 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index bd35fd9d722064..04eb777567e70c 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index e58b7f0fb15b15..e857c33fe4b38a 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 3686632ede5436..abf643a0cf79b1 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 191d134875348f..fe241448b25fd2 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index b645ac4c180ba2..f0ae9641e0c124 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 07c2a94bf6bf95..6d793a07280eeb 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
+  "studio.accessControl.downgradeDescription": "アクセス制御には Pro プランが必要です。",
+  "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
   "studio.accessControl.excluded": "対象外",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "稼働中のアクセスポイント {{count}} 件すべてを保護しています。",
   "studio.accessControl.protectingPartial": "稼働中のアクセスポイント {{m}} 件中 {{n}} 件を保護しています。",
+  "studio.accessControl.protectsCoverage": "{{n}} / {{m}} 個のアクセスポイントを保護",
+  "studio.accessControl.readyToResume": "再開できます",
   "studio.accessControl.restrictByIp": "IP アドレスで制限",
   "studio.accessControl.restrictedTo": "{{name}} に制限",
   "studio.accessControl.saveAnyway": "保存する",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index b9e5bca46c9ad8..b9a6f539ffaafe 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 16a358398c0c46..def724d64cd88a 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 84ebae52841b75..ddbc5c0585d974 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 909d9c54606c57..23c3978a1d9389 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 2cac09e728fb86..a0e62c5dd94841 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 070a4707b4e752..1932cc6d2bca85 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index a2c027fc2d9ecd..5e874c30d12b90 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 111b1a91f1e707..11386219a976b9 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 0f904b9aba25ce..fe8296fda02d81 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index d669c9f8f7a627..e45ac100f34c4b 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index bff0384f39fc7c..46fb5339c61182 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index beb093511394bb..73fe36b584073d 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
   "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "Restrict by IP address",
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 8fb78539e289a0..b2adeeaa57e11a 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "创建 IP 策略",
+  "studio.accessControl.downgradeDescription": "访问控制需要 Pro 套餐。",
+  "studio.accessControl.downgradeTitle": "此应用已不再受保护",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.entryLabel": "访问控制",
   "studio.accessControl.excluded": "未覆盖",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个在服务中的访问点。",
   "studio.accessControl.protectingPartial": "正在保护 {{n}} / {{m}} 个在服务中的访问点。",
+  "studio.accessControl.protectsCoverage": "保护 {{n}} / {{m}} 个访问点",
+  "studio.accessControl.readyToResume": "可恢复",
   "studio.accessControl.restrictByIp": "按 IP 地址限制",
   "studio.accessControl.restrictedTo": "已限制为 {{name}}",
   "studio.accessControl.saveAnyway": "仍要保存",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 54fa828cbf4cd4..901d1b947dc1c2 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -41,6 +41,8 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.createIpPolicy": "建立 IP 策略",
+  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "未涵蓋",
@@ -59,6 +61,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "正在保護全部 {{count}} 個服務中的存取點。",
   "studio.accessControl.protectingPartial": "正在保護 {{n}} / {{m}} 個服務中的存取點。",
+  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
+  "studio.accessControl.readyToResume": "Ready to resume",
   "studio.accessControl.restrictByIp": "依 IP 位址限制",
   "studio.accessControl.restrictedTo": "已限制為 {{name}}",
   "studio.accessControl.saveAnyway": "仍要儲存",

From 4dab47fdee51e3a009c92f3ef42dcc96ed76f374 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 10:29:47 +0800
Subject: [PATCH 031/108] feat(web): show IP access restrictions across public
 app requests

---
 .../components/__tests__/splash.spec.tsx      | 192 +++++++++-
 web/app/(shareLayout)/components/splash.tsx   | 101 ++++--
 .../base/chat/chat/__tests__/hooks.spec.tsx   | 287 +++++++++++++++
 web/app/components/base/chat/chat/hooks.ts    |  61 +++-
 .../file-uploader/__tests__/hooks.spec.ts     | 104 ++++--
 .../components/base/file-uploader/hooks.ts    |  11 +-
 .../image-uploader/__tests__/hooks.spec.ts    |  87 +++--
 .../components/base/image-uploader/hooks.ts   |   6 +-
 .../__tests__/use-result-run-state.spec.ts    | 132 +++++++
 .../hooks/__tests__/use-result-sender.spec.ts |  74 ++++
 .../result/hooks/use-result-run-state.ts      |  38 +-
 .../result/hooks/use-result-sender.ts         |  20 ++
 web/app/layout.tsx                            |   3 +-
 .../__tests__/access-restricted.spec.tsx      |  84 +++++
 .../__tests__/boundary.spec.tsx               | 195 ++++++++++
 .../webapp-ip-access/__tests__/state.spec.ts  |  97 +++++
 .../webapp-ip-access/access-restricted.tsx    |  69 ++++
 web/features/webapp-ip-access/boundary.tsx    |  36 ++
 web/features/webapp-ip-access/locale-menu.tsx |  53 +++
 web/features/webapp-ip-access/state.ts        | 116 ++++++
 web/i18n/ar-TN/share.json                     |   3 +
 web/i18n/de-DE/share.json                     |   3 +
 web/i18n/en-US/share.json                     |   3 +
 web/i18n/es-ES/share.json                     |   3 +
 web/i18n/fa-IR/share.json                     |   3 +
 web/i18n/fr-FR/share.json                     |   3 +
 web/i18n/hi-IN/share.json                     |   3 +
 web/i18n/id-ID/share.json                     |   3 +
 web/i18n/it-IT/share.json                     |   3 +
 web/i18n/ja-JP/share.json                     |   3 +
 web/i18n/ko-KR/share.json                     |   3 +
 web/i18n/lo-LA/share.json                     |   3 +
 web/i18n/nl-NL/share.json                     |   3 +
 web/i18n/pl-PL/share.json                     |   3 +
 web/i18n/pt-BR/share.json                     |   3 +
 web/i18n/ro-RO/share.json                     |   3 +
 web/i18n/ru-RU/share.json                     |   3 +
 web/i18n/sl-SI/share.json                     |   3 +
 web/i18n/th-TH/share.json                     |   3 +
 web/i18n/tr-TR/share.json                     |   3 +
 web/i18n/uk-UA/share.json                     |   3 +
 web/i18n/vi-VN/share.json                     |   3 +
 web/i18n/zh-Hans/share.json                   |   3 +
 web/i18n/zh-Hant/share.json                   |   3 +
 web/public/illustrations/ip-access-denied.png | Bin 0 -> 10590 bytes
 web/service/__tests__/base-request.spec.ts    |   3 +-
 .../__tests__/ip-access-denied.spec.ts        | 339 ++++++++++++++++++
 .../share-human-input-upload.spec.ts          | 108 ++++++
 web/service/base.ts                           |  66 +++-
 web/service/fetch.ts                          |  24 +-
 web/service/share.ts                          |  22 +-
 web/utils/is-abort-error.ts                   |   5 +
 52 files changed, 2268 insertions(+), 137 deletions(-)
 create mode 100644 web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
 create mode 100644 web/features/webapp-ip-access/__tests__/boundary.spec.tsx
 create mode 100644 web/features/webapp-ip-access/__tests__/state.spec.ts
 create mode 100644 web/features/webapp-ip-access/access-restricted.tsx
 create mode 100644 web/features/webapp-ip-access/boundary.tsx
 create mode 100644 web/features/webapp-ip-access/locale-menu.tsx
 create mode 100644 web/features/webapp-ip-access/state.ts
 create mode 100644 web/public/illustrations/ip-access-denied.png
 create mode 100644 web/service/__tests__/ip-access-denied.spec.ts
 create mode 100644 web/utils/is-abort-error.ts

diff --git a/web/app/(shareLayout)/components/__tests__/splash.spec.tsx b/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
index c9b5582b030fce..d4693d436febbc 100644
--- a/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
+++ b/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
@@ -1,4 +1,4 @@
-import { render, screen, waitFor } from '@testing-library/react'
+import { act, render, screen, waitFor } from '@testing-library/react'
 import Splash from '../splash'
 
 const navigationMocks = vi.hoisted(() => ({
@@ -15,6 +15,14 @@ const webAppAuthMocks = vi.hoisted(() => ({
 }))
 
 const fetchAccessTokenMock = vi.hoisted(() => vi.fn())
+const ipAccessState = vi.hoisted(() => ({
+  scope: {},
+  isCurrent: true,
+  isDenied: false,
+  deniedError: new Error('IP access denied'),
+}))
+
+const routerMock = { replace: navigationMocks.replace }
 
 const webAppState: {
   shareCode: string | null
@@ -32,10 +40,17 @@ vi.mock('@/context/web-app-context', () => ({
 
 vi.mock('@/next/navigation', () => ({
   usePathname: () => navigationMocks.pathname,
-  useRouter: () => ({ replace: navigationMocks.replace }),
+  useRouter: () => routerMock,
   useSearchParams: () => navigationMocks.searchParams,
 }))
 
+vi.mock('@/features/webapp-ip-access/state', () => ({
+  captureIpAccessScope: () => ipAccessState.scope,
+  hasIpAccessDenied: () => ipAccessState.isDenied,
+  isIpAccessScopeCurrent: () => ipAccessState.isCurrent,
+  isIpAccessDeniedError: (error: unknown) => error === ipAccessState.deniedError,
+}))
+
 vi.mock('@/service/share', () => ({
   fetchAccessToken: (...args: unknown[]) => fetchAccessTokenMock(...args),
 }))
@@ -45,6 +60,10 @@ vi.mock('@/service/webapp-auth', () => webAppAuthMocks)
 describe('Splash', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    fetchAccessTokenMock.mockReset()
+    webAppAuthMocks.webAppLogout.mockResolvedValue(undefined)
+    ipAccessState.isCurrent = true
+    ipAccessState.isDenied = false
     webAppState.shareCode = 'share-app'
     webAppState.webAppAccessMode = 'public'
     webAppState.embeddedUserId = 'embedded-user'
@@ -224,4 +243,173 @@ describe('Splash', () => {
 
     expect(screen.getByRole('button', { name: 'share.login.backToHome' })).toBeInTheDocument()
   })
+
+  it.each(['login status', 'passport'])(
+    'should stop initialization when %s is denied by IP policy',
+    async (request) => {
+      navigationMocks.searchParams = new URLSearchParams()
+      if (request === 'login status') {
+        webAppAuthMocks.webAppLoginStatus.mockRejectedValue(ipAccessState.deniedError)
+      } else {
+        webAppAuthMocks.webAppLoginStatus.mockResolvedValue({
+          userLoggedIn: true,
+          appLoggedIn: false,
+        })
+        fetchAccessTokenMock.mockRejectedValue(ipAccessState.deniedError)
+      }
+
+      await act(async () => {
+        render(
+          <Splash>
+            <div>share application</div>
+          </Splash>,
+        )
+      })
+
+      expect(webAppAuthMocks.webAppLoginStatus).toHaveBeenCalledTimes(1)
+      expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+      expect(webAppAuthMocks.setWebAppPassport).not.toHaveBeenCalled()
+      expect(navigationMocks.replace).not.toHaveBeenCalled()
+      expect(screen.queryByText('share application')).not.toBeInTheDocument()
+      expect(screen.queryByText('share.common.appUnavailable')).not.toBeInTheDocument()
+    },
+  )
+
+  it('should show an unavailable state when login status fails without allowing the app to load', async () => {
+    navigationMocks.searchParams = new URLSearchParams()
+    webAppAuthMocks.webAppLoginStatus.mockRejectedValue(new Response(null, { status: 503 }))
+
+    render(
+      <Splash>
+        <div>share application</div>
+      </Splash>,
+    )
+
+    expect(await screen.findByText('share.common.appUnknownError')).toBeInTheDocument()
+    expect(screen.getByRole('heading', { name: '503' })).toBeInTheDocument()
+    expect(fetchAccessTokenMock).not.toHaveBeenCalled()
+    expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+    expect(navigationMocks.replace).not.toHaveBeenCalled()
+    expect(screen.queryByText('share application')).not.toBeInTheDocument()
+  })
+
+  it('should keep authentication and block initialization when the passport policy service is unavailable', async () => {
+    navigationMocks.searchParams = new URLSearchParams()
+    webAppAuthMocks.webAppLoginStatus.mockResolvedValue({
+      userLoggedIn: true,
+      appLoggedIn: false,
+    })
+    fetchAccessTokenMock.mockRejectedValue(
+      Response.json({ code: 'policy_unavailable' }, { status: 503 }),
+    )
+
+    render(
+      <Splash>
+        <div>share application</div>
+      </Splash>,
+    )
+
+    expect(await screen.findByText('share.common.appUnknownError')).toBeInTheDocument()
+    expect(screen.getByRole('heading', { name: '503' })).toBeInTheDocument()
+    expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+    expect(webAppAuthMocks.setWebAppPassport).not.toHaveBeenCalled()
+    expect(navigationMocks.replace).not.toHaveBeenCalled()
+    expect(screen.queryByText('share application')).not.toBeInTheDocument()
+  })
+
+  it.each(['IP denial', 'navigation', 'unmount'])(
+    'should ignore login status received after %s',
+    async (interruption) => {
+      navigationMocks.searchParams = new URLSearchParams()
+      let finishLogin!: (value: { userLoggedIn: boolean; appLoggedIn: boolean }) => void
+      webAppAuthMocks.webAppLoginStatus.mockReturnValue(
+        new Promise((resolve) => {
+          finishLogin = resolve
+        }),
+      )
+      const { unmount } = render(
+        <Splash>
+          <div>share application</div>
+        </Splash>,
+      )
+
+      if (interruption === 'IP denial') ipAccessState.isDenied = true
+      else if (interruption === 'navigation') ipAccessState.isCurrent = false
+      else unmount()
+
+      await act(async () => {
+        finishLogin({ userLoggedIn: true, appLoggedIn: false })
+      })
+
+      expect(fetchAccessTokenMock).not.toHaveBeenCalled()
+      expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+      expect(navigationMocks.replace).not.toHaveBeenCalled()
+      expect(screen.queryByText('share application')).not.toBeInTheDocument()
+    },
+  )
+
+  it.each(['IP denial', 'navigation', 'unmount'])(
+    'should ignore a passport received after %s',
+    async (interruption) => {
+      navigationMocks.searchParams = new URLSearchParams()
+      webAppAuthMocks.webAppLoginStatus.mockResolvedValue({
+        userLoggedIn: true,
+        appLoggedIn: false,
+      })
+      let finishPassport!: (value: { access_token: string }) => void
+      fetchAccessTokenMock.mockReturnValue(
+        new Promise((resolve) => {
+          finishPassport = resolve
+        }),
+      )
+      const { unmount } = render(
+        <Splash>
+          <div>share application</div>
+        </Splash>,
+      )
+      await waitFor(() => expect(fetchAccessTokenMock).toHaveBeenCalledTimes(1))
+
+      if (interruption === 'IP denial') ipAccessState.isDenied = true
+      else if (interruption === 'navigation') ipAccessState.isCurrent = false
+      else unmount()
+
+      await act(async () => {
+        finishPassport({ access_token: 'late-passport' })
+      })
+
+      expect(webAppAuthMocks.setWebAppPassport).not.toHaveBeenCalled()
+      expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+      expect(navigationMocks.replace).not.toHaveBeenCalled()
+      expect(screen.queryByText('share application')).not.toBeInTheDocument()
+    },
+  )
+
+  it('should not sign out after a pending passport fails following IP denial', async () => {
+    navigationMocks.searchParams = new URLSearchParams()
+    webAppAuthMocks.webAppLoginStatus.mockResolvedValue({
+      userLoggedIn: true,
+      appLoggedIn: false,
+    })
+    let rejectPassport!: (error: Response) => void
+    fetchAccessTokenMock.mockReturnValue(
+      new Promise((_resolve, reject) => {
+        rejectPassport = reject
+      }),
+    )
+    render(
+      <Splash>
+        <div>share application</div>
+      </Splash>,
+    )
+    await waitFor(() => expect(fetchAccessTokenMock).toHaveBeenCalledTimes(1))
+
+    ipAccessState.isDenied = true
+    await act(async () => {
+      rejectPassport(new Response(null, { status: 401 }))
+    })
+
+    expect(webAppAuthMocks.webAppLogout).not.toHaveBeenCalled()
+    expect(navigationMocks.replace).not.toHaveBeenCalled()
+    expect(screen.queryByText('share application')).not.toBeInTheDocument()
+  })
 })
diff --git a/web/app/(shareLayout)/components/splash.tsx b/web/app/(shareLayout)/components/splash.tsx
index eaede783da1d64..668117c6ec3183 100644
--- a/web/app/(shareLayout)/components/splash.tsx
+++ b/web/app/(shareLayout)/components/splash.tsx
@@ -10,6 +10,12 @@ import {
 import AppUnavailable from '@/app/components/base/app-unavailable'
 import Loading from '@/app/components/base/loading'
 import { useWebAppStore } from '@/context/web-app-context'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessDeniedError,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import { AccessMode } from '@/models/access-control'
 import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
 import { fetchAccessToken } from '@/service/share'
@@ -60,8 +66,17 @@ function Splash({ children }: PropsWithChildren) {
   }, [getSigninUrl, pathname, redirectUrl, router])
 
   const [isLoading, setIsLoading] = useState(true)
-  const [unavailableShareCode, setUnavailableShareCode] = useState<string>()
+  const [initializationError, setInitializationError] = useState<{
+    shareCode: string
+    status?: number
+  }>()
   useEffect(() => {
+    const scope = captureIpAccessScope()
+    let cancelled = false
+    const canContinue = () =>
+      !cancelled && (scope === null || isIpAccessScopeCurrent(scope)) && !hasIpAccessDenied(scope)
+    if (!canContinue()) return
+
     const loginRedirect = resolveWebAppLoginRedirect(redirectUrl, window.location.origin)
     const isSigninRoute = isWebAppSigninPath(pathname)
     if ((redirectUrl !== null && !loginRedirect) || (isSigninRoute && !loginRedirect)) {
@@ -78,11 +93,13 @@ function Splash({ children }: PropsWithChildren) {
     if (tokenFromUrl) setWebAppAccessToken(tokenFromUrl)
 
     const redirectOrFinish = () => {
+      if (!canContinue()) return
       if (loginRedirect) navigateAfterWebAppLogin(loginRedirect, router.replace, basePath)
       else setIsLoading(false)
     }
 
     const proceedToAuth = (authenticationRequired: boolean) => {
+      if (!canContinue()) return
       if (
         authenticationRequired &&
         address.kind === 'environment' &&
@@ -100,37 +117,59 @@ function Splash({ children }: PropsWithChildren) {
       setIsLoading(false)
     }
 
-    ;(async () => {
-      // if access mode is public, user login is always true, but the app login(passport) may be expired
-      const { userLoggedIn, appLoggedIn } = await webAppLoginStatus(
-        effectiveShareCode,
-        embeddedUserId || undefined,
-      )
-      if (userLoggedIn && appLoggedIn) {
-        redirectOrFinish()
-      } else if (!userLoggedIn && !appLoggedIn) {
-        proceedToAuth(true)
-      } else if (!userLoggedIn && appLoggedIn) {
-        redirectOrFinish()
-      } else if (userLoggedIn && !appLoggedIn) {
-        try {
-          const { access_token } = await fetchAccessToken({
-            appCode: effectiveShareCode,
-            userId: embeddedUserId || undefined,
-          })
-          setWebAppPassport(address, access_token)
+    const initialize = async () => {
+      try {
+        // Public apps still need a valid app passport even when user login is not required.
+        const { userLoggedIn, appLoggedIn } = await webAppLoginStatus(
+          effectiveShareCode,
+          embeddedUserId || undefined,
+        )
+        if (!canContinue()) return
+
+        if (appLoggedIn) {
           redirectOrFinish()
-        } catch (error) {
-          if (error instanceof Response && error.status === 404) {
-            setUnavailableShareCode(effectiveShareCode)
+        } else if (!userLoggedIn) {
+          proceedToAuth(true)
+        } else {
+          try {
+            const { access_token } = await fetchAccessToken({
+              appCode: effectiveShareCode,
+              userId: embeddedUserId || undefined,
+            })
+            if (!canContinue()) return
+
+            setWebAppPassport(address, access_token)
+            redirectOrFinish()
+          } catch (error) {
+            if (!canContinue() || isIpAccessDeniedError(error)) return
+
+            if (error instanceof Response && error.status >= 500) {
+              setInitializationError({ shareCode: effectiveShareCode, status: error.status })
+              return
+            }
+            if (error instanceof Response && error.status === 404) {
+              setInitializationError({ shareCode: effectiveShareCode, status: 404 })
+              await webAppLogout(address)
+              return
+            }
             await webAppLogout(address)
-            return
+            proceedToAuth(error instanceof Response && error.status === 401)
           }
-          await webAppLogout(address)
-          proceedToAuth(error instanceof Response && error.status === 401)
         }
+      } catch (error) {
+        if (!canContinue() || isIpAccessDeniedError(error)) return
+
+        setInitializationError({
+          shareCode: effectiveShareCode,
+          status: error instanceof Response ? error.status : undefined,
+        })
       }
-    })()
+    }
+
+    void initialize()
+    return () => {
+      cancelled = true
+    }
   }, [
     shareCode,
     redirectUrl,
@@ -140,6 +179,7 @@ function Splash({ children }: PropsWithChildren) {
     webAppAccessMode,
     tokenFromUrl,
     embeddedUserId,
+    searchParams,
   ])
 
   if (message) {
@@ -163,10 +203,13 @@ function Splash({ children }: PropsWithChildren) {
     )
   }
 
-  if (unavailableShareCode === shareCode) {
+  if (initializationError?.shareCode === shareCode) {
     return (
       <div className="flex h-full items-center justify-center">
-        <AppUnavailable />
+        <AppUnavailable
+          code={initializationError.status ?? t(($) => $['common.appUnavailable'], { ns: 'share' })}
+          isUnknownReason={initializationError.status !== 404}
+        />
       </div>
     )
   }
diff --git a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
index acaabee193553d..b85aa932527556 100644
--- a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
+++ b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
@@ -1,7 +1,9 @@
 import type { ChatConfig, ChatItemInTree } from '../../types'
 import type { FileEntity } from '@/app/components/base/file-uploader/types'
+import { toast } from '@langgenius/dify-ui/toast'
 import { act, renderHook } from '@testing-library/react'
 import { InputVarType, WorkflowRunningStatus } from '@/app/components/workflow/types'
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
 import { useChat } from '../hooks'
@@ -49,6 +51,15 @@ const createAbortControllerMock = () => {
   vi.spyOn(controller, 'abort')
   return controller
 }
+const createDeferred = <T,>() => {
+  let resolve!: (value: T | PromiseLike<T>) => void
+  let reject!: (reason?: unknown) => void
+  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise
+    reject = rejectPromise
+  })
+  return { promise, resolve, reject }
+}
 type HookCallbacks = {
   getAbortController: (abortController: AbortController) => void
   onCompleted: (hasError?: boolean, errorMessage?: string) => Promise<void> | void
@@ -81,6 +92,8 @@ type UseChatFormSettings = NonNullable<Parameters<typeof useChat>[1]>
 describe('useChat', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
     vi.useFakeTimers()
     vi.mocked(useParams).mockReturnValue({} as ReturnType<typeof useParams>)
     vi.mocked(usePathname).mockReturnValue('')
@@ -905,6 +918,215 @@ describe('useChat', () => {
       expect(lastResponse!.agent_thoughts![0]!.message_files).toHaveLength(1)
     })
 
+    it('should retain the streamed answer and original settlement when history fails', async () => {
+      const historyError = new Response(null, { status: 503 })
+      const onGetConversationMessages = vi.fn().mockRejectedValue(historyError)
+      const onGetSuggestedQuestions = vi.fn()
+      const onConversationComplete = vi.fn()
+      const onSendSettled = vi.fn()
+      const { result } = renderHook(() =>
+        useChat({
+          suggested_questions_after_answer: { enabled: true },
+        } as ChatConfig),
+      )
+
+      act(() => {
+        result.current.handleSend(
+          'chat-messages',
+          { query: 'test' },
+          {
+            onGetConversationMessages,
+            onGetSuggestedQuestions,
+            onConversationComplete,
+            onSendSettled,
+          },
+        )
+      })
+      const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+      await act(async () => {
+        callbacks.onData('Streamed answer', true, {
+          messageId: 'answer-1',
+          conversationId: 'conversation-1',
+        })
+        await expect(callbacks.onCompleted()).resolves.toBeUndefined()
+      })
+
+      expect(result.current.chatList.at(-1)?.content).toBe('Streamed answer')
+      expect(result.current.isResponding).toBe(false)
+      expect(onGetSuggestedQuestions).not.toHaveBeenCalled()
+      expect(onConversationComplete).not.toHaveBeenCalled()
+      expect(onSendSettled).toHaveBeenCalledExactlyOnceWith(undefined)
+      expect(toast.error).not.toHaveBeenCalled()
+    })
+
+    it.each(['denied', 'navigation', 'new request', 'stop', 'unmount'] as const)(
+      'should ignore history results after %s',
+      async (transition) => {
+        window.history.replaceState({}, '', '/agent/history-test')
+        const scope = captureIpAccessScope()
+        const history = createDeferred<unknown>()
+        const onGetConversationMessages = vi.fn(() => history.promise)
+        const onGetSuggestedQuestions = vi.fn()
+        const onConversationComplete = vi.fn()
+        const onSendSettled = vi.fn()
+        const { result, unmount } = renderHook(() =>
+          useChat(
+            { suggested_questions_after_answer: { enabled: true } } as ChatConfig,
+            undefined,
+            undefined,
+            undefined,
+            undefined,
+            undefined,
+            undefined,
+            { isNewAgent: true },
+          ),
+        )
+
+        act(() => {
+          result.current.handleSend(
+            'chat-messages',
+            { query: 'test' },
+            {
+              isPublicAPI: true,
+              onGetConversationMessages,
+              onGetSuggestedQuestions,
+              onConversationComplete,
+              onSendSettled,
+            },
+          )
+        })
+        const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+        let completion: ReturnType<HookCallbacks['onCompleted']>
+        act(() => {
+          callbacks.onData('Streamed answer', true, {
+            messageId: 'answer-1',
+            conversationId: 'conversation-1',
+          })
+          completion = callbacks.onCompleted()
+        })
+        expect(onGetConversationMessages).toHaveBeenCalledOnce()
+
+        act(() => {
+          if (transition === 'navigation') window.history.replaceState({}, '', '/agent/another-app')
+          if (transition === 'new request')
+            result.current.handleSend(
+              'chat-messages',
+              { query: 'next question' },
+              { isPublicAPI: true },
+            )
+          if (transition === 'stop') result.current.handleStop()
+          if (transition === 'unmount') unmount()
+          if (transition === 'denied')
+            handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope)
+        })
+        const chatListBeforeHistory = result.current.chatList
+        await act(async () => {
+          history.resolve({ data: [{ id: 'answer-1', answer: 'Late history answer' }] })
+          await completion
+        })
+
+        expect(result.current.chatList).toEqual(chatListBeforeHistory)
+        expect(onGetSuggestedQuestions).not.toHaveBeenCalled()
+        expect(onConversationComplete).not.toHaveBeenCalled()
+        expect(onSendSettled).not.toHaveBeenCalled()
+        expect(toast.error).not.toHaveBeenCalled()
+      },
+    )
+
+    it.each(['denied', 'navigation', 'unmount'] as const)(
+      'should consume history rejection after %s without completion callbacks',
+      async (transition) => {
+        window.history.replaceState({}, '', '/agent/history-rejection')
+        const scope = captureIpAccessScope()
+        const history = createDeferred<unknown>()
+        const onGetSuggestedQuestions = vi.fn()
+        const onConversationComplete = vi.fn()
+        const onSendSettled = vi.fn()
+        const { result, unmount } = renderHook(() => useChat())
+        act(() => {
+          result.current.handleSend(
+            'chat-messages',
+            { query: 'test' },
+            {
+              isPublicAPI: true,
+              onGetConversationMessages: () => history.promise,
+              onGetSuggestedQuestions,
+              onConversationComplete,
+              onSendSettled,
+            },
+          )
+        })
+        const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+        let completion: ReturnType<HookCallbacks['onCompleted']>
+        act(() => {
+          callbacks.onData('Streamed answer', true, {
+            messageId: 'answer-1',
+            conversationId: 'conversation-1',
+          })
+          completion = callbacks.onCompleted()
+        })
+
+        await act(async () => {
+          const error = new Response(null, { status: transition === 'denied' ? 403 : 503 })
+          if (transition === 'denied')
+            handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+          if (transition === 'navigation') window.history.replaceState({}, '', '/chat/another-app')
+          if (transition === 'unmount') unmount()
+          history.reject(error)
+          await expect(completion).resolves.toBeUndefined()
+        })
+
+        expect(result.current.chatList.at(-1)?.content).toBe('Streamed answer')
+        expect(onGetSuggestedQuestions).not.toHaveBeenCalled()
+        expect(onConversationComplete).not.toHaveBeenCalled()
+        expect(onSendSettled).not.toHaveBeenCalled()
+        expect(toast.error).not.toHaveBeenCalled()
+      },
+    )
+
+    it.each(['resolve', 'reject'] as const)(
+      'should ignore a suggested question %s after navigation',
+      async (outcome) => {
+        window.history.replaceState({}, '', '/agent/suggestions-test')
+        const suggestions = createDeferred<unknown>()
+        const onSendSettled = vi.fn()
+        const { result } = renderHook(() =>
+          useChat({
+            suggested_questions_after_answer: { enabled: true },
+          } as ChatConfig),
+        )
+        act(() => {
+          result.current.handleSend(
+            'chat-messages',
+            { query: 'test' },
+            {
+              isPublicAPI: true,
+              onGetSuggestedQuestions: () => suggestions.promise,
+              onSendSettled,
+            },
+          )
+        })
+        const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+        let completion: ReturnType<HookCallbacks['onCompleted']>
+        act(() => {
+          callbacks.onData('Streamed answer', true, {
+            messageId: 'answer-1',
+            conversationId: 'conversation-1',
+          })
+          completion = callbacks.onCompleted()
+        })
+        await act(async () => {
+          window.history.replaceState({}, '', '/agent/another-app')
+          if (outcome === 'resolve') suggestions.resolve({ data: ['Late suggestion'] })
+          else suggestions.reject(new Error('Late failure'))
+          await completion
+        })
+
+        expect(result.current.suggestedQuestions).toEqual([])
+        expect(onSendSettled).not.toHaveBeenCalled()
+      },
+    )
+
     it('should fetch conversation messages and suggested questions onCompleted', async () => {
       let callbacks: HookCallbacks
 
@@ -2193,6 +2415,71 @@ describe('useChat', () => {
   })
 
   describe('handleStop and handleRestart', () => {
+    it.each(['rejection', 'throw'] as const)(
+      'should finish stopping locally after a service %s',
+      async (failure) => {
+        const error = new Error('Stop request failed')
+        const stopChat = vi.fn(() => {
+          if (failure === 'throw') throw error
+          return Promise.reject(error)
+        })
+        const { result, unmount } = renderHook(() =>
+          useChat(undefined, undefined, undefined, stopChat),
+        )
+        act(() => {
+          result.current.handleSend('chat-messages', { query: 'test' }, {})
+        })
+        const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+        const controller = createAbortControllerMock()
+        await act(async () => {
+          callbacks.onWorkflowStarted({ task_id: 'task-123' })
+          callbacks.getAbortController(controller)
+          result.current.handleStop()
+        })
+
+        expect(result.current.isResponding).toBe(false)
+        expect(controller.abort).toHaveBeenCalledOnce()
+        expect(toast.error).not.toHaveBeenCalled()
+        unmount()
+      },
+    )
+
+    it.each([false, true])(
+      'should consume a rejected stop request when unmounted is %s',
+      async (shouldUnmount) => {
+        window.history.replaceState({}, '', '/agent/stop-test')
+        const scope = captureIpAccessScope()
+        const error = new Response(null, { status: 403 })
+        const stopRequest = createDeferred<void>()
+        const stopChat = vi.fn(() => stopRequest.promise)
+        const { result, unmount } = renderHook(() =>
+          useChat(undefined, undefined, undefined, stopChat),
+        )
+
+        act(() => {
+          result.current.handleSend('chat-messages', { query: 'test' }, { isPublicAPI: true })
+        })
+        const callbacks = vi.mocked(ssePost).mock.calls[0]![2] as HookCallbacks
+        const controller = createAbortControllerMock()
+        act(() => {
+          callbacks.onWorkflowStarted({ task_id: 'task-123' })
+          callbacks.getAbortController(controller)
+          result.current.handleStop()
+        })
+
+        expect(stopChat).toHaveBeenCalledWith('task-123')
+        expect(result.current.isResponding).toBe(false)
+        expect(controller.abort).toHaveBeenCalledOnce()
+
+        await act(async () => {
+          if (shouldUnmount) unmount()
+          handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+          stopRequest.reject(error)
+        })
+        expect(toast.error).not.toHaveBeenCalled()
+      },
+    )
+
     it('should set responded false and call stopChat and abort controllers', () => {
       const stopChat = vi.fn()
       const { result } = renderHook(() => useChat(undefined, undefined, undefined, stopChat))
diff --git a/web/app/components/base/chat/chat/hooks.ts b/web/app/components/base/chat/chat/hooks.ts
index c35af2fb373102..cedf781eb701ec 100644
--- a/web/app/components/base/chat/chat/hooks.ts
+++ b/web/app/components/base/chat/chat/hooks.ts
@@ -22,6 +22,11 @@ import {
 import { isInstalledAppPath } from '@/app/components/explore/installed-app/routes'
 import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
 import { NodeRunningStatus, WorkflowRunningStatus } from '@/app/components/workflow/types'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import useTimestamp from '@/hooks/use-timestamp'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
@@ -192,7 +197,7 @@ export const useChat = (
     inputsForm: InputForm[]
   },
   prevChatTree?: ChatItemInTree[],
-  stopChat?: (taskId: string) => void,
+  stopChat?: (taskId: string) => void | Promise<unknown>,
   clearChatList?: boolean,
   clearChatListCallback?: (state: boolean) => void,
   initialConversationId?: string,
@@ -527,7 +532,15 @@ export const useChat = (
   const handleStop = useCallback(() => {
     hasStopRespondedRef.current = true
     handleResponding(false)
-    if (stopChat && taskIdRef.current && !pausedStateRef.current) stopChat(taskIdRef.current)
+    if (stopChat && taskIdRef.current && !pausedStateRef.current) {
+      void (async () => {
+        try {
+          await stopChat(taskIdRef.current)
+        } catch {
+          // The request layer owns error feedback; stopping locally must still finish.
+        }
+      })()
+    }
     if (conversationMessagesAbortControllerRef.current)
       conversationMessagesAbortControllerRef.current.abort()
     if (suggestedQuestionsAbortControllerRef.current)
@@ -1109,6 +1122,11 @@ export const useChat = (
       pausedStateRef.current = false
       resetWorkflowEventsSubscription()
       const requestGeneration = ++workflowRequestGenerationRef.current
+      const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+      const isCurrentRequest = () =>
+        requestGeneration === workflowRequestGenerationRef.current &&
+        isIpAccessScopeCurrent(ipAccessScope) &&
+        !hasIpAccessDenied(ipAccessScope)
 
       const parentMessage = threadMessages.find((item) => item.id === data.parent_message_id)
 
@@ -1181,13 +1199,13 @@ export const useChat = (
       let hasNotifiedConversationComplete = false
       let currentWorkflowRunId = ''
       const settleSend = (hasError?: boolean) => {
-        if (hasSettled) return
+        if (hasSettled || !isCurrentRequest()) return
 
         hasSettled = true
         onSendSettled?.(hasError)
       }
       const notifyConversationComplete = (workflowRunId?: string) => {
-        if (hasNotifiedConversationComplete) return
+        if (hasNotifiedConversationComplete || !isCurrentRequest()) return
 
         hasNotifiedConversationComplete = true
         onConversationComplete?.(conversationIdRef.current, workflowRunId)
@@ -1254,7 +1272,7 @@ export const useChat = (
           })
         },
         async onCompleted(hasError?: boolean) {
-          if (requestGeneration !== workflowRequestGenerationRef.current) return
+          if (!isCurrentRequest()) return
 
           handleResponding(false)
 
@@ -1268,11 +1286,22 @@ export const useChat = (
               !hasStopRespondedRef.current &&
               onGetConversationMessages
             ) {
-              const conversationMessagesResponse = await onGetConversationMessages(
-                conversationIdRef.current,
-                (newAbortController) =>
-                  (conversationMessagesAbortControllerRef.current = newAbortController),
-              )
+              let conversationMessagesResponse: unknown
+              try {
+                conversationMessagesResponse = await onGetConversationMessages(
+                  conversationIdRef.current,
+                  (newAbortController) => {
+                    if (isCurrentRequest())
+                      conversationMessagesAbortControllerRef.current = newAbortController
+                    else newAbortController.abort()
+                  },
+                )
+              } catch {
+                // Keep the streamed answer and its settlement when history cannot be refreshed.
+                return
+              }
+              if (!isCurrentRequest()) return
+
               const data = getConversationMessagesData(conversationMessagesResponse)
               const newResponseItem = data.find((item) => item.id === responseItem.id)
               completedWorkflowRunId = newResponseItem?.workflow_run_id ?? completedWorkflowRunId
@@ -1335,6 +1364,7 @@ export const useChat = (
             notifyConversationComplete(completedWorkflowRunId)
 
             if (
+              isCurrentRequest() &&
               config?.suggested_questions_after_answer?.enabled &&
               !hasStopRespondedRef.current &&
               onGetSuggestedQuestions
@@ -1342,12 +1372,15 @@ export const useChat = (
               try {
                 const { data }: any = await onGetSuggestedQuestions(
                   responseItem.id,
-                  (newAbortController) =>
-                    (suggestedQuestionsAbortControllerRef.current = newAbortController),
+                  (newAbortController) => {
+                    if (isCurrentRequest())
+                      suggestedQuestionsAbortControllerRef.current = newAbortController
+                    else newAbortController.abort()
+                  },
                 )
-                setSuggestedQuestions(data)
+                if (isCurrentRequest()) setSuggestedQuestions(data)
               } catch {
-                setSuggestedQuestions([])
+                if (isCurrentRequest()) setSuggestedQuestions([])
               }
             }
           } finally {
diff --git a/web/app/components/base/file-uploader/__tests__/hooks.spec.ts b/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
index 3ba3ce253957ac..9a14a4ccd204bf 100644
--- a/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
+++ b/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
@@ -2,9 +2,20 @@ import type { FileEntity } from '../types'
 import type { FileUpload } from '@/app/components/base/features/types'
 import type { FileUploadConfigResponse } from '@/models/common'
 import { act, renderHook } from '@testing-library/react'
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
 import { useFile, useFileSizeLimit } from '../hooks'
 
 const mockNotify = vi.fn()
+
+const createUploadError = (ipDenied: boolean | 'cancelled') => {
+  if (ipDenied === 'cancelled') return new DOMException('Upload cancelled', 'AbortError')
+  const error = new Error('Upload failed')
+  if (ipDenied) {
+    window.history.replaceState({}, '', '/chat/restricted-app')
+    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), error)
+  }
+  return error
+}
 const mockNavigationState = vi.hoisted(() => ({
   params: {} as { token?: string },
   pathname: '/chat',
@@ -316,28 +327,33 @@ describe('useFile', () => {
       expect(mockSetFiles).toHaveBeenCalled()
     })
 
-    it('should handle error callback during re-upload', () => {
-      const originalFile = new File(['content'], 'test.txt', { type: 'text/plain' })
-      mockStoreFiles = [
-        {
-          id: 'file-1',
-          name: 'test.txt',
-          type: 'text/plain',
-          size: 100,
-          progress: -1,
-          transferMethod: 'local_file',
-          supportFileType: 'document',
-          originalFile,
-        },
-      ] as FileEntity[]
-
-      const { result } = renderHook(() => useFile(defaultFileConfig))
-      result.current.handleReUploadFile('file-1')
-
-      const uploadCall = mockFileUpload.mock.calls[0]![0]
-      uploadCall.onErrorCallback(new Error('fail'))
-      expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
-    })
+    it.each([false, true, 'cancelled'] as const)(
+      'finishes failed re-upload and suppresses IP denial or cancellation (%s)',
+      (ipDenied) => {
+        const originalFile = new File(['content'], 'test.txt', { type: 'text/plain' })
+        mockStoreFiles = [
+          {
+            id: 'file-1',
+            name: 'test.txt',
+            type: 'text/plain',
+            size: 100,
+            progress: -1,
+            transferMethod: 'local_file',
+            supportFileType: 'document',
+            originalFile,
+          },
+        ] as FileEntity[]
+
+        const { result } = renderHook(() => useFile(defaultFileConfig))
+        result.current.handleReUploadFile('file-1')
+
+        const uploadCall = mockFileUpload.mock.calls[0]![0]
+        uploadCall.onErrorCallback(createUploadError(ipDenied))
+        expect(mockSetFiles).toHaveBeenCalled()
+        if (ipDenied) expect(mockNotify).not.toHaveBeenCalled()
+        else expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
+      },
+    )
   })
 
   describe('handleLoadFileFromLink', () => {
@@ -464,17 +480,22 @@ describe('useFile', () => {
       expect(mockIsAllowedFileExtension).toHaveBeenCalledWith('remote.txt', 'text/plain', [], [])
     })
 
-    it('should remove file when remote upload fails', async () => {
-      mockUploadRemoteFileInfo.mockRejectedValue(new Error('network error'))
+    it.each([false, true, 'cancelled'] as const)(
+      'removes failed remote uploads and suppresses IP denial or cancellation (%s)',
+      async (ipDenied) => {
+        mockUploadRemoteFileInfo.mockRejectedValue(createUploadError(ipDenied))
 
-      const { result } = renderHook(() => useFile(defaultFileConfig))
-      await act(async () => {
-        result.current.handleLoadFileFromLink('https://example.com/file.txt')
-        await vi.waitFor(() => expect(mockNotify).toHaveBeenCalled())
-      })
+        const { result } = renderHook(() => useFile(defaultFileConfig))
+        await act(async () => {
+          result.current.handleLoadFileFromLink('https://example.com/file.txt')
+          await vi.waitFor(() => expect(mockUploadRemoteFileInfo).toHaveBeenCalled())
+        })
 
-      expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
-    })
+        expect(mockSetFiles).toHaveBeenCalled()
+        if (ipDenied) expect(mockNotify).not.toHaveBeenCalled()
+        else expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
+      },
+    )
 
     it('should remove file when size limit is exceeded on remote upload', async () => {
       mockGetSupportFileType.mockReturnValue('image')
@@ -843,17 +864,22 @@ describe('useFile', () => {
       expect(mockFileUpload).not.toHaveBeenCalled()
     })
 
-    it('should handle fileUpload error callback', () => {
-      const file = new File(['content'], 'test.txt', { type: 'text/plain' })
+    it.each([false, true, 'cancelled'] as const)(
+      'finishes failed local upload and suppresses IP denial or cancellation (%s)',
+      (ipDenied) => {
+        const file = new File(['content'], 'test.txt', { type: 'text/plain' })
 
-      const { result } = renderHook(() => useFile(defaultFileConfig))
-      result.current.handleLocalFileUpload(file)
+        const { result } = renderHook(() => useFile(defaultFileConfig))
+        result.current.handleLocalFileUpload(file)
 
-      const uploadCall = mockFileUpload.mock.calls[0]![0]
-      uploadCall.onErrorCallback(new Error('upload failed'))
+        const uploadCall = mockFileUpload.mock.calls[0]![0]
+        uploadCall.onErrorCallback(createUploadError(ipDenied))
 
-      expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
-    })
+        expect(mockSetFiles).toHaveBeenCalled()
+        if (ipDenied) expect(mockNotify).not.toHaveBeenCalled()
+        else expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
+      },
+    )
 
     it('should handle FileReader error event', () => {
       capturedListeners = {}
diff --git a/web/app/components/base/file-uploader/hooks.ts b/web/app/components/base/file-uploader/hooks.ts
index 1e62e59ab3b72b..0cb59c2c28886e 100644
--- a/web/app/components/base/file-uploader/hooks.ts
+++ b/web/app/components/base/file-uploader/hooks.ts
@@ -17,11 +17,13 @@ import {
   VIDEO_SIZE_LIMIT,
 } from '@/app/components/base/file-uploader/constants'
 import { SupportUploadFileTypes } from '@/app/components/workflow/types'
+import { isIpAccessDeniedError } from '@/features/webapp-ip-access/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { uploadRemoteFileInfo } from '@/service/common'
 import { uploadHumanInputFormLocalFile, uploadHumanInputFormRemoteFileInfo } from '@/service/share'
 import { TransferMethod } from '@/types/app'
 import { formatFileSize } from '@/utils/format'
+import { isAbortError } from '@/utils/is-abort-error'
 import { useFileStore } from './store'
 import { useFileUploadContext } from './upload-context'
 import {
@@ -191,7 +193,7 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
               t(($) => $['fileUploader.uploadFromComputerUploadError'], { ns: 'common' }),
               t,
             )
-            toast.error(errorMessage)
+            if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
             handleUpdateFile({ ...uploadingFile, progress: -1 })
           },
         }
@@ -278,8 +280,9 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
             handleRemoveFile(uploadingFile.id)
           else handleUpdateFile(newFile)
         })
-        .catch(() => {
-          toast.error(t(($) => $['fileUploader.pasteFileLinkInvalid'], { ns: 'common' }))
+        .catch((error: unknown) => {
+          if (!isIpAccessDeniedError(error) && !isAbortError(error))
+            toast.error(t(($) => $['fileUploader.pasteFileLinkInvalid'], { ns: 'common' }))
           handleRemoveFile(uploadingFile.id)
         })
     },
@@ -372,7 +375,7 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
                 t(($) => $['fileUploader.uploadFromComputerUploadError'], { ns: 'common' }),
                 t,
               )
-              toast.error(errorMessage)
+              if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
               handleUpdateFile({ ...uploadingFile, progress: -1 })
             },
           }
diff --git a/web/app/components/base/image-uploader/__tests__/hooks.spec.ts b/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
index 586ffc9335762d..7087f1d86939d6 100644
--- a/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
+++ b/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
@@ -1,9 +1,20 @@
 import type { ImageFile } from '@/types/app'
 import { act, renderHook } from '@testing-library/react'
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
 import { TransferMethod } from '@/types/app'
 import { useImageFiles, useLocalFileUploader } from '../hooks'
 
 const mockNotify = vi.fn()
+
+const createUploadError = (ipDenied: boolean | 'cancelled') => {
+  if (ipDenied === 'cancelled') return new DOMException('Upload cancelled', 'AbortError')
+  const error = new Error('Upload failed')
+  if (ipDenied) {
+    window.history.replaceState({}, '', '/chat/restricted-app')
+    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), error)
+  }
+  return error
+}
 vi.mock('@langgenius/dify-ui/toast', () => ({
   toast: {
     error: (message: string) => mockNotify({ type: 'error', message }),
@@ -263,28 +274,32 @@ describe('useImageFiles', () => {
       expect(result.current.files[0]!.progress).toBe(100)
     })
 
-    it('should set progress to -1 and notify on error callback during re-upload', () => {
-      const { result } = renderHook(() => useImageFiles())
-      const file = new File(['test'], 'test.png', { type: 'image/png' })
-      const imageFile = createImageFile({ _id: 'file-1', file, progress: -1 })
+    it.each([false, true, 'cancelled'] as const)(
+      'sets failed re-upload progress and suppresses IP denial or cancellation (%s)',
+      (ipDenied) => {
+        const { result } = renderHook(() => useImageFiles())
+        const file = new File(['test'], 'test.png', { type: 'image/png' })
+        const imageFile = createImageFile({ _id: 'file-1', file, progress: -1 })
 
-      act(() => {
-        result.current.onUpload(imageFile)
-      })
+        act(() => {
+          result.current.onUpload(imageFile)
+        })
 
-      act(() => {
-        result.current.onReUpload('file-1')
-      })
+        act(() => {
+          result.current.onReUpload('file-1')
+        })
 
-      const uploadCall = mockImageUpload.mock.calls[0]![0]
+        const uploadCall = mockImageUpload.mock.calls[0]![0]
 
-      act(() => {
-        uploadCall.onErrorCallback(new Error('Network error'))
-      })
+        act(() => {
+          uploadCall.onErrorCallback(createUploadError(ipDenied))
+        })
 
-      expect(result.current.files[0]!.progress).toBe(-1)
-      expect(mockNotify).toHaveBeenCalledWith({ type: 'error', message: 'Upload error' })
-    })
+        expect(result.current.files[0]!.progress).toBe(-1)
+        if (ipDenied) expect(mockNotify).not.toHaveBeenCalled()
+        else expect(mockNotify).toHaveBeenCalledWith({ type: 'error', message: 'Upload error' })
+      },
+    )
   })
 
   it('should filter out deleted files in returned files', () => {
@@ -437,27 +452,31 @@ describe('useLocalFileUploader', () => {
     )
   })
 
-  it('should notify error and call onUpload with progress -1 on upload failure', async () => {
-    const onUpload = vi.fn()
-    const { result } = renderHook(() => useLocalFileUploader({ onUpload }))
+  it.each([false, true, 'cancelled'] as const)(
+    'sets failed local upload progress and suppresses IP denial or cancellation (%s)',
+    async (ipDenied) => {
+      const onUpload = vi.fn()
+      const { result } = renderHook(() => useLocalFileUploader({ onUpload }))
 
-    const file = new File(['test'], 'test.png', { type: 'image/png' })
+      const file = new File(['test'], 'test.png', { type: 'image/png' })
 
-    act(() => {
-      result.current.handleLocalFileUpload(file)
-    })
+      act(() => {
+        result.current.handleLocalFileUpload(file)
+      })
 
-    await vi.waitFor(() => {
-      expect(mockImageUpload).toHaveBeenCalled()
-    })
+      await vi.waitFor(() => {
+        expect(mockImageUpload).toHaveBeenCalled()
+      })
 
-    const uploadCall = mockImageUpload.mock.calls[0]![0]
+      const uploadCall = mockImageUpload.mock.calls[0]![0]
 
-    act(() => {
-      uploadCall.onErrorCallback(new Error('fail'))
-    })
+      act(() => {
+        uploadCall.onErrorCallback(createUploadError(ipDenied))
+      })
 
-    expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
-    expect(onUpload).toHaveBeenCalledWith(expect.objectContaining({ progress: -1 }))
-  })
+      if (ipDenied) expect(mockNotify).not.toHaveBeenCalled()
+      else expect(mockNotify).toHaveBeenCalledWith(expect.objectContaining({ type: 'error' }))
+      expect(onUpload).toHaveBeenCalledWith(expect.objectContaining({ progress: -1 }))
+    },
+  )
 })
diff --git a/web/app/components/base/image-uploader/hooks.ts b/web/app/components/base/image-uploader/hooks.ts
index 0f363f8b1dd4d4..41692a3e698d98 100644
--- a/web/app/components/base/image-uploader/hooks.ts
+++ b/web/app/components/base/image-uploader/hooks.ts
@@ -2,8 +2,10 @@ import type { ImageFile } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useCallback, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { isIpAccessDeniedError } from '@/features/webapp-ip-access/state'
 import { useParams } from '@/next/navigation'
 import { ALLOW_FILE_EXTENSIONS, TransferMethod } from '@/types/app'
+import { isAbortError } from '@/utils/is-abort-error'
 import { getImageUploadErrorMessage, imageUpload } from './utils'
 
 export const useImageFiles = () => {
@@ -103,7 +105,7 @@ export const useImageFiles = () => {
               t(($) => $['imageUploader.uploadFromComputerUploadError'], { ns: 'common' }),
               t,
             )
-            toast.error(errorMessage)
+            if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
             const newFiles = [
               ...files.slice(0, index),
               { ...currentImageFile, progress: -1 },
@@ -188,7 +190,7 @@ export const useLocalFileUploader = ({
                   t(($) => $['imageUploader.uploadFromComputerUploadError'], { ns: 'common' }),
                   t,
                 )
-                toast.error(errorMessage)
+                if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
                 onUpload({ ...imageFile, progress: -1 })
               },
             },
diff --git a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
index c48fcaf09ef00b..952d3dc7dba1a8 100644
--- a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
+++ b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
@@ -1,5 +1,6 @@
 import type { FeedbackType } from '@/app/components/base/chat/chat/type'
 import { act, renderHook, waitFor } from '@testing-library/react'
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
 import { AppSourceType } from '@/service/share'
 import { useResultRunState } from '../use-result-run-state'
 
@@ -27,6 +28,8 @@ vi.mock('@/service/share', async () => {
 describe('useResultRunState', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
     stopChatMessageRespondingMock.mockResolvedValue(undefined)
     stopWorkflowMessageMock.mockResolvedValue(undefined)
     updateFeedbackMock.mockResolvedValue(undefined)
@@ -75,6 +78,135 @@ describe('useResultRunState', () => {
     expect(abort).toHaveBeenCalledTimes(1)
   })
 
+  it.each([false, true])(
+    'should suppress IP denial feedback when stopping a workflow is %s',
+    async (isWorkflow) => {
+      window.history.replaceState(
+        {},
+        '',
+        isWorkflow ? '/workflow/stop-test' : '/completion/stop-test',
+      )
+      const scope = captureIpAccessScope()
+      const error = new Response(null, { status: 403 })
+      const stop = isWorkflow ? stopWorkflowMessageMock : stopChatMessageRespondingMock
+      stop.mockImplementationOnce(async () => {
+        handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+        throw error
+      })
+      const notify = vi.fn()
+      const { result } = renderHook(() =>
+        useResultRunState({
+          appSourceType: AppSourceType.webApp,
+          isWorkflow,
+          notify,
+        }),
+      )
+      act(() => result.current.setCurrentTaskId('task-denied'))
+
+      await act(async () => {
+        await expect(result.current.handleStop()).resolves.toBeUndefined()
+      })
+
+      expect(stop).toHaveBeenCalledOnce()
+      expect(notify).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each([
+    ['new run', 'resolve'],
+    ['new run', 'reject'],
+    ['navigation', 'resolve'],
+    ['navigation', 'reject'],
+    ['unmount', 'resolve'],
+    ['unmount', 'reject'],
+  ] as const)('should ignore a stop after %s when it ends with %s', async (transition, outcome) => {
+    window.history.replaceState({}, '', '/completion/stop-race')
+    let resolveStop!: () => void
+    let rejectStop!: (error: unknown) => void
+    const stopRequest = new Promise<void>((resolve, reject) => {
+      resolveStop = resolve
+      rejectStop = reject
+    })
+    stopChatMessageRespondingMock.mockReturnValueOnce(stopRequest)
+    const notify = vi.fn()
+    const onRunControlChange = vi.fn()
+    const { result, unmount } = renderHook(() =>
+      useResultRunState({
+        appSourceType: AppSourceType.webApp,
+        isWorkflow: false,
+        notify,
+        onRunControlChange,
+      }),
+    )
+    const controller = new AbortController()
+    const newController = new AbortController()
+    const abort = vi.spyOn(controller, 'abort')
+    const abortNewRun = vi.spyOn(newController, 'abort')
+    act(() => {
+      result.current.abortControllerRef.current = controller
+      result.current.setCurrentTaskId('task-old')
+      result.current.setRespondingTrue()
+    })
+    let stopping: Promise<void>
+    act(() => {
+      stopping = result.current.handleStop()
+    })
+    expect(result.current.isStopping).toBe(true)
+
+    act(() => {
+      if (transition === 'navigation')
+        window.history.replaceState({}, '', '/completion/another-app')
+      if (transition === 'unmount') unmount()
+      if (transition === 'new run') {
+        result.current.prepareForNewRun()
+        result.current.abortControllerRef.current = newController
+        result.current.setCurrentTaskId('task-new')
+        result.current.setIsStopping(true)
+      }
+    })
+    const controlsBeforeCompletion = onRunControlChange.mock.calls.length
+    const abortsBeforeCompletion = abort.mock.calls.length
+
+    await act(async () => {
+      if (outcome === 'resolve') resolveStop()
+      else rejectStop(new Error('Late stop failure'))
+      await stopping
+    })
+
+    expect(notify).not.toHaveBeenCalled()
+    expect(abortNewRun).not.toHaveBeenCalled()
+    expect(abort).toHaveBeenCalledTimes(abortsBeforeCompletion)
+    expect(onRunControlChange).toHaveBeenCalledTimes(controlsBeforeCompletion)
+    if (transition === 'new run') {
+      expect(result.current.currentTaskId).toBe('task-new')
+      expect(result.current.isStopping).toBe(true)
+    }
+  })
+
+  it('should not send a stop request after another public request denies access', async () => {
+    window.history.replaceState({}, '', '/workflow/already-denied')
+    const scope = captureIpAccessScope()
+    const notify = vi.fn()
+    const { result } = renderHook(() =>
+      useResultRunState({
+        appSourceType: AppSourceType.webApp,
+        isWorkflow: true,
+        notify,
+      }),
+    )
+    act(() => {
+      result.current.setCurrentTaskId('task-denied')
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope)
+    })
+    await act(async () => {
+      await result.current.handleStop()
+    })
+
+    expect(stopWorkflowMessageMock).not.toHaveBeenCalled()
+    expect(notify).not.toHaveBeenCalled()
+    expect(result.current.isStopping).toBe(false)
+  })
+
   it('should update feedback and react to external stop control', async () => {
     const notify = vi.fn()
     const onRunControlChange = vi.fn()
diff --git a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
index 8dc1dba662be18..93e76dde507695 100644
--- a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
+++ b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
@@ -4,6 +4,7 @@ import type { PromptConfig } from '@/models/debug'
 import type { AppSourceType } from '@/service/share'
 import type { VisionSettings } from '@/types/app'
 import { act, renderHook, waitFor } from '@testing-library/react'
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
 import { AppSourceType as AppSourceTypeEnum } from '@/service/share'
 import { withSelectorKey } from '@/test/i18n-mock'
 import { Resolution, TransferMethod } from '@/types/app'
@@ -243,6 +244,8 @@ const renderSender = ({
 describe('useResultSender', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
     mockWebAppState.appInfo.mode = 'completion'
     validateResultRequestMock.mockReturnValue({ canSend: true })
     buildResultRequestDataMock.mockReturnValue({ inputs: { name: 'Alice' } })
@@ -555,6 +558,77 @@ describe('useResultSender', () => {
     expect(onCompleted).toHaveBeenCalledTimes(1)
   })
 
+  it.each([
+    { transition: 'denied', timedOut: true, callback: 'onError' as const },
+    { transition: 'navigated', timedOut: true, callback: 'onError' as const },
+    { transition: 'denied', timedOut: false, callback: 'onError' as const },
+    { transition: 'navigated', timedOut: false, callback: 'onError' as const },
+    { transition: 'denied', timedOut: true, callback: 'onCompleted' as const },
+    { transition: 'navigated', timedOut: true, callback: 'onCompleted' as const },
+    { transition: 'denied', timedOut: false, callback: 'onCompleted' as const },
+  ])(
+    'settles $callback silently after $transition with timeout $timedOut',
+    async ({ transition, timedOut, callback }) => {
+      window.history.replaceState({}, '', '/completion/restricted-app')
+      const harness = createRunStateHarness()
+      let completionHandlers: CompletionHandlers | undefined
+      if (timedOut) sleepMock.mockResolvedValue(undefined)
+      sendCompletionMessageMock.mockImplementation(async (_data, handlers) => {
+        completionHandlers = handlers as CompletionHandlers
+      })
+      const { result, notify, onCompleted } = renderSender({
+        runState: harness.runState,
+        taskId: 14,
+      })
+
+      await act(async () => {
+        await result.current.handleSend()
+      })
+
+      await act(async () => {
+        if (transition === 'denied')
+          handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+        else {
+          window.history.replaceState({}, '', '/completion/another-app')
+          captureIpAccessScope()
+        }
+        completionHandlers![callback]()
+      })
+
+      expect(notify).not.toHaveBeenCalled()
+      expect(harness.runState.setRespondingFalse).toHaveBeenCalled()
+      expect(harness.runState.resetRunState).toHaveBeenCalled()
+      expect(onCompleted).toHaveBeenCalledExactlyOnceWith('', 14, false)
+      expect(harness.runState.setMessageId).not.toHaveBeenCalled()
+    },
+  )
+
+  it('silently settles a rejected workflow request after its page was denied', async () => {
+    window.history.replaceState({}, '', '/workflow/restricted-app')
+    let rejectRequest!: (error: Error) => void
+    const pending = new Promise<void>((_resolve, reject) => {
+      rejectRequest = reject
+    })
+    sendWorkflowMessageMock.mockReturnValue(pending)
+    const harness = createRunStateHarness()
+    const { result, notify, onCompleted } = renderSender({
+      runState: harness.runState,
+      isWorkflow: true,
+      taskId: 15,
+    })
+
+    await act(async () => {
+      await result.current.handleSend()
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+      rejectRequest(new Error('Late workflow failure'))
+    })
+
+    expect(notify).not.toHaveBeenCalled()
+    expect(harness.runState.setRespondingFalse).toHaveBeenCalled()
+    expect(harness.runState.resetRunState).toHaveBeenCalled()
+    expect(onCompleted).toHaveBeenCalledExactlyOnceWith('', 15, false)
+  })
+
   it('should handle non-timeout stream errors as failed completions', async () => {
     const harness = createRunStateHarness()
     let completionHandlers: CompletionHandlers | undefined
diff --git a/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts b/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
index 8c3fd273b51f58..25da6c7b2ae930 100644
--- a/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
+++ b/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
@@ -1,10 +1,20 @@
 import type { Dispatch, MutableRefObject, SetStateAction } from 'react'
 import type { FeedbackType } from '@/app/components/base/chat/chat/type'
 import type { WorkflowProcess } from '@/app/components/base/chat/types'
-import type { AppSourceType } from '@/service/share'
 import { useBoolean } from 'ahooks'
 import { useCallback, useEffect, useReducer, useRef, useState } from 'react'
-import { stopChatMessageResponding, stopWorkflowMessage, updateFeedback } from '@/service/share'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessDeniedError,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
+import {
+  AppSourceType,
+  stopChatMessageResponding,
+  stopWorkflowMessage,
+  updateFeedback,
+} from '@/service/share'
 
 type Notify = (payload: { type: 'error'; message: string }) => void
 
@@ -97,6 +107,7 @@ export const useResultRunState = ({
   })
   const [controlClearMoreLikeThis, setControlClearMoreLikeThis] = useState(0)
   const abortControllerRef = useRef<AbortController | null>(null)
+  const runGenerationRef = useRef(0)
   const [{ currentTaskId, isStopping }, dispatchRunControl] = useReducer(runControlReducer, {
     currentTaskId: null,
     isStopping: false,
@@ -131,6 +142,7 @@ export const useResultRunState = ({
   const getWorkflowProcessData = useCallback(() => workflowProcessDataRef.current, [])
 
   const resetRunState = useCallback(() => {
+    runGenerationRef.current += 1
     dispatchRunControl({ type: 'reset' })
     abortControllerRef.current = null
     onRunControlChange?.(null)
@@ -165,17 +177,28 @@ export const useResultRunState = ({
   const handleStop = useCallback(async () => {
     if (!currentTaskId || isStopping) return
 
+    const runGeneration = runGenerationRef.current
+    const ipAccessScope = appSourceType === AppSourceType.webApp ? captureIpAccessScope() : null
+    const isCurrentRequest = () =>
+      runGeneration === runGenerationRef.current &&
+      isIpAccessScopeCurrent(ipAccessScope) &&
+      !hasIpAccessDenied(ipAccessScope)
+    if (!isCurrentRequest()) return
+
+    const abortController = abortControllerRef.current
     setIsStopping(true)
     try {
       if (isWorkflow) await stopWorkflowMessage(appId!, currentTaskId, appSourceType, appId || '')
       else await stopChatMessageResponding(appId!, currentTaskId, appSourceType, appId || '')
 
-      abortControllerRef.current?.abort()
+      if (isCurrentRequest()) abortController?.abort()
     } catch (error) {
+      if (!isCurrentRequest() || isIpAccessDeniedError(error)) return
+
       const message = error instanceof Error ? error.message : String(error)
       notify({ type: 'error', message })
     } finally {
-      setIsStopping(false)
+      if (isCurrentRequest()) setIsStopping(false)
     }
   }, [appId, appSourceType, currentTaskId, isStopping, isWorkflow, notify, setIsStopping])
 
@@ -183,6 +206,13 @@ export const useResultRunState = ({
     setControlClearMoreLikeThis(Date.now())
   }, [])
 
+  useEffect(
+    () => () => {
+      runGenerationRef.current += 1
+    },
+    [],
+  )
+
   useEffect(() => {
     const abortCurrentRequest = () => {
       abortControllerRef.current?.abort()
diff --git a/web/app/components/share/text-generation/result/hooks/use-result-sender.ts b/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
index f9d94e7afd6ddd..0984a9648e641d 100644
--- a/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
+++ b/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
@@ -7,6 +7,11 @@ import { useCallback, useEffect, useRef } from 'react'
 import { trackWebAppEvent } from '@/app/components/base/amplitude/web-app-event'
 import { TEXT_GENERATION_TIMEOUT_MS } from '@/config'
 import { useWebAppStore } from '@/context/web-app-context'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import { AppSourceType, sendCompletionMessage, sendWorkflowMessage } from '@/service/share'
 import { sleep } from '@/utils'
 import { buildResultRequestData, validateResultRequest } from '../result-request'
@@ -89,6 +94,7 @@ export const useResultSender = ({
       promptConfig,
       visionConfig,
     })
+    const ipAccessScope = appSourceType === AppSourceType.webApp ? captureIpAccessScope() : null
 
     runState.prepareForNewRun()
 
@@ -106,6 +112,17 @@ export const useResultSender = ({
     let isTimeout = false
     let completionChunks: string[] = []
     let tempMessageId = ''
+    const stopInactiveRequest = () => {
+      if (isIpAccessScopeCurrent(ipAccessScope) && !hasIpAccessDenied(ipAccessScope)) return false
+
+      if (!isEnd) {
+        runState.setRespondingFalse()
+        runState.resetRunState()
+        if (!isTimeout) onCompleted(runState.getCompletionRes(), taskId, false)
+        isEnd = true
+      }
+      return true
+    }
 
     void (async () => {
       await sleep(TEXT_GENERATION_TIMEOUT_MS)
@@ -140,6 +157,7 @@ export const useResultSender = ({
       })
 
       void sendWorkflowMessage(data, otherOptions, appSourceType, appId).catch((error) => {
+        if (stopInactiveRequest()) return
         runState.setRespondingFalse()
         runState.resetRunState()
         logRequestError(notify, error)
@@ -159,6 +177,7 @@ export const useResultSender = ({
           runState.setCompletionRes(completionChunks.join(''))
         },
         onCompleted: () => {
+          if (stopInactiveRequest()) return
           if (isTimeout) {
             notify({
               type: 'warning',
@@ -178,6 +197,7 @@ export const useResultSender = ({
           runState.setCompletionRes(completionChunks.join(''))
         },
         onError: () => {
+          if (stopInactiveRequest()) return
           if (isTimeout) {
             notify({
               type: 'warning',
diff --git a/web/app/layout.tsx b/web/app/layout.tsx
index 50f9e13370a505..58a403c6c76614 100644
--- a/web/app/layout.tsx
+++ b/web/app/layout.tsx
@@ -13,6 +13,7 @@ import {
   dehydrateSystemFeatures,
   getOptionalSystemFeatures,
 } from '@/features/system-features/server'
+import IpAccessBoundary from '@/features/webapp-ip-access/boundary'
 import { getLocaleOnServer } from '@/i18n-config/server'
 import { headers } from '@/next/headers'
 import { getApplicationTitle } from '@/utils/document-title'
@@ -85,7 +86,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
                       <SystemFeaturesBootstrapBoundary>
                         <PartnerStackCookieRecorder />
                         <TooltipProvider delay={300} closeDelay={200}>
-                          {children}
+                          <IpAccessBoundary>{children}</IpAccessBoundary>
                         </TooltipProvider>
                       </SystemFeaturesBootstrapBoundary>
                     </I18nServerProvider>
diff --git a/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx b/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
new file mode 100644
index 00000000000000..e4c7df195d382e
--- /dev/null
+++ b/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
@@ -0,0 +1,84 @@
+import type { i18n as I18n } from 'i18next'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
+import { I18nextProvider, initReactI18next } from 'react-i18next'
+import { setLocaleOnClient } from '@/i18n-config'
+import enShare from '@/i18n/en-US/share.json'
+import zhShare from '@/i18n/zh-Hans/share.json'
+import AccessRestricted from '../access-restricted'
+
+vi.unmock('react-i18next')
+
+vi.mock('@/i18n-config', () => ({
+  setLocaleOnClient: vi.fn(),
+}))
+
+let i18n: I18n
+
+const renderPage = (clientIp?: string) =>
+  render(
+    <I18nextProvider i18n={i18n}>
+      <AccessRestricted clientIp={clientIp} />
+    </I18nextProvider>,
+  )
+
+describe('IP access restricted page', () => {
+  beforeEach(async () => {
+    vi.clearAllMocks()
+    i18n = createInstance()
+    await i18n.use(initReactI18next).init({
+      lng: 'en-US',
+      fallbackLng: 'en-US',
+      defaultNS: 'share',
+      keySeparator: false,
+      interpolation: { escapeValue: false },
+      resources: {
+        'en-US': { share: enShare },
+        'zh-Hans': { share: zhShare },
+      },
+    })
+    vi.mocked(setLocaleOnClient).mockImplementation(async (locale) => {
+      await i18n.changeLanguage(locale)
+    })
+  })
+
+  it.each([
+    ['en-US', '203.0.113.8', 'Your current IP address 203.0.113.8 isn’t on the allowlist.'],
+    [
+      'en-US',
+      '2001:db8:1234:5678:90ab:cdef:1234:5678',
+      'Your current IP address 2001:db8:1234:5678:90ab:cdef:1234:5678 isn’t on the allowlist.',
+    ],
+    ['zh-Hans', '203.0.113.8', '您当前的 IP 地址 203.0.113.8 不在允许列表中。'],
+  ])('renders the full localized IP sentence for %s and %s', async (locale, clientIp, sentence) => {
+    await i18n.changeLanguage(locale)
+    renderPage(clientIp)
+
+    const ip = screen.getByText(clientIp, { selector: 'code' })
+    expect(ip.closest('p')?.textContent).toBe(sentence)
+  })
+
+  it('shows the network restriction without an IP sentence when the server omits the IP', () => {
+    renderPage()
+
+    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(screen.getByText(enShare['ipAccessDenied.description'])).toBeInTheDocument()
+    expect(screen.queryByText(/Your current IP address/)).not.toBeInTheDocument()
+  })
+
+  it('changes the page language without a reload and keeps the current IP', async () => {
+    const user = userEvent.setup()
+    renderPage('203.0.113.8')
+
+    await user.click(screen.getByRole('button', { name: 'English' }))
+    await user.click(screen.getByRole('menuitemradio', { name: '简体中文' }))
+
+    expect(setLocaleOnClient).toHaveBeenCalledWith('zh-Hans', false)
+    expect(await screen.findByRole('heading', { name: '访问受限' })).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: '简体中文' })).toBeInTheDocument()
+    expect(screen.getByText('203.0.113.8', { selector: 'code' }).closest('p')?.textContent).toBe(
+      '您当前的 IP 地址 203.0.113.8 不在允许列表中。',
+    )
+  })
+})
diff --git a/web/features/webapp-ip-access/__tests__/boundary.spec.tsx b/web/features/webapp-ip-access/__tests__/boundary.spec.tsx
new file mode 100644
index 00000000000000..874a350c7fd00a
--- /dev/null
+++ b/web/features/webapp-ip-access/__tests__/boundary.spec.tsx
@@ -0,0 +1,195 @@
+import { QueryClient, QueryClientProvider, queryOptions, useQuery } from '@tanstack/react-query'
+import { act, render, screen } from '@testing-library/react'
+import { createInstance } from 'i18next'
+import { StrictMode } from 'react'
+import { I18nextProvider, initReactI18next } from 'react-i18next'
+import enShare from '@/i18n/en-US/share.json'
+import IpAccessBoundary from '../boundary'
+import { captureIpAccessScope, handleIpAccessDenied } from '../state'
+
+vi.unmock('react-i18next')
+vi.mock('@/i18n-config', () => ({ setLocaleOnClient: vi.fn() }))
+vi.mock('@/next/navigation', () => ({
+  usePathname: () => window.location.pathname,
+  useSearchParams: () => new URLSearchParams(window.location.search),
+}))
+
+const i18n = createInstance()
+
+function AppBootstrap({ request }: { request: () => Promise<never> }) {
+  useQuery(queryOptions({ queryKey: ['app-bootstrap'], queryFn: request }))
+  return <p>Application loading</p>
+}
+
+describe('IP denial page boundary', () => {
+  beforeEach(async () => {
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
+    await i18n.use(initReactI18next).init({
+      lng: 'en-US',
+      fallbackLng: 'en-US',
+      defaultNS: 'share',
+      keySeparator: false,
+      interpolation: { escapeValue: false },
+      resources: { 'en-US': { share: enShare } },
+    })
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it.each(['/chat/app', '/environment/workflow/app', '/form/token'])(
+    'replaces %s and stops query retries after the first IP rejection',
+    async (path) => {
+      vi.useFakeTimers()
+      window.history.replaceState({}, '', path)
+      const queryClient = new QueryClient({
+        defaultOptions: { queries: { retry: 3, retryDelay: 100 } },
+      })
+      const request = vi.fn(async () => {
+        const scope = captureIpAccessScope()
+        const error = new Response('', { status: 403 })
+        handleIpAccessDenied(
+          403,
+          { code: 'ip_access_denied', client_ip: '203.0.113.42' },
+          scope,
+          error,
+        )
+        throw error
+      })
+      render(
+        <I18nextProvider i18n={i18n}>
+          <QueryClientProvider client={queryClient}>
+            <IpAccessBoundary>
+              <AppBootstrap request={request} />
+            </IpAccessBoundary>
+          </QueryClientProvider>
+        </I18nextProvider>,
+      )
+
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(0)
+      })
+      expect(request).toHaveBeenCalledTimes(1)
+      expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+      expect(screen.queryByText('Application loading')).not.toBeInTheDocument()
+      expect(screen.getByText('203.0.113.42', { selector: 'code' })).toBeInTheDocument()
+
+      await act(async () => {
+        await vi.advanceTimersByTimeAsync(5_000)
+      })
+      expect(request).toHaveBeenCalledTimes(1)
+      queryClient.clear()
+    },
+  )
+
+  it('renders the new app immediately and ignores the old app response after navigation', () => {
+    window.history.replaceState({}, '', '/chat/first')
+    const previousScope = captureIpAccessScope()
+    const contents = (
+      <I18nextProvider i18n={i18n}>
+        <IpAccessBoundary>
+          <p>Current application</p>
+        </IpAccessBoundary>
+      </I18nextProvider>
+    )
+    const { rerender } = render(contents)
+    act(() => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+    })
+    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+
+    window.history.replaceState({}, '', '/agent/second')
+    rerender(
+      <I18nextProvider i18n={i18n}>
+        <IpAccessBoundary>
+          <p>Current application</p>
+        </IpAccessBoundary>
+      </I18nextProvider>,
+    )
+    act(() => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+    })
+    expect(screen.getByText('Current application')).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'Access restricted' })).not.toBeInTheDocument()
+  })
+
+  it('starts a new visit after leaving for a console page with no public requests', () => {
+    window.history.replaceState({}, '', '/chat/app')
+    const previousScope = captureIpAccessScope()
+    const application = (
+      <I18nextProvider i18n={i18n}>
+        <IpAccessBoundary>
+          <p>Current application</p>
+        </IpAccessBoundary>
+      </I18nextProvider>
+    )
+    const { rerender } = render(application)
+    act(() => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+    })
+    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+
+    window.history.replaceState({}, '', '/apps')
+    rerender(
+      <I18nextProvider i18n={i18n}>
+        <IpAccessBoundary>
+          <p>Console</p>
+        </IpAccessBoundary>
+      </I18nextProvider>,
+    )
+    expect(screen.getByText('Console')).toBeInTheDocument()
+
+    window.history.replaceState({}, '', '/chat/app')
+    rerender(application)
+    const currentScope = captureIpAccessScope()
+    expect(currentScope?.key).toBe(previousScope?.key)
+    expect(currentScope?.epoch).not.toBe(previousScope?.epoch)
+    act(() => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+    })
+    expect(screen.getByText('Current application')).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'Access restricted' })).not.toBeInTheDocument()
+
+    act(() => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, currentScope)
+    })
+    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+  })
+
+  it('preserves a bootstrap rejection when Strict Mode replays effects', async () => {
+    window.history.replaceState({}, '', '/chat/app')
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false } },
+    })
+    const request = vi.fn(async () => {
+      const scope = captureIpAccessScope()
+      const error = new Response('', { status: 403 })
+      handleIpAccessDenied(
+        403,
+        { code: 'ip_access_denied', client_ip: '203.0.113.42' },
+        scope,
+        error,
+      )
+      throw error
+    })
+    render(
+      <StrictMode>
+        <I18nextProvider i18n={i18n}>
+          <QueryClientProvider client={queryClient}>
+            <IpAccessBoundary>
+              <AppBootstrap request={request} />
+            </IpAccessBoundary>
+          </QueryClientProvider>
+        </I18nextProvider>
+      </StrictMode>,
+    )
+
+    expect(await screen.findByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(screen.queryByText('Application loading')).not.toBeInTheDocument()
+    expect(screen.getByText('203.0.113.42', { selector: 'code' })).toBeInTheDocument()
+    expect(request).toHaveBeenCalledTimes(1)
+    queryClient.clear()
+  })
+})
diff --git a/web/features/webapp-ip-access/__tests__/state.spec.ts b/web/features/webapp-ip-access/__tests__/state.spec.ts
new file mode 100644
index 00000000000000..f407225f7672ef
--- /dev/null
+++ b/web/features/webapp-ip-access/__tests__/state.spec.ts
@@ -0,0 +1,97 @@
+import {
+  captureIpAccessScope,
+  getIpAccessScopeKey,
+  handleIpAccessDenied,
+  hasIpAccessDenied,
+  ipAccessDeniedAtom,
+  ipAccessStore,
+  isIpAccessDeniedError,
+  isIpAccessScopeCurrent,
+} from '../state'
+
+const denied = { code: 'ip_access_denied', client_ip: '203.0.113.42' }
+const navigate = (path: string) => {
+  window.history.replaceState({}, '', path)
+  return captureIpAccessScope()
+}
+
+describe('WebApp IP denial scope', () => {
+  beforeEach(() => {
+    navigate('/')
+  })
+
+  it.each([
+    ['/workflow/app', 'webapp:default:app'],
+    ['/chat/app', 'webapp:default:app'],
+    ['/chatbot/app', 'webapp:default:app'],
+    ['/completion/app', 'webapp:default:app'],
+    ['/agent/app', 'webapp:default:app'],
+    ['/environment/chat/app', 'webapp:environment:app'],
+    ['/environment/workflow/app', 'webapp:environment:app'],
+    ['/form/token', 'form:token'],
+  ])('scopes the public entry %s', (path, expected) => {
+    expect(navigate(path)?.key).toBe(expected)
+  })
+
+  it('resolves a validated sign-in target without scoping console or external redirects', () => {
+    expect(getIpAccessScopeKey('/webapp-signin', '?redirect_url=%2Fchat%2Fapp')).toBe(
+      'webapp:default:app',
+    )
+    expect(getIpAccessScopeKey('/apps', '?redirect_url=%2Fchat%2Fapp')).toBeNull()
+    expect(
+      getIpAccessScopeKey('/webapp-signin', '?redirect_url=https://untrusted.example/chat/app'),
+    ).toBeNull()
+  })
+
+  it('keeps one denial across concurrent requests and conversation query changes', () => {
+    const scope = navigate('/chat/app')
+    const error = new Response('', { status: 403 })
+    expect(handleIpAccessDenied(403, denied, scope, error)).toBe(true)
+    const firstDenial = ipAccessStore.get(ipAccessDeniedAtom)
+
+    const sameScope = navigate('/chat/app?conversation=second')
+    handleIpAccessDenied(403, denied, sameScope)
+
+    expect(sameScope).toBe(scope)
+    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBe(firstDenial)
+    expect(hasIpAccessDenied(scope)).toBe(true)
+    expect(isIpAccessDeniedError(error)).toBe(true)
+  })
+
+  it('ignores a late denial even after navigating back to the same app', () => {
+    const previousVisit = navigate('/chat/app')
+    navigate('/chat/other-app')
+    const currentVisit = navigate('/chat/app')
+    const error = new Response('', { status: 403 })
+
+    expect(handleIpAccessDenied(403, denied, previousVisit, error)).toBe(true)
+    expect(isIpAccessScopeCurrent(previousVisit)).toBe(false)
+    expect(hasIpAccessDenied(currentVisit)).toBe(false)
+    expect(isIpAccessDeniedError(error)).toBe(true)
+  })
+
+  it('does not carry a denial into another app or HITL form', () => {
+    handleIpAccessDenied(403, denied, navigate('/chat/app'))
+    const other = navigate('/form/token')
+
+    expect(hasIpAccessDenied(other)).toBe(false)
+    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
+  })
+
+  it.each([
+    [401, { code: 'unauthorized' }],
+    [403, { code: 'web_app_access_denied' }],
+    [503, { code: 'policy_unavailable' }],
+  ])('leaves %s %j to its existing error owner', (status, body) => {
+    const scope = navigate('/workflow/app')
+    expect(handleIpAccessDenied(status, body, scope)).toBe(false)
+    expect(hasIpAccessDenied(scope)).toBe(false)
+  })
+
+  it('does not suppress an unhandled console error with the same error code', () => {
+    const scope = navigate('/apps')
+    const error = { status: 403, response: denied }
+    expect(handleIpAccessDenied(403, denied, scope, error)).toBe(false)
+    expect(isIpAccessDeniedError(error)).toBe(false)
+  })
+})
diff --git a/web/features/webapp-ip-access/access-restricted.tsx b/web/features/webapp-ip-access/access-restricted.tsx
new file mode 100644
index 00000000000000..706e85d5934d47
--- /dev/null
+++ b/web/features/webapp-ip-access/access-restricted.tsx
@@ -0,0 +1,69 @@
+'use client'
+
+import { useState } from 'react'
+import { Trans, useTranslation } from 'react-i18next'
+import { DifyLogo } from '@/app/components/base/logo/dify-logo'
+import { basePath } from '@/utils/var'
+import LocaleMenu from './locale-menu'
+
+type AccessRestrictedProps = {
+  clientIp?: string
+}
+
+export default function AccessRestricted({ clientIp }: AccessRestrictedProps) {
+  const { t } = useTranslation('share')
+  const [copyrightYear] = useState(() => new Date().getFullYear())
+
+  return (
+    <div className="flex min-h-dvh w-full bg-background-default-burn p-6">
+      <div className="flex min-w-0 flex-1 flex-col rounded-2xl border border-effects-highlight bg-background-default-subtle">
+        <header className="flex items-center justify-between gap-4 p-6">
+          <DifyLogo alt="Dify" size="large" className="w-15.75 shrink-0" />
+          <LocaleMenu />
+        </header>
+        <main className="flex flex-1 flex-col items-center px-6 pt-12 pb-6 md:pt-40">
+          <div className="flex w-full max-w-120 flex-col gap-6">
+            <div className="relative isolate aspect-12/7 overflow-hidden rounded-lg">
+              <img
+                src={`${basePath}/illustrations/ip-access-denied.png`}
+                width={480}
+                height={280}
+                alt=""
+                className="size-full object-cover"
+              />
+              <div className="absolute inset-0 bg-[#0033ff] mix-blend-plus-lighter" />
+            </div>
+            <div className="flex flex-col gap-3">
+              <h1 className="text-base leading-[1.2] font-semibold text-text-primary">
+                {t(($) => $['ipAccessDenied.title'])}
+              </h1>
+              <div className="flex flex-col gap-1.5 system-sm-regular text-text-primary">
+                <p>{t(($) => $['ipAccessDenied.description'])}</p>
+                {clientIp && (
+                  <p>
+                    <Trans
+                      i18nKey={($) => $['ipAccessDenied.ipAddress']}
+                      ns="share"
+                      values={{ ip: clientIp }}
+                      components={{
+                        ip: (
+                          <code
+                            dir="ltr"
+                            className="rounded bg-background-default-burn px-1 font-mono code-sm-semibold tracking-[0.065px] break-all"
+                          />
+                        ),
+                      }}
+                    />
+                  </p>
+                )}
+              </div>
+            </div>
+          </div>
+        </main>
+        <footer className="px-6 py-6 text-center system-xs-regular text-text-tertiary">
+          © {copyrightYear} LangGenius, Inc. All rights reserved.
+        </footer>
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/webapp-ip-access/boundary.tsx b/web/features/webapp-ip-access/boundary.tsx
new file mode 100644
index 00000000000000..8430fc13f5322a
--- /dev/null
+++ b/web/features/webapp-ip-access/boundary.tsx
@@ -0,0 +1,36 @@
+'use client'
+
+import type { PropsWithChildren } from 'react'
+import { useAtomValueRawSync } from 'jotai/react'
+import { useEffect } from 'react'
+import { usePathname, useSearchParams } from '@/next/navigation'
+import AccessRestricted from './access-restricted'
+import {
+  captureIpAccessScope,
+  getIpAccessScopeKey,
+  ipAccessDeniedAtom,
+  ipAccessStore,
+} from './state'
+
+export default function IpAccessBoundary({ children }: PropsWithChildren) {
+  const pathname = usePathname()
+  const searchParams = useSearchParams()
+  const search = searchParams.toString()
+  const denial = useAtomValueRawSync(ipAccessDeniedAtom, { store: ipAccessStore })
+  const scopeKey = getIpAccessScopeKey(
+    pathname,
+    search,
+    typeof window === 'undefined' ? undefined : window.location.origin,
+  )
+
+  // Stay mounted in the root layout to observe leaving public routes, even
+  // when the next page makes no request that would otherwise reset the scope.
+  useEffect(() => {
+    captureIpAccessScope()
+  }, [pathname, search])
+
+  if (denial && denial.scope.key === scopeKey)
+    return <AccessRestricted clientIp={denial.clientIp} />
+
+  return children
+}
diff --git a/web/features/webapp-ip-access/locale-menu.tsx b/web/features/webapp-ip-access/locale-menu.tsx
new file mode 100644
index 00000000000000..df20cd234750f2
--- /dev/null
+++ b/web/features/webapp-ip-access/locale-menu.tsx
@@ -0,0 +1,53 @@
+import type { Locale } from '@/i18n-config'
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuRadioGroup,
+  DropdownMenuRadioItem,
+  DropdownMenuRadioItemIndicator,
+  DropdownMenuTrigger,
+} from '@langgenius/dify-ui/dropdown-menu'
+import { useLocale } from '@/context/i18n'
+import { setLocaleOnClient } from '@/i18n-config'
+import { languages } from '@/i18n-config/language'
+
+const supportedLanguages = languages.filter((language) => language.supported)
+
+export default function LocaleMenu() {
+  const locale = useLocale()
+  const selectedLanguage = supportedLanguages.find((language) => language.value === locale)
+  const selectedLanguageName =
+    selectedLanguage?.value === 'en-US' ? selectedLanguage.prompt_name : selectedLanguage?.name
+
+  return (
+    <DropdownMenu>
+      <DropdownMenuTrigger
+        render={
+          <button
+            type="button"
+            className="inline-flex min-w-0 items-center gap-1 rounded-lg p-2 system-sm-medium text-text-tertiary hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+          />
+        }
+      >
+        <span aria-hidden className="i-ri-global-line size-4 shrink-0" />
+        <span>{selectedLanguageName}</span>
+        <span aria-hidden className="i-ri-arrow-down-s-line size-4 shrink-0" />
+      </DropdownMenuTrigger>
+      <DropdownMenuContent placement="bottom-end" className="max-h-80 w-60 overflow-y-auto">
+        <DropdownMenuRadioGroup<Locale>
+          value={locale}
+          onValueChange={(value) => {
+            void setLocaleOnClient(value, false)
+          }}
+        >
+          {supportedLanguages.map((language) => (
+            <DropdownMenuRadioItem<Locale> key={language.value} value={language.value} closeOnClick>
+              <span className="grow">{language.name}</span>
+              <DropdownMenuRadioItemIndicator />
+            </DropdownMenuRadioItem>
+          ))}
+        </DropdownMenuRadioGroup>
+      </DropdownMenuContent>
+    </DropdownMenu>
+  )
+}
diff --git a/web/features/webapp-ip-access/state.ts b/web/features/webapp-ip-access/state.ts
new file mode 100644
index 00000000000000..27211887190770
--- /dev/null
+++ b/web/features/webapp-ip-access/state.ts
@@ -0,0 +1,116 @@
+import { atom, createStore } from 'jotai/vanilla'
+import { env } from '@/env'
+import { parseWebAppAddress } from '@/service/webapp-address'
+import { resolveLoginRedirectTarget } from '@/utils/login-redirect'
+
+export type IpAccessScope = Readonly<{ key: string; epoch: number }>
+
+type IpAccessDenied = {
+  scope: IpAccessScope
+  clientIp?: string
+}
+
+type IpAccessDeniedResponse = {
+  code: 'ip_access_denied'
+  client_ip?: unknown
+}
+
+export const ipAccessDeniedAtom = atom<IpAccessDenied | null>(null)
+export const ipAccessStore = createStore()
+
+let currentScope: IpAccessScope | null = null
+let scopeEpoch = 0
+const handledErrors = new WeakSet<object>()
+
+function withoutBasePath(pathname: string) {
+  const prefix = env.NEXT_PUBLIC_BASE_PATH
+  return prefix && (pathname === prefix || pathname.startsWith(`${prefix}/`))
+    ? pathname.slice(prefix.length) || '/'
+    : pathname
+}
+
+export function getIpAccessScopeKey(pathname: string, search = '', origin?: string): string | null {
+  const path = withoutBasePath(pathname)
+  const address = parseWebAppAddress(path)
+  if (address) return `webapp:${address.kind}:${address.code}`
+
+  const form = /^\/form\/([^/]+)\/?$/.exec(path)
+  if (form) return `form:${form[1]}`
+
+  if (
+    path !== '/webapp-signin' &&
+    !path.startsWith('/webapp-signin/') &&
+    path !== '/webapp-reset-password' &&
+    !path.startsWith('/webapp-reset-password/')
+  )
+    return null
+
+  const redirect = resolveLoginRedirectTarget(new URLSearchParams(search).get('redirect_url'), {
+    currentOrigin: origin,
+    allowSameOriginAbsolute: Boolean(origin),
+  })
+  if (!redirect) return null
+
+  const target = new URL(redirect.href, origin || 'https://login-redirect.invalid')
+  const redirectAddress = parseWebAppAddress(withoutBasePath(target.pathname))
+  return redirectAddress ? `webapp:${redirectAddress.kind}:${redirectAddress.code}` : null
+}
+
+/** Capture the route before sending a request, including its current visit. */
+export function captureIpAccessScope(): IpAccessScope | null {
+  if (typeof globalThis.location === 'undefined') return null
+
+  const { pathname, search, origin } = globalThis.location
+  const key = getIpAccessScopeKey(pathname, search, origin)
+  if (key !== (currentScope?.key ?? null)) {
+    currentScope = key ? { key, epoch: ++scopeEpoch } : null
+    ipAccessStore.set(ipAccessDeniedAtom, null)
+  }
+  return currentScope
+}
+
+export function isIpAccessScopeCurrent(scope: IpAccessScope | null) {
+  return scope === null || captureIpAccessScope() === scope
+}
+
+export function hasIpAccessDenied(scope: IpAccessScope | null) {
+  return scope !== null && ipAccessStore.get(ipAccessDeniedAtom)?.scope === scope
+}
+
+export function isIpAccessDeniedResponse(
+  status: number,
+  data: unknown,
+): data is IpAccessDeniedResponse {
+  return (
+    status === 403 &&
+    typeof data === 'object' &&
+    data !== null &&
+    'code' in data &&
+    data.code === 'ip_access_denied'
+  )
+}
+
+/** A handled denial stays an error for callers, without triggering auth recovery or toasts. */
+export function handleIpAccessDenied(
+  status: number,
+  data: unknown,
+  scope: IpAccessScope | null,
+  error?: object,
+) {
+  if (!scope || !isIpAccessDeniedResponse(status, data)) return false
+
+  if (error) handledErrors.add(error)
+  if (!isIpAccessScopeCurrent(scope)) return true
+
+  const clientIp =
+    typeof data.client_ip === 'string' ? data.client_ip.trim() || undefined : undefined
+  const previous = ipAccessStore.get(ipAccessDeniedAtom)
+  if (previous?.scope !== scope || (!previous.clientIp && clientIp))
+    ipAccessStore.set(ipAccessDeniedAtom, { scope, clientIp })
+
+  return true
+}
+
+export function isIpAccessDeniedError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && handledErrors.has(error)
+}
diff --git a/web/i18n/ar-TN/share.json b/web/i18n/ar-TN/share.json
index 89437bcdc60046..bed77735aa4a58 100644
--- a/web/i18n/ar-TN/share.json
+++ b/web/i18n/ar-TN/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "عذراً!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "شكراً!",
+  "ipAccessDenied.description": "لا يمكن الوصول إلى هذا التطبيق إلا من الشبكات المعتمدة.",
+  "ipAccessDenied.ipAddress": "عنوان IP الحالي <ip>{{ip}}</ip> غير موجود في قائمة العناوين المسموح بها.",
+  "ipAccessDenied.title": "الوصول مقيّد",
   "login.backToHome": "العودة إلى الصفحة الرئيسية"
 }
diff --git a/web/i18n/de-DE/share.json b/web/i18n/de-DE/share.json
index 07ec4148da2680..a6701a3ccc2d37 100644
--- a/web/i18n/de-DE/share.json
+++ b/web/i18n/de-DE/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Entschuldigung!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Danke!",
+  "ipAccessDenied.description": "Auf diese App kann nur über genehmigte Netzwerke zugegriffen werden.",
+  "ipAccessDenied.ipAddress": "Ihre aktuelle IP-Adresse <ip>{{ip}}</ip> steht nicht auf der Liste zulässiger Adressen.",
+  "ipAccessDenied.title": "Zugriff eingeschränkt",
   "login.backToHome": "Zurück zur Startseite"
 }
diff --git a/web/i18n/en-US/share.json b/web/i18n/en-US/share.json
index 9ccc6adfd522ad..cf716251fa48f5 100644
--- a/web/i18n/en-US/share.json
+++ b/web/i18n/en-US/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Sorry!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Thanks!",
+  "ipAccessDenied.description": "This app can only be accessed from approved networks.",
+  "ipAccessDenied.ipAddress": "Your current IP address <ip>{{ip}}</ip> isn’t on the allowlist.",
+  "ipAccessDenied.title": "Access restricted",
   "login.backToHome": "Back to Home"
 }
diff --git a/web/i18n/es-ES/share.json b/web/i18n/es-ES/share.json
index 041585cc9efa6f..e5c333703d2fe9 100644
--- a/web/i18n/es-ES/share.json
+++ b/web/i18n/es-ES/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "¡Lo sentimos!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "¡Gracias!",
+  "ipAccessDenied.description": "Solo se puede acceder a esta aplicación desde redes aprobadas.",
+  "ipAccessDenied.ipAddress": "Tu dirección IP actual <ip>{{ip}}</ip> no está en la lista de permitidas.",
+  "ipAccessDenied.title": "Acceso restringido",
   "login.backToHome": "Volver a Inicio"
 }
diff --git a/web/i18n/fa-IR/share.json b/web/i18n/fa-IR/share.json
index dfcf0c4d444ed3..a9cb4ab25e9d4f 100644
--- a/web/i18n/fa-IR/share.json
+++ b/web/i18n/fa-IR/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "متأسفیم!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "متشکریم!",
+  "ipAccessDenied.description": "این برنامه فقط از طریق شبکه‌های تأییدشده قابل دسترسی است.",
+  "ipAccessDenied.ipAddress": "نشانی IP فعلی شما <ip>{{ip}}</ip> در فهرست نشانی‌های مجاز نیست.",
+  "ipAccessDenied.title": "دسترسی محدود است",
   "login.backToHome": "بازگشت به خانه"
 }
diff --git a/web/i18n/fr-FR/share.json b/web/i18n/fr-FR/share.json
index c121e03e336b78..d8b753416d973c 100644
--- a/web/i18n/fr-FR/share.json
+++ b/web/i18n/fr-FR/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Désolé !",
   "humanInput.submissionID": "submission_id : {{id}}",
   "humanInput.thanks": "Merci !",
+  "ipAccessDenied.description": "Cette application est uniquement accessible depuis les réseaux approuvés.",
+  "ipAccessDenied.ipAddress": "Votre adresse IP actuelle <ip>{{ip}}</ip> ne figure pas dans la liste des adresses autorisées.",
+  "ipAccessDenied.title": "Accès restreint",
   "login.backToHome": "Retour à l'accueil"
 }
diff --git a/web/i18n/hi-IN/share.json b/web/i18n/hi-IN/share.json
index 1904bea7656c2a..e3ca2b72101d0d 100644
--- a/web/i18n/hi-IN/share.json
+++ b/web/i18n/hi-IN/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "क्षमा करें!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "धन्यवाद!",
+  "ipAccessDenied.description": "इस ऐप को केवल स्वीकृत नेटवर्क से ही एक्सेस किया जा सकता है।",
+  "ipAccessDenied.ipAddress": "आपका वर्तमान IP पता <ip>{{ip}}</ip> अनुमति सूची में नहीं है।",
+  "ipAccessDenied.title": "पहुँच प्रतिबंधित है",
   "login.backToHome": "होम पर वापस"
 }
diff --git a/web/i18n/id-ID/share.json b/web/i18n/id-ID/share.json
index 45178425890030..13e4c8af3533b6 100644
--- a/web/i18n/id-ID/share.json
+++ b/web/i18n/id-ID/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Maaf!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Terima kasih!",
+  "ipAccessDenied.description": "Aplikasi ini hanya dapat diakses dari jaringan yang disetujui.",
+  "ipAccessDenied.ipAddress": "Alamat IP Anda saat ini <ip>{{ip}}</ip> tidak ada dalam daftar yang diizinkan.",
+  "ipAccessDenied.title": "Akses dibatasi",
   "login.backToHome": "Kembali ke Beranda"
 }
diff --git a/web/i18n/it-IT/share.json b/web/i18n/it-IT/share.json
index 6a3eff216616de..e7b78f470e2b9c 100644
--- a/web/i18n/it-IT/share.json
+++ b/web/i18n/it-IT/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Spiacente!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Grazie!",
+  "ipAccessDenied.description": "È possibile accedere a questa app solo da reti approvate.",
+  "ipAccessDenied.ipAddress": "Il tuo indirizzo IP attuale <ip>{{ip}}</ip> non è nell'elenco degli indirizzi consentiti.",
+  "ipAccessDenied.title": "Accesso limitato",
   "login.backToHome": "Torna alla home"
 }
diff --git a/web/i18n/ja-JP/share.json b/web/i18n/ja-JP/share.json
index 54bf8ff507bf9f..8f18f7c8200df2 100644
--- a/web/i18n/ja-JP/share.json
+++ b/web/i18n/ja-JP/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "申し訳ございません!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "ありがとうございます!",
+  "ipAccessDenied.description": "このアプリには、承認されたネットワークからのみアクセスできます。",
+  "ipAccessDenied.ipAddress": "現在の IP アドレス <ip>{{ip}}</ip> は許可リストに登録されていません。",
+  "ipAccessDenied.title": "アクセスが制限されています",
   "login.backToHome": "ホームに戻る"
 }
diff --git a/web/i18n/ko-KR/share.json b/web/i18n/ko-KR/share.json
index 84e360b9b6dca7..5c4590674d8aee 100644
--- a/web/i18n/ko-KR/share.json
+++ b/web/i18n/ko-KR/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "죄송합니다!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "감사합니다!",
+  "ipAccessDenied.description": "이 앱은 승인된 네트워크에서만 접근할 수 있습니다.",
+  "ipAccessDenied.ipAddress": "현재 IP 주소 <ip>{{ip}}</ip>이(가) 허용 목록에 없습니다.",
+  "ipAccessDenied.title": "접근 제한",
   "login.backToHome": "홈으로 돌아가기"
 }
diff --git a/web/i18n/lo-LA/share.json b/web/i18n/lo-LA/share.json
index 505f9038d90044..58dd65a15cec0b 100644
--- a/web/i18n/lo-LA/share.json
+++ b/web/i18n/lo-LA/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "ຂໍອະໄພ!",
   "humanInput.submissionID": "ລະຫັດການສົ່ງ (submission_id): {{id}}",
   "humanInput.thanks": "ຂອບໃຈ!",
+  "ipAccessDenied.description": "ແອັບນີ້ສາມາດເຂົ້າເຖິງໄດ້ຈາກເຄືອຂ່າຍທີ່ອະນຸມັດເທົ່ານັ້ນ.",
+  "ipAccessDenied.ipAddress": "ທີ່ຢູ່ IP ປັດຈຸບັນຂອງທ່ານ <ip>{{ip}}</ip> ບໍ່ຢູ່ໃນລາຍຊື່ທີ່ອະນຸຍາດ.",
+  "ipAccessDenied.title": "ຈຳກັດການເຂົ້າເຖິງ",
   "login.backToHome": "ກັບຄືນສູ່ໜ້າຫຼັກ"
 }
diff --git a/web/i18n/nl-NL/share.json b/web/i18n/nl-NL/share.json
index 9ccc6adfd522ad..b3b2c8abf99aeb 100644
--- a/web/i18n/nl-NL/share.json
+++ b/web/i18n/nl-NL/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Sorry!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Thanks!",
+  "ipAccessDenied.description": "Deze app is alleen toegankelijk via goedgekeurde netwerken.",
+  "ipAccessDenied.ipAddress": "Je huidige IP-adres <ip>{{ip}}</ip> staat niet op de lijst met toegestane adressen.",
+  "ipAccessDenied.title": "Toegang beperkt",
   "login.backToHome": "Back to Home"
 }
diff --git a/web/i18n/pl-PL/share.json b/web/i18n/pl-PL/share.json
index a811e314d248d5..1a88cdff2f2060 100644
--- a/web/i18n/pl-PL/share.json
+++ b/web/i18n/pl-PL/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Przepraszamy!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Dziękujemy!",
+  "ipAccessDenied.description": "Ta aplikacja jest dostępna tylko z zatwierdzonych sieci.",
+  "ipAccessDenied.ipAddress": "Twój bieżący adres IP <ip>{{ip}}</ip> nie znajduje się na liście dozwolonych adresów.",
+  "ipAccessDenied.title": "Ograniczony dostęp",
   "login.backToHome": "Powrót do strony głównej"
 }
diff --git a/web/i18n/pt-BR/share.json b/web/i18n/pt-BR/share.json
index 33a0a1eea0a476..4b3526e47f0420 100644
--- a/web/i18n/pt-BR/share.json
+++ b/web/i18n/pt-BR/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Desculpe!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Obrigado!",
+  "ipAccessDenied.description": "Este aplicativo só pode ser acessado por redes aprovadas.",
+  "ipAccessDenied.ipAddress": "Seu endereço IP atual <ip>{{ip}}</ip> não está na lista de permissões.",
+  "ipAccessDenied.title": "Acesso restrito",
   "login.backToHome": "Voltar para a página inicial"
 }
diff --git a/web/i18n/ro-RO/share.json b/web/i18n/ro-RO/share.json
index 36db28ae48edbc..bec25bad580f38 100644
--- a/web/i18n/ro-RO/share.json
+++ b/web/i18n/ro-RO/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Ne pare rău!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Mulțumim!",
+  "ipAccessDenied.description": "Această aplicație poate fi accesată numai din rețele aprobate.",
+  "ipAccessDenied.ipAddress": "Adresa IP curentă <ip>{{ip}}</ip> nu se află în lista adreselor permise.",
+  "ipAccessDenied.title": "Acces restricționat",
   "login.backToHome": "Înapoi la Acasă"
 }
diff --git a/web/i18n/ru-RU/share.json b/web/i18n/ru-RU/share.json
index bb84876703a5ad..90ea8abac14d61 100644
--- a/web/i18n/ru-RU/share.json
+++ b/web/i18n/ru-RU/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Извините!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Спасибо!",
+  "ipAccessDenied.description": "Это приложение доступно только из одобренных сетей.",
+  "ipAccessDenied.ipAddress": "Ваш текущий IP-адрес <ip>{{ip}}</ip> отсутствует в списке разрешённых адресов.",
+  "ipAccessDenied.title": "Доступ ограничен",
   "login.backToHome": "Назад на главную"
 }
diff --git a/web/i18n/sl-SI/share.json b/web/i18n/sl-SI/share.json
index 9498d6b2a2f1f4..88c26bf8b66f1a 100644
--- a/web/i18n/sl-SI/share.json
+++ b/web/i18n/sl-SI/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Oprostite!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Hvala!",
+  "ipAccessDenied.description": "Ta aplikacija je dostopna samo iz odobrenih omrežij.",
+  "ipAccessDenied.ipAddress": "Vaš trenutni naslov IP <ip>{{ip}}</ip> ni na seznamu dovoljenih naslovov.",
+  "ipAccessDenied.title": "Dostop omejen",
   "login.backToHome": "Nazaj na začetno stran"
 }
diff --git a/web/i18n/th-TH/share.json b/web/i18n/th-TH/share.json
index 04b69606eb1670..1fc5966175c885 100644
--- a/web/i18n/th-TH/share.json
+++ b/web/i18n/th-TH/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "ขออภัย!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "ขอบคุณ!",
+  "ipAccessDenied.description": "แอปนี้สามารถเข้าถึงได้จากเครือข่ายที่ได้รับอนุมัติเท่านั้น",
+  "ipAccessDenied.ipAddress": "ที่อยู่ IP ปัจจุบันของคุณ <ip>{{ip}}</ip> ไม่อยู่ในรายการที่อนุญาต",
+  "ipAccessDenied.title": "การเข้าถึงถูกจำกัด",
   "login.backToHome": "กลับไปที่หน้าแรก"
 }
diff --git a/web/i18n/tr-TR/share.json b/web/i18n/tr-TR/share.json
index dcec44786c8ab9..98263cd2be2cf2 100644
--- a/web/i18n/tr-TR/share.json
+++ b/web/i18n/tr-TR/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Üzgünüz!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Teşekkürler!",
+  "ipAccessDenied.description": "Bu uygulamaya yalnızca onaylanmış ağlardan erişilebilir.",
+  "ipAccessDenied.ipAddress": "Geçerli IP adresiniz <ip>{{ip}}</ip> izin verilenler listesinde değil.",
+  "ipAccessDenied.title": "Erişim kısıtlandı",
   "login.backToHome": "Ana Sayfaya Dön"
 }
diff --git a/web/i18n/uk-UA/share.json b/web/i18n/uk-UA/share.json
index 96c63408afb460..282ff0c8804993 100644
--- a/web/i18n/uk-UA/share.json
+++ b/web/i18n/uk-UA/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Вибачте!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Дякуємо!",
+  "ipAccessDenied.description": "Ця програма доступна лише зі схвалених мереж.",
+  "ipAccessDenied.ipAddress": "Вашої поточної IP-адреси <ip>{{ip}}</ip> немає в списку дозволених адрес.",
+  "ipAccessDenied.title": "Доступ обмежено",
   "login.backToHome": "Повернутися на головну"
 }
diff --git a/web/i18n/vi-VN/share.json b/web/i18n/vi-VN/share.json
index a45a5ee4bf5e91..3e26d78e3c279e 100644
--- a/web/i18n/vi-VN/share.json
+++ b/web/i18n/vi-VN/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "Xin lỗi!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Cảm ơn!",
+  "ipAccessDenied.description": "Chỉ có thể truy cập ứng dụng này từ các mạng đã được phê duyệt.",
+  "ipAccessDenied.ipAddress": "Địa chỉ IP hiện tại của bạn <ip>{{ip}}</ip> không nằm trong danh sách cho phép.",
+  "ipAccessDenied.title": "Quyền truy cập bị hạn chế",
   "login.backToHome": "Trở về Trang Chủ"
 }
diff --git a/web/i18n/zh-Hans/share.json b/web/i18n/zh-Hans/share.json
index 5e4918072febe1..7000bba52f561a 100644
--- a/web/i18n/zh-Hans/share.json
+++ b/web/i18n/zh-Hans/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "抱歉!",
   "humanInput.submissionID": "提交 ID: {{id}}",
   "humanInput.thanks": "谢谢!",
+  "ipAccessDenied.description": "此应用仅允许从已批准的网络访问。",
+  "ipAccessDenied.ipAddress": "您当前的 IP 地址 <ip>{{ip}}</ip> 不在允许列表中。",
+  "ipAccessDenied.title": "访问受限",
   "login.backToHome": "返回首页"
 }
diff --git a/web/i18n/zh-Hant/share.json b/web/i18n/zh-Hant/share.json
index c406a147cd7236..df7a687380ed0b 100644
--- a/web/i18n/zh-Hant/share.json
+++ b/web/i18n/zh-Hant/share.json
@@ -54,5 +54,8 @@
   "humanInput.sorry": "抱歉!",
   "humanInput.submissionID": "提交 ID: {{id}}",
   "humanInput.thanks": "謝謝!",
+  "ipAccessDenied.description": "此應用程式僅允許從已核准的網路存取。",
+  "ipAccessDenied.ipAddress": "您目前的 IP 位址 <ip>{{ip}}</ip> 不在允許清單中。",
+  "ipAccessDenied.title": "存取受限",
   "login.backToHome": "返回首頁"
 }
diff --git a/web/public/illustrations/ip-access-denied.png b/web/public/illustrations/ip-access-denied.png
new file mode 100644
index 0000000000000000000000000000000000000000..9987f78473a55b03659676a5925364f1521c0566
GIT binary patch
literal 10590
zcmb7qc|4Ts`#;Btibx7!MvhXpq?j_smZXx9wWPtM7+V;OtWn02p{$WT+t{}uF_dLw
z$&#^#?0fco``tt5bI$pF&*$~~{{ArLd7k^e=DF|tTHe?Dx_s5|C?7e@b(n^R=E%((
z*Y48L(Eb2_oCoQ_ofjw041j-!p5C};M?*t5PW_`TbiQj&LvxDe<~0Q^?8BMp{%nYD
z=-8@MN5=<;rxq4$L#G|S(+ZyMd~@cg@5L>SN`zEn=_{^~(xU-aJwwPhY>wFnLr=e-
zm@q1ts0y3*{c*sTVVI%95L(Mk`x57&dOL_`x)XnsjBhfHPL3E{({k0-p6Om5a*=Iq
zRsGrb@JXh2`cGNybaeKY0Pf3=`N&b$I|A=yUE!r`gNy?l<!efA2f;fF&COM^;L5jq
zcDYD%FL!wyX1dpPQNb3pZoAv=EW2AxyTV)B{kw|T)n1i>x=>*w*k*d+N$SK4(RV6|
zmOY;#jutG)^*Y_p;iRRcoLrk8cc$*&T$U%D^T|+W3nGe)?|O7GSDS;6ewao|o;iqa
zSl)-tYXSpDqIli6=GP<5&1c)#2drJE+;N&IcV4FJX19|j3$@**+B1zVzD-S|$;>5@
zppiL5BKyj87aPp7`}m|Mer?{z#)3Ao^)!QZU#S!l<v!=d`vM5rZE(N5J;W>K9gcL9
za#^oOGJkZKIc(q6*?BN_d-_Rbn5cf6mWNJ`+#K&_Cz)$IzQ4@b5xX&w!X3>x?!(KX
zU!@wj{X6GmKZi7fMdo&q`)0@7Xq2`0T%)y{9nriat1Cvv`EeA?5{+>xv!BwjGLkla
zS-?S8KOkTdQdn46Gxi&Nkj!6`tK_3#%ITFX6%oxy9Nnoe-<q;m0DIl!wvr!9AuTh3
zJ*3<svLNQ<BVwfNM#HKvUvH#`RC#UrIFeFrns_9C(o(NX-AH;eoevkI<z7(!b%2jE
zso-wD0>k_%xxr{L^!H230nWcuXC7?%8vZ4Amk#{Uv5OFW0|xJ#uTX)^gDnnj6&LRL
zKb`Jr7GLg5(OFVrU<&3WLm^d(Gg}@;dD5SAtyOTPYBR4%<MQ4oz5aYe{a$#GOgaK-
z^Pr`nfg4Vk-vF|k&x=%me~^mbz>=D2|92PR2Z{q!Q>Hwa2Nm4bnhr>Ucb5OPf^Q*F
zcXSU>7cdvgh{kiR?hUGvK@NMj*zYauKO4k~Im)uYe@z-`T0?yiTFoX`Gz+Sgb^?WG
z9?TV52VY3-nh?!dS9Em*Mt&nA(F>b#%ME;){h7<`6x+>@YJL7bPzvrtCJZyYksURc
zp(q^Tq@jtU>+}Kp7DuPIw^EM-d-wi#7h;T0xufoM>>b`eRv?W`7Q7stbr|l$us$Hi
z(e~#Fg9EHRk~npcdY^UHMPn#N3jLjb{1kLp*~fv@{0i)K99?qEW*f9w{Pq<qurZu{
z>lcq3ua&@z_ttg*?tO?HfDPiUlty}AWkNazKA;{SD~3t)ui?G}Q{6uH>U6+gjnlve
z!G4X?up83QcrY8%?%mtJNZq~4MpNKfCS2?|+qd4tec9@T+|~fgVr>0r!{hwc`HK*m
zW|@T+vlpB}bn~_q50#3?Vw@j4_PegO>T+33<G|qQ#>@Thb_<-8?AowznN1k3GSxnB
zMl%&3I1<F^d~)|C$HRkSq_x4;@QoRQ!^O7^Nj?^MF0rV@X&MiQ0U1M&s!q#+K=-Yo
z#ohBIt`<X6Q&R&Q%Tq~q-EFiqGoOEBYCfu8JB?n5cI->j_Sd#+D}I9K%D$LVt4ou5
z=Z$F5B-lvh{>93j?I*H}Z@YZi&Z0YvDPXhTCf1}kNI5MGe;*SNH$P^FIU0E3%~nM6
zcT9;8*lpJ)md#Z)ndP>vCmN#dR&@P#O)^IPBv%#bv`+1$fL_<t-o+2Dl-CovdXfS6
zg59m-ys)p%$O&b4LxJ(>z1+%ix7PJjQakoUw^nZbi`wCAp&3WHjh4VsyD)=$D@r(W
z|8a3;hWUg1Us%u;G$&FQcQP9r<)$C)#&&2(^eIEM`<3ZEY=?!w!Bqt+`!&hq<e=;6
zwF&9hw3Q7cAwtOy6_mHI@7I_xzn=)auv^_xzO%fpcB1)@KX0!M8I^B-btGK^9<Tes
zbUDXZuk&o#;(_{{*p=P%48`g;Vc_8ckH<d8#|?fe3L&|ftIVGqpCeb=RfkhF+!v$z
z+em1hVCEB=*>U`Ch`TQI@T+EsR9d=_9KE5Xc8x`DL#%lws!c(aGmd9nl%9_s)j(Uw
zVY_o!txURScw$Jq_4R}i%VatJ&@mlJdfVTwGF^X5=OA1Q3%z1LsWo7{@GW)+v+{|7
zS0wZK=+yg;Y-DVc0g;v-ZWWMT{T(J|b{BcgM}ZT|1PofZ{v{*F=axj}u^yrGl~#$}
zqHT*~O*p%;ucBqq=yK=HnIcB(!pCrnulm+y+WNTp0UR&;SO26T$MQ{swe4AVx!8_t
zxOH?<X1LKak(DO7T^FNiTAc$QZt+(cW=Q3%sbAaKohhI3Td8<Xw*XrP(|XIl+Zwdx
zy6^6E4OHUB<fbO|c&t^(37Pg7k(vyVn#r|ORi|D_?=S2%9bqLx^uh`}fPn1I95Z3O
z{Te@k>ApeEQ?h6Y7lMa%1$BjYbzf7Cj(~L;F!IqGMTiHn9W}n-$1^99Tl8!uc4sLi
zY5BW_crL@Mx=3h2Ccn4Xx+<&=HfXAkBXhjqeDS)*gX=;DQ;fh08nyf+#z}xj)}^>$
zLZJt4y!OWWt06H$)t|d2rFmfffMG+eHWxUL+UFUvX;$Ivlq-w6*^}DQF#C*1v4i3V
z`2%RVZ7NLDdam%9UqPnCKX24jow9r&DWmRCFre}}(+OG19juk>MbDB`_dQQYOm<E~
zxmf{G(hw*Vb-l{exc|}6p=IEgsL^G5TK{%W18+7kfEV=Z;+Z|y^qzyTV&XPzo=KqH
zeon^__Vr806@SblJ7y@NxPU&gYvD7a*b5G%i_HY~vGP4ty)IToT;3)BiFid^n4345
z`NZPZyMz*3zpZ&sAW7m+s~W#3htM_Gjyw`#APLK~dF+r1Cy>Jh;33gaWGF;v6bcbs
zAPWQIjaP6}r}NfO*P_d8wWvUctOOLAMQdpk;qO1j6=h{ib{rl_&#QE($a6=gd{VsE
z%W0TetKH2{HHYdWJU&h~@3bt%-4E!kd?gUnp5ZfB>q^rgCJ7kqv^oh}gX)aOV3oQ`
z&~U0rc=|D@26F@_iv^@w&i59Y>kj<EGjypYf&cm<HmTCwybF6<y6)P<TxYz?{3~*f
z;>4U^p1lRUj#NtCU^+8?PzdUxGBH&|yxsKZqS*|Xs7PU#(Y=35nILSK{oj6c&kidM
zzjW|(OnuNs`zuKf=oMbKZoHffxhG1zi6FQ=)^|7#=@GJb^dS9FUVW-6&RQxCw%&xi
zC+XB*kY)&6M=C1tsMm#eoVAAzijNyGr>gGc&$Gy`#pPH<P}sAP<qtd0#r<ty5a;&|
zc0>hDj($*=uwXq``IDisrdXD-uhII?qAr?4tpjNMBFUEzNDq<~A<iE0@<%x7Z)#ZP
zW(Zig7o>bMD;~m2e;%n1A9Mc^)qa1f^WGBkETP+GakR0Vhi!AVgv@T}Q(OP&1t%t&
zuFus^duY{*f#qwA^Un`mKrQa4LkKBxjVvD<@3+;;%B9pI&)mY1nMYKZ=6Tp=b4BY}
zfPuKx$lsCoQ5choizKF(#Fep`xsNx!le+W~GtoM|H1REy!rT}Zd{(Va^-QFMh&uH=
zYuQO`XYaJ-ed2$Nld&)%SK$LhKl{&S6HrmBDORONjgP{8KD9n(qH#?$quZG2DZ(l9
zx=MU^-`zF>fOJv6#nOn_IXYDjGiti5bk6*pAqi%7Hya4f(I@Rk5B*0DeQujGizvI{
z+Slv3_uqY!kfYh~dyvFx+-%R>Nr^D%O4V;RX&jn4+?nOl<1%xjYqAUb$L1;nGf%3k
ziuOdRv9bX-BF_{DNvsw&w71ag@;mBvREi$);y_td{)9WFX4aou_C5A#%B^4@Sk#fF
zYP?A*J#!37KZM_+oz^ualtB#GZsf4?JxC!sApZ;T4OH;kKyKxwlr*d?_?*EyO{)*}
zZ4~BJQgH?_p4(F}Rvlo^5?=!I;DnT1XHw0*wzXaq4tEg(mA;7dL+6V7m?-zmFLcJ^
z%Zl7Gr{@4H`^!*G-|!NWbxneI&u4qcI6NX1+>65hHC!NLdX5^EO@nybJdBPWmz1c5
zp>n$8Tzh!#HafP16K6ySh3s7enT5$&hmgfjjodQoxe)Jj*iO;ghOQih6RH&hoJUh_
z0+|%ZL6JmZX#}Z?YFAVXyQPT?fk2VQo#Lk<e}Z3yYOmxk{x^dYSPQvU8#IQXCq40e
zl9sv-SQlR-T<but;`(4{GU?o&9Mlc?9)wsuNVV+#yCrMw$u%+nRw#SNRocBAN@Gl(
zQ|cO+KjRJAQ$T;+$c=>QxwT`Jc)khsUtsNE(tI2}lNVu~uwl}{y~H7TY&>C<J6!-#
z6>*o%JN^{aAWxYv4`-XUNvB)NN=>u&6i$4Vo)vNFZXZ%1T>ov-4k4}$zw2{08Hxlt
zSQ7aBoySqH_fkg_&76h0KG=<w1~;vi?{0s7DZl=P@Y-X8NA0#MIZZQVl>321+7TG5
z+HDyU_zet?*T_dU8jMe`tVMT$%!ygjrWJN1RQEH0FS<P(Q7E_0CYVO-kZ;<yzVngs
z^|9F4@(s#?n22XCwBuapie|=z%@uYERK~8v(5A^KFuHz}({dv>WAvlxYTkYG*VdL@
zX>;9aqclsjPH$fw^*SyoLwVYJDP=-4N>!=rEk&L8*?9b2<lSyFqDcCL5c00yn6FhR
zH=6k>)76bV&toddP<o_8#tzRb*JoCy2Id$wMN8{Ws@#%pijmRpT#~OwgoZ%$1EXW4
zK;ZI4H9yp~r8yhZ{lr0~#SPZ-4OU0bUDT6M7p~=SpWka*$Fk*}toq~n1hM+aOG{rk
zJP@{_*L@VCq<)wc$5__HJ$yY;FFO7QvNY;?fhbfuM9lT$fy{@?lm67O=#HmlF;WoY
zeL(1Lj!Va({UXJ*=95%<v=<MIsDu-pVT0!ulEhd-XbWu5P-EQt<Zw$;HrD}(GCzxt
z8XjDMCOGA`C+GAjSP|)vRN=lY?AuK7n3JZHjPTF5$f)~8zB#{vyy~W^m^svaZEj$$
z;ZoE0H~wAkfU7$XQ438WIJxwNCydUEPtV24@`s73&dhB&OON81A@|WwU{)VAhgC94
zo@yeQFc}VrUsy9WidS$dSang0l1!o87m-FJ?9WtBz?YqMH|_*4%E~p$AZa-ME&)y;
ztgpm-k7XtbA-%PfXH>SI<;Lh!!m}(GYWa1|0^<_zBlgw*1}`SHdoU==)O*k$_*sA5
zxigjs#Gm>t1eH*IcsufVKq`fbw^zaFS7`$q>MrwCBRoucAAo!EEA<4{XDw*pVy?MA
z*R@$Z*?UTHz8ZyFs1{y(1B1rwWw)%D7p+(jw1<yVrU()bW>vPWYDvc_+39Pop);tJ
z13HX*2vginzN|8;9G>sAxjGvT#|^6Vrq>?7D1cm<=?Ne9wE|J#@gA-^D#@UgzvNQ6
z+`qF@lwXNsX%YzbZR>GFMz(2a*6O*uy_2%|F8BM%60sYc_DqvyH(8o#C?dU9haMm4
z0E)+b{$c5r-QH$bK{T|Vqh_$aG3xSI_St(sBN`P~4%8fxG`xXFhmkTKc67)Et$ntk
zHT5jLy{~7Msa8ctW^{~$Q!e&|@vT#xLo3J0V6hu|N&6cAj?N^T9~+tUgyrD!!1K4c
zYkU4<NHUlctRpDrqPSl7E80^qlc+b&lOJJZbg-+T$ewq?!lKkZMYuetT+M1dC~g`_
z7o*Bo$0gj!^ASC<L7a(j(Qv@JPE=|SMYt$@uB-CE<rp4So!;C!%1&Ae6o+tdUe1S|
zt|_{Sd36bj4&L3u_Vh@?LWM{egGKEG3+*A-kBmkiz7fU5ZI42X3g*W%=y?)jJn=R)
ziMNIv%?VbGlyFxaO=;sGg0Jgg?_rg$+#>P%ll9R=SKrrO<DAwAL_>EFXFo_xzhXNn
z-i}cfBqXiweA1Utox>;Ji1i8o*dKW?F#vZAT@h6J{28(3dT7mTOu!;XRDqac<NPaK
z%dI|dF@Fc9-f&K`sJB=hvq$H(dlM}hqR@SRe)=VT8a-6y%a$}-9Yz^ybB^gda-nW|
zZd~2r{lb}-_z==NgwtJU(Q#5p*Xv0a-}qm_B91>5+brQEZgy89L1$kV1u>noGl64M
z+2th6H)pk>Rf{_<*p-tUVh=?uY-25J=4!aD+uGx&Z;YrMh6uW@FK4?O6f0c6g%nZt
zm*uCdA5+Bb2NVTm_4yzAw>bK{e;LnVNY{y11_mOVbW>(qF^w9!_f2M<lAE84&7&e0
ziaUE*vpl|STOJh7^5VLHxl5PTEz+y${2+tv*_5Za{SOt8h9b_ldGJZ*i>q+=-v>FY
zRVLXfMqM;gQwc|4Oh7%DpBoNr9XRoI%B_Z<NqP8%0;8nQPBl2ERlrG!W`5CbiJ$Zw
z=hQ`r=!!fMah#mIVShf3zu;J4{Ef1rCWfj%lc}OCK%N!Pr?#&34tG6?EgQ)vjGsdn
z<H4a<E_}0n3`}7l>*G&C5<lgGAvFv1{*9{olv%L#?EP#y%W#l4N33f&veN&ufMA}S
zNPO=?eve1}BwV|1QA@H6X0MednvnPm(WcpKIXO2h2)zH+zAc2%iAN?mPkCBS)^;3e
zVU>d_6?PtnBb)%lxex+i*Gcd={evLp(a<O(Akq{Y%`}x^DYqHqx%UzrRoe=ynXVHr
zOAgF*nJV;dSZXSV>Nk(4LRsuLi&Y^p2td2}@X$d&dk#N}I;Uk879%5(2<rfOH}IMO
zKp9-%&ac9zaYJl|;$bySf$0HP5b!o{7V6F|=vLX=zlU=)v)=b5t3O(j{K2Uj+QNDn
zs?AlduW4_dMOwS3jX5s)K$(1H$Y|Y63iUx#SD9e<NgjY}Cf}}zGc`qmn5qC=5xc&Q
zd1gZ5_+bXf&@0?o_Yk}mpariA&vW_#k9Q|h96R}8UCMv?gT<x5ggtNgHvbBqsw<Pl
z!{$|OUVJAsNH%}-%|N{<-i6Q7H5V7H-u%c-w1li3lS@v+`#0u>y;V}X={!Am<M7|`
z5C7NEj`37>mOa)(=FL^y_6|iC8C|y0ZJzJCxk5pQS;6rTX;^s4{Ec`z<RDpsVw2ln
zwzDy%66KDa`KPddxN~4aYjiA#3(gB)&OVWL{FwoKD6p!ihi3{i|0Af&fGf+xRUAO7
zy}U*7Sn@ZsPNJoLvF%8mOA%jF&APv8*X9ik6xQWrpG`bHlfeaZ#kEmIgr6;c`o7+?
z36mploj^t+ETgXOd7jl_H4&uo@G1Cb)1iT*Qt@F=XJfI)N4$#!JuS1WRVn^xTXEZr
zG!VXT4y_))cp6!UFWdfVTVtDI`S)r0*5It4Ahcx8%k`}a{}3Wcd}zJJSEnP{NB+OP
z)w^j(qqu|$nFG%#&o(R+aMTNCXL!4@6*ugkS2?7Dd~}<1$|%(M)LD>hQFu5t^OyeN
z{NHlEBAujL;{7;+2zxxCxIhJwNn)?QaOjEtH(@5m6^eSzT>^(treSz79u5zIJ*5XR
z(DGIJ6%rsOzCL90nNf)~4+L)<bGI$GNQOKknaH>1`64uc78vTCQ17YLK4<Gr02y01
z9`bTI0(VT^5T-BTc_{0inC{ut*?zf$NW;R{=@M6&j7Q~(hdhDfPB8Fm(^ltoomdQQ
z4|17*NXznx<8+1vQ!1^Z?IcWP7G>wnw|TcMC(cjIpiA~Km><+HAmfQg&;P=}uFdh2
zHtXr3#G>Q}Cy)q-bI4LpF|(n8lY0o9>M(usCnWyD@=FRhbXZLPgYubCru2V@93W2~
z)Q{TtxD#H?h2o?!w5T^EefVDh${qkOvo!sYHeqj|+&C>}emdS|qHZN&V>uz(pY+{n
zEP9|dNo8PrwLf;(J=UCLLc*MI^gy_n59mM0CQ+VcebriA(;|Vac##xhpad(d<e$8x
zb^8*Mv|2XXi06^I_;GusM?Y85*Dvi)lodHf&MY4$$;_WqArKe&`$Y^WXZ^XdQWnnS
zFE5PLtIRCH+^o@5h?pAjv-hJTX^jL9CqH&~Yiv>1wL1sMG9!@;!gy6@0R4TiaWS!-
zAPTteL@U6h1iEIc5gebCIqbhmNTz;~RkX~;cw&CXL+4Bm@zu7j`oX?7X5f#TFUWy&
z5=+%ro+(K#(o>e?CTz66>@~4(Q_{bLwCXE8Nwny?*#EX+=c8~>I^vT0unLC*orq%A
zAV3wD7_=Z1&DdA=N&pG;Z9M831o_dMyQNJ`AqF!m)l?#CmzT~{fvKdCRxKZ+9ow+P
zBj;ASlG$>cG&~iqI@O_C1+d+jBmmmA*?va-!qttOadwF8yiU=|qJFoJOYQN>YCY$;
zExr$_2uaIr%~gI7b%-LG-r+r$Z_*NOVlxvgM&q=0{W=r8k=B~cx#=D0yXX15Z#6TM
zQ}H<HWPy}R-<|ww3!#z&y-Cs9Rto9g)$Kr{bc_r@PaKDcY;i%c%}yRJDy(tBv((_B
zba<oLW_*STi-Bl&S%#6q-xC)q0|=5aY$OeKbSX(TZMtE!U<S9rlbz|Bn(sWVMU@N3
z(;B44I}S%Bao0yCjYX05d$XICZ;tpkzP&Aw*&#?7!y0!J1E2`;<+b0M8TJf1MCylA
z<~2(X@dDjP)2sE9IpRvL__N8bgnX7WazN%`V?dES^DWY-7{qo+4kUD=c)4$4xw)9c
zll_MbI*<I|t1G&X(enR=F;03iHzl*?qTN(o0nGb<Wv)2$N>jnVT>i!1A&O{d_FkUK
zoK(4oz5kR$4#Mmgm{<Xm%tA`S%x9|pnP20^4wHM9;w*n9)qwY+GGIw*0G0)ciBEIB
zVcriZo_KXGKx1DRk9?}bQTlY?^A@BjD+;P*cHHoN!8iTInUVpe*U@hwE6{AnR9@uM
z!_u_I6-Df%>gAvMnF0DU+2g*wLiV5X(l47RHwddPe?>>BP1ocl?okuuzF;}1Gy+h8
ztdS#sS=jM)qjEWi>COjXjT-g}P4wGf%-v+Lwv?7@n!f*`8_v2T9I&8J#4k}Fct4$Z
z9N34z`he?`!qoGrHDwOi_qPF$)buWSaGj~?9dT$R7vRMOG73lKJFj|eQS<ossqK;d
z$a@syO&vC?{Pu1R>B%-188Yl;G>zq{@)5qOxG5fWYUb+-kNyfc&MVTc8<_M$o#o8S
zNPp2h{zZyaW|+YzLGHS}{i_Npg*aF+L*No}I@<WmqEY{&Ud`qEJRE`n5%7B*SJrH2
zE^6hwT~i~-Lpsr!g|`;h{*XqnoD|f6Q+=uNjXq{+m~tRA+I1<BHxpwav;G_ispPy(
z84;J~t>rot5)f`PQWrW`C!GBPxjm^nP`26^b=lh5|DwJ{gH?EpoV#r4a=ZSbeyS2F
zY&~5ah<&u!UA5F->U8PBM+ec;`5Nwlk#Hn4pbUPB+C`2s$RqbcM9Ej$W%Ym}!H>P(
z#B`C(E{dq>;sD^x?F36?-ZiE<1ICKV#Q5^Xpax}#lkvj9VZ>BZbCIA_?<u8#-=}wr
zEPL3`BT0yIWAw+aii^@5a)5;rjA@!{Fq<j{99)+76ja}X?+;y2S6UKfKuF%vR$gu}
z6WSZ`pHFqWwkubeKFb?FH9u?aL2Ib1u)^h6hR@3wc!rE5qV^b0mJ6r%Y>_nLL0}w3
zT5E8t6|CPs=1>)ggRg*upUxLVNlp=mBrP3|2AIW#I#`SzPoRN*1MJfcGi41(p&vwB
zE?-pI4{zx(jp{tqd_p4za}9{@^!{C+Xz^B6fX(>4anht`Ou*R?=2>r+Nx^YWhjaUf
zgqZiC(n}{s>N_#Vw|jloPu^-~)j~Yr{+U(viH7FjB()ddx(c;kW6@h;zp~!s?zR&g
z5l*h#IoBg_gqU`%H+e=7whmZ@V|zAx=K43LK*(F>o{YpV^g?yv;uASyvyR_wloOTo
zT)ma4!q>uDJFG1oj&%*zpLn|1oiKJwxLRO0cY2TP1g1O4TFI=<w&J&7VgY9_TCy0r
z6cWcDQUlVESKi5m?Tj4f8>alUxvo5t{F*Q?-~h|5OiaAfsJos%ofDZ^U3^ou6Lq#i
z{f9nd|KRo2OdSJOXSBaIM&g5?7TmaVpe5cSzzFB}K^d3#ZI6fF+$vrU|6X(!YI0NZ
z#a3+xyZ>Y=LH4cn@#e>D&Pn{<5GbUsozo#TVr)zzO_f@x=EubH7V20E0wU626gP%e
zrJSV{JK`6#f01jbbY)y*V$Gsm@oy{sb>e|>{HFr}x4|juU)XN4Tt^7#FI(=;bJWs~
zE;u5Mfcsfk_TUqSjMW!k=JM;>yx@Gr#{f7t!o2ei;XdVl%YZ*_te9HHx%{6pj@d`_
zR!p{V`hD{#_(EYPC)^L6DTu-18G*9hK*?XC*E>1Al2Ul8AXaI}q|^LXlkBENXZ{nl
z;;F2UVX$1a_{y3Y;>`Nu*w}8r7S6ZpQIQYFSV3l`-2<AMS5(^ff;Uf&eze2OBr64H
zuJW;{&N1GCbFHuYkH_Qj)$`N+<mOz?z=n1K_+(Xxelr~R`T}v!Iq1FR(R*Mxy^>nS
zp2!~I5@4r6Cb@1t#<B3m%=DL+6PeW@lHPbF{i$)iSN9&`8grw2+dDeAErWePGKJq0
z!D-3dnPBK&omXA;(d-2wxVv1&d1ZQ<EVpB035kKDnII-aofZxDOXe3AYWV{jU@(}~
zNktz8y?EeRw#_`mQQ2g~d=;BfN0vd+s}T?fz19F-wNm$L`@!|(%7>I(`bB$t&J}CR
zhf(l`raxq~F%j9Ls~3sZ{ZJ}q+C7vrxnG%Td|us?Xn%Q8J^M_2C5Ihw5-0pXO^W84
z>ARdOeeb&}A~4NYXye|U>%T!w3k7BAAe6y)t^=uDraOMv+we&%>xmP;Dx&~QKDFco
zNNIlP_28vuKot-)JkT)pB--sDOq=E0kG~BBX*#mJFbR}RL1ZPY*I3BQorXN1owCcc
z9<u~hR^@X6K%G1eQ>UdBp2x3hFa)sC41T5tt1s4hF6o&ZEKS-81mRUB+yaHF<ipCf
z#!sgXeRg#o)Nt?&;@!bwC*K2xgfyXW7@{O;G?K0hLP>34Q1y>?wini^Rf*HT^T}<^
z&pmJ=+)v+wv+Gh1XgS7q@`mamw1cc@Dp}_NZ4X%7uVyzjiDPjbaju}@;F*u8H&HdY
za8;l9_GQ2rZ-h{!W-=X3$;+}h>a#4dvZdBi>!&SixhV4I`605(SjYs8hm{d6{Wzb4
z$&{IK_9%_K`vALyJc~wApv?09B<ke-eg;sH|M!j!1JR0=g7=^Y!0cPHItPY{4bKg_
zOS~OPOfNY}Spj-v7h0n3i5Rzyi5x&a{Erbop&yt(7!@dkc7=grR+a@6cC23gw0E{S
zfBPrr3eb7r>U1zYz`56cujONF%oCWm3@APX@y>q@H>-2*)!yr7`TGN#CJv|A68x`0
z9KSFKwR_}+=@_Hrejfur^Z#gP_(yNUf4#_JH!L(Nz==;p+!h!h_E<&jzL21n>h(gm
z^v+CMkJr>(Pb^O|XEpBA1q~P8Eq>w?dPpQo?AGwvF*!cfh86{c&KWr!UqBh+HfPJ-
zck=7^I!vgWQ1c!IFapfF4-s`+!1nyHv!g(R(%<l=pI#}#piqe|{jG%u#b?u*BgMha
zERFDGz<%2Qm+p~S`+skYah-$%tfb&pC5`;EltJw!Nr)EP@6_=KxB_Iu|G(N;_FG>{
z?t4(YTc8^WbpO^oWW|{|?$69AAdZ&-)t#Po+R8_cFHrqqd#4ZPoP5k=%;OC37jcpL
zz5NfKO&Dgsp+$_vsL&?+BQw>UaJvscXfI~i>*fKiEvio0AE_M~|9tRs{f}AAj{TOO
zzV(Ft63w2S9i4G`i&*>Nm5<z62seV|?=k>AfC0XDz%F+4L4@0Ky4uTVX-8Prk&~dA
z1btY3%D4A-?fiKU&_o7K+z3=87h`D*3_ld*=C+(;$hR{h;~@k7$Svat*@as7!?9~s
zXFqq4Rtm2d@=1SK`Pthuewxm-WX-CdRMv86Fs<ucGjLcdBRc>%4XMatYAlO-*`Y3T
zpVm1(35<DW77|C@1{inGya3%a4W#)1>jv57G&M=W5mkZUu8ob2t&~Ur2#K~8=<}+!
z>J$qEwYx3iPD(z|r^|36KrKg%4W)|rUd}S0pm2qEciz3hVkTOwLN}Xq*?DW8{6yMe
z+Vnlo-+Jtd&(ITz;0;|@I#Gd5Sr5zLNRP9N+E-r8?QHHscP3(Yo?s`E!apaegnted
z*2P|61Z_q}X4Cw<>$Rnbl`6JfnXTUb?II`9uC@B#-pzlNc4x{aZMat!m2b~H9c_5~
zM>No>qjl>`DRPh)mxc6!*UHdCtG%n2-6dCcX;|Ns6YP@BzJM{z7$rT7ruActqmiu%
a&2_UUmPRqTVJPr~=BCn}YgtzfJ^v3RZn|~=

literal 0
HcmV?d00001

diff --git a/web/service/__tests__/base-request.spec.ts b/web/service/__tests__/base-request.spec.ts
index 423232f1069d2e..192e43a425a106 100644
--- a/web/service/__tests__/base-request.spec.ts
+++ b/web/service/__tests__/base-request.spec.ts
@@ -45,7 +45,8 @@ vi.mock('../refresh-token', () => ({
   refreshAccessTokenOrReLogin: mocks.refreshAccessTokenOrReLogin,
 }))
 
-vi.mock('../webapp-address', () => ({
+vi.mock('../webapp-address', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../webapp-address')>()),
   getWebAppPublicApiPath: (_address: unknown, path: string) => path,
   resolveWebAppAddress: mocks.resolveWebAppAddress,
 }))
diff --git a/web/service/__tests__/ip-access-denied.spec.ts b/web/service/__tests__/ip-access-denied.spec.ts
new file mode 100644
index 00000000000000..4c1f5e0e5f1a5f
--- /dev/null
+++ b/web/service/__tests__/ip-access-denied.spec.ts
@@ -0,0 +1,339 @@
+import { toast } from '@langgenius/dify-ui/toast'
+import { waitFor } from '@testing-library/react'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
+import {
+  captureIpAccessScope,
+  ipAccessDeniedAtom,
+  ipAccessStore,
+  isIpAccessDeniedError,
+} from '@/features/webapp-ip-access/state'
+// oxlint-disable-next-line no-restricted-imports -- This integration spec exercises public WebApp transport error handling.
+import { request, sseGet, ssePost, upload } from '../base'
+import * as webAppAuth from '../webapp-auth'
+
+const refreshAccessTokenOrReLogin = vi.hoisted(() => vi.fn())
+
+vi.mock('@langgenius/dify-ui/toast', () => ({
+  toast: { error: vi.fn() },
+}))
+
+vi.mock('../refresh-token', () => ({ refreshAccessTokenOrReLogin }))
+
+const denial = {
+  code: 'ip_access_denied',
+  message: 'Your IP address is not allowed.',
+  status: 403,
+  client_ip: '2001:db8::12',
+}
+
+const createResponse = (data: unknown, status = 403) =>
+  new Response(JSON.stringify(data), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  })
+
+const createPendingResponse = () => {
+  let resolve!: (response: Response) => void
+  const promise = new Promise<Response>((resolveResponse) => {
+    resolve = resolveResponse
+  })
+  return { promise, resolve }
+}
+
+const createXhr = (data: unknown, status = 403) =>
+  ({
+    open: vi.fn(),
+    setRequestHeader: vi.fn(),
+    send: vi.fn(function (this: { onreadystatechange?: () => void }) {
+      this.onreadystatechange?.()
+    }),
+    status,
+    response: data,
+    readyState: 4,
+    upload: {},
+    withCredentials: false,
+    responseType: '',
+  }) as unknown as XMLHttpRequest
+
+const transitionWhileRequestIsPending = async (transition: 'denied' | 'navigated') => {
+  if (transition === 'denied') {
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(createResponse(denial))
+    const error = await request('/parameters', {}, { isPublicAPI: true }).catch(
+      (caught: unknown) => caught,
+    )
+    expect(isIpAccessDeniedError(error)).toBe(true)
+  } else {
+    window.history.replaceState({}, '', '/environment/chat/another-app')
+    captureIpAccessScope()
+  }
+}
+
+describe('WebApp IP access denial transport', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
+    window.history.replaceState({}, '', '/chat/ip-restricted-app')
+  })
+
+  afterEach(() => {
+    vi.restoreAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
+  })
+
+  it.each(['/site', '/webapp/access-mode', '/login/status', '/passport'])(
+    'handles denied initialization request %s without consuming its body or changing the URL',
+    async (path) => {
+      const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(denial))
+      const url = window.location.href
+      let error: unknown
+
+      try {
+        await request(path, {}, { isPublicAPI: true })
+      } catch (caught) {
+        error = caught
+      }
+
+      expect(error).toBeInstanceOf(Response)
+      expect(isIpAccessDeniedError(error)).toBe(true)
+      expect(ipAccessStore.get(ipAccessDeniedAtom)?.clientIp).toBe(denial.client_ip)
+      await expect((error as Response).json()).resolves.toEqual(denial)
+      expect(fetch).toHaveBeenCalledOnce()
+      expect(window.location.href).toBe(url)
+      expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+      expect(toast.error).not.toHaveBeenCalled()
+    },
+  )
+
+  it('handles a denied HITL submission without a WebApp address', async () => {
+    window.history.replaceState({}, '', '/form/ip-restricted-form')
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(denial))
+
+    const error = await request(
+      '/form/human_input/ip-restricted-form',
+      { method: 'POST', body: { action: 'approve' } },
+      { isPublicAPI: true },
+    ).catch((caught: unknown) => caught)
+
+    expect(isIpAccessDeniedError(error)).toBe(true)
+    expect(toast.error).not.toHaveBeenCalled()
+    expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+  })
+
+  it('does not publish a late rejection for the previous App', async () => {
+    const pending = createPendingResponse()
+    vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(pending.promise)
+    const response = request('/site', {}, { isPublicAPI: true }).catch((error: unknown) => error)
+    await waitFor(() => expect(globalThis.fetch).toHaveBeenCalledOnce())
+
+    window.history.replaceState({}, '', '/chat/another-app')
+    captureIpAccessScope()
+    pending.resolve(createResponse(denial))
+
+    expect(isIpAccessDeniedError(await response)).toBe(true)
+    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
+  describe('concurrent authorization responses', () => {
+    beforeEach(() => {
+      window.history.replaceState({}, '', '/environment/chat/ip-restricted-app')
+    })
+
+    it.each([
+      { transition: 'denied' as const, status: 401, code: 'unauthorized' },
+      { transition: 'navigated' as const, status: 401, code: 'unauthorized' },
+      { transition: 'denied' as const, status: 403, code: 'web_app_access_denied' },
+      { transition: 'navigated' as const, status: 403, code: 'web_app_access_denied' },
+      { transition: 'denied' as const, status: 401, code: null },
+      { transition: 'navigated' as const, status: 401, code: null },
+    ])(
+      'ignores late JSON $status/$code auth recovery after the page is $transition',
+      async ({ transition, status, code }) => {
+        const pending = createPendingResponse()
+        const fetch = vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(pending.promise)
+        const beginRecovery = vi.spyOn(webAppAuth, 'beginWebAppAuthorizationRecovery')
+        const clearPassport = vi.spyOn(webAppAuth, 'clearWebAppPassport')
+        const response = request('/meta', {}, { isPublicAPI: true }).catch(
+          (error: unknown) => error,
+        )
+        await waitFor(() => expect(fetch).toHaveBeenCalledOnce())
+
+        await transitionWhileRequestIsPending(transition)
+        const url = window.location.href
+        const currentDenial = ipAccessStore.get(ipAccessDeniedAtom)
+        pending.resolve(
+          code
+            ? createResponse({ code, message: 'Late authorization error' }, status)
+            : new Response('not JSON', { status }),
+        )
+
+        expect(await response).toBeInstanceOf(Response)
+        expect(window.location.href).toBe(url)
+        expect(ipAccessStore.get(ipAccessDeniedAtom)).toBe(currentDenial)
+        expect(beginRecovery).not.toHaveBeenCalled()
+        expect(clearPassport).not.toHaveBeenCalled()
+        expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+        expect(toast.error).not.toHaveBeenCalled()
+      },
+    )
+
+    it.each(['denied', 'navigated'] as const)(
+      'does not complete auth recovery from a successful response after the page is %s',
+      async (transition) => {
+        const pending = createPendingResponse()
+        const fetch = vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(pending.promise)
+        const completeRecovery = vi.spyOn(webAppAuth, 'completeWebAppAuthorizationRecovery')
+        const response = request('/site', {}, { isPublicAPI: true })
+        await waitFor(() => expect(fetch).toHaveBeenCalledOnce())
+
+        await transitionWhileRequestIsPending(transition)
+        pending.resolve(createResponse({ result: 'ok' }, 200))
+
+        await expect(response).resolves.toEqual({ result: 'ok' })
+        expect(completeRecovery).not.toHaveBeenCalled()
+      },
+    )
+
+    it.each([
+      { transition: 'denied' as const, stream: ssePost, name: 'POST' },
+      { transition: 'navigated' as const, stream: ssePost, name: 'POST' },
+      { transition: 'denied' as const, stream: sseGet, name: 'GET' },
+      { transition: 'navigated' as const, stream: sseGet, name: 'GET' },
+    ])(
+      'settles a late SSE $name authorization failure after the page is $transition',
+      async ({ transition, stream }) => {
+        const pending = createPendingResponse()
+        vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(pending.promise)
+        const beginRecovery = vi.spyOn(webAppAuth, 'beginWebAppAuthorizationRecovery')
+        const onError = vi.fn()
+        const onNotifyError = vi.fn()
+        await stream('/chat-messages', {}, { isPublicAPI: true, onError, onNotifyError })
+
+        await transitionWhileRequestIsPending(transition)
+        const url = window.location.href
+        pending.resolve(createResponse({ code: 'unauthorized', message: 'Late stream error' }, 401))
+
+        await waitFor(() =>
+          expect(onError).toHaveBeenCalledExactlyOnceWith('Late stream error', 'unauthorized'),
+        )
+        expect(window.location.href).toBe(url)
+        expect(beginRecovery).not.toHaveBeenCalled()
+        expect(onNotifyError).not.toHaveBeenCalled()
+        expect(toast.error).not.toHaveBeenCalled()
+      },
+    )
+
+    it.each([
+      { transition: 'denied' as const, status: 401 },
+      { transition: 'navigated' as const, status: 401 },
+      { transition: 'denied' as const, status: 500 },
+      { transition: 'navigated' as const, status: 500 },
+    ])(
+      'silently aborts late XHR $status errors after the page is $transition',
+      async ({ transition, status }) => {
+        const beginRecovery = vi.spyOn(webAppAuth, 'beginWebAppAuthorizationRecovery')
+        const xhr = createXhr({ code: 'unauthorized', message: 'Late upload error' }, status)
+        xhr.send = vi.fn()
+        const response = upload({ xhr, data: new FormData() }, true).catch(
+          (error: unknown) => error,
+        )
+
+        await transitionWhileRequestIsPending(transition)
+        const url = window.location.href
+        xhr.onreadystatechange?.(new Event('readystatechange'))
+
+        expect(await response).toMatchObject({ name: 'AbortError' })
+        expect(window.location.href).toBe(url)
+        expect(beginRecovery).not.toHaveBeenCalled()
+      },
+    )
+  })
+
+  it.each([
+    { status: 403, code: 'web_app_disabled', isPublicAPI: true },
+    { status: 503, code: 'policy_unavailable', isPublicAPI: true },
+    { status: 403, code: 'ip_access_denied', isPublicAPI: false },
+  ])(
+    'preserves ordinary errors for $status/$code with public API $isPublicAPI',
+    async ({ status, code, isPublicAPI }) => {
+      const data = { code, status, message: `Unchanged ${code}` }
+      vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(data, status))
+
+      const error = await request('/site', { method: 'POST' }, { isPublicAPI }).catch(
+        (caught: unknown) => caught,
+      )
+
+      expect(error).toBeInstanceOf(Response)
+      expect(isIpAccessDeniedError(error)).toBe(false)
+      expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
+      await expect((error as Response).json()).resolves.toEqual(data)
+      expect(toast.error).toHaveBeenCalledWith(data.message)
+      expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each([
+    { name: 'POST', stream: ssePost, path: '/chat-messages' },
+    { name: 'GET', stream: sseGet, path: '/workflow/run-id/events' },
+  ])(
+    'settles a denied SSE $name before reading a stream without duplicate notifications',
+    async ({ stream, path }) => {
+      const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(denial))
+      const onData = vi.fn()
+      const onError = vi.fn()
+      const onCompleted = vi.fn()
+      const onNotifyError = vi.fn()
+      const url = window.location.href
+
+      await stream(path, {}, { isPublicAPI: true, onData, onError, onCompleted, onNotifyError })
+
+      await waitFor(() => {
+        expect(onError).toHaveBeenCalledExactlyOnceWith(denial.message, denial.code)
+      })
+      expect(onCompleted).not.toHaveBeenCalled()
+      expect(onData).not.toHaveBeenCalled()
+      expect(onNotifyError).not.toHaveBeenCalled()
+      expect(toast.error).not.toHaveBeenCalled()
+      expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+      expect(fetch).toHaveBeenCalledOnce()
+      expect(window.location.href).toBe(url)
+    },
+  )
+
+  it('settles a denied stream through its completion callback when it has no error callback', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(denial))
+    const onCompleted = vi.fn()
+
+    await ssePost('/chat-messages', {}, { isPublicAPI: true, onCompleted })
+
+    await waitFor(() => expect(onCompleted).toHaveBeenCalledExactlyOnceWith(true, denial.message))
+    expect(toast.error).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    { route: '/chat/ip-restricted-app', path: '/files/upload' },
+    { route: '/form/ip-restricted-form', path: '/human-input-forms/files' },
+  ])(
+    'marks denied XHR uploads on $route for the uploader to suppress duplicate errors',
+    async ({ route, path }) => {
+      window.history.replaceState({}, '', route)
+      const xhr = createXhr(denial)
+
+      await expect(upload({ xhr, data: new FormData() }, true, path)).rejects.toBe(xhr)
+
+      expect(isIpAccessDeniedError(xhr)).toBe(true)
+      expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+      expect(toast.error).not.toHaveBeenCalled()
+    },
+  )
+
+  it('preserves unrelated XHR errors', async () => {
+    const xhr = createXhr({ code: 'file_too_large', message: 'File too large' }, 413)
+
+    await expect(upload({ xhr, data: new FormData() }, true)).rejects.toBe(xhr)
+
+    expect(isIpAccessDeniedError(xhr)).toBe(false)
+  })
+})
diff --git a/web/service/__tests__/share-human-input-upload.spec.ts b/web/service/__tests__/share-human-input-upload.spec.ts
index 4fd7ac47aa1e9d..68c108e150d949 100644
--- a/web/service/__tests__/share-human-input-upload.spec.ts
+++ b/web/service/__tests__/share-human-input-upload.spec.ts
@@ -1,3 +1,5 @@
+import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+
 const mockPostPublic = vi.hoisted(() => vi.fn())
 const mockUpload = vi.hoisted(() => vi.fn())
 
@@ -21,6 +23,10 @@ vi.mock('../webapp-auth', () => ({
 describe('human input form upload services', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockPostPublic.mockReset()
+    mockUpload.mockReset()
+    window.history.replaceState({}, '', '/')
+    captureIpAccessScope()
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-05-06T00:00:00Z'))
   })
@@ -118,4 +124,106 @@ describe('human input form upload services', () => {
     expect(formData.get('url')).toBe('https://example.com/file.txt')
     expect(response).toEqual(expect.objectContaining({ id: 'remote-file-1' }))
   })
+
+  it('should cancel local upload before requesting a token when the form is already denied', async () => {
+    const { uploadHumanInputFormLocalFile } = await import('../share')
+    window.history.replaceState({}, '', '/form/already-denied')
+    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+    const onErrorCallback = vi.fn()
+    const onSuccessCallback = vi.fn()
+
+    await uploadHumanInputFormLocalFile({
+      formToken: 'already-denied',
+      file: new File(['content'], 'test.txt', { type: 'text/plain' }),
+      onProgressCallback: vi.fn(),
+      onSuccessCallback,
+      onErrorCallback,
+    })
+
+    expect(mockPostPublic).not.toHaveBeenCalled()
+    expect(mockUpload).not.toHaveBeenCalled()
+    expect(onSuccessCallback).not.toHaveBeenCalled()
+    expect(onErrorCallback).toHaveBeenCalledWith(expect.objectContaining({ name: 'AbortError' }))
+  })
+
+  it.each(['IP denial', 'navigation'])(
+    'should cancel the pending upload chain after %s without uploading to the new scope',
+    async (interruption) => {
+      const { uploadHumanInputFormRemoteFileInfo } = await import('../share')
+      const formToken = `pending-${interruption}`
+      window.history.replaceState({}, '', `/form/${formToken}`)
+      let finishToken!: (value: { upload_token: string; expires_at: number }) => void
+      mockPostPublic.mockReturnValueOnce(
+        new Promise((resolve) => {
+          finishToken = resolve
+        }),
+      )
+
+      const uploadResult = uploadHumanInputFormRemoteFileInfo(
+        formToken,
+        'https://example.com/file.txt',
+      ).catch((error: unknown) => error)
+      expect(mockPostPublic).toHaveBeenCalledTimes(1)
+
+      if (interruption === 'IP denial')
+        handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+      else window.history.replaceState({}, '', '/form/another-form')
+
+      finishToken({
+        upload_token: 'late-token',
+        expires_at: Math.floor(Date.now() / 1000) + 60,
+      })
+
+      expect(await uploadResult).toMatchObject({ name: 'AbortError' })
+      expect(mockUpload).not.toHaveBeenCalled()
+    },
+  )
+
+  it('should treat a token error received after navigation as upload cancellation', async () => {
+    const { uploadHumanInputFormRemoteFileInfo } = await import('../share')
+    window.history.replaceState({}, '', '/form/failed-token')
+    let rejectToken!: (error: Response) => void
+    mockPostPublic.mockReturnValueOnce(
+      new Promise((_resolve, reject) => {
+        rejectToken = reject
+      }),
+    )
+
+    const uploadResult = uploadHumanInputFormRemoteFileInfo(
+      'failed-token',
+      'https://example.com/file.txt',
+    ).catch((error: unknown) => error)
+    window.history.replaceState({}, '', '/form/another-form')
+    rejectToken(new Response(null, { status: 503 }))
+
+    expect(await uploadResult).toMatchObject({ name: 'AbortError' })
+    expect(mockUpload).not.toHaveBeenCalled()
+  })
+
+  it('should preserve a normal token failure while the form is still active', async () => {
+    const { uploadHumanInputFormRemoteFileInfo } = await import('../share')
+    window.history.replaceState({}, '', '/form/unavailable-token')
+    const tokenError = new Response(null, { status: 503 })
+    mockPostPublic.mockRejectedValueOnce(tokenError)
+
+    await expect(
+      uploadHumanInputFormRemoteFileInfo('unavailable-token', 'https://example.com/file.txt'),
+    ).rejects.toBe(tokenError)
+    expect(mockUpload).not.toHaveBeenCalled()
+  })
+
+  it('should preserve an IP denial returned by the token request', async () => {
+    const { uploadHumanInputFormRemoteFileInfo } = await import('../share')
+    window.history.replaceState({}, '', '/form/token-denied')
+    const tokenError = new Response(null, { status: 403 })
+    mockPostPublic.mockImplementationOnce(async () => {
+      handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), tokenError)
+      throw tokenError
+    })
+
+    await expect(
+      uploadHumanInputFormRemoteFileInfo('token-denied', 'https://example.com/file.txt'),
+    ).rejects.toBe(tokenError)
+    expect(mockUpload).not.toHaveBeenCalled()
+  })
 })
diff --git a/web/service/base.ts b/web/service/base.ts
index 4d0d2f9c9f98d9..c9b65d99bb055a 100644
--- a/web/service/base.ts
+++ b/web/service/base.ts
@@ -1,5 +1,6 @@
 import type { FetchOptionType, ResponseError } from './fetch'
 import type { MessageEnd, MessageReplace, ThoughtItem } from '@/app/components/base/chat/chat/type'
+import type { IpAccessScope } from '@/features/webapp-ip-access/state'
 import type { VisionFile } from '@/types/app'
 import type {
   DataSourceNodeCompletedResponse,
@@ -39,6 +40,12 @@ import {
   PUBLIC_API_PREFIX,
   WEB_APP_SHARE_CODE_HEADER_NAME,
 } from '@/config'
+import {
+  captureIpAccessScope,
+  handleIpAccessDenied,
+  hasIpAccessDenied,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import { asyncRunSafe } from '@/utils'
 import { isClient } from '@/utils/client'
 import { resolveLoginRedirectTarget } from '@/utils/login-redirect'
@@ -55,6 +62,9 @@ import {
 
 const TIME_OUT = 100000
 
+const canRecoverWebAppAuthorization = (scope: IpAccessScope | null) =>
+  isIpAccessScopeCurrent(scope) && !hasIpAccessDenied(scope)
+
 const isWebAppAuthorizationEndpoint = (url: string) =>
   /\/(?:login(?:\/|\?|$)|passport(?:\?|$))/.test(url)
 
@@ -155,12 +165,26 @@ const handlePublicStreamResponseError = async (
   onError: IOnError | undefined,
   onNotifyError: IOnError | undefined,
   silent: boolean | undefined,
+  ipAccessScope: IpAccessScope | null,
+  onCompleted: IOnCompleted | undefined,
 ) => {
   let data: { code?: string; message?: string; reason?: string } | undefined
   try {
     data = (await response.clone().json()) as typeof data
   } catch {}
 
+  if (data && handleIpAccessDenied(response.status, data, ipAccessScope, response)) {
+    const message = data.message || 'IP access denied'
+    if (onError) onError(message, 'ip_access_denied')
+    else onCompleted?.(true, message)
+    return
+  }
+  if (!canRecoverWebAppAuthorization(ipAccessScope)) {
+    const message = data?.message || 'Server Error'
+    if (onError) onError(message, typeof data?.code === 'string' ? data.code : undefined)
+    else onCompleted?.(true, message)
+    return
+  }
   if (data) {
     if (handleWebAppAuthorizationError(data)) return
     if (data.code === 'web_sso_auth_required' || data.code === 'unauthorized') {
@@ -594,6 +618,7 @@ export const upload = async (
   url?: string,
   searchParams?: string,
 ): Promise<UploadResponse> => {
+  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
   const address = resolveWebAppAddress()
   const shareCode = address?.code
   const publicApiPrefix = PUBLIC_API_PREFIX
@@ -628,6 +653,14 @@ export const upload = async (
       if (xhr.readyState === 4) {
         if (xhr.status === 201) resolve(xhr.response)
         else {
+          if (handleIpAccessDenied(xhr.status, xhr.response, ipAccessScope, xhr)) {
+            reject(xhr)
+            return
+          }
+          if (isPublicAPI && !canRecoverWebAppAuthorization(ipAccessScope)) {
+            reject(new DOMException('The upload is no longer active.', 'AbortError'))
+            return
+          }
           if (
             isPublicAPI &&
             (xhr.status === 401 || xhr.status === 403) &&
@@ -689,6 +722,7 @@ export const ssePost = async (
     onUnhandledEvent,
     silent,
   } = otherOptions
+  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
   const abortController = new AbortController()
 
   // No need to get token from localStorage, cookies will be sent automatically
@@ -727,7 +761,14 @@ export const ssePost = async (
       if (!/^[23]\d{2}$/.test(String(res.status))) {
         if (res.status === 401 || (res.status === 403 && isPublicAPI)) {
           if (isPublicAPI) {
-            void handlePublicStreamResponseError(res, onError, onNotifyError, silent)
+            void handlePublicStreamResponseError(
+              res,
+              onError,
+              onNotifyError,
+              silent,
+              ipAccessScope,
+              onCompleted,
+            )
           } else {
             refreshAccessTokenOrReLogin(TIME_OUT)
               .then(() => {
@@ -850,6 +891,7 @@ export const sseGet = async (
     onUnhandledEvent,
     silent,
   } = otherOptions
+  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
   const abortController = new AbortController()
 
   const baseOptions = getBaseOptions()
@@ -882,7 +924,14 @@ export const sseGet = async (
       if (!/^[23]\d{2}$/.test(String(res.status))) {
         if (res.status === 401 || (res.status === 403 && isPublicAPI)) {
           if (isPublicAPI) {
-            void handlePublicStreamResponseError(res, onError, onNotifyError, silent)
+            void handlePublicStreamResponseError(
+              res,
+              onError,
+              onNotifyError,
+              silent,
+              ipAccessScope,
+              onCompleted,
+            )
           } else {
             refreshAccessTokenOrReLogin(TIME_OUT)
               .then(() => {
@@ -1072,10 +1121,16 @@ export const request = async <T>(url: string, options = {}, otherOptions?: IOthe
   try {
     const otherOptionsForBaseFetch = otherOptions || {}
     const { isPublicAPI = false, silent } = otherOptionsForBaseFetch
+    const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
     const [err, resp] = await asyncRunSafe<T>(baseFetch(url, options, otherOptionsForBaseFetch))
     if (err === null) {
       const address = resolveWebAppAddress()
-      if (isPublicAPI && address?.kind === 'environment' && !isWebAppAuthorizationEndpoint(url))
+      if (
+        isPublicAPI &&
+        canRecoverWebAppAuthorization(ipAccessScope) &&
+        address?.kind === 'environment' &&
+        !isWebAppAuthorizationEndpoint(url)
+      )
         completeWebAppAuthorizationRecovery(address)
       return resp
     }
@@ -1083,7 +1138,10 @@ export const request = async <T>(url: string, options = {}, otherOptions?: IOthe
     if (errResp.status === 401 || (errResp.status === 403 && isPublicAPI)) {
       if (!isClient) return Promise.reject(err)
 
-      const [parseErr, errRespData] = await asyncRunSafe<ResponseError>(errResp.json())
+      const [parseErr, errRespData] = await asyncRunSafe<ResponseError>(errResp.clone().json())
+      if (!parseErr && handleIpAccessDenied(errResp.status, errRespData, ipAccessScope, errResp))
+        return Promise.reject(err)
+      if (isPublicAPI && !canRecoverWebAppAuthorization(ipAccessScope)) return Promise.reject(err)
       if (parseErr) {
         if (errResp.status === 401) {
           discardRegistrationStateForConsoleAuthBoundary(otherOptionsForBaseFetch)
diff --git a/web/service/fetch.ts b/web/service/fetch.ts
index c6dc9b0f519ba6..bd24aa56235b7b 100644
--- a/web/service/fetch.ts
+++ b/web/service/fetch.ts
@@ -1,5 +1,6 @@
 import type { AfterResponseHook, BeforeRequestHook, Hooks } from 'ky'
 import type { IOtherOptions } from './base'
+import type { IpAccessScope } from '@/features/webapp-ip-access/state'
 import Cookies from 'js-cookie'
 import ky, { HTTPError } from 'ky'
 import {
@@ -13,6 +14,12 @@ import {
   PUBLIC_API_PREFIX,
   WEB_APP_SHARE_CODE_HEADER_NAME,
 } from '@/config'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessDeniedResponse,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import { shouldSuppressAppDeletionErrorToast } from './app-deletion'
 import { clearRequestErrorToasts, notifyRequestError } from './request-error-toast'
 import { getWebAppPublicApiPath, resolveWebAppAddress } from './webapp-address'
@@ -50,6 +57,7 @@ export type ResponseError = {
   error?: string
   reason?: string
   status: number
+  client_ip?: string
 }
 
 const createResponseFromHTTPError = (error: HTTPError): Response => {
@@ -69,7 +77,10 @@ const createResponseFromHTTPError = (error: HTTPError): Response => {
   })
 }
 
-const afterResponseErrorCode = (otherOptions: IOtherOptions): AfterResponseHook => {
+const afterResponseErrorCode = (
+  otherOptions: IOtherOptions,
+  ipAccessScope: IpAccessScope | null,
+): AfterResponseHook => {
   return async ({ request, response }) => {
     if (!/^[23]\d{2}$/.test(String(response.status))) {
       let errorData: ResponseError | null = null
@@ -81,6 +92,11 @@ const afterResponseErrorCode = (otherOptions: IOtherOptions): AfterResponseHook
         response.status !== 401 &&
         errorData &&
         !otherOptions.silent &&
+        !(
+          ipAccessScope &&
+          (!isIpAccessScopeCurrent(ipAccessScope) || hasIpAccessDenied(ipAccessScope))
+        ) &&
+        !(ipAccessScope && isIpAccessDeniedResponse(response.status, errorData)) &&
         !shouldSuppressAppDeletionErrorToast(request.url, response.status)
 
       const errorMessage = errorData?.message || errorData?.error
@@ -158,6 +174,7 @@ async function base<T>(
     fetchCompat = false,
     request,
   } = otherOptions
+  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
 
   const headers = new Headers(headersFromProps || {})
 
@@ -189,7 +206,10 @@ async function base<T>(
         ...(baseHooks.beforeRequest || []),
         isPublicAPI && beforeRequestPublicWithCode,
       ].filter((h): h is BeforeRequestHook => Boolean(h)),
-      afterResponse: [...(baseHooks.afterResponse || []), afterResponseErrorCode(otherOptions)],
+      afterResponse: [
+        ...(baseHooks.afterResponse || []),
+        afterResponseErrorCode(otherOptions, ipAccessScope),
+      ],
     },
   })
 
diff --git a/web/service/share.ts b/web/service/share.ts
index e398cf4a9fc58e..a4a4e06b7093ff 100644
--- a/web/service/share.ts
+++ b/web/service/share.ts
@@ -5,6 +5,12 @@ import type { ChatConfig } from '@/app/components/base/chat/types'
 import type { AccessMode } from '@/models/access-control'
 import type { AppConversationData, AppData, AppMeta, ConversationItem } from '@/models/share'
 import { WEB_APP_SHARE_CODE_HEADER_NAME } from '@/config'
+import {
+  captureIpAccessScope,
+  hasIpAccessDenied,
+  isIpAccessDeniedError,
+  isIpAccessScopeCurrent,
+} from '@/features/webapp-ip-access/state'
 import {
   del as consoleDel,
   get as consoleGet,
@@ -522,7 +528,21 @@ const uploadHumanInputFormFile = async (
   formData: FormData,
   onProgress?: (e: ProgressEvent) => void,
 ) => {
-  const uploadToken = await getHumanInputFormUploadToken(formToken)
+  const scope = captureIpAccessScope()
+  const ensureCanUpload = () => {
+    if (!isIpAccessScopeCurrent(scope) || hasIpAccessDenied(scope))
+      throw new DOMException('The form upload is no longer active.', 'AbortError')
+  }
+  ensureCanUpload()
+
+  let uploadToken: string
+  try {
+    uploadToken = await getHumanInputFormUploadToken(formToken)
+  } catch (error) {
+    if (!isIpAccessDeniedError(error)) ensureCanUpload()
+    throw error
+  }
+  ensureCanUpload()
 
   return upload(
     {
diff --git a/web/utils/is-abort-error.ts b/web/utils/is-abort-error.ts
new file mode 100644
index 00000000000000..a2fbaa5416b89e
--- /dev/null
+++ b/web/utils/is-abort-error.ts
@@ -0,0 +1,5 @@
+export function isAbortError(error: unknown): boolean {
+  return (
+    typeof error === 'object' && error !== null && 'name' in error && error.name === 'AbortError'
+  )
+}

From 892c6ee1c08010edf6e67aa9f786ef07fb933834 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 10:30:09 +0800
Subject: [PATCH 032/108] fix(web): let editors inspect network policies
 without workspace mutations

---
 .../account-setting/__tests__/index.spec.tsx  |  30 ++-
 .../header/account-setting/index.tsx          |   4 +-
 .../ip-policies-page/__tests__/index.spec.tsx | 219 +++++++++++++++++-
 .../ip-policies-page/index.tsx                |  61 +++--
 .../ip-policies-page/policy-dialog.tsx        | 151 ++++++++----
 .../ip-policies-page/policy-item.tsx          | 101 ++++----
 .../__tests__/permissions.spec.tsx            |  58 +++++
 web/features/network-access/permissions.ts    |  17 ++
 8 files changed, 516 insertions(+), 125 deletions(-)
 create mode 100644 web/features/network-access/__tests__/permissions.spec.tsx
 create mode 100644 web/features/network-access/permissions.ts

diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index fffc93383b6b39..424e9f4e895278 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -571,20 +571,46 @@ describe('AccountSetting', () => {
       ).toBeInTheDocument()
     })
 
-    it('should hide IP Policies for workspace members', () => {
+    it('opens IP Policies read-only for editors', () => {
       mockConsoleState.current = {
         ...baseConsoleState,
+        currentWorkspace: { ...baseConsoleState.currentWorkspace, role: 'editor' },
         isCurrentWorkspaceManager: false,
         isCurrentWorkspaceOwner: false,
       }
 
       renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
 
+      expect(screen.getByRole('button', { name: 'common.settings.ipPolicies' })).toBeInTheDocument()
       expect(
-        screen.queryByRole('button', { name: 'common.settings.ipPolicies' }),
+        screen.getByText('deployments.studio.accessControl.emptyPoliciesTitle'),
+      ).toBeInTheDocument()
+      expect(
+        screen.queryByRole('button', { name: 'common.settings.ipPolicyAddEntry' }),
       ).not.toBeInTheDocument()
     })
 
+    it.each(['normal', 'dataset_operator'])(
+      'hides IP Policies and rejects direct entry for %s',
+      (role) => {
+        mockConsoleState.current = {
+          ...baseConsoleState,
+          currentWorkspace: { ...baseConsoleState.currentWorkspace, role },
+          isCurrentWorkspaceManager: false,
+          isCurrentWorkspaceOwner: false,
+        }
+
+        renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
+
+        expect(
+          screen.queryByRole('button', { name: 'common.settings.ipPolicies' }),
+        ).not.toBeInTheDocument()
+        expect(
+          screen.queryByText('deployments.studio.accessControl.emptyPoliciesTitle'),
+        ).not.toBeInTheDocument()
+      },
+    )
+
     it('should change active tab when clicking on menu item', () => {
       // Arrange
       renderAccountSetting({ onTabChange: mockOnTabChange })
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 083a4a8ee446bc..06f8c063eacc23 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -22,6 +22,7 @@ import {
   isCurrentWorkspaceDatasetOperatorAtom,
   isCurrentWorkspaceManagerAtom,
 } from '@/context/workspace-state'
+import { canReadNetworkAccessAtom } from '@/features/network-access/permissions'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useBreakpoints, { MediaType } from '@/hooks/use-breakpoints'
 import { consoleQuery } from '@/service/console'
@@ -74,8 +75,7 @@ export default function AccountSetting({
     systemFeatures.deployment_edition === 'CLOUD' && !isCurrentWorkspaceDatasetOperator
   const canViewWorkflowLogArchives =
     systemFeatures.deployment_edition === 'CLOUD' && isCurrentWorkspaceManager
-  const canViewIpPolicies =
-    systemFeatures.deployment_edition === 'CLOUD' && isCurrentWorkspaceManager
+  const canViewIpPolicies = useAtomValue(canReadNetworkAccessAtom)
   const activeMenu = (() => {
     if (activeTab === ACCOUNT_SETTING_TAB.IP_POLICIES && !canViewIpPolicies)
       return ACCOUNT_SETTING_TAB.MEMBERS
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index cc20e736d53d99..be4ca58c350fc9 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -1,6 +1,7 @@
-import { screen, waitFor, within } from '@testing-library/react'
+import { act, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
 import {
   createNetworkAccessGroupFixture,
   seedNetworkAccessGroups,
@@ -14,6 +15,7 @@ const translations = vi.hoisted(() => ({
   'operation.delete': 'Delete',
   'operation.edit': 'Edit',
   'operation.moreActionsFor': 'More actions for {{name}}',
+  'operation.save': 'Save',
   'settings.ipPolicies': 'IP Policies',
   'settings.ipPoliciesDescription':
     'Reusable rules that control which IP addresses or ranges can access your apps',
@@ -51,6 +53,211 @@ vi.mock('react-i18next', async () => {
 })
 
 describe('IpPoliciesPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it.each([true, false])(
+    'lets an editor read the complete policy without management actions (entitled: %s)',
+    async (entitled) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, {
+        entitled,
+        groups: [
+          createNetworkAccessGroupFixture({
+            allowed_cidrs: ['203.0.113.42/32', '198.51.100.0/24', '2001:db8::/32'],
+            used_by_count: 1,
+            app_ids: ['app-a'],
+            apps: [
+              {
+                id: 'app-a',
+                name: 'Support Bot',
+                mode: 'chat',
+                icon: null,
+                icon_type: null,
+                icon_background: null,
+              },
+            ],
+          }),
+        ],
+      })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role: 'editor' },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+
+      expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
+      expect(
+        screen.queryByRole('button', { name: 'More actions for Internal Network' }),
+      ).not.toBeInTheDocument()
+      await user.tab()
+      expect(screen.getByRole('button', { name: 'Internal Network' })).toHaveFocus()
+      await user.keyboard('{Enter}')
+
+      const dialog = screen.getByRole('dialog', { name: 'Internal Network' })
+      expect(within(dialog).getByText('203.0.113.42/32')).toBeInTheDocument()
+      expect(within(dialog).getByText('198.51.100.0/24')).toBeInTheDocument()
+      expect(within(dialog).getByText('2001:db8::/32')).toBeInTheDocument()
+      expect(within(dialog).getByRole('link', { name: 'Support Bot' })).toBeInTheDocument()
+      expect(within(dialog).queryByRole('textbox')).not.toBeInTheDocument()
+      expect(
+        within(dialog).queryByRole('button', { name: /Create|Save|Delete|Add/ }),
+      ).not.toBeInTheDocument()
+      await user.keyboard('{Escape}')
+      await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+      expect(globalThis.fetch).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each(['edit', 'delete'] as const)(
+    'allows an entitled administrator to %s a policy',
+    async (action) => {
+      const user = userEvent.setup()
+      const group = createNetworkAccessGroupFixture({ version: 7 })
+      const requests: Array<{ method: string; url: string; body: unknown }> = []
+      vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+        const request = input instanceof Request ? input : new Request(String(input), init)
+        const body = await request.text()
+        requests.push({
+          method: request.method,
+          url: request.url,
+          body: body ? JSON.parse(body) : null,
+        })
+        return request.method === 'DELETE'
+          ? new Response(null, { status: 204 })
+          : new Response(JSON.stringify({ group, entitled: true }), {
+              headers: { 'content-type': 'application/json' },
+            })
+      })
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { groups: [group] })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role: 'admin' },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+
+      await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+      await user.click(
+        screen.getByRole('menuitem', { name: action === 'edit' ? 'Edit' : 'Delete' }),
+      )
+      if (action === 'edit') {
+        await user.clear(screen.getByRole('textbox', { name: 'Name' }))
+        await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Office Network')
+        await user.click(screen.getByRole('button', { name: 'Save' }))
+      } else {
+        await user.click(
+          within(screen.getByRole('alertdialog')).getByRole('button', { name: 'Delete' }),
+        )
+      }
+
+      await waitFor(() =>
+        expect(requests).toContainEqual(
+          action === 'edit'
+            ? {
+                method: 'PUT',
+                url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups/group-1',
+                body: {
+                  name: 'Office Network',
+                  description: '',
+                  allowed_cidrs: group.allowed_cidrs,
+                  expected_version: 7,
+                },
+              }
+            : {
+                method: 'DELETE',
+                url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups/group-1?expected_version=7',
+                body: null,
+              },
+        ),
+      )
+    },
+  )
+
+  it.each(['create', 'edit', 'delete'] as const)(
+    'stops %s when manager permission is revoked',
+    async (action) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { groups: [createNetworkAccessGroupFixture()] })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role: 'admin' },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+
+      if (action === 'create') {
+        await user.click(screen.getByRole('button', { name: 'Add' }))
+        await user.type(screen.getByRole('textbox', { name: 'Name' }), 'New policy')
+        await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+      } else {
+        await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+        await user.click(
+          screen.getByRole('menuitem', { name: action === 'edit' ? 'Edit' : 'Delete' }),
+        )
+        if (action === 'edit')
+          await user.type(screen.getByRole('textbox', { name: 'Name' }), ' draft')
+      }
+
+      await act(async () => {
+        seedCurrentWorkspaceQuery(queryClient, { role: 'editor' })
+      })
+
+      await waitFor(() => {
+        expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
+        expect(
+          screen.queryByRole('button', { name: /^(Create|Save|Delete)$/ }),
+        ).not.toBeInTheDocument()
+        expect(screen.queryByRole('textbox')).not.toBeInTheDocument()
+      })
+      if (action === 'edit') {
+        expect(screen.getByRole('dialog', { name: 'Internal Network' })).toBeInTheDocument()
+        expect(screen.queryByText('Internal Network draft')).not.toBeInTheDocument()
+      } else {
+        expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+        expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+      }
+      expect(globalThis.fetch).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each(['normal', 'dataset_operator'] as const)(
+    'does not query or render policies for %s',
+    (role) => {
+      const queryClient = createConsoleQueryClient()
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+
+      expect(screen.queryByRole('heading', { name: 'IP Policies' })).not.toBeInTheDocument()
+      expect(globalThis.fetch).not.toHaveBeenCalled()
+    },
+  )
+
   it('opens the new policy dialog from Add', async () => {
     const user = userEvent.setup()
     const queryClient = createConsoleQueryClient()
@@ -59,7 +266,7 @@ describe('IpPoliciesPage', () => {
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
-      { queryClient },
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
     expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
@@ -92,7 +299,7 @@ describe('IpPoliciesPage', () => {
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
-      { queryClient },
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
     await user.click(screen.getByRole('button', { name: 'Add' }))
@@ -125,7 +332,7 @@ describe('IpPoliciesPage', () => {
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
-      { queryClient },
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
     expect(screen.getByText('Internal Network')).toBeInTheDocument()
@@ -174,7 +381,7 @@ describe('IpPoliciesPage', () => {
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
-      { queryClient },
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
@@ -221,7 +428,7 @@ describe('IpPoliciesPage', () => {
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
-      { queryClient },
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 939d10cb7735e3..b18d2c9c216747 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -3,6 +3,7 @@
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import { Button } from '@langgenius/dify-ui/button'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -12,6 +13,10 @@ import {
   pricingQueryParamName,
   pricingQueryParser,
 } from '@/app/components/billing/pricing/query-params'
+import {
+  canManageNetworkAccessPoliciesAtom,
+  canReadNetworkAccessAtom,
+} from '@/features/network-access/permissions'
 import { consoleQuery } from '@/service/console'
 import { IpPolicyDialog } from './policy-dialog'
 import {
@@ -24,7 +29,10 @@ import {
   policyUpdatedColClassName,
 } from './policy-item'
 
-type DialogState = { mode: 'create' } | { mode: 'edit'; group: NetworkAccessGroupResponse } | null
+type DialogState =
+  | { mode: 'create' }
+  | { mode: 'edit' | 'view'; group: NetworkAccessGroupResponse }
+  | null
 
 function IpPoliciesListSkeleton() {
   const { t } = useTranslation()
@@ -51,8 +59,11 @@ function IpPoliciesListSkeleton() {
 export default function IpPoliciesPage() {
   const { t } = useTranslation()
   const queryClient = useQueryClient()
+  const canReadPolicies = useAtomValue(canReadNetworkAccessAtom)
+  const canManagePolicies = useAtomValue(canManageNetworkAccessPoliciesAtom)
   const [_pricing, setPricing] = useQueryState(pricingQueryParamName, pricingQueryParser)
   const groupsQuery = consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions({
+    enabled: canReadPolicies,
     retry: false,
   })
   const { data, isPending, isError } = useQuery(groupsQuery)
@@ -65,7 +76,8 @@ export default function IpPoliciesPage() {
   const [dialogState, setDialogState] = useState<DialogState>(null)
   const groups = data?.groups ?? []
   const entitled = data?.entitled === true
-  const editingGroup = dialogState?.mode === 'edit' ? dialogState.group : null
+  const canMutate = canManagePolicies && entitled
+  const selectedGroup = dialogState && dialogState.mode !== 'create' ? dialogState.group : null
   const isSaving = createGroup.isPending || updateGroup.isPending
 
   const refreshGroupsAfterConflict = async (groupId?: string) => {
@@ -76,7 +88,7 @@ export default function IpPoliciesPage() {
   }
 
   const handleOpenCreate = () => {
-    if (isError) return
+    if (!canManagePolicies || isPending || isError) return
     if (!entitled) {
       void setPricing('open')
       return
@@ -84,6 +96,8 @@ export default function IpPoliciesPage() {
     setDialogState({ mode: 'create' })
   }
 
+  if (!canReadPolicies) return null
+
   return (
     <div className="flex flex-col gap-4">
       <div className="flex items-start justify-between gap-4">
@@ -95,10 +109,12 @@ export default function IpPoliciesPage() {
             {t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })}
           </p>
         </div>
-        <Button variant="primary" size="small" onClick={handleOpenCreate}>
-          <span aria-hidden className="i-ri-add-line size-4" />
-          {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
-        </Button>
+        {canManagePolicies && (
+          <Button variant="primary" size="small" onClick={handleOpenCreate}>
+            <span aria-hidden className="i-ri-add-line size-4" />
+            {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
+          </Button>
+        )}
       </div>
 
       {isPending && <IpPoliciesListSkeleton />}
@@ -139,42 +155,47 @@ export default function IpPoliciesPage() {
             <PolicyItem
               key={group.id}
               group={group}
-              canMutate={entitled}
-              onEdit={(nextGroup) => setDialogState({ mode: 'edit', group: nextGroup })}
+              canMutate={canMutate}
+              onView={(group) => setDialogState({ mode: 'view', group })}
+              onEdit={(group) => {
+                if (!canMutate) return
+                setDialogState({ mode: 'edit', group })
+              }}
             />
           ))}
         </div>
       )}
 
-      {dialogState && (
+      {dialogState && (dialogState.mode !== 'create' || canMutate) && (
         <IpPolicyDialog
-          mode={dialogState.mode}
+          mode={canMutate ? dialogState.mode : 'view'}
           open
-          initialName={editingGroup?.name}
-          initialEntries={editingGroup?.allowed_cidrs}
-          usedByCount={editingGroup?.used_by_count}
-          referencedApps={editingGroup?.apps}
+          initialName={selectedGroup?.name}
+          initialEntries={selectedGroup?.allowed_cidrs}
+          usedByCount={selectedGroup?.used_by_count}
+          referencedApps={selectedGroup?.apps}
           isPending={isSaving}
           onOpenChange={(open) => {
             if (!open) setDialogState(null)
           }}
           onSubmit={(payload) => {
-            if (editingGroup) {
+            if (!canMutate || isSaving || dialogState.mode === 'view') return
+            if (selectedGroup) {
               updateGroup.mutate(
                 {
-                  params: { group_id: editingGroup.id },
+                  params: { group_id: selectedGroup.id },
                   body: {
                     name: payload.name,
-                    description: editingGroup.description ?? '',
+                    description: selectedGroup.description ?? '',
                     allowed_cidrs: payload.allowed_cidrs,
-                    expected_version: editingGroup.version,
+                    expected_version: selectedGroup.version,
                   },
                 },
                 {
                   onSuccess: () => setDialogState(null),
                   onError: (error) => {
                     if (getNetworkAccessErrorStatus(error) !== 409) return
-                    void refreshGroupsAfterConflict(editingGroup.id)
+                    void refreshGroupsAfterConflict(selectedGroup.id)
                   },
                 },
               )
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 1db4de9ad53d2c..886234f4412ca1 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -30,7 +30,7 @@ type IpPolicyDialogSubmit = {
 
 type IpPolicyDialogProps = {
   open: boolean
-  mode: 'create' | 'edit'
+  mode: 'create' | 'edit' | 'view'
   currentIp?: string
   initialName?: string
   initialEntries?: readonly string[]
@@ -73,12 +73,16 @@ export function IpPolicyDialog({
         <div className="flex shrink-0 items-start gap-4">
           <div className="flex min-w-0 flex-1 flex-col gap-1">
             <DialogTitle className="title-2xl-semi-bold text-text-primary">
-              {mode === 'edit'
-                ? t(($) => $['settings.ipPolicyEditTitle'], { ns: 'common' })
-                : t(($) => $['settings.ipPolicyNewTitle'], { ns: 'common' })}
+              {mode === 'view'
+                ? initialName
+                : mode === 'edit'
+                  ? t(($) => $['settings.ipPolicyEditTitle'], { ns: 'common' })
+                  : t(($) => $['settings.ipPolicyNewTitle'], { ns: 'common' })}
             </DialogTitle>
             <DialogDescription className="system-sm-regular text-text-tertiary">
-              {t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
+              {mode === 'view'
+                ? t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })
+                : t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
             </DialogDescription>
           </div>
           <DialogClose
@@ -94,54 +98,101 @@ export function IpPolicyDialog({
           />
         </div>
 
-        <form
-          className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto"
-          onSubmit={(event) => {
-            event.preventDefault()
-            if (!canSubmit) return
-            onSubmit?.({
-              name: name.trim(),
-              allowed_cidrs: collectAllowedCidrs(entryValues),
-            })
-          }}
-        >
-          <Field className="flex shrink-0 flex-col gap-3">
-            <FieldLabel>{t(($) => $['settings.ipPolicyName'], { ns: 'common' })}</FieldLabel>
-            <Input
-              value={name}
-              maxLength={IP_POLICY_NAME_MAX_LENGTH}
-              placeholder={t(($) => $['settings.ipPolicyNamePlaceholder'], { ns: 'common' })}
-              onChange={(event) => setName(event.currentTarget.value)}
-            />
-          </Field>
-
-          <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
-
-          {mode === 'edit' && usedByCount > 0 && (
+        {mode === 'view' ? (
+          <div className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto">
+            <dl className="flex flex-col gap-6">
+              <div className="flex flex-col gap-3">
+                <dt className="system-sm-medium text-text-primary">
+                  {t(($) => $['settings.ipPolicyName'], { ns: 'common' })}
+                </dt>
+                <dd className="system-sm-regular wrap-anywhere text-text-secondary">
+                  {initialName}
+                </dd>
+              </div>
+              <div className="flex flex-col gap-3">
+                <dt className="system-sm-medium text-text-primary">
+                  {t(($) => $['settings.ipPolicyAllowlist'], { ns: 'common' })}
+                </dt>
+                <dd>
+                  <ul className="flex flex-col gap-2">
+                    {initialEntries?.map((entry) => (
+                      <li
+                        key={entry}
+                        className="system-sm-regular wrap-anywhere text-text-secondary"
+                      >
+                        <code>{entry}</code>
+                      </li>
+                    ))}
+                  </ul>
+                </dd>
+              </div>
+              {usedByCount > 0 && (
+                <div className="flex flex-col gap-3">
+                  <dt className="system-sm-medium text-text-primary">
+                    {t(($) => $['settings.ipPolicyUsedByLabel'], { ns: 'common' })}
+                  </dt>
+                  <dd>
+                    <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
+                  </dd>
+                </div>
+              )}
+            </dl>
+            <div className="flex shrink-0 justify-end pt-2">
+              <Button variant="secondary" onClick={() => onOpenChange(false)}>
+                {t(($) => $['operation.close'], { ns: 'common' })}
+              </Button>
+            </div>
+          </div>
+        ) : (
+          <form
+            className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto"
+            onSubmit={(event) => {
+              event.preventDefault()
+              if (!canSubmit || isPending) return
+              onSubmit?.({
+                name: name.trim(),
+                allowed_cidrs: collectAllowedCidrs(entryValues),
+              })
+            }}
+          >
             <Field className="flex shrink-0 flex-col gap-3">
-              <FieldLabel>
-                {t(($) => $['settings.ipPolicyUsedByLabel'], { ns: 'common' })}
-              </FieldLabel>
-              <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
+              <FieldLabel>{t(($) => $['settings.ipPolicyName'], { ns: 'common' })}</FieldLabel>
+              <Input
+                value={name}
+                maxLength={IP_POLICY_NAME_MAX_LENGTH}
+                placeholder={t(($) => $['settings.ipPolicyNamePlaceholder'], { ns: 'common' })}
+                onChange={(event) => setName(event.currentTarget.value)}
+              />
             </Field>
-          )}
 
-          <div className="flex shrink-0 items-center justify-end gap-2 pt-2">
-            <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
-              {t(($) => $['operation.cancel'], { ns: 'common' })}
-            </Button>
-            <Button
-              type="submit"
-              variant="primary"
-              disabled={!canSubmit || isPending}
-              loading={isPending}
-            >
-              {mode === 'edit'
-                ? t(($) => $['operation.save'], { ns: 'common' })
-                : t(($) => $['settings.ipPolicyCreate'], { ns: 'common' })}
-            </Button>
-          </div>
-        </form>
+            <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
+
+            {mode === 'edit' && usedByCount > 0 && (
+              <Field className="flex shrink-0 flex-col gap-3">
+                <FieldLabel>
+                  {t(($) => $['settings.ipPolicyUsedByLabel'], { ns: 'common' })}
+                </FieldLabel>
+                <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
+              </Field>
+            )}
+
+            <div className="flex shrink-0 items-center justify-end gap-2 pt-2">
+              <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
+                {t(($) => $['operation.cancel'], { ns: 'common' })}
+              </Button>
+              <Button
+                type="submit"
+                variant="primary"
+                disabled={!canSubmit || isPending}
+                loading={isPending}
+              >
+                {mode === 'edit'
+                  ? t(($) => $['operation.save'], { ns: 'common' })
+                  : t(($) => $['settings.ipPolicyCreate'], { ns: 'common' })}
+              </Button>
+            </div>
+          </form>
+        )}
       </DialogContent>
     </Dialog>
   )
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index a87da162e545c7..faaea41b499410 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -10,6 +10,7 @@ import {
   AlertDialogDescription,
   AlertDialogTitle,
 } from '@langgenius/dify-ui/alert-dialog'
+import { Button } from '@langgenius/dify-ui/button'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -35,10 +36,11 @@ export const policyActionsColClassName = 'flex w-8 shrink-0 items-center justify
 type PolicyItemProps = {
   group: NetworkAccessGroupResponse
   canMutate: boolean
+  onView: (group: NetworkAccessGroupResponse) => void
   onEdit: (group: NetworkAccessGroupResponse) => void
 }
 
-export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
+export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps) {
   const { t } = useTranslation()
   const { formatTimeFromNow } = useFormatTimeFromNow()
   const [menuOpen, setMenuOpen] = useState(false)
@@ -75,9 +77,16 @@ export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
 
   return (
     <div className={`${policyRowClassName} border-b border-divider-subtle py-3`}>
-      <p className={`${policyNameColClassName} system-sm-medium text-text-secondary`}>
-        {group.name}
-      </p>
+      <div className={policyNameColClassName}>
+        <Button
+          variant="ghost"
+          size="small"
+          className="h-auto max-w-full justify-start p-0 text-text-secondary"
+          onClick={() => onView(group)}
+        >
+          <span className="truncate">{group.name}</span>
+        </Button>
+      </div>
       <p className={`${policyIpEntriesColClassName} system-sm-regular text-text-tertiary`}>
         {group.allowed_cidrs.length}
       </p>
@@ -88,49 +97,51 @@ export function PolicyItem({ group, canMutate, onEdit }: PolicyItemProps) {
         {formatTimeFromNow(Date.parse(group.updated_at))}
       </p>
       <div className={policyActionsColClassName}>
-        <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>
-          <DropdownMenuTrigger
-            render={
-              <IconButton
-                size="md"
-                aria-label={t(($) => $['operation.moreActionsFor'], {
-                  ns: 'common',
-                  name: group.name,
-                })}
-                className="data-popup-open:bg-state-base-hover"
+        {canMutate && (
+          <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>
+            <DropdownMenuTrigger
+              render={
+                <IconButton
+                  size="md"
+                  aria-label={t(($) => $['operation.moreActionsFor'], {
+                    ns: 'common',
+                    name: group.name,
+                  })}
+                  className="data-popup-open:bg-state-base-hover"
+                >
+                  <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
+                </IconButton>
+              }
+            />
+            <DropdownMenuContent placement="bottom-end" sideOffset={4} className="min-w-35">
+              <DropdownMenuItem
+                disabled={!canMutate}
+                className="system-sm-semibold text-text-secondary"
+                onClick={() => {
+                  if (!canMutate) return
+                  onEdit(group)
+                }}
               >
-                <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
-              </IconButton>
-            }
-          />
-          <DropdownMenuContent placement="bottom-end" sideOffset={4} className="min-w-35">
-            <DropdownMenuItem
-              disabled={!canMutate}
-              className="system-sm-semibold text-text-secondary"
-              onClick={() => {
-                if (!canMutate) return
-                onEdit(group)
-              }}
-            >
-              {t(($) => $['operation.edit'], { ns: 'common' })}
-            </DropdownMenuItem>
-            <DropdownMenuSeparator />
-            <DropdownMenuItem
-              disabled={!canMutate}
-              variant="destructive"
-              className="system-sm-semibold"
-              onClick={() => {
-                if (!canMutate) return
-                setConfirmDelete(true)
-                setMenuOpen(false)
-              }}
-            >
-              {t(($) => $['operation.delete'], { ns: 'common' })}
-            </DropdownMenuItem>
-          </DropdownMenuContent>
-        </DropdownMenu>
+                {t(($) => $['operation.edit'], { ns: 'common' })}
+              </DropdownMenuItem>
+              <DropdownMenuSeparator />
+              <DropdownMenuItem
+                disabled={!canMutate}
+                variant="destructive"
+                className="system-sm-semibold"
+                onClick={() => {
+                  if (!canMutate) return
+                  setConfirmDelete(true)
+                  setMenuOpen(false)
+                }}
+              >
+                {t(($) => $['operation.delete'], { ns: 'common' })}
+              </DropdownMenuItem>
+            </DropdownMenuContent>
+          </DropdownMenu>
+        )}
       </div>
-      <AlertDialog open={confirmDelete} onOpenChange={setConfirmDelete}>
+      <AlertDialog open={confirmDelete && canMutate} onOpenChange={setConfirmDelete}>
         <AlertDialogContent backdropProps={{ forceRender: true }} className="w-100">
           <div className="flex flex-col gap-2 p-6 pb-4">
             <AlertDialogTitle className="title-xl-semi-bold text-text-primary">
diff --git a/web/features/network-access/__tests__/permissions.spec.tsx b/web/features/network-access/__tests__/permissions.spec.tsx
new file mode 100644
index 00000000000000..642ea0efb99fc2
--- /dev/null
+++ b/web/features/network-access/__tests__/permissions.spec.tsx
@@ -0,0 +1,58 @@
+import { act, waitFor } from '@testing-library/react'
+import { useAtomValue } from 'jotai'
+import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
+import { renderHookWithConsoleQuery } from '@/test/console/query-data'
+import { canManageNetworkAccessPoliciesAtom, canReadNetworkAccessAtom } from '../permissions'
+
+function useNetworkAccessPermissions() {
+  return {
+    canRead: useAtomValue(canReadNetworkAccessAtom),
+    canManage: useAtomValue(canManageNetworkAccessPoliciesAtom),
+  }
+}
+
+describe('network access permissions', () => {
+  it.each([
+    { role: 'owner', canRead: true, canManage: true },
+    { role: 'admin', canRead: true, canManage: true },
+    { role: 'editor', canRead: true, canManage: false },
+    { role: 'normal', canRead: false, canManage: false },
+    { role: 'dataset_operator', canRead: false, canManage: false },
+  ] as const)('allows the supported operations for $role', ({ role, canRead, canManage }) => {
+    const { result } = renderHookWithConsoleQuery(useNetworkAccessPermissions, {
+      currentWorkspace: { role },
+      systemFeatures: { deployment_edition: 'CLOUD' },
+    })
+    expect(result.current).toEqual({ canRead, canManage })
+  })
+
+  it.each(['COMMUNITY', 'ENTERPRISE'] as const)(
+    'does not grant access in %s',
+    (deployment_edition) => {
+      const { result } = renderHookWithConsoleQuery(useNetworkAccessPermissions, {
+        currentWorkspace: { role: 'owner' },
+        systemFeatures: { deployment_edition },
+      })
+      expect(result.current).toEqual({ canRead: false, canManage: false })
+    },
+  )
+
+  it('waits for the authoritative workspace and responds to role changes', async () => {
+    vi.mocked(globalThis.fetch).mockImplementation(() => new Promise(() => {}))
+    const { result, queryClient } = renderHookWithConsoleQuery(useNetworkAccessPermissions, {
+      currentWorkspace: null,
+      systemFeatures: { deployment_edition: 'CLOUD' },
+    })
+    expect(result.current).toEqual({ canRead: false, canManage: false })
+
+    await act(async () => {
+      seedCurrentWorkspaceQuery(queryClient, { role: 'admin' })
+    })
+    await waitFor(() => expect(result.current).toEqual({ canRead: true, canManage: true }))
+
+    await act(async () => {
+      seedCurrentWorkspaceQuery(queryClient, { role: 'editor' })
+    })
+    await waitFor(() => expect(result.current).toEqual({ canRead: true, canManage: false }))
+  })
+})
diff --git a/web/features/network-access/permissions.ts b/web/features/network-access/permissions.ts
new file mode 100644
index 00000000000000..c8fc9e79c62055
--- /dev/null
+++ b/web/features/network-access/permissions.ts
@@ -0,0 +1,17 @@
+'use client'
+
+import { atom } from 'jotai'
+import { currentWorkspaceAtom, currentWorkspaceLoadingAtom } from '@/context/workspace-state'
+import { deploymentEditionAtom } from '@/features/system-features/state'
+
+export const canReadNetworkAccessAtom = atom((get) => {
+  if (get(currentWorkspaceLoadingAtom) || get(deploymentEditionAtom) !== 'CLOUD') return false
+  const { id, role } = get(currentWorkspaceAtom)
+  return Boolean(id) && (role === 'owner' || role === 'admin' || role === 'editor')
+})
+
+export const canManageNetworkAccessPoliciesAtom = atom((get) => {
+  if (!get(canReadNetworkAccessAtom)) return false
+  const { role } = get(currentWorkspaceAtom)
+  return role === 'owner' || role === 'admin'
+})

From e4d98dddd975bc02b3b8e5d542eee5c5050f7cac Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 10:30:32 +0800
Subject: [PATCH 033/108] fix(web): align IP access controls with app
 capabilities and Agent access

---
 .../__tests__/chip-status.spec.ts             |  23 +-
 .../__tests__/config-panel.spec.tsx           |   8 +-
 .../access-control/__tests__/draft.spec.ts    |  69 ++-
 .../access-control/__tests__/index.spec.tsx   | 500 ++++++++++++++++--
 .../__tests__/network-access.spec.ts          |  62 ++-
 .../access-control/chip-status.ts             |  19 +-
 .../access-control/config-panel.tsx           |  37 +-
 .../access-control/downgrade-panel.tsx        |  17 +-
 .../app/access-point/access-control/draft.ts  |  38 +-
 .../app/access-point/access-control/index.tsx | 100 ++--
 .../access-control/network-access.ts          |  26 +-
 .../access-control/policy-field.tsx           |  23 +-
 .../access-control/scope-list.tsx             |  24 +-
 .../access-control/status-panel.tsx           |  34 +-
 web/app/components/app/access-point/index.tsx |  12 +-
 .../access/__tests__/page.spec.tsx            | 192 +++++++
 .../agent-v2/agent-detail/access/page.tsx     |  19 +-
 17 files changed, 1010 insertions(+), 193 deletions(-)
 create mode 100644 web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx

diff --git a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
index d9d35ac7d01e75..c2353c2216ac98 100644
--- a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
@@ -1,3 +1,4 @@
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { getAccessControlChipState, getInServiceCoverage } from '../chip-status'
 
 const assignment = {
@@ -15,7 +16,10 @@ const assignment = {
 describe('getInServiceCoverage', () => {
   it('counts selected access points against every configured access point', () => {
     expect(
-      getInServiceCoverage({ webApp: true, serviceApi: true, mcp: false, trigger: true }),
+      getInServiceCoverage(
+        { webApp: true, serviceApi: true, mcp: false, trigger: true },
+        ACCESS_POINT_ORDER,
+      ),
     ).toEqual({ coveredCount: 3, inServiceCount: 4 })
   })
 })
@@ -24,6 +28,7 @@ describe('getAccessControlChipState', () => {
   it('returns pro when the workspace is not entitled and has no assignment', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: false,
         assignment: null,
       }).kind,
@@ -33,6 +38,7 @@ describe('getAccessControlChipState', () => {
   it('keeps the saved assignment visible when the workspace is not entitled', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: false,
         assignment,
       }).kind,
@@ -42,6 +48,7 @@ describe('getAccessControlChipState', () => {
   it('returns off when the app has never been configured', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: true,
         assignment: null,
       }),
@@ -51,6 +58,7 @@ describe('getAccessControlChipState', () => {
   it('returns paused when a saved policy is not enforcing', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: true,
         assignment: { ...assignment, enabled: false },
       }),
@@ -65,6 +73,7 @@ describe('getAccessControlChipState', () => {
   it('returns on when every access point is covered', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: true,
         assignment,
       }),
@@ -79,6 +88,7 @@ describe('getAccessControlChipState', () => {
   it('returns partial when some access points are excluded', () => {
     expect(
       getAccessControlChipState({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: true,
         assignment: {
           ...assignment,
@@ -93,3 +103,14 @@ describe('getAccessControlChipState', () => {
     })
   })
 })
+
+describe('app capability coverage', () => {
+  it.each([
+    { available: ['webApp', 'serviceApi', 'mcp'] as const, count: 3 },
+    { available: ['webApp', 'serviceApi'] as const, count: 2 },
+  ])('counts full coverage as $count of $count', ({ available, count }) => {
+    expect(
+      getAccessControlChipState({ assignment, entitled: true, availableAccessPoints: available }),
+    ).toMatchObject({ kind: 'on', coveredCount: count, inServiceCount: count })
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index 30195b987e4ad7..b6782ac2a97955 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -3,6 +3,7 @@ import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/pop
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useState } from 'react'
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import { render } from '@/test/console/render'
 import { AccessControlConfigPanel } from '../config-panel'
 import { createDefaultAccessControlDraft } from '../draft'
@@ -50,7 +51,7 @@ vi.mock('react-i18next', async () => {
 
 function PanelHarness({
   currentIp,
-  initialDraft = createDefaultAccessControlDraft(),
+  initialDraft = createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
   onSave = vi.fn(),
 }: {
   currentIp?: string
@@ -68,6 +69,9 @@ function PanelHarness({
       <PopoverContent>
         <AccessControlConfigPanel
           draft={draft}
+          availableAccessPoints={ACCESS_POINT_ORDER}
+          appIcon={{}}
+          canManagePolicies
           policies={policies}
           currentIp={currentIp}
           onCancel={onCancel}
@@ -156,7 +160,7 @@ describe('AccessControlConfigPanel', () => {
     render(
       <PanelHarness
         initialDraft={{
-          ...createDefaultAccessControlDraft(),
+          ...createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
           selectedPolicyId: 'internal-network',
           enabled: true,
         }}
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
index 3510c0d5e9f7b9..62628686c96404 100644
--- a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -1,22 +1,33 @@
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import {
   policyIncludesIp,
   splitPolicySummary,
 } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
-import { canSaveAccessControl, createDefaultAccessControlDraft } from '../draft'
+import {
+  canSaveAccessControl,
+  createDefaultAccessControlDraft,
+  isAccessControlDraftEqual,
+} from '../draft'
 
 const selectedDraft = {
-  ...createDefaultAccessControlDraft(),
+  ...createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
   selectedPolicyId: 'policy-1',
 }
 
 describe('canSaveAccessControl', () => {
   it('disables save when no policy is selected', () => {
-    expect(canSaveAccessControl({ draft: createDefaultAccessControlDraft() })).toBe(false)
+    expect(
+      canSaveAccessControl({
+        availableAccessPoints: ACCESS_POINT_ORDER,
+        draft: createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
+      }),
+    ).toBe(false)
   })
 
   it('disables save when every access point is off', () => {
     expect(
       canSaveAccessControl({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         draft: {
           selectedPolicyId: 'policy-1',
           enabled: true,
@@ -32,12 +43,15 @@ describe('canSaveAccessControl', () => {
   })
 
   it('enables save when a policy is selected and at least one access point is on', () => {
-    expect(canSaveAccessControl({ draft: selectedDraft })).toBe(true)
+    expect(
+      canSaveAccessControl({ availableAccessPoints: ACCESS_POINT_ORDER, draft: selectedDraft }),
+    ).toBe(true)
   })
 
   it('counts trigger as a selectable access point', () => {
     expect(
       canSaveAccessControl({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         draft: {
           selectedPolicyId: 'policy-1',
           enabled: true,
@@ -58,14 +72,9 @@ describe('canSaveAccessControl', () => {
         draft: {
           selectedPolicyId: 'policy-1',
           enabled: true,
-          scopes: {
-            webApp: false,
-            serviceApi: false,
-            mcp: false,
-            trigger: true,
-          },
+          scopes: { webApp: false, serviceApi: false, mcp: false, trigger: true },
         },
-        persistableAccessPoints: [],
+        availableAccessPoints: [],
       }),
     ).toBe(false)
   })
@@ -73,6 +82,7 @@ describe('canSaveAccessControl', () => {
   it('disables save when the draft matches the saved baseline', () => {
     expect(
       canSaveAccessControl({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         draft: selectedDraft,
         baseline: selectedDraft,
       }),
@@ -82,6 +92,7 @@ describe('canSaveAccessControl', () => {
   it('allows saving a pause when a policy is already selected', () => {
     expect(
       canSaveAccessControl({
+        availableAccessPoints: ACCESS_POINT_ORDER,
         draft: { ...selectedDraft, enabled: false },
         baseline: selectedDraft,
       }),
@@ -121,3 +132,39 @@ describe('policyIncludesIp', () => {
     expect(policyIncludesIp(['198.51.100.0/24'], '203.0.113.42')).toBe(false)
   })
 })
+
+describe('available access points', () => {
+  it.each([
+    { available: ['webApp', 'serviceApi', 'mcp', 'trigger'] as const, selected: 4 },
+    { available: ['webApp', 'serviceApi', 'mcp'] as const, selected: 3 },
+    { available: ['webApp', 'serviceApi'] as const, selected: 2 },
+  ])('defaults to $selected supported scopes', ({ available, selected }) => {
+    const draft = createDefaultAccessControlDraft(available)
+    expect(Object.values(draft.scopes).filter(Boolean)).toHaveLength(selected)
+    available.forEach((scope) => expect(draft.scopes[scope]).toBe(true))
+  })
+
+  it('ignores unsupported scope differences when checking for edits', () => {
+    const baseline = createDefaultAccessControlDraft(['webApp', 'serviceApi'])
+    expect(
+      isAccessControlDraftEqual(
+        baseline,
+        {
+          ...baseline,
+          scopes: { ...baseline.scopes, mcp: true, trigger: true },
+        },
+        ['webApp', 'serviceApi'],
+      ),
+    ).toBe(true)
+  })
+
+  it('does not count an unsupported trigger selection toward a valid binding', () => {
+    const draft = {
+      ...selectedDraft,
+      scopes: { webApp: false, serviceApi: false, mcp: false, trigger: true },
+    }
+    expect(
+      canSaveAccessControl({ draft, availableAccessPoints: ['webApp', 'serviceApi', 'mcp'] }),
+    ).toBe(false)
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 8b1436c1d8d240..433b3dc6185c62 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -1,8 +1,15 @@
-import type { AppNetworkAccessGroupBindingResponse } from '@dify/contracts/api/console/apps/types.gen'
+import type {
+  AppNetworkAccessGroupBindingResponse,
+  AppNetworkAccessGroupResponse,
+} from '@dify/contracts/api/console/apps/types.gen'
 import type { CloudPlan } from '@dify/contracts/api/console/features/types.gen'
-import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
+import type {
+  GetWorkspacesCurrentSummaryResponse,
+  NetworkAccessGroupResponse,
+} from '@dify/contracts/api/console/workspaces/types.gen'
 import { screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { consoleQuery } from '@/service/console'
 import {
   createNetworkAccessGroupFixture,
   seedAppNetworkAccessGroup,
@@ -74,16 +81,6 @@ const accessControlTranslations = vi.hoisted(() => ({
   'studio.accessControl.turnOffConfirm': 'Turn off',
 }))
 
-vi.mock('@/app/components/app/store', () => ({
-  useStore: (selector: (state: { appDetail: { id: string; mode: string } }) => unknown) =>
-    selector({
-      appDetail: {
-        id: 'app-1',
-        mode: 'chat',
-      },
-    }),
-}))
-
 vi.mock('nuqs', async (importOriginal) => {
   const actual = await importOriginal<typeof import('nuqs')>()
   return {
@@ -105,28 +102,42 @@ const renderEntry = ({
   deploymentEdition = 'CLOUD',
   groups = [],
   binding = null,
+  availableAccessPoints = ['webapp', 'service_api', 'mcp'],
+  role = 'owner',
+  canEditBinding = true,
 }: {
   plan?: CloudPlan
   deploymentEdition?: 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
   groups?: NetworkAccessGroupResponse[]
   binding?: AppNetworkAccessGroupBindingResponse | null
+  availableAccessPoints?: AppNetworkAccessGroupResponse['available_access_points']
+  role?: GetWorkspacesCurrentSummaryResponse['role']
+  canEditBinding?: boolean
 } = {}) => {
   const queryClient = createConsoleQueryClient()
   const entitled = plan === 'professional' || plan === 'team'
   seedNetworkAccessGroups(queryClient, { entitled, groups })
-  seedAppNetworkAccessGroup(queryClient, 'app-1', { entitled, binding })
-
-  return renderWithConsoleQuery(<AccessControlEntry />, {
-    queryClient,
-    systemFeatures: { deployment_edition: deploymentEdition },
-    features: plan
-      ? {
-          billing: {
-            subscription: { interval: 'month', plan },
-          },
-        }
-      : undefined,
+  seedAppNetworkAccessGroup(queryClient, 'app-1', {
+    entitled,
+    binding,
+    available_access_points: availableAccessPoints,
   })
+
+  return renderWithConsoleQuery(
+    <AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={canEditBinding} />,
+    {
+      queryClient,
+      currentWorkspace: { role },
+      systemFeatures: { deployment_edition: deploymentEdition },
+      features: plan
+        ? {
+            billing: {
+              subscription: { interval: 'month', plan },
+            },
+          }
+        : undefined,
+    },
+  )
 }
 
 const getChip = () => screen.getByRole('button', { name: /Access Control/ })
@@ -166,13 +177,13 @@ describe('AccessControlEntry', () => {
       },
     })
 
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
     expect(screen.getByText('Access control needs the Pro plan.')).toBeInTheDocument()
     expect(screen.getByText('Ready to resume')).toBeInTheDocument()
     expect(screen.getByText('Internal Network')).toBeInTheDocument()
-    expect(screen.getByText('Protects 3 of 4 access points')).toBeInTheDocument()
+    expect(screen.getByText('Protects 3 of 3 access points')).toBeInTheDocument()
     expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
     expect(screen.queryByRole('switch', { name: 'Restrict by IP address' })).not.toBeInTheDocument()
@@ -264,10 +275,7 @@ describe('AccessControlEntry', () => {
       'aria-disabled',
       'true',
     )
-    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
+    expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
     expect(screen.queryByText('Not enabled')).not.toBeInTheDocument()
   })
 
@@ -386,7 +394,7 @@ describe('AccessControlEntry', () => {
       },
     })
 
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
     expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
@@ -415,7 +423,7 @@ describe('AccessControlEntry', () => {
     await user.click(screen.getByRole('button', { name: 'Turn off' }))
 
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
   })
 
   it('discards an unsaved first-time draft on Cancel', async () => {
@@ -423,7 +431,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
+    await user.click(screen.getByRole('switch', { name: 'Web App' }))
     await user.click(screen.getByRole('button', { name: 'Cancel' }))
 
     await waitFor(() => {
@@ -431,7 +439,7 @@ describe('AccessControlEntry', () => {
     })
 
     await user.click(getChip())
-    expect(screen.getByRole('switch', { name: 'Trigger' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toBeChecked()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
 
@@ -440,8 +448,8 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Trigger' }))
-    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+    await user.click(screen.getByRole('switch', { name: 'Web App' }))
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toBeChecked()
 
     await user.keyboard('{Escape}')
     await waitFor(() => {
@@ -450,7 +458,7 @@ describe('AccessControlEntry', () => {
 
     await user.click(getChip())
     expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Web App' })).not.toBeChecked()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
@@ -482,15 +490,15 @@ describe('AccessControlEntry', () => {
     await waitFor(() => {
       expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
     })
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
 
     await user.click(getChip())
     expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
     expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
-    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
+    expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
   })
 
   it('discards an unsaved edit on Cancel', async () => {
@@ -626,12 +634,420 @@ describe('AccessControlEntry', () => {
     await waitFor(() => {
       expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
     })
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
 
     await user.click(getChip())
     expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('3 of 4')).toBeInTheDocument()
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+  })
+})
+
+const capabilityCases = [
+  {
+    name: 'workflow',
+    points: ['webapp', 'service_api', 'mcp', 'trigger'],
+    labels: ['Web App', 'Backend Service API', 'MCP Server', 'Trigger'],
+  },
+  {
+    name: 'legacy and chatflow',
+    points: ['webapp', 'service_api', 'mcp'],
+    labels: ['Web App', 'Backend Service API', 'MCP Server'],
+  },
+  { name: 'agent', points: ['webapp', 'service_api'], labels: ['Web App', 'Backend Service API'] },
+] satisfies {
+  name: string
+  points: AppNetworkAccessGroupResponse['available_access_points']
+  labels: string[]
+}[]
+
+const createBinding = (
+  overrides: Partial<AppNetworkAccessGroupBindingResponse> = {},
+): AppNetworkAccessGroupBindingResponse => ({
+  id: 'binding-1',
+  tenant_id: 'workspace-1',
+  app_id: 'app-1',
+  enabled: true,
+  group_id: 'group-1',
+  access_points: ['webapp', 'service_api', 'mcp'],
+  version: 2,
+  created_at: '2026-01-01T00:00:00Z',
+  updated_at: '2026-01-01T00:00:00Z',
+  ...overrides,
+})
+
+describe('supported access points and binding permission', () => {
+  beforeEach(() => vi.clearAllMocks())
+
+  it.each(capabilityCases)(
+    'shows and saves exactly the $name capabilities',
+    async ({ points, labels }) => {
+      const user = userEvent.setup()
+      const requests: Record<string, unknown>[] = []
+      const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
+        const request = new Request(input, init)
+        if (request.method === 'PUT') {
+          const payload = await request.json()
+          requests.push(payload)
+          return Response.json({
+            binding: createBinding({ ...payload, version: 1 }),
+            available_access_points: points,
+            effective_enabled: true,
+          })
+        }
+        return Response.json({
+          tenant_id: 'workspace-1',
+          app_id: 'app-1',
+          entitled: true,
+          binding: createBinding({ access_points: points }),
+          available_access_points: points,
+          effective_enabled: true,
+        })
+      })
+      try {
+        renderEntry({
+          plan: 'professional',
+          availableAccessPoints: points,
+          groups: [createNetworkAccessGroupFixture()],
+        })
+        await user.click(getChip())
+        expect(screen.getAllByRole('switch')).toHaveLength(labels.length)
+        labels.forEach((label) => expect(screen.getByRole('switch', { name: label })).toBeChecked())
+        await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+        await user.click(screen.getByRole('button', { name: 'Save' }))
+        await waitFor(() =>
+          expect(requests).toEqual([
+            { enabled: true, group_id: 'group-1', access_points: points, expected_version: 0 },
+          ]),
+        )
+      } finally {
+        fetchSpy.mockRestore()
+      }
+    },
+  )
+
+  it.each(capabilityCases)(
+    'shows full $name coverage in saved status',
+    async ({ points, labels }) => {
+      const user = userEvent.setup()
+      renderEntry({
+        plan: 'professional',
+        availableAccessPoints: points,
+        groups: [createNetworkAccessGroupFixture()],
+        binding: createBinding({ access_points: points }),
+      })
+      expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+      await user.click(getChip())
+      expect(
+        screen.getByText(`Protecting all ${points.length} access points in service.`),
+      ).toBeInTheDocument()
+      labels.forEach((label) => expect(screen.getByText(label)).toBeInTheDocument())
+      if (!points.includes('trigger')) expect(screen.queryByText('Trigger')).not.toBeInTheDocument()
+      if (!points.includes('mcp')) expect(screen.queryByText('MCP Server')).not.toBeInTheDocument()
+    },
+  )
+
+  it.each(capabilityCases)(
+    'uses $name capabilities in the downgrade summary',
+    async ({ points }) => {
+      const user = userEvent.setup()
+      renderEntry({
+        plan: 'sandbox',
+        availableAccessPoints: points,
+        groups: [createNetworkAccessGroupFixture()],
+        binding: createBinding({ access_points: points }),
+      })
+      await user.click(getChip())
+      expect(
+        screen.getByText(`Protects ${points.length} of ${points.length} access points`),
+      ).toBeInTheDocument()
+    },
+  )
+
+  it('lets editors select and save an existing policy without allowing policy creation', async () => {
+    const user = userEvent.setup()
+    const { unmount } = renderEntry({ plan: 'professional', role: 'editor' })
+    await user.click(getChip())
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Manage IP policies' }))
+    expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
+    unmount()
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      Response.json({
+        binding: createBinding(),
+        available_access_points: ['webapp', 'service_api', 'mcp'],
+        effective_enabled: true,
+      }),
+    )
+    try {
+      renderEntry({
+        plan: 'professional',
+        role: 'editor',
+        groups: [createNetworkAccessGroupFixture()],
+      })
+      await user.click(getChip())
+      await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      await waitFor(() => expect(fetchSpy).toHaveBeenCalled())
+      const [input, init] = fetchSpy.mock.calls[0]!
+      expect(new Request(input, init).method).toBe('PUT')
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
+
+  it('preserves selected scopes and versions when pausing and resuming a binding', async () => {
+    const user = userEvent.setup()
+    const availableAccessPoints = ['webapp', 'service_api', 'mcp'] as const
+    let binding = createBinding({ access_points: ['webapp', 'mcp'] })
+    const payloads: unknown[] = []
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
+      const request = new Request(input, init)
+      if (request.url.endsWith('/workspaces/current/network-access-groups'))
+        return Response.json({
+          tenant_id: 'workspace-1',
+          entitled: true,
+          groups: [createNetworkAccessGroupFixture()],
+        })
+      if (request.method === 'PUT') {
+        const payload = await request.json()
+        payloads.push(payload)
+        binding = createBinding({ ...payload, version: binding.version + 1 })
+        return Response.json({
+          binding,
+          available_access_points: availableAccessPoints,
+          effective_enabled: binding.enabled,
+        })
+      }
+      return Response.json({
+        tenant_id: 'workspace-1',
+        app_id: 'app-1',
+        entitled: true,
+        binding,
+        available_access_points: availableAccessPoints,
+        effective_enabled: binding.enabled,
+      })
+    })
+    try {
+      renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()], binding })
+      await user.click(getChip())
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      expect(screen.getByRole('alertdialog')).toHaveTextContent(
+        'Web App, MCP Server will be reachable from any IP.',
+      )
+      await user.click(screen.getByRole('button', { name: 'Turn off' }))
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      await waitFor(() =>
+        expect(payloads).toEqual([
+          {
+            enabled: false,
+            group_id: 'group-1',
+            access_points: ['webapp', 'mcp'],
+            expected_version: 2,
+          },
+        ]),
+      )
+      await waitFor(() =>
+        expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+      )
+      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      await waitFor(() => expect(payloads).toHaveLength(2))
+      expect(payloads[1]).toEqual({
+        enabled: true,
+        group_id: 'group-1',
+        access_points: ['webapp', 'mcp'],
+        expected_version: 3,
+      })
+      await waitFor(() =>
+        expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+      )
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
+
+  it('shows a paid read-only binding without a downgrade or editing controls', async () => {
+    const user = userEvent.setup()
+    const fetchSpy = vi.spyOn(globalThis, 'fetch')
+    try {
+      renderEntry({
+        plan: 'professional',
+        canEditBinding: false,
+        groups: [createNetworkAccessGroupFixture()],
+        binding: createBinding(),
+      })
+      await user.click(getChip())
+      expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
+        'aria-disabled',
+        'true',
+      )
+      expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+      expect(screen.queryByText('This app is no longer protected')).not.toBeInTheDocument()
+      expect(
+        screen.queryByRole('button', { name: 'Turn on Access Control' }),
+      ).not.toBeInTheDocument()
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+      expect(fetchSpy).not.toHaveBeenCalled()
+    } finally {
+      fetchSpy.mockRestore()
+    }
+  })
+
+  it('discards unsaved policy and scope edits when binding permission is revoked', async () => {
+    const user = userEvent.setup()
+    const rendered = renderEntry({
+      plan: 'professional',
+      groups: [
+        createNetworkAccessGroupFixture(),
+        createNetworkAccessGroupFixture({ id: 'group-2', name: 'Office' }),
+      ],
+      binding: createBinding(),
+    })
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+    await user.click(screen.getByRole('option', { name: /Office/ }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+
+    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={false} />)
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.getByText('Protecting all 3 access points in service.')).toBeInTheDocument()
+    expect(screen.queryByText('Office')).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
+      'aria-disabled',
+      'true',
+    )
+
+    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />)
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(screen.getByRole('combobox', { name: 'IP Policy' })).toHaveTextContent(
+      'Internal Network',
+    )
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toBeChecked()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+
+  it('closes an outstanding pause confirmation when binding permission is revoked', async () => {
+    const user = userEvent.setup()
+    const rendered = renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: createBinding(),
+    })
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    expect(screen.getByRole('alertdialog')).toBeInTheDocument()
+
+    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={false} />)
+    await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
+    await user.click(getChip())
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+
+    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />)
+    await user.click(getChip())
+    expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+  })
+
+  it('keeps first-time binding controls read-only when app edits are forbidden', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      canEditBinding: false,
+      groups: [createNetworkAccessGroupFixture()],
+    })
+    await user.click(getChip())
+    expect(screen.getByRole('option', { name: /Internal Network/ })).toBeDisabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+  })
+
+  it.each(['normal', 'dataset_operator'] as const)('hides the entry from workspace %s', (role) => {
+    renderEntry({ plan: 'professional', role })
+    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+  })
+
+  it('does not create an editable fallback when available access points are empty', () => {
+    renderEntry({ plan: 'professional', availableAccessPoints: [] })
+    expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+  })
+
+  it('discards the previous app draft when the App ID changes', async () => {
+    const user = userEvent.setup()
+    const rendered = renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+    })
+    seedAppNetworkAccessGroup(rendered.queryClient, 'app-2', {
+      available_access_points: ['webapp', 'service_api'],
+    })
+    await user.click(getChip())
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('switch', { name: 'Web App' }))
+    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    rendered.rerender(<AccessControlEntry appId="app-2" appIcon={{}} canEditBinding />)
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    await user.click(getChip())
+    expect(screen.getByRole('switch', { name: 'Web App' })).toBeChecked()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(screen.queryByRole('switch', { name: 'MCP Server' })).not.toBeInTheDocument()
+  })
+
+  it.each([
+    {
+      name: 'failed binding query',
+      response: () => Response.json({ message: 'Service unavailable' }, { status: 503 }),
+      status: 'error',
+    },
+    {
+      name: 'missing capability field',
+      response: () =>
+        Response.json({
+          tenant_id: 'workspace-1',
+          app_id: 'app-1',
+          entitled: true,
+          binding: null,
+          effective_enabled: false,
+        }),
+      status: 'success',
+    },
+  ])('does not enable editing after $name', async ({ response, status }) => {
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { entitled: true })
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => response())
+    try {
+      renderWithConsoleQuery(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />, {
+        queryClient,
+        systemFeatures: { deployment_edition: 'CLOUD' },
+      })
+      await waitFor(() =>
+        expect(
+          queryClient.getQueryState(
+            consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
+              input: { params: { app_id: 'app-1' } },
+            }),
+          )?.status,
+        ).toBe(status),
+      )
+      expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+      expect(fetchSpy).toHaveBeenCalledTimes(1)
+    } finally {
+      fetchSpy.mockRestore()
+    }
   })
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
index 63c51d27717d6b..0681bfe7e3e9c3 100644
--- a/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/network-access.spec.ts
@@ -1,6 +1,8 @@
+import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 import {
   accessPointsFromScopes,
   draftFromBinding,
+  getAvailableAccessPoints,
   getNetworkAccessErrorStatus,
   scopesFromAccessPoints,
   toApiAccessPoint,
@@ -31,12 +33,15 @@ describe('network access mappers', () => {
 
   it('includes every selected access point in the PUT payload', () => {
     expect(
-      accessPointsFromScopes({
-        webApp: true,
-        serviceApi: true,
-        mcp: true,
-        trigger: true,
-      }),
+      accessPointsFromScopes(
+        {
+          webApp: true,
+          serviceApi: true,
+          mcp: true,
+          trigger: true,
+        },
+        ACCESS_POINT_ORDER,
+      ),
     ).toEqual(['webapp', 'service_api', 'mcp', 'trigger'])
   })
 
@@ -49,13 +54,13 @@ describe('network access mappers', () => {
           mcp: true,
           trigger: true,
         },
-        ['webapp', 'service_api', 'mcp'],
+        ['webApp', 'serviceApi', 'mcp'],
       ),
     ).toEqual(['webapp', 'service_api', 'mcp'])
   })
 
   it('creates an empty draft when the app has no binding', () => {
-    expect(draftFromBinding(null)).toEqual({
+    expect(draftFromBinding(null, ACCESS_POINT_ORDER)).toEqual({
       selectedPolicyId: null,
       enabled: true,
       scopes: {
@@ -69,17 +74,20 @@ describe('network access mappers', () => {
 
   it('hydrates a draft from a bound group', () => {
     expect(
-      draftFromBinding({
-        id: 'binding-1',
-        tenant_id: 'workspace-1',
-        app_id: 'app-1',
-        enabled: true,
-        group_id: 'group-1',
-        access_points: ['webapp', 'service_api'],
-        version: 3,
-        created_at: '2026-01-01T00:00:00Z',
-        updated_at: '2026-01-01T00:00:00Z',
-      }),
+      draftFromBinding(
+        {
+          id: 'binding-1',
+          tenant_id: 'workspace-1',
+          app_id: 'app-1',
+          enabled: true,
+          group_id: 'group-1',
+          access_points: ['webapp', 'service_api'],
+          version: 3,
+          created_at: '2026-01-01T00:00:00Z',
+          updated_at: '2026-01-01T00:00:00Z',
+        },
+        ['webApp', 'serviceApi'],
+      ),
     ).toEqual({
       selectedPolicyId: 'group-1',
       enabled: true,
@@ -92,3 +100,19 @@ describe('network access mappers', () => {
     })
   })
 })
+
+describe('available scope mapping', () => {
+  it('orders supported access points independently of response order', () => {
+    expect(getAvailableAccessPoints(['mcp', 'webapp', 'service_api'])).toEqual([
+      'webApp',
+      'serviceApi',
+      'mcp',
+    ])
+  })
+  it('keeps an explicit empty capability list empty', () => {
+    expect(getAvailableAccessPoints([])).toEqual([])
+    expect(
+      accessPointsFromScopes({ webApp: true, serviceApi: true, mcp: true, trigger: true }, []),
+    ).toEqual([])
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/chip-status.ts b/web/app/components/app/access-point/access-control/chip-status.ts
index 8833d78767e5a5..66084fba01172d 100644
--- a/web/app/components/app/access-point/access-control/chip-status.ts
+++ b/web/app/components/app/access-point/access-control/chip-status.ts
@@ -1,6 +1,5 @@
 import type { AccessControlDraft } from './draft'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
-import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 
 export type AccessControlAssignment = {
   policyId: string
@@ -18,28 +17,33 @@ export type AccessControlChipState = {
   policyName?: string
 }
 
-export function getInServiceCoverage(scopes: Record<AccessPoint, boolean>) {
-  const covered = ACCESS_POINT_ORDER.filter((scope) => scopes[scope])
+export function getInServiceCoverage(
+  scopes: Record<AccessPoint, boolean>,
+  availableAccessPoints: readonly AccessPoint[],
+) {
+  const covered = availableAccessPoints.filter((scope) => scopes[scope])
 
   return {
     coveredCount: covered.length,
-    inServiceCount: ACCESS_POINT_ORDER.length,
+    inServiceCount: availableAccessPoints.length,
   }
 }
 
 export function getAccessControlChipState({
   entitled,
   assignment,
+  availableAccessPoints,
 }: {
   entitled?: boolean
   assignment: AccessControlAssignment | null
+  availableAccessPoints: readonly AccessPoint[]
 }): AccessControlChipState {
   if (!assignment) {
     if (entitled === false) return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
     return { kind: 'off', coveredCount: 0, inServiceCount: 0 }
   }
 
-  const coverage = getInServiceCoverage(assignment.scopes)
+  const coverage = getInServiceCoverage(assignment.scopes, availableAccessPoints)
 
   if (!assignment.enabled) {
     return {
@@ -50,7 +54,10 @@ export function getAccessControlChipState({
   }
 
   return {
-    kind: coverage.coveredCount === coverage.inServiceCount ? 'on' : 'partial',
+    kind:
+      coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
+        ? 'on'
+        : 'partial',
     policyName: assignment.policyName,
     ...coverage,
   }
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index b4c00ee2bcd49e..716cb7008b6610 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -2,6 +2,8 @@
 
 import type { FormEvent } from 'react'
 import type { AccessControlDraft, AccessControlPolicy } from './draft'
+import type { AccessControlAppIcon } from './index'
+import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
@@ -16,7 +18,10 @@ type AccessControlConfigPanelProps = {
   draft: AccessControlDraft
   policies: readonly AccessControlPolicy[]
   currentIp?: string
-  persistableAccessPoints?: readonly string[]
+  availableAccessPoints: readonly AccessPoint[]
+  appIcon: AccessControlAppIcon
+  readOnly?: boolean
+  canManagePolicies: boolean
   baseline?: AccessControlDraft
   showBack?: boolean
   saving?: boolean
@@ -32,7 +37,10 @@ export function AccessControlConfigPanel({
   draft,
   policies,
   currentIp,
-  persistableAccessPoints,
+  availableAccessPoints,
+  appIcon,
+  readOnly = false,
+  canManagePolicies,
   baseline,
   showBack = false,
   saving = false,
@@ -46,10 +54,8 @@ export function AccessControlConfigPanel({
   const { t } = useTranslation()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
-  const hasPersistableSelection = persistableAccessPoints
-    ? persistableAccessPoints.length > 0
-    : hasSelectedAccessPoint(draft)
-  const canSave = canSaveAccessControl({ draft, baseline, persistableAccessPoints })
+  const hasPersistableSelection = hasSelectedAccessPoint(draft, availableAccessPoints)
+  const canSave = !readOnly && canSaveAccessControl({ draft, baseline, availableAccessPoints })
 
   const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
     event.preventDefault()
@@ -90,9 +96,12 @@ export function AccessControlConfigPanel({
             policies={policies}
             selectedPolicyId={draft.selectedPolicyId}
             currentIp={currentIp}
+            readOnly={readOnly}
+            canManagePolicies={canManagePolicies}
             onCreatePolicy={onCreatePolicy}
             onManagePolicies={onManagePolicies}
             onSelectPolicy={(policyId) => {
+              if (readOnly) return
               onDraftChange({ ...draft, selectedPolicyId: policyId })
             }}
           />
@@ -107,7 +116,13 @@ export function AccessControlConfigPanel({
               ? t(($) => $['studio.accessControl.applyToHelpSelected'], { ns: 'deployments' })
               : t(($) => $['studio.accessControl.applyToHelp'], { ns: 'deployments' })}
           </p>
-          <AccessControlScopeList draft={draft} onDraftChange={onDraftChange} />
+          <AccessControlScopeList
+            draft={draft}
+            appIcon={appIcon}
+            availableAccessPoints={availableAccessPoints}
+            readOnly={readOnly}
+            onDraftChange={onDraftChange}
+          />
           {hasSelectedPolicy && draft.enabled && !hasPersistableSelection && (
             <p className="system-xs-regular text-text-warning">
               {t(($) => $['studio.accessControl.selectAccessPoint'], { ns: 'deployments' })}
@@ -119,9 +134,11 @@ export function AccessControlConfigPanel({
           <Button type="button" variant="secondary" onClick={onCancel}>
             {t(($) => $['operation.cancel'], { ns: 'common' })}
           </Button>
-          <Button type="submit" variant="primary" disabled={!canSave || saving} loading={saving}>
-            {t(($) => $['operation.save'], { ns: 'common' })}
-          </Button>
+          {!readOnly && (
+            <Button type="submit" variant="primary" disabled={!canSave || saving} loading={saving}>
+              {t(($) => $['operation.save'], { ns: 'common' })}
+            </Button>
+          )}
         </div>
       </div>
     </form>
diff --git a/web/app/components/app/access-point/access-control/downgrade-panel.tsx b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
index b948f97666061b..8506f865491e1e 100644
--- a/web/app/components/app/access-point/access-control/downgrade-panel.tsx
+++ b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
@@ -1,13 +1,12 @@
 'use client'
 
 import type { AccessControlAssignment } from './chip-status'
+import type { AccessControlAppIcon } from './index'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
 import { useTranslation } from 'react-i18next'
-import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
-import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
 import { getInServiceCoverage } from './chip-status'
 
@@ -19,17 +18,20 @@ const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
 
 type AccessControlDowngradePanelProps = {
   assignment: AccessControlAssignment
+  appIcon: AccessControlAppIcon
+  availableAccessPoints: readonly AccessPoint[]
   onTurnOn: () => void
 }
 
 export function AccessControlDowngradePanel({
   assignment,
+  appIcon,
+  availableAccessPoints,
   onTurnOn,
 }: AccessControlDowngradePanelProps) {
   const { t } = useTranslation()
-  const appInfo = useAppStore((state) => state.appDetail)
-  const coverage = getInServiceCoverage(assignment.scopes)
-  const protectedScopes = ACCESS_POINT_ORDER.filter((scope) => assignment.scopes[scope])
+  const coverage = getInServiceCoverage(assignment.scopes, availableAccessPoints)
+  const protectedScopes = availableAccessPoints.filter((scope) => assignment.scopes[scope])
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const turnOn = t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })
   const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
@@ -64,10 +66,7 @@ export function AccessControlDowngradePanel({
                       key={scope}
                       size="tiny"
                       decorative
-                      iconType={appInfo?.icon_type}
-                      icon={appInfo?.icon}
-                      background={appInfo?.icon_background ?? undefined}
-                      imageUrl={appInfo?.icon_url}
+                      {...appIcon}
                       className="rounded-sm bg-util-colors-orange-orange-100"
                     />
                   ) : (
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
index a9bde917d5d467..49d6ebb61be736 100644
--- a/web/app/components/app/access-point/access-control/draft.ts
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -1,6 +1,5 @@
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
-import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
 
 export type AccessControlPolicy = Pick<NetworkAccessGroupResponse, 'id' | 'name' | 'allowed_cidrs'>
 
@@ -10,40 +9,49 @@ export type AccessControlDraft = {
   enabled: boolean
 }
 
-export const createDefaultAccessControlDraft = (): AccessControlDraft => ({
+export const createDefaultAccessControlDraft = (
+  availableAccessPoints: readonly AccessPoint[],
+): AccessControlDraft => ({
   selectedPolicyId: null,
   enabled: true,
   scopes: {
-    webApp: true,
-    serviceApi: true,
-    mcp: true,
-    trigger: true,
+    webApp: availableAccessPoints.includes('webApp'),
+    serviceApi: availableAccessPoints.includes('serviceApi'),
+    mcp: availableAccessPoints.includes('mcp'),
+    trigger: availableAccessPoints.includes('trigger'),
   },
 })
 
-export function isAccessControlDraftEqual(left: AccessControlDraft, right: AccessControlDraft) {
+export function isAccessControlDraftEqual(
+  left: AccessControlDraft,
+  right: AccessControlDraft,
+  availableAccessPoints: readonly AccessPoint[],
+) {
   if (left.selectedPolicyId !== right.selectedPolicyId) return false
   if (left.enabled !== right.enabled) return false
 
-  return ACCESS_POINT_ORDER.every((scope) => left.scopes[scope] === right.scopes[scope])
+  return availableAccessPoints.every((scope) => left.scopes[scope] === right.scopes[scope])
 }
 
-export function hasSelectedAccessPoint(draft: AccessControlDraft) {
-  return ACCESS_POINT_ORDER.some((scope) => draft.scopes[scope])
+export function hasSelectedAccessPoint(
+  draft: AccessControlDraft,
+  availableAccessPoints: readonly AccessPoint[],
+) {
+  return availableAccessPoints.some((scope) => draft.scopes[scope])
 }
 
 export function canSaveAccessControl({
   draft,
   baseline,
-  persistableAccessPoints,
+  availableAccessPoints,
 }: {
   draft: AccessControlDraft
   baseline?: AccessControlDraft
-  persistableAccessPoints?: readonly string[]
+  availableAccessPoints: readonly AccessPoint[]
 }) {
-  if (baseline && isAccessControlDraftEqual(draft, baseline)) return false
+  if (!availableAccessPoints.length) return false
+  if (baseline && isAccessControlDraftEqual(draft, baseline, availableAccessPoints)) return false
   if (!draft.enabled) return Boolean(draft.selectedPolicyId)
   if (!draft.selectedPolicyId) return false
-  if (persistableAccessPoints) return persistableAccessPoints.length > 0
-  return hasSelectedAccessPoint(draft)
+  return hasSelectedAccessPoint(draft, availableAccessPoints)
 }
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index a4ed26725baab5..fc5bba54ddcb70 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -1,15 +1,16 @@
 'use client'
 
+import type { ComponentProps } from 'react'
 import type { AccessControlAssignment } from './chip-status'
 import type { AccessControlDraft } from './draft'
+import type AppIcon from '@/app/components/base/app-icon'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { useStore as useAppStore } from '@/app/components/app/store'
 import {
   pricingQueryParamName,
   pricingQueryParser,
@@ -19,8 +20,10 @@ import {
   settingsQueryParamName,
   settingsQueryParser,
 } from '@/app/components/header/account-setting/query-params'
-import { isCurrentWorkspaceManagerAtom } from '@/context/workspace-state'
-import { deploymentEditionAtom } from '@/features/system-features/state'
+import {
+  canManageNetworkAccessPoliciesAtom,
+  canReadNetworkAccessAtom,
+} from '@/features/network-access/permissions'
 import { consoleQuery } from '@/service/console'
 import { AccessControlChipAffix } from './chip-affix'
 import { getAccessControlChipState } from './chip-status'
@@ -31,26 +34,39 @@ import { AccessControlFreePaywall } from './free-paywall'
 import {
   accessPointsFromScopes,
   draftFromBinding,
+  getAvailableAccessPoints,
   getNetworkAccessErrorStatus,
-  scopesFromAccessPoints,
 } from './network-access'
 import { AccessControlStatusPanel } from './status-panel'
 
+export type AccessControlAppIcon = Pick<
+  ComponentProps<typeof AppIcon>,
+  'iconType' | 'icon' | 'background' | 'imageUrl'
+>
+
+type AccessControlEntryProps = {
+  appId: string
+  appIcon: AccessControlAppIcon
+  canEditBinding: boolean
+}
+
 type GtagHandler = (command: 'event', action: 'click_upgrade_btn', payload: { loc: string }) => void
 
-export function AccessControlEntry() {
+export function AccessControlEntry(props: AccessControlEntryProps) {
+  return <AccessControlSession key={`${props.appId}:${props.canEditBinding}`} {...props} />
+}
+
+function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlEntryProps) {
   const { t } = useTranslation()
   const queryClient = useQueryClient()
-  const deploymentEdition = useAtomValue(deploymentEditionAtom)
-  const isManager = useAtomValue(isCurrentWorkspaceManagerAtom)
+  const canRead = useAtomValue(canReadNetworkAccessAtom)
+  const canManagePolicies = useAtomValue(canManageNetworkAccessPoliciesAtom)
   const [_pricing, setPricing] = useQueryState(pricingQueryParamName, pricingQueryParser)
   const [_settingsDestination, setSettingsDestination] = useQueryState(
     settingsQueryParamName,
     settingsQueryParser,
   )
-  const appInfo = useAppStore((state) => state.appDetail)
-  const appId = appInfo?.id
-  const canFetchNetworkAccess = deploymentEdition === 'CLOUD' && isManager
+  const canFetchNetworkAccess = canRead && Boolean(appId)
   const groupsQuery = useQuery(
     consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions({
       enabled: canFetchNetworkAccess,
@@ -59,7 +75,7 @@ export function AccessControlEntry() {
   )
   const bindingQuery = useQuery(
     consoleQuery.apps.byAppId.networkAccessGroup.get.queryOptions({
-      input: appId ? { params: { app_id: appId } } : skipToken,
+      input: { params: { app_id: appId } },
       context: { silent: true },
       retry: false,
       enabled: canFetchNetworkAccess && Boolean(appId),
@@ -83,44 +99,49 @@ export function AccessControlEntry() {
     Boolean(appId) &&
     (bindingErrorStatus === 400 || bindingErrorStatus === 403 || bindingErrorStatus === 404)
 
-  if (deploymentEdition !== 'CLOUD' || !isManager) return null
+  if (!canFetchNetworkAccess) return null
   if (hideForUnsupportedApp) return null
-  if (groupsQuery.isPending || (appId && bindingQuery.isPending)) return null
+  if (groupsQuery.isPending || bindingQuery.isPending) return null
+  if (groupsQuery.isError || bindingQuery.isError || !groupsQuery.data || !bindingQuery.data)
+    return null
+  if (!Array.isArray(bindingQuery.data.available_access_points)) return null
+  const availableAccessPoints = getAvailableAccessPoints(bindingQuery.data.available_access_points)
+  if (!availableAccessPoints.length) return null
 
   const label = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
-  const groups = groupsQuery.data?.groups ?? []
-  const binding = bindingQuery.data?.binding
+  const groups = groupsQuery.data.groups
+  const binding = bindingQuery.data.binding
   const policies = groups.map((group) => ({
     id: group.id,
     name: group.name,
     allowed_cidrs: group.allowed_cidrs,
   }))
-  const baseline = draftFromBinding(binding)
-  const resolvedDraft = draft ?? baseline
+  const baseline = draftFromBinding(binding, availableAccessPoints)
+  const entitled = bindingQuery.data.entitled
+  const canMutate = canRead && canEditBinding && entitled
+  const resolvedDraft = canMutate ? (draft ?? baseline) : baseline
   const assignment: AccessControlAssignment | null = binding?.group_id
     ? {
         policyId: binding.group_id,
         policyName: groups.find((group) => group.id === binding.group_id)?.name ?? binding.group_id,
-        scopes: scopesFromAccessPoints(binding.access_points),
+        scopes: baseline.scopes,
         enabled: binding.enabled,
       }
     : null
-  const entitled = bindingQuery.data?.entitled ?? groupsQuery.data?.entitled
-  const canMutate = entitled === true
-  const dirty = !isAccessControlDraftEqual(resolvedDraft, baseline)
+  const dirty = !isAccessControlDraftEqual(resolvedDraft, baseline, availableAccessPoints)
   const persistableAccessPoints = accessPointsFromScopes(
     resolvedDraft.scopes,
-    bindingQuery.data?.available_access_points,
+    availableAccessPoints,
   )
   const canSave = canSaveAccessControl({
     draft: resolvedDraft,
     baseline,
-    persistableAccessPoints,
+    availableAccessPoints,
   })
-  const chip = getAccessControlChipState({ entitled, assignment })
+  const chip = getAccessControlChipState({ entitled, assignment, availableAccessPoints })
   const showPaywall = chip.kind === 'pro'
-  const showDowngrade = Boolean(assignment) && !canMutate
-  const showStatus = Boolean(assignment) && canMutate && view === 'status'
+  const showDowngrade = Boolean(assignment) && !entitled
+  const showStatus = Boolean(assignment) && entitled && (!canMutate || view === 'status')
 
   const tooltip =
     chip.kind === 'pro'
@@ -170,6 +191,7 @@ export function AccessControlEntry() {
   }
 
   const handleCreatePolicy = () => {
+    if (!canMutate || !canManagePolicies) return
     setOpen(false)
     setCreatePolicyOpen(true)
   }
@@ -197,7 +219,7 @@ export function AccessControlEntry() {
     },
     onSuccess?: () => void,
   ) => {
-    if (!appId) return
+    if (!canMutate) return
 
     updateBinding.mutate(
       {
@@ -287,17 +309,23 @@ export function AccessControlEntry() {
             {showPaywall ? (
               <AccessControlFreePaywall onTurnOn={handleTurnOn} />
             ) : showDowngrade && assignment ? (
-              <AccessControlDowngradePanel assignment={assignment} onTurnOn={handleTurnOn} />
+              <AccessControlDowngradePanel
+                assignment={assignment}
+                appIcon={appIcon}
+                availableAccessPoints={availableAccessPoints}
+                onTurnOn={handleTurnOn}
+              />
             ) : showStatus && assignment ? (
               <AccessControlStatusPanel
                 draft={resolvedDraft}
+                appIcon={appIcon}
+                availableAccessPoints={availableAccessPoints}
                 policies={policies}
                 enabled={resolvedDraft.enabled}
                 updating={updateBinding.isPending}
                 dirty={dirty}
                 canSave={canSave}
                 readOnly={!canMutate}
-                onUpgrade={handleTurnOn}
                 onEnabledChange={handleEnabledChange}
                 onCancel={handleCancel}
                 onSave={handleSave}
@@ -311,8 +339,11 @@ export function AccessControlEntry() {
             ) : (
               <AccessControlConfigPanel
                 draft={resolvedDraft}
+                appIcon={appIcon}
+                availableAccessPoints={availableAccessPoints}
                 policies={policies}
-                persistableAccessPoints={persistableAccessPoints}
+                readOnly={!canMutate}
+                canManagePolicies={canManagePolicies}
                 baseline={baseline}
                 showBack={showBack}
                 saving={updateBinding.isPending}
@@ -320,7 +351,9 @@ export function AccessControlEntry() {
                 onCancel={handleCancel}
                 onCreatePolicy={handleCreatePolicy}
                 onManagePolicies={handleManagePolicies}
-                onDraftChange={setDraft}
+                onDraftChange={(nextDraft) => {
+                  if (canMutate) setDraft(nextDraft)
+                }}
                 onSave={handleSave}
               />
             )}
@@ -328,13 +361,14 @@ export function AccessControlEntry() {
         </Popover>
         <TooltipContent>{tooltip}</TooltipContent>
       </Tooltip>
-      {createPolicyOpen && (
+      {createPolicyOpen && canMutate && canManagePolicies && (
         <IpPolicyDialog
           mode="create"
           open
           isPending={createGroup.isPending}
           onOpenChange={handlePolicyDialogOpenChange}
           onSubmit={(payload) => {
+            if (!canMutate || !canManagePolicies) return
             createGroup.mutate(
               {
                 body: {
diff --git a/web/app/components/app/access-point/access-control/network-access.ts b/web/app/components/app/access-point/access-control/network-access.ts
index ceb7d6f9f091d8..b370ef5077c6d6 100644
--- a/web/app/components/app/access-point/access-control/network-access.ts
+++ b/web/app/components/app/access-point/access-control/network-access.ts
@@ -65,27 +65,31 @@ export function scopesFromAccessPoints(
   }
 }
 
+export function getAvailableAccessPoints(
+  accessPoints: readonly NetworkAccessPoint[],
+): AccessPoint[] {
+  const available = new Set(accessPoints)
+  return ACCESS_POINT_ORDER.filter((accessPoint) => available.has(toApiAccessPoint(accessPoint)))
+}
+
 export function accessPointsFromScopes(
   scopes: AccessControlDraft['scopes'],
-  availableAccessPoints?: readonly string[],
+  availableAccessPoints: readonly AccessPoint[],
 ): NetworkAccessPoint[] {
-  const allowed = availableAccessPoints ? new Set(availableAccessPoints) : null
-
-  return ACCESS_POINT_ORDER.filter((accessPoint) => {
-    if (!scopes[accessPoint]) return false
-    if (!allowed) return true
-    return allowed.has(toApiAccessPoint(accessPoint))
-  }).map(toApiAccessPoint)
+  return availableAccessPoints.filter((accessPoint) => scopes[accessPoint]).map(toApiAccessPoint)
 }
 
 export function draftFromBinding(
-  binding: AppNetworkAccessGroupBindingResponse | null | undefined,
+  binding: AppNetworkAccessGroupBindingResponse | null,
+  availableAccessPoints: readonly AccessPoint[],
 ): AccessControlDraft {
-  if (!binding?.group_id) return createDefaultAccessControlDraft()
+  if (!binding?.group_id) return createDefaultAccessControlDraft(availableAccessPoints)
 
   return {
     selectedPolicyId: binding.group_id,
     enabled: binding.enabled,
-    scopes: scopesFromAccessPoints(binding.access_points),
+    scopes: scopesFromAccessPoints(
+      accessPointsFromScopes(scopesFromAccessPoints(binding.access_points), availableAccessPoints),
+    ),
   }
 }
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index e423382fe803b0..56223105522dab 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -26,6 +26,8 @@ type AccessControlPolicyFieldProps = {
   policies: readonly AccessControlPolicy[]
   selectedPolicyId: string | null
   currentIp?: string
+  readOnly?: boolean
+  canManagePolicies: boolean
   onCreatePolicy: () => void
   onManagePolicies: () => void
   onSelectPolicy: (policyId: string) => void
@@ -35,6 +37,8 @@ export function AccessControlPolicyField({
   policies,
   selectedPolicyId,
   currentIp,
+  readOnly = false,
+  canManagePolicies,
   onCreatePolicy,
   onManagePolicies,
   onSelectPolicy,
@@ -56,9 +60,15 @@ export function AccessControlPolicyField({
         <p className="w-full text-center system-sm-medium text-text-secondary">
           {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
         </p>
-        <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
-          {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
-        </Button>
+        {canManagePolicies && !readOnly ? (
+          <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
+            {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
+          </Button>
+        ) : (
+          <Button type="button" variant="secondary" onClick={onManagePolicies}>
+            {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
+          </Button>
+        )}
       </div>
     )
   }
@@ -123,8 +133,11 @@ export function AccessControlPolicyField({
               type="button"
               role="option"
               aria-selected={false}
+              disabled={readOnly}
               className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-              onClick={() => onSelectPolicy(policy.id)}
+              onClick={() => {
+                if (!readOnly) onSelectPolicy(policy.id)
+              }}
             >
               <span className="min-w-0 flex-1 truncate px-1">{policy.name}</span>
               <span className="shrink-0 system-xs-regular text-text-tertiary">
@@ -155,7 +168,9 @@ export function AccessControlPolicyField({
       <div className="flex w-full items-center gap-1">
         <Select
           value={selectedPolicyId}
+          disabled={readOnly}
           onValueChange={(value) => {
+            if (readOnly) return
             if (value === MANAGE_POLICIES_VALUE) {
               onManagePolicies()
               return
diff --git a/web/app/components/app/access-point/access-control/scope-list.tsx b/web/app/components/app/access-point/access-control/scope-list.tsx
index 044c24f9030189..0cb2b5db9b440f 100644
--- a/web/app/components/app/access-point/access-control/scope-list.tsx
+++ b/web/app/components/app/access-point/access-control/scope-list.tsx
@@ -1,12 +1,11 @@
 'use client'
 
 import type { AccessControlDraft } from './draft'
+import type { AccessControlAppIcon } from './index'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Switch } from '@langgenius/dify-ui/switch'
 import { useTranslation } from 'react-i18next'
-import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
-import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
 
 const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
@@ -17,12 +16,20 @@ const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
 
 type AccessControlScopeListProps = {
   draft: AccessControlDraft
+  appIcon: AccessControlAppIcon
+  availableAccessPoints: readonly AccessPoint[]
+  readOnly?: boolean
   onDraftChange: (draft: AccessControlDraft) => void
 }
 
-export function AccessControlScopeList({ draft, onDraftChange }: AccessControlScopeListProps) {
+export function AccessControlScopeList({
+  draft,
+  appIcon,
+  availableAccessPoints,
+  readOnly = false,
+  onDraftChange,
+}: AccessControlScopeListProps) {
   const { t } = useTranslation()
-  const appInfo = useAppStore((state) => state.appDetail)
 
   const labels: Record<AccessPoint, string> = {
     webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
@@ -33,7 +40,7 @@ export function AccessControlScopeList({ draft, onDraftChange }: AccessControlSc
 
   return (
     <div className="flex w-full flex-col gap-0.5">
-      {ACCESS_POINT_ORDER.map((scope) => {
+      {availableAccessPoints.map((scope) => {
         const label = labels[scope]
 
         return (
@@ -42,10 +49,7 @@ export function AccessControlScopeList({ draft, onDraftChange }: AccessControlSc
               <AppIcon
                 size="tiny"
                 decorative
-                iconType={appInfo?.icon_type}
-                icon={appInfo?.icon}
-                background={appInfo?.icon_background ?? undefined}
-                imageUrl={appInfo?.icon_url}
+                {...appIcon}
                 className="rounded-sm bg-util-colors-orange-orange-100"
               />
             ) : (
@@ -59,8 +63,10 @@ export function AccessControlScopeList({ draft, onDraftChange }: AccessControlSc
             <span className="min-w-0 flex-1 system-sm-medium text-text-secondary">{label}</span>
             <Switch
               checked={draft.scopes[scope]}
+              disabled={readOnly}
               aria-label={label}
               onCheckedChange={(checked) => {
+                if (readOnly) return
                 onDraftChange({
                   ...draft,
                   scopes: {
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index 79eefa2f1759fd..962e1df6537d00 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -1,6 +1,7 @@
 'use client'
 
 import type { AccessControlDraft, AccessControlPolicy } from './draft'
+import type { AccessControlAppIcon } from './index'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import {
   AlertDialog,
@@ -17,8 +18,6 @@ import { PopoverTitle } from '@langgenius/dify-ui/popover'
 import { Switch } from '@langgenius/dify-ui/switch'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
-import { useStore as useAppStore } from '@/app/components/app/store'
 import AppIcon from '@/app/components/base/app-icon'
 import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 import { getInServiceCoverage } from './chip-status'
@@ -31,6 +30,8 @@ const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
 
 type AccessControlStatusPanelProps = {
   draft: AccessControlDraft
+  appIcon: AccessControlAppIcon
+  availableAccessPoints: readonly AccessPoint[]
   policies: readonly AccessControlPolicy[]
   enabled: boolean
   onEdit: () => void
@@ -38,7 +39,6 @@ type AccessControlStatusPanelProps = {
   dirty?: boolean
   canSave?: boolean
   readOnly?: boolean
-  onUpgrade?: () => void
   onCancel?: () => void
   onSave?: () => void
   onEnabledChange: (enabled: boolean) => void
@@ -46,6 +46,8 @@ type AccessControlStatusPanelProps = {
 
 export function AccessControlStatusPanel({
   draft,
+  appIcon,
+  availableAccessPoints,
   policies,
   enabled,
   onEdit,
@@ -53,26 +55,24 @@ export function AccessControlStatusPanel({
   dirty = false,
   canSave = false,
   readOnly = false,
-  onUpgrade,
   onCancel,
   onSave,
   onEnabledChange,
 }: AccessControlStatusPanelProps) {
   const { t } = useTranslation()
-  const appInfo = useAppStore((state) => state.appDetail)
   const [confirmPause, setConfirmPause] = useState(false)
   const selectedPolicy = policies.find((policy) => policy.id === draft.selectedPolicyId)
   const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.allowed_cidrs) : undefined
-  const coverage = getInServiceCoverage(draft.scopes)
+  const coverage = getInServiceCoverage(draft.scopes, availableAccessPoints)
   const labels: Record<AccessPoint, string> = {
     webApp: t(($) => $['overview.appInfo.title'], { ns: 'appOverview' }),
     serviceApi: t(($) => $['overview.apiInfo.title'], { ns: 'appOverview' }),
     mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
     trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
   }
-  const exposedNames = ACCESS_POINT_ORDER.filter((scope) => draft.scopes[scope]).map(
-    (scope) => labels[scope],
-  )
+  const exposedNames = availableAccessPoints
+    .filter((scope) => draft.scopes[scope])
+    .map((scope) => labels[scope])
   const policyName = selectedPolicy?.name
 
   return (
@@ -86,11 +86,7 @@ export function AccessControlStatusPanel({
               })
             : t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
         </PopoverTitle>
-        {readOnly ? (
-          <Button type="button" variant="ghost" size="small" onClick={onUpgrade}>
-            {t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })}
-          </Button>
-        ) : (
+        {!readOnly && (
           <Button type="button" variant="ghost" size="small" onClick={onEdit}>
             {t(($) => $['operation.edit'], { ns: 'common' })}
           </Button>
@@ -121,6 +117,7 @@ export function AccessControlStatusPanel({
             disabled={updating || readOnly}
             aria-label={t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
             onCheckedChange={(next) => {
+              if (readOnly || updating) return
               if (next) {
                 onEnabledChange(true)
                 return
@@ -163,7 +160,7 @@ export function AccessControlStatusPanel({
           <p className="system-sm-medium text-text-secondary">
             {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
           </p>
-          {ACCESS_POINT_ORDER.map((scope) => {
+          {availableAccessPoints.map((scope) => {
             const excluded = !draft.scopes[scope]
             const label = labels[scope]
 
@@ -173,10 +170,7 @@ export function AccessControlStatusPanel({
                   <AppIcon
                     size="tiny"
                     decorative
-                    iconType={appInfo?.icon_type}
-                    icon={appInfo?.icon}
-                    background={appInfo?.icon_background ?? undefined}
-                    imageUrl={appInfo?.icon_url}
+                    {...appIcon}
                     className="rounded-sm bg-util-colors-orange-orange-100"
                   />
                 ) : (
@@ -245,7 +239,9 @@ export function AccessControlStatusPanel({
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </AlertDialogCancelButton>
             <AlertDialogConfirmButton
+              disabled={readOnly || updating}
               onClick={() => {
+                if (readOnly || updating) return
                 onEnabledChange(false)
                 setConfirmPause(false)
               }}
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index 944c1115d8e66c..c8a89aa4f881d9 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -55,6 +55,7 @@ function AccessPointContent({
   showEnvironmentTabs,
 }: AccessPointContentProps) {
   const { t } = useTranslation()
+  const appInfo = useAppStore((state) => state.appDetail)
   const environments = useAtomValue(inUseAppEnvironmentsAtom)
   const [queryStates, setQueryStates] = useQueryStates(accessPointQueryStates)
   const { accessPoint: highlightedAccessPoint, environment } = queryStates
@@ -75,7 +76,16 @@ function AccessPointContent({
             <h1 id="access-point-title" className="title-xl-semi-bold text-text-primary">
               {t(($) => $['appMenus.accessPoint'], { ns: 'common' })}
             </h1>
-            <AccessControlEntry />
+            <AccessControlEntry
+              appId={appId}
+              appIcon={{
+                iconType: appInfo?.icon_type,
+                icon: appInfo?.icon,
+                background: appInfo?.icon_background,
+                imageUrl: appInfo?.icon_url,
+              }}
+              canEditBinding={canManageAccessPoint}
+            />
           </div>
           <p className="system-xs-regular text-text-tertiary">
             {t(($) => $['studio.accessPoint.description'], { ns: 'deployments' })}
diff --git a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
new file mode 100644
index 00000000000000..c7ff3bb316eaed
--- /dev/null
+++ b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
@@ -0,0 +1,192 @@
+import type { AgentAppDetailWithSite } from '@dify/contracts/api/console/agent/types.gen'
+import { screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import { AgentPermission } from '@/features/agent-v2/acl'
+import { consoleQuery } from '@/service/console'
+import {
+  createNetworkAccessGroupFixture,
+  seedAppNetworkAccessGroup,
+  seedNetworkAccessGroups,
+} from '@/test/console/network-access'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
+import { createAgentFixture } from '@/test/fixtures/agent'
+import { AgentAccessPage } from '../page'
+
+vi.mock('@/context/i18n', () => ({
+  useDocLink: () => (path: string) => `https://docs.example.test${path}`,
+}))
+
+// These cards own independent publishing and API-key workflows.
+vi.mock('../components/web-app-access-card', () => ({ WebAppAccessCard: () => null }))
+vi.mock('../components/service-api-access-card', () => ({ ServiceApiAccessCard: () => null }))
+vi.mock('../components/workflow-references-table', () => ({ WorkflowReferencesTable: () => null }))
+
+vi.mock('react-i18next', async () => {
+  const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  return createReactI18nextMock({
+    'studio.accessControl.entryLabel': 'Access Control',
+    'studio.accessControl.chipOff': 'Off',
+    'studio.accessControl.chipOn': 'ON',
+    'studio.accessControl.chipPartial': '{{n}} of {{m}}',
+    'studio.accessControl.restrictByIp': 'Restrict by IP address',
+    'studio.accessControl.protectingAll': 'Protecting all {{count}} access points.',
+    'studio.accessControl.selectPolicy': 'Select a policy',
+    'studio.accessControl.ipPolicy': 'IP Policy',
+    'studio.accessControl.manageIpPolicies': 'Manage IP policies',
+    'overview.appInfo.title': 'Web App',
+    'overview.apiInfo.title': 'Backend Service API',
+    'mcp.server.title': 'MCP Server',
+    'settings.trigger': 'Trigger',
+    'operation.save': 'Save',
+    'operation.edit': 'Edit',
+    'operation.cancel': 'Cancel',
+  })
+})
+
+function setup(overrides: Partial<AgentAppDetailWithSite> = {}, configured = false) {
+  const queryClient = createConsoleQueryClient()
+  const agent = createAgentFixture({
+    app_id: 'public-app',
+    backing_app_id: 'runtime-app',
+    hidden_app_backed: false,
+    ...overrides,
+  })
+  queryClient.setQueryData(
+    consoleQuery.agent.byAgentId.get.queryKey({ input: { params: { agent_id: agent.id } } }),
+    agent,
+  )
+  const policy = createNetworkAccessGroupFixture()
+  seedNetworkAccessGroups(queryClient, { groups: [policy] })
+  const binding = configured
+    ? {
+        id: 'binding-1',
+        tenant_id: 'workspace-1',
+        app_id: 'public-app',
+        enabled: true,
+        group_id: policy.id,
+        access_points: ['webapp', 'service_api'] as const,
+        version: 1,
+        updated_by_account_id: null,
+        created_at: policy.created_at,
+        updated_at: policy.updated_at,
+      }
+    : null
+  const appBinding = seedAppNetworkAccessGroup(queryClient, 'public-app', {
+    available_access_points: ['webapp', 'service_api'],
+    binding: binding ? { ...binding, access_points: [...binding.access_points] } : null,
+    effective_enabled: configured,
+  })
+  const renderPage = (agentId: string) => (
+    <NuqsTestingAdapter>
+      <AgentAccessPage agentId={agentId} />
+    </NuqsTestingAdapter>
+  )
+  const rendered = renderWithConsoleQuery(renderPage(agent.id), {
+    queryClient,
+    currentWorkspace: { id: 'workspace-1', role: 'editor' },
+    systemFeatures: { deployment_edition: 'CLOUD' },
+  })
+  return { ...rendered, agent, policy, appBinding, renderPage }
+}
+
+describe('Agent IP access configuration', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('lets an Editor configure the public App ID with exactly two access points', async () => {
+    const user = userEvent.setup()
+    const { appBinding, policy } = setup({
+      access_ready: false,
+      enable_site: false,
+      enable_api: false,
+    })
+    const writes: Array<{ url: string; body: unknown }> = []
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      if (request.method === 'PUT') {
+        const body = await request.json()
+        writes.push({ url: request.url, body })
+      }
+      if (request.url.includes('/workspaces/current/network-access-groups'))
+        return Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [policy] })
+      return Response.json(appBinding)
+    })
+
+    await user.click(await screen.findByRole('button', { name: /Access Control/ }))
+    expect(screen.getByRole('switch', { name: 'Web App' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toBeChecked()
+    expect(screen.queryByRole('switch', { name: 'MCP Server' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+
+    await waitFor(() =>
+      expect(writes).toEqual([
+        {
+          url: 'http://localhost:5001/console/api/apps/public-app/network-access-group',
+          body: {
+            enabled: true,
+            group_id: 'group-1',
+            access_points: ['webapp', 'service_api'],
+            expected_version: 0,
+          },
+        },
+      ]),
+    )
+  })
+
+  it.each([{ app_id: null }, { hidden_app_backed: true }, { permission_keys: [] }])(
+    'does not offer an independent IP binding for an ineligible Agent: %o',
+    (overrides) => {
+      setup(overrides)
+      expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+      expect(globalThis.fetch).not.toHaveBeenCalled()
+    },
+  )
+
+  it('shows both protected endpoints as complete coverage for a read-only Agent', async () => {
+    const user = userEvent.setup()
+    setup({ permission_keys: [AgentPermission.AccessPointView] }, true)
+    const chip = await screen.findByRole('button', { name: /Access Control/ })
+    expect(chip).toHaveTextContent('ON')
+    await user.click(chip)
+    expect(screen.getByText('Protecting all 2 access points.')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+    const toggle = screen.getByRole('switch', { name: 'Restrict by IP address' })
+    expect(toggle).toHaveAttribute('aria-disabled', 'true')
+    await user.click(toggle)
+    expect(toggle).toBeChecked()
+    expect(
+      vi
+        .mocked(globalThis.fetch)
+        .mock.calls.filter(([input]) => input instanceof Request && input.method !== 'GET'),
+    ).toHaveLength(0)
+  })
+
+  it('closes an unsaved policy draft when switching Agents', async () => {
+    const user = userEvent.setup()
+    const { queryClient, rerender, renderPage } = setup()
+    await user.click(await screen.findByRole('button', { name: /Access Control/ }))
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('switch', { name: 'Backend Service API' }))
+
+    const second = createAgentFixture({ id: 'agent-2', app_id: 'second-app' })
+    queryClient.setQueryData(
+      consoleQuery.agent.byAgentId.get.queryKey({ input: { params: { agent_id: second.id } } }),
+      second,
+    )
+    seedAppNetworkAccessGroup(queryClient, 'second-app', {
+      available_access_points: ['webapp', 'service_api'],
+    })
+    rerender(renderPage(second.id))
+    await waitFor(() =>
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+    )
+    await user.click(screen.getByRole('button', { name: /Access Control/ }))
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toBeChecked()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  })
+})
diff --git a/web/features/agent-v2/agent-detail/access/page.tsx b/web/features/agent-v2/agent-detail/access/page.tsx
index bb8a00ddd4f86e..0de9770a2ab4e6 100644
--- a/web/features/agent-v2/agent-detail/access/page.tsx
+++ b/web/features/agent-v2/agent-detail/access/page.tsx
@@ -9,7 +9,9 @@ import {
 } from '@langgenius/dify-ui/scroll-area'
 import { useQuery } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
+import { AccessControlEntry } from '@/app/components/app/access-point/access-control'
 import { useDocLink } from '@/context/i18n'
+import { getAgentACLCapabilities } from '@/features/agent-v2/acl'
 import { consoleQuery } from '@/service/console'
 import { AgentDetailSectionSurface } from '../section-surface'
 import { ServiceApiAccessCard } from './components/service-api-access-card'
@@ -32,10 +34,12 @@ export function AgentAccessPage({ agentId }: AgentAccessPageProps) {
       },
     }),
   )
+  const agent = agentQuery.data
+  const capabilities = getAgentACLCapabilities(agent?.permission_keys)
 
   return (
     <AgentDetailSectionSurface label={t(($) => $['agentDetail.sections.access'])}>
-      <header className="h-15.5 shrink-0 px-6 pt-3 pb-2">
+      <header className="flex shrink-0 flex-wrap items-start justify-between gap-3 px-6 pt-3 pb-2">
         <div className="min-w-0">
           <h2 className="system-xl-semibold text-text-primary">
             {t(($) => $['agentDetail.access.title'])}
@@ -53,6 +57,19 @@ export function AgentAccessPage({ agentId }: AgentAccessPageProps) {
             </a>
           </p>
         </div>
+        {agent?.app_id && !agent.hidden_app_backed && capabilities.canViewAccessPoint && (
+          <AccessControlEntry
+            appId={agent.app_id}
+            appIcon={{
+              iconType:
+                agent.icon_type === 'image' || agent.icon_type === 'link' ? 'image' : 'emoji',
+              icon: agent.icon ?? undefined,
+              background: agent.icon_background,
+              imageUrl: agent.icon_url,
+            }}
+            canEditBinding={capabilities.canManageAccessPoint}
+          />
+        )}
       </header>
 
       <ScrollArea className="min-h-0 flex-1 overflow-hidden">

From aecdac0441015088877a2c2ef0547608412596ac Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 11:08:50 +0800
Subject: [PATCH 034/108] fix(web): match disabled access point label to design

---
 .../components/app/access-point/access-control/status-panel.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index 962e1df6537d00..ede80770a31a80 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -196,7 +196,7 @@ export function AccessControlStatusPanel({
                 </span>
                 {excluded && (
                   <span className="min-w-0 flex-1 text-right system-xs-regular text-text-quaternary">
-                    {t(($) => $['studio.accessControl.excluded'], { ns: 'deployments' })}
+                    {t(($) => $['studio.accessControl.notEnabled'], { ns: 'deployments' })}
                   </span>
                 )}
               </div>

From a2c08682973becf932e71335796588af56d45043 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 11:21:43 +0800
Subject: [PATCH 035/108] fix(ci): expose API documentation converter errors

---
 api/dev/generate_swagger_markdown_docs.py     |  7 +++++
 .../test_generate_swagger_markdown_docs.py    | 28 +++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/api/dev/generate_swagger_markdown_docs.py b/api/dev/generate_swagger_markdown_docs.py
index a9451c52778d52..9b13b7502a7b9f 100644
--- a/api/dev/generate_swagger_markdown_docs.py
+++ b/api/dev/generate_swagger_markdown_docs.py
@@ -223,6 +223,13 @@ def _convert_spec_to_markdown(spec_path: Path, markdown_path: Path) -> None:
             text=True,
         )
         if result.returncode != 0:
+            logger.error(
+                "swagger-markdown failed for %s (exit code %s)\nstdout:\n%s\nstderr:\n%s",
+                spec_path,
+                result.returncode,
+                result.stdout,
+                result.stderr,
+            )
             raise subprocess.CalledProcessError(
                 result.returncode,
                 result.args,
diff --git a/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py b/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
index 9231e274d5c0b1..8bdaa2dc2966d8 100644
--- a/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
+++ b/api/tests/unit_tests/commands/test_generate_swagger_markdown_docs.py
@@ -403,6 +403,34 @@ def test_patch_union_schema_markdown_ignores_unrenderable_shapes(tmp_path: Path)
     assert module._patch_union_schema_markdown("#### BrokenUnion\n", spec_path) == "#### BrokenUnion\n"
 
 
+def test_convert_spec_to_markdown_logs_converter_failure_without_overwriting_docs(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, caplog: pytest.LogCaptureFixture
+):
+    module = _load_generate_swagger_markdown_docs_module()
+    spec_path = tmp_path / "console-openapi.json"
+    output_path = tmp_path / "console-openapi.md"
+    spec_path.write_text("{}", encoding="utf-8")
+    output_path.write_text("Existing documentation\n", encoding="utf-8")
+
+    def run_converter(args, **_kwargs):
+        return module.subprocess.CompletedProcess(
+            args=args, returncode=1, stdout="Loading converter", stderr="Unable to resolve npm runtime"
+        )
+
+    monkeypatch.setattr(module.subprocess, "run", run_converter)
+
+    with pytest.raises(module.subprocess.CalledProcessError) as exc_info:
+        module._convert_spec_to_markdown(spec_path, output_path)
+
+    assert exc_info.value.returncode == 1
+    assert exc_info.value.stdout == "Loading converter"
+    assert exc_info.value.stderr == "Unable to resolve npm runtime"
+    assert str(spec_path) in caplog.text
+    assert "Loading converter" in caplog.text
+    assert "Unable to resolve npm runtime" in caplog.text
+    assert output_path.read_text(encoding="utf-8") == "Existing documentation\n"
+
+
 def test_convert_spec_to_markdown_patches_generated_union_tables(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     module = _load_generate_swagger_markdown_docs_module()
     spec_path = tmp_path / "console-openapi.json"

From b2a0bc1483e3a02443c1d616954b042d83e624e3 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 17 Sep 2026 11:25:22 +0800
Subject: [PATCH 036/108] fix(ci): use system npm with pnpm-managed Node

---
 .github/actions/setup-web/action.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/actions/setup-web/action.yml b/.github/actions/setup-web/action.yml
index 69565020d793f3..7cd9a0be7e774a 100644
--- a/.github/actions/setup-web/action.yml
+++ b/.github/actions/setup-web/action.yml
@@ -14,3 +14,7 @@ runs:
         node-manager: false
         cache: true
         run-install: true
+    - name: Use system npm and npx
+      shell: bash
+      # pnpm's Node runtime does not bundle npm/npx, so Vite+ must use the runner's tools.
+      run: vp env off npm

From fbc723df15d9b4a0caa3377bce5521dece3093e2 Mon Sep 17 00:00:00 2001
From: yyh <92089059+lyzno1@users.noreply.github.com>
Date: Thu, 17 Sep 2026 12:18:35 +0800
Subject: [PATCH 037/108] Update .github/actions/setup-web/action.yml

---
 .github/actions/setup-web/action.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/actions/setup-web/action.yml b/.github/actions/setup-web/action.yml
index 7cd9a0be7e774a..69565020d793f3 100644
--- a/.github/actions/setup-web/action.yml
+++ b/.github/actions/setup-web/action.yml
@@ -14,7 +14,3 @@ runs:
         node-manager: false
         cache: true
         run-install: true
-    - name: Use system npm and npx
-      shell: bash
-      # pnpm's Node runtime does not bundle npm/npx, so Vite+ must use the runner's tools.
-      run: vp env off npm

From 9d1cfbf5fe2c36eea44b1a24afd9ef97edc07a84 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 13:18:23 +0800
Subject: [PATCH 038/108] feat(web): align IP policy deletion dialog with
 design

---
 .../ip-policies-page/__tests__/index.spec.tsx | 137 ++++++++++++++++--
 .../ip-policies-page/policy-item.tsx          |  70 ++++++---
 .../ip-policies-page/referenced-apps.tsx      |  10 +-
 web/i18n/ar-TN/common.json                    |   7 +-
 web/i18n/de-DE/common.json                    |   7 +-
 web/i18n/en-US/common.json                    |   7 +-
 web/i18n/es-ES/common.json                    |   7 +-
 web/i18n/fa-IR/common.json                    |   7 +-
 web/i18n/fr-FR/common.json                    |   7 +-
 web/i18n/hi-IN/common.json                    |   7 +-
 web/i18n/id-ID/common.json                    |   7 +-
 web/i18n/it-IT/common.json                    |   7 +-
 web/i18n/ja-JP/common.json                    |   7 +-
 web/i18n/ko-KR/common.json                    |   7 +-
 web/i18n/lo-LA/common.json                    |   7 +-
 web/i18n/nl-NL/common.json                    |   7 +-
 web/i18n/pl-PL/common.json                    |   7 +-
 web/i18n/pt-BR/common.json                    |   7 +-
 web/i18n/ro-RO/common.json                    |   7 +-
 web/i18n/ru-RU/common.json                    |   7 +-
 web/i18n/sl-SI/common.json                    |   7 +-
 web/i18n/th-TH/common.json                    |   7 +-
 web/i18n/tr-TR/common.json                    |   7 +-
 web/i18n/uk-UA/common.json                    |   7 +-
 web/i18n/vi-VN/common.json                    |   7 +-
 web/i18n/zh-Hans/common.json                  |   7 +-
 web/i18n/zh-Hant/common.json                  |   7 +-
 27 files changed, 276 insertions(+), 109 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index be4ca58c350fc9..61b38166cc6910 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -1,6 +1,8 @@
 import { act, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import { initReactI18next } from 'react-i18next'
 import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
 import {
   createNetworkAccessGroupFixture,
@@ -33,8 +35,11 @@ const translations = vi.hoisted(() => ({
   'settings.ipPolicyEnforcingOne': '1 app',
   'settings.ipPolicyDeleteBound': 'This policy is in use',
   'settings.ipPolicyDeleteBoundDescription':
-    '{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
-  'settings.ipPolicyDeleteConfirm': 'Delete “{{name}}”?',
+    'Delete <policyName>{{name}}</policyName>? These apps will allow access from any IP address. This cannot be undone.',
+  'settings.ipPolicyDeleteConfirm': 'Delete IP policy?',
+  'settings.ipPolicyDeleteDescription':
+    'Delete <policyName>{{name}}</policyName>? This cannot be undone.',
+  'settings.ipPolicyUsedBy': 'Used by {{count}} apps',
   'settings.ipPolicyUsedByLabel': 'Used by',
   'settings.ipPolicyDialogDescription':
     'Specify which IP addresses or ranges can access your apps.',
@@ -47,14 +52,21 @@ const translations = vi.hoisted(() => ({
   'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
 }))
 
-vi.mock('react-i18next', async () => {
-  const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  return createReactI18nextMock(translations)
-})
+vi.unmock('react-i18next')
 
 describe('IpPoliciesPage', () => {
-  beforeEach(() => {
+  beforeEach(async () => {
     vi.clearAllMocks()
+    await createInstance()
+      .use(initReactI18next)
+      .init({
+        lng: 'en-US',
+        fallbackLng: 'en-US',
+        defaultNS: 'common',
+        keySeparator: false,
+        interpolation: { escapeValue: false },
+        resources: { 'en-US': { common: translations, deployments: translations } },
+      })
   })
 
   it.each([true, false])(
@@ -433,17 +445,114 @@ describe('IpPoliciesPage', () => {
 
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
     await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
-    expect(screen.getByRole('heading', { name: 'Delete “Internal Network”?' })).toBeInTheDocument()
-    expect(
-      screen.getByText(
-        'Internal Network is applied to 2 apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.',
-      ),
-    ).toBeInTheDocument()
-    const dialog = screen.getByRole('alertdialog')
+    const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
+    expect(dialog).toHaveAccessibleDescription(
+      /Delete Internal Network\s*\? These apps will allow access from any IP address\. This cannot be undone\./,
+    )
+    expect(within(dialog).getByText('Internal Network', { selector: 'strong' })).toBeInTheDocument()
+    expect(within(dialog).getByText('Used by 2 apps')).toBeInTheDocument()
+    expect(globalThis.fetch).not.toHaveBeenCalled()
     expect(within(dialog).getByRole('button', { name: 'Delete' })).toBeEnabled()
     expect(within(dialog).getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
       'href',
       '/app/app-a/overview',
     )
   })
+
+  it.each(['Cancel', 'Close'])(
+    'dismisses deletion through %s without deleting the policy',
+    async (button) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { groups: [createNetworkAccessGroupFixture()] })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+      )
+
+      await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+      await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
+      const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
+      expect(dialog).toHaveAccessibleDescription(
+        /Delete Internal Network\s*\? This cannot be undone\./,
+      )
+      expect(within(dialog).queryByText(/Used by/)).not.toBeInTheDocument()
+      await user.click(within(dialog).getByRole('button', { name: button }))
+
+      await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
+      expect(screen.getByRole('button', { name: 'Internal Network' })).toBeInTheDocument()
+      expect(globalThis.fetch).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each([true, false])(
+    'waits for deletion and only closes on success (success: %s)',
+    async (succeeds) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      const group = createNetworkAccessGroupFixture({ version: 7 })
+      seedNetworkAccessGroups(queryClient, { groups: [group] })
+      let resolveDeletion!: (response: Response) => void
+      const deletion = new Promise<Response>((resolve) => {
+        resolveDeletion = resolve
+      })
+      const deleteRequests: Request[] = []
+      vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+        const request = input instanceof Request ? input : new Request(String(input), init)
+        if (request.method === 'DELETE') {
+          deleteRequests.push(request)
+          return deletion
+        }
+        return new Response(JSON.stringify({ groups: [], entitled: true }), {
+          headers: { 'content-type': 'application/json' },
+        })
+      })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+      )
+
+      await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+      await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
+      const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
+      const deleteButton = within(dialog).getByRole('button', { name: 'Delete' })
+      await user.click(deleteButton)
+
+      await waitFor(() => expect(deleteButton).toHaveAttribute('aria-disabled', 'true'))
+      expect(within(dialog).getByRole('button', { name: 'Cancel' })).toBeDisabled()
+      expect(within(dialog).getByRole('button', { name: 'Close' })).toBeDisabled()
+      await user.click(deleteButton)
+      await user.keyboard('{Escape}')
+      expect(dialog).toBeInTheDocument()
+      expect(deleteRequests).toHaveLength(1)
+      expect(deleteRequests[0]?.url).toContain('group-1?expected_version=7')
+
+      await act(async () => {
+        resolveDeletion(
+          succeeds
+            ? new Response(null, { status: 204 })
+            : new Response(JSON.stringify({ message: 'Unable to delete policy' }), {
+                status: 500,
+                headers: { 'content-type': 'application/json' },
+              }),
+        )
+      })
+
+      if (succeeds) {
+        await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
+        expect(screen.queryByRole('button', { name: 'Internal Network' })).not.toBeInTheDocument()
+      } else {
+        await waitFor(() => expect(deleteButton).not.toHaveAttribute('aria-disabled', 'true'))
+        expect(dialog).toBeInTheDocument()
+        expect(within(dialog).getByRole('button', { name: 'Cancel' })).toBeEnabled()
+        await user.click(within(dialog).getByRole('button', { name: 'Cancel' }))
+        await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
+        expect(screen.getByRole('button', { name: 'Internal Network' })).toBeInTheDocument()
+      }
+    },
+  )
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index faaea41b499410..91d4c504e4393d 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -21,7 +21,7 @@ import {
 import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
-import { useTranslation } from 'react-i18next'
+import { Trans, useTranslation } from 'react-i18next'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { consoleQuery } from '@/service/console'
 import { PolicyReferencedApps } from './referenced-apps'
@@ -60,7 +60,7 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
           })
 
   const handleDelete = () => {
-    if (!canMutate) return
+    if (!canMutate || deleteGroup.isPending) return
 
     deleteGroup.mutate(
       {
@@ -141,31 +141,63 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
           </DropdownMenu>
         )}
       </div>
-      <AlertDialog open={confirmDelete && canMutate} onOpenChange={setConfirmDelete}>
-        <AlertDialogContent backdropProps={{ forceRender: true }} className="w-100">
-          <div className="flex flex-col gap-2 p-6 pb-4">
-            <AlertDialogTitle className="title-xl-semi-bold text-text-primary">
-              {t(($) => $['settings.ipPolicyDeleteConfirm'], { ns: 'common', name: group.name })}
+      <AlertDialog
+        open={confirmDelete && canMutate}
+        onOpenChange={(open) => {
+          if (!deleteGroup.isPending) setConfirmDelete(open)
+        }}
+      >
+        <AlertDialogContent
+          backdropProps={{ forceRender: true }}
+          className="flex w-120 flex-col gap-6 p-6 shadow-xl"
+        >
+          <div className="flex items-start gap-4">
+            <AlertDialogTitle className="min-w-0 flex-1 title-2xl-semi-bold text-text-primary">
+              {t(($) => $['settings.ipPolicyDeleteConfirm'], { ns: 'common' })}
             </AlertDialogTitle>
-            <AlertDialogDescription className="system-sm-regular text-text-secondary">
-              {isBound
-                ? t(($) => $['settings.ipPolicyDeleteBoundDescription'], {
-                    ns: 'common',
-                    name: group.name,
-                    count: group.used_by_count,
-                  })
-                : t(($) => $['settings.ipPolicyDeleteDescription'], { ns: 'common' })}
+            <IconButton
+              size="lg"
+              aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+              disabled={deleteGroup.isPending}
+              onClick={() => setConfirmDelete(false)}
+            >
+              <span aria-hidden className="i-ri-close-line size-4" />
+            </IconButton>
+          </div>
+          <div className="flex flex-col gap-4">
+            <AlertDialogDescription className="text-sm leading-5.5 wrap-anywhere text-text-tertiary">
+              <Trans
+                ns="common"
+                i18nKey={
+                  isBound
+                    ? ($) => $['settings.ipPolicyDeleteBoundDescription']
+                    : ($) => $['settings.ipPolicyDeleteDescription']
+                }
+                values={{ name: group.name }}
+                components={{ policyName: <strong className="font-semibold" /> }}
+              />
             </AlertDialogDescription>
             {isBound && (
-              <PolicyReferencedApps apps={group.apps} usedByCount={group.used_by_count} />
+              <div className="flex flex-col gap-3">
+                <p className="system-sm-medium text-text-secondary">
+                  {t(($) => $['settings.ipPolicyUsedBy'], {
+                    ns: 'common',
+                    count: group.used_by_count,
+                  })}
+                </p>
+                {group.apps.length > 0 && (
+                  <PolicyReferencedApps apps={group.apps} usedByCount={group.used_by_count} />
+                )}
+              </div>
             )}
           </div>
-          <AlertDialogActions>
-            <AlertDialogCancelButton variant="secondary">
+          <AlertDialogActions className="p-0 pt-2">
+            <AlertDialogCancelButton variant="secondary" disabled={deleteGroup.isPending}>
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </AlertDialogCancelButton>
             <AlertDialogConfirmButton
-              disabled={!canMutate || deleteGroup.isPending}
+              disabled={!canMutate}
+              loading={deleteGroup.isPending}
               onClick={handleDelete}
             >
               {t(($) => $['operation.delete'], { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
index 6b4ba9edefa886..de2788e000aabb 100644
--- a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
@@ -30,12 +30,12 @@ export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedApps
   return (
     <ul className="flex flex-wrap content-start items-start gap-2">
       {apps.map((app) => (
-        <li key={app.id}>
+        <li key={app.id} className="max-w-full min-w-0">
           <a
             href={`/app/${app.id}/overview`}
             target="_blank"
             rel="noreferrer"
-            className="flex min-h-7 items-center gap-1.5 rounded-md border border-components-panel-border-subtle bg-background-default py-1 pr-1.5 pl-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+            className="flex min-h-7 max-w-full items-center gap-1.5 rounded-md border border-components-panel-border-subtle bg-background-default py-1 pr-1.5 pl-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
           >
             <AppIcon
               size="xs"
@@ -43,9 +43,11 @@ export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedApps
               iconType={toAppIconType(app.icon_type)}
               icon={app.icon ?? undefined}
               background={app.icon_background}
-              className="size-5 rounded-sm"
+              className="size-5 shrink-0 rounded-sm"
             />
-            <span className="system-sm-medium whitespace-nowrap text-text-primary">{app.name}</span>
+            <span className="min-w-0 system-sm-medium wrap-anywhere text-text-primary">
+              {app.name}
+            </span>
             <span
               aria-hidden
               className="i-ri-arrow-right-up-line size-3.5 shrink-0 text-text-tertiary"
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index 6dedf5fed9b3eb..d1447f738d7d9c 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "هل تريد حذف <policyName>{{name}}</policyName>؟ ستسمح هذه التطبيقات بالوصول من أي عنوان IP. لا يمكن التراجع عن هذا الإجراء.",
+  "settings.ipPolicyDeleteConfirm": "حذف سياسة IP؟",
+  "settings.ipPolicyDeleteDescription": "هل تريد حذف <policyName>{{name}}</policyName>؟ لا يمكن التراجع عن هذا الإجراء.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "مستخدم بواسطة",
+  "settings.ipPolicyUsedBy_one": "يستخدمه {{count}} تطبيق",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 1dc71f753c4e9c..76ea7a6f60d340 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> löschen? Diese Apps erlauben dann den Zugriff von jeder IP-Adresse. Dies kann nicht rückgängig gemacht werden.",
+  "settings.ipPolicyDeleteConfirm": "IP-Richtlinie löschen?",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> löschen? Dies kann nicht rückgängig gemacht werden.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Verwendet von",
+  "settings.ipPolicyUsedBy_one": "Von {{count}} App verwendet",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 449aa9927f0b6c..99f72fb6f345c9 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Delete <policyName>{{name}}</policyName>? These apps will allow access from any IP address. This cannot be undone.",
+  "settings.ipPolicyDeleteConfirm": "Delete IP policy?",
+  "settings.ipPolicyDeleteDescription": "Delete <policyName>{{name}}</policyName>? This cannot be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Used by",
+  "settings.ipPolicyUsedBy_one": "Used by {{count}} app",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 62472fd194b3d4..8efc98c6a91d13 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "¿Eliminar <policyName>{{name}}</policyName>? Estas aplicaciones permitirán el acceso desde cualquier dirección IP. Esta acción no se puede deshacer.",
+  "settings.ipPolicyDeleteConfirm": "¿Eliminar la política de IP?",
+  "settings.ipPolicyDeleteDescription": "¿Eliminar <policyName>{{name}}</policyName>? Esta acción no se puede deshacer.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Usado por",
+  "settings.ipPolicyUsedBy_one": "Usada por {{count}} aplicación",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index da7113012485bf..592198de2a0727 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "آیا <policyName>{{name}}</policyName> حذف شود؟ این برنامه‌ها دسترسی از هر نشانی IP را مجاز خواهند کرد. این اقدام قابل بازگشت نیست.",
+  "settings.ipPolicyDeleteConfirm": "خط‌مشی IP حذف شود؟",
+  "settings.ipPolicyDeleteDescription": "آیا <policyName>{{name}}</policyName> حذف شود؟ این اقدام قابل بازگشت نیست.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "استفاده‌شده توسط",
+  "settings.ipPolicyUsedBy_one": "استفاده‌شده توسط {{count}} برنامه",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index e4d1e07f4958b7..bdc908f5eb2ac5 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Supprimer <policyName>{{name}}</policyName> ? Ces applications autoriseront l’accès depuis n’importe quelle adresse IP. Cette action est irréversible.",
+  "settings.ipPolicyDeleteConfirm": "Supprimer la politique IP ?",
+  "settings.ipPolicyDeleteDescription": "Supprimer <policyName>{{name}}</policyName> ? Cette action est irréversible.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Utilisé par",
+  "settings.ipPolicyUsedBy_one": "Utilisée par {{count}} application",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index b9293da3e8a2f2..1317dc3a2caf17 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> हटाएं? ये ऐप किसी भी IP पते से एक्सेस की अनुमति देंगे। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
+  "settings.ipPolicyDeleteConfirm": "IP नीति हटाएं?",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> हटाएं? इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "इनके द्वारा उपयोग",
+  "settings.ipPolicyUsedBy_one": "{{count}} ऐप द्वारा उपयोग में",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 9cc3eaeee7c142..f98414a7ddbd80 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Hapus <policyName>{{name}}</policyName>? Aplikasi ini akan mengizinkan akses dari alamat IP mana pun. Tindakan ini tidak dapat dibatalkan.",
+  "settings.ipPolicyDeleteConfirm": "Hapus kebijakan IP?",
+  "settings.ipPolicyDeleteDescription": "Hapus <policyName>{{name}}</policyName>? Tindakan ini tidak dapat dibatalkan.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Digunakan oleh",
+  "settings.ipPolicyUsedBy_one": "Digunakan oleh {{count}} aplikasi",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 46de63d041c247..a00507835a54b7 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Eliminare <policyName>{{name}}</policyName>? Queste app consentiranno l’accesso da qualsiasi indirizzo IP. Questa azione non può essere annullata.",
+  "settings.ipPolicyDeleteConfirm": "Eliminare la policy IP?",
+  "settings.ipPolicyDeleteDescription": "Eliminare <policyName>{{name}}</policyName>? Questa azione non può essere annullata.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Usato da",
+  "settings.ipPolicyUsedBy_one": "Usata da {{count}} app",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 7117cf812ee652..9a28f184c3b56f 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> を削除しますか？これらのアプリは任意の IP アドレスからアクセスできるようになります。この操作は取り消せません。",
+  "settings.ipPolicyDeleteConfirm": "IP ポリシーを削除しますか？",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> を削除しますか？この操作は取り消せません。",
   "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "エントリを削除",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "使用中",
+  "settings.ipPolicyUsedBy_one": "{{count}} 個のアプリで使用中",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 52cc46289c1213..3048cd38ae072e 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName>을(를) 삭제하시겠습니까? 이 앱들은 모든 IP 주소에서 접근할 수 있게 됩니다. 이 작업은 되돌릴 수 없습니다.",
+  "settings.ipPolicyDeleteConfirm": "IP 정책을 삭제하시겠습니까?",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName>을(를) 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "사용 중",
+  "settings.ipPolicyUsedBy_one": "{{count}}개 앱에서 사용 중",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index aee97f3f3c6ce9..d5ab2d84dcdf33 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "ລຶບ <policyName>{{name}}</policyName> ຫຼືບໍ່? ແອັບເຫຼົ່ານີ້ຈະອະນຸຍາດໃຫ້ເຂົ້າເຖິງຈາກທີ່ຢູ່ IP ໃດກໍໄດ້. ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
+  "settings.ipPolicyDeleteConfirm": "ລຶບນະໂຍບາຍ IP ຫຼືບໍ່?",
+  "settings.ipPolicyDeleteDescription": "ລຶບ <policyName>{{name}}</policyName> ຫຼືບໍ່? ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "ຖືກໃຊ້ໂດຍ",
+  "settings.ipPolicyUsedBy_one": "ຖືກໃຊ້ໂດຍ {{count}} ແອັບ",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 7fa4620816be8b..2c98a328a46197 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> verwijderen? Deze apps staan dan toegang vanaf elk IP-adres toe. Dit kan niet ongedaan worden gemaakt.",
+  "settings.ipPolicyDeleteConfirm": "IP-beleid verwijderen?",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> verwijderen? Dit kan niet ongedaan worden gemaakt.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Gebruikt door",
+  "settings.ipPolicyUsedBy_one": "Gebruikt door {{count}} app",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index b54b7a7616bb8a..988fe693672a9d 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Usunąć <policyName>{{name}}</policyName>? Te aplikacje będą zezwalać na dostęp z dowolnego adresu IP. Tej operacji nie można cofnąć.",
+  "settings.ipPolicyDeleteConfirm": "Usunąć politykę IP?",
+  "settings.ipPolicyDeleteDescription": "Usunąć <policyName>{{name}}</policyName>? Tej operacji nie można cofnąć.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Używane przez",
+  "settings.ipPolicyUsedBy_one": "Używana przez {{count}} aplikację",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index 4b511f33fcb670..ee9613cc6a115e 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Excluir <policyName>{{name}}</policyName>? Esses aplicativos permitirão o acesso de qualquer endereço IP. Esta ação não pode ser desfeita.",
+  "settings.ipPolicyDeleteConfirm": "Excluir política de IP?",
+  "settings.ipPolicyDeleteDescription": "Excluir <policyName>{{name}}</policyName>? Esta ação não pode ser desfeita.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Usado por",
+  "settings.ipPolicyUsedBy_one": "Usada por {{count}} aplicativo",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index f19b579cfe36c6..2cef8176e76648 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Ștergeți <policyName>{{name}}</policyName>? Aceste aplicații vor permite accesul de la orice adresă IP. Această acțiune nu poate fi anulată.",
+  "settings.ipPolicyDeleteConfirm": "Ștergeți politica IP?",
+  "settings.ipPolicyDeleteDescription": "Ștergeți <policyName>{{name}}</policyName>? Această acțiune nu poate fi anulată.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Folosit de",
+  "settings.ipPolicyUsedBy_one": "Utilizată de {{count}} aplicație",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index c5273e3d403448..8bea0b21adce0a 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Удалить <policyName>{{name}}</policyName>? Эти приложения станут доступны с любого IP-адреса. Это действие нельзя отменить.",
+  "settings.ipPolicyDeleteConfirm": "Удалить IP-политику?",
+  "settings.ipPolicyDeleteDescription": "Удалить <policyName>{{name}}</policyName>? Это действие нельзя отменить.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Используется",
+  "settings.ipPolicyUsedBy_one": "Используется {{count}} приложением",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 3b39912ceb2e55..810d24437fdbc8 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Izbrišem <policyName>{{name}}</policyName>? Te aplikacije bodo dovolile dostop s katerega koli naslova IP. Tega dejanja ni mogoče razveljaviti.",
+  "settings.ipPolicyDeleteConfirm": "Izbrišem pravilnik IP?",
+  "settings.ipPolicyDeleteDescription": "Izbrišem <policyName>{{name}}</policyName>? Tega dejanja ni mogoče razveljaviti.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Uporablja",
+  "settings.ipPolicyUsedBy_one": "Uporablja jo {{count}} aplikacija",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 7a169f5a2bb012..89942ee87b9a68 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "ลบ <policyName>{{name}}</policyName> หรือไม่? แอปเหล่านี้จะอนุญาตให้เข้าถึงจากที่อยู่ IP ใดก็ได้ การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "settings.ipPolicyDeleteConfirm": "ลบนโยบาย IP หรือไม่?",
+  "settings.ipPolicyDeleteDescription": "ลบ <policyName>{{name}}</policyName> หรือไม่? การดำเนินการนี้ไม่สามารถยกเลิกได้",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "ถูกใช้โดย",
+  "settings.ipPolicyUsedBy_one": "ใช้งานโดย {{count}} แอป",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 7bebb32a8458ad..76b9096f66011f 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> silinsin mi? Bu uygulamalar herhangi bir IP adresinden erişime izin verecek. Bu işlem geri alınamaz.",
+  "settings.ipPolicyDeleteConfirm": "IP politikası silinsin mi?",
+  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> silinsin mi? Bu işlem geri alınamaz.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Kullanan",
+  "settings.ipPolicyUsedBy_one": "{{count}} uygulama tarafından kullanılıyor",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index 7c8fa144e44912..b13ad3f6455379 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Видалити <policyName>{{name}}</policyName>? Ці застосунки дозволятимуть доступ із будь-якої IP-адреси. Цю дію неможливо скасувати.",
+  "settings.ipPolicyDeleteConfirm": "Видалити IP-політику?",
+  "settings.ipPolicyDeleteDescription": "Видалити <policyName>{{name}}</policyName>? Цю дію неможливо скасувати.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Використовується",
+  "settings.ipPolicyUsedBy_one": "Використовується {{count}} застосунком",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index a6e00910968026..b757865f7d5ebe 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} is applied to {{count}} apps. Deleting it turns off IP restriction for those apps, so they can be reached from any IP. Other app permissions stay the same.",
-  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
-  "settings.ipPolicyDeleteDescription": "This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Xóa <policyName>{{name}}</policyName>? Các ứng dụng này sẽ cho phép truy cập từ mọi địa chỉ IP. Không thể hoàn tác thao tác này.",
+  "settings.ipPolicyDeleteConfirm": "Xóa chính sách IP?",
+  "settings.ipPolicyDeleteDescription": "Xóa <policyName>{{name}}</policyName>? Không thể hoàn tác thao tác này.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "Remove entry",
   "settings.ipPolicyUsedBy": "Used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Được dùng bởi",
+  "settings.ipPolicyUsedBy_one": "Được {{count}} ứng dụng sử dụng",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 0496196501e43f..f6a34ea7c1dae9 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "该策略正在使用中",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} 已应用到 {{count}} 个应用。删除后这些应用将不再受 IP 限制，可从任意 IP 访问。其他登录与应用权限不变。",
-  "settings.ipPolicyDeleteConfirm": "删除“{{name}}”？",
-  "settings.ipPolicyDeleteDescription": "此操作无法撤销。",
+  "settings.ipPolicyDeleteBoundDescription": "确定删除 <policyName>{{name}}</policyName>？这些应用将允许从任意 IP 地址访问。此操作无法撤销。",
+  "settings.ipPolicyDeleteConfirm": "删除 IP 策略？",
+  "settings.ipPolicyDeleteDescription": "确定删除 <policyName>{{name}}</policyName>？此操作无法撤销。",
   "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
   "settings.ipPolicyEditUsedBy": "该策略已被 {{count}} 个应用使用。保存后会更新所有这些应用的允许列表。",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "删除条目",
   "settings.ipPolicyUsedBy": "已被 {{count}} 个应用使用",
   "settings.ipPolicyUsedByLabel": "被用于",
+  "settings.ipPolicyUsedBy_one": "已被 {{count}} 个应用使用",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index cf77466fd3ac69..8e2c4ec7968c6d 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -571,9 +571,9 @@
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "該策略正在使用中",
-  "settings.ipPolicyDeleteBoundDescription": "{{name}} 已套用到 {{count}} 個應用。刪除後這些應用將不再受 IP 限制，可從任意 IP 存取。其他登入與應用權限不變。",
-  "settings.ipPolicyDeleteConfirm": "刪除「{{name}}」？",
-  "settings.ipPolicyDeleteDescription": "此操作無法復原。",
+  "settings.ipPolicyDeleteBoundDescription": "確定刪除 <policyName>{{name}}</policyName>？這些應用程式將允許從任何 IP 位址存取。此操作無法復原。",
+  "settings.ipPolicyDeleteConfirm": "刪除 IP 原則？",
+  "settings.ipPolicyDeleteDescription": "確定刪除 <policyName>{{name}}</policyName>？此操作無法復原。",
   "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
   "settings.ipPolicyEditUsedBy": "該策略已被 {{count}} 個應用使用。儲存後會更新所有這些應用的允許清單。",
@@ -594,6 +594,7 @@
   "settings.ipPolicyRemoveEntry": "刪除條目",
   "settings.ipPolicyUsedBy": "已被 {{count}} 個應用使用",
   "settings.ipPolicyUsedByLabel": "被用於",
+  "settings.ipPolicyUsedBy_one": "已被 {{count}} 個應用使用",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",

From f01cdb35cd24e984d6972e0ade8a00261ef0b9cf Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Sun, 20 Sep 2026 15:52:36 +0800
Subject: [PATCH 039/108] fix(api): expose trusted current IP before policy
 creation

Refs SNP-835. Support the first Policy without relaxing trusted-proxy or persisted workspace-role checks.
---
 .../console/workspace/network_access_group.py |  33 ++
 api/openapi/markdown/console-openapi.md       |  15 +
 api/services/network_access_group_service.py  |  17 +
 .../workspace/test_network_access_group.py    | 149 ++++++-
 .../test_network_access_group_service.py      |  37 ++
 .../api/console/workspaces/orpc.gen.ts        | 414 +++++++++---------
 .../api/console/workspaces/types.gen.ts       |  23 +
 .../api/console/workspaces/zod.gen.ts         |  13 +
 .../network-access-current-ip.test.ts         |  39 ++
 9 files changed, 540 insertions(+), 200 deletions(-)
 create mode 100644 packages/contracts/network-access-current-ip.test.ts

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 19204fa0105adf..1d8626904b19ab 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -123,6 +123,10 @@ class NetworkAccessGroupDeleteResponse(ResponseModel):
     deleted: bool
 
 
+class NetworkAccessGroupCurrentIPResponse(ResponseModel):
+    client_ip: str
+
+
 class NetworkAccessGroupCurrentIPCheckResponse(ResponseModel):
     client_ip: str
     allowed: bool
@@ -189,6 +193,7 @@ class AppNetworkAccessGroupMutationResponse(ResponseModel):
     NetworkAccessGroupListResponse,
     NetworkAccessGroupMutationResponse,
     NetworkAccessGroupDeleteResponse,
+    NetworkAccessGroupCurrentIPResponse,
     NetworkAccessGroupCurrentIPCheckResponse,
     AppNetworkAccessGroupBindingResponse,
     AppNetworkAccessGroupResponse,
@@ -366,6 +371,34 @@ def delete(
         return _serialize_response(NetworkAccessGroupDeleteResponse, payload)
 
 
+@console_ns.route("/workspaces/current/network-access-groups/current-ip")
+class CurrentWorkspaceNetworkAccessGroupCurrentIPApi(Resource):
+    @console_ns.response(
+        200,
+        "Trusted current client IP retrieved without requiring an existing network access group",
+        console_ns.models[NetworkAccessGroupCurrentIPResponse.__name__],
+    )
+    @console_ns.response(403, "The workspace role does not allow network access policy reads")
+    @console_ns.response(503, "A trusted current client IP is unavailable")
+    @console_account_admission(editions=frozenset({DeploymentEdition.CLOUD}))
+    def get(self, request_context: RequestContext) -> dict[str, Any]:
+        @after_this_request
+        def disable_client_ip_response_cache(response: Response) -> Response:
+            response.headers["Cache-Control"] = "no-store"
+            return response
+
+        try:
+            payload = application_services().network_access_groups.get_current_ip(
+                request_context,
+                client_ip_supplier=_resolve_current_network_access_client_ip,
+            )
+        except NetworkAccessClientIPUnavailableError as exc:
+            raise ServiceUnavailable("Current client IP is unavailable.") from exc
+        except NetworkAccessGroupError as exc:
+            raise _translate_service_error(exc) from exc
+        return _serialize_response(NetworkAccessGroupCurrentIPResponse, payload)
+
+
 @console_ns.route("/workspaces/current/network-access-groups/<uuid:group_id>/check-current-ip")
 class CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi(Resource):
     @console_ns.response(
diff --git a/api/openapi/markdown/console-openapi.md b/api/openapi/markdown/console-openapi.md
index f629458521d8ee..4e1c7321a1fb92 100644
--- a/api/openapi/markdown/console-openapi.md
+++ b/api/openapi/markdown/console-openapi.md
@@ -10771,6 +10771,15 @@ Update a plugin endpoint
 | ---- | ----------- | ------ |
 | 201 | Workspace network access group created successfully | **application/json**: [NetworkAccessGroupMutationResponse](#networkaccessgroupmutationresponse)<br> |
 
+### [GET] /workspaces/current/network-access-groups/current-ip
+#### Responses
+
+| Code | Description | Schema |
+| ---- | ----------- | ------ |
+| 200 | Trusted current client IP retrieved without requiring an existing network access group | **application/json**: [NetworkAccessGroupCurrentIPResponse](#networkaccessgroupcurrentipresponse)<br> |
+| 403 | The workspace role does not allow network access policy reads |  |
+| 503 | A trusted current client IP is unavailable |  |
+
 ### [DELETE] /workspaces/current/network-access-groups/{group_id}
 #### Parameters
 
@@ -19987,6 +19996,12 @@ Model with provider entity.
 | client_ip | string |  | Yes |
 | policy_version | integer |  | Yes |
 
+#### NetworkAccessGroupCurrentIPResponse
+
+| Name | Type | Description | Required |
+| ---- | ---- | ----------- | -------- |
+| client_ip | string |  | Yes |
+
 #### NetworkAccessGroupDeleteResponse
 
 | Name | Type | Description | Required |
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index d692b90d779040..9005604fb68348 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -287,6 +287,23 @@ def update_app_binding(
         self._finalize_effective_enabled(payload)
         return payload
 
+    def get_current_ip(
+        self,
+        context: RequestContext,
+        *,
+        client_ip_supplier: Callable[[], str],
+    ) -> dict[str, str]:
+        """Return trusted request metadata without requiring a saved policy.
+
+        Like policy reads and the existing IP preflight, this read-only helper
+        authorizes the persisted workspace role before resolving the request IP.
+        It does not create a policy, enable enforcement, or require a paid plan;
+        policy mutations keep their separate paid-plan admission.
+        """
+
+        self._ensure_workspace_role(context, _POLICY_READ_ROLES)
+        return {"client_ip": client_ip_supplier()}
+
     def check_current_ip(
         self,
         context: RequestContext,
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 436ea98740f0f2..dae277dcdb193e 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -7,7 +7,7 @@
 from uuid import UUID
 
 import pytest
-from flask import Flask
+from flask import Flask, Response
 from pydantic import ValidationError
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
 
@@ -16,15 +16,18 @@
     AppNetworkAccessGroupApi,
     AppNetworkAccessGroupUpdatePayload,
     CurrentWorkspaceNetworkAccessGroupApi,
+    CurrentWorkspaceNetworkAccessGroupCurrentIPApi,
     CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi,
     CurrentWorkspaceNetworkAccessGroupsApi,
     NetworkAccessGroupCreatePayload,
+    NetworkAccessGroupCurrentIPResponse,
     NetworkAccessGroupDeleteQuery,
     NetworkAccessGroupUpdatePayload,
     _translate_service_error,
     _translate_upstream_error,
 )
 from core.network_access.client_ip import NetworkAccessClientIPUnavailableError
+from enums import DeploymentEdition
 from machinery.context import RequestContext
 from services.network_access_group_service import (
     NetworkAccessGroupAccessDeniedError,
@@ -497,3 +500,147 @@ def test_group_response_rejects_enforcing_count_greater_than_used_by_count() ->
             CurrentWorkspaceNetworkAccessGroupsApi(),
             request_context=_request_context(),
         )
+
+
+@pytest.mark.parametrize(
+    ("peer", "forwarded", "expected"),
+    [
+        ("172.18.0.3", "203.0.113.7", "203.0.113.7"),
+        ("172.18.0.3", "2001:db8::42", "2001:db8::42"),
+        ("172.18.0.3", "::ffff:203.0.113.7", "203.0.113.7"),
+        ("203.0.113.7", "192.0.2.1", "203.0.113.7"),
+        ("172.18.0.3", "192.0.2.1, 203.0.113.7, 172.18.0.4", "203.0.113.7"),
+    ],
+    ids=["ipv4", "ipv6", "mapped-ipv6", "untrusted-peer-spoof", "trusted-proxy-appended-peer"],
+)
+def test_current_ip_read_uses_trusted_resolver_and_ignores_client_supplied_ip(
+    config_overrides: Callable[..., None],
+    peer: str,
+    forwarded: str,
+    expected: str,
+) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
+    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: {"client_ip": client_ip_supplier()}
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
+
+    with (
+        app.test_request_context(
+            "/workspaces/current/network-access-groups/current-ip?client_ip=192.0.2.1&group_id=ignored",
+            headers={
+                "X-Forwarded-For": forwarded,
+                "CF-Connecting-IP": "192.0.2.1",
+                "X-Real-IP": "192.0.2.1",
+                "Forwarded": "for=192.0.2.1",
+            },
+            json={"client_ip": "192.0.2.1"},
+            environ_base={"REMOTE_ADDR": peer},
+        ),
+        _application_services(service),
+    ):
+        result = unwrap(api.get)(api, request_context=_request_context())
+        response = app.process_response(app.make_response(result))
+
+    assert result == {"client_ip": expected}
+    assert response.headers["Cache-Control"] == "no-store"
+    assert service.get_current_ip.call_args.args == (_request_context(),)
+    assert set(service.get_current_ip.call_args.kwargs) == {"client_ip_supplier"}
+    service.get_group.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("trusted_proxies", "forwarded"),
+    [
+        ("", "203.0.113.7"),
+        ("not-a-cidr", "203.0.113.7"),
+        ("172.18.0.0/16", None),
+        ("172.18.0.0/16", "malformed"),
+        ("172.18.0.0/16", "172.18.0.4"),
+    ],
+    ids=["missing-proxy-config", "invalid-proxy-config", "missing-xff", "invalid-xff", "all-trusted-hops"],
+)
+def test_current_ip_read_fails_closed_with_no_store_on_503(
+    config_overrides: Callable[..., None], trusted_proxies: str, forwarded: str | None
+) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=trusted_proxies)
+    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: {"client_ip": client_ip_supplier()}
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
+
+    with (
+        app.test_request_context(
+            headers={"X-Forwarded-For": forwarded} if forwarded is not None else {},
+            environ_base={"REMOTE_ADDR": "172.18.0.3"},
+        ),
+        _application_services(service),
+    ):
+        with pytest.raises(ServiceUnavailable, match="Current client IP is unavailable") as exc_info:
+            unwrap(api.get)(api, request_context=_request_context())
+        response = app.process_response(app.make_response(exc_info.value.get_response()))
+
+    assert response.status_code == 503
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+def test_current_ip_read_maps_role_denial_without_resolving_ip() -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    service.get_current_ip.side_effect = NetworkAccessGroupAccessDeniedError
+    api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
+
+    with (
+        app.test_request_context(),
+        _application_services(service),
+        patch(
+            "controllers.console.workspace.network_access_group.resolve_network_access_client_ip"
+        ) as resolve_client_ip,
+    ):
+        with pytest.raises(Forbidden, match="workspace role") as exc_info:
+            unwrap(api.get)(api, request_context=_request_context())
+        response = app.process_response(app.make_response(exc_info.value.get_response()))
+
+    resolve_client_ip.assert_not_called()
+    assert response.status_code == 403
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("edition", [DeploymentEdition.COMMUNITY, DeploymentEdition.ENTERPRISE])
+def test_current_ip_read_is_cloud_only(config_overrides: Callable[..., None], edition: DeploymentEdition) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(DEPLOYMENT_EDITION=edition)
+
+    with app.test_request_context(), _application_services(service), pytest.raises(NotFound):
+        CurrentWorkspaceNetworkAccessGroupCurrentIPApi().get()
+
+    service.get_current_ip.assert_not_called()
+
+
+def test_current_ip_read_requires_authenticated_account(config_overrides: Callable[..., None]) -> None:
+    app = Flask(__name__)
+    service = MagicMock()
+    config_overrides(DEPLOYMENT_EDITION=DeploymentEdition.CLOUD, LOGIN_DISABLED=False)
+    login_manager = MagicMock()
+    login_manager.unauthorized.return_value = Response(status=401)
+
+    with (
+        app.test_request_context(),
+        _application_services(service),
+        patch("libs.login._resolve_current_user", return_value=None),
+        patch("libs.login._get_login_manager", return_value=login_manager),
+    ):
+        response = CurrentWorkspaceNetworkAccessGroupCurrentIPApi().get()
+
+    assert isinstance(response, Response)
+    assert response.status_code == 401
+    service.get_current_ip.assert_not_called()
+
+
+def test_current_ip_read_response_schema_exposes_only_client_ip() -> None:
+    schema = NetworkAccessGroupCurrentIPResponse.model_json_schema(mode="serialization")
+
+    assert schema["required"] == ["client_ip"]
+    assert set(schema["properties"]) == {"client_ip"}
+    assert schema["properties"]["client_ip"]["type"] == "string"
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 6b93bcf59e0573..25fd8060b49198 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -669,6 +669,43 @@ def test_current_ip_check_authorizes_and_loads_tenant_policy_before_reading_ip()
     assert result == {"client_ip": "2001:db8::42", "allowed": True, "policy_version": 7}
 
 
+@pytest.mark.parametrize("role", ["owner", "admin", "editor"])
+@pytest.mark.parametrize("paid", [True, False], ids=["paid", "lapsed-or-free"])
+def test_current_ip_read_needs_no_policy_and_preserves_read_admission(role: str, paid: bool) -> None:
+    harness = _harness(role=role, paid=paid)
+    order: list[str] = []
+    harness.memberships.get_role_for_account.side_effect = lambda **_kwargs: order.append("role") or role
+
+    result = harness.service.get_current_ip(
+        _context(),
+        client_ip_supplier=lambda: order.append("ip") or "2001:db8::42",
+    )
+
+    assert result == {"client_ip": "2001:db8::42"}
+    assert order == ["role", "ip"]
+    harness.memberships.get_role_for_account.assert_called_once_with(
+        workspace_id=WORKSPACE_ID,
+        account_id=ACCOUNT_ID,
+    )
+    assert harness.control_plane.method_calls == []
+    assert harness.apps.method_calls == []
+    harness.entitlement.is_paid_plan.assert_not_called()
+
+
+@pytest.mark.parametrize("role", ["normal", "dataset_operator", "unknown", None])
+def test_current_ip_read_rejects_disallowed_persisted_roles_before_reading_ip(role: str | None) -> None:
+    harness = _harness(role=role)
+    supplier = MagicMock(return_value="203.0.113.7")
+
+    with pytest.raises(NetworkAccessGroupAccessDeniedError):
+        harness.service.get_current_ip(_context(), client_ip_supplier=supplier)
+
+    supplier.assert_not_called()
+    assert harness.control_plane.method_calls == []
+    assert harness.apps.method_calls == []
+    harness.entitlement.is_paid_plan.assert_not_called()
+
+
 def test_current_ip_check_rejects_role_before_policy_or_ip_lookup() -> None:
     harness = _harness(role="normal")
     supplier = MagicMock(return_value="203.0.113.7")
diff --git a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
index 20779120424fd2..17a483afb640c0 100644
--- a/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/orpc.gen.ts
@@ -92,6 +92,7 @@ import {
   zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse,
   zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdPath,
   zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse,
+  zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse,
   zGetWorkspacesCurrentNetworkAccessGroupsResponse,
   zGetWorkspacesCurrentPermissionResponse,
   zGetWorkspacesCurrentPluginAssetQuery,
@@ -1739,6 +1740,20 @@ export const models2 = {
 }
 
 export const get22 = oc
+  .route({
+    inputStructure: 'detailed',
+    method: 'GET',
+    operationId: 'getWorkspacesCurrentNetworkAccessGroupsCurrentIp',
+    path: '/workspaces/current/network-access-groups/current-ip',
+    tags: ['console'],
+  })
+  .output(zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse)
+
+export const currentIp = {
+  get: get22,
+}
+
+export const get23 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1750,7 +1765,7 @@ export const get22 = oc
   .output(zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse)
 
 export const checkCurrentIp = {
-  get: get22,
+  get: get23,
 }
 
 export const delete8 = oc
@@ -1769,7 +1784,7 @@ export const delete8 = oc
   )
   .output(zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdResponse)
 
-export const get23 = oc
+export const get24 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1798,12 +1813,12 @@ export const put5 = oc
 
 export const byGroupId = {
   delete: delete8,
-  get: get23,
+  get: get24,
   put: put5,
   checkCurrentIp,
 }
 
-export const get24 = oc
+export const get25 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1826,8 +1841,9 @@ export const post26 = oc
   .output(zPostWorkspacesCurrentNetworkAccessGroupsResponse)
 
 export const networkAccessGroups = {
-  get: get24,
+  get: get25,
   post: post26,
+  currentIp,
   byGroupId,
 }
 
@@ -1836,7 +1852,7 @@ export const networkAccessGroups = {
  *
  * Returns permission flags that control workspace features like member invitations and owner transfer.
  */
-export const get25 = oc
+export const get26 = oc
   .route({
     description:
       'Returns permission flags that control workspace features like member invitations and owner transfer.',
@@ -1850,10 +1866,10 @@ export const get25 = oc
   .output(zGetWorkspacesCurrentPermissionResponse)
 
 export const permission = {
-  get: get25,
+  get: get26,
 }
 
-export const get26 = oc
+export const get27 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1865,7 +1881,7 @@ export const get26 = oc
   .output(zGetWorkspacesCurrentPluginAssetResponse)
 
 export const asset = {
-  get: get26,
+  get: get27,
 }
 
 export const post27 = oc
@@ -1898,7 +1914,7 @@ export const exclude = {
   post: post28,
 }
 
-export const get27 = oc
+export const get28 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1910,7 +1926,7 @@ export const get27 = oc
   .output(zGetWorkspacesCurrentPluginAutoUpgradeFetchResponse)
 
 export const fetch_ = {
-  get: get27,
+  get: get28,
 }
 
 export const autoUpgrade = {
@@ -1919,7 +1935,7 @@ export const autoUpgrade = {
   fetch: fetch_,
 }
 
-export const get28 = oc
+export const get29 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1930,10 +1946,10 @@ export const get28 = oc
   .output(zGetWorkspacesCurrentPluginDebuggingKeyResponse)
 
 export const debuggingKey = {
-  get: get28,
+  get: get29,
 }
 
-export const get29 = oc
+export const get30 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1945,10 +1961,10 @@ export const get29 = oc
   .output(zGetWorkspacesCurrentPluginFetchManifestResponse)
 
 export const fetchManifest = {
-  get: get29,
+  get: get30,
 }
 
-export const get30 = oc
+export const get31 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -1960,7 +1976,7 @@ export const get30 = oc
   .output(zGetWorkspacesCurrentPluginIconResponse)
 
 export const icon = {
-  get: get30,
+  get: get31,
 }
 
 export const post29 = oc
@@ -2014,7 +2030,7 @@ export const install = {
   pkg,
 }
 
-export const get31 = oc
+export const get32 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2026,7 +2042,7 @@ export const get31 = oc
   .output(zGetWorkspacesCurrentPluginInstalledIdsResponse)
 
 export const installedIds = {
-  get: get31,
+  get: get32,
 }
 
 export const post32 = oc
@@ -2063,7 +2079,7 @@ export const latestVersions = {
   post: post33,
 }
 
-export const get32 = oc
+export const get33 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2075,12 +2091,12 @@ export const get32 = oc
   .output(zGetWorkspacesCurrentPluginListResponse)
 
 export const list2 = {
-  get: get32,
+  get: get33,
   installations,
   latestVersions,
 }
 
-export const get33 = oc
+export const get34 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2092,14 +2108,14 @@ export const get33 = oc
   .output(zGetWorkspacesCurrentPluginMarketplacePkgResponse)
 
 export const pkg2 = {
-  get: get33,
+  get: get34,
 }
 
 export const marketplace2 = {
   pkg: pkg2,
 }
 
-export const get34 = oc
+export const get35 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2111,7 +2127,7 @@ export const get34 = oc
   .output(zGetWorkspacesCurrentPluginParametersDynamicOptionsResponse)
 
 export const dynamicOptions = {
-  get: get34,
+  get: get35,
 }
 
 /**
@@ -2155,7 +2171,7 @@ export const change2 = {
   post: post35,
 }
 
-export const get35 = oc
+export const get36 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2166,7 +2182,7 @@ export const get35 = oc
   .output(zGetWorkspacesCurrentPluginPermissionFetchResponse)
 
 export const fetch2 = {
-  get: get35,
+  get: get36,
 }
 
 export const permission2 = {
@@ -2174,7 +2190,7 @@ export const permission2 = {
   fetch: fetch2,
 }
 
-export const get36 = oc
+export const get37 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2186,7 +2202,7 @@ export const get36 = oc
   .output(zGetWorkspacesCurrentPluginReadmeResponse)
 
 export const readme = {
-  get: get36,
+  get: get37,
 }
 
 export const post36 = oc
@@ -2234,7 +2250,7 @@ export const delete9 = {
   byIdentifier,
 }
 
-export const get37 = oc
+export const get38 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2246,11 +2262,11 @@ export const get37 = oc
   .output(zGetWorkspacesCurrentPluginTasksByTaskIdResponse)
 
 export const byTaskId = {
-  get: get37,
+  get: get38,
   delete: delete9,
 }
 
-export const get38 = oc
+export const get39 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2262,7 +2278,7 @@ export const get38 = oc
   .output(zGetWorkspacesCurrentPluginTasksResponse)
 
 export const tasks = {
-  get: get38,
+  get: get39,
   deleteAll,
   byTaskId,
 }
@@ -2367,7 +2383,7 @@ export const upload = {
   pkg: pkg3,
 }
 
-export const get39 = oc
+export const get40 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2384,7 +2400,7 @@ export const get39 = oc
   .output(zGetWorkspacesCurrentPluginByCategoryListResponse)
 
 export const list3 = {
-  get: get39,
+  get: get40,
 }
 
 export const byCategory = {
@@ -2437,7 +2453,7 @@ export const delete10 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdPath }))
   .output(zDeleteWorkspacesCurrentRbacAccessPoliciesByPolicyIdResponse)
 
-export const get40 = oc
+export const get41 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2466,12 +2482,12 @@ export const put6 = oc
 
 export const byPolicyId = {
   delete: delete10,
-  get: get40,
+  get: get41,
   put: put6,
   copy,
 }
 
-export const get41 = oc
+export const get42 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2494,7 +2510,7 @@ export const post46 = oc
   .output(zPostWorkspacesCurrentRbacAccessPoliciesResponse)
 
 export const accessPolicies = {
-  get: get41,
+  get: get42,
   post: post46,
   byPolicyId,
 }
@@ -2554,7 +2570,7 @@ export const delete11 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAgentsByAgentIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get42 = oc
+export const get43 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2571,10 +2587,10 @@ export const get42 = oc
 
 export const memberBindings = {
   delete: delete11,
-  get: get42,
+  get: get43,
 }
 
-export const get43 = oc
+export const get44 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2590,7 +2606,7 @@ export const get43 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings = {
-  get: get43,
+  get: get44,
 }
 
 export const byPolicyId2 = {
@@ -2602,7 +2618,7 @@ export const accessPolicies2 = {
   byPolicyId: byPolicyId2,
 }
 
-export const get44 = oc
+export const get45 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2619,10 +2635,10 @@ export const get44 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdAccessPolicyResponse)
 
 export const accessPolicy = {
-  get: get44,
+  get: get45,
 }
 
-export const get45 = oc
+export const get46 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2639,7 +2655,7 @@ export const get45 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies = {
-  get: get45,
+  get: get46,
 }
 
 export const put9 = oc
@@ -2670,7 +2686,7 @@ export const users = {
   byTargetAccountId,
 }
 
-export const get46 = oc
+export const get47 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2698,11 +2714,11 @@ export const put10 = oc
   .output(zPutWorkspacesCurrentRbacAgentsByAgentIdWhitelistResponse)
 
 export const whitelist = {
-  get: get46,
+  get: get47,
   put: put10,
 }
 
-export const get47 = oc
+export const get48 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2714,7 +2730,7 @@ export const get47 = oc
   .output(zGetWorkspacesCurrentRbacAgentsByAgentIdWhitelistConfigResponse)
 
 export const whitelistConfig = {
-  get: get47,
+  get: get48,
 }
 
 export const byAgentId2 = {
@@ -2746,7 +2762,7 @@ export const delete12 = oc
   )
   .output(zDeleteWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdMemberBindingsResponse)
 
-export const get48 = oc
+export const get49 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2763,10 +2779,10 @@ export const get48 = oc
 
 export const memberBindings2 = {
   delete: delete12,
-  get: get48,
+  get: get49,
 }
 
-export const get49 = oc
+export const get50 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2782,7 +2798,7 @@ export const get49 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings2 = {
-  get: get49,
+  get: get50,
 }
 
 export const byPolicyId3 = {
@@ -2794,7 +2810,7 @@ export const accessPolicies4 = {
   byPolicyId: byPolicyId3,
 }
 
-export const get50 = oc
+export const get51 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2811,10 +2827,10 @@ export const get50 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdAccessPolicyResponse)
 
 export const accessPolicy2 = {
-  get: get50,
+  get: get51,
 }
 
-export const get51 = oc
+export const get52 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2831,7 +2847,7 @@ export const get51 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies2 = {
-  get: get51,
+  get: get52,
 }
 
 export const put11 = oc
@@ -2862,7 +2878,7 @@ export const users2 = {
   byTargetAccountId: byTargetAccountId2,
 }
 
-export const get52 = oc
+export const get53 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2890,11 +2906,11 @@ export const put12 = oc
   .output(zPutWorkspacesCurrentRbacAppsByAppIdWhitelistResponse)
 
 export const whitelist2 = {
-  get: get52,
+  get: get53,
   put: put12,
 }
 
-export const get53 = oc
+export const get54 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2906,7 +2922,7 @@ export const get53 = oc
   .output(zGetWorkspacesCurrentRbacAppsByAppIdWhitelistConfigResponse)
 
 export const whitelistConfig2 = {
-  get: get53,
+  get: get54,
 }
 
 export const byAppId = {
@@ -2942,7 +2958,7 @@ export const delete13 = oc
     zDeleteWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdMemberBindingsResponse,
   )
 
-export const get54 = oc
+export const get55 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2963,10 +2979,10 @@ export const get54 = oc
 
 export const memberBindings3 = {
   delete: delete13,
-  get: get54,
+  get: get55,
 }
 
-export const get55 = oc
+export const get56 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -2982,7 +2998,7 @@ export const get55 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings3 = {
-  get: get55,
+  get: get56,
 }
 
 export const byPolicyId4 = {
@@ -2994,7 +3010,7 @@ export const accessPolicies6 = {
   byPolicyId: byPolicyId4,
 }
 
-export const get56 = oc
+export const get57 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3011,10 +3027,10 @@ export const get56 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdAccessPolicyResponse)
 
 export const accessPolicy3 = {
-  get: get56,
+  get: get57,
 }
 
-export const get57 = oc
+export const get58 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3031,7 +3047,7 @@ export const get57 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdUserAccessPoliciesResponse)
 
 export const userAccessPolicies3 = {
-  get: get57,
+  get: get58,
 }
 
 export const put13 = oc
@@ -3062,7 +3078,7 @@ export const users3 = {
   byTargetAccountId: byTargetAccountId3,
 }
 
-export const get58 = oc
+export const get59 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3090,11 +3106,11 @@ export const put14 = oc
   .output(zPutWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistResponse)
 
 export const whitelist3 = {
-  get: get58,
+  get: get59,
   put: put14,
 }
 
-export const get59 = oc
+export const get60 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3106,7 +3122,7 @@ export const get59 = oc
   .output(zGetWorkspacesCurrentRbacDatasetsByDatasetIdWhitelistConfigResponse)
 
 export const whitelistConfig3 = {
-  get: get59,
+  get: get60,
 }
 
 export const byDatasetId = {
@@ -3122,7 +3138,7 @@ export const datasets = {
   byDatasetId,
 }
 
-export const get60 = oc
+export const get61 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3150,7 +3166,7 @@ export const put15 = oc
   .output(zPutWorkspacesCurrentRbacMembersByMemberIdRbacRolesResponse)
 
 export const rbacRoles = {
-  get: get60,
+  get: get61,
   put: put15,
 }
 
@@ -3162,7 +3178,7 @@ export const members2 = {
   byMemberId: byMemberId2,
 }
 
-export const get61 = oc
+export const get62 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3173,10 +3189,10 @@ export const get61 = oc
   .output(zGetWorkspacesCurrentRbacMyPermissionsResponse)
 
 export const myPermissions = {
-  get: get61,
+  get: get62,
 }
 
-export const get62 = oc
+export const get63 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3187,10 +3203,10 @@ export const get62 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAgentResponse)
 
 export const agent = {
-  get: get62,
+  get: get63,
 }
 
-export const get63 = oc
+export const get64 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3201,10 +3217,10 @@ export const get63 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogAppResponse)
 
 export const app = {
-  get: get63,
+  get: get64,
 }
 
-export const get64 = oc
+export const get65 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3215,10 +3231,10 @@ export const get64 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogDatasetResponse)
 
 export const dataset = {
-  get: get64,
+  get: get65,
 }
 
-export const get65 = oc
+export const get66 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3229,7 +3245,7 @@ export const get65 = oc
   .output(zGetWorkspacesCurrentRbacRolePermissionsCatalogResponse)
 
 export const catalog = {
-  get: get65,
+  get: get66,
   agent,
   app,
   dataset,
@@ -3254,7 +3270,7 @@ export const copy2 = {
   post: post47,
 }
 
-export const get66 = oc
+export const get67 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3266,7 +3282,7 @@ export const get66 = oc
   .output(zGetWorkspacesCurrentRbacRolesByRoleIdMembersResponse)
 
 export const members3 = {
-  get: get66,
+  get: get67,
 }
 
 export const delete14 = oc
@@ -3280,7 +3296,7 @@ export const delete14 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentRbacRolesByRoleIdPath }))
   .output(zDeleteWorkspacesCurrentRbacRolesByRoleIdResponse)
 
-export const get67 = oc
+export const get68 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3304,13 +3320,13 @@ export const put16 = oc
 
 export const byRoleId = {
   delete: delete14,
-  get: get67,
+  get: get68,
   put: put16,
   copy: copy2,
   members: members3,
 }
 
-export const get68 = oc
+export const get69 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3331,7 +3347,7 @@ export const post48 = oc
   .output(zPostWorkspacesCurrentRbacRolesResponse)
 
 export const roles = {
-  get: get68,
+  get: get69,
   post: post48,
   byRoleId,
 }
@@ -3356,7 +3372,7 @@ export const bindings = {
   put: put17,
 }
 
-export const get69 = oc
+export const get70 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3372,10 +3388,10 @@ export const get69 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings4 = {
-  get: get69,
+  get: get70,
 }
 
-export const get70 = oc
+export const get71 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3391,7 +3407,7 @@ export const get70 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings4 = {
-  get: get70,
+  get: get71,
 }
 
 export const byPolicyId5 = {
@@ -3404,7 +3420,7 @@ export const accessPolicies8 = {
   byPolicyId: byPolicyId5,
 }
 
-export const get71 = oc
+export const get72 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3415,7 +3431,7 @@ export const get71 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAgentsAccessPolicyResponse)
 
 export const accessPolicy4 = {
-  get: get71,
+  get: get72,
 }
 
 export const agents3 = {
@@ -3443,7 +3459,7 @@ export const bindings2 = {
   put: put18,
 }
 
-export const get72 = oc
+export const get73 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3459,10 +3475,10 @@ export const get72 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings5 = {
-  get: get72,
+  get: get73,
 }
 
-export const get73 = oc
+export const get74 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3478,7 +3494,7 @@ export const get73 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings5 = {
-  get: get73,
+  get: get74,
 }
 
 export const byPolicyId6 = {
@@ -3491,7 +3507,7 @@ export const accessPolicies9 = {
   byPolicyId: byPolicyId6,
 }
 
-export const get74 = oc
+export const get75 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3502,7 +3518,7 @@ export const get74 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceAppsAccessPolicyResponse)
 
 export const accessPolicy5 = {
-  get: get74,
+  get: get75,
 }
 
 export const apps2 = {
@@ -3530,7 +3546,7 @@ export const bindings3 = {
   put: put19,
 }
 
-export const get75 = oc
+export const get76 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3546,10 +3562,10 @@ export const get75 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdMemberBindingsResponse)
 
 export const memberBindings6 = {
-  get: get75,
+  get: get76,
 }
 
-export const get76 = oc
+export const get77 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3565,7 +3581,7 @@ export const get76 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPoliciesByPolicyIdRoleBindingsResponse)
 
 export const roleBindings6 = {
-  get: get76,
+  get: get77,
 }
 
 export const byPolicyId7 = {
@@ -3578,7 +3594,7 @@ export const accessPolicies10 = {
   byPolicyId: byPolicyId7,
 }
 
-export const get77 = oc
+export const get78 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3589,7 +3605,7 @@ export const get77 = oc
   .output(zGetWorkspacesCurrentRbacWorkspaceDatasetsAccessPolicyResponse)
 
 export const accessPolicy6 = {
-  get: get77,
+  get: get78,
 }
 
 export const datasets2 = {
@@ -3655,7 +3671,7 @@ export const import_ = {
   post: post50,
 }
 
-export const get78 = oc
+export const get79 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3666,7 +3682,7 @@ export const get78 = oc
   .output(zGetWorkspacesCurrentSkillsTagsResponse)
 
 export const tags = {
-  get: get78,
+  get: get79,
 }
 
 export const post51 = oc
@@ -3709,7 +3725,7 @@ export const duplicate = {
   post: post52,
 }
 
-export const get79 = oc
+export const get80 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3721,7 +3737,7 @@ export const get79 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdExportResponse)
 
 export const export2 = {
-  get: get79,
+  get: get80,
 }
 
 export const post53 = oc
@@ -3744,7 +3760,7 @@ export const check = {
   post: post53,
 }
 
-export const get80 = oc
+export const get81 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3761,10 +3777,10 @@ export const get80 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdFilesContentResponse)
 
 export const content = {
-  get: get80,
+  get: get81,
 }
 
-export const get81 = oc
+export const get82 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3781,7 +3797,7 @@ export const get81 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdFilesPreviewResponse)
 
 export const preview = {
-  get: get81,
+  get: get82,
 }
 
 export const patch5 = oc
@@ -3844,7 +3860,7 @@ export const publish = {
   post: post54,
 }
 
-export const get82 = oc
+export const get83 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3856,7 +3872,7 @@ export const get82 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdReferencesResponse)
 
 export const references = {
-  get: get82,
+  get: get83,
 }
 
 export const post55 = oc
@@ -3890,7 +3906,7 @@ export const delete15 = oc
   .input(z.object({ params: zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdPath }))
   .output(zDeleteWorkspacesCurrentSkillsBySkillIdVersionsByVersionIdResponse)
 
-export const get83 = oc
+export const get84 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3919,11 +3935,11 @@ export const patch6 = oc
 
 export const byVersionId = {
   delete: delete15,
-  get: get83,
+  get: get84,
   patch: patch6,
 }
 
-export const get84 = oc
+export const get85 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3935,7 +3951,7 @@ export const get84 = oc
   .output(zGetWorkspacesCurrentSkillsBySkillIdVersionsResponse)
 
 export const versions = {
-  get: get84,
+  get: get85,
   byVersionId,
 }
 
@@ -3955,7 +3971,7 @@ export const delete16 = oc
   )
   .output(zDeleteWorkspacesCurrentSkillsBySkillIdResponse)
 
-export const get85 = oc
+export const get86 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -3984,7 +4000,7 @@ export const patch7 = oc
 
 export const bySkillId = {
   delete: delete16,
-  get: get85,
+  get: get86,
   patch: patch7,
   assist,
   duplicate,
@@ -3996,7 +4012,7 @@ export const bySkillId = {
   versions,
 }
 
-export const get86 = oc
+export const get87 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4020,7 +4036,7 @@ export const post56 = oc
   .output(zPostWorkspacesCurrentSkillsResponse)
 
 export const skills2 = {
-  get: get86,
+  get: get87,
   post: post56,
   files,
   import: import_,
@@ -4028,7 +4044,7 @@ export const skills2 = {
   bySkillId,
 }
 
-export const get87 = oc
+export const get88 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4039,10 +4055,10 @@ export const get87 = oc
   .output(zGetWorkspacesCurrentSummaryResponse)
 
 export const summary2 = {
-  get: get87,
+  get: get88,
 }
 
-export const get88 = oc
+export const get89 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4053,7 +4069,7 @@ export const get88 = oc
   .output(zGetWorkspacesCurrentToolLabelsResponse)
 
 export const toolLabels = {
-  get: get88,
+  get: get89,
 }
 
 export const post57 = oc
@@ -4086,7 +4102,7 @@ export const delete17 = {
   post: post58,
 }
 
-export const get89 = oc
+export const get90 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4097,11 +4113,11 @@ export const get89 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderApiGetQuery }))
   .output(zGetWorkspacesCurrentToolProviderApiGetResponse)
 
-export const get90 = {
-  get: get89,
+export const get91 = {
+  get: get90,
 }
 
-export const get91 = oc
+export const get92 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4113,7 +4129,7 @@ export const get91 = oc
   .output(zGetWorkspacesCurrentToolProviderApiRemoteResponse)
 
 export const remote = {
-  get: get91,
+  get: get92,
 }
 
 export const post59 = oc
@@ -4150,7 +4166,7 @@ export const test = {
   pre,
 }
 
-export const get92 = oc
+export const get93 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4162,7 +4178,7 @@ export const get92 = oc
   .output(zGetWorkspacesCurrentToolProviderApiToolsResponse)
 
 export const tools = {
-  get: get92,
+  get: get93,
 }
 
 export const post61 = oc
@@ -4183,7 +4199,7 @@ export const update2 = {
 export const api = {
   add,
   delete: delete17,
-  get: get90,
+  get: get91,
   remote,
   schema,
   test,
@@ -4211,7 +4227,7 @@ export const add2 = {
   post: post62,
 }
 
-export const get93 = oc
+export const get94 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4228,10 +4244,10 @@ export const get93 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialInfoResponse)
 
 export const info = {
-  get: get93,
+  get: get94,
 }
 
-export const get94 = oc
+export const get95 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4251,7 +4267,7 @@ export const get94 = oc
   )
 
 export const byCredentialType = {
-  get: get94,
+  get: get95,
 }
 
 export const schema2 = {
@@ -4263,7 +4279,7 @@ export const credential = {
   schema: schema2,
 }
 
-export const get95 = oc
+export const get96 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4280,7 +4296,7 @@ export const get95 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderCredentialsResponse)
 
 export const credentials3 = {
-  get: get95,
+  get: get96,
 }
 
 export const post63 = oc
@@ -4323,7 +4339,7 @@ export const delete18 = {
   post: post64,
 }
 
-export const get96 = oc
+export const get97 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4335,10 +4351,10 @@ export const get96 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderIconResponse)
 
 export const icon2 = {
-  get: get96,
+  get: get97,
 }
 
-export const get97 = oc
+export const get98 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4350,10 +4366,10 @@ export const get97 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderInfoResponse)
 
 export const info2 = {
-  get: get97,
+  get: get98,
 }
 
-export const get98 = oc
+export const get99 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4367,7 +4383,7 @@ export const get98 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderOauthClientSchemaResponse)
 
 export const clientSchema = {
-  get: get98,
+  get: get99,
 }
 
 export const delete19 = oc
@@ -4385,7 +4401,7 @@ export const delete19 = oc
   )
   .output(zDeleteWorkspacesCurrentToolProviderBuiltinByProviderOauthCustomClientResponse)
 
-export const get99 = oc
+export const get100 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4416,7 +4432,7 @@ export const post65 = oc
 
 export const customClient = {
   delete: delete19,
-  get: get99,
+  get: get100,
   post: post65,
 }
 
@@ -4425,7 +4441,7 @@ export const oauth = {
   customClient,
 }
 
-export const get100 = oc
+export const get101 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4437,7 +4453,7 @@ export const get100 = oc
   .output(zGetWorkspacesCurrentToolProviderBuiltinByProviderToolsResponse)
 
 export const tools2 = {
-  get: get100,
+  get: get101,
 }
 
 export const post66 = oc
@@ -4492,7 +4508,7 @@ export const auth = {
   post: post67,
 }
 
-export const get101 = oc
+export const get102 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4504,14 +4520,14 @@ export const get101 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpToolsByProviderIdResponse)
 
 export const byProviderId = {
-  get: get101,
+  get: get102,
 }
 
 export const tools3 = {
   byProviderId,
 }
 
-export const get102 = oc
+export const get103 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4523,7 +4539,7 @@ export const get102 = oc
   .output(zGetWorkspacesCurrentToolProviderMcpUpdateByProviderIdResponse)
 
 export const byProviderId2 = {
-  get: get102,
+  get: get103,
 }
 
 export const update4 = {
@@ -4602,7 +4618,7 @@ export const delete21 = {
   post: post70,
 }
 
-export const get103 = oc
+export const get104 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4613,11 +4629,11 @@ export const get103 = oc
   .input(z.object({ query: zGetWorkspacesCurrentToolProviderWorkflowGetQuery.optional() }))
   .output(zGetWorkspacesCurrentToolProviderWorkflowGetResponse)
 
-export const get104 = {
-  get: get103,
+export const get105 = {
+  get: get104,
 }
 
-export const get105 = oc
+export const get106 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4629,7 +4645,7 @@ export const get105 = oc
   .output(zGetWorkspacesCurrentToolProviderWorkflowToolsResponse)
 
 export const tools4 = {
-  get: get105,
+  get: get106,
 }
 
 export const post71 = oc
@@ -4650,7 +4666,7 @@ export const update5 = {
 export const workflow = {
   create: create2,
   delete: delete21,
-  get: get104,
+  get: get105,
   tools: tools4,
   update: update5,
 }
@@ -4662,7 +4678,7 @@ export const toolProvider = {
   workflow,
 }
 
-export const get106 = oc
+export const get107 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4674,10 +4690,10 @@ export const get106 = oc
   .output(zGetWorkspacesCurrentToolProvidersResponse)
 
 export const toolProviders = {
-  get: get106,
+  get: get107,
 }
 
-export const get107 = oc
+export const get108 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4688,10 +4704,10 @@ export const get107 = oc
   .output(zGetWorkspacesCurrentToolsApiResponse)
 
 export const api2 = {
-  get: get107,
+  get: get108,
 }
 
-export const get108 = oc
+export const get109 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4702,10 +4718,10 @@ export const get108 = oc
   .output(zGetWorkspacesCurrentToolsBuiltinResponse)
 
 export const builtin2 = {
-  get: get108,
+  get: get109,
 }
 
-export const get109 = oc
+export const get110 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4716,10 +4732,10 @@ export const get109 = oc
   .output(zGetWorkspacesCurrentToolsMcpResponse)
 
 export const mcp2 = {
-  get: get109,
+  get: get110,
 }
 
-export const get110 = oc
+export const get111 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4730,7 +4746,7 @@ export const get110 = oc
   .output(zGetWorkspacesCurrentToolsWorkflowResponse)
 
 export const workflow2 = {
-  get: get110,
+  get: get111,
 }
 
 export const tools5 = {
@@ -4740,7 +4756,7 @@ export const tools5 = {
   workflow: workflow2,
 }
 
-export const get111 = oc
+export const get112 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4752,13 +4768,13 @@ export const get111 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderIconResponse)
 
 export const icon3 = {
-  get: get111,
+  get: get112,
 }
 
 /**
  * Get info for a trigger provider
  */
-export const get112 = oc
+export const get113 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4771,7 +4787,7 @@ export const get112 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderInfoResponse)
 
 export const info3 = {
-  get: get112,
+  get: get113,
 }
 
 /**
@@ -4792,7 +4808,7 @@ export const delete22 = oc
 /**
  * Get OAuth client configuration for a provider
  */
-export const get113 = oc
+export const get114 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4826,7 +4842,7 @@ export const post72 = oc
 
 export const client = {
   delete: delete22,
-  get: get113,
+  get: get114,
   post: post72,
 }
 
@@ -4893,7 +4909,7 @@ export const create3 = {
 /**
  * Get the request logs for a subscription instance for a trigger provider
  */
-export const get114 = oc
+export const get115 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -4914,7 +4930,7 @@ export const get114 = oc
   )
 
 export const bySubscriptionBuilderId2 = {
-  get: get114,
+  get: get115,
 }
 
 export const logs = {
@@ -4988,7 +5004,7 @@ export const verifyAndUpdate = {
 /**
  * Get a subscription instance for a trigger provider
  */
-export const get115 = oc
+export const get116 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5009,7 +5025,7 @@ export const get115 = oc
   )
 
 export const bySubscriptionBuilderId5 = {
-  get: get115,
+  get: get116,
 }
 
 export const builder = {
@@ -5024,7 +5040,7 @@ export const builder = {
 /**
  * List all trigger subscriptions for the current tenant's provider
  */
-export const get116 = oc
+export const get117 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5037,13 +5053,13 @@ export const get116 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsListResponse)
 
 export const list4 = {
-  get: get116,
+  get: get117,
 }
 
 /**
  * Initiate OAuth authorization flow for a trigger provider
  */
-export const get117 = oc
+export const get118 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5060,7 +5076,7 @@ export const get117 = oc
   .output(zGetWorkspacesCurrentTriggerProviderByProviderSubscriptionsOauthAuthorizeResponse)
 
 export const authorize = {
-  get: get117,
+  get: get118,
 }
 
 export const oauth3 = {
@@ -5177,7 +5193,7 @@ export const triggerProvider = {
 /**
  * List all trigger providers for the current tenant
  */
-export const get118 = oc
+export const get119 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5189,7 +5205,7 @@ export const get118 = oc
   .output(zGetWorkspacesCurrentTriggersResponse)
 
 export const triggers = {
-  get: get118,
+  get: get119,
 }
 
 export const current = {
@@ -5237,7 +5253,7 @@ export const webappLogo = {
   upload: upload3,
 }
 
-export const get119 = oc
+export const get120 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5259,7 +5275,7 @@ export const post81 = oc
   .output(zPostWorkspacesCustomConfigResponse)
 
 export const customConfig = {
-  get: get119,
+  get: get120,
   post: post81,
   webappLogo,
 }
@@ -5294,7 +5310,7 @@ export const switch3 = {
   post: post83,
 }
 
-export const get120 = oc
+export const get121 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5306,7 +5322,7 @@ export const get120 = oc
   .output(zGetWorkspacesByTenantIdModelProvidersByProviderByIconTypeByLangResponse)
 
 export const byLang = {
-  get: get120,
+  get: get121,
 }
 
 export const byIconType = {
@@ -5325,7 +5341,7 @@ export const byTenantId = {
   modelProviders: modelProviders2,
 }
 
-export const get121 = oc
+export const get122 = oc
   .route({
     inputStructure: 'detailed',
     method: 'GET',
@@ -5336,7 +5352,7 @@ export const get121 = oc
   .output(zGetWorkspacesResponse)
 
 export const workspaces = {
-  get: get121,
+  get: get122,
   current,
   customConfig,
   info: info4,
diff --git a/packages/contracts/generated/api/console/workspaces/types.gen.ts b/packages/contracts/generated/api/console/workspaces/types.gen.ts
index c332d99398de7b..1502081a7e34a1 100644
--- a/packages/contracts/generated/api/console/workspaces/types.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/types.gen.ts
@@ -390,6 +390,10 @@ export type NetworkAccessGroupMutationResponse = {
   group: NetworkAccessGroupResponse
 }
 
+export type NetworkAccessGroupCurrentIpResponse = {
+  client_ip: string
+}
+
 export type NetworkAccessGroupDeleteResponse = {
   deleted: boolean
 }
@@ -3948,6 +3952,25 @@ export type PostWorkspacesCurrentNetworkAccessGroupsResponses = {
 export type PostWorkspacesCurrentNetworkAccessGroupsResponse =
   PostWorkspacesCurrentNetworkAccessGroupsResponses[keyof PostWorkspacesCurrentNetworkAccessGroupsResponses]
 
+export type GetWorkspacesCurrentNetworkAccessGroupsCurrentIpData = {
+  body?: never
+  path?: never
+  query?: never
+  url: '/workspaces/current/network-access-groups/current-ip'
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsCurrentIpErrors = {
+  403: unknown
+  503: unknown
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponses = {
+  200: NetworkAccessGroupCurrentIpResponse
+}
+
+export type GetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse =
+  GetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponses[keyof GetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponses]
+
 export type DeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdData = {
   body?: never
   path: {
diff --git a/packages/contracts/generated/api/console/workspaces/zod.gen.ts b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
index 53b4a896f21d77..4ce6daaf8e334e 100644
--- a/packages/contracts/generated/api/console/workspaces/zod.gen.ts
+++ b/packages/contracts/generated/api/console/workspaces/zod.gen.ts
@@ -263,6 +263,13 @@ export const zNetworkAccessGroupCreatePayload = z.object({
   name: z.string().min(1).max(100),
 })
 
+/**
+ * NetworkAccessGroupCurrentIPResponse
+ */
+export const zNetworkAccessGroupCurrentIpResponse = z.object({
+  client_ip: z.string(),
+})
+
 /**
  * NetworkAccessGroupDeleteResponse
  */
@@ -4670,6 +4677,12 @@ export const zPostWorkspacesCurrentNetworkAccessGroupsBody = zNetworkAccessGroup
  */
 export const zPostWorkspacesCurrentNetworkAccessGroupsResponse = zNetworkAccessGroupMutationResponse
 
+/**
+ * Trusted current client IP retrieved without requiring an existing network access group
+ */
+export const zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse =
+  zNetworkAccessGroupCurrentIpResponse
+
 export const zDeleteWorkspacesCurrentNetworkAccessGroupsByGroupIdPath = z.object({
   group_id: z.uuid(),
 })
diff --git a/packages/contracts/network-access-current-ip.test.ts b/packages/contracts/network-access-current-ip.test.ts
new file mode 100644
index 00000000000000..b68d06a45600a5
--- /dev/null
+++ b/packages/contracts/network-access-current-ip.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vite-plus/test'
+import { currentIp, workspaces } from './generated/api/console/workspaces/orpc.gen'
+import {
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpPath,
+  zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse,
+  zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse,
+} from './generated/api/console/workspaces/zod.gen'
+
+describe('generated network access current-IP contract', () => {
+  it('exposes the policy-independent operation alongside the group preflight', () => {
+    expect(workspaces.current.networkAccessGroups.currentIp.get).toBe(currentIp.get)
+    expect(workspaces.current.networkAccessGroups.byGroupId.checkCurrentIp.get).toBeDefined()
+  })
+
+  it.each(['192.0.2.1', '2001:db8::1'])('accepts a trusted IP without a saved policy: %s', (ip) => {
+    expect(
+      zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse.parse({ client_ip: ip }),
+    ).toEqual({ client_ip: ip })
+  })
+
+  it.each([{}, null, { client_ip: 42 }])('requires a string client_ip: %j', (response) => {
+    expect(
+      zGetWorkspacesCurrentNetworkAccessGroupsCurrentIpResponse.safeParse(response).success,
+    ).toBe(false)
+  })
+
+  it('retains the existing saved-group preflight contract', () => {
+    const schema = zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpResponse
+    expect(schema.parse({ client_ip: '192.0.2.1', allowed: false, policy_version: 1 })).toEqual({
+      client_ip: '192.0.2.1',
+      allowed: false,
+      policy_version: 1,
+    })
+    expect(schema.safeParse({ client_ip: '192.0.2.1' }).success).toBe(false)
+    expect(
+      zGetWorkspacesCurrentNetworkAccessGroupsByGroupIdCheckCurrentIpPath.safeParse({}).success,
+    ).toBe(false)
+  })
+})

From 38eb8f61106d6a54aaf658038fc4086146253589 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Sun, 20 Sep 2026 15:52:36 +0800
Subject: [PATCH 040/108] fix(dev): restore SaaS workflow queue consumers
 safely

Refs SNP-836. Add an opt-in, guarded Compose repair and tests without enabling unrelated queue consumers.
---
 .github/scripts/saas-dev/README.md            | 128 +++++
 .../scripts/saas-dev/fix_workflow_queues.py   | 445 ++++++++++++++++++
 .../saas-dev/test_fix_workflow_queues.py      | 382 +++++++++++++++
 3 files changed, 955 insertions(+)
 create mode 100644 .github/scripts/saas-dev/README.md
 create mode 100644 .github/scripts/saas-dev/fix_workflow_queues.py
 create mode 100644 .github/scripts/saas-dev/test_fix_workflow_queues.py

diff --git a/.github/scripts/saas-dev/README.md b/.github/scripts/saas-dev/README.md
new file mode 100644
index 00000000000000..109dcad91670ec
--- /dev/null
+++ b/.github/scripts/saas-dev/README.md
@@ -0,0 +1,128 @@
+# SaaS dev workflow consumers (SNP-836)
+
+This is an **opt-in repair for the existing SaaS dev host**, not a general Cloud
+worker configuration or a Staging/Production deployment change. It never starts,
+stops, scales, or restarts containers and never enqueues, deletes, or consumes jobs.
+
+## Why
+
+The host's `/home/ubuntu/langgenius/docker-compose.yaml` explicitly sets the main
+worker's `CELERY_QUEUES`. This overrides the image defaults and omits
+`workflow_professional`, `workflow_team`, and `workflow_sandbox`. An allowed
+Webhook can therefore return HTTP 200 while its workflow remains queued.
+
+The repair appends only these three queues to the existing main worker setting.
+It preserves the existing ten queues, their order, comments, quoting, all other
+file bytes, file owner/group/mode, the two worker replicas, and every other
+service. It intentionally rejects a different or ambiguous baseline for review.
+
+Do **not** remove `CELERY_QUEUES`, enable all default queues, or change the shared
+image entrypoint. Dedicated Cloud workers elsewhere must not start competing for
+other queues. In the 2026-09-20 dev audit, `schedule_poller`, `schedule_executor`,
+and `trigger_refresh_publisher` each already contained more than 51,000 messages.
+Those queues and their data are outside this repair's scope.
+
+## Prerequisites and dry-run
+
+Requirements: Python 3.10+, PyYAML, Docker Compose v2, and access to the existing
+`langgenius-api-1` and two main worker containers. PyYAML was already installed on
+the audited host; no new package or credential is required. The existing API
+image supplies its Redis client. Resolved Compose configuration and broker
+credentials are processed only in memory, never printed or saved by the repair.
+
+From the repository root, run the script over SSH. Omitting `--apply` is a
+dry-run: the target and services are unchanged. A temporary validation candidate
+in the same directory is removed after validation.
+
+```sh
+ssh -T -i /Users/yansongzhang/.ssh/id_rsa -o IdentitiesOnly=yes \
+  ubuntu@ec2-100-30-236-187.compute-1.amazonaws.com \
+  'python3 - --target saas-dev' \
+  < .github/scripts/saas-dev/fix_workflow_queues.py
+```
+
+Every dry-run and apply performs these fail-closed preflight checks:
+
+- The target is precisely `/home/ubuntu/langgenius/docker-compose.yaml`, a regular
+  file, not a symlink or hardlink. `services.worker.environment.CELERY_QUEUES`
+  occurs exactly once and is an explicit, single-line string.
+- The resolved candidate differs only in that one environment value. The worker
+  is Cloud, and `CELERY_WORKER_QUEUES` does not override the intended setting.
+- Exactly two running main worker containers match the existing Compose project
+  and file. Their real PID 1 `-Q` arguments match their environment and contain
+  only the reviewed original queues and the three approved workflow queues.
+- Compose API/worker and running API/worker broker URLs match exactly in memory.
+  Redis prefixes, Sentinel, custom TLS, or a different topology fail closed;
+  review these explicitly instead of checking the wrong broker/namespace.
+- All three workflow queues, including Redis priority suffix keys, have **zero**
+  messages. Both broker `unacked` and `unacked_index` must also be **zero**.
+
+If any guard fails, stop and inspect the cause. Do not purge queues, remove
+messages, restart consumers, or weaken the guard to make the repair pass. A
+nonzero `unacked` count may be legitimate in-flight work; wait for it to finish
+and rerun the read-only check. The check is a snapshot, not a lock on producers;
+recheck immediately before the planned worker deployment.
+
+## Apply and deploy
+
+Review the dry-run's old/new queue lists and `before_sha256`. Apply requires that
+exact SHA256 plus the explicit target and apply flag:
+
+```sh
+ssh -T -i /Users/yansongzhang/.ssh/id_rsa -o IdentitiesOnly=yes \
+  ubuntu@ec2-100-30-236-187.compute-1.amazonaws.com \
+  'python3 - --target saas-dev --apply --expected-sha256 REVIEWED_SHA256' \
+  < .github/scripts/saas-dev/fix_workflow_queues.py
+```
+
+The script validates first, verifies the original content again, writes an exact
+same-directory backup with the original owner/group/mode, then atomically
+replaces the target and verifies the resulting bytes. It prints the concrete
+backup path, hashes, queue names, and `services_restarted: false`. Treat the
+backup as sensitive: it contains the original Compose configuration and must not
+be committed or attached to an issue. Record only its path and hash in the
+deployment report. An already-patched file is a no-op without another backup.
+
+This repository's `deploy-saas.yml` executes the configured
+`SSH_SCRIPT_SAAS_DEV`; the audited script pulls and recreates the normal API,
+Web, main worker, priority worker, and plugin worker services from this existing
+host Compose file. It does not replace that file, so the queue change persists
+through subsequent `deploy/saas` deployments. Keep the repair and API changes on
+the original PR and synchronize to `deploy/saas` through the normal reviewed
+workflow. Do not change the deployment script variable, pipeline settings,
+Staging/Production manifests, or unrelated service configurations for this fix.
+
+## Regression checklist
+
+1. After the normal deployment, inspect the two main worker PID 1 queue arguments:
+   the original ten queues plus exactly the three workflow queues must be present;
+   replica count and other workers' queue arguments must be unchanged.
+2. Create a disposable, no-model Webhook → End workflow. Bind a denying IP policy:
+   a request must return 403 and produce no workflow run or trigger log.
+3. Permit only the test source IP and send **one** Webhook request. HTTP 200 alone
+   is insufficient: verify the trigger log and workflow run reach `succeeded`,
+   with zero model tokens and no residual workflow queue message.
+4. Restore a denying policy, verify 403 and unchanged run count; confirm the
+   existing Web/API/MCP access-control regressions remain correct.
+5. Clean up only the disposable test resources through their normal lifecycle.
+   Do not clear shared queues, historical messages, or unrelated user data.
+6. Confirm none of the excluded schedule/refresh queues gained a consumer. Their
+   lengths can grow naturally while the beat process continues producing tasks;
+   growth is not a reason to consume or purge them during this fix.
+
+If rolling back, first check for running/pending workflow work and obtain approval
+for any service operation. Inspect the exact backup path printed by the apply;
+verify that the live file still has the recorded `after_sha256` before restoring
+it, so another person's intervening edits are not overwritten. Restore the
+backup with owner/group/mode preserved, validate Compose without printing its
+secret-bearing output, and use the normal worker deployment procedure. This
+script deliberately provides no automatic destructive rollback or queue purge.
+
+## Local tests
+
+```sh
+python3 -m unittest discover -s .github/scripts/saas-dev -p 'test_*.py' -v
+```
+
+Tests use temporary synthetic Compose files and mocked broker responses. They
+do not contact dev, invoke Docker, or use real credentials.
diff --git a/.github/scripts/saas-dev/fix_workflow_queues.py b/.github/scripts/saas-dev/fix_workflow_queues.py
new file mode 100644
index 00000000000000..6f1fb76374918b
--- /dev/null
+++ b/.github/scripts/saas-dev/fix_workflow_queues.py
@@ -0,0 +1,445 @@
+#!/usr/bin/env python3
+"""Opt-in, SaaS-dev-only repair for SNP-836; never starts a consumer.
+
+Requires Python 3.10+, PyYAML, Docker Compose v2, and the existing API container.
+The host's PyYAML is used only to locate YAML scalar spans; the file is not dumped
+or reformatted, and neither resolved configuration nor credentials are printed.
+"""
+
+import argparse
+import copy
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+import tempfile
+
+import yaml
+from yaml.nodes import MappingNode, ScalarNode
+
+TARGET = Path("/home/ubuntu/langgenius/docker-compose.yaml")
+BASE_QUEUES = (
+    "dataset",
+    "mail",
+    "ops_trace",
+    "app_deletion",
+    "pipeline",
+    "workflow_storage",
+    "conversation",
+    "workflow_based_app_execution",
+    "evaluation",
+    "new_agent_beta",
+)
+WORKFLOW_QUEUES = ("workflow_professional", "workflow_team", "workflow_sandbox")
+
+
+class UnsafeConfiguration(ValueError):
+    pass
+
+
+def field(node, name):
+    if not isinstance(node, MappingNode):
+        raise UnsafeConfiguration("Expected an explicit YAML mapping")
+    matches = [
+        (key, value)
+        for key, value in node.value
+        if isinstance(key, ScalarNode) and key.value == name
+    ]
+    if len(matches) != 1:
+        raise UnsafeConfiguration(f"Expected exactly one explicit {name} field")
+    key, value = matches[0]
+    if value.start_mark.index < key.end_mark.index:
+        raise UnsafeConfiguration(f"Aliased {name} field requires manual review")
+    return value
+
+
+def plan_patch(before):
+    """Change only the unique, direct worker queue scalar; return UTF-8 bytes."""
+    text = before.decode("utf-8")
+    try:
+        root = yaml.compose(text, Loader=yaml.SafeLoader)
+    except yaml.YAMLError:
+        raise UnsafeConfiguration(
+            "Invalid YAML; details suppressed to protect credentials"
+        ) from None
+    worker = field(field(root, "services"), "worker")
+    environment = field(worker, "environment")
+    queue = field(environment, "CELERY_QUEUES")
+    if not isinstance(queue, ScalarNode) or queue.tag != "tag:yaml.org,2002:str":
+        raise UnsafeConfiguration("CELERY_QUEUES must be an explicit string")
+    if (
+        queue.style not in (None, "'", '"')
+        or queue.start_mark.line != queue.end_mark.line
+    ):
+        raise UnsafeConfiguration(
+            "Multiline or non-scalar queue syntax requires manual review"
+        )
+    # Aliases can refer to a scalar outside this service. Never mutate its source.
+    if not (
+        worker.start_mark.index
+        < queue.start_mark.index
+        < queue.end_mark.index
+        <= worker.end_mark.index
+    ):
+        raise UnsafeConfiguration("Queue aliases outside worker require manual review")
+    current = queue.value.split(",")
+    if any(not re.fullmatch(r"[a-z_]+", item) for item in current):
+        raise UnsafeConfiguration(
+            "Queue interpolation, whitespace, or unsupported syntax requires review"
+        )
+    if len(current) != len(set(current)):
+        raise UnsafeConfiguration("Duplicate queue names require manual review")
+    if not set(BASE_QUEUES).issubset(current) or set(current) - set(
+        BASE_QUEUES + WORKFLOW_QUEUES
+    ):
+        raise UnsafeConfiguration(
+            "Worker queues differ from the reviewed SaaS dev baseline"
+        )
+    missing = [item for item in WORKFLOW_QUEUES if item not in current]
+    if not missing:
+        return before, current, current
+    updated = current + missing
+    raw = text[queue.start_mark.index : queue.end_mark.index]
+    quoted = queue.style or ""
+    # Refuse anchors, tags, escapes and aliases instead of rewriting them.
+    if raw != quoted + queue.value + quoted:
+        raise UnsafeConfiguration("Decorated queue scalar requires manual review")
+    replacement = quoted + ",".join(updated) + quoted
+    after = (
+        text[: queue.start_mark.index] + replacement + text[queue.end_mark.index :]
+    ).encode("utf-8")
+    if plan_patch(after)[0] != after:
+        raise UnsafeConfiguration("Candidate queue patch is not idempotent")
+    return after, current, updated
+
+
+def sha256(content):
+    return hashlib.sha256(content).hexdigest()
+
+
+def safe_command(command, *, input_text=None):
+    result = subprocess.run(
+        command, input=input_text, text=True, capture_output=True, timeout=45
+    )
+    if result.returncode:
+        raise UnsafeConfiguration(
+            "Read-only Docker validation failed; output suppressed to protect credentials"
+        )
+    return result.stdout
+
+
+def resolved_config(path):
+    return json.loads(
+        safe_command(
+            [
+                "docker",
+                "compose",
+                "--project-directory",
+                str(TARGET.parent),
+                "-f",
+                str(path),
+                "config",
+                "--format",
+                "json",
+            ]
+        )
+    )
+
+
+def validate_resolved(before, after, old_queues, new_queues):
+    """Catch inherited overrides, YAML ambiguity, and accidental unrelated edits."""
+    environment = before["services"]["worker"]["environment"]
+    if environment.get("DEPLOYMENT_EDITION") != "CLOUD":
+        raise UnsafeConfiguration("Expected CLOUD SaaS dev worker")
+    if environment.get("CELERY_WORKER_QUEUES"):
+        raise UnsafeConfiguration("CELERY_WORKER_QUEUES overrides CELERY_QUEUES")
+    if environment.get("CELERY_QUEUES") != ",".join(old_queues):
+        raise UnsafeConfiguration(
+            "Resolved queues differ from the explicit queue scalar"
+        )
+    expected = copy.deepcopy(before)
+    expected["services"]["worker"]["environment"]["CELERY_QUEUES"] = ",".join(
+        new_queues
+    )
+    if after != expected:
+        raise UnsafeConfiguration(
+            "Resolved candidate changes more than worker CELERY_QUEUES"
+        )
+
+
+BROKER_CHECK = r"""
+import json, os
+from redis import Redis
+try:
+    if os.environ.get("REDIS_KEY_PREFIX"):
+        raise ValueError("Unsupported broker namespace")
+    client = Redis.from_url(os.environ["CELERY_BROKER_URL"], socket_timeout=10)
+    counts = {}
+    for queue in ("workflow_professional", "workflow_team", "workflow_sandbox"):
+        name = queue.encode()
+        keys = {name, *client.scan_iter(match=name + b"\x06\x16*")}
+        counts[queue] = sum(client.llen(key) for key in keys)
+    counts["unacked"] = client.hlen("unacked")
+    counts["unacked_index"] = client.zcard("unacked_index")
+    print(json.dumps(counts))
+except Exception:
+    print("Broker check failed; details suppressed", file=__import__("sys").stderr)
+    raise SystemExit(1)
+"""
+
+
+def validate_broker_environments(config, runtime_environments):
+    """Compare credentials only in memory; unsupported broker layouts fail shut."""
+    expected = config["services"]["worker"]["environment"].get("CELERY_BROKER_URL")
+    if not isinstance(expected, str) or not expected.startswith("redis://"):
+        raise UnsafeConfiguration("Only the reviewed direct Redis broker is supported")
+    environments = [
+        config["services"][service]["environment"] for service in ("api", "worker")
+    ]
+    for environment in environments + list(runtime_environments):
+        if environment.get("CELERY_BROKER_URL") != expected:
+            raise UnsafeConfiguration(
+                "API/worker broker mismatch; refusing an unreliable backlog check"
+            )
+        if environment.get("REDIS_KEY_PREFIX"):
+            raise UnsafeConfiguration(
+                "Redis key prefixes require a separate namespace-aware review"
+            )
+        for setting in ("CELERY_USE_SENTINEL", "BROKER_USE_SSL"):
+            if str(environment.get(setting, "false")).lower() not in (
+                "",
+                "false",
+                "none",
+                "0",
+            ):
+                raise UnsafeConfiguration(
+                    "Redis Sentinel or custom TLS requires separate review"
+                )
+
+
+def check_runtime_broker(config):
+    workers = safe_command(
+        [
+            "docker",
+            "ps",
+            "-q",
+            "--filter",
+            "label=com.docker.compose.project=langgenius",
+            "--filter",
+            "label=com.docker.compose.service=worker",
+        ]
+    ).split()
+    if (
+        len(workers) != 2
+        or config["services"]["worker"].get("deploy", {}).get("replicas") != 2
+    ):
+        raise UnsafeConfiguration("Expected the reviewed two-worker SaaS dev topology")
+    containers = json.loads(
+        safe_command(["docker", "inspect", "langgenius-api-1", *workers])
+    )
+    environments = []
+    for container in containers:
+        labels = container["Config"].get("Labels", {})
+        service = labels.get("com.docker.compose.service")
+        if (
+            not container["State"]["Running"]
+            or service not in ("api", "worker")
+            or labels.get("com.docker.compose.project") != "langgenius"
+            or labels.get("com.docker.compose.project.config_files") != str(TARGET)
+        ):
+            raise UnsafeConfiguration(
+                "Running containers do not match the reviewed Compose deployment"
+            )
+        environment = dict(item.split("=", 1) for item in container["Config"]["Env"])
+        environments.append(environment)
+        if service == "worker":
+            if environment.get("CELERY_WORKER_QUEUES"):
+                raise UnsafeConfiguration(
+                    "Runtime CELERY_WORKER_QUEUES overrides the reviewed queue setting"
+                )
+            argv = safe_command(
+                ["docker", "exec", container["Id"], "cat", "/proc/1/cmdline"]
+            ).split("\0")
+            if (
+                argv.count("-Q") != 1
+                or argv.index("-Q") + 1 >= len(argv)
+                or argv[argv.index("-Q") + 1] != environment.get("CELERY_QUEUES")
+            ):
+                raise UnsafeConfiguration(
+                    "Runtime worker argv and queue environment differ"
+                )
+            queues = environment["CELERY_QUEUES"].split(",")
+            if set(queues) - set(BASE_QUEUES + WORKFLOW_QUEUES) or not set(
+                BASE_QUEUES
+            ).issubset(queues):
+                raise UnsafeConfiguration(
+                    "Runtime queues differ from the reviewed baseline"
+                )
+    validate_broker_environments(config, environments)
+
+
+def broker_check(config):
+    check_runtime_broker(config)
+    counts = json.loads(
+        safe_command(
+            [
+                "docker",
+                "exec",
+                "-i",
+                "langgenius-api-1",
+                "/app/api/.venv/bin/python",
+                "-",
+            ],
+            input_text=BROKER_CHECK,
+        )
+    )
+    expected = set(WORKFLOW_QUEUES) | {"unacked", "unacked_index"}
+    if set(counts) != expected or any(
+        type(value) is not int or value != 0 for value in counts.values()
+    ):
+        raise UnsafeConfiguration(
+            "Workflow backlog or unacked tasks exist; do not start new consumers"
+        )
+    return counts
+
+
+def regular_file(path):
+    metadata = path.lstat()
+    if not stat.S_ISREG(metadata.st_mode) or metadata.st_nlink != 1:
+        raise UnsafeConfiguration(
+            "Target must be a regular non-symlink, non-hardlinked file"
+        )
+    return metadata
+
+
+def private_copy(path, content, metadata, prefix):
+    fd, name = tempfile.mkstemp(prefix=prefix, dir=path.parent)
+    copy_path = Path(name)
+    try:
+        with os.fdopen(fd, "wb") as handle:
+            os.fchown(handle.fileno(), metadata.st_uid, metadata.st_gid)
+            os.fchmod(handle.fileno(), stat.S_IMODE(metadata.st_mode))
+            handle.write(content)
+            handle.flush()
+            os.fsync(handle.fileno())
+        return copy_path
+    except BaseException:
+        copy_path.unlink(missing_ok=True)
+        raise
+
+
+def apply_patch(path, before, after, expected_sha256, validate, preflight):
+    """No service operations. Keep an exact backup and fail closed on drift."""
+    import fcntl
+
+    if sha256(before) != expected_sha256:
+        raise UnsafeConfiguration("Expected SHA256 does not match the reviewed dry-run")
+    metadata = regular_file(path)
+    with path.open("rb") as original:
+        fcntl.flock(original.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if path.read_bytes() != before:
+            raise UnsafeConfiguration("Compose changed since the dry-run")
+        candidate = private_copy(path, after, metadata, ".snp836-candidate-")
+        try:
+            validate(candidate)
+            preflight()
+            if before == after:
+                return None
+            backup = private_copy(
+                path, before, metadata, "docker-compose.yaml.snp836-backup-"
+            )
+            if backup.read_bytes() != before:
+                raise UnsafeConfiguration("Backup verification failed")
+            if path.read_bytes() != before or path.stat().st_ino != metadata.st_ino:
+                raise UnsafeConfiguration(
+                    "Compose changed before replacement; backup retained"
+                )
+            os.replace(candidate, path)
+            if path.read_bytes() != after:
+                raise UnsafeConfiguration(
+                    f"Post-write verification failed; restore backup {backup}"
+                )
+            return backup
+        finally:
+            candidate.unlink(missing_ok=True)
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--target", required=True, choices=["saas-dev"])
+    parser.add_argument(
+        "--apply",
+        action="store_true",
+        help="Write only the reviewed queue change; never restart",
+    )
+    parser.add_argument(
+        "--expected-sha256", help="Required with --apply; copy from a fresh dry-run"
+    )
+    args = parser.parse_args(argv)
+    if args.apply and not args.expected_sha256:
+        parser.error("--apply requires --expected-sha256")
+    try:
+        metadata = regular_file(TARGET)
+        before = TARGET.read_bytes()
+        after, old_queues, new_queues = plan_patch(before)
+        resolved_before = resolved_config(TARGET)
+
+        def validate(candidate):
+            validate_resolved(
+                resolved_before, resolved_config(candidate), old_queues, new_queues
+            )
+
+        if args.apply:
+            backup = apply_patch(
+                TARGET,
+                before,
+                after,
+                args.expected_sha256,
+                validate,
+                lambda: broker_check(resolved_before),
+            )
+        else:
+            # Compose reads secrets, so keep even a temporary candidate private.
+            candidate = private_copy(TARGET, after, metadata, ".snp836-candidate-")
+            try:
+                validate(candidate)
+                broker_check(resolved_before)
+            finally:
+                candidate.unlink(missing_ok=True)
+            backup = None
+        print(
+            json.dumps(
+                {
+                    "target": "saas-dev",
+                    "path": str(TARGET),
+                    "mode": "apply" if args.apply else "dry-run",
+                    "changed": before != after,
+                    "before_sha256": sha256(before),
+                    "after_sha256": sha256(after),
+                    "queues_before": old_queues,
+                    "queues_after": new_queues,
+                    "backup": str(backup) if backup else None,
+                    "services_restarted": False,
+                },
+                indent=2,
+            )
+        )
+    except (
+        UnsafeConfiguration,
+        OSError,
+        KeyError,
+        ValueError,
+        subprocess.SubprocessError,
+    ) as exc:
+        # Do not leak subprocess output, YAML snippets, broker URLs, or environment.
+        message = (
+            str(exc) if isinstance(exc, UnsafeConfiguration) else type(exc).__name__
+        )
+        parser.exit(1, f"Refused: {message}\n")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/.github/scripts/saas-dev/test_fix_workflow_queues.py b/.github/scripts/saas-dev/test_fix_workflow_queues.py
new file mode 100644
index 00000000000000..ec3fec85f77435
--- /dev/null
+++ b/.github/scripts/saas-dev/test_fix_workflow_queues.py
@@ -0,0 +1,382 @@
+import copy
+import importlib.util
+from pathlib import Path
+import stat
+import tempfile
+import unittest
+from unittest.mock import patch
+
+SPEC = importlib.util.spec_from_file_location(
+    "fix_workflow_queues", Path(__file__).with_name("fix_workflow_queues.py")
+)
+repair = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(repair)
+
+BASE = ",".join(repair.BASE_QUEUES)
+FULL = ",".join(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
+
+
+def compose(value=BASE, before_worker="", after_worker="", newline="\n"):
+    return (
+        (
+            "# Keep this comment and unrelated settings\n"
+            "x-common: &common\n  LOG_LEVEL: INFO\n"
+            "services:\n"
+            + before_worker
+            + "  worker:\n    image: langgenius/dify-api:deploy-saas\n"
+            "    environment:\n      <<: *common\n      DEPLOYMENT_EDITION: CLOUD\n"
+            f"      CELERY_QUEUES: {value}  # deliberately explicit\n"
+            "      OTHER_CONFIG: unchanged\n" + after_worker + "volumes:\n  storage:\n"
+        )
+        .replace("\n", newline)
+        .encode()
+    )
+
+
+OTHER_WORKERS = (
+    "  priority_worker:\n    environment:\n      CELERY_QUEUES: priority_dataset,priority_pipeline\n"
+    "  worker-plugin_autoupgrade:\n    environment:\n      CELERY_QUEUES: plugin\n"
+    "  worker_beat:\n    environment:\n      MODE: beat\n"
+)
+
+
+class PatchPlanTests(unittest.TestCase):
+    def test_preserves_every_other_byte_for_worker_at_different_positions(self):
+        for before_worker, after_worker in ((OTHER_WORKERS, ""), ("", OTHER_WORKERS)):
+            for quote in ("", "'", '"'):
+                for newline in ("\n", "\r\n"):
+                    with self.subTest(
+                        before=bool(before_worker), quote=quote, newline=newline
+                    ):
+                        before = compose(
+                            quote + BASE + quote, before_worker, after_worker, newline
+                        )
+                        after, old, new = repair.plan_patch(before)
+                        self.assertEqual(
+                            after, before.replace(BASE.encode(), FULL.encode(), 1)
+                        )
+                        self.assertEqual(old, list(repair.BASE_QUEUES))
+                        self.assertEqual(
+                            new, list(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
+                        )
+
+    def test_only_appends_missing_names_and_keeps_existing_order(self):
+        current = ",".join(reversed(repair.BASE_QUEUES)) + ",workflow_team"
+        after, old, new = repair.plan_patch(compose(current))
+        self.assertEqual(new, old + ["workflow_professional", "workflow_sandbox"])
+        self.assertIn(",".join(new).encode(), after)
+
+    def test_idempotent_when_all_queues_already_exist(self):
+        before = compose(FULL)
+        after, old, new = repair.plan_patch(before)
+        self.assertEqual(after, before)
+        self.assertEqual(old, new)
+
+    def test_rejects_duplicate_unknown_missing_or_interpolated_queues(self):
+        for value in (
+            BASE + ",dataset",
+            BASE + ",schedule_poller",
+            BASE.replace("dataset,", ""),
+            "${CELERY_QUEUES}",
+            BASE + ", workflow_team",
+            '"' + BASE + '\\n"',
+        ):
+            with (
+                self.subTest(value=value),
+                self.assertRaises(repair.UnsafeConfiguration),
+            ):
+                repair.plan_patch(compose(value))
+
+    def test_missing_and_ambiguous_target_fields_fail_closed(self):
+        original = compose()
+        for content in (
+            original.replace(b"  worker:", b"  another_worker:"),
+            original.replace(b"CELERY_QUEUES:", b"OTHER_QUEUES:"),
+            original.replace(
+                b"    environment:", b"    environment: {}\n    environment:"
+            ),
+            original.replace(b"  worker:", b"  worker: {}\n  worker:"),
+            original.replace(b"services:", b"services: {}\nservices:"),
+            original.replace(
+                b"      CELERY_QUEUES:",
+                b"      CELERY_QUEUES: other\n      CELERY_QUEUES:",
+            ),
+        ):
+            with (
+                self.subTest(content=content),
+                self.assertRaises(repair.UnsafeConfiguration),
+            ):
+                repair.plan_patch(content)
+
+    def test_rejects_non_scalar_list_block_and_alias_values(self):
+        values = ("[dataset,mail]", "true", "|\n        " + BASE, ">\n        " + BASE)
+        for value in values:
+            with (
+                self.subTest(value=value),
+                self.assertRaises(repair.UnsafeConfiguration),
+            ):
+                repair.plan_patch(compose(value))
+        outside_alias = (
+            b"x-queues: &queues " + BASE.encode() + b"\n" + compose("*queues")
+        )
+        with self.assertRaises(repair.UnsafeConfiguration):
+            repair.plan_patch(outside_alias)
+        worker_alias = (
+            b"x-worker: &worker\n  environment:\n    CELERY_QUEUES: "
+            + BASE.encode()
+            + b"\nservices:\n  worker: *worker\n"
+        )
+        with self.assertRaises(repair.UnsafeConfiguration):
+            repair.plan_patch(worker_alias)
+
+
+class ResolvedValidationTests(unittest.TestCase):
+    def setUp(self):
+        self.before = {
+            "services": {
+                "worker": {
+                    "environment": {
+                        "DEPLOYMENT_EDITION": "CLOUD",
+                        "CELERY_QUEUES": BASE,
+                    }
+                },
+                "priority_worker": {
+                    "environment": {
+                        "CELERY_QUEUES": "priority_dataset,priority_pipeline"
+                    }
+                },
+            }
+        }
+        self.after = copy.deepcopy(self.before)
+        self.after["services"]["worker"]["environment"]["CELERY_QUEUES"] = FULL
+
+    def test_accepts_exact_single_field_change(self):
+        repair.validate_resolved(
+            self.before,
+            self.after,
+            repair.BASE_QUEUES,
+            repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
+        )
+
+    def test_rejects_overrides_non_cloud_or_unrelated_changes(self):
+        for field, value in (
+            ("CELERY_WORKER_QUEUES", "override"),
+            ("DEPLOYMENT_EDITION", "COMMUNITY"),
+            ("CELERY_QUEUES", "other"),
+        ):
+            before = copy.deepcopy(self.before)
+            before["services"]["worker"]["environment"][field] = value
+            with (
+                self.subTest(field=field),
+                self.assertRaises(repair.UnsafeConfiguration),
+            ):
+                repair.validate_resolved(
+                    before,
+                    self.after,
+                    repair.BASE_QUEUES,
+                    repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
+                )
+        self.after["services"]["priority_worker"]["environment"]["CELERY_QUEUES"] += (
+            ",workflow_professional"
+        )
+        with self.assertRaises(repair.UnsafeConfiguration):
+            repair.validate_resolved(
+                self.before,
+                self.after,
+                repair.BASE_QUEUES,
+                repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
+            )
+
+
+class ApplyTests(unittest.TestCase):
+    def setUp(self):
+        self.temp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temp.cleanup)
+        self.path = Path(self.temp.name) / "docker-compose.yaml"
+        self.before = compose()
+        self.after = repair.plan_patch(self.before)[0]
+        self.path.write_bytes(self.before)
+        self.path.chmod(0o640)
+
+    def apply(
+        self, validate=lambda candidate: None, preflight=lambda: None, expected=None
+    ):
+        return repair.apply_patch(
+            self.path,
+            self.before,
+            self.after,
+            expected or repair.sha256(self.before),
+            validate,
+            preflight,
+        )
+
+    def test_backup_content_permissions_and_exact_change(self):
+        backup = self.apply()
+        self.assertEqual(backup.read_bytes(), self.before)
+        self.assertEqual(self.path.read_bytes(), self.after)
+        self.assertEqual(stat.S_IMODE(backup.stat().st_mode), 0o640)
+        self.assertEqual(stat.S_IMODE(self.path.stat().st_mode), 0o640)
+        self.assertEqual(list(self.path.parent.glob(".snp836-candidate-*")), [])
+
+    def test_noop_does_not_write_or_create_backup(self):
+        original_inode = self.path.stat().st_ino
+        backup = repair.apply_patch(
+            self.path,
+            self.before,
+            self.before,
+            repair.sha256(self.before),
+            lambda candidate: None,
+            lambda: None,
+        )
+        self.assertIsNone(backup)
+        self.assertEqual(self.path.stat().st_ino, original_inode)
+        self.assertEqual(list(self.path.parent.glob("*backup*")), [])
+
+    def test_hash_and_before_content_guards(self):
+        with self.assertRaises(repair.UnsafeConfiguration):
+            self.apply(expected="0" * 64)
+        self.path.write_bytes(self.before + b"# concurrent update\n")
+        with self.assertRaises(repair.UnsafeConfiguration):
+            self.apply()
+        self.assertEqual(list(self.path.parent.glob("*backup*")), [])
+
+    def test_validation_or_backlog_failure_does_not_write(self):
+        def refuse(*args):
+            raise repair.UnsafeConfiguration("unsafe")
+
+        for arguments in ({"validate": refuse}, {"preflight": refuse}):
+            with (
+                self.subTest(arguments=arguments),
+                self.assertRaises(repair.UnsafeConfiguration),
+            ):
+                self.apply(**arguments)
+            self.assertEqual(self.path.read_bytes(), self.before)
+            self.assertEqual(list(self.path.parent.glob("*backup*")), [])
+            self.assertEqual(list(self.path.parent.glob(".snp836-candidate-*")), [])
+
+    def test_concurrent_edit_after_validation_is_not_overwritten(self):
+        concurrent = self.before + b"# operator edit\n"
+        with self.assertRaises(repair.UnsafeConfiguration):
+            self.apply(validate=lambda candidate: self.path.write_bytes(concurrent))
+        self.assertEqual(self.path.read_bytes(), concurrent)
+
+    def test_symlink_is_rejected(self):
+        alias = self.path.parent / "alias"
+        alias.symlink_to(self.path)
+        with self.assertRaises(repair.UnsafeConfiguration):
+            repair.regular_file(alias)
+
+
+class BrokerPreflightTests(unittest.TestCase):
+    def setUp(self):
+        self.env = {"CELERY_BROKER_URL": "redis://fake-fixture:6379/1"}
+        self.config = {
+            "services": {
+                "api": {"environment": self.env.copy()},
+                "worker": {"environment": self.env.copy()},
+            }
+        }
+
+    def test_matching_plain_broker_is_accepted(self):
+        repair.validate_broker_environments(
+            self.config, [self.env.copy(), self.env.copy(), self.env.copy()]
+        )
+
+    def test_namespace_or_broker_mismatch_fails_at_every_layer(self):
+        for layer in ("api", "worker", "runtime"):
+            for setting, value in (
+                ("REDIS_KEY_PREFIX", "isolated"),
+                ("CELERY_BROKER_URL", "redis://different-fixture:6379/2"),
+                ("CELERY_USE_SENTINEL", "true"),
+                ("BROKER_USE_SSL", "true"),
+            ):
+                with (
+                    self.subTest(layer=layer, setting=setting),
+                    self.assertRaises(repair.UnsafeConfiguration),
+                ):
+                    config = copy.deepcopy(self.config)
+                    runtime = [self.env.copy()]
+                    target = (
+                        runtime[0]
+                        if layer == "runtime"
+                        else config["services"][layer]["environment"]
+                    )
+                    target[setting] = value
+                    repair.validate_broker_environments(config, runtime)
+
+    def test_any_workflow_backlog_unacked_or_invalid_reply_blocks_apply(self):
+        empty = {queue: 0 for queue in repair.WORKFLOW_QUEUES}
+        empty.update(unacked=0, unacked_index=0)
+        with (
+            patch.object(repair, "check_runtime_broker"),
+            patch.object(repair, "safe_command") as command,
+        ):
+            command.return_value = repair.json.dumps(empty)
+            self.assertEqual(repair.broker_check(self.config), empty)
+            for key in empty:
+                command.return_value = repair.json.dumps({**empty, key: 1})
+                with (
+                    self.subTest(key=key),
+                    self.assertRaises(repair.UnsafeConfiguration),
+                ):
+                    repair.broker_check(self.config)
+            for invalid in ({}, {**empty, "unknown": 0}, {**empty, "unacked": False}):
+                command.return_value = repair.json.dumps(invalid)
+                with self.assertRaises(repair.UnsafeConfiguration):
+                    repair.broker_check(self.config)
+
+    def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self):
+        self.config["services"]["worker"]["deploy"] = {"replicas": 2}
+        containers = []
+        for index, service in enumerate(("api", "worker", "worker")):
+            containers.append(
+                {
+                    "Id": f"fixture-{index}",
+                    "State": {"Running": True},
+                    "Config": {
+                        "Env": [
+                            "CELERY_BROKER_URL=" + self.env["CELERY_BROKER_URL"],
+                            "CELERY_QUEUES=" + BASE,
+                        ],
+                        "Labels": {
+                            "com.docker.compose.service": service,
+                            "com.docker.compose.project": "langgenius",
+                            "com.docker.compose.project.config_files": str(
+                                repair.TARGET
+                            ),
+                        },
+                    },
+                }
+            )
+        responses = [
+            "fixture-1\nfixture-2\n",
+            repair.json.dumps(containers),
+            "celery\0worker\0-Q\0" + BASE + "\0",
+            "celery\0worker\0-Q\0" + BASE + "\0",
+        ]
+        with patch.object(repair, "safe_command", side_effect=responses):
+            repair.check_runtime_broker(self.config)
+        with patch.object(repair, "safe_command", return_value="one-worker-only\n"):
+            with self.assertRaises(repair.UnsafeConfiguration):
+                repair.check_runtime_broker(self.config)
+        with patch.object(
+            repair,
+            "safe_command",
+            side_effect=responses[:2] + ["celery\0-Q\0wrong_queue\0"],
+        ):
+            with self.assertRaises(repair.UnsafeConfiguration):
+                repair.check_runtime_broker(self.config)
+        containers[0]["Config"]["Labels"]["com.docker.compose.project.config_files"] = (
+            "/different/compose.yaml"
+        )
+        with patch.object(
+            repair,
+            "safe_command",
+            side_effect=[responses[0], repair.json.dumps(containers)],
+        ):
+            with self.assertRaises(repair.UnsafeConfiguration):
+                repair.check_runtime_broker(self.config)
+
+
+if __name__ == "__main__":
+    unittest.main()

From 148db4240500d44c43f453a76b885ca532cf4209 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 16:45:19 +0800
Subject: [PATCH 041/108] feat(web): unify app not found and IP access error
 pages

---
 web/.storybook/storybook.css                  |   1 +
 .../(appDetailLayout)/[appId]/layout-main.tsx |   3 +-
 .../components/__tests__/splash.spec.tsx      |  10 +-
 web/app/(shareLayout)/components/splash.tsx   |  19 +-
 .../base/chat/chat/__tests__/hooks.spec.tsx   |  16 +-
 web/app/components/base/chat/chat/hooks.ts    |  14 +-
 .../file-uploader/__tests__/hooks.spec.ts     |   4 +-
 .../components/base/file-uploader/hooks.ts    |   8 +-
 .../image-uploader/__tests__/hooks.spec.ts    |   4 +-
 .../components/base/image-uploader/hooks.ts   |   6 +-
 .../try-app/__tests__/app-not-found.spec.tsx  |  69 +++++
 web/app/components/explore/try-app/index.tsx  | 160 ++++++------
 .../__tests__/use-result-run-state.spec.ts    |  12 +-
 .../hooks/__tests__/use-result-sender.spec.ts |  10 +-
 .../result/hooks/use-result-run-state.ts      |  18 +-
 .../result/hooks/use-result-sender.ts         |  13 +-
 web/app/get-query-client.ts                   |   3 +
 web/app/layout.tsx                            |   4 +-
 web/app/styles/globals.css                    |   1 +
 .../agent-detail/__tests__/layout.spec.tsx    |   4 +-
 web/features/agent-v2/agent-detail/layout.tsx |   8 +-
 .../__tests__/boundary.spec.tsx               | 172 ++++++------
 .../app-access-error/__tests__/page.spec.tsx  |  77 ++++++
 .../app-access-error/__tests__/state.spec.ts  | 118 +++++++++
 .../boundary.tsx                              |  22 +-
 .../locale-menu.tsx                           |  13 +-
 web/features/app-access-error/locale.ts       |  14 +
 .../app-access-error/page.stories.tsx         |  44 ++++
 web/features/app-access-error/page.tsx        | 123 +++++++++
 web/features/app-access-error/state.ts        | 235 +++++++++++++++++
 .../app-access-error/trial-boundary.tsx       |  48 ++++
 .../__tests__/access-restricted.spec.tsx      |  84 ------
 .../webapp-ip-access/__tests__/state.spec.ts  |  97 -------
 .../webapp-ip-access/access-restricted.tsx    |  69 -----
 web/features/webapp-ip-access/state.ts        | 116 ---------
 web/i18n/ar-TN/share.json                     |   7 +-
 web/i18n/de-DE/share.json                     |   7 +-
 web/i18n/en-US/share.json                     |   7 +-
 web/i18n/es-ES/share.json                     |   7 +-
 web/i18n/fa-IR/share.json                     |   7 +-
 web/i18n/fr-FR/share.json                     |   7 +-
 web/i18n/hi-IN/share.json                     |   7 +-
 web/i18n/id-ID/share.json                     |   7 +-
 web/i18n/it-IT/share.json                     |   7 +-
 web/i18n/ja-JP/share.json                     |   7 +-
 web/i18n/ko-KR/share.json                     |   7 +-
 web/i18n/lo-LA/share.json                     |   7 +-
 web/i18n/nl-NL/share.json                     |   7 +-
 web/i18n/pl-PL/share.json                     |   7 +-
 web/i18n/pt-BR/share.json                     |   7 +-
 web/i18n/ro-RO/share.json                     |   7 +-
 web/i18n/ru-RU/share.json                     |   7 +-
 web/i18n/sl-SI/share.json                     |   7 +-
 web/i18n/th-TH/share.json                     |   7 +-
 web/i18n/tr-TR/share.json                     |   7 +-
 web/i18n/uk-UA/share.json                     |   7 +-
 web/i18n/vi-VN/share.json                     |   7 +-
 web/i18n/zh-Hans/share.json                   |   7 +-
 web/i18n/zh-Hant/share.json                   |   7 +-
 .../illustrations/app-not-accessible.png      | Bin 0 -> 164689 bytes
 web/public/illustrations/ip-access-denied.png | Bin 10590 -> 0 bytes
 .../__tests__/ip-access-denied.spec.ts        | 244 ++++++++++++++++--
 .../share-human-input-upload.spec.ts          |  10 +-
 web/service/base.ts                           |  96 +++++--
 web/service/console/query-policies.ts         |  19 ++
 web/service/fetch.ts                          |  35 ++-
 web/service/share.ts                          |  16 +-
 67 files changed, 1455 insertions(+), 752 deletions(-)
 create mode 100644 web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
 rename web/features/{webapp-ip-access => app-access-error}/__tests__/boundary.spec.tsx (50%)
 create mode 100644 web/features/app-access-error/__tests__/page.spec.tsx
 create mode 100644 web/features/app-access-error/__tests__/state.spec.ts
 rename web/features/{webapp-ip-access => app-access-error}/boundary.tsx (56%)
 rename web/features/{webapp-ip-access => app-access-error}/locale-menu.tsx (89%)
 create mode 100644 web/features/app-access-error/locale.ts
 create mode 100644 web/features/app-access-error/page.stories.tsx
 create mode 100644 web/features/app-access-error/page.tsx
 create mode 100644 web/features/app-access-error/state.ts
 create mode 100644 web/features/app-access-error/trial-boundary.tsx
 delete mode 100644 web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
 delete mode 100644 web/features/webapp-ip-access/__tests__/state.spec.ts
 delete mode 100644 web/features/webapp-ip-access/access-restricted.tsx
 delete mode 100644 web/features/webapp-ip-access/state.ts
 create mode 100644 web/public/illustrations/app-not-accessible.png
 delete mode 100644 web/public/illustrations/ip-access-denied.png

diff --git a/web/.storybook/storybook.css b/web/.storybook/storybook.css
index 159deff4fee4ea..97ae138474d346 100644
--- a/web/.storybook/storybook.css
+++ b/web/.storybook/storybook.css
@@ -3,6 +3,7 @@
 @source '../app';
 @source '../context';
 @source '../hooks';
+@source '../features';
 @source '.';
 @source '../../packages/dify-ui/src';
 @source '../node_modules/streamdown/dist';
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
index e37f124dd9a961..02176547d48ab8 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
@@ -19,6 +19,7 @@ import { userProfileQueryOptions } from '@/features/account-profile/client'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import useDocumentTitle from '@/hooks/use-document-title'
 import { usePathname, useRouter } from '@/next/navigation'
+import { isAppDeletingOrDeleted } from '@/service/app-deletion'
 import { fetchAppDetailDirect } from '@/service/apps'
 import { AppModeEnum } from '@/types/app'
 import { getRedirectionPath } from '@/utils/app-redirection'
@@ -120,7 +121,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
       .catch((error: unknown) => {
         if (ignore) return
 
-        if (isNotFoundError(error)) router.replace('/apps')
+        if (isNotFoundError(error) && isAppDeletingOrDeleted(appId)) router.replace('/apps')
       })
       .finally(() => {
         if (ignore) return
diff --git a/web/app/(shareLayout)/components/__tests__/splash.spec.tsx b/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
index d4693d436febbc..318bd90c0f8563 100644
--- a/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
+++ b/web/app/(shareLayout)/components/__tests__/splash.spec.tsx
@@ -44,11 +44,11 @@ vi.mock('@/next/navigation', () => ({
   useSearchParams: () => navigationMocks.searchParams,
 }))
 
-vi.mock('@/features/webapp-ip-access/state', () => ({
-  captureIpAccessScope: () => ipAccessState.scope,
-  hasIpAccessDenied: () => ipAccessState.isDenied,
-  isIpAccessScopeCurrent: () => ipAccessState.isCurrent,
-  isIpAccessDeniedError: (error: unknown) => error === ipAccessState.deniedError,
+vi.mock('@/features/app-access-error/state', () => ({
+  captureAppAccessScope: () => ipAccessState.scope,
+  hasAppAccessError: () => ipAccessState.isDenied,
+  isAppAccessScopeCurrent: () => ipAccessState.isCurrent,
+  isAppAccessError: (error: unknown) => error === ipAccessState.deniedError,
 }))
 
 vi.mock('@/service/share', () => ({
diff --git a/web/app/(shareLayout)/components/splash.tsx b/web/app/(shareLayout)/components/splash.tsx
index 668117c6ec3183..9d63dea9b2f332 100644
--- a/web/app/(shareLayout)/components/splash.tsx
+++ b/web/app/(shareLayout)/components/splash.tsx
@@ -11,11 +11,11 @@ import AppUnavailable from '@/app/components/base/app-unavailable'
 import Loading from '@/app/components/base/loading'
 import { useWebAppStore } from '@/context/web-app-context'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessDeniedError,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessScope,
+  hasAppAccessError,
+  isAppAccessError,
+  isAppAccessScopeCurrent,
+} from '@/features/app-access-error/state'
 import { AccessMode } from '@/models/access-control'
 import { usePathname, useRouter, useSearchParams } from '@/next/navigation'
 import { fetchAccessToken } from '@/service/share'
@@ -71,10 +71,10 @@ function Splash({ children }: PropsWithChildren) {
     status?: number
   }>()
   useEffect(() => {
-    const scope = captureIpAccessScope()
+    const scope = captureAppAccessScope()
     let cancelled = false
     const canContinue = () =>
-      !cancelled && (scope === null || isIpAccessScopeCurrent(scope)) && !hasIpAccessDenied(scope)
+      !cancelled && (scope === null || isAppAccessScopeCurrent(scope)) && !hasAppAccessError(scope)
     if (!canContinue()) return
 
     const loginRedirect = resolveWebAppLoginRedirect(redirectUrl, window.location.origin)
@@ -141,7 +141,7 @@ function Splash({ children }: PropsWithChildren) {
             setWebAppPassport(address, access_token)
             redirectOrFinish()
           } catch (error) {
-            if (!canContinue() || isIpAccessDeniedError(error)) return
+            if (!canContinue() || isAppAccessError(error)) return
 
             if (error instanceof Response && error.status >= 500) {
               setInitializationError({ shareCode: effectiveShareCode, status: error.status })
@@ -149,7 +149,6 @@ function Splash({ children }: PropsWithChildren) {
             }
             if (error instanceof Response && error.status === 404) {
               setInitializationError({ shareCode: effectiveShareCode, status: 404 })
-              await webAppLogout(address)
               return
             }
             await webAppLogout(address)
@@ -157,7 +156,7 @@ function Splash({ children }: PropsWithChildren) {
           }
         }
       } catch (error) {
-        if (!canContinue() || isIpAccessDeniedError(error)) return
+        if (!canContinue() || isAppAccessError(error)) return
 
         setInitializationError({
           shareCode: effectiveShareCode,
diff --git a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
index b85aa932527556..0a4b30ea4dcc07 100644
--- a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
+++ b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
@@ -3,7 +3,7 @@ import type { FileEntity } from '@/app/components/base/file-uploader/types'
 import { toast } from '@langgenius/dify-ui/toast'
 import { act, renderHook } from '@testing-library/react'
 import { InputVarType, WorkflowRunningStatus } from '@/app/components/workflow/types'
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
 import { useChat } from '../hooks'
@@ -93,7 +93,7 @@ describe('useChat', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     vi.useFakeTimers()
     vi.mocked(useParams).mockReturnValue({} as ReturnType<typeof useParams>)
     vi.mocked(usePathname).mockReturnValue('')
@@ -963,7 +963,7 @@ describe('useChat', () => {
       'should ignore history results after %s',
       async (transition) => {
         window.history.replaceState({}, '', '/agent/history-test')
-        const scope = captureIpAccessScope()
+        const scope = captureAppAccessScope()
         const history = createDeferred<unknown>()
         const onGetConversationMessages = vi.fn(() => history.promise)
         const onGetSuggestedQuestions = vi.fn()
@@ -1017,7 +1017,7 @@ describe('useChat', () => {
           if (transition === 'stop') result.current.handleStop()
           if (transition === 'unmount') unmount()
           if (transition === 'denied')
-            handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope)
+            handleAppAccessError(403, { code: 'ip_access_denied' }, scope)
         })
         const chatListBeforeHistory = result.current.chatList
         await act(async () => {
@@ -1037,7 +1037,7 @@ describe('useChat', () => {
       'should consume history rejection after %s without completion callbacks',
       async (transition) => {
         window.history.replaceState({}, '', '/agent/history-rejection')
-        const scope = captureIpAccessScope()
+        const scope = captureAppAccessScope()
         const history = createDeferred<unknown>()
         const onGetSuggestedQuestions = vi.fn()
         const onConversationComplete = vi.fn()
@@ -1069,7 +1069,7 @@ describe('useChat', () => {
         await act(async () => {
           const error = new Response(null, { status: transition === 'denied' ? 403 : 503 })
           if (transition === 'denied')
-            handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+            handleAppAccessError(403, { code: 'ip_access_denied' }, scope, error)
           if (transition === 'navigation') window.history.replaceState({}, '', '/chat/another-app')
           if (transition === 'unmount') unmount()
           history.reject(error)
@@ -2448,7 +2448,7 @@ describe('useChat', () => {
       'should consume a rejected stop request when unmounted is %s',
       async (shouldUnmount) => {
         window.history.replaceState({}, '', '/agent/stop-test')
-        const scope = captureIpAccessScope()
+        const scope = captureAppAccessScope()
         const error = new Response(null, { status: 403 })
         const stopRequest = createDeferred<void>()
         const stopChat = vi.fn(() => stopRequest.promise)
@@ -2473,7 +2473,7 @@ describe('useChat', () => {
 
         await act(async () => {
           if (shouldUnmount) unmount()
-          handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+          handleAppAccessError(403, { code: 'ip_access_denied' }, scope, error)
           stopRequest.reject(error)
         })
         expect(toast.error).not.toHaveBeenCalled()
diff --git a/web/app/components/base/chat/chat/hooks.ts b/web/app/components/base/chat/chat/hooks.ts
index cedf781eb701ec..850776c3cc2b61 100644
--- a/web/app/components/base/chat/chat/hooks.ts
+++ b/web/app/components/base/chat/chat/hooks.ts
@@ -23,10 +23,10 @@ import { isInstalledAppPath } from '@/app/components/explore/installed-app/route
 import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
 import { NodeRunningStatus, WorkflowRunningStatus } from '@/app/components/workflow/types'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessScope,
+  hasAppAccessError,
+  isAppAccessScopeCurrent,
+} from '@/features/app-access-error/state'
 import useTimestamp from '@/hooks/use-timestamp'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
@@ -1122,11 +1122,11 @@ export const useChat = (
       pausedStateRef.current = false
       resetWorkflowEventsSubscription()
       const requestGeneration = ++workflowRequestGenerationRef.current
-      const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+      const appAccessScope = isPublicAPI ? captureAppAccessScope() : null
       const isCurrentRequest = () =>
         requestGeneration === workflowRequestGenerationRef.current &&
-        isIpAccessScopeCurrent(ipAccessScope) &&
-        !hasIpAccessDenied(ipAccessScope)
+        isAppAccessScopeCurrent(appAccessScope) &&
+        !hasAppAccessError(appAccessScope)
 
       const parentMessage = threadMessages.find((item) => item.id === data.parent_message_id)
 
diff --git a/web/app/components/base/file-uploader/__tests__/hooks.spec.ts b/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
index 9a14a4ccd204bf..dc93512f419cf5 100644
--- a/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
+++ b/web/app/components/base/file-uploader/__tests__/hooks.spec.ts
@@ -2,7 +2,7 @@ import type { FileEntity } from '../types'
 import type { FileUpload } from '@/app/components/base/features/types'
 import type { FileUploadConfigResponse } from '@/models/common'
 import { act, renderHook } from '@testing-library/react'
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { useFile, useFileSizeLimit } from '../hooks'
 
 const mockNotify = vi.fn()
@@ -12,7 +12,7 @@ const createUploadError = (ipDenied: boolean | 'cancelled') => {
   const error = new Error('Upload failed')
   if (ipDenied) {
     window.history.replaceState({}, '', '/chat/restricted-app')
-    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), error)
+    handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope(), error)
   }
   return error
 }
diff --git a/web/app/components/base/file-uploader/hooks.ts b/web/app/components/base/file-uploader/hooks.ts
index 0cb59c2c28886e..ca6a2795864f5b 100644
--- a/web/app/components/base/file-uploader/hooks.ts
+++ b/web/app/components/base/file-uploader/hooks.ts
@@ -17,7 +17,7 @@ import {
   VIDEO_SIZE_LIMIT,
 } from '@/app/components/base/file-uploader/constants'
 import { SupportUploadFileTypes } from '@/app/components/workflow/types'
-import { isIpAccessDeniedError } from '@/features/webapp-ip-access/state'
+import { isAppAccessError } from '@/features/app-access-error/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { uploadRemoteFileInfo } from '@/service/common'
 import { uploadHumanInputFormLocalFile, uploadHumanInputFormRemoteFileInfo } from '@/service/share'
@@ -193,7 +193,7 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
               t(($) => $['fileUploader.uploadFromComputerUploadError'], { ns: 'common' }),
               t,
             )
-            if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
+            if (!isAppAccessError(error) && !isAbortError(error)) toast.error(errorMessage)
             handleUpdateFile({ ...uploadingFile, progress: -1 })
           },
         }
@@ -281,7 +281,7 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
           else handleUpdateFile(newFile)
         })
         .catch((error: unknown) => {
-          if (!isIpAccessDeniedError(error) && !isAbortError(error))
+          if (!isAppAccessError(error) && !isAbortError(error))
             toast.error(t(($) => $['fileUploader.pasteFileLinkInvalid'], { ns: 'common' }))
           handleRemoveFile(uploadingFile.id)
         })
@@ -375,7 +375,7 @@ export const useFile = (fileConfig: FileUpload, noNeedToCheckEnable = true) => {
                 t(($) => $['fileUploader.uploadFromComputerUploadError'], { ns: 'common' }),
                 t,
               )
-              if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
+              if (!isAppAccessError(error) && !isAbortError(error)) toast.error(errorMessage)
               handleUpdateFile({ ...uploadingFile, progress: -1 })
             },
           }
diff --git a/web/app/components/base/image-uploader/__tests__/hooks.spec.ts b/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
index 7087f1d86939d6..c4983023793e71 100644
--- a/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
+++ b/web/app/components/base/image-uploader/__tests__/hooks.spec.ts
@@ -1,6 +1,6 @@
 import type { ImageFile } from '@/types/app'
 import { act, renderHook } from '@testing-library/react'
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { TransferMethod } from '@/types/app'
 import { useImageFiles, useLocalFileUploader } from '../hooks'
 
@@ -11,7 +11,7 @@ const createUploadError = (ipDenied: boolean | 'cancelled') => {
   const error = new Error('Upload failed')
   if (ipDenied) {
     window.history.replaceState({}, '', '/chat/restricted-app')
-    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), error)
+    handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope(), error)
   }
   return error
 }
diff --git a/web/app/components/base/image-uploader/hooks.ts b/web/app/components/base/image-uploader/hooks.ts
index 41692a3e698d98..a0f045a6d69b71 100644
--- a/web/app/components/base/image-uploader/hooks.ts
+++ b/web/app/components/base/image-uploader/hooks.ts
@@ -2,7 +2,7 @@ import type { ImageFile } from '@/types/app'
 import { toast } from '@langgenius/dify-ui/toast'
 import { useCallback, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { isIpAccessDeniedError } from '@/features/webapp-ip-access/state'
+import { isAppAccessError } from '@/features/app-access-error/state'
 import { useParams } from '@/next/navigation'
 import { ALLOW_FILE_EXTENSIONS, TransferMethod } from '@/types/app'
 import { isAbortError } from '@/utils/is-abort-error'
@@ -105,7 +105,7 @@ export const useImageFiles = () => {
               t(($) => $['imageUploader.uploadFromComputerUploadError'], { ns: 'common' }),
               t,
             )
-            if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
+            if (!isAppAccessError(error) && !isAbortError(error)) toast.error(errorMessage)
             const newFiles = [
               ...files.slice(0, index),
               { ...currentImageFile, progress: -1 },
@@ -190,7 +190,7 @@ export const useLocalFileUploader = ({
                   t(($) => $['imageUploader.uploadFromComputerUploadError'], { ns: 'common' }),
                   t,
                 )
-                if (!isIpAccessDeniedError(error) && !isAbortError(error)) toast.error(errorMessage)
+                if (!isAppAccessError(error) && !isAbortError(error)) toast.error(errorMessage)
                 onUpload({ ...imageFile, progress: -1 })
               },
             },
diff --git a/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx b/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
new file mode 100644
index 00000000000000..87bc444e36820d
--- /dev/null
+++ b/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
@@ -0,0 +1,69 @@
+import type { ComponentProps } from 'react'
+import { toast } from '@langgenius/dify-ui/toast'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
+import { I18nextProvider } from 'react-i18next'
+import {
+  appAccessErrorAtom,
+  appAccessStore,
+  captureAppAccessScope,
+  isAppAccessError,
+} from '@/features/app-access-error/state'
+import enCommon from '@/i18n/en-US/common.json'
+import enShare from '@/i18n/en-US/share.json'
+import TryApp from '../index'
+
+vi.unmock('react-i18next')
+vi.mock('../app', () => ({ default: () => null }))
+vi.mock('../preview', () => ({ default: () => null }))
+vi.mock('../app-info', () => ({ default: () => null }))
+vi.mock('@langgenius/dify-ui/toast', () => ({ toast: { error: vi.fn() } }))
+
+it('shows the unified error inside a dismissible trial dialog, retaining the parent page', async () => {
+  vi.spyOn(navigator, 'languages', 'get').mockReturnValue(['en-US'])
+  const i18n = createInstance()
+  await i18n.init({
+    lng: 'en-US',
+    keySeparator: false,
+    resources: { 'en-US': { common: enCommon } },
+  })
+  window.history.replaceState({}, '', '/explore/apps')
+  captureAppAccessScope()
+  const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+    new Response(JSON.stringify({ code: 'app_not_found', message: 'App not found' }), {
+      status: 404,
+      headers: { 'Content-Type': 'application/json' },
+    }),
+  )
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: (count, error) => !isAppAccessError(error) && count < 3 } },
+  })
+  const onClose = vi.fn()
+  const user = userEvent.setup()
+  render(
+    <QueryClientProvider client={queryClient}>
+      <I18nextProvider i18n={i18n}>
+        <p>Explore apps</p>
+        <TryApp
+          appId="missing"
+          app={{ can_trial: true } as ComponentProps<typeof TryApp>['app']}
+          onClose={onClose}
+          onCreate={vi.fn()}
+        />
+      </I18nextProvider>
+    </QueryClientProvider>,
+  )
+  expect(
+    await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] }),
+  ).toBeInTheDocument()
+  expect(screen.getByText('Explore apps')).toBeInTheDocument()
+  expect(fetch).toHaveBeenCalledOnce()
+  expect(toast.error).not.toHaveBeenCalled()
+  expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+  await user.click(screen.getByRole('button', { name: enCommon['operation.close'] }))
+  expect(onClose).toHaveBeenCalledOnce()
+  queryClient.clear()
+  vi.restoreAllMocks()
+})
diff --git a/web/app/components/explore/try-app/index.tsx b/web/app/components/explore/try-app/index.tsx
index 956350e293da52..a890fb33ba569d 100644
--- a/web/app/components/explore/try-app/index.tsx
+++ b/web/app/components/explore/try-app/index.tsx
@@ -8,6 +8,7 @@ import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppUnavailable from '@/app/components/base/app-unavailable'
 import Loading from '@/app/components/base/loading'
+import TrialAppAccessBoundary from '@/features/app-access-error/trial-boundary'
 import { useGetTryAppInfo } from '@/service/use-try-app'
 import App from './app'
 import AppInfo from './app-info'
@@ -24,7 +25,7 @@ type Props = Readonly<{
   onCreate: () => void
 }>
 
-function TryApp({
+function TryAppContent({
   appId,
   app,
   canCreate = true,
@@ -39,86 +40,95 @@ function TryApp({
   const activeType = canUseTryTab ? type : TypeEnum.DETAIL
   const { data: appDetail, isLoading, isError, error } = useGetTryAppInfo(appId)
 
+  return (
+    <div className="h-full min-w-7xl">
+      {isLoading ? (
+        <div className="flex h-full items-center justify-center">
+          <Loading type="area" />
+        </div>
+      ) : isError ? (
+        <div className="flex h-full items-center justify-center">
+          <AppUnavailable
+            className="size-auto"
+            isUnknownReason={!error}
+            unknownReason={error instanceof Error ? error.message : undefined}
+          />
+        </div>
+      ) : !appDetail ? (
+        <div className="flex h-full items-center justify-center">
+          <AppUnavailable className="size-auto" isUnknownReason />
+        </div>
+      ) : (
+        <Tabs
+          value={activeType}
+          onValueChange={(selectedValue) => setType(selectedValue)}
+          className="flex h-full flex-col"
+        >
+          <div className="flex shrink-0 justify-between pl-4">
+            <TabsList>
+              <TabsTab
+                value={TypeEnum.TRY}
+                disabled={!canUseTryTab}
+                className="pt-2 data-active:border-util-colors-blue-brand-blue-brand-500"
+              >
+                <span className="system-md-semibold-uppercase">
+                  {t(($) => $['tryApp.tabHeader.try'], { ns: 'explore' })}
+                </span>
+              </TabsTab>
+              <TabsTab
+                value={TypeEnum.DETAIL}
+                className="pt-2 data-active:border-util-colors-blue-brand-blue-brand-500"
+              >
+                <span className="system-md-semibold-uppercase">
+                  {t(($) => $['tryApp.tabHeader.detail'], { ns: 'explore' })}
+                </span>
+              </TabsTab>
+            </TabsList>
+            <Button
+              size="large"
+              variant="tertiary"
+              aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+              className="flex size-7 items-center justify-center rounded-[10px] p-0 text-components-button-tertiary-text"
+              onClick={onClose}
+            >
+              <span aria-hidden className="i-ri-close-line size-5" />
+            </Button>
+          </div>
+          {/* Main content */}
+          <div className="mt-2 flex h-0 grow justify-between space-x-2">
+            <TabsPanel value={TypeEnum.TRY} className="min-w-0 flex-1">
+              <App appId={appId} appDetail={appDetail} />
+            </TabsPanel>
+            <TabsPanel value={TypeEnum.DETAIL} className="min-w-0 flex-1">
+              <Preview appId={appId} appDetail={appDetail} />
+            </TabsPanel>
+            <AppInfo
+              className="w-90 shrink-0"
+              appDetail={appDetail}
+              appId={appId}
+              canCreate={canCreate}
+              categories={categories}
+              createButtonStepByStepTourTarget={createButtonStepByStepTourTarget}
+              onCreate={onCreate}
+            />
+          </div>
+        </Tabs>
+      )}
+    </div>
+  )
+}
+function TryApp(props: Props) {
   return (
     <Dialog
       open
       onOpenChange={(open) => {
-        if (!open) onClose()
+        if (!open) props.onClose()
       }}
     >
-      <DialogContent className="h-[calc(100dvh-32px)] max-h-[calc(100dvh-32px)] w-full max-w-[calc(100vw-32px)] min-w-7xl overflow-hidden overflow-x-auto border-none p-2 text-left align-middle">
-        {isLoading ? (
-          <div className="flex h-full items-center justify-center">
-            <Loading type="area" />
-          </div>
-        ) : isError ? (
-          <div className="flex h-full items-center justify-center">
-            <AppUnavailable
-              className="size-auto"
-              isUnknownReason={!error}
-              unknownReason={error instanceof Error ? error.message : undefined}
-            />
-          </div>
-        ) : !appDetail ? (
-          <div className="flex h-full items-center justify-center">
-            <AppUnavailable className="size-auto" isUnknownReason />
-          </div>
-        ) : (
-          <Tabs
-            value={activeType}
-            onValueChange={(selectedValue) => setType(selectedValue)}
-            className="flex h-full flex-col"
-          >
-            <div className="flex shrink-0 justify-between pl-4">
-              <TabsList>
-                <TabsTab
-                  value={TypeEnum.TRY}
-                  disabled={!canUseTryTab}
-                  className="pt-2 data-active:border-util-colors-blue-brand-blue-brand-500"
-                >
-                  <span className="system-md-semibold-uppercase">
-                    {t(($) => $['tryApp.tabHeader.try'], { ns: 'explore' })}
-                  </span>
-                </TabsTab>
-                <TabsTab
-                  value={TypeEnum.DETAIL}
-                  className="pt-2 data-active:border-util-colors-blue-brand-blue-brand-500"
-                >
-                  <span className="system-md-semibold-uppercase">
-                    {t(($) => $['tryApp.tabHeader.detail'], { ns: 'explore' })}
-                  </span>
-                </TabsTab>
-              </TabsList>
-              <Button
-                size="large"
-                variant="tertiary"
-                aria-label={t(($) => $['operation.close'], { ns: 'common' })}
-                className="flex size-7 items-center justify-center rounded-[10px] p-0 text-components-button-tertiary-text"
-                onClick={onClose}
-              >
-                <span aria-hidden className="i-ri-close-line size-5" />
-              </Button>
-            </div>
-            {/* Main content */}
-            <div className="mt-2 flex h-0 grow justify-between space-x-2">
-              <TabsPanel value={TypeEnum.TRY} className="min-w-0 flex-1">
-                <App appId={appId} appDetail={appDetail} />
-              </TabsPanel>
-              <TabsPanel value={TypeEnum.DETAIL} className="min-w-0 flex-1">
-                <Preview appId={appId} appDetail={appDetail} />
-              </TabsPanel>
-              <AppInfo
-                className="w-90 shrink-0"
-                appDetail={appDetail}
-                appId={appId}
-                canCreate={canCreate}
-                categories={categories}
-                createButtonStepByStepTourTarget={createButtonStepByStepTourTarget}
-                onCreate={onCreate}
-              />
-            </div>
-          </Tabs>
-        )}
+      <DialogContent className="h-[calc(100dvh-32px)] max-h-[calc(100dvh-32px)] w-full max-w-[calc(100vw-32px)] min-w-0 overflow-hidden overflow-x-auto border-none p-2 text-left align-middle">
+        <TrialAppAccessBoundary key={props.appId} appId={props.appId} onClose={props.onClose}>
+          <TryAppContent {...props} />
+        </TrialAppAccessBoundary>
       </DialogContent>
     </Dialog>
   )
diff --git a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
index 952d3dc7dba1a8..aa19e24de775bc 100644
--- a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
+++ b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-run-state.spec.ts
@@ -1,6 +1,6 @@
 import type { FeedbackType } from '@/app/components/base/chat/chat/type'
 import { act, renderHook, waitFor } from '@testing-library/react'
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { AppSourceType } from '@/service/share'
 import { useResultRunState } from '../use-result-run-state'
 
@@ -29,7 +29,7 @@ describe('useResultRunState', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     stopChatMessageRespondingMock.mockResolvedValue(undefined)
     stopWorkflowMessageMock.mockResolvedValue(undefined)
     updateFeedbackMock.mockResolvedValue(undefined)
@@ -86,11 +86,11 @@ describe('useResultRunState', () => {
         '',
         isWorkflow ? '/workflow/stop-test' : '/completion/stop-test',
       )
-      const scope = captureIpAccessScope()
+      const scope = captureAppAccessScope()
       const error = new Response(null, { status: 403 })
       const stop = isWorkflow ? stopWorkflowMessageMock : stopChatMessageRespondingMock
       stop.mockImplementationOnce(async () => {
-        handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope, error)
+        handleAppAccessError(403, { code: 'ip_access_denied' }, scope, error)
         throw error
       })
       const notify = vi.fn()
@@ -185,7 +185,7 @@ describe('useResultRunState', () => {
 
   it('should not send a stop request after another public request denies access', async () => {
     window.history.replaceState({}, '', '/workflow/already-denied')
-    const scope = captureIpAccessScope()
+    const scope = captureAppAccessScope()
     const notify = vi.fn()
     const { result } = renderHook(() =>
       useResultRunState({
@@ -196,7 +196,7 @@ describe('useResultRunState', () => {
     )
     act(() => {
       result.current.setCurrentTaskId('task-denied')
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, scope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, scope)
     })
     await act(async () => {
       await result.current.handleStop()
diff --git a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
index 93e76dde507695..80e77c76b4f616 100644
--- a/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
+++ b/web/app/components/share/text-generation/result/hooks/__tests__/use-result-sender.spec.ts
@@ -4,7 +4,7 @@ import type { PromptConfig } from '@/models/debug'
 import type { AppSourceType } from '@/service/share'
 import type { VisionSettings } from '@/types/app'
 import { act, renderHook, waitFor } from '@testing-library/react'
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { AppSourceType as AppSourceTypeEnum } from '@/service/share'
 import { withSelectorKey } from '@/test/i18n-mock'
 import { Resolution, TransferMethod } from '@/types/app'
@@ -245,7 +245,7 @@ describe('useResultSender', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     mockWebAppState.appInfo.mode = 'completion'
     validateResultRequestMock.mockReturnValue({ canSend: true })
     buildResultRequestDataMock.mockReturnValue({ inputs: { name: 'Alice' } })
@@ -587,10 +587,10 @@ describe('useResultSender', () => {
 
       await act(async () => {
         if (transition === 'denied')
-          handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+          handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope())
         else {
           window.history.replaceState({}, '', '/completion/another-app')
-          captureIpAccessScope()
+          captureAppAccessScope()
         }
         completionHandlers![callback]()
       })
@@ -619,7 +619,7 @@ describe('useResultSender', () => {
 
     await act(async () => {
       await result.current.handleSend()
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+      handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope())
       rejectRequest(new Error('Late workflow failure'))
     })
 
diff --git a/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts b/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
index 25da6c7b2ae930..fe3098d920a0c7 100644
--- a/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
+++ b/web/app/components/share/text-generation/result/hooks/use-result-run-state.ts
@@ -4,11 +4,11 @@ import type { WorkflowProcess } from '@/app/components/base/chat/types'
 import { useBoolean } from 'ahooks'
 import { useCallback, useEffect, useReducer, useRef, useState } from 'react'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessDeniedError,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessScope,
+  hasAppAccessError,
+  isAppAccessError,
+  isAppAccessScopeCurrent,
+} from '@/features/app-access-error/state'
 import {
   AppSourceType,
   stopChatMessageResponding,
@@ -178,11 +178,11 @@ export const useResultRunState = ({
     if (!currentTaskId || isStopping) return
 
     const runGeneration = runGenerationRef.current
-    const ipAccessScope = appSourceType === AppSourceType.webApp ? captureIpAccessScope() : null
+    const appAccessScope = appSourceType === AppSourceType.webApp ? captureAppAccessScope() : null
     const isCurrentRequest = () =>
       runGeneration === runGenerationRef.current &&
-      isIpAccessScopeCurrent(ipAccessScope) &&
-      !hasIpAccessDenied(ipAccessScope)
+      isAppAccessScopeCurrent(appAccessScope) &&
+      !hasAppAccessError(appAccessScope)
     if (!isCurrentRequest()) return
 
     const abortController = abortControllerRef.current
@@ -193,7 +193,7 @@ export const useResultRunState = ({
 
       if (isCurrentRequest()) abortController?.abort()
     } catch (error) {
-      if (!isCurrentRequest() || isIpAccessDeniedError(error)) return
+      if (!isCurrentRequest() || isAppAccessError(error)) return
 
       const message = error instanceof Error ? error.message : String(error)
       notify({ type: 'error', message })
diff --git a/web/app/components/share/text-generation/result/hooks/use-result-sender.ts b/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
index 0984a9648e641d..ce16701f165a51 100644
--- a/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
+++ b/web/app/components/share/text-generation/result/hooks/use-result-sender.ts
@@ -8,10 +8,10 @@ import { trackWebAppEvent } from '@/app/components/base/amplitude/web-app-event'
 import { TEXT_GENERATION_TIMEOUT_MS } from '@/config'
 import { useWebAppStore } from '@/context/web-app-context'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessScope,
+  hasAppAccessError,
+  isAppAccessScopeCurrent,
+} from '@/features/app-access-error/state'
 import { AppSourceType, sendCompletionMessage, sendWorkflowMessage } from '@/service/share'
 import { sleep } from '@/utils'
 import { buildResultRequestData, validateResultRequest } from '../result-request'
@@ -94,7 +94,7 @@ export const useResultSender = ({
       promptConfig,
       visionConfig,
     })
-    const ipAccessScope = appSourceType === AppSourceType.webApp ? captureIpAccessScope() : null
+    const appAccessScope = appSourceType === AppSourceType.webApp ? captureAppAccessScope() : null
 
     runState.prepareForNewRun()
 
@@ -113,7 +113,8 @@ export const useResultSender = ({
     let completionChunks: string[] = []
     let tempMessageId = ''
     const stopInactiveRequest = () => {
-      if (isIpAccessScopeCurrent(ipAccessScope) && !hasIpAccessDenied(ipAccessScope)) return false
+      if (isAppAccessScopeCurrent(appAccessScope) && !hasAppAccessError(appAccessScope))
+        return false
 
       if (!isEnd) {
         runState.setRespondingFalse()
diff --git a/web/app/get-query-client.ts b/web/app/get-query-client.ts
index 8526a53dc4ecf9..673887057df2c5 100644
--- a/web/app/get-query-client.ts
+++ b/web/app/get-query-client.ts
@@ -1,4 +1,5 @@
 import { defaultShouldDehydrateQuery, environmentManager, QueryClient } from '@tanstack/react-query'
+import { isAppAccessError } from '@/features/app-access-error/state'
 
 const STALE_TIME = 1000 * 60 * 5
 
@@ -7,6 +8,8 @@ function makeQueryClient() {
     defaultOptions: {
       queries: {
         staleTime: STALE_TIME,
+        retry: (failureCount, error) =>
+          !isAppAccessError(error) && failureCount < (environmentManager.isServer() ? 0 : 3),
       },
       dehydrate: {
         shouldDehydrateQuery: (query) =>
diff --git a/web/app/layout.tsx b/web/app/layout.tsx
index 58a403c6c76614..7b3899446bd94f 100644
--- a/web/app/layout.tsx
+++ b/web/app/layout.tsx
@@ -8,12 +8,12 @@ import { ThemeProvider } from 'next-themes'
 import { NuqsAdapter } from 'nuqs/adapters/next/app'
 import { IS_PROD } from '@/config'
 import { getDatasetMap } from '@/env'
+import AppAccessBoundary from '@/features/app-access-error/boundary'
 import { SystemFeaturesBootstrapBoundary } from '@/features/system-features/bootstrap-boundary'
 import {
   dehydrateSystemFeatures,
   getOptionalSystemFeatures,
 } from '@/features/system-features/server'
-import IpAccessBoundary from '@/features/webapp-ip-access/boundary'
 import { getLocaleOnServer } from '@/i18n-config/server'
 import { headers } from '@/next/headers'
 import { getApplicationTitle } from '@/utils/document-title'
@@ -86,7 +86,7 @@ export default async function RootLayout({ children }: { children: React.ReactNo
                       <SystemFeaturesBootstrapBoundary>
                         <PartnerStackCookieRecorder />
                         <TooltipProvider delay={300} closeDelay={200}>
-                          <IpAccessBoundary>{children}</IpAccessBoundary>
+                          <AppAccessBoundary>{children}</AppAccessBoundary>
                         </TooltipProvider>
                       </SystemFeaturesBootstrapBoundary>
                     </I18nServerProvider>
diff --git a/web/app/styles/globals.css b/web/app/styles/globals.css
index 9cb7d3a459f995..44f8e606661896 100644
--- a/web/app/styles/globals.css
+++ b/web/app/styles/globals.css
@@ -3,6 +3,7 @@
 @source '../../app';
 @source '../../context';
 @source '../../hooks';
+@source '../../features';
 @source '../../../packages/dify-ui/src';
 @source '../../node_modules/streamdown/dist';
 @source '../../node_modules/@streamdown/math/dist';
diff --git a/web/features/agent-v2/agent-detail/__tests__/layout.spec.tsx b/web/features/agent-v2/agent-detail/__tests__/layout.spec.tsx
index 6215125739aecd..2dffda1345ff0f 100644
--- a/web/features/agent-v2/agent-detail/__tests__/layout.spec.tsx
+++ b/web/features/agent-v2/agent-detail/__tests__/layout.spec.tsx
@@ -78,7 +78,7 @@ describe('AgentDetailLayout', () => {
     await waitFor(() => expect(router.replace).toHaveBeenCalledWith('/agents/agent-1/configure'))
   })
 
-  it('redirects to the roster when the agent no longer exists', async () => {
+  it('leaves a missing agent to the app error boundary without redirecting', async () => {
     const { wrapper, queryClient } = setup()
     queryClient.setDefaultOptions({ queries: { retry: false, retryOnMount: false } })
     queryClient
@@ -94,7 +94,7 @@ describe('AgentDetailLayout', () => {
         fetchStatus: 'idle',
       })
     render(content, { wrapper })
-    await waitFor(() => expect(router.replace).toHaveBeenCalledWith('/agents'))
+    expect(router.replace).not.toHaveBeenCalled()
     expect(screen.queryByText('Agent detail content')).not.toBeInTheDocument()
   })
 })
diff --git a/web/features/agent-v2/agent-detail/layout.tsx b/web/features/agent-v2/agent-detail/layout.tsx
index 857c5ceea5b554..cbc95ebb98981f 100644
--- a/web/features/agent-v2/agent-detail/layout.tsx
+++ b/web/features/agent-v2/agent-detail/layout.tsx
@@ -15,15 +15,12 @@ type AgentDetailLayoutProps = {
   children: ReactNode
 }
 
-const isNotFoundResponse = (error: unknown) => error instanceof Response && error.status === 404
-
 export function AgentDetailLayout({ agentId, children }: AgentDetailLayoutProps) {
   const { t } = useTranslation('agentV2')
   const pathname = usePathname()
   const router = useRouter()
   const { t: tCommon } = useTranslation('common')
   const { agentQuery, ...capabilities } = useAgentPermissions(agentId)
-  const shouldRedirectToRoster = isNotFoundResponse(agentQuery.error)
   const section = pathname.endsWith('/access-config')
     ? 'access-config'
     : pathname.endsWith('/access')
@@ -37,9 +34,8 @@ export function AgentDetailLayout({ agentId, children }: AgentDetailLayoutProps)
   const agentTitle = agentQuery.data?.name ?? t(($) => $['agentDetail.documentTitle'])
   const canAccessSection = getAgentSectionAccess(capabilities)[section]
   const defaultSection = getAgentDefaultSection(capabilities)
-  const redirectPath = shouldRedirectToRoster
-    ? '/agents'
-    : agentQuery.isSuccess && !canAccessSection
+  const redirectPath =
+    agentQuery.isSuccess && !canAccessSection
       ? defaultSection
         ? `/agents/${agentId}/${defaultSection}`
         : '/agents'
diff --git a/web/features/webapp-ip-access/__tests__/boundary.spec.tsx b/web/features/app-access-error/__tests__/boundary.spec.tsx
similarity index 50%
rename from web/features/webapp-ip-access/__tests__/boundary.spec.tsx
rename to web/features/app-access-error/__tests__/boundary.spec.tsx
index 874a350c7fd00a..2e7ac2e709a539 100644
--- a/web/features/webapp-ip-access/__tests__/boundary.spec.tsx
+++ b/web/features/app-access-error/__tests__/boundary.spec.tsx
@@ -3,11 +3,17 @@ import { act, render, screen } from '@testing-library/react'
 import { createInstance } from 'i18next'
 import { StrictMode } from 'react'
 import { I18nextProvider, initReactI18next } from 'react-i18next'
+import enCommon from '@/i18n/en-US/common.json'
 import enShare from '@/i18n/en-US/share.json'
-import IpAccessBoundary from '../boundary'
-import { captureIpAccessScope, handleIpAccessDenied } from '../state'
+import AppAccessBoundary from '../boundary'
+import { captureAppAccessScope, handleAppAccessError } from '../state'
 
 vi.unmock('react-i18next')
+vi.mock('@/i18n-config/load-resource', () => ({
+  loadI18nResource: async (_locale: string, namespace: string) => ({
+    default: namespace === 'share' ? enShare : enCommon,
+  }),
+}))
 vi.mock('@/i18n-config', () => ({ setLocaleOnClient: vi.fn() }))
 vi.mock('@/next/navigation', () => ({
   usePathname: () => window.location.pathname,
@@ -24,7 +30,7 @@ function AppBootstrap({ request }: { request: () => Promise<never> }) {
 describe('IP denial page boundary', () => {
   beforeEach(async () => {
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     await i18n.use(initReactI18next).init({
       lng: 'en-US',
       fallbackLng: 'en-US',
@@ -39,123 +45,139 @@ describe('IP denial page boundary', () => {
     vi.useRealTimers()
   })
 
-  it.each(['/chat/app', '/environment/workflow/app', '/form/token'])(
-    'replaces %s and stops query retries after the first IP rejection',
-    async (path) => {
-      vi.useFakeTimers()
-      window.history.replaceState({}, '', path)
-      const queryClient = new QueryClient({
-        defaultOptions: { queries: { retry: 3, retryDelay: 100 } },
-      })
-      const request = vi.fn(async () => {
-        const scope = captureIpAccessScope()
-        const error = new Response('', { status: 403 })
-        handleIpAccessDenied(
-          403,
-          { code: 'ip_access_denied', client_ip: '203.0.113.42' },
-          scope,
-          error,
-        )
-        throw error
-      })
-      render(
-        <I18nextProvider i18n={i18n}>
-          <QueryClientProvider client={queryClient}>
-            <IpAccessBoundary>
-              <AppBootstrap request={request} />
-            </IpAccessBoundary>
-          </QueryClientProvider>
-        </I18nextProvider>,
+  it.each([
+    '/chat/app',
+    '/environment/workflow/app',
+    '/form/token',
+    '/app/app/workflow',
+    '/agents/app/access',
+    '/explore/installed/app',
+  ])('replaces %s and stops query retries after the first IP rejection', async (path) => {
+    vi.useFakeTimers()
+    window.history.replaceState({}, '', path)
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: 3, retryDelay: 100 } },
+    })
+    const request = vi.fn(async () => {
+      const scope = captureAppAccessScope()
+      const error = new Response('', { status: 403 })
+      handleAppAccessError(
+        403,
+        { code: 'ip_access_denied', client_ip: '203.0.113.42' },
+        scope,
+        error,
       )
+      throw error
+    })
+    render(
+      <I18nextProvider i18n={i18n}>
+        <QueryClientProvider client={queryClient}>
+          <AppAccessBoundary>
+            <AppBootstrap request={request} />
+          </AppAccessBoundary>
+        </QueryClientProvider>
+      </I18nextProvider>,
+    )
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(500)
+    })
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(
+      screen.getByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).toBeInTheDocument()
+    expect(screen.queryByText('Application loading')).not.toBeInTheDocument()
+    expect(screen.getByText('203.0.113.42', { selector: 'code' })).toBeInTheDocument()
+
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(5_000)
+    })
+    expect(request).toHaveBeenCalledTimes(1)
+    queryClient.clear()
+  })
 
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(0)
-      })
-      expect(request).toHaveBeenCalledTimes(1)
-      expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
-      expect(screen.queryByText('Application loading')).not.toBeInTheDocument()
-      expect(screen.getByText('203.0.113.42', { selector: 'code' })).toBeInTheDocument()
-
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(5_000)
-      })
-      expect(request).toHaveBeenCalledTimes(1)
-      queryClient.clear()
-    },
-  )
-
-  it('renders the new app immediately and ignores the old app response after navigation', () => {
+  it('renders the new app immediately and ignores the old app response after navigation', async () => {
     window.history.replaceState({}, '', '/chat/first')
-    const previousScope = captureIpAccessScope()
+    const previousScope = captureAppAccessScope()
     const contents = (
       <I18nextProvider i18n={i18n}>
-        <IpAccessBoundary>
+        <AppAccessBoundary>
           <p>Current application</p>
-        </IpAccessBoundary>
+        </AppAccessBoundary>
       </I18nextProvider>
     )
     const { rerender } = render(contents)
     act(() => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, previousScope)
     })
-    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(
+      await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).toBeInTheDocument()
 
     window.history.replaceState({}, '', '/agent/second')
     rerender(
       <I18nextProvider i18n={i18n}>
-        <IpAccessBoundary>
+        <AppAccessBoundary>
           <p>Current application</p>
-        </IpAccessBoundary>
+        </AppAccessBoundary>
       </I18nextProvider>,
     )
     act(() => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, previousScope)
     })
     expect(screen.getByText('Current application')).toBeInTheDocument()
-    expect(screen.queryByRole('heading', { name: 'Access restricted' })).not.toBeInTheDocument()
+    expect(
+      screen.queryByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).not.toBeInTheDocument()
   })
 
-  it('starts a new visit after leaving for a console page with no public requests', () => {
+  it('starts a new visit after leaving for a console page with no public requests', async () => {
     window.history.replaceState({}, '', '/chat/app')
-    const previousScope = captureIpAccessScope()
+    const previousScope = captureAppAccessScope()
     const application = (
       <I18nextProvider i18n={i18n}>
-        <IpAccessBoundary>
+        <AppAccessBoundary>
           <p>Current application</p>
-        </IpAccessBoundary>
+        </AppAccessBoundary>
       </I18nextProvider>
     )
     const { rerender } = render(application)
     act(() => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, previousScope)
     })
-    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(
+      await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).toBeInTheDocument()
 
     window.history.replaceState({}, '', '/apps')
     rerender(
       <I18nextProvider i18n={i18n}>
-        <IpAccessBoundary>
+        <AppAccessBoundary>
           <p>Console</p>
-        </IpAccessBoundary>
+        </AppAccessBoundary>
       </I18nextProvider>,
     )
     expect(screen.getByText('Console')).toBeInTheDocument()
 
     window.history.replaceState({}, '', '/chat/app')
     rerender(application)
-    const currentScope = captureIpAccessScope()
+    const currentScope = captureAppAccessScope()
     expect(currentScope?.key).toBe(previousScope?.key)
     expect(currentScope?.epoch).not.toBe(previousScope?.epoch)
     act(() => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, previousScope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, previousScope)
     })
     expect(screen.getByText('Current application')).toBeInTheDocument()
-    expect(screen.queryByRole('heading', { name: 'Access restricted' })).not.toBeInTheDocument()
+    expect(
+      screen.queryByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).not.toBeInTheDocument()
 
     act(() => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, currentScope)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, currentScope)
     })
-    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(
+      await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).toBeInTheDocument()
   })
 
   it('preserves a bootstrap rejection when Strict Mode replays effects', async () => {
@@ -164,9 +186,9 @@ describe('IP denial page boundary', () => {
       defaultOptions: { queries: { retry: false } },
     })
     const request = vi.fn(async () => {
-      const scope = captureIpAccessScope()
+      const scope = captureAppAccessScope()
       const error = new Response('', { status: 403 })
-      handleIpAccessDenied(
+      handleAppAccessError(
         403,
         { code: 'ip_access_denied', client_ip: '203.0.113.42' },
         scope,
@@ -178,15 +200,17 @@ describe('IP denial page boundary', () => {
       <StrictMode>
         <I18nextProvider i18n={i18n}>
           <QueryClientProvider client={queryClient}>
-            <IpAccessBoundary>
+            <AppAccessBoundary>
               <AppBootstrap request={request} />
-            </IpAccessBoundary>
+            </AppAccessBoundary>
           </QueryClientProvider>
         </I18nextProvider>
       </StrictMode>,
     )
 
-    expect(await screen.findByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
+    expect(
+      await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] }),
+    ).toBeInTheDocument()
     expect(screen.queryByText('Application loading')).not.toBeInTheDocument()
     expect(screen.getByText('203.0.113.42', { selector: 'code' })).toBeInTheDocument()
     expect(request).toHaveBeenCalledTimes(1)
diff --git a/web/features/app-access-error/__tests__/page.spec.tsx b/web/features/app-access-error/__tests__/page.spec.tsx
new file mode 100644
index 00000000000000..da25ed139b24c9
--- /dev/null
+++ b/web/features/app-access-error/__tests__/page.spec.tsx
@@ -0,0 +1,77 @@
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
+import { I18nextProvider } from 'react-i18next'
+import enShare from '@/i18n/en-US/share.json'
+import jaShare from '@/i18n/ja-JP/share.json'
+import zhShare from '@/i18n/zh-Hans/share.json'
+import { getBrowserLocale } from '../locale'
+import AppNotAccessible from '../page'
+
+vi.unmock('react-i18next')
+
+beforeEach(() => {
+  vi.spyOn(navigator, 'languages', 'get').mockReturnValue(['en-US'])
+  document.title = 'Previous title'
+  document.cookie = 'locale=zh-Hans'
+})
+afterEach(() => vi.restoreAllMocks())
+
+it.each([
+  ['en-GB', enShare],
+  ['zh-CN', zhShare],
+  ['ja', jaShare],
+])('uses browser language %s for exact page and document copy', async (language, copy) => {
+  vi.spyOn(navigator, 'languages', 'get').mockReturnValue([language])
+  const parent = createInstance()
+  await parent.init({ lng: 'zh-Hans' })
+  render(
+    <I18nextProvider i18n={parent}>
+      <AppNotAccessible clientIp="2001:db8::12" />
+    </I18nextProvider>,
+  )
+  expect(
+    await screen.findByRole('heading', { name: copy['appNotAccessible.title'] }),
+  ).toBeInTheDocument()
+  expect(screen.getByText(copy['appNotAccessible.description'])).toBeInTheDocument()
+  expect(screen.getByText('2001:db8::12', { selector: 'code' }).closest('p')?.textContent).toBe(
+    copy['appNotAccessible.ipAddress'].replace('<ip>{{ip}}</ip>', '2001:db8::12'),
+  )
+  await waitFor(() => expect(document.title).toBe(copy['appNotAccessible.documentTitle']))
+  expect(parent.language).toBe('zh-Hans')
+})
+
+it.each([undefined, '', 'unknown', '203.0.113.1, 192.0.2.1', '999.1.1.1'])(
+  'omits the IP sentence for %s',
+  async (clientIp) => {
+    render(<AppNotAccessible clientIp={clientIp} />)
+    await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] })
+    expect(screen.queryByText(/Your IP address/)).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /sign in|retry/i })).not.toBeInTheDocument()
+  },
+)
+
+it('changes only the error-page language, retaining the IP and restoring the title on exit', async () => {
+  const user = userEvent.setup()
+  const { unmount } = render(<AppNotAccessible clientIp="203.0.113.8" />)
+  await user.click(await screen.findByRole('button', { name: 'English' }))
+  await user.click(screen.getByRole('menuitemradio', { name: '日本語 (日本)' }))
+  expect(
+    await screen.findByRole('heading', { name: jaShare['appNotAccessible.title'] }),
+  ).toBeInTheDocument()
+  await waitFor(() => expect(document.title).toBe(jaShare['appNotAccessible.documentTitle']))
+  expect(screen.getByText('203.0.113.8', { selector: 'code' })).toBeInTheDocument()
+  expect(document.cookie).toContain('locale=zh-Hans')
+  unmount()
+  expect(document.title).toBe('Previous title')
+})
+
+it.each([
+  [['zh-TW'], 'zh-Hant'],
+  [['zh-SG'], 'zh-Hans'],
+  [['xx-XX', 'ja-JP'], 'ja-JP'],
+  [['xx-XX'], 'en-US'],
+  [['*', 'not_a_locale'], 'en-US'],
+])('matches supported browser preferences %j', (languages, expected) => {
+  expect(getBrowserLocale(languages)).toBe(expected)
+})
diff --git a/web/features/app-access-error/__tests__/state.spec.ts b/web/features/app-access-error/__tests__/state.spec.ts
new file mode 100644
index 00000000000000..03024d6b449e0e
--- /dev/null
+++ b/web/features/app-access-error/__tests__/state.spec.ts
@@ -0,0 +1,118 @@
+import {
+  appAccessErrorAtom,
+  appAccessStore,
+  captureAppAccessRequest,
+  captureAppAccessScope,
+  getAppAccessScopeKey,
+  handleAppAccessError,
+  hasAppAccessError,
+  isAppAccessError,
+  isAppAccessScopeCurrent,
+} from '../state'
+
+const denied = { code: 'ip_access_denied', client_ip: '203.0.113.42' }
+const navigate = (path: string) => {
+  window.history.replaceState({}, '', path)
+  return captureAppAccessScope()
+}
+
+describe('WebApp IP denial scope', () => {
+  beforeEach(() => {
+    navigate('/')
+  })
+
+  it.each([
+    ['/workflow/app', 'webapp:default:app'],
+    ['/chat/app', 'webapp:default:app'],
+    ['/chatbot/app', 'webapp:default:app'],
+    ['/completion/app', 'webapp:default:app'],
+    ['/agent/app', 'webapp:default:app'],
+    ['/environment/chat/app', 'webapp:environment:app'],
+    ['/environment/workflow/app', 'webapp:environment:app'],
+    ['/form/token', 'form:token'],
+  ])('scopes the public entry %s', (path, expected) => {
+    expect(navigate(path)?.key).toBe(expected)
+  })
+
+  it('resolves a validated sign-in target without scoping console or external redirects', () => {
+    expect(getAppAccessScopeKey('/webapp-signin', '?redirect_url=%2Fchat%2Fapp')).toBe(
+      'webapp:default:app',
+    )
+    expect(getAppAccessScopeKey('/apps', '?redirect_url=%2Fchat%2Fapp')).toBeNull()
+    expect(
+      getAppAccessScopeKey('/webapp-signin', '?redirect_url=https://untrusted.example/chat/app'),
+    ).toBeNull()
+  })
+
+  it('keeps one denial across concurrent requests and conversation query changes', () => {
+    const scope = navigate('/chat/app')
+    const error = new Response('', { status: 403 })
+    expect(handleAppAccessError(403, denied, scope, error)).toBe(true)
+    const firstDenial = appAccessStore.get(appAccessErrorAtom)
+
+    const sameScope = navigate('/chat/app?conversation=second')
+    handleAppAccessError(403, denied, sameScope)
+
+    expect(sameScope).toBe(scope)
+    expect(appAccessStore.get(appAccessErrorAtom)).toBe(firstDenial)
+    expect(hasAppAccessError(scope)).toBe(true)
+    expect(isAppAccessError(error)).toBe(true)
+  })
+
+  it('ignores a late denial even after navigating back to the same app', () => {
+    const previousVisit = navigate('/chat/app')
+    navigate('/chat/other-app')
+    const currentVisit = navigate('/chat/app')
+    const error = new Response('', { status: 403 })
+
+    expect(handleAppAccessError(403, denied, previousVisit, error)).toBe(true)
+    expect(isAppAccessScopeCurrent(previousVisit)).toBe(false)
+    expect(hasAppAccessError(currentVisit)).toBe(false)
+    expect(isAppAccessError(error)).toBe(true)
+  })
+
+  it('does not carry a denial into another app or HITL form', () => {
+    handleAppAccessError(403, denied, navigate('/chat/app'))
+    const other = navigate('/form/token')
+
+    expect(hasAppAccessError(other)).toBe(false)
+    expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+  })
+
+  it.each([
+    [401, { code: 'unauthorized' }],
+    [403, { code: 'web_app_access_denied' }],
+    [503, { code: 'policy_unavailable' }],
+  ])('leaves %s %j to its existing error owner', (status, body) => {
+    const scope = navigate('/workflow/app')
+    expect(handleAppAccessError(status, body, scope)).toBe(false)
+    expect(hasAppAccessError(scope)).toBe(false)
+  })
+
+  it('does not suppress an unhandled console error with the same error code', () => {
+    const scope = navigate('/apps')
+    const error = { status: 403, response: denied }
+    expect(handleAppAccessError(403, denied, scope, error)).toBe(false)
+    expect(isAppAccessError(error)).toBe(false)
+  })
+})
+
+describe('application identity request matching', () => {
+  it.each([
+    ['/app/one/workflow', '/console/api/apps/one', false, true, true],
+    ['/app/one/workflow', '/apps/two', false, false, false],
+    ['/app/one/workflow', '/apps/one/workflows/draft', false, true, false],
+    ['/agents/one/access', '/console/api/agent/one', false, true, true],
+    ['/explore/installed/one', '/installed-apps/one/parameters', false, true, true],
+    ['/chat/one', '/site', true, true, true],
+    ['/chat/one', '/webapp/access-mode?appCode=two', true, false, false],
+    ['/environment/agent/one', '/environment/two/site', true, false, false],
+    ['/chat/one', '/conversations/missing/messages', true, true, false],
+    ['/form/token', '/form/human_input/token', true, true, false],
+  ])('scopes %s requesting %s', (route, url, isPublic, scoped, identity) => {
+    navigate(route)
+    const result = captureAppAccessRequest(url, isPublic)
+    expect(Boolean(result.scope)).toBe(scoped)
+    expect(result.appIdentity).toBe(identity)
+  })
+})
diff --git a/web/features/webapp-ip-access/boundary.tsx b/web/features/app-access-error/boundary.tsx
similarity index 56%
rename from web/features/webapp-ip-access/boundary.tsx
rename to web/features/app-access-error/boundary.tsx
index 8430fc13f5322a..f3b51372c10475 100644
--- a/web/features/webapp-ip-access/boundary.tsx
+++ b/web/features/app-access-error/boundary.tsx
@@ -4,33 +4,33 @@ import type { PropsWithChildren } from 'react'
 import { useAtomValueRawSync } from 'jotai/react'
 import { useEffect } from 'react'
 import { usePathname, useSearchParams } from '@/next/navigation'
-import AccessRestricted from './access-restricted'
+import AppNotAccessible from './page'
 import {
-  captureIpAccessScope,
-  getIpAccessScopeKey,
-  ipAccessDeniedAtom,
-  ipAccessStore,
+  appAccessErrorAtom,
+  appAccessStore,
+  captureAppAccessScope,
+  getAppAccessScopeKey,
 } from './state'
 
-export default function IpAccessBoundary({ children }: PropsWithChildren) {
+export default function AppAccessBoundary({ children }: PropsWithChildren) {
   const pathname = usePathname()
   const searchParams = useSearchParams()
   const search = searchParams.toString()
-  const denial = useAtomValueRawSync(ipAccessDeniedAtom, { store: ipAccessStore })
-  const scopeKey = getIpAccessScopeKey(
+  const denial = useAtomValueRawSync(appAccessErrorAtom, { store: appAccessStore })
+  const scopeKey = getAppAccessScopeKey(
     pathname,
     search,
     typeof window === 'undefined' ? undefined : window.location.origin,
   )
 
-  // Stay mounted in the root layout to observe leaving public routes, even
+  // Stay mounted in the root layout to observe leaving application routes, even
   // when the next page makes no request that would otherwise reset the scope.
   useEffect(() => {
-    captureIpAccessScope()
+    captureAppAccessScope()
   }, [pathname, search])
 
   if (denial && denial.scope.key === scopeKey)
-    return <AccessRestricted clientIp={denial.clientIp} />
+    return <AppNotAccessible clientIp={denial.clientIp} />
 
   return children
 }
diff --git a/web/features/webapp-ip-access/locale-menu.tsx b/web/features/app-access-error/locale-menu.tsx
similarity index 89%
rename from web/features/webapp-ip-access/locale-menu.tsx
rename to web/features/app-access-error/locale-menu.tsx
index df20cd234750f2..41fc2e3785c319 100644
--- a/web/features/webapp-ip-access/locale-menu.tsx
+++ b/web/features/app-access-error/locale-menu.tsx
@@ -7,14 +7,17 @@ import {
   DropdownMenuRadioItemIndicator,
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
-import { useLocale } from '@/context/i18n'
-import { setLocaleOnClient } from '@/i18n-config'
 import { languages } from '@/i18n-config/language'
 
 const supportedLanguages = languages.filter((language) => language.supported)
 
-export default function LocaleMenu() {
-  const locale = useLocale()
+export default function LocaleMenu({
+  locale,
+  onChange,
+}: {
+  locale: Locale
+  onChange: (locale: Locale) => void
+}) {
   const selectedLanguage = supportedLanguages.find((language) => language.value === locale)
   const selectedLanguageName =
     selectedLanguage?.value === 'en-US' ? selectedLanguage.prompt_name : selectedLanguage?.name
@@ -37,7 +40,7 @@ export default function LocaleMenu() {
         <DropdownMenuRadioGroup<Locale>
           value={locale}
           onValueChange={(value) => {
-            void setLocaleOnClient(value, false)
+            onChange(value)
           }}
         >
           {supportedLanguages.map((language) => (
diff --git a/web/features/app-access-error/locale.ts b/web/features/app-access-error/locale.ts
new file mode 100644
index 00000000000000..a6450e0861da82
--- /dev/null
+++ b/web/features/app-access-error/locale.ts
@@ -0,0 +1,14 @@
+import type { Locale } from '@/i18n-config'
+import { match } from '@formatjs/intl-localematcher'
+import { LanguagesSupported } from '@/i18n-config/language'
+
+export function getBrowserLocale(preferences: readonly string[]): Locale {
+  const valid = preferences.filter((language) => {
+    try {
+      return Intl.getCanonicalLocales(language).length > 0
+    } catch {
+      return false
+    }
+  })
+  return match(valid, LanguagesSupported, 'en-US') as Locale
+}
diff --git a/web/features/app-access-error/page.stories.tsx b/web/features/app-access-error/page.stories.tsx
new file mode 100644
index 00000000000000..cc19a1a9dd143a
--- /dev/null
+++ b/web/features/app-access-error/page.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from '@storybook/nextjs-vite'
+import { ThemeProvider } from 'next-themes'
+import AppNotAccessible from './page'
+
+const meta = {
+  title: 'App/App Not Accessible',
+  component: AppNotAccessible,
+  parameters: { layout: 'fullscreen' },
+  decorators: [
+    (Story) => (
+      <ThemeProvider attribute="data-theme" defaultTheme="light">
+        <Story />
+      </ThemeProvider>
+    ),
+  ],
+} satisfies Meta<typeof AppNotAccessible>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+export const WithoutIP: Story = {}
+export const IPv4: Story = { args: { clientIp: '203.0.113.42' } }
+export const IPv6: Story = { args: { clientIp: '2001:db8:1234:5678:90ab:cdef:1234:5678' } }
+
+export const NarrowIframe: Story = {
+  render: () => (
+    <iframe
+      title="375px app error preview"
+      width={375}
+      height={667}
+      src="/iframe.html?id=app-app-not-accessible--i-pv-6&viewMode=story"
+    />
+  ),
+}
+export const ShortIframe: Story = {
+  render: () => (
+    <iframe
+      title="Short app error preview"
+      width={800}
+      height={360}
+      src="/iframe.html?id=app-app-not-accessible--i-pv-4&viewMode=story"
+    />
+  ),
+}
diff --git a/web/features/app-access-error/page.tsx b/web/features/app-access-error/page.tsx
new file mode 100644
index 00000000000000..0b5c263b92b73b
--- /dev/null
+++ b/web/features/app-access-error/page.tsx
@@ -0,0 +1,123 @@
+'use client'
+
+import type { Locale } from '@/i18n-config'
+import { cn } from '@langgenius/dify-ui/cn'
+import { createInstance } from 'i18next'
+import resourcesToBackend from 'i18next-resources-to-backend'
+import { Suspense, useEffect, useState } from 'react'
+import { I18nextProvider, Trans, useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import { DifyLogo } from '@/app/components/base/logo/dify-logo'
+import ThemeSelector from '@/app/components/base/theme-selector'
+import { loadI18nResource } from '@/i18n-config/load-resource'
+import { getInitOptions } from '@/i18n-config/settings'
+import { basePath } from '@/utils/var'
+import { getBrowserLocale } from './locale'
+import LocaleMenu from './locale-menu'
+import { getClientIp } from './state'
+
+type AppNotAccessibleProps = {
+  clientIp?: string
+  /** A dialog supplies its own landmarks and close control. */
+  embedded?: boolean
+}
+
+function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
+  const { t, i18n } = useTranslation('share')
+  const [copyrightYear] = useState(() => new Date().getFullYear())
+  const title = t(($) => $['appNotAccessible.documentTitle'])
+  const ip = getClientIp({ client_ip: clientIp })
+  const Content = embedded ? 'div' : 'main'
+
+  useEffect(() => {
+    const previous = document.title
+    document.title = title
+    return () => {
+      document.title = previous
+    }
+  }, [title])
+
+  return (
+    <div
+      lang={i18n.language}
+      dir={i18n.dir()}
+      className={cn(
+        'w-full overflow-y-auto bg-background-default-burn p-1',
+        embedded ? 'min-h-full' : 'h-dvh',
+      )}
+    >
+      <div className="flex min-h-full min-w-0 flex-col rounded-lg border border-effects-highlight bg-background-default-subtle">
+        <header className="flex shrink-0 items-center justify-between gap-2 pt-4 pr-3 pb-3 pl-6">
+          <DifyLogo alt="Dify" size="large" className="w-15.75 shrink-0" />
+          <div className="flex min-w-0 items-center gap-2">
+            <LocaleMenu
+              locale={i18n.language as Locale}
+              onChange={(value) => {
+                void i18n.changeLanguage(value)
+              }}
+            />
+            <ThemeSelector />
+          </div>
+        </header>
+        <Content className="flex flex-1 items-center justify-center px-6 pt-12 pb-12 md:pb-30">
+          <div className="flex w-full max-w-120 flex-col items-start">
+            <img
+              src={`${basePath}/illustrations/app-not-accessible.png`}
+              width={184}
+              height={184}
+              alt=""
+              className="mb-6 size-46 max-w-full object-contain"
+            />
+            <h1 className="text-base leading-[1.2] font-semibold wrap-break-word text-text-primary">
+              {t(($) => $['appNotAccessible.title'])}
+            </h1>
+            <p className="mt-2 system-sm-regular text-text-primary">
+              {t(($) => $['appNotAccessible.description'])}
+            </p>
+            {ip && (
+              <p className="mt-8 max-w-full system-sm-regular text-text-primary">
+                <Trans
+                  t={t}
+                  i18nKey={($) => $['appNotAccessible.ipAddress']}
+                  values={{ ip }}
+                  components={{
+                    ip: (
+                      <code
+                        dir="ltr"
+                        className="rounded bg-background-default-burn px-1 font-mono code-sm-semibold tracking-[0.065px] break-all"
+                      />
+                    ),
+                  }}
+                />
+              </p>
+            )}
+          </div>
+        </Content>
+        <footer className="shrink-0 px-6 pt-2 pb-6 text-center system-xs-regular text-text-tertiary">
+          © {copyrightYear} LangGenius, Inc. All rights reserved.
+        </footer>
+      </div>
+    </div>
+  )
+}
+
+export default function AppNotAccessible(props: AppNotAccessibleProps) {
+  const [i18n] = useState(() => {
+    // A private instance keeps browser-language selection and menu changes off the console cookie.
+    const instance = createInstance()
+    void instance.use(resourcesToBackend(loadI18nResource)).init({
+      ...getInitOptions(),
+      lng: getBrowserLocale(typeof navigator === 'undefined' ? [] : navigator.languages),
+      ns: ['share', 'common'],
+      defaultNS: 'share',
+    })
+    return instance
+  })
+  return (
+    <Suspense fallback={<Loading type="app" />}>
+      <I18nextProvider i18n={i18n}>
+        <PageContent {...props} />
+      </I18nextProvider>
+    </Suspense>
+  )
+}
diff --git a/web/features/app-access-error/state.ts b/web/features/app-access-error/state.ts
new file mode 100644
index 00000000000000..5a7380ce34c454
--- /dev/null
+++ b/web/features/app-access-error/state.ts
@@ -0,0 +1,235 @@
+import { atom, createStore } from 'jotai/vanilla'
+import { z } from 'zod'
+import { env } from '@/env'
+import { isAppDeletingOrDeleted } from '@/service/app-deletion'
+import { parseWebAppAddress } from '@/service/webapp-address'
+import { resolveLoginRedirectTarget } from '@/utils/login-redirect'
+
+export type AppAccessScope = Readonly<{ key: string; epoch: number }>
+
+type AppAccessError = {
+  reason: 'ip_access_denied' | 'app_not_found'
+  scope: AppAccessScope
+  clientIp?: string
+}
+
+type IpAccessDeniedResponse = {
+  code: 'ip_access_denied'
+  client_ip?: unknown
+}
+
+export const appAccessErrorAtom = atom<AppAccessError | null>(null)
+export const trialAppAccessErrorAtom = atom<AppAccessError | null>(null)
+export const appAccessStore = createStore()
+export const trialAppAccessScopeAtom = atom<AppAccessScope | null>(null)
+
+let currentScope: AppAccessScope | null = null
+let scopeEpoch = 0
+const handledErrors = new WeakSet<object>()
+
+function withoutBasePath(pathname: string) {
+  const prefix = env.NEXT_PUBLIC_BASE_PATH
+  return prefix && (pathname === prefix || pathname.startsWith(`${prefix}/`))
+    ? pathname.slice(prefix.length) || '/'
+    : pathname
+}
+
+export function getAppAccessScopeKey(
+  pathname: string,
+  search = '',
+  origin?: string,
+): string | null {
+  const path = withoutBasePath(pathname)
+  const address = parseWebAppAddress(path)
+  if (address) return `webapp:${address.kind}:${address.code}`
+
+  const consoleApp = /^\/app\/([^/]+)(?:\/|$)/.exec(path)
+  if (consoleApp) return `app:${consoleApp[1]}`
+  const agent = /^\/agents\/([^/]+)(?:\/|$)/.exec(path)
+  if (agent) return `agent:${agent[1]}`
+  const installed = /^\/(?:explore\/)?installed\/([^/]+)(?:\/|$)/.exec(path)
+  if (installed) return `installed:${installed[1]}`
+
+  const form = /^\/form\/([^/]+)\/?$/.exec(path)
+  if (form) return `form:${form[1]}`
+
+  if (
+    path !== '/webapp-signin' &&
+    !path.startsWith('/webapp-signin/') &&
+    path !== '/webapp-reset-password' &&
+    !path.startsWith('/webapp-reset-password/')
+  )
+    return null
+
+  const redirect = resolveLoginRedirectTarget(new URLSearchParams(search).get('redirect_url'), {
+    currentOrigin: origin,
+    allowSameOriginAbsolute: Boolean(origin),
+  })
+  if (!redirect) return null
+
+  const target = new URL(redirect.href, origin || 'https://login-redirect.invalid')
+  const redirectAddress = parseWebAppAddress(withoutBasePath(target.pathname))
+  return redirectAddress ? `webapp:${redirectAddress.kind}:${redirectAddress.code}` : null
+}
+
+/** Capture the route before sending a request, including its current visit. */
+export function captureAppAccessScope(): AppAccessScope | null {
+  if (typeof globalThis.location === 'undefined') return null
+
+  const { pathname, search, origin } = globalThis.location
+  const key = getAppAccessScopeKey(pathname, search, origin)
+  if (key !== (currentScope?.key ?? null)) {
+    currentScope = key ? { key, epoch: ++scopeEpoch } : null
+    appAccessStore.set(appAccessErrorAtom, null)
+  }
+  return currentScope
+}
+
+export function isAppAccessScopeCurrent(scope: AppAccessScope | null) {
+  return scope?.key.startsWith('trial:')
+    ? scope === appAccessStore.get(trialAppAccessScopeAtom)
+    : scope === null || captureAppAccessScope() === scope
+}
+
+export function hasAppAccessError(scope: AppAccessScope | null) {
+  return scope !== null && appAccessStore.get(errorAtomFor(scope))?.scope === scope
+}
+
+export function isIpAccessDeniedResponse(
+  status: number,
+  data: unknown,
+): data is IpAccessDeniedResponse {
+  return (
+    status === 403 &&
+    typeof data === 'object' &&
+    data !== null &&
+    'code' in data &&
+    data.code === 'ip_access_denied'
+  )
+}
+
+/** A handled denial stays an error for callers, without triggering auth recovery or toasts. */
+export function handleAppAccessError(
+  status: number,
+  data: unknown,
+  scope: AppAccessScope | null,
+  error?: object,
+  appIdentity = false,
+) {
+  if (scope?.key.startsWith('form:') && status === 404) return false
+  if (!scope || !isAppAccessErrorResponse(status, data, appIdentity)) return false
+  if (isScopeBeingDeleted(scope)) return false
+
+  if (error) handledErrors.add(error)
+  if (!isAppAccessScopeCurrent(scope)) return true
+
+  const clientIp = getClientIp(data)
+  const errorAtom = errorAtomFor(scope)
+  const previous = appAccessStore.get(errorAtom)
+  if (previous?.scope !== scope || (!previous.clientIp && clientIp))
+    appAccessStore.set(errorAtom, {
+      scope,
+      clientIp,
+      reason: previous?.reason ?? (status === 403 ? 'ip_access_denied' : 'app_not_found'),
+    })
+
+  return true
+}
+
+export function isAppAccessError(error: unknown): boolean {
+  return typeof error === 'object' && error !== null && handledErrors.has(error)
+}
+
+const ipAddressSchema = z.union([z.ipv4(), z.ipv6()])
+
+/** Only render a single IP supplied by the response, never an address list or a placeholder. */
+export function getClientIp(data: unknown): string | undefined {
+  if (typeof data !== 'object' || data === null || !('client_ip' in data)) return undefined
+  const value = typeof data.client_ip === 'string' ? data.client_ip.trim() : undefined
+  return ipAddressSchema.safeParse(value).success ? value : undefined
+}
+
+export function isAppAccessErrorResponse(status: number, data: unknown, appIdentity = false) {
+  return (
+    isIpAccessDeniedResponse(status, data) ||
+    (status === 404 &&
+      (appIdentity ||
+        (typeof data === 'object' &&
+          data !== null &&
+          'code' in data &&
+          data.code === 'app_not_found')))
+  )
+}
+
+/** Match the request to the captured route; unrelated resource 404s keep their own owner. */
+export function captureAppAccessRequest(url: string, isPublicAPI = false, method = 'GET') {
+  const scope = captureAppAccessScope()
+  const none = { scope: null, appIdentity: false }
+  const target = new URL(url, 'https://app-request.invalid')
+  const path = target.pathname.replace(/\/$/, '')
+  const trial = /\/trial-apps\/([^/]+)(\/.*)?$/.exec(path)
+  if (!isPublicAPI && trial) {
+    const trialScope = appAccessStore.get(trialAppAccessScopeAtom)
+    if (trialScope?.key !== `trial:${trial[1]}`) return none
+    return {
+      scope: trialScope,
+      appIdentity: method.toUpperCase() === 'GET' && (!trial[2] || trial[2] === '/parameters'),
+    }
+  }
+  if (!scope) return none
+  if (isPublicAPI) {
+    if (scope.key.startsWith('form:')) {
+      const token = /\/form\/human_input\/([^/]+)/.exec(path)?.[1]
+      return token && scope.key !== `form:${token}` ? none : { scope, appIdentity: false }
+    }
+    if (!scope.key.startsWith('webapp:')) return none
+    const code = scope.key.split(':').slice(2).join(':')
+    const requestedCode = target.searchParams.get('appCode') || target.searchParams.get('app_code')
+    const environmentCode = /\/environment\/([^/]+)\//.exec(path)?.[1]
+    if ((requestedCode && requestedCode !== code) || (environmentCode && environmentCode !== code))
+      return none
+    const appIdentity =
+      /\/(?:site|parameters|meta|passport|login\/status|webapp\/access-mode)$/.test(path)
+    return { scope, appIdentity }
+  }
+  const resource = /\/(apps|agent|installed-apps)\/([^/]+)(\/.*)?$/.exec(path)
+  if (!resource) return none
+  const [, kind, id, suffix] = resource
+  const prefix = kind === 'apps' ? 'app' : kind === 'agent' ? 'agent' : 'installed'
+  if (scope.key !== `${prefix}:${id}` || isScopeBeingDeleted(scope)) return none
+  return {
+    scope,
+    appIdentity:
+      method.toUpperCase() === 'GET' &&
+      (!suffix || (prefix === 'installed' && ['/parameters', '/meta'].includes(suffix))),
+  }
+}
+
+export function throwIfAppAccessBlocked(scope: AppAccessScope | null) {
+  if (!hasAppAccessError(scope)) return
+  const error = new DOMException('The app is no longer accessible.', 'AbortError')
+  handledErrors.add(error)
+  throw error
+}
+
+function isScopeBeingDeleted(scope: AppAccessScope) {
+  return isAppDeletingOrDeleted(scope.key.startsWith('app:') ? scope.key.slice(4) : scope.key)
+}
+
+function errorAtomFor(scope: AppAccessScope) {
+  return scope.key.startsWith('trial:') ? trialAppAccessErrorAtom : appAccessErrorAtom
+}
+
+/** The dialog registers before mounting request owners and retires the visit on close. */
+export function beginTrialAppAccess(appId: string): AppAccessScope {
+  const trialScope = { key: `trial:${appId}`, epoch: ++scopeEpoch }
+  appAccessStore.set(trialAppAccessScopeAtom, trialScope)
+  appAccessStore.set(trialAppAccessErrorAtom, null)
+  return trialScope
+}
+
+export function endTrialAppAccess(scope: AppAccessScope) {
+  if (appAccessStore.get(trialAppAccessScopeAtom) !== scope) return
+  appAccessStore.set(trialAppAccessScopeAtom, null)
+  appAccessStore.set(trialAppAccessErrorAtom, null)
+}
diff --git a/web/features/app-access-error/trial-boundary.tsx b/web/features/app-access-error/trial-boundary.tsx
new file mode 100644
index 00000000000000..5d2862055e225e
--- /dev/null
+++ b/web/features/app-access-error/trial-boundary.tsx
@@ -0,0 +1,48 @@
+'use client'
+
+import type { PropsWithChildren } from 'react'
+import { Button } from '@langgenius/dify-ui/button'
+import { useAtomValueRawSync } from 'jotai/react'
+import { useEffect } from 'react'
+import { useTranslation } from 'react-i18next'
+import Loading from '@/app/components/base/loading'
+import AppNotAccessible from './page'
+import {
+  appAccessStore,
+  beginTrialAppAccess,
+  endTrialAppAccess,
+  trialAppAccessErrorAtom,
+  trialAppAccessScopeAtom,
+} from './state'
+
+export default function TrialAppAccessBoundary({
+  appId,
+  onClose,
+  children,
+}: PropsWithChildren<{ appId: string; onClose: () => void }>) {
+  const { t } = useTranslation('common')
+  const scope = useAtomValueRawSync(trialAppAccessScopeAtom, { store: appAccessStore })
+  const error = useAtomValueRawSync(trialAppAccessErrorAtom, { store: appAccessStore })
+  useEffect(() => {
+    const visit = beginTrialAppAccess(appId)
+    return () => endTrialAppAccess(visit)
+  }, [appId])
+
+  if (!scope || scope.key !== `trial:${appId}`) return <Loading type="area" />
+  if (error?.scope !== scope) return children
+  return (
+    <div className="relative h-full overflow-y-auto">
+      <Button
+        variant="tertiary"
+        aria-label={t(($) => $['operation.close'])}
+        className="absolute top-3 right-3 z-10"
+        onClick={onClose}
+      >
+        <span aria-hidden className="i-ri-close-line size-5" />
+      </Button>
+      <div className="min-h-full pt-10">
+        <AppNotAccessible embedded clientIp={error.clientIp} />
+      </div>
+    </div>
+  )
+}
diff --git a/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx b/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
deleted file mode 100644
index e4c7df195d382e..00000000000000
--- a/web/features/webapp-ip-access/__tests__/access-restricted.spec.tsx
+++ /dev/null
@@ -1,84 +0,0 @@
-import type { i18n as I18n } from 'i18next'
-import { render, screen } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import { createInstance } from 'i18next'
-import { I18nextProvider, initReactI18next } from 'react-i18next'
-import { setLocaleOnClient } from '@/i18n-config'
-import enShare from '@/i18n/en-US/share.json'
-import zhShare from '@/i18n/zh-Hans/share.json'
-import AccessRestricted from '../access-restricted'
-
-vi.unmock('react-i18next')
-
-vi.mock('@/i18n-config', () => ({
-  setLocaleOnClient: vi.fn(),
-}))
-
-let i18n: I18n
-
-const renderPage = (clientIp?: string) =>
-  render(
-    <I18nextProvider i18n={i18n}>
-      <AccessRestricted clientIp={clientIp} />
-    </I18nextProvider>,
-  )
-
-describe('IP access restricted page', () => {
-  beforeEach(async () => {
-    vi.clearAllMocks()
-    i18n = createInstance()
-    await i18n.use(initReactI18next).init({
-      lng: 'en-US',
-      fallbackLng: 'en-US',
-      defaultNS: 'share',
-      keySeparator: false,
-      interpolation: { escapeValue: false },
-      resources: {
-        'en-US': { share: enShare },
-        'zh-Hans': { share: zhShare },
-      },
-    })
-    vi.mocked(setLocaleOnClient).mockImplementation(async (locale) => {
-      await i18n.changeLanguage(locale)
-    })
-  })
-
-  it.each([
-    ['en-US', '203.0.113.8', 'Your current IP address 203.0.113.8 isn’t on the allowlist.'],
-    [
-      'en-US',
-      '2001:db8:1234:5678:90ab:cdef:1234:5678',
-      'Your current IP address 2001:db8:1234:5678:90ab:cdef:1234:5678 isn’t on the allowlist.',
-    ],
-    ['zh-Hans', '203.0.113.8', '您当前的 IP 地址 203.0.113.8 不在允许列表中。'],
-  ])('renders the full localized IP sentence for %s and %s', async (locale, clientIp, sentence) => {
-    await i18n.changeLanguage(locale)
-    renderPage(clientIp)
-
-    const ip = screen.getByText(clientIp, { selector: 'code' })
-    expect(ip.closest('p')?.textContent).toBe(sentence)
-  })
-
-  it('shows the network restriction without an IP sentence when the server omits the IP', () => {
-    renderPage()
-
-    expect(screen.getByRole('heading', { name: 'Access restricted' })).toBeInTheDocument()
-    expect(screen.getByText(enShare['ipAccessDenied.description'])).toBeInTheDocument()
-    expect(screen.queryByText(/Your current IP address/)).not.toBeInTheDocument()
-  })
-
-  it('changes the page language without a reload and keeps the current IP', async () => {
-    const user = userEvent.setup()
-    renderPage('203.0.113.8')
-
-    await user.click(screen.getByRole('button', { name: 'English' }))
-    await user.click(screen.getByRole('menuitemradio', { name: '简体中文' }))
-
-    expect(setLocaleOnClient).toHaveBeenCalledWith('zh-Hans', false)
-    expect(await screen.findByRole('heading', { name: '访问受限' })).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: '简体中文' })).toBeInTheDocument()
-    expect(screen.getByText('203.0.113.8', { selector: 'code' }).closest('p')?.textContent).toBe(
-      '您当前的 IP 地址 203.0.113.8 不在允许列表中。',
-    )
-  })
-})
diff --git a/web/features/webapp-ip-access/__tests__/state.spec.ts b/web/features/webapp-ip-access/__tests__/state.spec.ts
deleted file mode 100644
index f407225f7672ef..00000000000000
--- a/web/features/webapp-ip-access/__tests__/state.spec.ts
+++ /dev/null
@@ -1,97 +0,0 @@
-import {
-  captureIpAccessScope,
-  getIpAccessScopeKey,
-  handleIpAccessDenied,
-  hasIpAccessDenied,
-  ipAccessDeniedAtom,
-  ipAccessStore,
-  isIpAccessDeniedError,
-  isIpAccessScopeCurrent,
-} from '../state'
-
-const denied = { code: 'ip_access_denied', client_ip: '203.0.113.42' }
-const navigate = (path: string) => {
-  window.history.replaceState({}, '', path)
-  return captureIpAccessScope()
-}
-
-describe('WebApp IP denial scope', () => {
-  beforeEach(() => {
-    navigate('/')
-  })
-
-  it.each([
-    ['/workflow/app', 'webapp:default:app'],
-    ['/chat/app', 'webapp:default:app'],
-    ['/chatbot/app', 'webapp:default:app'],
-    ['/completion/app', 'webapp:default:app'],
-    ['/agent/app', 'webapp:default:app'],
-    ['/environment/chat/app', 'webapp:environment:app'],
-    ['/environment/workflow/app', 'webapp:environment:app'],
-    ['/form/token', 'form:token'],
-  ])('scopes the public entry %s', (path, expected) => {
-    expect(navigate(path)?.key).toBe(expected)
-  })
-
-  it('resolves a validated sign-in target without scoping console or external redirects', () => {
-    expect(getIpAccessScopeKey('/webapp-signin', '?redirect_url=%2Fchat%2Fapp')).toBe(
-      'webapp:default:app',
-    )
-    expect(getIpAccessScopeKey('/apps', '?redirect_url=%2Fchat%2Fapp')).toBeNull()
-    expect(
-      getIpAccessScopeKey('/webapp-signin', '?redirect_url=https://untrusted.example/chat/app'),
-    ).toBeNull()
-  })
-
-  it('keeps one denial across concurrent requests and conversation query changes', () => {
-    const scope = navigate('/chat/app')
-    const error = new Response('', { status: 403 })
-    expect(handleIpAccessDenied(403, denied, scope, error)).toBe(true)
-    const firstDenial = ipAccessStore.get(ipAccessDeniedAtom)
-
-    const sameScope = navigate('/chat/app?conversation=second')
-    handleIpAccessDenied(403, denied, sameScope)
-
-    expect(sameScope).toBe(scope)
-    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBe(firstDenial)
-    expect(hasIpAccessDenied(scope)).toBe(true)
-    expect(isIpAccessDeniedError(error)).toBe(true)
-  })
-
-  it('ignores a late denial even after navigating back to the same app', () => {
-    const previousVisit = navigate('/chat/app')
-    navigate('/chat/other-app')
-    const currentVisit = navigate('/chat/app')
-    const error = new Response('', { status: 403 })
-
-    expect(handleIpAccessDenied(403, denied, previousVisit, error)).toBe(true)
-    expect(isIpAccessScopeCurrent(previousVisit)).toBe(false)
-    expect(hasIpAccessDenied(currentVisit)).toBe(false)
-    expect(isIpAccessDeniedError(error)).toBe(true)
-  })
-
-  it('does not carry a denial into another app or HITL form', () => {
-    handleIpAccessDenied(403, denied, navigate('/chat/app'))
-    const other = navigate('/form/token')
-
-    expect(hasIpAccessDenied(other)).toBe(false)
-    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
-  })
-
-  it.each([
-    [401, { code: 'unauthorized' }],
-    [403, { code: 'web_app_access_denied' }],
-    [503, { code: 'policy_unavailable' }],
-  ])('leaves %s %j to its existing error owner', (status, body) => {
-    const scope = navigate('/workflow/app')
-    expect(handleIpAccessDenied(status, body, scope)).toBe(false)
-    expect(hasIpAccessDenied(scope)).toBe(false)
-  })
-
-  it('does not suppress an unhandled console error with the same error code', () => {
-    const scope = navigate('/apps')
-    const error = { status: 403, response: denied }
-    expect(handleIpAccessDenied(403, denied, scope, error)).toBe(false)
-    expect(isIpAccessDeniedError(error)).toBe(false)
-  })
-})
diff --git a/web/features/webapp-ip-access/access-restricted.tsx b/web/features/webapp-ip-access/access-restricted.tsx
deleted file mode 100644
index 706e85d5934d47..00000000000000
--- a/web/features/webapp-ip-access/access-restricted.tsx
+++ /dev/null
@@ -1,69 +0,0 @@
-'use client'
-
-import { useState } from 'react'
-import { Trans, useTranslation } from 'react-i18next'
-import { DifyLogo } from '@/app/components/base/logo/dify-logo'
-import { basePath } from '@/utils/var'
-import LocaleMenu from './locale-menu'
-
-type AccessRestrictedProps = {
-  clientIp?: string
-}
-
-export default function AccessRestricted({ clientIp }: AccessRestrictedProps) {
-  const { t } = useTranslation('share')
-  const [copyrightYear] = useState(() => new Date().getFullYear())
-
-  return (
-    <div className="flex min-h-dvh w-full bg-background-default-burn p-6">
-      <div className="flex min-w-0 flex-1 flex-col rounded-2xl border border-effects-highlight bg-background-default-subtle">
-        <header className="flex items-center justify-between gap-4 p-6">
-          <DifyLogo alt="Dify" size="large" className="w-15.75 shrink-0" />
-          <LocaleMenu />
-        </header>
-        <main className="flex flex-1 flex-col items-center px-6 pt-12 pb-6 md:pt-40">
-          <div className="flex w-full max-w-120 flex-col gap-6">
-            <div className="relative isolate aspect-12/7 overflow-hidden rounded-lg">
-              <img
-                src={`${basePath}/illustrations/ip-access-denied.png`}
-                width={480}
-                height={280}
-                alt=""
-                className="size-full object-cover"
-              />
-              <div className="absolute inset-0 bg-[#0033ff] mix-blend-plus-lighter" />
-            </div>
-            <div className="flex flex-col gap-3">
-              <h1 className="text-base leading-[1.2] font-semibold text-text-primary">
-                {t(($) => $['ipAccessDenied.title'])}
-              </h1>
-              <div className="flex flex-col gap-1.5 system-sm-regular text-text-primary">
-                <p>{t(($) => $['ipAccessDenied.description'])}</p>
-                {clientIp && (
-                  <p>
-                    <Trans
-                      i18nKey={($) => $['ipAccessDenied.ipAddress']}
-                      ns="share"
-                      values={{ ip: clientIp }}
-                      components={{
-                        ip: (
-                          <code
-                            dir="ltr"
-                            className="rounded bg-background-default-burn px-1 font-mono code-sm-semibold tracking-[0.065px] break-all"
-                          />
-                        ),
-                      }}
-                    />
-                  </p>
-                )}
-              </div>
-            </div>
-          </div>
-        </main>
-        <footer className="px-6 py-6 text-center system-xs-regular text-text-tertiary">
-          © {copyrightYear} LangGenius, Inc. All rights reserved.
-        </footer>
-      </div>
-    </div>
-  )
-}
diff --git a/web/features/webapp-ip-access/state.ts b/web/features/webapp-ip-access/state.ts
deleted file mode 100644
index 27211887190770..00000000000000
--- a/web/features/webapp-ip-access/state.ts
+++ /dev/null
@@ -1,116 +0,0 @@
-import { atom, createStore } from 'jotai/vanilla'
-import { env } from '@/env'
-import { parseWebAppAddress } from '@/service/webapp-address'
-import { resolveLoginRedirectTarget } from '@/utils/login-redirect'
-
-export type IpAccessScope = Readonly<{ key: string; epoch: number }>
-
-type IpAccessDenied = {
-  scope: IpAccessScope
-  clientIp?: string
-}
-
-type IpAccessDeniedResponse = {
-  code: 'ip_access_denied'
-  client_ip?: unknown
-}
-
-export const ipAccessDeniedAtom = atom<IpAccessDenied | null>(null)
-export const ipAccessStore = createStore()
-
-let currentScope: IpAccessScope | null = null
-let scopeEpoch = 0
-const handledErrors = new WeakSet<object>()
-
-function withoutBasePath(pathname: string) {
-  const prefix = env.NEXT_PUBLIC_BASE_PATH
-  return prefix && (pathname === prefix || pathname.startsWith(`${prefix}/`))
-    ? pathname.slice(prefix.length) || '/'
-    : pathname
-}
-
-export function getIpAccessScopeKey(pathname: string, search = '', origin?: string): string | null {
-  const path = withoutBasePath(pathname)
-  const address = parseWebAppAddress(path)
-  if (address) return `webapp:${address.kind}:${address.code}`
-
-  const form = /^\/form\/([^/]+)\/?$/.exec(path)
-  if (form) return `form:${form[1]}`
-
-  if (
-    path !== '/webapp-signin' &&
-    !path.startsWith('/webapp-signin/') &&
-    path !== '/webapp-reset-password' &&
-    !path.startsWith('/webapp-reset-password/')
-  )
-    return null
-
-  const redirect = resolveLoginRedirectTarget(new URLSearchParams(search).get('redirect_url'), {
-    currentOrigin: origin,
-    allowSameOriginAbsolute: Boolean(origin),
-  })
-  if (!redirect) return null
-
-  const target = new URL(redirect.href, origin || 'https://login-redirect.invalid')
-  const redirectAddress = parseWebAppAddress(withoutBasePath(target.pathname))
-  return redirectAddress ? `webapp:${redirectAddress.kind}:${redirectAddress.code}` : null
-}
-
-/** Capture the route before sending a request, including its current visit. */
-export function captureIpAccessScope(): IpAccessScope | null {
-  if (typeof globalThis.location === 'undefined') return null
-
-  const { pathname, search, origin } = globalThis.location
-  const key = getIpAccessScopeKey(pathname, search, origin)
-  if (key !== (currentScope?.key ?? null)) {
-    currentScope = key ? { key, epoch: ++scopeEpoch } : null
-    ipAccessStore.set(ipAccessDeniedAtom, null)
-  }
-  return currentScope
-}
-
-export function isIpAccessScopeCurrent(scope: IpAccessScope | null) {
-  return scope === null || captureIpAccessScope() === scope
-}
-
-export function hasIpAccessDenied(scope: IpAccessScope | null) {
-  return scope !== null && ipAccessStore.get(ipAccessDeniedAtom)?.scope === scope
-}
-
-export function isIpAccessDeniedResponse(
-  status: number,
-  data: unknown,
-): data is IpAccessDeniedResponse {
-  return (
-    status === 403 &&
-    typeof data === 'object' &&
-    data !== null &&
-    'code' in data &&
-    data.code === 'ip_access_denied'
-  )
-}
-
-/** A handled denial stays an error for callers, without triggering auth recovery or toasts. */
-export function handleIpAccessDenied(
-  status: number,
-  data: unknown,
-  scope: IpAccessScope | null,
-  error?: object,
-) {
-  if (!scope || !isIpAccessDeniedResponse(status, data)) return false
-
-  if (error) handledErrors.add(error)
-  if (!isIpAccessScopeCurrent(scope)) return true
-
-  const clientIp =
-    typeof data.client_ip === 'string' ? data.client_ip.trim() || undefined : undefined
-  const previous = ipAccessStore.get(ipAccessDeniedAtom)
-  if (previous?.scope !== scope || (!previous.clientIp && clientIp))
-    ipAccessStore.set(ipAccessDeniedAtom, { scope, clientIp })
-
-  return true
-}
-
-export function isIpAccessDeniedError(error: unknown): boolean {
-  return typeof error === 'object' && error !== null && handledErrors.has(error)
-}
diff --git a/web/i18n/ar-TN/share.json b/web/i18n/ar-TN/share.json
index bed77735aa4a58..aa6f4b26f93af2 100644
--- a/web/i18n/ar-TN/share.json
+++ b/web/i18n/ar-TN/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "تواصل مع مسؤول التطبيق إذا كنت بحاجة إلى مساعدة.",
+  "appNotAccessible.documentTitle": "التطبيق غير متاح · Dify",
+  "appNotAccessible.ipAddress": "عنوان IP الخاص بك هو <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "هذا التطبيق غير موجود أو لا يمكن الوصول إليه من شبكتك.",
   "chat.chatFormTip": "لا يمكن تعديل إعدادات الدردشة بعد بدء الدردشة.",
   "chat.chatSettingsTitle": "إعداد الدردشة الجديدة",
   "chat.collapse": "طي",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "عذراً!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "شكراً!",
-  "ipAccessDenied.description": "لا يمكن الوصول إلى هذا التطبيق إلا من الشبكات المعتمدة.",
-  "ipAccessDenied.ipAddress": "عنوان IP الحالي <ip>{{ip}}</ip> غير موجود في قائمة العناوين المسموح بها.",
-  "ipAccessDenied.title": "الوصول مقيّد",
   "login.backToHome": "العودة إلى الصفحة الرئيسية"
 }
diff --git a/web/i18n/de-DE/share.json b/web/i18n/de-DE/share.json
index a6701a3ccc2d37..a7a0ed2f30c989 100644
--- a/web/i18n/de-DE/share.json
+++ b/web/i18n/de-DE/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Wenden Sie sich an den App-Administrator, wenn Sie Hilfe benötigen.",
+  "appNotAccessible.documentTitle": "App nicht zugänglich · Dify",
+  "appNotAccessible.ipAddress": "Ihre IP-Adresse ist <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Diese App existiert nicht oder ist von Ihrem Netzwerk aus nicht zugänglich.",
   "chat.chatFormTip": "Chat-Einstellungen können nach Beginn des Chats nicht mehr geändert werden.",
   "chat.chatSettingsTitle": "Neues Chat-Setup",
   "chat.collapse": "Reduzieren",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Entschuldigung!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Danke!",
-  "ipAccessDenied.description": "Auf diese App kann nur über genehmigte Netzwerke zugegriffen werden.",
-  "ipAccessDenied.ipAddress": "Ihre aktuelle IP-Adresse <ip>{{ip}}</ip> steht nicht auf der Liste zulässiger Adressen.",
-  "ipAccessDenied.title": "Zugriff eingeschränkt",
   "login.backToHome": "Zurück zur Startseite"
 }
diff --git a/web/i18n/en-US/share.json b/web/i18n/en-US/share.json
index cf716251fa48f5..c64c3cbb3192ad 100644
--- a/web/i18n/en-US/share.json
+++ b/web/i18n/en-US/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Contact the app administrator if you need help.",
+  "appNotAccessible.documentTitle": "App not accessible · Dify",
+  "appNotAccessible.ipAddress": "Your IP address is <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "This app doesn’t exist or isn’t accessible from your network.",
   "chat.chatFormTip": "Chat settings cannot be modified after the chat has started.",
   "chat.chatSettingsTitle": "New chat setup",
   "chat.collapse": "Collapse",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Sorry!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Thanks!",
-  "ipAccessDenied.description": "This app can only be accessed from approved networks.",
-  "ipAccessDenied.ipAddress": "Your current IP address <ip>{{ip}}</ip> isn’t on the allowlist.",
-  "ipAccessDenied.title": "Access restricted",
   "login.backToHome": "Back to Home"
 }
diff --git a/web/i18n/es-ES/share.json b/web/i18n/es-ES/share.json
index e5c333703d2fe9..615f30dc6505f3 100644
--- a/web/i18n/es-ES/share.json
+++ b/web/i18n/es-ES/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Contacta con el administrador de la aplicación si necesitas ayuda.",
+  "appNotAccessible.documentTitle": "Aplicación no accesible · Dify",
+  "appNotAccessible.ipAddress": "Tu dirección IP es <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Esta aplicación no existe o no es accesible desde tu red.",
   "chat.chatFormTip": "No se pueden modificar los ajustes del chat después de que el chat ha comenzado.",
   "chat.chatSettingsTitle": "Nueva configuración de chat",
   "chat.collapse": "Contraer",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "¡Lo sentimos!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "¡Gracias!",
-  "ipAccessDenied.description": "Solo se puede acceder a esta aplicación desde redes aprobadas.",
-  "ipAccessDenied.ipAddress": "Tu dirección IP actual <ip>{{ip}}</ip> no está en la lista de permitidas.",
-  "ipAccessDenied.title": "Acceso restringido",
   "login.backToHome": "Volver a Inicio"
 }
diff --git a/web/i18n/fa-IR/share.json b/web/i18n/fa-IR/share.json
index a9cb4ab25e9d4f..965e50285e12f2 100644
--- a/web/i18n/fa-IR/share.json
+++ b/web/i18n/fa-IR/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "اگر به کمک نیاز دارید، با مدیر برنامه تماس بگیرید.",
+  "appNotAccessible.documentTitle": "برنامه قابل دسترسی نیست · Dify",
+  "appNotAccessible.ipAddress": "نشانی IP شما <ip>{{ip}}</ip> است.",
+  "appNotAccessible.title": "این برنامه وجود ندارد یا از شبکه شما قابل دسترسی نیست.",
   "chat.chatFormTip": "تنظیمات چت پس از شروع چت قابل تغییر نیستند.",
   "chat.chatSettingsTitle": "راه‌اندازی چت جدید",
   "chat.collapse": "بستن",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "متأسفیم!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "متشکریم!",
-  "ipAccessDenied.description": "این برنامه فقط از طریق شبکه‌های تأییدشده قابل دسترسی است.",
-  "ipAccessDenied.ipAddress": "نشانی IP فعلی شما <ip>{{ip}}</ip> در فهرست نشانی‌های مجاز نیست.",
-  "ipAccessDenied.title": "دسترسی محدود است",
   "login.backToHome": "بازگشت به خانه"
 }
diff --git a/web/i18n/fr-FR/share.json b/web/i18n/fr-FR/share.json
index d8b753416d973c..37d9d18a9a5d9d 100644
--- a/web/i18n/fr-FR/share.json
+++ b/web/i18n/fr-FR/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Contactez l’administrateur de l’application si vous avez besoin d’aide.",
+  "appNotAccessible.documentTitle": "Application inaccessible · Dify",
+  "appNotAccessible.ipAddress": "Votre adresse IP est <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Cette application n’existe pas ou n’est pas accessible depuis votre réseau.",
   "chat.chatFormTip": "Les paramètres de chat ne peuvent pas être modifiés une fois que le chat a commencé.",
   "chat.chatSettingsTitle": "Nouvelle configuration de chat",
   "chat.collapse": "Réduire",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Désolé !",
   "humanInput.submissionID": "submission_id : {{id}}",
   "humanInput.thanks": "Merci !",
-  "ipAccessDenied.description": "Cette application est uniquement accessible depuis les réseaux approuvés.",
-  "ipAccessDenied.ipAddress": "Votre adresse IP actuelle <ip>{{ip}}</ip> ne figure pas dans la liste des adresses autorisées.",
-  "ipAccessDenied.title": "Accès restreint",
   "login.backToHome": "Retour à l'accueil"
 }
diff --git a/web/i18n/hi-IN/share.json b/web/i18n/hi-IN/share.json
index e3ca2b72101d0d..216e7d06a99ab5 100644
--- a/web/i18n/hi-IN/share.json
+++ b/web/i18n/hi-IN/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "सहायता के लिए ऐप के व्यवस्थापक से संपर्क करें।",
+  "appNotAccessible.documentTitle": "ऐप उपलब्ध नहीं है · Dify",
+  "appNotAccessible.ipAddress": "आपका IP पता <ip>{{ip}}</ip> है।",
+  "appNotAccessible.title": "यह ऐप मौजूद नहीं है या आपके नेटवर्क से इसे एक्सेस नहीं किया जा सकता।",
   "chat.chatFormTip": "चैट शुरू होने के बाद चैट सेटिंग्स को संशोधित नहीं किया जा सकता।",
   "chat.chatSettingsTitle": "नया चैट सेटअप",
   "chat.collapse": "संकुचित करें",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "क्षमा करें!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "धन्यवाद!",
-  "ipAccessDenied.description": "इस ऐप को केवल स्वीकृत नेटवर्क से ही एक्सेस किया जा सकता है।",
-  "ipAccessDenied.ipAddress": "आपका वर्तमान IP पता <ip>{{ip}}</ip> अनुमति सूची में नहीं है।",
-  "ipAccessDenied.title": "पहुँच प्रतिबंधित है",
   "login.backToHome": "होम पर वापस"
 }
diff --git a/web/i18n/id-ID/share.json b/web/i18n/id-ID/share.json
index 13e4c8af3533b6..81cb64513acf75 100644
--- a/web/i18n/id-ID/share.json
+++ b/web/i18n/id-ID/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Hubungi administrator aplikasi jika Anda memerlukan bantuan.",
+  "appNotAccessible.documentTitle": "Aplikasi tidak dapat diakses · Dify",
+  "appNotAccessible.ipAddress": "Alamat IP Anda adalah <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Aplikasi ini tidak ada atau tidak dapat diakses dari jaringan Anda.",
   "chat.chatFormTip": "Pengaturan obrolan tidak dapat dimodifikasi setelah obrolan dimulai.",
   "chat.chatSettingsTitle": "Penyiapan obrolan baru",
   "chat.collapse": "Roboh",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Maaf!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Terima kasih!",
-  "ipAccessDenied.description": "Aplikasi ini hanya dapat diakses dari jaringan yang disetujui.",
-  "ipAccessDenied.ipAddress": "Alamat IP Anda saat ini <ip>{{ip}}</ip> tidak ada dalam daftar yang diizinkan.",
-  "ipAccessDenied.title": "Akses dibatasi",
   "login.backToHome": "Kembali ke Beranda"
 }
diff --git a/web/i18n/it-IT/share.json b/web/i18n/it-IT/share.json
index e7b78f470e2b9c..6ba23cee0d4200 100644
--- a/web/i18n/it-IT/share.json
+++ b/web/i18n/it-IT/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Contatta l’amministratore dell’app se hai bisogno di aiuto.",
+  "appNotAccessible.documentTitle": "App non accessibile · Dify",
+  "appNotAccessible.ipAddress": "Il tuo indirizzo IP è <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Questa app non esiste o non è accessibile dalla tua rete.",
   "chat.chatFormTip": "Le impostazioni della chat non possono essere modificate dopo che la chat è iniziata.",
   "chat.chatSettingsTitle": "Nuova configurazione della chat",
   "chat.collapse": "Riduci",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Spiacente!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Grazie!",
-  "ipAccessDenied.description": "È possibile accedere a questa app solo da reti approvate.",
-  "ipAccessDenied.ipAddress": "Il tuo indirizzo IP attuale <ip>{{ip}}</ip> non è nell'elenco degli indirizzi consentiti.",
-  "ipAccessDenied.title": "Accesso limitato",
   "login.backToHome": "Torna alla home"
 }
diff --git a/web/i18n/ja-JP/share.json b/web/i18n/ja-JP/share.json
index 8f18f7c8200df2..e427d578177e03 100644
--- a/web/i18n/ja-JP/share.json
+++ b/web/i18n/ja-JP/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "サポートが必要な場合は、アプリの管理者にお問い合わせください。",
+  "appNotAccessible.documentTitle": "アプリにアクセスできません · Dify",
+  "appNotAccessible.ipAddress": "お使いの IP アドレスは <ip>{{ip}}</ip> です。",
+  "appNotAccessible.title": "このアプリは存在しないか、お使いのネットワークからはアクセスできません。",
   "chat.chatFormTip": "チャット開始後は設定を変更できません",
   "chat.chatSettingsTitle": "チャット設定",
   "chat.collapse": "縮小",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "申し訳ございません!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "ありがとうございます!",
-  "ipAccessDenied.description": "このアプリには、承認されたネットワークからのみアクセスできます。",
-  "ipAccessDenied.ipAddress": "現在の IP アドレス <ip>{{ip}}</ip> は許可リストに登録されていません。",
-  "ipAccessDenied.title": "アクセスが制限されています",
   "login.backToHome": "ホームに戻る"
 }
diff --git a/web/i18n/ko-KR/share.json b/web/i18n/ko-KR/share.json
index 5c4590674d8aee..f894b55efd92f5 100644
--- a/web/i18n/ko-KR/share.json
+++ b/web/i18n/ko-KR/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "도움이 필요하면 앱 관리자에게 문의하세요.",
+  "appNotAccessible.documentTitle": "앱에 접근할 수 없음 · Dify",
+  "appNotAccessible.ipAddress": "IP 주소는 <ip>{{ip}}</ip>입니다.",
+  "appNotAccessible.title": "이 앱이 존재하지 않거나 현재 네트워크에서 접근할 수 없습니다.",
   "chat.chatFormTip": "채팅이 시작된 후에는 채팅 설정을 수정할 수 없습니다.",
   "chat.chatSettingsTitle": "새 채팅 설정",
   "chat.collapse": "축소",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "죄송합니다!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "감사합니다!",
-  "ipAccessDenied.description": "이 앱은 승인된 네트워크에서만 접근할 수 있습니다.",
-  "ipAccessDenied.ipAddress": "현재 IP 주소 <ip>{{ip}}</ip>이(가) 허용 목록에 없습니다.",
-  "ipAccessDenied.title": "접근 제한",
   "login.backToHome": "홈으로 돌아가기"
 }
diff --git a/web/i18n/lo-LA/share.json b/web/i18n/lo-LA/share.json
index 58dd65a15cec0b..bd85d38c949f7b 100644
--- a/web/i18n/lo-LA/share.json
+++ b/web/i18n/lo-LA/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "ຖ້າທ່ານຕ້ອງການຄວາມຊ່ວຍເຫຼືອ ກະລຸນາຕິດຕໍ່ຜູ້ດູແລແອັບ.",
+  "appNotAccessible.documentTitle": "ບໍ່ສາມາດເຂົ້າເຖິງແອັບໄດ້ · Dify",
+  "appNotAccessible.ipAddress": "ທີ່ຢູ່ IP ຂອງທ່ານແມ່ນ <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "ແອັບນີ້ບໍ່ມີຢູ່ ຫຼື ບໍ່ສາມາດເຂົ້າເຖິງຈາກເຄືອຂ່າຍຂອງທ່ານໄດ້.",
   "chat.chatFormTip": "ການຕັ້ງຄ່າການສົນທະນາບໍ່ສາມາດແກ້ໄຂໄດ້ຫຼັງຈາກເລີ່ມຕົ້ນການສົນທະນາ.",
   "chat.chatSettingsTitle": "ຕັ້ງຄ່າການສົນທະນາໃໝ່",
   "chat.collapse": "ຫຍໍ້",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "ຂໍອະໄພ!",
   "humanInput.submissionID": "ລະຫັດການສົ່ງ (submission_id): {{id}}",
   "humanInput.thanks": "ຂອບໃຈ!",
-  "ipAccessDenied.description": "ແອັບນີ້ສາມາດເຂົ້າເຖິງໄດ້ຈາກເຄືອຂ່າຍທີ່ອະນຸມັດເທົ່ານັ້ນ.",
-  "ipAccessDenied.ipAddress": "ທີ່ຢູ່ IP ປັດຈຸບັນຂອງທ່ານ <ip>{{ip}}</ip> ບໍ່ຢູ່ໃນລາຍຊື່ທີ່ອະນຸຍາດ.",
-  "ipAccessDenied.title": "ຈຳກັດການເຂົ້າເຖິງ",
   "login.backToHome": "ກັບຄືນສູ່ໜ້າຫຼັກ"
 }
diff --git a/web/i18n/nl-NL/share.json b/web/i18n/nl-NL/share.json
index b3b2c8abf99aeb..cfe9465e65e0c9 100644
--- a/web/i18n/nl-NL/share.json
+++ b/web/i18n/nl-NL/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Neem contact op met de appbeheerder als u hulp nodig hebt.",
+  "appNotAccessible.documentTitle": "App niet toegankelijk · Dify",
+  "appNotAccessible.ipAddress": "Uw IP-adres is <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Deze app bestaat niet of is niet toegankelijk vanuit uw netwerk.",
   "chat.chatFormTip": "Chat settings cannot be modified after the chat has started.",
   "chat.chatSettingsTitle": "New chat setup",
   "chat.collapse": "Collapse",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Sorry!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Thanks!",
-  "ipAccessDenied.description": "Deze app is alleen toegankelijk via goedgekeurde netwerken.",
-  "ipAccessDenied.ipAddress": "Je huidige IP-adres <ip>{{ip}}</ip> staat niet op de lijst met toegestane adressen.",
-  "ipAccessDenied.title": "Toegang beperkt",
   "login.backToHome": "Back to Home"
 }
diff --git a/web/i18n/pl-PL/share.json b/web/i18n/pl-PL/share.json
index 1a88cdff2f2060..896174e3f04cc2 100644
--- a/web/i18n/pl-PL/share.json
+++ b/web/i18n/pl-PL/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Jeśli potrzebujesz pomocy, skontaktuj się z administratorem aplikacji.",
+  "appNotAccessible.documentTitle": "Aplikacja niedostępna · Dify",
+  "appNotAccessible.ipAddress": "Twój adres IP to <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Ta aplikacja nie istnieje lub nie jest dostępna z Twojej sieci.",
   "chat.chatFormTip": "Ustawienia czatu nie mogą być modyfikowane po rozpoczęciu czatu.",
   "chat.chatSettingsTitle": "Nowa konfiguracja czatu",
   "chat.collapse": "Zwiń",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Przepraszamy!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Dziękujemy!",
-  "ipAccessDenied.description": "Ta aplikacja jest dostępna tylko z zatwierdzonych sieci.",
-  "ipAccessDenied.ipAddress": "Twój bieżący adres IP <ip>{{ip}}</ip> nie znajduje się na liście dozwolonych adresów.",
-  "ipAccessDenied.title": "Ograniczony dostęp",
   "login.backToHome": "Powrót do strony głównej"
 }
diff --git a/web/i18n/pt-BR/share.json b/web/i18n/pt-BR/share.json
index 4b3526e47f0420..e85d067885662a 100644
--- a/web/i18n/pt-BR/share.json
+++ b/web/i18n/pt-BR/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Entre em contato com o administrador do app se precisar de ajuda.",
+  "appNotAccessible.documentTitle": "App inacessível · Dify",
+  "appNotAccessible.ipAddress": "Seu endereço IP é <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Este app não existe ou não pode ser acessado pela sua rede.",
   "chat.chatFormTip": "As configurações do chat não podem ser modificadas após o início do chat.",
   "chat.chatSettingsTitle": "Nova configuração de chat",
   "chat.collapse": "Contrair",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Desculpe!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Obrigado!",
-  "ipAccessDenied.description": "Este aplicativo só pode ser acessado por redes aprovadas.",
-  "ipAccessDenied.ipAddress": "Seu endereço IP atual <ip>{{ip}}</ip> não está na lista de permissões.",
-  "ipAccessDenied.title": "Acesso restrito",
   "login.backToHome": "Voltar para a página inicial"
 }
diff --git a/web/i18n/ro-RO/share.json b/web/i18n/ro-RO/share.json
index bec25bad580f38..e199d3e243456a 100644
--- a/web/i18n/ro-RO/share.json
+++ b/web/i18n/ro-RO/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Contactați administratorul aplicației dacă aveți nevoie de ajutor.",
+  "appNotAccessible.documentTitle": "Aplicație inaccesibilă · Dify",
+  "appNotAccessible.ipAddress": "Adresa dvs. IP este <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Această aplicație nu există sau nu poate fi accesată din rețeaua dvs.",
   "chat.chatFormTip": "Setările chat-ului nu pot fi modificate după ce chat-ul a început.",
   "chat.chatSettingsTitle": "Nouă configurare a chatului",
   "chat.collapse": "Restrânge",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Ne pare rău!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Mulțumim!",
-  "ipAccessDenied.description": "Această aplicație poate fi accesată numai din rețele aprobate.",
-  "ipAccessDenied.ipAddress": "Adresa IP curentă <ip>{{ip}}</ip> nu se află în lista adreselor permise.",
-  "ipAccessDenied.title": "Acces restricționat",
   "login.backToHome": "Înapoi la Acasă"
 }
diff --git a/web/i18n/ru-RU/share.json b/web/i18n/ru-RU/share.json
index 90ea8abac14d61..53f114cc5f1106 100644
--- a/web/i18n/ru-RU/share.json
+++ b/web/i18n/ru-RU/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Если вам нужна помощь, обратитесь к администратору приложения.",
+  "appNotAccessible.documentTitle": "Приложение недоступно · Dify",
+  "appNotAccessible.ipAddress": "Ваш IP-адрес — <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Это приложение не существует или недоступно из вашей сети.",
   "chat.chatFormTip": "Настройки чата не могут быть изменены после его начала.",
   "chat.chatSettingsTitle": "Новая настройка чата",
   "chat.collapse": "Свернуть",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Извините!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Спасибо!",
-  "ipAccessDenied.description": "Это приложение доступно только из одобренных сетей.",
-  "ipAccessDenied.ipAddress": "Ваш текущий IP-адрес <ip>{{ip}}</ip> отсутствует в списке разрешённых адресов.",
-  "ipAccessDenied.title": "Доступ ограничен",
   "login.backToHome": "Назад на главную"
 }
diff --git a/web/i18n/sl-SI/share.json b/web/i18n/sl-SI/share.json
index 88c26bf8b66f1a..5c5906e14244ac 100644
--- a/web/i18n/sl-SI/share.json
+++ b/web/i18n/sl-SI/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Če potrebujete pomoč, se obrnite na skrbnika aplikacije.",
+  "appNotAccessible.documentTitle": "Aplikacija ni dostopna · Dify",
+  "appNotAccessible.ipAddress": "Vaš naslov IP je <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Ta aplikacija ne obstaja ali ni dostopna iz vašega omrežja.",
   "chat.chatFormTip": "Nastavitve klepeta ni mogoče spremeniti po začetku klepeta.",
   "chat.chatSettingsTitle": "Nova nastavitev klepeta",
   "chat.collapse": "Skrči",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Oprostite!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Hvala!",
-  "ipAccessDenied.description": "Ta aplikacija je dostopna samo iz odobrenih omrežij.",
-  "ipAccessDenied.ipAddress": "Vaš trenutni naslov IP <ip>{{ip}}</ip> ni na seznamu dovoljenih naslovov.",
-  "ipAccessDenied.title": "Dostop omejen",
   "login.backToHome": "Nazaj na začetno stran"
 }
diff --git a/web/i18n/th-TH/share.json b/web/i18n/th-TH/share.json
index 1fc5966175c885..6ec7cb4726cb15 100644
--- a/web/i18n/th-TH/share.json
+++ b/web/i18n/th-TH/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "หากต้องการความช่วยเหลือ โปรดติดต่อผู้ดูแลแอป",
+  "appNotAccessible.documentTitle": "ไม่สามารถเข้าถึงแอปได้ · Dify",
+  "appNotAccessible.ipAddress": "ที่อยู่ IP ของคุณคือ <ip>{{ip}}</ip>",
+  "appNotAccessible.title": "แอปนี้ไม่มีอยู่หรือไม่สามารถเข้าถึงได้จากเครือข่ายของคุณ",
   "chat.chatFormTip": "การตั้งค่าแชทไม่สามารถเปลี่ยนแปลงได้หลังจากที่แชทเริ่มต้นขึ้นแล้ว.",
   "chat.chatSettingsTitle": "การตั้งค่าการสนทนาใหม่",
   "chat.collapse": "ย่อ",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "ขออภัย!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "ขอบคุณ!",
-  "ipAccessDenied.description": "แอปนี้สามารถเข้าถึงได้จากเครือข่ายที่ได้รับอนุมัติเท่านั้น",
-  "ipAccessDenied.ipAddress": "ที่อยู่ IP ปัจจุบันของคุณ <ip>{{ip}}</ip> ไม่อยู่ในรายการที่อนุญาต",
-  "ipAccessDenied.title": "การเข้าถึงถูกจำกัด",
   "login.backToHome": "กลับไปที่หน้าแรก"
 }
diff --git a/web/i18n/tr-TR/share.json b/web/i18n/tr-TR/share.json
index 98263cd2be2cf2..9ab5ea89189658 100644
--- a/web/i18n/tr-TR/share.json
+++ b/web/i18n/tr-TR/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Yardıma ihtiyacınız varsa uygulama yöneticisiyle iletişime geçin.",
+  "appNotAccessible.documentTitle": "Uygulamaya erişilemiyor · Dify",
+  "appNotAccessible.ipAddress": "IP adresiniz <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Bu uygulama mevcut değil veya ağınızdan erişilemiyor.",
   "chat.chatFormTip": "Sohbet başladıktan sonra sohbet ayarları değiştirilemez.",
   "chat.chatSettingsTitle": "Yeni sohbet kurulumu",
   "chat.collapse": "Kısıtla",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Üzgünüz!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Teşekkürler!",
-  "ipAccessDenied.description": "Bu uygulamaya yalnızca onaylanmış ağlardan erişilebilir.",
-  "ipAccessDenied.ipAddress": "Geçerli IP adresiniz <ip>{{ip}}</ip> izin verilenler listesinde değil.",
-  "ipAccessDenied.title": "Erişim kısıtlandı",
   "login.backToHome": "Ana Sayfaya Dön"
 }
diff --git a/web/i18n/uk-UA/share.json b/web/i18n/uk-UA/share.json
index 282ff0c8804993..c76ed49f275fa0 100644
--- a/web/i18n/uk-UA/share.json
+++ b/web/i18n/uk-UA/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Якщо потрібна допомога, зверніться до адміністратора застосунку.",
+  "appNotAccessible.documentTitle": "Застосунок недоступний · Dify",
+  "appNotAccessible.ipAddress": "Ваша IP-адреса — <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Цей застосунок не існує або недоступний із вашої мережі.",
   "chat.chatFormTip": "Налаштування чату не можуть бути змінені після початку чату.",
   "chat.chatSettingsTitle": "Нове налаштування чату",
   "chat.collapse": "Згорнути",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Вибачте!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Дякуємо!",
-  "ipAccessDenied.description": "Ця програма доступна лише зі схвалених мереж.",
-  "ipAccessDenied.ipAddress": "Вашої поточної IP-адреси <ip>{{ip}}</ip> немає в списку дозволених адрес.",
-  "ipAccessDenied.title": "Доступ обмежено",
   "login.backToHome": "Повернутися на головну"
 }
diff --git a/web/i18n/vi-VN/share.json b/web/i18n/vi-VN/share.json
index 3e26d78e3c279e..44f5ac6a014774 100644
--- a/web/i18n/vi-VN/share.json
+++ b/web/i18n/vi-VN/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "Hãy liên hệ với quản trị viên ứng dụng nếu bạn cần trợ giúp.",
+  "appNotAccessible.documentTitle": "Không thể truy cập ứng dụng · Dify",
+  "appNotAccessible.ipAddress": "Địa chỉ IP của bạn là <ip>{{ip}}</ip>.",
+  "appNotAccessible.title": "Ứng dụng này không tồn tại hoặc không thể truy cập từ mạng của bạn.",
   "chat.chatFormTip": "Cài đặt trò chuyện không thể được thay đổi sau khi cuộc trò chuyện đã bắt đầu.",
   "chat.chatSettingsTitle": "Cài đặt trò chuyện mới",
   "chat.collapse": "Thu gọn",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "Xin lỗi!",
   "humanInput.submissionID": "submission_id: {{id}}",
   "humanInput.thanks": "Cảm ơn!",
-  "ipAccessDenied.description": "Chỉ có thể truy cập ứng dụng này từ các mạng đã được phê duyệt.",
-  "ipAccessDenied.ipAddress": "Địa chỉ IP hiện tại của bạn <ip>{{ip}}</ip> không nằm trong danh sách cho phép.",
-  "ipAccessDenied.title": "Quyền truy cập bị hạn chế",
   "login.backToHome": "Trở về Trang Chủ"
 }
diff --git a/web/i18n/zh-Hans/share.json b/web/i18n/zh-Hans/share.json
index 7000bba52f561a..a188d7f274fb1a 100644
--- a/web/i18n/zh-Hans/share.json
+++ b/web/i18n/zh-Hans/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "如需帮助，请联系应用管理员。",
+  "appNotAccessible.documentTitle": "应用无法访问 · Dify",
+  "appNotAccessible.ipAddress": "您的 IP 地址是 <ip>{{ip}}</ip>。",
+  "appNotAccessible.title": "此应用不存在，或无法从您的网络访问。",
   "chat.chatFormTip": "对话开始后，对话设置将无法修改。",
   "chat.chatSettingsTitle": "新对话设置",
   "chat.collapse": "折叠",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "抱歉!",
   "humanInput.submissionID": "提交 ID: {{id}}",
   "humanInput.thanks": "谢谢!",
-  "ipAccessDenied.description": "此应用仅允许从已批准的网络访问。",
-  "ipAccessDenied.ipAddress": "您当前的 IP 地址 <ip>{{ip}}</ip> 不在允许列表中。",
-  "ipAccessDenied.title": "访问受限",
   "login.backToHome": "返回首页"
 }
diff --git a/web/i18n/zh-Hant/share.json b/web/i18n/zh-Hant/share.json
index df7a687380ed0b..5ac035cb9b434d 100644
--- a/web/i18n/zh-Hant/share.json
+++ b/web/i18n/zh-Hant/share.json
@@ -1,4 +1,8 @@
 {
+  "appNotAccessible.description": "如需協助，請聯絡應用程式管理員。",
+  "appNotAccessible.documentTitle": "應用程式無法存取 · Dify",
+  "appNotAccessible.ipAddress": "您的 IP 位址是 <ip>{{ip}}</ip>。",
+  "appNotAccessible.title": "此應用程式不存在，或無法從您的網路存取。",
   "chat.chatFormTip": "聊天設定在聊天開始後無法修改。",
   "chat.chatSettingsTitle": "新的聊天設置",
   "chat.collapse": "摺疊",
@@ -54,8 +58,5 @@
   "humanInput.sorry": "抱歉!",
   "humanInput.submissionID": "提交 ID: {{id}}",
   "humanInput.thanks": "謝謝!",
-  "ipAccessDenied.description": "此應用程式僅允許從已核准的網路存取。",
-  "ipAccessDenied.ipAddress": "您目前的 IP 位址 <ip>{{ip}}</ip> 不在允許清單中。",
-  "ipAccessDenied.title": "存取受限",
   "login.backToHome": "返回首頁"
 }
diff --git a/web/public/illustrations/app-not-accessible.png b/web/public/illustrations/app-not-accessible.png
new file mode 100644
index 0000000000000000000000000000000000000000..6e5f00072934f44964f1f0a34322b7698aef33e5
GIT binary patch
literal 164689
zcmZU)Wl&vB(>6+QcXwyw?(Q1gA-KD{J3F`s_YmCOos9(u9^7@~E?@5FJ^xNsPpz6+
zRja0ZP21Jev8u|lD2RlJ5D*Y3@^Vt@5D;Hn{u}VH|5l0!$VLA>5M1Q++#w)vY5p5u
z<khLK{w;oSSC^H5sGT7``8R>K7XK;^0nw0%^kxe4Z;t9At?QxTY~|r?>ShTcV{7eb
zn%|IN4gnc9B`+ne>GS105YB{n<o?n50oci8&`6`$=+~o>*%i;8Wu*`KnFS$F4h?B5
zCKr-~-d~y|0a@e?&y1d9<<~aQ^SD{%*B8_!xRtXiypiXC<zTTFFbDN~Y2|JGv)A|i
z3ltl~|DR-`n0C9|vcSmyUVRpXgnhve`79t$MjN>j6As+NC?h6dJuqEa^FZ#0_#Yv_
z!Lq9__+nLU?E?Y4fJ?Q_GM7tVo??d(OtO$qKm5Xexb06gmzjD7txdYDS+6hNI56Ai
zop8R7hZN4%EW{hL1JjL#w8~=4!5EU(bmZ9*WFcRk>LR{Ci$Ht^hxk_%H?2t6xK4<%
z!G5fy7UpLl2U<f`$D%@~^O4h&icp7pqp5EF9~*S2O1v@2yS{A=YAhNNgFmiiRWH`Y
zK|Fo9p5Xu6EJUuDs!yR2{f;QraLpa1^Oq4u71=q*meEA`VUhn&7<7;>_D`?KiqOT{
z#b5%l?f?6>EEI;^gPnm?$Hni1dyFj@^$c`dY0T?DH>r)kxH5k<MTDi2C*8h3|CCy$
zsFm#%Z0xl??6M>|Z0flf2+_5IfHi^m2!?~2%K*0{r;`+rd9*AA(;-@aPCsFkC#?du
zIIwF)7MXaHPJerItN?nUVAkOX4rn2#R|5H~^jaSZJI}mpLT;Nxb39iLWJidoRyy?2
zCsa^lEB&jjGt^IfHvvc#wlBm-Zd7AnHgJ4085LxSYS&hzAF0F}R7?Ow0ueG(>leO+
z{?P6O>`3c8glX-#V(HcXb6so<4yK?k2oW9xP(3}s(^{f>+9N;YhR%JbNqZne0M-)4
zSF@Jl6RiW^P%y(k87=U)g$0-y@^TyC_ooP1o;X^}krZfDEBSH?oz_ZS6mX>Lfii8e
zIX?#g|B(83?tkS>{ucIQ*ecOgb6IL*E9%l*dfzCwgEm9-U}aFf(xp+`MAl=hR1>&x
zI|L@`n0XsU#9m<iLKT(qj1OzPK*q(-4}nk~gEx}%JjM_C!l%qe4o4ia2cO$85pk-|
z#h8UlF0nH6emfH_>_w(X)DhO^7rxzqsQv>6j+9}fupl2!@FOZ=hIB<eMVINDk(0Gc
zySI4ktaM=wO2e;TOhyL7;VNGx1{c39Nj#;#_Q)lC-y<PQkY?jYoiMkiI!2R-HErJI
zU!ur}9~Kk};oNri9LUI+@_Xn8Ex56W`;+&dXM-GhqVTI=E-sNr9(F|U+L3yv!+J^U
zSENXPuhlOK#Nj-*x)~^a>6x8Af1t+wdj%J0KH~U~mw)sG4rQ%Er|xi_>ta_pIXu!+
zlO!s~JP_6cGUMOm$6BTfH>ve{i*Rhkjd5Y>!Gm%EUYbvuX;U5In~AI1^tFKZc3`@D
zLSwp=qjP*RC92xx-#dTp&YzPuspwT%#p&}8?|@CuzPSX;r~o1BSS<5j3Fk0+<#B(}
zYxusot72ka|GwSTf6uwD?u{;~_Yd=Ru70at4Hh^JBR+{oIP7Bjzisk0P?VCNzrSMc
zwkOp*0Oj$wT--grL7TT4hh~4%xerWq69`6yX_A%MFnG{s$QiVzbks=kEm1RCaYdxK
zSx57`2V8hzgZYFjnf$@%BLqHT#H6MN)S;5XWK>ppWcMPjV%UD4A?&Y>({6j4rgeD5
zjjywT*wz21d}Ac27z57w(9-<Okn+;m=aEXc<?BP1$xBo{j}1l)I)g3j7|XkqPH_O)
z;rE{VXnOlS&Oh3(rl&DamvI$T5e`%}>OKKan|TcwaGFxVr8M8?tH!y=J$jsT(|>2_
zqq(vckJ&bI@3O@;ClUPCLix|M1w)r(b8UqU=p5mTem!*`4o$A`c&Et*1x-bD&Uhz#
zYsCB3xiUZgAS)EO0<#7vK9r2$jxjF`!W{bF6o``eq7?-Eez$b5l^*5vRkQp7x2q;{
zG&WA9CPR(9t{-#b&%#%c@He<13>b_nla8{Q9mgQ@Ek?H3VaPsQL$xEwuHCpepjC@t
z;g+w_kKU!EkIIQ3s^vBRdu5x4HfGfkQnGIWe*&$<tiB6N)#k^GxMP)bUhJDrpXHK0
zamvhUY_-*q-98Husn*#4OrIFpaT)6B1T_}RnqT?#WGS1X_cwWX`oYeyq&WAUym&;H
z{R<%^WpOPHy}7OlYQZ4XMLW1}Drq;TfMIhW0cbsVgh9AB<^|b8cY`xi%aer%M0s8*
z>xv?Mrj#s`JXa2Ep{mFw0%O!0sV{+!`&$4yRE8&CE9P_3-L{OUJL5lar&%o|U`2L^
zrT`3Gm9O8l|1|ZsIr>V)T04+{7y_u>oqsq`dZvsRJ8CHKe5Ncu1>BITMWc`H``)g|
zRkjtHVgqq$CL1Px2;z4b1P|GDAW3sZnc27(<4f{cQx_++m1J!JUo5Yq@<Y(17h4fE
zRY|xD;$>0E;{J0b(IKJI>=3Y;(?O6++23~*4(s6@n7q6>jkPnrH=sC9VL2b!g@v{E
zu-kYW!@n-sQ3u|7AA5N>W<_92uwFd9%@pB#cSSkD;@<f@Cq40bREyx`*jq&#OUQLR
zlwZK>&i`<-thW>J7QX#TZi=S(eyHzb=21(JsAz+HlhH9!Z=FAiS#^2T8^LEar|AS1
z2+<-KajEtvs6IA?Mo8p1jGX4gI@30cPR4oNZW)%K$we64`Cv{pJ&CoZPu)CZVTRRK
zgb<mIre8j&pZ&NdupZC{uoH%x9pxt)4_$!@3OPG)#H-NQ*|moa9BkH;2RRU}+|lfI
z5Spp92?k*e)}O4I;un3mZ5j|E^PG^C<+rCF(;A<^Z+VO-M}rG<!1e)KCYUcGnIrYF
z9`L?}F5Wu4ibQEs>s$OJ4Q1lEI$Y6huU#1C-_0B1u1A0<(wk+}_XHCTmrz1US+V;G
zUv>FQiT`P9pov&34+LyGB3YZqsL|NDK4dp&%h!De&BC|pO#KoVn6(<SdyfC{^(l`r
z_9=icPjQsf-+|-N`Hdpmdr?vF+$p2<m<W8JJrZs*tJ+?LC*8M?nqo8dcgDvA)#K|P
z{drrx=B3!1_oKV_E{x%xy~%>N%aw7cr_TWGG~NC?k^n{wUQ8gK&^wD>yzss62;rNc
zM@Gm~>+81i2b~KLadJBcT`o)I-XJ;KgHs3v<tlD#wkY*U7KyTgMYj5r)#r^p{&n{Q
z!eHC9oF3uNQJ(}!AR3`2ntJN2Sa%=_*Ou~KdoN5+|E#}JCwBh(&j#HybS@9$Depel
z?84UP7!v`oZlGuzE$3x6Ct@tltFP6IN`G6TMML-k)8_rwHk{%8?)I(`^>wSXsFXxl
z9#{&J$Ir_Ap!fN&%GRF4#qru3+ty+(CB6TKKOvBJsfdvR>zD8zyUmq6{z}z<_Rs~N
zEj_igl=$S)Y`8pWB$`4U|0D;P66I+1gM!g(roL&d7MITm5hjLX7;~h~NTE1MXXsJJ
z&6nc&GE8uF+|i#BgtE_NHCa_*c;}`0qr!wT7QgZ#qFMs^hxeu+K~{e_^`$%y=&PlP
z-U2uNLJ#Mi4VY2p@;t<RGQQ^>JE@D2>}OIIC3rKf!dqKaPywnyDt++^`;YTke-@7h
ztjPMY^F$z?iN|Ys%!m4VzPxFw4;-+7A;wO2rxU>;<z+zJDl`3!bidcj^v`R`Ls>CL
zJ37sVE!@53e^C-FIWk5DZmNH{upXsZH2!#rk*>|1zJrv$<;rv;d?ckxf6>Jd^9@PV
z)Cy*6C)*aYW3}WGe$gvTV_ahc4{DU{jaZBjHMX8kPyMZo#W`kGGc)hs4XSFv^5{$H
zcIG>Sl|rID6X6vl4hv%zQ7R@yN@lrovcc>z0#gbqCMUo2a`wPccFH9M=Pqny=q<v3
zF8ULea{7RB`koSFtmr(2s&@I2`#UGIGN}NR-gk{@w-TmaOFlc{%&eFyUQmJhZXb+g
z;=VLRd-n;q!oaBUwx|T_t`%HxqTTHrC5zXUKjkFaYCfxt#{QO?#Ar@Q(&PNy@gqjs
z6;cw1D6gTiYO^OGYU@#mo-6gW`PBuigL>N|I_mbHY+i7H`oUp?qxL1B2yQw4U}8Pz
z1a3qn3pNYmR`uCWE52%}5UM8@1=1IJ%~g5oni{=;glp6V#4@+fS>1Tn75~J-lvoC<
z63v9&JafNahLAMD7tXrh>S=c0KM_nDgQQbFuZ3lAl(vo}`x5byBlMe3jsSF#Kh;!L
zdV|u|Ba6|#HYqsiHkGoBo3&7H(y!)5O{C1DZ50Hn5a0Ar<0WRRL@8mmS+pJ%vd)v9
zg2Z0n5b*yOK^rsPsdrX``ogpxn0SE*1n{NV_xcQW@V{^`+CfqRQB{6B(OB4~Zkf-k
z@XrSA`A8TtElW|k!k^fe7x+ganOb#@5*=#^c9(<4+X~P5u6~RRZ%&8sFYrass;%Hx
zh0XO~+WndaHytA4QextZEpp3U^Y)zdGvTQnPa>96aN@`AB{3p@5Dl~w|C7HlU2fgL
z;<qe;gc5eo${=lAk0v|9ocYJf?OcBZ8F!o!;f<*xSk(sG=<dF_;IOsAD0Ocl#5eIc
z`+Rdv3t$CMlp(Y6b<lBWig)~jK4FBlkv&wVsoEQvnGWt9X#VI~RPZlrayAibdf$SH
zh&W0!F-+oIRG$uS(5gUn<9j&R8)*vyaj@7#&Yp!be<Cn!QBWQ>M7;}Qh+5`vE-nr<
z(q0VA1b@KDOP=Z~)Z+DuF~P>S=h76Mj$E$eu?LS()h7q={C+~zZ~av3b@}w?Wpgqf
z#6jI`xg%_5eKB0dG%~r!sf(uZVtd>0F82MviOC!FJxaOd182inok^I?`qpPSoh*C|
z4X@?f)=JW1q6FhWmzWNxsAYu3XO4q=`ojP|SIgtRfeIeaa}cq~$Mqa&KYmlp=~!R{
zLexCI%n2Oj{PyY@X2#94{zX^PVa=QUM9dW&fZ8<dUfy9%S%2f^+ZVi3$DDVe!-mTV
z4fC>iY|ER>dTW{nHmX<qv|u*0Ztd2?XKb&x6(Ct-b*b^A{OgBUwe6mK+Y2QL#qB`-
zsS7qiTs8}i39CU<Gk{CsN9%_Oa3sfeHGjY@sj#GBbgvuBI?%#bz&3i=q;TPhGgBsO
z*zm8DAe~K;D{nOgfOvC<Dm@ayE=p8ccde1=(olxf2yA3OfN;qCRpR%JYbNM=eZ1X}
zO<y0qtS4vLLF@R7sAhYsfW(B|%u#%pB0fszjS<@BYP2o<bgnOeTz4!x!q+Uk`Id%P
z{p8mO+gSDso22$@(&$%ZZL)KoEt2v>k`G~klg}_fv~nLwCMU+<v}A*!^1;{)JEt?^
z&9@A{?g2kR5aW^Pf^Ac$^~H^60MB&VT*48{Rb+ZO=KwZc_&nBw#|X{LP7c;7!C86|
zt6F9w3UN0;p_OScCbF&ggPjN@?5^8kO?KZ01(QFkx<iQ=yeOr;*_fvF{8j<)AiI&E
zL*2&xUoLCRnTr{KWBDq|6%>)QkBmeSlLs)=H{G<P<=6c&rc5&@cX(%$d7WH4%l5V<
z%5lcVq&TyUP!1zA{xZNI`g0myuOK4LA9y7-ERM@)btht5gh7vJt0XodDpOSPDvU|h
zTx_uci1T5<lEk$vd74&Kqfvr<S1Ec*mFFYWt7+m-j;CRl?wF0A56OwA)C*cYy9fA{
zWuVe9-1_PLIF<d@ADP<*w`W5hC`03hXQ+T(8`bzAoBY0Hp_l)<$(P3cNtixJo!p)r
z$D22Y7Uc<j2##?O*JQEyyK~KL-W<X7ZK?q^b{KkpgF6Z#S$7Tz){PfU-*PzmQ^wOi
z{5ipBgqi3Fk>LPs!!E<%MQ7}PXooC(;wt6-Xlo1#seFeFYzg9qeY_Za;Pi5ujaom&
z!CbT&PY}YY=R_kHPbj)E|FSLu{e@jb*k!*wV9WDML}P99G*l?Q{UR+f4pUPR=r$N|
z;Rh#O%aXhQA`*2WCrju`Xn7Vqpa4YzxMw1#*-e+>Tcv_4%M~4G=txX|Xy1YNz#8PS
zSQ`02lM6jJl}7pIf$mx+^Lmz9b*;MR-|kOYqb=9qizuqmxhtzbiOuX*s0`qJ72?e<
zh?qi?3Hasv&m-Z7utvbAwkA#2Kami~JL|!V%gRiBPpScCt^DH-uwTDw@NSMVE2HX?
z;+ar<e4cX32@qXp-&`r`g($QCM6{Mo3|RKK?MHX4xN?j0c^x}^mt~cpw|{{FEk{=T
z-u$Sq+&}?ry=TTe5YykS`EvfuDe<YL&*T|V`r#aBQX=h;;muKeu=fsA^c;)LD($L}
z%<~j@sGlL76%uv6Y$-_9`?%H@ePsWi)AAb-BR;u}rpJ0VvY3TGFyjK95sK3CKd4M|
zn44R&;twj{cu|#DSLj7IG*lXr741&{EV;y?OzR{GN@K=%&LGnC0;P7~Z%Ar70lZpm
z)72i9nksZf>HbFTiT%K7S00l3bS~MFhnv?s?NhtC0R(Wfp;o#Ez`v{we|I}+9_phs
zD|=8r?IbPpuPO$Ptl(Dnab*jhdb9ON;Ndi-KG{X^vkr0ma@mte>+z0ut%^OK6j2^&
z&xbAD$}(x)LMCpt$H=w+ut@tMJ~}#Qy8j0f9|Mt?r=|d{=s#@C$;7SXC`g;pGK-&@
z5r?N|u(U2I(ImZBX8+s|H30_JjMdMB*iHM}WM#y}%K7(XU+28$`<dVu1Hf&qr0bEH
z;?5ybNDX_|?`<iWNmjMP<)keiGW9L?wC^Y0ancWOf)N4Q6RU0{GJkm#oOXA8@fyvx
z5Vbc~#XJMaY=scsk)qL$3RT{mu|kjT%SaOmQL)^K0&_EZF{MPv2n>WYgCp=P-%ZzC
z{*aF{NYc**#VVl5mh~ZPl^Tq15=FngmjSehbP<9RmtrtRdF;&*5WS72a)b0m->|Va
zbxo^VtY;*CbQa)v&hVi63y7tH=_Qt^w&*aD6T*biimt-1|A!CQm~c;unwdvHR(7N>
zp5|(?e&FBNrC~^qsNqtN<dmD1nx2lxoEc<E-WJ!_q%OLP0`GO?^M8O&-$(%0?c1t?
zy4+x?x%UaV*C(Do?&?d)0j-AilA->!)#fW}k7_cHY0VzVaUCc>3_il<`=}cTH%E#6
z(1<@E7U$w2jpBk}?dL{0lRnn!D+YJS5;Wbc-y6X_Ae${Le1R@nE+sxUHer14fbSMV
zlc=5g^Fny(pUAGfvc`SrMSmPuW2S;t*d|dd^0?ceOV)Hq(|-J%zhz7dc!PdHqV?;7
zpK#M&n-h=8E?M$KqPNR)`<m_>&}_t)!?ZMu{GB7C?x(+p_U|<obWZonC;UizS-E#f
zU-EvCCvT-EEA1?8smNnnGio=$mQI=tJc!>*`d<u>4g)OBKonsy^$e>F>KkV}<18u<
zqyuG$+P#r07>vivIuOhNPd5MRO!t4lhM8!+`~>)Zn%{1+dD2--jIicgWe}}eGWZm6
zQB4_IS>>=xu~eJfS5>#02Wq~)lqAyD69)6%tk=c`(B1I<9cI|byXi`5Lu?vn$PZC4
zhM-wfna)~~4K<O^ROKsyk0hC`cWc2}oyDGXoiIX=HqAlG8fwc-=k0}+UCt`eG~=L{
zk+>XmlP}YLs+C;RkZ-JcCi`iiK*)lHs1#>YCpMEk(CGYp>yGd%D9UVEe?KUR45$}$
zM{d@pS^&x@pzGmMJhB9}@Aj0ZT&(L(l+S+UZ!0pU-_T@89}c_8XfRj80;NQ80}LKn
zON=;SzsK-XnI++ou<Z>zA}#-u*3~CU7RS{nw58_k_lg&CipsxpZYXYs8gZ2F8cVla
ze2+rm#jX1l*^SQ=<ENx}y}TB#=<TqpjNeO60Xw!*@$W{k9>6ruM16Jy>#JYK&f}kB
zCk~~oa>S8HGbU(NCu=N%dM9+3{X|l+nS3bf&<Xpg>8Z~sQIkF@Sh);izdGS$p`?YP
z;?EI_4bh6n57H+{6^uwC=U1tI$ieTxKjBl*(N@f!(?xFs#D49g!Moxzp4m#nxT<&>
zwx;tNEF)Cnk1*$@bk-nk0{_CDQEM4qq7BNY)gGH)_84=Qx3N1DFy2-KyAOh#+(q&V
zK8ed%gXvCV&mW@;XFlQXCiE&bYpG_o7bfG3tw>T4CYF<)N=@`o|I3!PlhA+dB-S&<
zrfg;ZaPTR`Q5b&gW!WqGDpZpAmtQJ2lAM801KN{&k5N4;Pz>74?Fw92-31f*4ZJ!E
z9k;?%^85>66YwQcgm)C0j?((kL|z<sriPCCXNk+Y<9HC`89<uYYH*(>SSE7G96Pdx
zO?To$xY}pP-b&_q-1ResoXIODjM-7%3{^|^a#Ycu*(bt?(*F|X#$`M=Q}S_@W{g4t
zH;voD0wzb4XKS5|X9eSyU)b#HA2NnnTERPawKUHN98l4es{f9vXW$$kDNEtfKfnqB
zC3+qD;TYUQ^vvceK#2wIex|ebBq7gtvY~$$Uz_Q!@?{=81BNTbMA#A0VKxpewv@q)
zQsvm|mJN;o9xl!$Dz!CsUgiO^NrBIScg4Abm*5hfD-Ozw66q2<Z_!YoFW!%PGU;Id
zvFSnDOGDHn`=8kdu#i)M9jNAiX1^+CvS|sq-8TVmhm56{U8}bX!})Jq5_MG!%oDmv
z7H|~jmcW#r&e|T&962o!D(vlDHubo-^7E2D|9(jybllhEdwm4EaPR=XFtD-3Vz!;I
z4DM3!_!sB_F8TdUZ!|F`p1U@XhhvLhxbl(;YVV!CU|->sO{s`T?&l^q(Lt>@)v2id
z@ah=B$Q@hmroFpUHuyRwoRP!n;ar5^G7;BGR=;U@=eM$=Y-qP%f#n=~zkgl@<(7S7
zeMds`YQhCcrqQuCr?C6`bRC7-4CD}<Snqn8zjL=C{pwp=_~oY={E;FF0rm6KsOr3J
z$t-1zo^VYK(2;8Drv3LjC?W(n6^Zq-#Q6_x2!o_3of_L!>-;2|SE~1rroDkyFG7(T
zH~h77>#TX_z}r};s4z{N?u9cTljijf^@AFWOC;ny<YH0B7*>xs?%auT(sh%V&EV;j
zBc0=m2NKwz{<)EGL(?~sgqOk|3YPM%hnW$BtMcYfQW8dzMMHEWC3P77@`F_TVBxX2
z)j^5sV1tX)3rB?-L(xc9fh+y5N}BBioaOlIB5xcSMFWKOQn6@0!A#Nu85p>2vF{I+
zN%b75if>$^V!Ob}+`?)^(2Bx)*@FH4DrE6)%Jf2puTU`lv*V+POW5<WYBVO3qfCO^
zx)Z9*v99n>A51!#mKi{0IFkm^?ZcPA{c@ef;<-9*Y5GTJT-dMuZhuyKckdw#4^G)L
zQa)T!%R8{~mL<-mu#!)ez~X!9nBJ;vH}5~WnL$>8&n0l^+ktEPG>Zmp_qG;BBz19%
zu?h$k)l*<;nn1Eu;V(4nz4Yk@G$O3TrTthGy0W*Lnm2gEU-}h@x-3Yrpax201ZWBj
zVPqfO0n6>XHh~x?vjwc?*4Q=e-?5`}eg)L1_nc?M41baR^DQDtY@`#W+Dr#Pk}dxH
zJ!=Q6;(Z8@5Y%N$E3LoWqDJqt>OmQMNBz!VqJGP75IiGul4rG1{kUCq;8fOqz|$n8
zUT}p&uJrXEfMjLC#8I)XwD2<4af~gW7uEQo!~?D?fof3(P*{?@N3Y1?)+t@t&l8qc
z_mB+E|BCxej)}phUDEEToXBD;?#>UsRb0+_Jk%|7xGl&^U2^hW?o;dBJ{o=96v7#)
z2@cVq8gaT+O7p_s{3Wfj#BlE)JOWyDDr-M523&Tc{&SIZBItuIe>tHe6<IT|RagCe
z<#IADBFNw6DM3P<dS!*Wn`D&J1E*-iCFiS}d;#lf$Ior1=@R48S-t52l#nm><L}4T
zrfttuuu!Jh%vGt^{r)vZO6>hMfh=}{Q`Oh9v42uTl%=n$$12baPS{q;G;atbe68uf
zeSXuf4elr25HDWKV0?xPO8h%}qgVF9t{^;J@w=^|a$B$h(HA~Q8hwJnPT;V~?GbgC
z>2I}+aqRBcXyGvo9HKWDI>&VrVxVB<V&uG2Zy!0>IkSI9nB4K{`#Xt4F6~~)?}1l>
z*q;J=diBwxg+wqapM*bxYcwijfS$0B)e^T2r>z(7Yq$+F!+h8^z3NZ+a;#I7^k5#y
zI2`AIc=RV!4Q1zdH#LH<*SPc!dcuo(H=8gr9rPKXH%r3NxiyBTZ)Ivme;8}kX?=PC
zFH?U6k$pT#k@);9=OBm?@p;~gN!CEH)VEeoghX=!4YF3|#-H^_88}4z=0puU)m}`|
zz=NTl6%St`Gc#>+wQr&Sbi-2VJaDf^PN3xnoWW8k-sR|xeHfdWB^iB1<Ja}m<x}?Y
zk!;RxnQITVT9fq@cbER)T6q|^=g;K9!kPv-kzjl-T)5gX*E&JCYkBR<^#bL(nFuGX
z_K}*@VJ?iJ-R|G-h}Er9<?b(Fh;9CsU>>hQn{N%Y&ah1$?9eCF7a#Z+>EDjCe<ut)
ztB5ZPdk~-gUTZZmNG5xSIl)?H{Ph5b&lFVuAPwxjgH@~6brt10;J4a~H9YGji8U9I
zUi<Ot!Pu8>ZwGhZ8#;#Si+^2a%r4?fw&EFyR-4&2XV@L~RYRb@X65+ILnaXHrx@$#
z_hnKRc&?BwS94dum|HDBXmQAu_b9}U-J0t?b&r{J0Qa$!;DjtY<4A-;X<|=K-8nB9
zA)V}xOKr;56#U8$0rmUyw~joH<-KdgeoJ6A)bFtyYUtFyQplK1o&H$NYz#cLaq1DR
z?k3piX%ydP$~bt$+Vg$~P3|b-?^8iZ@Y3~{k#$;9A|o=kBnqp!V^jXG^xeN!Gk_a?
z+M_qM<I5Alrw`ur2UQ=$o?xA*`ls-CJ6b!x4ua@m>>n0Af=e9oE+XF1yGi(tzraS}
zHwnB`9A&{TTkGX99Y^dK_G}GpJ~45hwE?l*xD-b}Uw@v<@dDg7=~UOgNrr~sL^A;V
z*%paQR6kKO+nV|$QU4YDr9y8G`ff#VaiXQR8)Or?&=5w8@ft5&2h~IH2uEfKVoE~r
zI0p_ND2X>!aKB&>X;brNY!)ZO#|}%i1OV&v5`1EcOpFmYM96?aZD{3>h+Q`rXcooJ
zDf{z371W;ovfXKkJRl{>DXfGM!AV9i3deg-gVIFCr^A}{<f#Q>#nVuNMI{b7e-1T#
za!N^4QUiicycGtf@QOhUg34AcMB1`b1ZTI_`b@%B8g_!mY<^qtIz%bAc$>m;s22L}
ztU2~G&Er3WHb8bl9zI~MnyM+N;_W@PYP(rdPFXrXoUUj4^5ht>+dp23u>glhn3N!{
zAgQcD9EVO)>3oM<mJ*@YScWpYoj_BC*>2IJ_cOKg4ze+bw0WAg0fLn&g`Ob3JCyOQ
zYdGJcG|{k>sA&L7rz)wgBmHI&!V4TF{S&+t*SiZU@n<aJ85*C`JhU~nwfX0b+^r&&
zwpSK78nAZ`pD!p;*eTr}k-KCs4@)L>ne&X#K3OmEE0`0-_YG?Q+$iL>0|Syg71Y>f
z6l+%tvdN_MJ`zvkl6neXNC&;6)ibCkWwd<~Szg*(JWC4(L(86VN{BnruiSDW9)4q(
zM9SySLB9(uRa#X2^MviTq>^?(pn@iS5LM8~A@NjZUzOykXUD3eUc#y>^P-deuKJRw
zNEq^I3Ewon2kC^(j5>0E-14e5nq+1jF&RhV+JdrRyK_)2sFID5K&2Li5p9rc7I%8M
zta`k`gp<XAA1ta~DBZ=X4iYS|C<{_I@-2}05E%OE*Zjaqv-QpddK;|C;n|wuoD(gK
zVdCQ;G~%Oexu)Cgx#QJ(wk-1bw4Hh$P}-A~A_9>HBf!*s8n?gkwW%=RMRICs664a=
z1mE}|_TK3~g?Xv$;qo+YFz)_f!+`iYO1Jfb4jarRH_G?R#lB*{k}`#14^G}eC^kDH
zT|+IAs05O-c>rq1TPjX%M5C|t{%?evN(f&(ZrlR0Y_%Pju43sM!0EoxZgW7UZ8rI!
zj1gSUy*U697CEFIEE;c8$iO>2vsfxlxwNtk)Z+RCk2}nMX-U<x6<2rhU)9BHxlZT!
zcaH9m(q@DeT^-gzx!G`*jwsdVO)y~ss&+(9B_k`+f1)$BU^ehqTNMA!R4)7KwiuYx
z2u~|f6SEjR^09G8#g4lk?9QHruZS(a_QiidVbP;AvRc#*(i()(Ba!j+samn4jTt>N
zP+~_V8FmER+iBMMj{tb|E>il^*(pYUY}#|X=T@V^ufl&%XdD$SO7K^Eri}kW@l`y~
z${QtgVX;)R^^?GN!TefFNH~#L3GGjm&;d0;2nd_*hcb`(iK=HUyC<CSaW?6fXo=mw
zF2k7ORY2_zXsu4N)w3x4lcnQqazX{6f<l{n1*!nn_)tDRw+G{B1}#Y|Z^Eb<IicZ|
zyUw+yY;6H(5z(<X$7-4*V@~P@b@nQTO2d9RUW${0qX}>^iAHP|y`d<MvOXD2RU<V9
z6<^fN2~PEJQyjmbcgf9AYM(abzxy+y;nmCbX^pdFCa8<j<2zVsH9d;zxzcC$YJ86z
zGT)8qot}_@I`|k6vTbPq7`ULX*s)PzBQzBoY4qk+@VGqIlS*k_-a{SKlA~Y1-UMuF
zpa1GNuBsUx$=BtMQhgM);`XpZ4JTyPQ(Xn=Cqy_$MBYGeU4?=^NSZU!%xJCn&jLV>
zAi)?Cw0ic+^bYyH>gi>gT-o__s@l~lK>h;fb)#Byf#Q5VuL;XlsK{=41K_ATO`IJC
z%=aBP@CoPBO(XnJIfQqho2dxZx(kSC{`nGfoPZy9q@bg0LU;X$ni9I)4i=k%3kEVU
z>br2*d0nFU50TE~rY!|5Mtx82_0#=xE7?lRc;Ds3l@ck%Z>6Vp{qdN@PxbTB_gN$*
zUFG;$)yG9f?YYbmTwHAH+wLSnE<q4dhlt_U4m5$gd2X@tWz{NH+RX#>SeHJp1IRuS
z<<SYee~+c}2j7#WH)h~b8M$B+-8V?mV2gR2r;R1l(2Ba-(%W?|l_=de?AFq1uQti5
z`c!WU5~cfbGJ-ED5MAJiFP68TzNBuJ(tJZJZf=6o6S9CJ31@H?VLWk=a=m37_bwyz
zKCLa@6X1g^=s!XFePj(Vc5hPkYgCxEFU_=}+mObpI%rB_ADZgC(~=Tec!3r;i<A=%
z8PTl@Of?9g*gY@l;<F%HEdqlVlZllFoKtgCG@)e=t>ZPTQK5$kL#U$QQ!8GkZBvBf
z)oUaEhJQT^3&*v!U@MYiOnWJjs;7v5Px-F88R)Y6m+;XZkoWFRYydy@%A)56;pr$N
z2%P%Bd3(kD(;~a}Mp}oDKMFg$5kxQ3Hp72xXL$q%Fb)_Bt}WkU)<hoGyZ#N&qo(>v
z(KJ_eKxks_FJd+V4n)6pD*IeFNkBO<m1F58{P79k-m;#GcejRR40eJ+B;_<;c#MX0
zjT+H^KO~T0Xp8ySpCXBC6kU{!HZ1I`rfXD_3O3z$j4;X)`9@GU4!1oiL1rH+NwFnI
zgUwt!(c{%HCcebD-~ByBp7s-<;2X}RhUGRqu~5U&tB~GGln^+Jks`;{5n(RXl9kg?
z`D{R43-3xM^Ep<{)SC8G{=f<O(unS=tCVOl*Jq*7A_D3P3RMjpM)`BqZRG6-g<aa6
zFF_gCTOO61W*rPM(SOok@pw4iexOx5sWfaSzSOI^%cNq>P3>2?Yo5Hxch1<$JM5`%
zk@0J=Ts260==>^<`KKa@Dr?rQ+U7k4J!c74+I}*JyJlj-UrQ^F)GuR0U!GJ{?<6>6
z9NwceU!<JMcbT1wwiD1j?a3JjZsPBu*&`Ey45Hdek4j8LDsDzUT~Z%>)Nr;dgxC=F
zPTsj0tjlUy4*zJKtQijU+1-SoOM#@QrYI#d_=><OX22NGqgK-_F%IB{&0XZr7_l-n
z_o0>g-kxK=mHMK@uN*4uswOHlZAk|c3sA$ugZN+34sWGbxLBQEI*kJH9?%;kfCauP
zw`VE#s_P4jMI+_LCz&)1%(}m?1icJ@&byE-4Kf?t7N>KC*VQ^suu8gbUH82lq<`Ti
zQAD~EDT|*}Q)~Ks#G5&ag1-5)nLbj5s1Dc8$P8>Mmfb5&gwX?R@EY&Fuq%+^^UV#K
zkQ0MXp7D*YU^8a_l)d_G*5dDfbQ8B?q{sAFK_WU;lztsycW??F+2zN&)P>18GzP|9
zNC*ZyY(#qZ5bfv5|AIe%C92lO!8O2D=Vk4OtPVLF(j~>(8i(q#HhH{(F5T$BF(w&~
znv-|sPSXXadsO^@OLIB17U8jb)#oF9PIz+4cun&C{8}AAM_-Z~8Y7SZCAV6aFe(@X
z@%q@hV1FO;JsWemMd}*0FCD!MAewOYL0IK5spx#r_*ZdVEsYtVCLRiWsEl#Wi>^7l
z<Q*i+3dC>dNO;~!--<^^G)`wT`OPCb8?Hc6El*#6-kD}iFD(%<$jn~y<diEh_OIZp
zD_c?{Z(;Ldw}+)<ujPP{bJEiA8!E??glh}X=1tCHMb;99k=%o2Ysc6LI~L}vQRuO1
z`^e_8iWsAQO+|lQAU6|48ahKd9RG?x(Fs2kz_mjSyB!Rp8+gU6eIgu!8H`uyCy*Yd
z^Rr}Ai=fdgWPF%1Of&t4I*sQ|TAhWamM4Zd);ui7^?X1q%9ktviw@=pUm62@ZM;7f
z|Lg<m1r6Ku!;=2Skh+9YJHRMXybF%%;0JbEpFqaw;CI6yUJf!&CX}cxokU=(&dxT;
z()_Bmsf$$atT}3_GvMtg5MZmP^d~nfb)DVA8uo@1B<A|KQ9ZRT;oeSMCP>QRc$G+o
z&71$->;q7BybBE9irlH1!7k=iB<Uk8>%FLU080=~k}3Z1K<LAlUTdmuHjvKu;=Fmn
z5AZzxMs=<kh~c)y)4{1x%S36Cu*8eM6ITKjMTC!4#dj^wU5b9Lbr>pb>2825iJdRN
zohKtu&^g>MK!^EoE~(z!PMhDVNJHqA)^E3AUH(_Z2p`xr^zBf0+h*4mFOJ=P_og}`
zv*Li!k3-!Gk~seyZ0~VZPoUS`Ev{jg`Fr4rrPOuwVQ3P)DwT`?LwRs5gh_v2fCJK9
zMx-6#B>5^8>Tc;U^zKsql<b0OnxM?fcx~r^3C3XmwlblqJrU0F@Z>{bkCGp;2P1*a
z&d{DV4D|}H=C5{SEZrGGxL@toC=kf404WTZ^FPi{mx+7WgU8Yrp`6p^1^KP%MXnX6
zG5e|k-A@CFR8JkF!`Ha=FOp_NS}ygf)i=Il*1@4-(&w&uGQXfv)`&6f%o@QInJR9I
z_FFWbo~T*HD$Qs-C;YW3qoz2*&Zjg#k?jrUo0XonSCJaVBttJk?l&EXTf901@N7<_
zM5BE<lptHZf>2mfI?9RR!_erSH6JGBM3w4eVWWcTXugcm?KhK*aCFjhCZdsmx9mM(
zWkaPeMr6%wC_~DOOOli6mK@IVdg96@?bh40qjoS+n9Ds<I{>p4fK?){3i^+|ClW*(
z^)ngYf)=#a=Q{8bv=Rvq#yC6r7p+XH@ER>s_BO8?VDb7-*F?<|?kTJRd+0NtIygl1
z=F9aJ0xvLr%-^sVis(2<ky6M1h;>FI#Qt{PfssIu-$u)MypK604*AqWzuZZ;XL!{u
zBBsq4ZDv(~^lwI&@uMN?jhA=Cm_Q(h)IbUQeTml`J&ZMa$YS7!R&{3dC-?%v(PJ(l
zaIyNZWKr(OG?mRPG`-W2b)aFTv~k*hQoA79Z?^6#eVY+*i6}xE3F@kYU&bPA<DD6;
zUq(V>0OLJjdh%P->4S{ljI!)G3MTSA5gFv~u=O(T&os-P4($6@%noe^xJ*gj9T>2T
zx*~<k&6V@T>-TRx;#@nZNZHbAA%8tGJiOxga_nC+$SxJ1ADj89JcoCT3!x{DKgM!J
zT9VMA4J$lvMGW!t6N3i&-Rfg@li)X&`o_ij-`S~$dI%0q4Jg0ifV?*1<MMm~Ho0Lb
z>9Y#Xl0OxQL%|NNZMz<yxCfWgnyrcZ<=(|+6Yv3+d}#<}#Nn!cQ^$ppijINN<6c33
zLrBWM?iR-9)@6N2ZyS%^v4Q9hTqvR(;SzWJ{6FiM!v?+k;@_rcfl30Ubx&9vTPXwO
zOe3ddfQOA}pi?b8iG=ufQ%VL80<B(ew(=vMJF*CjE1OMZ*|rl3LJCS^mEHD1$8v&V
z-+sOvP78}^+n(IRPmib7&lU|O$%h4Vrf25>q&ZwF1~;Q@GkV_(w?U{%JsGC+@xqkP
z*8<ANWTXlq^xnMQ#NEE=rXB1TQmJ4`BX#2H(6fPnRQ%<dsf-UQ-PAL7p|Y4&;7_rm
zZ>l|+6q_GJu3e<of=Km8?0IOC*{^U{{L#f*A<xO5RdzIw*IR>f=oHm_eC1SyaXveb
z70>m2gNQV4Oq#^TNg3?;4R1=8N<-j5M@%-Viv5{46gQ`A^4Epny0?_^^vG)YDX%Di
z0<H-aZ*WYv!Oc{I#=iAswrllG%K>?fZw2HX9rdDN+{!Kz26DS8xC1iW;Rt9ZT=xDm
z<VfAd)u`6bS!$P%>LR;DY^*S9<T%bC`~!-lY_ck=$&=IlR%+A{Z>S*%g9BVoRd>Da
z!ekudRZB_xtf#%m54Uol0csT*YF>#v{@o4g%*X?*Kanpke7-tEC`+;FvW(1KcdH+4
zk+}}=4cHrqnl65j$f&KbM{B`oH&r^iQ-LgnORLY+?a+jX)x1CXzuk@gvhhjMYLgmw
zM~IqH#s*3K@!BUm026BFmK>PQuaL!5{50-9*_Um2<oO}1)_=#wO;2C6D{U3gw`%OZ
z<eFOM<?swwb&439H;Af@>J7(02u=imqo0A8O(f!h9(C}<2R^~@Rfk{Fs@suQd6APf
zE&tuY9e;kZ+wJE{>;4f1XuAn28jZg<x_ef&-Pt++dS{{=`{zEb$**{7s5l>Aik|q@
zHGe^5sx;^$HXWu@w<DP5R3JZNj+rswXDa5SG2p>RwX6@wvCMoEG`0yY?7rOsE=;B)
zf{`i=pGlDWKjHVQ38qf7(F%oDLfzs41(!Ye4Hsq@x&@0}YjTF-`oWi0>HdDIzJ<sH
zXaZ{T3Y~7Ov1|e21jO`;`@sQDaaUF)Fh}AI29kliyd2e!bP<0Oo~6v(>v$&PzUC?;
zb>AG=tNzI#ZYh%O))tTP!hFGMv>tAl^KWDOSw)l}mZar)AzuEuUg5x(!%x`b^7LLh
z?qPZtdT-pN)Oeg=!85-x0^(v-fFjktKqz!M^x-omo3`UBet;CNo+2|T;Sz1URFLi)
zR3l$b{!W%`U)f$39(z?M;fiVs0tq7ga@YR5HX>EAi+R5;`<}oGxf9B71!kTzqYI0R
zDgxN?Z^bDNx+G<~_8qh$*JUcK1t*LK<BL)XX-O-uXe<-VA+s-%Ysv`eQD9l(y{-QF
z^7SJdA-WFl!&?gQVnPPC4FbXl8}#3^Z1!C9uXvwJ2mDHZ<oXDsXh*E{=RAtV+Y@s~
zllk;OgUnd?LF!;p=}oHg@KpkoMrwn_<2o6NK<vf3a)~#<8#h#o&6+^^qH7nSt~xim
z7XF;|@Jjbp@7K=nxwOlHweMs@trRQ~Ef0tfM(wBudm^&IGbiLWLcasZmd_P`jDXsm
zXSXn#tZ)qJ&wT55P}#mKD_zQ7t>h0Zqg?NCkDT?Ac76tyR|Q=LpIbaJ@RV=|;pqrx
zCP^8UJp}a!qHIb3<-$uq2+)I8e7qnE6m%9=9W~R?$O>La^vO{tPokAo!2oaa{A-+O
zF#KjZmeEmH{5ix0SSi?u8ln1d0HzII%z%y~vRh%#rUNQ5v!dqVIOJKBIj#ua50tRn
zn$51B?0@&1df#+mn`TGLO!kzmaD8H#8*U+upZSkD?$nZ$;R~&pr_J(j7I%Jm^6M`}
zugWGhO@H-@p8Q&-HZn-JQqdn40~a@9uzX7Z^!ibp0<Z1X-Ai)t_7dZt7$v|_;5!v1
z@Zr4AGQ+z?^$XE5;>gKMVV0qZX@6ccDqaU_XJu3EOVf+qj%9-00MKAXj+DZlYl}0q
zOO?a9QtiQ0T>=A_Q|t9-Q)g6EuXp`*{ItS}!oo!C<InLkn|`0R82>;_u+)I!kyP{d
z(Jp^VqBcw42s4e7PyS1TMB6;|E;<cbUwAk>PQYEtwtV&4Pub?CKGbx{ELhNojP6+k
zGLq7@8Q+w2JIWw?g@@5E`j=;cBQJ;q6qljV7Pn~=3(=HCYYpA_W(~KSk{XTSL3qKF
zEF^P%i#T9i2C?|C5q+*P1@BkeGtcp04xLtab$=RVZDZ>MF)U!1HE0E&rkfCTtA+Y>
zM`5SfxcDx;(q$_F29h^f_92WfZ6h5xUM*;L8`niQgWt4=F@81)(Gor^5+ym_93z*^
z6+IaAP2lRvJT>~}m^|gSku)N$ShAMX99mg*Q5Y#Qr#1DmnPg;LU$y>OUTsR|;%|H<
zL~OZX-aJ`9|7SFxmr1jt1zx4@GUOQ4QO*T7Q>@fgdnf8VQ8nit+65PC)|4;*U^4PE
z=ak%csEOpybqX`8sn!R|E2Ee-;$%6#8$rRT#~>)n(nt1_@=KdD^n&WO9u?{&%X<cE
z>1Nwp5mutbvhPwO)u6Uqt>oO^?ym4f7{iKlpWo+-!H$<ARv8o#^Y)N<K&qPU!j&01
z$SV={IZ1PlSM&~!L|eh$bHlsqd|@U?uvY#f*`rI$!(#IXVVR&Y9W<%buSacpKKOsF
zGN`UODvca@=tt+yR2R29d>Kg(D=z!pB9T%GB4suUJ>v#<D68P^bna5TPSo@-lwQq8
zY9Ln3Hb&pNjga{ZR`_p_3OQS9#ILUl{+<xMEcMtuJSYTpi9A6+ka$j}xyl?4<4wW;
zify+#duojqhzYEK6aglx$P~H0jL+3)t2gsl7hT`6^@=%^$&{oG`+<jKhw8#GzdheO
ztTNLC$@|OLtmAh_%~f~-A%+a6aC2~y(f)p}lQnli9i5YvM?0%AV^)TsV$k4e7Z0Jd
z5Yt+vlYZPhjwlCMSO)%0Q3KSotSdcBth5wFpk?&r1w%CLE&EJ?-0O#a+PV?ft1$Kf
zwU@+rG%`Q%vsWj=w7V`~-Es=U0ck4;xkvB&GY&quTypq80tT&r?hiFEy^;4bMqoPr
zCPby2llWql9`vu7EvMqayXfzQ^+D(c@b<ROn2r-d7G);_>VAN>%&Fu=#L<eD^_|HW
z!&LyNblau+kbQcnV>{;*Te0U;zcMNaZ7-TKD>V>KBhwIDJt>q4h!kJ&rS$kcrL0le
zSquKG7Nl_R+9s2KCF2^APx`e*toRdT(VR{+X8O02Lh9K9bA&TRtCIL&y-v2abUa}y
z?lNhs5ApXv=HrcSnomJQIFCCES+vJIR?MBVC)|uwLtng<Dq4|E@J7P{elImI^@zGq
zVv-sXsLL8X`XEiSd>luwVXrI6_5}A(zKZJ0%su~nfX59d1#}S8i-}8#?}Ell%w)A&
z0Lp69Jv?7rNvI3u^_*eqxFIC(6mjIH7&@D!A|25ITpZuth&vLsDb-h2nm3ggRb^;?
zlTXRb40bsMA2Pd2Ez|nb45)ZrgQQuYPB()6C16I~EGsCaDeI5-eM(zjV*DN<##D@T
z?mu@gjGv;BDD8lkfEE*PV>j<_c|jOONy^M*0mZ_@Zo2`tu;SDFQq*xqRt1ra$qbt(
zwLHu|y*E<$<P&5fPNP01iW;9(w6!>Tj_`}AeGlf_dM~QH^#?(IzV-^%!iuU_NHD1J
z$}>!i1=xjkxuRQcXN25Jca=cH9ixFg9A_9>8$tx+4lO%l*s}gQ-1^~he1Zho(ZHIY
zdDE|3s*hJZ4TdV=K`Z~+DqJug73_?%d<S`W<|GlIAb{4Y6!}{7J;~*{?047(a;=Y(
z?JEjT+D76BT*HS15QI*N^G^Qlx6;tH;~^Ina;@Rdo&<x@><gX3aI@SOe~*Xmn0U#h
zdtef<brrqqT88T~2)1UK^qAy~;(JPZ^`YWjeyMeXedDKS!Y4#-KU)}J`1GPrtYc|F
zp;JU+bH-pFvSL58_@=+7T75Z2xQn2JdL66Uq~&uR;LTkAwFN4jd8_F4b+z`j-h_PT
zMhh>=tQ<khJ12vtyh+t}%#g2B5_`NM<DV7mqQWa%zcf!DE<eQZ<cp%CnoSRFobl7N
zlX83oBB+fjUdOBUYQxzQ^X8cW-4jCL4`N;%4oNod73VQLh@>et;NmU0>BA>mg&fm@
zFI>3>i}M&9Q5aW0yqr(#i(k#za@&b82KnBhsFdZUU4($GAJ7MbECIJD<3^-K-Iu&<
zqZa!g>e?+mP-V>WY8=mDM+LH9Z=(<WQBJqmj}YT_iH0toid}`(D}~jiIEB^mOn|78
z84MWO0%|AA?WRVIBGNp?AD*p5A?ENH?6`lv0kZw0uZPl3ELj2S$`5W9y#!=hMyq$;
zai>N$A_SWzve2^KMfh%;q)KuxGMX>8?l)=xJA8(cVascWKhPTh7txs50Ja2Q<^CkP
zy$?n9R?8kW+!XKGnf|N<ZVn+EuuQI%T4k3J?%L;OZ!UaNizl&L!SkLtsIOS(BkpgT
z%0MhE&ZM)%=C`?MkBLnt9)_!A<Zr}w!7uSc7UgAci3`*IHSgWD_#DT-XAbcc%KT=g
z=;gMoN_7}t+o5SfM=I_dWqV?}<t=?#4~m+PU?_o*Qt*qEeJ7LD-#-xTsf#a@^Ay!O
zpA?$@uJqY9rLc+Mmj>qHYURI6lqp>-8Hk{3yh()*Mf8+v=p25>M(SCXSzY-97d<Bw
z5eN3^cVJ|$C8tklA1`J3RohsGM(Mma0kU~9y7X=Wkz3QjP^BrnBPPF}o3F3iTM?MH
z%rS1YkSinv6iY?rkP=KWh=dU;#sKgd|6py`Cu^$(hB@2^q3PvH4WE|3{@f(PDrfR9
z`h4LC1xvP!>dE_mH~g;gBr30$2Qcr-v?pY|hqjb6OeS<HU8d1^P4{Rom9^yt&x+|p
zM|Fe8QZ@@QaW1{)hu)x2jTk49HY=p`ZVx=-%~Q@eknNe04kFR8j_{x8-BW65gU{Mj
z+3f$}Wf4%t#QCH^)9>?h-t2g@B;n0EB{&XYH!Ls9c#$PS`8fv3pg)6=q85vt;@=Pi
ztwM<xz{(~#7Z(7#&yoR1QY^$=3|R?<2^GaT-ovIn9p(KRrC2jHMdul*iJCx%V-<Y1
zHT8ZK$+=C{fD3d+6dLCtsz1w3Q#V-2=~jR(HsaNVs^U?@>V>~uV@2c)T^K{#mf@<6
zwS@0*xIa|5yf1uc)5;`b9jVWGn2PP7s$$l7_%-b^+j*TQ67|wAQ?^h_Ld^Y>GP&Z+
z_B>`l0Z!_g{_OcgzQR>GhnQ`Z$sFx4sB5wZlX3N+lI-O|nfsFZ5*(aPJnmXNb_hD;
zJ9SEh$TRu4g(*2((_y8wP&^!>uUIvd;e+&R`i%6z35xaYszeyeSIYr0>QtdEEAG&i
zxz<UKxegOrP=FOvOpvSqY|FQWdyV<cE;PF=IV_!ZCqKRHKVFeX%zt2YWSftmi@Irk
zn+`_<q}R!!QrqMSdXn-$Qg}HF+gB}xOjqPUx!TVbxJ_W#6<@-<v1xid#q2tpCrhri
z!lMdX5WY4bqjH8ZmhdvR;;8Cq8aruI_g9=lAZZ{;J`neB<jvt$jw9z<PSd;LpO;P1
ziUf10oj|oo164UQS%l{Q2Sh--zkh|ZUD2!AG6_b>nlb|inBj!eXIIFeU53LMi_T~@
z0ADW*c_EoOw|&A&JGarP>|<pMSD=<>S~8x#oR#idNgLVC$~@ay(Y8<J{YCTcgrjpU
zDs`2W?_Pm|7k-Z824eB7Ka`_MB-?L`pc;>HY;CS6H5*@G&c>z8$vw=m@(omMDYsM}
z_$Dj-bPlR%j0!icM&6sxNHJ9D$1|DJw~IM~jjVF_Oq1g|aX^U6#x?6qP+%oJZBhhK
z{&}6X=G_SpY=4>8jdE3^zHnrB4Z(>7Ih})*QG6X7fgVy+b}`4CRq~*5&ipxw*K8ya
zn;WG~q~u;GDN9zq=5<!mw2#(zfR*goilU8YqF*5LV4D^hq9G>gHkl=gA0n@4{c$0N
zERMDxAa_A+R3V8)mFgA0MZrgd!W;~w*)6J<{LYBldBSmxUl~p$3hF<>!CsL{5=YV?
z7q`aQxW(3m<lH^*?1h$??B%iXyA&;`K(V#*A?e%Y{c$P#Xx(jNx@zH;^nI{pcj5Se
z*>-0DH4Xnn(La9*Toa1_>_g`C@vLUgUS!{EHDgDMn~!m9?Z++LHYAnvgji_}W-YLR
z?~2hpEy+BooUwq)xTRP}Y;`xb?Xw})kqE+loU>TO3`;~z;fbXTTJH>EuRnqFj(;#q
zqLqJxDAM@&wW?*<5^Q~75L2uk!1XxxAr|}Y?Zk-$LO7xY7lZM3pxwiinh)udn)|IS
zioN_@Fh9-Bprr_oeofrYY=x^4pSl&APvQ2A1+?HB&@V7K!W2-L4fdMi8S5|O*3qnd
z&r)nd0MkX8$(d#U<vLcS&IFbpkJ#K+ZA0qQ*gbwFdbtjwxOd$d&{x;}0Xt3;T#3MI
zT(<APDXmyN`gUNd9<E~gvB@7h0RI7;i>nQVRJ4Twb8LMBW4W0XKJ1Fj>H{2(^``fo
zNk!z(E0rP?k?YZb<1>NI8Fu9VE1jsO9dLAif~qI-Wj~6Z$X1HB{+!hi<yf_S3R0iV
zI!;uAF;0bxe@2Q_Gx<SSSt*?&>U`&#zm1Jr!--1o3<dQ+@kA&B@>X2Jau<Bk$D9nT
z=JQ#W!qu1K#DlPTTb+9$b1pZ=_v(<+db+|!HW62`*hsFBXL4+X_g%}z`n$u`Ogn}L
zDmU~@1#NfG8t|j&lR}XbRdQw{ep|>&TR&ix`d*YQOEaxMjwh9CylXU1WsaGz$$08U
zn~k+O?4N~7<-hJcNat1d#w{p#|3?^rV-CG+9U+w<YS)}>{NiDGaoO}dB)wb`jo5`v
z?Waz|Trk3lLMG{5R)%A4me&WIp3x8oN0}=KhsH6{NRYrLdiE(I?r~Xrr)2v_?|QDc
zt;ZgiG+WG`(KiPuDX3mM83i*;cGNVh%wCm+!p}yWxNK-%Un>-IJuHZeD38Ml34~zE
z-NR8RY`;S>xam*C<<8_I`dCgWDCJ4W;;F}L9kX$oTgE9bZ1zeeXA%De#%xU%Rw=BU
z)^k};5W)pNYu`8=Ur<EsAk=(Tj4Gik_#od*I$|b>o^v{@&`nN4AaRkjnGVIuz(P1(
zpGyVoF+KbSfKJOT-)9xuHnDQu!;1FoV6~rpW?T@9d6~^t6c}sTC|i0LznGZ%PYMwo
zyy)vfJccy^wTU^^Z7A(|!qD1tLwjG;bS4A^F04M}f;#5z$|0~wH~#4%cWDzjh`1{w
zUn!6g5W`gL!6K{^5i(wyjA4&lWBdqnX_oRwuY~h&{Uj?sCJ=1}6t?tHP<2PPNr*&P
z|J)yg3DW)kI4I>vNhov-r7hn<wFt9tAYLL(ld5IT=Gmy^yA6}wufbuaV*gWcxCnW7
zwZh@$>=gHMSw7aamsJP-DDkw(Fa$*(epiGfkjl<-5wJ@Ourc(UaQqv9V*w@t%h`XL
zQoiF^R_^z~;d>W#yC3aUxDWzjV~GMN-DGO%%@k3E&lgEiN!Dwj>?_Ap)^!MEXZEGO
zn`GciP35UcJ>|bujS0J#_VGA7mIyp-sWYZ~y;AV;ug&%tVx`I#2g^lX^m3h1KHZKJ
zAB;ZLXipH;YFcM-r5DMRx|&(hzL~OkdbD`u1cfl?S=U3Nz*aNRn#oO+Z6m#jHzL30
zv9zu*$0=`38OH5>{~#+KNB3{w?0G4CZ{*)G2PU%!6}O%yIoo2-CCFV>YjEZtr=n=b
zmCVuOhvR)G3LhCJ3A*amER?n`CuR4?$Xq)j92aQ-`WeImm>ivAsgj@F``giT4V|!?
zQ057cesH}q^1!pQeE6GxLg}vMaB!WKZ(fMv*N(TWOPI995!)+V^23f80zvl5HhWW6
z^$p8<e2_}&TUnNo{0FQ|??z$MM<miQ<lQ+hd>6$VUx7&TRlH-4QvCRh_-_C@$dz$i
zq`&hKW#vVAyN3KHC!zY;TIJ-RiqfE$Rr*y$1nR1IBIM0@A|r5`i$~96#Vcmffuu2K
z>jIQKEaRUj<)8l!rA>>)`bNQu&yfA63vleAPblUPm_gzM2b^b`?)4HO!j@dh?2qL*
z8|@O|FHYu-aDHTZ28Rf|-;H78JGX^p;Gx54(|ssf@i+XJ!wGJMBDCP4lu0!3J&#qw
zy?lP}Bm`R8;PW)YVz(l=ryK42I%N6qan*>;O@!*zVb4!P+yx_W{J_wF51xH3hN=4?
zg9C}hEH(Nn){+K4f5rD8v)n%}7MT`a^dg-Uj!zJt+*8ibHSc{~@yD{*v@xu`<we=f
zA^&#?iz%82&ErF2Za$JOuEKu<?3%1G_s+|y3-f?>KXmOh1g>0<j>)@}9_zU@{4N^(
z)w<eoIb7DR6CQaBi2ZH_236!i^=Vv58OBn7Tp-J>&J3^=h3TZEk1e-j&^5<{f(!+@
z662<YiI4Rn)fo+M!(Jq;zsOkU%&?})ZLUB^w>x62kA<vRw2NWav)%ZNWnlejdks;l
zw5YLQ*X@h>f|MfQ4)fijeb2;VSK0O0R!79iwEqU~^1mMX2DuL_DT=O*!6;&#YL*%z
zl%b{wrDD%WDfe==hhlXcClLxMM8-A#nvHIMA0?V!sSP|O5-Q`=;HfC#PoUJNqNHgq
zsy9T0i9K%YW(dNTI%9Y{YBeKeoCs7Uz_D(K%sB5{5%To=FIeQJILgs<Cy9l&9CW$9
zYl~9d^q26x`~)Xn!VYF^RFI=$VJNw=F-IlyM_~+=_liy)J5KAn&w4F<X*>$&{EoPR
zRup%<iqg5ilI2A+uTskQ{uSlKC6sRZJ>p-f#qkG*VQbS-;vUs!e+dq`2w96$5y>40
zhajm}n11{?;r|&J{^3Z)@yf%7qNFz-hoQ8rY%Mb);zcYhVbJgJPKhuV{14DivOA&N
zsS2z`k>1V91721e+>5-wW{`INa+GY`j4}~Jf;XXX(I*GL`*?!+KIg07NA_oxW|@K1
zL=dIg7pBTUTaovk@G#9-4|0w4$u1-|r@=<|lY;nojS02cv3d$}mkp14uW&|kJU;dK
z$ntq#1#5Wxa@JlXJR@1Dw+l|a1vNe+5ZWm9P38=?p}5-%r`CqdP+af-RDZvL={>yb
zCRW`TVFPYT9mctvkk|STqsa8q&YPVg^=7>R!v<```vZ&xTG#x2Va6n4gqUuzM)`<Y
zA_?oI#;v^z>kvxBgT6;Vq}=Y17Ar^aJ!CWOzLiz09Z_WhDoKt%^xu=ra(no_NAs?O
zzJE#R?Q2Bd$S5z+zW03*!uvAik>8cWd_R)Dewll};5}d1pNM;-vd%=xfFryVryoIo
z`o8m!b@aXWQ1u@Iq2e&_{KB>z9x)$OcF4UE;d9a4g}e`Lkv}p`E+OmwvC@sbmzy|L
z;_LrNG#&jOC|U3<%3WJnx$Z;R{sqWbI2n`n7NeZLmv(nCN7o)!`uRI@{0kS{#!7cB
zMJZQNv}=)4yyCwiE!zpsMoQ3e3fd7E`V9B^x>@G6E_C~EhT*ZukyLpq^}<Y{B;{|W
z7gjGYsb!wt*Sv{-8+Oi?-uuMg<bTGXbb2NtZO1X4$)vbOCiv*Zl73?X3YHC$_ZVP!
zvvtNl#J!dZ6FF<W8-O(pN5Zf*X8j@0HIB?>@hE(5SoDIPrl9nxB;&o)Biqj4d?<qy
zHL+3s6n)Cyk!~WMh|NZQ%$PA0y~xXaXWG;8D0<o~?+wV$P(c)k5pI_uYAos5inbA^
zB}BNMyq&Rd?5{m2%~t00coEtldOGOG(483=#i{*bb4P64am3c9Jkuu@JGWR%W=}-A
zj3~%^>kyfO%H4JJ&geCq&4-|DqsVNeN4+!WV+V$aI4GeiXsyUhNE^<MN?j(Nb8IVu
zW5E>Qq6qy2wRObng{XO^7$Lc<gy}l+Ua!IM1G&-fr1uo89f|bS!;BwhKSd0lqBdvr
zJMZ9BmQ3r^5p{3qy}66?k@aeJ#5FEWJ&WI|fuuAek{5_9L{6TAzL3KQBj@44M*n;3
z7wO9iq{2NCMC8jNUWmT<A@7P9IG1EZjCt?)@P@9*7+m+9T;~Vilb^QpRzZ7@`udo8
z-)!^K4B~e1fxyB6)FR4+n6z|WQuH1W<@YDceHmRIhU9TUFh3~@G=`Y?R>XX)VEbAx
zc*9O+iKCIVsVolrg;^5pDK2htQ@b?<iZ!S!t;fTw^nU`FM6{*rZbn5wNA~NZF;2v?
zAY@g#Vgt&3ovd8-!f~Jnj<>!O@mzTE)$ZS?)VfWXvl*|!$?a?+$<DL47aQef$kE~@
zr?IMTj&U>0MQvJ*lzN|LHQjrA+Z3Wc$~*teYPF5w*O~`H@#e=+x@T5YS=qCxa0GVA
z_zXsQZ?remcKnT%?TyGeXj0{)0_&8q!5KzbSkB3+_i7l~`VHfk+19e|RGBVr#9u;o
ztp+7D?3DtN?M0-KGxY~`-H)@1uI8xsiMq$@Vb4E<OX$rX%7nhbx!KGJo@vxyxV&EG
zQFJyN`iGEWsML2oMh0EsKA8>^6?<o6bjSSg7?|%JOVm%<-X9vjOzQ@bDM*AXbvBr}
zH>-?!5=ov#pTdWRykDtm{|y`M?FzNGx9*W@7pl9Bz-E(8Z^kkEvSpl<s@H}^jmsqW
zgCrJ+2oz<GO-1u+RC|_~Wxb(Z*(iM{Y8(D;l!wjv*hub0)pFBhbgwZ-lV>E#lwhTw
z<;&mWOypU;?;<u{3oGn<xij(Jof|RQ^|sk>V-B6`jWDkj+e`)hWTQ_N-M?gY`y#Rp
znbduacP`4?-Zty+6)Q5~P*&I-ZGv0yR*uwxlx|9jD$iMUksPmHm>m{J<vv@B%*V<Q
z$x$Xu&#;uNx;i4irZHC{<NO3c>Hf3OEH~Cs8Bb;7d|U<}Gde5VsZ{jbN^2m(>(t!a
zRj!THr{6`Dg~6DI+|Pc=s#^l#Vsp+ayY{2F@iDW^7(3xzD#jz{7E^TS98hrf1DG<u
z55}N+{&Hi(ibX=7<uksA0{=Ux(gP@4a5b_XFNu0GZ(|<H=KhHkDP640J0ImsZ<Q06
z_39}o+j);Ll|%lrf1~aRBk4oI$A6&(@qx(y$cmP{q7=M!y`WCmNj)=JS<5Eo2)a@F
z%9AqCJt0G-WX%I8?O4J}0xe2K*YhZEo+Kz~OU1@>Sy^By%C+?<3XYTS%-=B@h5S0^
z6t=1xuSHSgSfi2Dk2>Lq(6a>&y$5ytV>q6yMLy3}obNtMlxh=-)IAur>v1VMDw{Ko
zIXBH@PC^bvYd%2XYAMH4#x~rH!kwRxGAYQ)cE620!<j|Ny8Tu-J3d62s<UeMeB>|u
zp=dj+<g*Cj?xBOsMWU&>$oyagCUsp3hq@4Dgh)y{)+m$SeWZ6Rr@nj!%bE8P-S20m
zyXGmiK8diDGT+^-(nqrWKtQSXZ-R68)v`|`+uou6Z$*jM$Le}EqC}mFVIQZn+C6LF
z^tG@GwUt#;dBzn(QM&9$w4pXLho7k5&fTnP&uX#hl~V7mtYXt9(j^3#!?RH-Zk3#t
zlKR2@)c@5e^Y~e%wi>0M{8-4n*~q4qtirzs4$aGI_BW$oZV5_1oWLASyHFPNFsHYT
zm93I8TBWx6NtCwjr32MReJ1(s?04m2D_yk%#a$h!(0wd-b0>bm{|_VXFI1{p8&RQp
zS%v0SoCh{z{0GBOx~Pg(wC-X~5|uf%W>(p-QDjxJlzwy(D{J4*DuSJ)Kx<+ZElcG)
z9c%x=%H4ZV9`v#D_5&<`-5YXj9h+!;x*Aa$^bq&Zgvw8hL#(c;iaEEhLb*!o&ewv<
zu0@!<Ggc{Bd<Tu;dWdl;_f!9yAChga=dYu@dlMYK04hDJkl#8Q*>7dhnwle?XXV-f
zl=du;hepx9AEQzu0?1E$r*k_B7QSQbfsN0w@|G=Bw-@Cd>u8NUAj=C|ULpi5bU1z#
zbiRWzFV-Vc^iiYjM)AH7LNqh>Y@Z_i38u{mi=5IQ8>7_hpDsj+O3B7&l<Y^PsKS!}
z+0`hT{kqJ(S~PnmiuPV9$1L;y+o>J%;iNGrnsu)<6C^~d6n6ZQIo-{)?x=4YelEGd
zL*WkLX<W6V)QnIV=5B@FEMx1?XpWcKT{2^|!5tk|q;o>Si6%nnE7xKs%V)>FGZ$m^
zgnB7fkT4C{c+vCF-@F^C!5!E%{&DQTdP@`=ADftj!4rNA9<*|9Ar^Y%Wxz~^p;N}O
z!P%EWb9*tQ{v>ovGN_@<aYe8WE{Ez4@}!YYJ-AJUbq+^6QRjScJQu`A(zz#Lcwszz
zDGE=l7zfLsTyEiZJu%UNz)C9ywGPr#%4TwAsUmhPlO+W|!Q@?bme}=c#NzMV*VByH
zvcF<b!XM3kaClp-pgqkPQMmp!3_hD1d=umL+(Pu|$w)#1^QIJG`3@cGFzQN77D>`M
zY{QZf7b6$0-lD}IK5ZBimWV8Q5G=!n%IfWt20=^7B8ig@-8KY)4SuL`3~5b?PzMvs
z=vU$M(wGGp_PPBC91vMV!K{ff*grTd&Tx;iBBsj9pc0EYj6UYb5VX3jr4>Qd#Vm@#
zeS|3aUgA<_0-mNuaJ3DJ-HL!`4}AOgATh;9<1$ysk)X47rXE-VZKM}!U=8Ej<`E<A
zg`VI6YuS$F;5y&&84$OHD>e&y+WoqBn~ZnE2HRF~t!X!uI2-4?wj&taia9em4`}al
zsCyaR&3NJ?;O$-T3~A(+<WHDI4{}Z4%l(Zq{Hbm~Fdy7Ek5GpVR`<W4@ux&NPh!te
z(Hf>|0Uo!17B&)<r^R%^()<CfM&ghZH)4C{VmsUj>}X<E^&?sr8q?JsG;l9rjoYu;
zE!&wrj{3&pSWL_YZtr?RzSA>gHfLRnnWEUa7S~Sm{eeUj>Rv+RJ?mki;kDV`K*tIr
z9!m3TZOrc31fBb!TLKDSw-a-g26cPqE-2nsq6;jXcQ!(6l$;^+wl;w}O6_0>?%oUS
z30ft?d|(Z<o@^>dkSSWnUId`R{Z=FNJzE&F>Wq0>VcQ{NeOs)`e6Dq^q%p9=yQPU<
zvrV=oX6`;(WKHx%K~gXkyHX6%P3dE2qP!~zubKwS@GDrouS1%{)-`QoJnKE)<7vja
zv)!oNceA`deP}61>W`V`^6~i6(|E?z^X0fReK=yuN*DqfYz_zFyCrAAhyC~hSP~rI
z0Xs`N_dD>$rz2rhEKg6lnrqe=D69g5N`4M&Y|<ey%C_MxSW~cBib)JG@W<M;O*p?u
z1T_nZ8||{)TP`9Ft3D)RinLZ@`0on-_ccM@k_@G~={b@sn#d!hb^k*a%3moy=)~*=
z9u-R)k=}+??gmt<512ngIrT^!Kx^8u+hP7TSo8ALV_CWIaO*YvH`u@PwO^yWbwjvK
zA<@c`hcMc`Gu#gI0IAyh9x8f1HSafAO_4EMWZD@P3dAo(B4%9ft-oPq+ZrS4H(0$1
z+FGSVeKNZ3f<52kN7ZUGK>-Xlym0<7DQ?JqB_tLySl^6=d6M1kmAjgvf|A+OS=mNY
z{1XubOt8;6FH8yF8y2C+crL{sOo|#a$Ky^Z&M<TY=w;Cz%dcS7fd~<bxfyD`FC%B`
zo8hrB-#dwSpm3HMa4O8cG7%5^dwh)f(_pvrX6La}LvfxZ7@zrF*Rs)kPw3I!SJ!(R
zF(z=m`OY}Aj#z1Gnr(`pLV=<jBq|u|+t#<;tZwJ4Y)sG0@OT+(jn(w5M#ajTjPeMN
z$kE)RRP6k*@xy$F5M#*{U-#EWwWZd5K1OzTM7%RBLMdFckQJ+;_nIP<>4}ovFA0eo
z#>sk=(%sjiPK$^tXpV1X=f@~+{U}_wIY6Q<SudO1pqZ1ke#RhaFfeX!NQ`KdXV0o)
z6C*_^G%nfehM=nFV&ZVRP<-Gq;$jUhxRj4n%3A&gr>?=V`db(_w;*bbl}DPXo?+CV
zd3C&u2h=;Krf8+ocQxH_%A~`4L#b-nrc}2*+S``HDKo=hTA=)^OetKq9*DGPBglI2
zH^^NUVctuSvt}@>ZEqpjd|s&O7=S~8iTFxf)e;GnKQ=rp3xq(dw_=QL%Alo!&l0UP
z>x;l6K65`Fhhcy0ld*^7cW3gmr1CIQ(=Oz=Q+phJ+^wmO4Z}&{Q{LwQVaVQ`CDT0h
zo!GqPXQJTKv!mKFl;ocUJAZ{Kv-)}hQvEH%QNqg*W%WVdt9cfcry<G;fIf@3Bb=ks
zEEBTEQ~7xjxhu_}UW7C%))q#XU>eu5x>HHKG+g#|nrW6Plx%r{8r1iVy<t96^+CSD
zu11uLjb1gc^q~3$f;>~`E28SLAe-)=Ae2&(_tRVsnmZWT3*yk%Mtj6lnKGzT*jmH5
zziQjC=zB$M8A5O}nM0qXxI&(5D9$WV@BAK(Rdl<JF)(6}Sfhvq(eK_^*k-vH^YaeG
zn`W%xy2W@Ftr$vj;mC0`K84JETCW+bx$daWvezPlQ$>v9NuLil^P*aM=TxlUiibuR
z_4M|iNo8dfAB)JKZsJemgq-;H;6CffLVAG`sSu8yXBt~lnojRi2e#5WlDRLHNJJ_p
zq>ArU9G{q$8|FM^e>w&ug)ZU#nBMn=o*U24F_ixieHCMQia4nIth=h7VYK(g9JIeh
z>a?`ahewxxAuvo{mS%A*xKw7qDrhd2`&x|Q(CHbheD7>l-n9@JzaA>bckrJFA^VZZ
z5II7N*3o``Y!FT`1bzas1Q%&+l4moEjakV%-Cf|9??d&bnbKpiKKKrl;;UGvKbbb$
zhbUb++=y3vk%qd>dr-5Hs5WNC*A@_o#4l2ima+`Zw-WmoX&d~Rj!rDVg!%}D4~ZpW
zU-u_0U)+W{ktSQD<&J&J1^(U+^tCTeCy_`#wg5cZ*+}_l5ftAi=%p}eQMXL<K*@Uq
zL(XrF-lzn@m>^;v5pkBIL3xUvf5~izdH*zOn|fzE5Q^+-)|GT8N5eZisaWmpkNDfR
zgoEw0Va}b=mKm1Mb@V){U_I4s(s!6MnImpy2lmA<^ZC#)7<DllA*4CcZERUf^~McG
z&*Kq`o9PG+NkikpqUd^{!}5Lxx|mQLYT>#s(lIoH4xSBh=KZX9+=l(20uCffi;qy-
zolXmat0K~j$#K+BGIKCmEJOuPi;VxQ!f$cHcOU`1mLlSvB!*k~atU=uk81admSkiO
zDh;<!maF!df0Q6;rBJ*D5fbs82hG0pl|1;Cry$Y_WhQ;sw&f$MBsrr0)b2ZNHh*3Y
zT<=+<+R}7o47ejLd~bwh$&U8|*f%pqG&c;BY5o4hZO&VG+*8&B&~Rrf`idj1iiS;1
zYM*kFs?4S~+<+*UJcq<OmSkFsN>tm^->^bonH2TBfTE%pzJ}%N8>T#9D6r)`S+MVv
zC0NFi;Jh|uJ!AHl#F&1}#*UF);e9}tm(zG}zGnMDZTI}93kh!s@tG1H7p7oDdK*%P
zw?~x=d3)`i%;^0XZZC6}&(`&EFY-W750cWhAb#_6n9~x+ihtX{ZRx~&##XVcyGVbs
zB>|b&{hFozXf|9e-H3I*hv8Sh0~{w$>HkW|f4&-pb8aRD8@CiLz5p3Qp&&wPu6P3F
zjijIwF)miVh0=MM7_li6d9R#F)NePO{+Y=9%jsbSr)jDbg7W>_Q2g12#*dIK>I{oA
zk`#)=U(Gdso9tTM+HzJG44ZOIHCfhC{BIb`-!t!Jy$hu1lRH>VV6OQlhS1`xYTZn%
z?7c>@Nr6;6Jwmd*y&1A4t7uvYd~zdmxI-e8FqJft6is8*ht2Y^^+2u5gDJsNj9=4C
zE0ot#r6^-qZ>$f4H7%W$DMcT>Rw#yDu2R);FR|_W!|ycf7HxFSF)dA`C?hQ95cL<o
zRvuM<@!REWbR_F*zNcd0kBB9XI3Nux6s5}lB5L_!voO5TCb)N4O59f&Kf(!$Sp|u-
z#sy3(lt$y7wNK_sHoq54@kc@DpOrdqi&@r-2uPXMf#MG@F@8-o+9#|b#zl!?j5?g#
zE~YVv6lci(TWW%@qdE{N7BeCp)~UOQbG*wapAi;MjN+Q5=yStTDD!}^zKBwn@2p;s
zW!`3rvq;GsogytPiW%AP4k>LvG~a7l=aBeKSpI}_Wg6v<<{z+;!H5)j<~pr(e}L*H
z)7&<~Qbw$c(rqCt6k}}1+@CDx)44t|s=VZ_vq>xznOr11cR8zGM&W0thN_kSX1tWg
zN<RNA%q4`zS$aI`NO>>M_?>N9=<pOKLc&hwA@Qj(Pjz$8Vq^4{h`MF{N?F@xWlY=c
zQT?yshBJ<1!H|Q-QS7y;#6?VM`!+-f+^R-WM7Jc#_(a56u^j&_jM0`GCdYy+6^Fq~
znWT*77$GB@G8~iaSpQ#u$#&)awT6(KW~4?EV4D3o_}^(0ZtcCjs`DmPkP_12CE1%d
zh_PBL`m)|RPZcPIb8ZqEY*yiW)iU&{D<!*Jvic;&vFDGhjO23_-LEM*?;56Fr|iGU
zQql1?%Jm?tZlHtWzHdmj&e8S{ID@NMd9Ya-@!7v|0Z&EI{V__#rbno3Ez0yxl<j^6
zWes`Axu-y>?Rk-v2VAUD+l+iJP1ltCPkzSAcF#j4)$M5egf_!3<U32BN@9*Zb6IJ}
zW;nDirEJ?;<UWy)+~>-b@>Of$>~W*GrHK_U|4jC;;Qn)1*{&5NTlBHK9h;S`cV3qD
z=RJKh%37B|$O_B%E=BIWM*aCu-pxw(E@TesYyQFyl{2>AAU3t)*#82`yi4i+R+Ml5
z7@5DyQ7ZTR6wWQL$`orQEsIdKb9(PsPVV?7iq>zY_Xe4>bAwX;$rDEV-+2fnZF}IL
zF)nS}h~h=p3q;MFE0&>@4hLZoQnqe4N_U-tj1@x_$M%iP>EDk^t%Kz6dy#)tI>vRJ
zEM@VIV7D@gx3Jo6TLe;73R`~3oQw9MLiaOgpp%VJrS~c;x#vAr+`1c1&CN15?M2?7
zuaTQ8cinpC@b<u=x3h}9D^dJ#0rEZ_!<=0ksD16Mta}S9Sv60NSLwPJS!MeUk#-NI
zn_E!ux?#ytx`M{g(})V*!^&1P;*`y2BmKr<Y;;cxL;~N+po`Ua?LpSFskBZ@SZRA3
z9lSnjOBW&L^#ZY43g>;BIrkkvc`(4r)kap^VjTQM>;BBjNhw%HO5ZwlJ9EDCs(feJ
z&NZl_!@ET9Mm>EN&NmQY!Mq$A$2SRq>?Ij<3mdWEbzy~q{8`gb>UmjYibrw#ELx+I
zHdiXU|Be#RLRLn~;IfT#ko#60iARQ@Z2$WxR}Zi<|6ZEwMRITDet0%3Z(K<I_n>I=
zc4R#<(^#jA?q;RiHlUKq^A>JF)p{B5Nhy5(C6tizw2X)-N5eLx|H9Cb2+@(S^{-G{
zQQ7{0NDn9H!pSpGxbHHELssmIJQFGBzA;{@?6{ror**pTLlo?mdrv8L-Hf8$FVK5+
zR<QeXl<mAktaqhy$@8paAL$r0H=GT#kn?r{%3mFBsrJ7>d#{Z-eVb6d;Yo3?rCPlR
zHQI|P^XaJe{F~;nZ;&tJV98%Knw=8d9JWO_515>uYiKOY1HnA}McT$O`a<M?l8X}%
zP9PD=bR+1~uA5e4-b_1ooG$D>nVF`EKKK2RH*6Bh7Q-ESP0HO^mk`I4*m$Jdr(=;N
z4SnTP@#og)LnhuV>=|f|rs(-s+$qZkHBHu8=Jz>MRU&9AFgUYb6tfoXB%Q?;5f@FA
zU2K-cm6nW3qB8W3YU0omiC#+}&3P5tJ}35nbPTtr6p<=4nWQ(2B_$6+FrGvwW9?jt
zsi2<3aJ4Id!5xN;@u1Q{JT@@~I=wO`$)?1QF(^}alFAc@uIKh-4wa~q#5~f15Ah-G
zn;gmcq-crbEIz574XQMf3EL_<F?h&!r~xaIa^3on3L`z3Hmw^mi9Jw*7O<pdq)j%m
z?8H?Cd2DPfxXLhS^ib>|D$}{a!joc$lLkMYBm;g}GJ5D5L*g(S0x3hNA$G*XCBni}
zd&knB(t+6YwW6;GCidv@B?n}A(%H*_&iOPg@tn8MfY!EM7};}0e-paCk;aX7aOw<H
z<aR<?>PBMRYdo;Oo9S8)vs#}5zuS+tr<%Am;Z@kI3U6;(%evOSh~@Q~o}zAI81tTx
zUeIVRW<5R9)K6jVR~YtvOfweG2U}i&mSHGjhi!WvI$sA1y)>}n5%@0mL2qc`eElrq
zxE1*Kucq(Pre3#MXK}4TP_^+22EAd?9g>S;spW4Xp?Mv(&(5qV|3+cSKKN>byyNpf
zFiqRTz?+$8<pYQ-4I=5iMsDrAmn!o!wWpEyEPoKo8#FC(@D^?v@*-1om23J3ylcO4
z*jbj&;k@fPSS<;>+xs35c1gs}Ej|B2FtCiq)`spm4?-<9Qlwd$6KEL@<4}?r(}GAJ
znu1-TkwX#@gB-DzV6~Q`d#?;Q#$&sSV2c?>a~(unehVxv1-{YL&LltMjMfDaF9`)(
z5oguF(%d{QwSlPt8ru<#NdG^XOj%ckuY;bnf$E4wZ0>IOGNqhOPn@^~%)gQrS}d%o
zJ7Lc@Y^!^UifPmBr{=}5;Gmzdf<YwGxRbG1|7Ij)J<EJut%ynAiA>$F!5=ocn)b$b
zp=vs;!!i_CbCE1pT1ye5JE3bDw<je)vE*Yi6dpIYfZH;XnHsdxtQI0Rg*cabXf|aS
ztt<;PYa(I?Wyt;~s3Vx>Eg><V#)1|H6eYh8k`Wx61v_h&@Y%Lf5-o-u=>$i$C+RV4
zEB#%V)1~^`zvJSIm2ucPcP|F4P@;ex{Qa<T9oV72bE{In^G_JHZM^wAQkfBE@2Z<S
zl#&lkD-?5b#x005(uTQ=XnW}<n^?7ZiXxP#dC!<Eyvedwv_1uge}BY#3^7E-*5`>5
z+Y`|?!!ltMQ81%jX7D6a9FV=PNG8>-Tr)Uax2aLDaXpQb^?hb}*uue~H7Y;k_Za2j
zq{vFWred7;GUJ!Yo|kM+lMXdm8%@N!+UQgI;(SsLaiq=5jH;)``z)*SM2k>rR;I{|
zE5#qygvTo^c7kC4$F-VHK4xrcp};&zifEFf#w_c(-?Ec}k<LkmC}MQ$2g;bP4dK3;
zeHzJqILULfS#FG3DNmBlNh5boHp`8^4!^ftWP=gxeq^7N+)cMBPIo9rWO%KN>Fl9#
zxYGDx#y5AYE0TRZgB#8;rVF?-)_<!~AN2M<Yl;9Yg$I_hI`^C5@iOK}8M%L#;@I?@
zd3RVmF`9cUrHiM9$C04$kzwp)F;<_LPAsN)&FQ_I%G(i!u+vuA)>W*^|B6|UQ7))Q
zDHdC1)?=>Ml6}8Kb<h*8#vEVa$Wyjwo>^wLk;o6RUL4%CI5Owc;VY8jsqgU6e418H
zZ=Nc}Hem>h6N-qsFYSKR$ao{-(NKHx-@FL5x-LV#ij;!A7Bn;LhV{#QV~w594Y_*i
z-YjwUV~R;Qm`+Pdb;F;-Y5xQm+`3Y&?N@5N&l_c?*sij3uoMA?DE|K(&&23M$(w1c
zW-G_2^%-WLO_5wn2}bQF`M<fBj!i_x|4LxAIWrB5iHMCREC9;hsO%G6En?6j%cn<M
zARJB;UG(YssMr{R<OPtjrF8!UnO!8ZJnO+!l-zfAw50_><wupMeC0Ir-mrzr&}TA`
zKR*|JssE}?rAXQr8SRY8O_npaUiR@IYnB;9Q1wJMqOAuk()4gbOA?|q^VIK>x3Z*_
zN2H~UkTI9@+&&q_nOxjyPfW(tKAE|PttpTqt4IrpF|=vN@~cR0o`i$6`+_xIpJTi?
zvR~AmqMo7AF_(qq1C6aiW`Ji=b5`Fz$h1NUTO|n5R_#-n#z7i21~%kAKisfF=?w*7
z9H65=PL1v-QAnIV9eal$idqus%3d9ABIt;A(>P7;NQt&MGTS}*UujY8m}bs}9K)!%
zD2l9CTA?61c1jJ^ZCIy7%pJ*rg{Pr$D6rmp#qTPKB$TM}7La@21;|-?I>Kwuu%Ib<
zYqXIWCt?iJ?;eKSKb;ye55`~lA969`flTzZHc1I(fkL>AV(n+$9I`?QkGU|ntniG$
zp)4_+^B%P1-}$|88ws-iT8zp)@0rLuyvD>B)IK_n_Caja*pJyt9PiJ+LvrfmsQza@
zmt!e;d1{~a$S`7c1s!BVquWE{;RuW|`}F0Ygn!do(tMY2>{A?c08ZRxh+e8Yu0Yw^
zyX2u#IPV(dyx_n9L@dzy&Mu|&fN7iiZkRF_RGu_fl3*b0iso;#iLQ?iSx*?)A<FuO
zqCE_SZz9Hn$~cS8nb#Z6R*~Pu0+bOCr$-}<yihu_-ge4dd=VQu+FUSlQ$>|W)M>oG
zPdg9QpQt(&M4P6CsQbu1*(0tQ_fC&;Vu%=%Lw-LLu>btM&mk5rR}Ni%xOYYzVB%Rr
zDH*N266T^ppD~SF4&UC$aqDe|5<P~YdynM%A^Q?}&lf!xnddX^FmoD4jNyCjhh9gA
z9a|hcA5r&x(LC4>@!rGuXhe*!n2TwVrjb$YP{M06vhBTaxcR`BD369}J{whCZsI(8
zSh=r-6#IsPy?!g{0CYDi>uf_!pc^%NAH)C<WIt93=gOI+(DSfLl9M{u{S(p_`jsEB
z8vX$(tw>SU_%TX$UM=r0`S>I_I-Y~W)r!2QuOQ@@hp!#X6TalBYUOlNx=xNxGo_3p
zrAy`3ljRSS6|`3FJsEX@$e0e6FWyK;3kPjLk|@4<rL?E+y)N3d-f1bm{gS9hzw>Ug
zl6?PfrLye53*?5j)wKOksrPO&iXu6vroGns&378*)Bj6knMT_!Y5zDE)vumnmYHpz
zZdEFYDwH<w;d_yL+c?GX@Q<SFI3z+o#Jm2}-xomEAI2i{Z)s8Y51o;L;lHf!yB6X2
z^%ztvN|)TyLBz~)2jlQ5do5KFgkx<;%xEOYwiVu2AMLy}V1+`6qrt)I_swP^-h|V)
z6D8Z8ljV6Y{+QKt&4Yuq>t)^#FmCCU!rB9))Gk)72kC?iVr+n0D*4qo5n#glldMkP
zy{HOsTRs1g@OX?J>&;X0_us^-wSZFE{iLO~%RrFXJFm7?HogF-7E~%5Z$QPSW1Q(m
zZiui+n~?VxerlMDg@Oy!x^H8ZUGAvIGTTN-Q^8Qcr$dGSJrRMlbT#}Nw(91WSe3io
zHj4ik)tj?WwZGJw^X|>4;T~3_f20%>$2XP#7vw;UIAp5)JDF1tnGqTk>A1ay4yRzd
z8UH8b8QlF>=JfY5f&7w4_{foW*t4?E?S^yDPt1CZwNtBpkCpqq;kwOxh2CLGz_{1R
z?Kr&d>v)0SYVFFn%|Gqcg@r)qlg9GteIi!=PeXWNj@P=B5qo}b{4h>D)PFQc#t=Sz
zmT?j~LvG)z??Scei3rU9wNp{7%KIs+bh~N8_)+O~V|>RiP&9WkYW+PZ_jy^B*1|@)
zW{Z23u^nqr5$vG@%g<^9T}s);TW}mesoHfbs<d`EJYG0`9#*tfnqsoi-7VA>AGIk+
zh@c0l&y=yT?Tc8Ax1HJ^U=@DiAP(Gv{}vDj&KaF;H0Bx|o?RFh+>eq^M&r~u=doJ9
zn^k(LPj0tT-_;)0dz|1<I;)BhqlY<zeo}J!nX|=%F>TpO-oigqpW0CB_M#%t!$ymc
z4bv>jm|zzv+Ivvy_n<c5M(H~j85JD~b$f)=ci~NEp{ipib5I-0{Ck;WsZ^9Q=braT
zIl7m0G9DD~+==YlDv`D66jW^8jdINohuVVT#>IW)>|Yls((`u0rle?bk?=fjOpprM
zC^71E#SHPR;LD0>juCtvNYM1gB1F9Yu{^!J<Ijcz&Mu!EyyYD(bUs^z_Qn?ZdwnQo
z_S#Qi`|N(q6fv5mr<abe73yt#P28zmTQHHO+U>}mJp>B|--B%@&B4l;BuipUtVKQW
zJ-#&Y6p^Y-Uo^N1zHR5SxEMQMX&<C-DyM!Qdv;9s*<Xd~y$(uTEWE+zc=qn!igMol
z`K_E;7t#_4@YXH2AcecRcg?T4&-Vhe*ljG(eLK28nu-4wm;)6brli_pq(hAd3vF50
za_UliI{7WWGA4mpm7oQ#+x6vxhG6;dz}Jj0z8rMzZs36hw{sS3XDoID4=%b1u5MM2
zQ9k7U<_DNHCKi777v8$;DcVCiYv1=HXx4X_!aUHl^Wfe*KU^96k{*OIrv4%R4g=n^
zUC?X`py(=NtewXUlbizA+$+HKW~OKy+V0l~qkE7X-vTxG7OaW|?v{0knfJN$0{(hI
zAZA_3I`4W#%h=KDaV$9+rbA1-jk!-<Zg_r&I1a);yy^h*&zoS}`@d?LQnl_|NL^)m
zq=n?Nq!6sya8)1edL*Jdu~-@Bk_@Hv#oNMOpaN!Fm9h_RLD?gD#&1(@S^iG0rR<GM
zk0bIh-YaDAQ@D<tS<xbt@-2Ts`GJP0Cq~a3X{lGa5er4Y^#2+Wiu@S&<Y-IL^H+t-
z%<}vvz7;dNSKRP*Q+!_r!k)2p2bQyuZ4q9;Fyf>OnQbU|RDH;-b?0<8(i3)gJErpf
zFjdM%9`GUW`CplBG~>Z<yN;E&v`4jDd<vQJxF*vSb++~Eor@V3Yxzg_FvrftAkmXj
z{>ERCIpcJJhm@j!K8dQP<s=2zuaqx(2t{`!qwJIM$p7>);x4>O+13|P^5zZr9|I+{
zs90?<sFWNq2f)-+7wyZI(dR0bj4)hUBN5|?1~a4<-8qei0vQ?Xpx8`2^6)V~r-v*g
z_;KzNjiXSqO7T-~xB;sy6Nvh1Go6}fw`ilVfu9_975^^*W}5h!z#{@QO^qy%`7c4>
zkZlwq#A$oujKmMUhpA}0;TAqEV%-UZDopmI3GB4vNEM237tiGwqNxb0l2V=|O(~--
zt1L*|I@DD9fBoyrx!$gv%2%*jbuWpjJjy8F4xHQc9bp>E&hRfog=ag76MNV=?=I?J
z8YTp;WMh5%QR;D#XmUSBH!j8h960v;05w6K<aHgaiu+halc97eo--3wUXC(PH_9|0
z94kM<i3`SNs-9JA9moBKEH4a}de2^K-TNmQzYOZgTC;SrQn@c+AW{J{j@Kq**1ElC
z(dG`twlI)a&JrgI9yOgfLWj?DIhKlf7e?K8;zMsc<0tYT#EcPf#QT8b#W&&#516ji
zUskDiA^^29<xjP!_Z9ZJz$}i9mm1L<BOqgT9;!b-6a5BXW{l{be4Z=qxFhYlvlnC`
zXPqN@yos1NjpvxAo+rZi8}WJS_#M{KdRU<!;%MqUH<Dh+%vu$p$gEd2<SaD(LcTsO
z_3JqSJKuW~Y|m(>D;Dls@(|~{Cd+c3au?i9H_G7bmhK<HxAZqSaY2o7zHz1!D7=hR
zt5(a5kH3$ag?Vv>Z;Y_iuKqu+#-%|U^UWB?J!gqXiI%Dl&f|LVw{>J$2Q^gQls86X
z<he-0v4zmW;%a>Md$8nG7(XvE7Gh%g580p}ylRx0IY#{zr|EGMOs_v75BzTsp%{4{
zlcsd12DQDT0=^LrR6ab|Ic>dNh~hGd%V4%kPF7O~osw4imxyS3Usf*swLmCJA7{fZ
zdkMA})2r8<Q|Ee{mQeO0lG3w{VpA+OY}7P{>NgIq=V;*z$H>~-#=$*X(W0J<=`0*!
zF}dJpEP2RmvkoHx#I!pY^I|tVUBXB~lz-hKQMm{8u6-{8`!4J~XqFohJ$1I_6Q$?F
z>x^6L%|Kqn-MC*p8~z3}9O!fv|3eTqCmJ2tgF?@@&7a0%5L#cEFK>2eVV<xG0_)ho
zN0xe>wEkT#+jy<RHnR15F=g}5u#D3^aP;`uDBc!3nlBUg+Q;#YmU_*tRCrx6<9Q1z
zSN#dc0hF4ypQF;h8fAeX%DTFhij~iba#rK|2vz=FtU{yqH||01gLSNG<EPBwZ9}=L
zGRNK)lr^0g=9*sy>X!|&oI-M|8jV|O0v^j0&aI9Qr`X4?z0h)+C=Ym0t#jK{&eN;<
zn2MdKQ1pg_IXd>jp?V=4Ov-kx6$)|W9QZjaZ92f5K^H4+ZDy7HT^T^EreiNF^ERN=
z-$iS00rHoY;uwRa=)-9w3SGjSUO#I2M%ussl2rCsYEyA=3(EBlCQ_scv0TZ{t7Av&
zi%_9!%(-v2)%p5uI58m7i6~OsV>l%l(Fr5{A`ayxZaGBRF^A(pfk$>mAZhbNciQ<9
zdk(h8|JzK0t4h{uO}ZEJnHAe6?>CY6*KBQa7$6o)U1UGq5^Nra!O0211(w0VWogg*
zFCPD~wor*z;^S?~-nHNJEny>Z5048hWaXBweb?x5HoJcT8;Z3xzdjx|*1C7cKCre`
zB3BmR{!mw$v`pZ!!S|r^t(<E?#Kt`X{rpBAw7$g^{~F>abdJu4U`twy6B;5|^MZO;
zT<0^xY&`I^t}5Qa37eDEfI2VGvE!pSPg6RB)fXG@`qSXOpJX)s7QX)q@kvKs7qj!{
z!2|7J_D-PfRU{!m9O^P|)1Id75l=hjRc_fp)Z+}!0xkD(rYvK`@o|6CJ79%g9AnTl
z59hqg%?Z~j{w@!-H2~Z}P2Inn*>pc+x|hckDoCDcLCQLxuV=qYQ3wTC;)m#oV^0+B
zE;1f`WDNL#)!A?t{`FlV!dT>*31Y(jP00FGWE9d&QK*LO4~tQ|YbE{etpNW&fKt`;
z5DGr}Kl5j}Q`PGpL+&Sa#t&15T=>B-=4ki~)iXlzl20&2nu#z%_N#f*GptqH{??ng
z)hxG`Ec}~o)Z<1>?U4I+*?sjf70Z5kP+d3zyW1m!@CG@BYbfk0GJhEqM1l5mR;})j
zdZH{ijud8*qMZ|v13LVe#a-aPnANtu6TZ)cs`j}_7rMSLzfbS$PJTkl!^2i6MS(dO
z8#J*(ghkePnkUCcwNd5SyRXJ*Ped@QV~Rw=fxE`IU8q&RWwu4WQ>oBi!YI!wv&>j?
zq`YLOiHuvJw0}n;LOG6eM(vC#f2-J1?f*9%`Ysf{Rw0$c^~;7^avzuqXE2Du^*18t
zl>$Qt@JTL8HeL>q5-xv7wFsSz|8ii`6fkpoJgNgOrEJ%OMo=43ezmlAU{wJxoSnDG
z4K<w>;JAC@P`0sNrZ94>sx=}4o~UlmG-)&Xq_gV%j3^iV;(hNuRG+@oqCCn4D^ggk
z9@Zzo4=I^=97?9AA#818%-I+bhvvV*-MsHu^+}@^hHzhIN5;cBVUc$vC~(eB3<tX6
zVVCrY4-XDIwwVe-5g;o5`QbROgb%$tcXd9}KZp!W$E0h0)*aagDKSORw)+0?Y&@EI
z`;znR;6vCHk$5AZDo(Fg5z!NiA1YTWg1>=?f?3+yCh^oL5)(l<>hWEyjt5y$dzbJu
zRmz0-=COxkyKoEnH7p&E@-9z+DRFiTX5jleQjpm7O~mB=6Fq7->`F2QD>^=-lXwE3
zhb}e_!LD`|J7@^_#^rpCV<e6(h=s08IoBLgI+vU)6d0(l2OeKeUqD}calPZ@bgW10
z-~uiJh|izDgRPG(h*0t@m(Pi3>g6x`lXaL-PuG{zHM&Wb(zWHG8;u*_EZD&&3>J0P
z%V(FH^`c;~j+xT2?r0RB0-1#rEe5+6{)CaC=kZ{lXGEX-Q^{wgG1et}O)zc!OxDt}
zL5^!r$pN-}`PIfa$2zziM=DQB>M`H{SvZMX&u}IN+1as!g+jya*ipd4qx`u1x4xe0
zTmHEGTyBmfLK90LVx0Z1MkdI>J&757{f-W9OoR~oi#alCl=IvX$JWc>x9fpe<33TZ
zxYj}K5SP|d8<6xi$53kj%!^ECkbW7z$ayfoO9Uj8g65nFlfjvN=2Rp?SsujkfkU)0
z^8L~-Jk%D&5L1XgFmdk}iAcr4#4-8K-h+AaWMIx)2iVm#kB@I@FyDD{=qj!*S<bd>
zp?R2mGUm()J@uLVx1QFS*qNcVvRrJwu6hOA?xeO&N1wLHepnpdr!<Rl8rH_-O2TZ~
zOkh(mS+QT*u6L|D2RmwneZCF#*Kl-PbuvpH^$}O!%s{!n6*D(*gwp^X6F9aqDDU=n
zEgfsl&@AW9;A+oD*#63`*q`J==EpOUe#;!ja#r)so<E`U$rmu~mkf)Z`4)yx%|!R`
zr99AD4}Z*dgF0l#au9S(-k7H>DO;zzd%UOCd#s>2{l+MUPwvj+JGyiWQ>YCz6?%(~
zi%&b5Z*O4yvh!#GxU!kjNCLe$T4}T-weArpNay(Gctvg_+ZvrOUp9iXB$7(%ba<`&
zCOY#p{NQFA3%&|odwwpK6FyUtxnzKun-2NHY~`G@EZE=C%(^miwB;XK6(v5GVSC&G
z8iX<&85o;sI@c|8Jae@zw_S$=_mGTE9$FfPKQ~fID!EbLGWOy_Jlo$E8tSm6zgpZ9
z^yV>o`^uEFl@}iS2K(2CIxEf5l;uk-3d`=IfokCh<mibN;5UDt@y}K<t|<;a=Sc=-
zkfI<_SNLjOsXHe}nM89mVyKS0o+cJ&tzBoaUJm7MuDfh(L|Qlh?mc($<~H5hwW5Wu
zh{<9|%mG^`-0pOwCS~I1KeZ~YT^ye*<NC%HT4O2S(z#EwAlSr)49>(A=i7O=n|AFQ
z&9c6cuuc3_>V{2c>g5=e<iWSUuVUVsTvpJ?`TCtYXZ9a!aK&2&PhC{e{@&Pq=pW#H
zzBALRBgjfVe22F;{Q|AuGxJ5#oDT7fV}lpn!MC4!mibJ7AH@Hujpq9Zd5`rjvbf%S
zTwBMUHn>tk+?mT_lo7#(*udU$&q^FXh=4jY=(f6<q_(|np6+k)=zA6Y@$WHIz029{
zcj)YK606&CNQ<L0X5l(w+^x9wj$HP`yMCts?E=mw&Jgk8MPn*tqg1!Xe)ww(3%mxJ
ze~#sgIb+2=iI%}<pQ|pN{{A8Rq%D3Qnqx<(J@RmN&Tzxh^dMaONc>nU4pfbZ1(JcE
zx0_j-{>4`nbzq(ISX-D$IF=N6cw(x(2hh6dY3#54t;w!S_gq%CYa<`zz6Fb&v!tAO
zCQY!&WfwbUG4}W-p*5ia$72DGTVBLc>$Y;Ys^{nFPy-fZrgE&?#+X~?&0&%d0ExXy
z3as4K!&q*%j&-{%a0h8K>GFSo?j4@4W9T4(z&X0SI@`UUhCs0hdn7PLMGPV8vLXfh
zniQm@fN$H*Oevs3Bcdan5YmWD23I#nH{rAWO-#^LjQNySzK9JwvW`*1t3HTFU@NiJ
zKW;?#sw=1yZ(`f~F60ysLR|f~S#0rNc-u4i*f-8abg7_{j@ek-FVr>%x_L3}HXcJm
z;-t;BuMtS018nm)g(1dxJELWjl&BzgxX!y=7MZB%fUv~1h;by!O#oRyroW^zP18wt
zOhts#cN41Y_H%AXuDD!v!%{U2qfJT-FuJ=LnmYV+nIv)+ng_aP2r)GI>5P%u4c&Bb
zHg(cCD^e1{71Ha9x-*B+otgr7K*!GgL@nC5Iggyvbyh%Hn)WVwWkBIO_R&jiiuhAv
ze5*?QpVw~1u>po5JPGMYfX%xT9_!CYbTk9owz-gdQ@Rqf>pDHo@iS<j6v4H(3%joH
z<JcqcXvklYYl~Nh1+Ak#Qk3937XPb%3l6(@Ew;Q_Xidw@R<){+Ey11(Y)acI-=_Rs
zUsTnpzvPoXovVFDz10yUsZo6p3zjPwNqBR~YT6hHVvfYopuwW*7+KA*X{QCHBXlfY
zO?yg2mzRXRhGhEg$knlJzeS{B!X7~qC6aQ#Xa3okKk>bT-%jGhX%iV%?q=9FOb?q8
z(i{|hHxb)j5IIcEMQ0wMc~{u6>lv|+^y6WsdhBI?A};nWW@ginnLUhDV$*25&SarT
zWn$|FBAR1T8u(8vR{y}HmBlQjW()k9%7Y3W=hT3J#+aROf<WAo37};_I7S!wj;+)z
z9|w!GgqS>oM<7JQ3AsQMNLMkY&`M=oH@RLenMN*>QN<G04(d?sRHrT<hQuty6p3jU
zS>T{j8|a-xCos!kbZW2vA?-+6vY5%*6Mh%2A}rQ{_>{p+-{<9PM#PJZD7;&|BiP9X
z+f#V^hVNj5^ItfI5c_}HW?v64qFxF#3GSysp+gO{@f14QWXG8Kk32A`g!UH`gKVe!
zb=4RfF-&3%HS_)$LaIzbIOwNtJS%gs>juqgrBg$O9-^_d8RB6*C<a`Y^Css@)T;;t
z&kUQWfVig0gM-;E@?KG$@eJMWXCkGUoHns$beem*Pe}-FuXN2RT8Co=m9uU`-1)yl
zr>}?JmxOp*J72<5F;aCwRpR04YA5O-72V6P!={lB;CRDW_Z`d{Kb^OAt1KqjA~;l@
zJ=2Cg-<ZdA+gRSw-i*W{!(y`8X8+sl3%SaS9|liu+)NTQ3p9oHo$ga$jVB_@MQbL(
z*kbZXrv0MOB<O@`lvo|QM}rbizr~`GeydCpRdU_f%m^=nu(C5n@0@oY7M}EWpI6Hb
z8&k#q=C?LY#EOiuz0v^EJ17UHsk-a)I;=i<B@v%-5|>rZJxz(5_>rzXZpZR#f`(4!
z*!p@LOGSr)jRo>PY2zoz`ium)5@8#dtYuD+wCHnDwA)EVe)IN7xuN(xE+&LA!L9P0
zgaDXANZS&lGbNrDg<_r`V%G}fEr_&43oQ`B0!g%?iJCKzGa+fF8#r1Zhd4qyb}E-n
z+hTpupE#!pNk}3w!3qm;{7Q^M1f?05ORgwFLsp&EK4;cg8ju)qzd-tgI8@P?J8*=c
z__w@sJ(?C~v80s2Xx}r9_sq=~3z6^NkpkbE9|N5heqebDvQuXrJ7u0xFB2%##Ii(%
zGbWC6JFz50j>~c2CLtpU7Y$4t>teIn<+G;r*SwDoKF|Rw=0jLWN{Ol>#!@v9vW*Jj
z3ArZF!?AYJV<wnBW-v#RZn6*}u*5KVATt&wm}Ff-YAeXJSVdCphQ!wR-YdnRHKN3F
z8By9;sK#NzC1yBgKnwBwzrb~8DzgS`O!xhbYu98*5e0v0Fglk1kR_xf(cC7&m-<9l
z!HL7p%OS3Rm35%ttoYyaT?^xtq-2%3Iv?T-Y2ao~16;FC=8X%BkeWKormY+4-+8A9
zsr-dwWer&#E5;5}Xm1b`#%S#6lL#EacyR-b>og}8Lh4NH!FZcN7=@&-V$F#4L364Q
zF(CFH3#BhntOw)4dJ<|@ExJ)>4fXJ*r`u{4{S-y-C1S)MD=b@1dXV?f0`(SMXK}u9
znMB?tAKk+A(woEqV(lJ%7s^*mIu4F{$5>OHHj7xjC-Tu!G+Ie3oq~j$G9WSp7QL5-
zec6NI=3`*XsF2PH$C=BE1V8JLFBfP)@6wps&JF6WONW&vTSzzLwp1*P`{*8#<xwLt
zyVXwwm?@&CHOiP3BKR8i`z0Delb6{9qA`L_(r#z64jk|^8zBb0IY`&39z~DfH%J7#
zUlMjeGlz|kn><MPQ4J8sf%82`9^6V)&}OJ}8?f`zCV6E?VHXAs+X<__06Ru@;lm6!
zjtNH=fgEhKqnKd@ASvd3Dq;naZV19E#7K%njAFouN+zVa#|=9jg!%y$HY+!fr#K90
z3>By(Uvkrdr!cKSW3llj{%3~%K@oiQUJoR--4uY8bm;N`m4r48CY{FWPTkM~H3XSO
z%#+1H%!)X3b-HmcJx3fA8a#-xF_{-xhPa`fZ=r(~``nBU0LBk!Qo0k~O~+VwxSj>D
zVR}2m>{&Wn`X0$&4bhjN`cx80DBEXaO_c|`@_oV#>hP?5sQjSoUu84u(i?N%hkmZF
z{D^6D7Mt(TvHqd}vMV|mK3^16Vj8i2dI0}{NK<GEpctYnJ8cTF7A%4TZZ+mf9_WhE
zWbs?u6M#*urG|j9rdX(Ziri*2XEc2ZG!o8Q?4eC{NIV;FNh-fa(}vZO=rdchRNR7;
z!ZcVfa_F}7Z}EVavxH%%Yw?rMHSQicky{5lS-`DoiH@sCm^v260gfdC=g2to8Wdi&
zgK1tX=jm5t^j{k=^8qW8r~Zbe7Bw@Ut5dPtUS^)|ZO21ibXbU$A~JBdi=93}#nqRP
z5_2rW^y_U*Z4*1!BJm3M_)twU@_+n>qb{4_wx3y;+AP+f)#Mjcq{RgB>N9p0OUv}V
zr(+S^NmPLh+ruP&vi1b<=5to~HmP{;87t|_XkiIzQK5CJc#s%$;jzD{7)1KG_nsqE
z&>%$UbU4_A=KhGs$hd#KQ|0rBRXy<C`DTzKBV6W^%nz`7_*n=iS3ah5U=c!O8b^yo
zr;X;vyDu^L2#J39k{vpop)?MX9kvi6)pm3C&&Ly4V5J4Kp0F^D4pur031QP*&_LRQ
zR(v=!4y;wfr_U<z?c)Lo(+%`6^~UZE;N_R%p>9y|@r#7+o9Hm4!&o3;g*48r*^L>`
z2&*Waz5kRAYBROYW*)-2AF<qr_h-`SvRA<eFC@ahKS<X!IYhF3jduL=@puF`>v;cp
zh4Gev6tNkSQ2khPj-ffS>Knd!G1gD{6o!p8m-Dzk?GwJdi01ThYoGg%GfY?bvbyuN
zofo_SL(5}e(S?IL_~MhtVRh+#7^C%t?Nhty9xIavW?*vw&;A`qr}=y3AA}-FPhznN
z?LX1!RzK;#{dj}cl5eMqg){BYT45aE#1PR6Kr(%Q<GDDdv~c#)LnKYvtIItJzRASk
z5hjKOGhN#JLB+N~u9sO7k#fruM_^gWZtN_c!IvpRE%9+y?%sS3mZn^Up*#_*2A_-W
zZ9l+}1S?-TD-9cm|Mhq{>K$7VO8bWoqxro-JTbw?Jlh_@-UkR(UK>R6oSS&u92<{I
z9ISUOzl5iJP>5sA4IC1T$%=K+*-SJ{Qi6s5g78}|Nt&;{kh9u+hJ>N2LDi`og9quj
z?%N6~G8nG<Cd2r01+hbnt_opW5>bmkx>$iT$AWK6)8Wh_MI|A8EvQJUEj~uWMdt%m
znKn$B!f~ooK~9M{JnWJ^k0)`$wHGls((O3^G*WhFTaZ9XQBJa2-Q@0ZlrXs9qe0UC
z9y3D7MMd89Sft%MoVX$bGxa-|n_;>^*;@iClVj=Eaqa~Sr<B_;aWZG)N*T+@AhEcI
zOGd*QRB`6H3}@F`P&-y<<H{MbMo@#jhI~3cK8UNP(fFh@oOP0pl57Qohl}%*NgYFC
zoW{O?iJgtj<m~KoG}ISZk(Eotsh`V+B+@*6?@}Aia$4D>aT-QDEEt-pLX+w~9kCY1
zuDsO3MrMJXeKu!fsC|h;bdpwR@_<oz5a*s5WZ$f|VB$DZoRwIRT}*T2QRMrT_+0@U
zd(gv4t$V3h(z4G^!${%WbItKGAv_#J#s>+t#Z>n6!WSHLrr0e>Ri)I(6-3Qg73Yq#
zBexhhsm6kw5wu!pZz;5<>_l#VYnl~f@)*XA1ZoRN2`$nus{(l|q!j14>RX&u4Q06C
zTpg!YDl9pZxI0?;RzEv<tY#YG5ANIW5c93OEZkmd*VW5xEMdcGh<$IH{M`a02$uV`
z)rxoLG%00}?VtT$E<zFP`?j;YiFJQl*SE~Yw(I<oikx$bD*ssfi{M3@vG5`x8$ZsJ
zLYTEr>2`5C)Ol*Mm5p;+kw8rpo3gDXh(U>l;!*6A;b}HpG#=QpPr=2L71)R}&dM;!
zMyfBCWOA2Hwz3TyHT?ck3mV#i(tP7tqR~k7t>Bjz*s*&*#|;-LXd)eUy@S|tRp`k%
z5)<O^(~IJ;w^74&(-iEW&(d6>M<Z@6Ad(^<ad_8|d{OVpI<3R%`Sv(D{!<~P${2pb
zg)HOhZPNNjQuj0aaXmyJZ!>7W77#ozQOa~6-Fy*o)Vsj$yxfAO4h17?>_TxYno63I
z0IvTQLsyT2+kXnQcQTac(F76qqS3R7#IfA?e+oA5QE=0Dh$|*at31a;n~l_q#A?SA
zrTw$>Y}nhP;8#Devi;4BIdX!Gdo7F<m!$Wzuv?~C*{bavzq`hY=1yRA1<6!Bx)j3*
zNzXMW18a8zf4k0x?FSg@DoK<TkQQT1@%h<L=>3hI3Vu#oyT`>b+DT-&5WCRGmLd=_
z2K}yA2+fhsGR8Gy<o*k#d7jfy%_(Z?m5iObBz*gEi+I_O5FWFH4mHSP#U5cepQOq`
z+AH50Eo=Z3lxNX$qC?$6VlJy{!}aHK?4iB&haW50*{on}Es073BxKPzOG^a%>6r>P
z(Olk0BeuJdB)NHt*p?XPH_w{sy@JdTSOUw(uhmx7zKgJP9>e4HT%GIu1Z!>*h}$eD
z%CGs>CT(TGD<toajI9z8%J|xTPvv(kNqp0igxI^a?0aUBKpdgfZNbX4@ArN`ItP`n
z04(GXfes!MBk%@OG<`?2j+r0oIDItZPrn*u4UIHJvAPtNB_?s!(5mC3WjZF*DEQ}x
z9J^YWv=Y>4^T#ErgjDR<NsDOMU|`M~4NHl|w%9f3ep1G#)7iC_Bbll^(5@ktwB(;G
zWw6H34)k&!PfE3|`+#-y%&=4o-kPIg)jCBg^ZfAwfgdq`)#57`f77QHpT@g{MclYw
zS~EW%tG>tnin69V;Eu23q$O4A+wRkQUVjl=E?R=4hd$<>=J?)WDyD^Dhn42vO<c)P
zVB0<&Lz8rDr$fq5`l1i#lUO5OY*Y>LLsTr=WJ9b~!**h{6Nt{7w@8DMKzai&(E!Bt
zEL^X{L&ttXoQB;8ELgsgUJ(<Z=M`xVxOO|S$eN(gbZl$jn75khj|~!%*I*mMu(iR8
zj#gdbzI`n;SF7n{5!MnkkG525SA&MOHVafD(KhbZv2X*4Zp8I~iWK6CK3l;_NUCGw
zc9P?hGWElG#5p9YP*p43yVLdPap+gjMUX4Sdd?NxrN=Rr`2)qtt=f9_vQo11E<Jw4
z$;_t);n@5)^u*1=-kiDkuLNV<I;|{@lQ=Rl&Ca$rc)82Nuz014Ge#?zMf=oB$X%m#
zFnqWw5A;EaB>rwzv5yYdx8{;Ag%r)2OGki~#j>p&Eu=Y6GgPeKp=0Gb60RqJb?FuZ
z_lUJRJ*p8QJ15i5Oe#Q#wVrOZu>Busp1ZEa4kkP?4HLqQbq=Hk{zN*8Zy1lu`~4W*
z`DevDd#Jwlf-BL_aE!$kat_SnO(M%kwn{t9_hSJ@M6t=UWAo^*XzIH$MN{vmzxV7;
z=X85|`N(XYj+IHHY|N2s#mFiJ!-g?dR1pL2)ud^lF#RjZR8Ta+ig9H?A&EDNhZ9n8
z6YH(&(mZKUN(?5ARHRLDRS83Kk^-SS(}=R<KDvkget51G9%A_}J39u=J+yx8#M%qd
zfrqiw1dUCqB6(gsv4RyABoDD6&ZbGD3c@oArp-KJYR(s5mP?p$3X!fsQihJwQsN{#
z$YS*GlTvRq)oS59_FQnsk=mFaJjV6QY<ZKPi4}ihe4WmjwrMkAtGa1TeD<`xal$@F
zh@u2B^NmUI*h}iv^Cw!->e7&#Wf+gpb|Vq86+a<PrP0OkovAjkWR9%7Si^)<C02we
z<nt!l(CTJ5XJRap26M#3#7T=k_(?*is5oyDaZuevt(|7YAll@EQmyiE5Gyc=M)8y?
zhHhe<|L;^AJ<E7fj7oDv&j;urCN0=0HL+;%>Nu&AuE%qv4c4VixL~4n#g3m}N(Xft
z$0g^*!AI>%p#xj>QRT$yx7Um*EB(Qyq#;EQB#oPPPn>hw47;)3-i?t-7;q4!cVv)W
zT!Gk*tLX5h)@UblYwPbsF^^3=olcNKViGKf%|0ELP^j4x77X=1ahCPMwVw9o(8&)a
zrdNF!@0>P0F|&SIyfwx;R46h1e#U=tX#(7|hpxWZjvnH)vWs-6ZXpJtRYPL0^GW2q
zhjbkmO^qdqrABk6a?P(x0ZzQlf(uTz(wd^Vud^c|l_M@jh$rcCN;SP}dVJ1FkEE1N
z_-mrT5i%695w|~tBMm}i+=93SoIFIgWS)V9>oee-W<)HcHE&7QM!{NjK1yH8M3I?X
zM1-&K*y=eZjlsAZ;*1PL$H9F2D8L^6S|6DXO^K`iLl$!09*n5$(}YmJC&GI2ueO-K
zY~v=sU7<|nf$N^+uAe=?dlqfex`v$>?6IDwx^b4STF-L(GSBvE^VSEoj8SgwrFn!U
zvbuHanY02<59pS&2}_szwbi@5x~0yoFWN#oJ)=`s&J4)w%9(V%s8e6Ehkhsd^iQ|Y
zO3Miv<)_i}XVC9_xBl@4pPn#A)n_da&}WaXoZ3y-Ro!|9kqLP&ed9iQzRaVo->+#H
z+ND`fp%dg3ja$E|cZCx{d}-*7H(@)Kgadh>pDcfv8RwOnj-RtKUqr;Z*<Xnxv!CgE
z+d^Y(J&(IAHCoTcwqRHJ<^HbcJ|h~bihD6d4O&hk5_W`F`*?FuODOZ|@2&Fav31=#
zo8r^inVQbdp#B%R^mkVT^vrWrecnb@&p3y!O%`KJ<9RxbV?nDvcYQ#&)dlp`2k5h0
zrE<T{Xdc8L@|*P!SNe2IO+eq?8qniM)3Y@G;+o|wn$O%0nm?be6npfwO@7T*?bVbi
zB;cN+YL?RpYv;K157*OsN(1_`o%C7gG3NO!YM-2Em;U}zpPq4ss=u*J)dx-J(Ah-l
z!zrSUfDaQjecX=&!G}InefPhsxu@Q$cPXc9F3Z`v+j0Td;%hf$;;11ajaiLfQ_5S7
zG-ls7!<`mvx`I_}zK91-=y>k-3wkQ-XL7goeBu!cxqErD=1sj&^X_*AeJD|V>{L>m
zObPf=AJA@jI;fp{Yf!uY4Zl`%Rky~*wP?y2K~0%Tb6OtI-(C~YW1L=X{+57dbCA~i
zG`EJ+gPQdmn!6I8zM+vm3w-*rJ+xk`Xim=x(%$m<ajF`uxhm-Y%NttY4>MHX+0%8m
za+2<|PW9hyv@$HxvD9vv1(7kVxU~b7oZBX-vqd>8?`daM#Hp8db+geThRUuBQ1I9w
zk@k*Ncva?51Ii>S&wZ^N{RsVmI74-CrF`B!x-B;uYerm!2p4!(tM6mM_Sf`vY1bK{
zV`m0La2~~8<<eDOK32u;LUg>2eut7v_{1&km}}PpI`<3Aro(R&Mo7XsSsMLGlR%y1
zp|(^a<Qj>LNsED|g`8}NMJ6$)+T?>}SS&PQnl_vWN>v`roXAGfl+)g7BeB>Jy58bt
z%CH13WU{7RGn4hV`JoJsf!aaT`yjjFD5M)!U_#T*+la-_jN`#(BDqs+RKK(nSFDLj
zw;J>6kdSia$bb&ZkyngE=d3NHhiK`Yo6*nZV|(jRwA~Pq7V79(e(R*I^HpoXc+n{f
zt@(tQAomazZ70!&PmK{4lEyd+MP@h2vlFTREpF0aCQ^$m@*0yqP$W)n^?@gm*n+5Y
z46+%fUver`x-Q0<&K(*@<GNicd39+kF2+$2^~&oOBD3|BI4Ptv=8|+5Bts7#@WL|0
z%JmLWPm;6}l5#SxGhvM)=2;=CU2F9~8I~*^Kn*qsa-OwDsy~UAES<X;M15mI%x1iw
znNdD$w0AA^;-E$0v`&PhEmIOmoVI#iHug=~kFNwGfYhHZz@XA4SaYGM%V70S`XB>)
z_GMuAm8&Dz{;$u%>pwu;sq063W6BpJpz0Q)nPN$w=nljnIaY;7iD9a4>@R8ILt`yd
z4HLz!3zJVt;~FSN_+jx*+Jh-JuC>tGp*<)&&4dor!mKo>`T?5DG&{65T0`l?vFSS3
z3@=W`NLQ-3X&>5&Ateq>x7rnpd*OZR;_*L^lF5&`Z<xF1%2dQ8uDAAVnyjW;S7K_B
z3-7)@7_PHUWij@D@!+0p_}=csw)P;#T^YmLQf86xCJnB26LEkJjDEBa?;pxH`<^)K
zpt3sB=ikFwV!Xxu^sQQa+Na=Ca?qW84pP{!X(wzYEz~>M^x_{Z<FA^k_2_lrnZL8d
z;8D$Op>p;%jv-`!hfm$t9DJ8l9=c%%99q-5VgIX0^I{15W3gL>?wf~fGgwFrW_;x#
z@xEp}CoqSx{kfFC8n>&GJ(KR)!baS1u%v6;@YXc^N=&2?VUBC1c8Gw<0uhLXYP3@!
zq|~kYewT_lN0t2};&2pH{4}xZZDD<cRJ53G^hdwhZDY1955^VLiI@OP3B8s?Ks1<4
z@?M7Lsxc-^B1<|F=|eH@6>jd#a9lEmL^p)z5(fdjuJWeC43pOt(-uvUV<~O5Y0Lz+
z<ho&>FMB1Oaae?}FM(!GFbgHWv5I#arYyQ{cz#N!P(@xdOhJwLl5QoM@jg-=a^1-5
zf?l^=>HTMw`VlGG(R9P%)5nx?->~G)yM^t+SAv6rMTxf<ve@Z&GR(O{1ZRtkZGB=Q
z@hR_(V=-qg-~mbMa2iM^9I`mGOY4%5BV~lMn=$_4MAlWqZy+?s!i!e!oY49a`Vb}y
zrNfVII?ajL6w<idRL;mXW;%e$du(E2Ew-*@4+WQv{+SUiwKoopE~2X1hJJHJu=(?g
zu;H`~2*r6R{-|6@s(V{c9#V=qOhxEWb$I>?w#tU}<NG}Ua{sVbY|vmm^{mg(p#>PJ
zi}kD@zk*KpNO)a2$ZWX@J*lxwNi0A@&s7`;{=_@9(^!1!nWQl4A<^tqCDk2A!*)y&
zcx*h)9Bn8_%*;(9lr9J(ZN=E=!o!OPd01@$^g4cokT}<jP09qd%nUbgt{AR)EOd{g
zx)mwUHOMg&M>AuM2-_uN9TG`qv6=`%F%Jil=>>y~5Dp<2i-CB!A$~i0;F@g={uOM#
z?@sKzXtRkC11Oj=(Z+}TFt`&}gsHW!05O{Ef#K>XKs8W`g@vWQ%)pQG+|vwX$Ao{6
zaFb@1Fv1of9C9o{1Hlsl6<(>v!70X;>eh&AvWi$37U=;iU8+rwO|cP~X1-q)UUxAP
z0mvFcl(N{gqA_AlZFb{8V9dOQ%XSGoAwO+a*(^glY4~2r=fqhn&L=A&@m{GRq*o}H
zK{~9G5@3okhdR}>uJJ4Bp3K#`Jg5{bSf|G|{)m)j^I(KSQ&F<`o65U)JgsZX(}9uP
z@Wec_@C(Ni;#e;C3cAN;IB9V|H$oMNgPmv$c>wA%SOEl+L%JLTYf1Y*b77gwO%i27
zATB-fgtw*e*6d}BjLj$J%%aIP!)!)$YXeLgM+yx@jD;BCFVI(HX&{dEq7|$H;n2~#
z9RICsBYi1EDE7J0GCMZJ-)#OQF&FcpAE7^#m<)S=(5Qb-OW5jN#{<6Qd>$R2>y~c7
zj*PdlBy$*&?0&BD7x|Ln9N;vjZ_K@ccYR*VhS`$f+c#35KkWNB#<}sVqz4g>7{s(A
zC4rH)niQ33!sAbR1&W=|6jG4I&|eY_bCO*|EYnT8#c-EbjCzonN{h*F#SqzI6G<pU
zU(%oO^UWBfOP($(Ekr#EQkxru866OV#B+p%(qe3;6Q^+~$ZBX^W)BtTxrOBqQ<<dl
z1zw4zJLlYSq#My<q=TY!NyE2c9hqaq1UH;Kl%d}o8MKf4w$!{ECW>DPflF(3Y4R=<
zM;cP&e8P<mgNdLaWt5~=O&W$8q_d%kLa7*w?39rEye^TQ5TOX}BS}~{`eKkmV=4SK
zXnf@+mZB!w$Em_<#cRjVSehI2P!wC*YBB7Cha^zF0V|5LrF_M3^rV-IdW5I`AmM^f
zJV;ucMTSC=QXE0siT4uHko6PtAC_np@)t?t3*>JV^F{KY^knKt(2BgFx=3OqmXQ%Q
zLA)p^o+Cs-4D+yfI%p)3X7UONUrA}tQ8POQMQ=KJ;+R4uP&XNwkChq7yQx|Ujvh%0
z^#s!HRiLtS@QIAP1$a4~`ZkG#naBf`mZTz%<|UD)C^=3yNMuE5Wp&A%rNj!_#>R$_
z^i2BjnAlq^Ed)5NIdO1W*oZVP&SMy1L`_6TBJd%0+OGjpfDRUWUYBgJcvjS<Xq*iZ
zYl-G=_#jorNs*O1qV@$BcHY*^$0j2CUZHm|$Ct*x@VQ~O!oP_q!_hYI+0PWC;PDcK
z;z0Ey^ald(B@Z>vio2n0`lC@iS?eXG0v~@D-VdHI%BKZod5nu&+Bcq#q>?VPo@45G
z5SvWXyII4Ze-1W!xWfK*bCA{N3Q9_mlW!Fi;4&Yc{1rn!>8)P59hgvR73qlO>aY-I
z)%ON4btG{26$}^E>A2}~q8LdQ&I~^tsHEX8i063iE(^=<(bz}y$v21t!k{wY@gwGd
zAB&$QYHoE9tDd()Un>xn@CehObp%kF7{p7r+E9}~ZTKC@cDJYoUGJ4F*^!drn(gCj
z??t_f!{ecCJ??#_^U_w~<YAfE<t26Fy@=KPmQP8E|Hi5-@fE}N>V84?3d)A|#=HPF
z&x}QIO#m(L*`RG#5hL@b3nWZqxi*NsuiL;kXxREP^>Ym&d%}()$dy?B`eGGZ-k@ze
zH;7F$6a-e%7>T$rgnWhV@1QP@1y5RG-=ks910<_nt{L;dbg5EEaj97Nj1{(Rz`{qU
z{<T6!p&Ic_NUy-Q2KlZxt+4L0(ECZ|y-ZN^2E)$X97BTvEPKw5!L15DxSQI!n&w&f
zdk6-dHn_e<rT$U9^EGUK(Tc!oUD_i{EJKLEx+B20ykupJ`nmNbE7WydMozTRdb+gW
zt65!HY~|A|8RrqP<PGw;5qGlTSIH39N^IvGJvML)*W4~<o3t2S_avO)5O3kqMpq%q
zDEPUCB~RL6qqXws!$jZ&Nnb>aA~*M_K3~Q5S4jV`fn&={RIo#pW`vR|Al<mViRNM^
zQO@gBtay}kCaYEH9V>MzohrmR{`P&b814by{2R^b7SeMlLNUQvu!FOz4B(mH#^U4=
zz<oa_-NkmZksG9WA-!aS5e91}(fMUp&yCBfO*JTwnNoo~H06SmgM+SL5EfS%Ue9dk
zB~P-%Z#{07_p8xHe>!fEc3{n$NO|UCL>aGBdCL3`@Pq%`DDp^}g$&cCsVdvM(9Hha
zZyh>ByJX$#W_$V7H!}R}96SE<OJG!m4YyuK?0J_FM@!wU;_r{e;DRxB{NpxaKFb*X
zcoius#ik|FOzY4w?Ly$$-&irejN`WJ7_K=(!>~fDWY=}#18YiEtbW;wx*Uc#p0c8h
zn5og{2B5o{jBHn!rDOf<I8q4!AHNlYtic?YUT1+yNJ6JYRqYI7{<AieWiUK*w}RS2
z9raVGdQ#pb*pCLc(!$)m`!DGHu#&~bDRA$;MYp_sk|<Z2-kr?&?q9)@Xw@2*)MyQB
zXW@t;+EFEOkS!n(w2c&pbJoO>5>vrTFA9oD!R^1+;M;G=x8wXiY$cJP5LzsmuYed4
zeB%c;F2fS&J|qM@*hqq&M55n6UuZ!ZaZ5kGNk?!mDX07@a)!IH@dFDo6GSu+D{_V@
zIOP%*TDuP_=_IoU`>^CS1sQQ93VxS3fJ8cQzu$vEGZ%*phQ@I0SY&01w6ouT!@>q7
zfSr2<N1%!3(XX;RVN?8m4ASZO+5c8hRivZl9AbvL1?BBWirs~EOBC3NI{$ou^z_D!
zzfqy?qxMnzhsF4@^3xdU8T#I97M2ue#f4V}p>`@vm>jRfR{}*_`sh>IJUZ9yN*s5u
zI-Q^Q`y{c?^b21~Mf&24c`)A2mk}4dElbSl*Wls&<sqL9m0}8Yrw8}_6UZIH*y}IG
zu!>v@`{NCyi`p-cEUk-<AQr8rxuj+M&MOQ<5-qru1QWr1hI}Mzu#P>8Z5Tw8@#$L@
zqz+;@|GTtiT7%H&us?O8h7Iq<pm?a2_NE=Rc^qTTC1qughpwwQW0D8+pSI#82gAdE
zu%f1j&_cQvrlh9};>j6M${w1YG66ezgC6j^Mt(G8+&h0IrKC4y+@_Tse%Cz+T79f^
z>jvbmn2PkPQdxE5I^z9nxRzXv@)esgY=<z{?Kgcyf5^a10VgqT@xD(XGnTR`2wR~9
z(Ba#O=a=4#?W6C<WRevL0sqI|0ww0u?FsdBhW0E6QH96Wna7!B)gHfF!;Rn2FyT8v
zeExzBr%ffqT4u;%ZP_;b>JA^y8LeZ=#eQsB7>_X*+M$k6rQFOiG!`>o*6{1^YPjes
z74JT0#mH$o?~1X@Xs4DK9jiW9@YpOBvp!Ss(~CH+zZY1&H5Q6s1&K1<wnf2xF9y-v
zDOfZ=-d&!6H$EilekhY8wR%w;-k7c7=@&it<uz7Zc2f*CcUqvt>ntc(b3p}6Ka$C(
zdD$z2<{#jby0=4J{|T1gz81L68r*uxVw}G%UfI>WTi-HfwfR7#TlN>gp=ITEdx@_2
zH3VYf@zdXWanG#^`}>20*n&3phd&V&Rj3GK6Xxnlz^@-xF^0x|%WfSXji62WHuZC;
zSdM;l5fZ*`x`uC^ZNa>SK`bRI`KcGIa-4+XYWD^Uo_~i9L!!QG3p70bK|JOyB6;ax
zBR0~WjaEGLq6#lnS3H#C`Hz4%J|N0$m?k%S!!Cxu|4X!2MM|uO8K2tl(L6e4QjF+z
z+t*w1`=@mD_%uwcqS1O>!G<j~j|r+&lnKw!U;a_W*=JcXZ@wSP_r&4hmu<9$i0UH|
zP!myt|9Dz(93-wwB+1u`SoXm@D_7{i7QO)L=717Cjz^?m)DiMF(c3<Ny0z2Hbfn79
z?20XxjK<frsQXV8=(}zhFCLd1zy32nSehNb`Mt_cA7{lSKUMMhD>htul^vE6yVMm0
zEf)OXMg<R07k_=13itJP{NZlmunG*l$KKsm{ObN7hG$txuFmnqdmNuGArc{3le&)C
zG{-Ye((v*}I=*wZj$b_$ht=yuJaG{YIDijdW%%Sw4R_oV#B=xA@GYXiW9(Ml)29dV
zag*9yf!2*shUDnHeRXm$dqq2yds)%~)t+9-JpNj4&0Yd!z6-^}gM1HLzy|TtSs-ZP
z@#*uxJ~;uE$--#8^ywd?tZ6ICJ^PXS{EetwGZ@1kDo4rEpQ4g`;B>u-VNd*6*fLwP
z-~O&r_}P8Jj#6>#c?u<OO+^1g)M6R_J@?2L=lVzyt?O%dsNzHa#p6U4m-guF44-bB
z;M3=A4eH{C`KtoDrgHrsvxwKO>C_=?ldE<8;dgxUxfNS9`MGk7Pq$7alJ0E6@O3Wz
z>c9GQab@csP4{?peMfUZPdbh2pW>x@{Q7tQ8r1zkdTvud-+Lgachfy3ms8!R(0i(a
z`ZW&*^gvM6*Hilf0aahNEubf#Mi_BYkSCt1bw%gZJQApn&@W6gk}u1gk)aK>-i{*}
z%fms^H{A0uN#}J}xwTGDK<n}7`f}=P(68y|{F=sTJoR&muAlr1pB|)vYVXwbhE`RM
zS;ZAz4PyfuMt5sfSGsf;4RuqCt~a(A*QflNFyC1Et99w;P50<N64&f&Q1$Napx))t
z^t?;x+Q~gSJ+Gg2qgOt^r%~6tU8?T!sd~u|y6Cz`$0(0}-me03eD@wu_14aS?xX8@
z-=k|&sE#oK{mfq(^LU_1)qMeKLzk)#K3~jJkgf;yQ*QC;T|K(KpPt{fPbEE>uAh1{
z3H48<buf|ZQ*ZOh=QhwhHc|gvRDb#RsqV=E-EwM>S6sr=zr=9<hcTZT&E*>0P^2EI
z-`%#40{-K=Nk4b>6r9F+;>kg6TZ3O$Y2Y{PqJ2n%`kQBH%xY-NCwugqZ}{{kng_A3
z*6s+(G5^NxVm@e1P0-|=2k6;WT2q}py5{z)dhW&a{3$eVj(~p6BVun+-P={&?bY->
z&ALA1T$-=bY2GVb`t^@_^dQaIs?9-->zek_a+Slmz=);Zn*`h3NA=5WB1dLg?L5Pt
zUnDywuvWI;!YbVneia7y!|GhCP;y|tQPjVFFa1+d=D*UA|Lx7JOHGodI<a~eJl&(f
zR-Mg~PWc=65U(l7P`f9H#MX4?%6N_ImXqKPTA4k@OUwB^d~E#=`Wa%&AI$YBNs~up
z=XZJsoiuesjOUss?~K)N{fCYlE@$lQZxhR#M{-uFYV+aLQVafgeH?E3qlQ~=u;84F
zJe=nV`(q0eVMSv)6u1_Va%zenyWWdKY7MdFIdL-FtN2gf<3iKoWaLlM(7cRT{JH>K
z#M<eMs7Ipgv~7OuS(c1R7wcH?GQ$}^^I>Bfm6I^RLTsYGO^1I=5|T!1XkTjK!$-R5
zd10|`VU~DHr#2F4GF0ag11VT*mtCkeEc_ge!VcVo$_L6UdTgz>{)aF9ry9zC&WCTC
z_1byCv^X~!4iFjZ!dowwu-|?>)qc}hpY`&GJeqyD<u5*8avE>s`al2d7n}(D?%4{S
zc-xOpmXHV`Aw`B~4ekWi5OaU!A2?nmD(c*yc4NZ<l4Dy%d{2$>o!waSK?<(>J;T$)
z&i>#pKCIY8Vk{9Kowy}^s|SrMl2CUs=NsQtSmieY*e5h7!XibO|LyHY<DxW-JWu1R
z-?y-nuGF!$n>Yc&Z^AN2JimY8AdJ7*O`?`~OuEd6?LOh^PgFKhYx-st2bS4U_ifHM
zylG|SXZD~iE`~(s79(-QP9HXWWXJb!1n&Kv1wX&L8!LCwJjL2c!AbJ^-9a4q+=8iB
zYIyqz8>W2Eg>Az2z#7YS)v630&TlSK)P^fgZ?!F1n$Ct52KggPZF*ULr?&Lv)f#DS
zW8pvfMHx2sU@)yvh^NbZ`6+Es=7ZQcX+^IoTgJ1akvQyk*f#Zerc^sDBsg!%a3@@N
zuBB~>E4ln!<@Xn6+U|SBru^|IF6E+M+r9C_{bzc3%4Ld+>o@*DWd*rb?AoOwla9C>
ze@}BJ?72y7#rFm=^B+lgbCrf^Co{adFo2hc&j`lH8hVdC9IHRF;)3r7_}o|QnDkv2
zcKc(PYN5SF6t=bl=pi~Ktwux33Q{~z?m}l$Jak2fz(~%%jiGx(EYijVcr#J%Lo3~i
zmbBsF;L_1QJ(yFPVM+hq)YPWJ#8%pmymxr3pUXr*OUK45Rz`4D3`NTd(D{J}t-omu
zk4*oVb@q=4<-n!w^q0zuHou4Dk{qmHPD6xp)*~eKd>Es+7n=JeEK9l)MLdQE>ueM+
zDPU=%w)38KCHS~<uSq?q{nar6)~w>QZ9~p@c&`x9><eIMiN$~YgQ|^aCH(PUL~Lir
zGig>LkV3$UE@H)QdBl%)h4I^;(V(Ws8rFjl2LFVj(->}jPGveF)!+Uz0AE^yv`m!t
z7eWj(#EQFK^ua?)mph*FquUZI%>ac3i)3jtEV%E@Aa;=!{Est9Cf7pOV|6Jw;v`uj
znHzrnv>#eL@P}uE^n9EVidHDyL_4Sd4o3(f+bGVH_$yYoGD&TOK;VKp^II$zpQOhm
zJqq+9@WYC+Ha6lErS!tb1UgViipPoeXw9KNQsM^7VrhEq@OovGZ4EJ;y|t7?2P-w6
zFqpCV>j-Ve+ohS8CQK{`aXd3Sh~-<Ycy6{Ao0>>o9AhyP-H-^51elM$uaRiNiU;5G
zV+Gx(#+vp9R%&8)0{%LKkYvEZ?s(3JJ#HH;$@C6kmM8`+H5q^Zw}<a@)AMg?d`pL&
zDe)o$5;v^vGGcM>EH8GufxpajVM|9Glq6>Obqj4-rX9bV5kO;ymEHNA2TgjsRD>BG
z0My7KF?izr09LkI@WeX-tlmfMla@ugOaz2v(xbfL#d>Pjy>A4tm56_yV1yiIcJA+J
zQ2yGGY(>YA;Rxh&Z1vgEv(bm8n^IwQo+=HGcst$zaOkLp(vs+8tL8fCyXe`!8bj{i
zhIV*Rbbm5z#aS$N+$1hs!FS9PF~X0TbKI8!U&gePku>TFK5Q&HmIYwDPC<)@4$<r+
zkqrtSEm>G$`G`ic@7S;NH|7VJljPI0mXK~JHCE;?Wnvj8X@tCeczce5*!Upc`rM9S
zqRliBq<;njkG>Pc&MqtdG1H5k9kDX$iV%qj0?I~f^*8?v!XK~UCl3VB&JvBis|x~+
zka(7YUq9+1F_#rLKjeikE|wImhzL^{iI*<Ynx02<=z{ra!|Kb0Llym9A)-VYf%{Nz
z#kP^AI`lVY=CN?}fAiTdDY`ru`d4|F^ZB=+bhxnV8}Fmn1B^Z^KK>>4TNa|@)cL*l
z7PJpSO4kptf6L=&I@66~;W1YI@weHCDKC@aOX#s>x+RFnV<O_aNWnOWC|<)%Pr3|<
zXms!sma$u8_*m;8qWVk+5oz8g=r=kHlyu=Ks30y&XMWQ*L>CbS=^niy2ul{-cYv1N
za2ugB1<dT040_c__0n~f(5NNVFe{TtO`5OK_5DF8A~foLMxr#UuwD~(8_br1uHY*y
z^++v6lu`R{*Sowwg(aI-tY1~sEj#qhqiPk$-mM}cJ-4RV;Ul4~{j)2u_Trfb*I>+x
z<$QIT-l5IlR_SHIt#%73m~;`G86f4OjWqW`b7=~bJdI@c7E&Z>of;FdOt{6;yKL<=
z{DCHt{ijmjiF8(mij=g5Dn(GZHXA7viB?gD5LeQs(t#1f#3q#Joo<SuL(jXPzR`8w
zqQROGLuasJ1e~T5*Gh+7V7JDt>7>+bBqi#ISZUp-%ET>9DouTRbb2q<-w=S3Nr*xm
zpd#+NP{Ptg_zw_YmP!;LZBt8zNcUzj9EBjx5JJ=q^gPXmP7*dH#cGE8)np%}r)QHD
z_AJp4ZrrB^xnV}ANKa8=i5P5=4U+byN-{G&N$D;+OcHlkhjwpZ?T4Jy%FZ8J;s-sh
zdHg<Rv&FJ_Mc3yMsW6(m=(tYc{;n2g8#I(z^`Gg>EDz!9gh^{JM4a<gkZ90G{S593
zf(@s+YP0Z|0y_&zXEjJmEKLL#v(qBdXaZubu#)oGaJvwuo3tfqov{>}p>EoVDT<lH
z6p}y^=QhnX=}Cy#5_2<L&WYi~L*p*?mU=*iHJ#?Pjp`c~BM~<@(I~0zxW3mzYmPXu
zRtvX`NVLRsFMZInXw0?$88;c%m9h`7iL)0axz`l@EkXwfWx~FH>wCAngFUA{*IS;w
zAdclaX7SCz@1u3-fuqHL{ivb7nzTqKy$yBfXJJ{K93BgTdmcmPDN7CVM*_o+AzfIJ
ze=i|#4~(tb?`)pMZkO$l-g#oCg``R(98MI`ZFB?zFmvPS!ik3?o*72kL;)i~Y<R=|
z+i0<3xbJ3&nrNfa=Jxu8enl#6r5C3}QrU4tLD4}=3&?P@H=TJ*$+MDaEJ_Ta1xv)L
zpc<u{f;dM+HkfR?L{k_JCfw*{x+q0w%zJdftaMlNLJZ1(lv!g4OEt_y%wQw$<?x~R
zDwfy}Y4=!^VJUw>cg?adswYvTqm;(BOnNGbwy`V`DUsSo%DbS90%+W;iH_1n6KTn;
zLxpRy)g%>+@f72(q={Wi{T3lX<vKUKBE@I~g#%Bz5DL(9L+!$6gG;YFNb_tugT>(}
zEEZ`{)5Rfa<}Q`Mjqn51HdP_SJ;E;2wHYqi(i|To3xzdPY$clO;WR9oK>!Kyi?}T)
z<|JL@{Gsw;g0L1{*38-sUl4Jf3#>B4D%)gu_CQW@kZ`p!OqX7?)(r7l>ZrwTtOFrR
zqY6}U6p_+a8A^pI()ZNxZjxI;V|vVCQ;jjWm(I}C-I*-dqp)DpZTi;BlErB8=6|N~
zjuqd7ZO{;&x-&y>yzyxqQwy&z0gByjcy3Ws1@6kBKjNlXu8qlglVLz%>;u{pNT6<0
zZ(ye}3K~v03avXi#=~fD&{|?c&HcnpZ#%j!IAo+rVu*nb2wgYbcMbm_T9b4y5nif5
zK{RJ-5a>;Er5J|@h7%`fBhB;h7&+&`FGnmH<13u8^_t1{lo99mid;zAAdNQsSyK>S
zlO^M~PZL4k9wU~{lEGbrPDi0V2jlj}0e2qNJoS$wkF4kMARDZ{he6KQVQ?NH|74Zf
zE?R}wEz_m3`@!%0s&0l~&@z9>Usi4&tA%E{!$<p`FhF~dS*&7eCEaE?;@IeCkH(~P
zc9$+41DK^x^Sm_eJ@nfvBG0LY%eDY!WNMMQaa)b}-)Pk!Q>vNfpG>-9)5a%C!zOHw
zTm3{i$PB;I&0A3nS8v{?7~X=dK^enAx&ez--m>9HC)t9HwI5-r<qkHSI^_*KudgY(
zTP!U7lh}tj)-GXz7EPZU_j~Lv+Zh=ssV`_T7Q?UE2<}3-m#E*i9wT{hhgDkHC>Ar&
znhq)JRvV=4HjOzmv!&_sPatu*X`4ly6dJHrn~`;hnI3pLlPSu0yU4ggU)nX9#Ye_A
z5J*-v9HI3#kq^@<;sG0}&$xkrxe<|op^b)|o|iE)<nxBRH0MSV0NyTglM-U>G_xj2
zS85}sxb*sK5%$McnZC<ri+)~E>2e-L`&(e7R5M-tO|J-|__(C%iF08_dM^_}%W)vN
zu86B6o@<s_mkdRUI25!PMrz5!@68>jcVT&6gOb2k=yA#dG(GQ@Z{2l;4_ez!mgHHD
zPx4!^?_MvyZV)V_>F6fr0xp^lKaG92E-&?>17WW%CZSCnn{+|Ms4){8>1Kcjk=Bl6
zAI6?(=f)ZlN1r_5VHm)*2ZYZCL$hi)YD)4*12g{<*M-joI#gPF2KmiQB+r8Mr8CG_
zkkD5L>AV#7W%e77tN1Y6I)<8QOTDPGU75f}(F70u=`bbrz_p5>c8Iqvp2elyh0Mub
zY$h^Nzxp|rF?t95?d{B+w2-OUE05OUs(&1LG9QaoD%A&=rj-y!=tOn!cbL!`kJ2?I
za5Oy%78lQkWqw1cI`9aJUP#38QmUBAWsQTHGqnx)-nVF?nmK;*9g>vz1<x;o49SQZ
zLOgQGH&qNx;q3BD8LKQ)WH5N)2`0TM30ajCF`P3=M_n=4l+m<&+&(jAiXu0@NCt5o
zi5+893vT~~V5K3cE*X+m{B;NM^B=0jf?M#jYpl`+Rbhsyq6l}IY*%sZPj#darE$Yg
zhze}e48oPf3Yg<KVn-h1W42XqTRs#Cn-<E3ZWD4iuIT>JkMbCni>tXAJ#xlj7m=c(
zH!-tV)mjH|{!}Z5C5y2Pz>&>OX2nPltTu4`;wPF2!HpY8nU^5lFJT^+q*Q8Daotsf
z<Y=S(_LnNN1ei=`CXpM_KEWm(Ke?LNS&=m18d|0v6T!>CA|(2t{e9anRVm@W<r?~E
z6RlFs>$((`{pton#+?i|TtV$^gLEK*6p96ey*F;TPI!6(*ZzREc&8#==>@s3s2<p9
z6W{Vnjs)7|H(yIFYU9RriNI9^S{bgV_G#U~?`|fFUbIg!kh7pucxM2=`W3yO5Y<gr
zQJdU=c{~%crhat=*e^&uCf3JqZlHrc2;+Hiiy(i}535%Wt$`SA`LJ<VlJTiwg(Ax9
zZP;_hd_Fg!9yr_9=l-t;^jLYSGNEVc;q1&az-me@xbQR;rRgGGkXMEr5MmA?R=nbJ
zD^h5oU3Q@j=_#5#=#02D3jB1?U2{1}`@B}%c#V!&;Q(hcg~S6AVWs1$D;2qBrr$)5
zb^Fa2D6%1lqwhcbKCM5O9Y6j7L!d2S<j|HLwnX3$;ke`?1tW&o*!M2d;Az&r41Q$Z
zbqn{a{N3TO`rcz&+Zx{UyL{w4)TXQRpU^u#DP^&#V6H7sW7nPKxDZ~nJa;{B`S)m+
zFl30*v-CT><>tvaN=~VNL?|vxtZv&gi3=BA#3V4b<vZ|uhGJ;daHj1$n^40LuE%F{
zYr+}u6&%0tmO)c!DS$RzvJ$}GZy@<dR{-~2V}rF(<S|qY#Gt8&_0sjLW0B<N`1_T@
zfrRy{78F9T*6tp5!-Wbal5Bc9Ei`A2$e$RH%73B7v=HllY8~(sLTrTK@!gZ`(tXzu
z<Pq)*`cRzW!mSs_A}dD2pDrU&OP3IV8j-UUw+oZUs`%bS8&0a%@x94(-K&{#Jw!{U
z9pz>`MYXXJQ)%gBgk|XB^QC;H>9wnn`Je6Yb-NY_#WGQdnvJEy@2;z3Sxgt$-9NOl
zIF&dTEAa_L5eo_@-tT39`aa14S^~J|hjcs=B2z@{2_cpU_>i5f;?I}cNH;|YoHh;I
z+)(%mZkzj%8l&Q&AKH<`gZS%Jq=fVdZpR`wq(ZW*3KF4QH`Rv9VH$4u1}!OfK*psJ
zNS3JqROSV7<2g3&7!>5cxWLYtM4(oKob&lmlkde%XERi#1^G=E5?kISPB5E{gJe^E
z7+oF2&(5@p)Li^WXVA$Nut*7@2*;oVJxC{6?H|7%i$MVuzrKi+X<jijc7u`=5oa?P
z?)*O+vgxq6^Si{dcZg66iebe<*Yk(?G5x!-Y!Hp*^zYda>=5gK8OX}cxqH(khntho
ziuNl7@BKo$X&XVwm<(=}`TJ63Dt{Ol6YO*U*8{9ku316L#&mn}N1Ah+M`!o{%*GT_
zKq-P*mxrbgwr)4>yE+E3ZXFNb7>5|QCUaTJO-RcxS@Yu2AKMT^-0$62kmA~9c;*V_
zl0^%mEJwv(FONYs&CM^)Bhgu_D%XSXwie5GLTwPgx*!3g3UpdCg7fmxm<QyctI&Er
zV>H7B<6?2%I2|Wd$-VcbC~!$VFFmJ`d)LpiC3-)@rs=z|oc7f6i@LDsv@OiPcdMS=
z^$8A4--H)P*?HAv4T$^pMtZVM<MS6`*WJQ8<!hTKW(el#OYQo1*f`b9LOs3ra8OD+
z_9~-XA(G-N$K3d`F!=1%mni4aju$b5M|$;7x2U?$tLpD8Ql%a7A73Es>hy|u!WwFP
z`U~@dy1Pf$KUxyhg`w$Zs{*=p0+HQk(T=P3=~v(56UEwlpKDsDTh|w_3+RK+p;b85
zr{PpptGFgWXk61bZP)dE?W*49()Ck+LGL(;cI9NBUU0EjYjJD(o&%b`W4~cz{O#Y<
z^?IL<@gBYW2OixU;QFeK0llqT)tkC?{iN$iB0Msnr%V&-v?C2R6}JCY#?mS+US(v^
z&gAj(^EB^eDCvm^VQ{E;;Kn<XuXmkkJC%fzQ;6|(y0zy%@X;7*`kQlwoi^9sp6k+;
zQGQ*Ss_FKzKK-+`0ll?L*WX_t>~FdL$LG8{M(Vn9PC$=6*{5%4R`mnTn!aFzuDiUt
ze%0S;4#skti=dWps!!kCrs;bdRDI1BVH3~wn;)flAl6ja)TjTSNAL9M`lcPKzNb;s
zJ3YGo&EL`(PST~#{?K#$dPA$O@7$+pyPGu4>({mKO($$Ho=dyntP54Wm7d?YP1Sd`
z(EEK{n|24y;dsI%6M|a#4}7|t+Pr$Js_$*q^-h|{Gk+ZbML@d0koB`O{d&q-9(}`s
zfWC+3aQS9c&e?CCp!biY_MM^XspkgtUG)Av4MBbNW=(gwH2ph&Bn|lluCX&UEt%T5
z?Etl%`nPbSrUe3;_T4|wNnJ-Q*r`D+ZVE|gr}05JG$=-V8`?zGx(D@hry0LRLIje^
zJ9@4`1<h0avUp6E^LZ>iF~49v8tZ28>Ca!n&Za$B6VM-hTiDlY`oG`z>FqS8&%f!>
z#lB=`c{EgX=r7JzN!P3EA1|R#jqCT$pfRuY(VFt;wlOY!v9#e<^-os>Y46aQc#77<
zSeg^spBWeW^=6l<?`u@`ZTkY!$KryUXy1;a(_msiulS)y57N80?9yp(X>v|S|CpXX
zsat0!_2?si>e57f%H`{Wnwy%rbfd;&MlN_TvM*oUS94DZn81_5Udm>ib^#*)fsly{
zkMyg1^@K`<Zt#eq9}sCo=gR(641QKJHrFkS(yHdaJ{rMlANCcj!Eprp_|+E&23Nhr
z{HlytQ$2#?HWHoO^=J^kqm%sXt7znk6lp<AB1jgq*N1nXu;9$^`mp5FBvhSE;*D&J
zv|bP+Y~3Be(pd^W?HeAv|8^oyK05$cK|Gj{zXmz83wHVjLW7^{xaeF3uY926ofTHt
z6G{6{vh!F{YJTS&mGm^Ecq7U(DK!><d0bdA2n!ivqe-0b$nQCxf7XYe{mhO(KWfL)
zU8FmV*O`@BngX8)`;;StxXPtBGkfv(J^tikXnUHOzhwj8G3s<Se(!wFv-8p68e|z1
z*KSu{|Alwqw8L7VSRdt6w1?G?kwNqfvHFAB+?exH44eEd6`#CfN9`0JtYyT239EKm
zn#Bn!Zo68+U+xd$mp``R5)x<FitSRKC30e3L@aa}DV-Lq=NMI@;P!ve_~u%K890Q+
z-vp-*7frNc#=9!cIL(e<+^HZYheR_0`Xu~x!=)OUNlcTP7Ql{{c+B{SAvR4YhKbtp
zsJQIZAYzkjJds2oF50L6c%J0xLlh&VtDm#qkyvEwN{)&u&R1;E@%+11#H1Uc*=;W1
zjvF+#_%q=2(-pk=k&gG)SYb;rB29|vKB?G)OHa4sh4=k9<MagFau-pUnOs^nSm=zq
zWTHkQ0**C1N$i$M9NSYg|9Ms>;&s|+9h^5_MNOuKf4)h>X*Iwv|6qkRM=D^M5)%yS
z%dSmB>(f1lnp0);@}F^Q-2=Rf*c@h$h0@c^*9^)~M!VbfVEkZsx?G4Il!*Aw2eEMQ
zwK!(*pAZ}4v5tRT;mf_`=@^os#2g6Vljn$oo!W!ta|feh0?Df@;vh1L3;X*l+GX!Q
z$}s8M0lf8G3?^Po<vFpWq}E`iHFHv#iXVNGxZ{TcxbBCs`0j6L%nL-`OWNy1A6#;-
ziX^KdEm~SgO!DjuT5D-shOw}?8UFH19rG73oP8R{t8?slcQJ8uB4C}L-a|C-%m-um
zZGZFPx%=$6<Tn;&U&G3WT=Pf$?29c#!q*atAHUukD9hG&Pr4~wKEuMwsz2l{3-3bP
z_dk&cd@^<UA8#ZhEA?Y^dCtJTvxK!#ulD3v1C!MC<Y&x`*u5u>k%CC35_&Ac3WcbE
z$<t$n_tIB6X^sXG&RFvuVkbFHR<-0Qe!ZzHsPAad^(}jJy`hV1=ie?o|F~v7OV?vh
zRrSR?g3^=g-33H75rux|bE>2OBn4g{&>wqOP~cp9dufmeZLZz-s$Wwk1T@RJn(!jj
zzw<k{^bmXg<Dm5V`h2}#Py2>nW}3k$RX_VzUU~h)WxC!@)b-XzU3Xqdt7|e*j<rGk
z%6pCL&wr%r!X@;*RjNMt48rUu>w3~elHebCQe#-FA2<_viyuK{Fu=;2=b+%3>7raI
ze)m?43Ve=A5;B&2{s8ix9`i-@48BG^TX+%TG);@0;?p+l4Qiqfi??WcV;k46zAs>S
z&7I2iqDzRA@T>Z2qINd#Au5;pdG2om(qj&%>3YqT!lPBw=d9B7hBjSazLV?am-!@@
zLJM3kx+0+aHC11_i6|<f(l<77ed6`vdAFpv&c59*$LXzkME%k{&0DYQ*+iAI(|mF)
zPrK10=joHxs^%fGYt0T#E4zXy@JU4FkK@`ozw&8v9+qobw_DRzZr8Nzi--z5Eg-po
z^KSP`YV4KIRlSEetq<2~dfIu0Cnh_Y>s40=h?)~#ro>H=4tUD}u8;Z=T|ZfPgVOh(
zh;^dr?=K-rkDi}TRCe)qi60mBpTzaa*Lr08KV7S9O+A{ntwGZqKcKdqBr?Qkdi=Tm
z;E<_2`7l$#kj;mn_SIZgqxC3N8}C5wy~E{R6rXuJZ(&s=7btwP2xZTvqEEb<{)OJX
zfAF8VR@25ldzC^IxP{jL{Ph93zusG{>0LA~*FHd4w_cZAOXA6X?LeEV365w5aYioU
zs($&X@V=!JZ3>s3wjSd67SW#Ax=Yn}G;@9GZ)iQ8qRTly<JWS|^^X>-bf2!T-K)|w
z0eY6MSF8FtzxB#Fd1<z;`+S<dkk)PbH$?^~+S`=@{kn&Zy**>DCf0`b@6YJKsr~%n
z=zbo442p{GkFk_?zpK;+S3#uC6Z0XgP6Q`3lGL_kOQ)m$YJ>8odr>yGgeY;2qL;^_
zNTk`Dek?hqUN8`I?y})bqz9^S87{$2Zn$EXEPseZZyUoMGbnsk+qgy<)Be0!M}Ic-
z3lD^tnm5kI8JsIqXmgYYv_H)ZXp?>%)Smn}sMUXuHgrXgW;v7C_R}@pa+0b~yUnZL
z`;M-k{?mZ|+ZTwP&G2dVv+45;UAIjoamh%(zK<5!@QGe+={71)>d~xIHDdcUE#`b$
z2-zNeUx!GY=F_`1+R(#Dq;Q(CNNi^la!V)HyD_N87P|CBv<MSwiLIXOA{LMikn?Gw
z<p+omr+V`IdK-yXFxaPAP77-66jir=gLfSHB!>@7<rJbl^JktUe`IqR7Z79iT#WMl
z-b3Br7cAf7=Lwg7M(x2EO}p|>UTylznttuW0sW^BiBwgcx`o6iia6}bRsF>|0e$Ru
z{rbN?3+Rq-xoD$y>6UX;-EuBnFVOT=JAC@^sX=`&vAv0PBp^T8CDWEEG|tE-<h?DR
zm(m7XNJu>AOu9bWE3ex`YP$@s?P{fsov)H8g*NesZs~3<Sm~Ja#Baa0<v>ug<p;IR
z?etkl^FPt0vD1TEtT=4xdb^v-hIzFvKOxl-gj`Q?YwQfaW;>7immknteDs;%*S5CN
z^+DabGKJ>pG&6PH2wh*cC7@@Y8YCpF>glJ@`^QuJr}}j3IYPj#=^OU@^prZk*5pyO
z*a})}C-qSM0nIMnpDo?SwUqjRwz(y!4IV{p8SU1TQ#Fl|h)Ovtpe3J4Nczywi%3}c
z;<d=1cfL7yh6Pc@tkc<8byrBNiKsM&{SE&)v_tBI_bwEB&_ajPY1ewSC*Rey|NE6s
zzx{dI4>>)$?HpaROeN7(J=cEos8{>ZKQ!(4&-=AY|4ifW2++RLX^+vE76!HVm#TW*
z#VQ@xLES+IHpX`Amh*HyjznT`5Mf4ZBBs)(H@aw@6w!Q43DSDhb-6cl0{Q{M?8IK_
z>xiI0x=a6m%zXub9YykYb<aFmm#ickcXxLW5eOQByBzKua0i4tIGn>JI0Q>@3r>)D
zLfqXpS+}P%)7@WH_iP9pfh2eL|8BUw&AxeWUQ1PV`OijLBAQJ(4*zcB$cRg{i3dq7
z?ol|VGKMX9Mo(heAFN@=cN$S?J#@oBTBoGLdMK4MWKA>ZvF>(`LYj4|se$fN@m@-|
zljVJ#*LYu{Scj@o)*V0ByXFTt!t1a%)@r|XvT~f!GPC`ay!OXerRB_r%@xzp{&^6x
z#*YD&(TK~nGh`s;A5iyNDo>kwm9$%*j=`g9o>uy{T=?Vd04F=}AG(^J<Mb63fi@*!
zU>6O6Kp_ULVu64vnYSnT#-{w^9T7N%P#9>US!e>+V6Z4FQ$TGk^=zk_lmIgg_$|mt
zRTy9MAQ0yGn`uBDxgV7WbbU_>7Z}gNKpiT^apq?_QDBZz2+<Fd8%{t~Gzi%thqCM_
zH_+sDTc%fa4t{54#6mZUfI6gMN*Pzu*3Sq9Ib>n*F5=?9Q3tP%vie#mW@Xql-iLQI
zIJ|VDdZL?SL2oY&mX4`|pG`FmQ}Fj!)6=2*Md%OF;aYVtQ_(t69V4oo52^pAUdt2-
zafh)C^!C-(QoI-=#wy@v1Te@>l~9ZGNI`j8hl&<YrL{8W14))_T<bav4CZAC*jHgH
z=5)3I6}8~7(=EL3+Pc|PO;Y=~C{C=Q>u5zYF!)!8dP7c%3srI32kSBU;1smV4J4qV
zE(EzbE>y+?ris5aNI;ftVL&?pwMl$_2tS_);paUQ@n%%0V?jFeaNIUz;B#ud5Ywri
z%47slx@2}L-gj(B4JoK4C@u})VD{1C0hNuPi?|qs#dWBtNop_(be?Eh2nH<3M;B8`
z4URJdT|s4(frH;~1$B^<rE->5ytJThX`k|g?=4kh)}u4kS21h&3G>>B5jM=3<H3<N
z%sS*NJml_Hf%KE7dU8i1Sr>KBI^ILqQ-L_W2bcGKwJ%~9jXtfiE@J{in<YKW(3R*x
zY9@y$x(nTq(rqks3My_*gA@;{kuS5dkWXV8NKoT9Pz?aZDzj2K@|MIklTbxjLuoF4
zKB#$&c&7obX?Z!vy>XzdCaCKSlwTZ1DZc5h19d3F!??dO%J>QB4)3}@d>Dt3f^MAZ
zgr(AO32T!<Zp(!)xZe*t|7S#=-&{k=-r{NfbMs<#1K+n&xfgaeo*0Rx)_~O}2q|R^
zf#t1(NbT*=^4VwMi|flFZ*CeC^lipM!PTm6)*ukgw!*dnRM~mhdvw??4UyaMY!>5V
zn43t*w9aF2m63(Nm=5_P$1{;ypqzvyvx>$;x%C93c2p|A#aO6NA<jf2#q&;qqVV6L
z82)1dJW>&OxvEZfgbD_8S7ER%*Fq8&u&uTTT-_f7lIWJDCKyl?<+?zph62wilt@g5
zgWm%h|Eo)Iu<alfgKMM}@Np20WI>@W6u83D6`4d_8ns0ia7gVNr3AQ&xGsNJ6(lrl
z2?x}d=+9IUucPpa(Aa_+M*`}>3>=SA$I)jVkgA4IWCB#8Z@?Z*`UIYR^_}Pr=Nf@O
zyGxWV1e!JF=MgQQ6M$B@Hu;B;i%$@PS^yfIuEq&~9YjWob6xJNR7huNn1oG+j1bg4
zo+Fg3i}R&<P_dKFvcN}FMbYPrA1SF0Xo;@;OdZ{V9~lnyU5&Ow>tF?x@-z&cIb-O*
zS}KyV1qxq$PC(;Fn6;#IOzuHN422;c8g!qYBlIC@_KFVW>SR!#yOl8#?$Uf#rvd7O
zBtUyX_Xn?$DfB+Hsy!nJnJx-bRS}#&3Z%LOwJ;BwvFQ{@GQjcB5MiBrUKybni|<k7
zewHAvK`{!LU_e0y-e+ND5bym1NK-^A|0CrJ1Mp8YM9EVNOQGJ15-rfRxxKDy4$SGj
z5B67V>+NO#4I%ETlSU>~tABvgO1CP&;4f68fUal*5TB1PQJEeW4&^72VuC^ol5xtk
zky?S*=z%`09`THYd|8z=#floSNf)^p{;ZCZ!ozXzC}c=`X7-Q@upEcMKBUP&P(XPs
ztRdFxA=C&uPvCdepfF%)d&YbuCViiq^j`w6PvD6{<vX>WiHo_1rYb2at&c8*65e^`
z5+<5LWM%hKf8mqpR*tdV<94dj&o;srH{k2nb0{BD2SsYTO4+>ys-~=i?W`J(Fdlih
z0z3foQ%_V)e=K562JeBL3;MyHk-LHVe=lbpRP&v$L0;oduqdTx{eaXu=*&9D7P1t!
zP0mj_1^&ZP@kkBSp}Gp3Fab6&)9-?mkq`+$o$0TIxALnc33!2E%sgF>LRd{cf%}+w
zdQWY`&-F-V%m=)s;GL{vOs1f_%tJjf%nfFxGS4v(T1o@p8lk}rd>Z(|h2E>Ndoj2Y
z!r-Xmw;u7?O8F388uiKcEB>S@RyeY@HB0eBeO$<&i3;H9HEh9*VIHs_v<qc7i$hQE
zXtuoVn`$Xb@kelQVCjHQV7l<stevTn(~v?a^n9o~@DC-O|3Ix~q^@YxZTpqR_|Vux
z^{|uNqN+~Qs(?s?)tAKMUP<(dSRvHi@Q~nPVJhcL=`5(E?WcXCCYQ>M!$2>X(r8D7
zzo}wotPBI0)Jw*|+38$uG_P<RWYE$U5YSbC`N(-(KSF~x(29@{33840rTmr$8pwr9
zAJq%PZv@2TX;n`dD}sh7OmP-9*rH|C6}M&%<~<%BI$XDQq3;y+n2j_DJlrEWfrIgh
zPc&$W$&x*mm&9-`dkcVKQs*X$ca@KaRKUNP-;MBF|NZ|ZOw816wV>M2Mkt;IYSss6
zEoKY$@QWDu&O$;+A~i4(&{#&?0Eg2QJXBPaaP|vPzg9#4CPbuqtZ*>D*nSL4IuKJW
zUGB?66iP5T+)9}WX;Omd;M7Z5Z#px-;?p*z3=&0x?weDe*H3L0JhIF@+(=84FNni#
zP?93obi2a5zZg}ABGZX>)-1FGPHtu1qWoSccs#5mbe^Vd3`Xsd_d+>bVQNy&WP_xt
zc>6MB>T+#fO!1lCedz&+&Z`IR+^^Ls?~ThuWbu9e>qj)ugI$&-3`5g`Bbjj511rnc
zx!x8vk7EZ^#}T9K@l17Om1K6H9_GpjR~wm1>`f4i7V|2J2PHA8r!lcp1Dra^jh$ez
zhK+4LeynTRbgb+8a!c-?F1k!*8A%7uc(tp|apm750j4}cL<g;XQ3YYZHq~JDRc8vd
z47bc<f&@Y(&LwD>{AP9}Cv+dzYX0)^{HKB!Wi2YP=_7CF1&`lB!kagH_I9>>!}Th=
zG3PD5dJ%@a)O)}A{aY9Jb7Fm9NZnhaRO&KkQ7-D0TR0GY&f6n23XR$)2$k7jf9hwL
zgGm%q4!)&WscW=z<pV<_$EV@<opgc)o!W5Tr;Ed7IXbyg0-S|Wng(s&vK8k;`T?JM
zg3TKhP=YnrucL;?6}Nd|W}J^4Df#fBk~b>E%?RKghHU+#>;P-p)aFBn+kDVKn>TNU
zuLW%XKBqJr-nld50|qgE$_bnoG)QtKnDL+JS|C$VD)#A0S*FU+5fD6Jdo&<5-rwUG
z0bU{@M2Ed!g{k55NLkpK&<p7mqlp+WeLd<S!qN`DspuPib|`E2!$)A}frxuo^VW0k
zB;n25E_%evZ7>Z)4rfi@{tzbb8A~+)@L#+vS!yb~czwl;t1L^Gw1TKZRfZdpfvcp`
z{M}NY9m^bDug&%w2zqsN0T|N02T7MR+E4mP!_zg@<^kNJ;YV@as*TGB^`R7Q+f~dr
zYskW*))TuO^tj+!mm%%xD(L!sVH#$S`p@XbWR(K<%ve2s!y#NtR2nLz&RSuWE>!^^
z&Y>5#nmu=>HDJ@p`-Qi@W;wj$PtQZwZ-(O-l3-300VAFa+pRx;1oB2w`k{a9AO3YD
z+AxC)J5)h9^JO?^#LuPil-oGC!x{(<Sq#7IOKd}E(mLoebT!)Y|M4soO4HZv+i+N^
zwF%hpX%N&(fKR3enYW#3pmEy8fQ|mLC3P_GEym*O9k%s-+{jAwplQbA=G0$R2QwbD
zp%KQMUcL)sX=&6%ArMSUPkfrPdwOr!_WIZ+)h~|E_uf9Se?jPyoW}fuP=N0x-w2)U
z1ZAI<h{ESD1Rx8A_m9s6z}sj_%t;7ykpOE~EsjA#Y@P?-JV(ua@VkSywhFjc2aVB(
z{v^6Ldo&R2?R$~Ax1%s1ttF|Bs22)vc1A;0Fto3Vqf<YxaeLMHq+#^BYJAqoklC>f
z#9VYbjvCEF!~6X1gBn?^9=D#fMsKwPuip<)fHB*zA6L*SUAMb1W$?@au_y-fXW+kg
zdaz`Mf)rvHi)&Na=5dfK9GH*Fhr7&y)o%xs+=lU`pr5wvDO+0hs@Aa|N2c%Ia%$Hm
z)@gmZ>^V)Wc>LtR-d9gl>mNU<U)IV~c_em9=8mUN;yY%XWNm-#1Z&%y$MVvbk1dFQ
zbyDx9spmG5_PKekeP)ley;J4J$Bz$|zIF_EW*iOCS10AgUYXe3opE$g)hoy4l)iMl
zwd<8BeEX{>vmGy;XziGBe1m;6j%`r+(&W6#FOSWG(8aWUjG1GU+bAT~CfJhqY>2HE
zu<0Y*r`_c0v5m&BP;l>w!ul_f7I%5D68AfS`=}3d?T@AQrPc7m2Pxpp6)^8L51h@?
zl+`n12}GkM2j7c~3mP+4)Rei>Vd18^GQam=y{C}qq!J~J2T)q(4k?CB@ZZ1OfCh*s
z=`4#Q@Ry4i^l!)DiEFu<G?3_48t`vIwOSWt?>wYfi=bq)9|qR8P?z><Yl&JRh-J0#
z!|MzJl@Pq`{Ll)y;MEbqO|MQ$+5FnX?Cq~k%B+0ln8~3TCk?0zo|@_;A0x@4=Z%&O
zS8-t5UHI@742Eq^z{)rA`?h(yu^D|gNB?&YYW#CvMq?5ck6HgjD}WknX&6%+U&4W=
zsRCZOOF_>@059BYgS-2XeA0ZHA27DEPq<V@vd*Y~-Q?$^#*@|a3?Ad%{mdM$yGd?q
zlP?;MyAra$F7T5R{tvTIii%U&fGBe95>sq2!X&Hn{5Sr=hPxXNc)u1nR;Q8$ynDsd
zP(QIFJZ*mKN*|3u)Zwnmo|qI5znj!a_%}Y0lo&XZO{O{;K!8m|XU4#oyzV86G)sBu
z<E~C)JK?s3F0$d{@%ZkNkVoGbl~oZ>UjJx9R>eGd`Qr|y|EZi&@p}&T{izd^vtbw-
ze8XJX@MKTEHP4m1Dy4j2rYGy_9NBED0WqNTxxC3q`Hwg8*-<HPcp@gzbs+m(f@2ts
z>c?nLHajCG-~B!*7j2O8gSkmrT#BDLo&X($OdTpK4?m6Y=RzK91d4^0>&EFn#wo4f
z@m?htvp$IfG_+|4Jzz8cp(gTyj!q+lzHxCJu3b%ykhi=fWIQ3|Z7-m|V;DN7Cg6Gw
zjmY!vOUQ&P<kb%)bV}sW1jsN%ueGoSM#Z$ZTv1Ui#O05<0^Kj7%h{AhM}<7NUn7&M
z(P`>g_#e4OoTI|&6Os;$bQK?!6xQIlxEX1wHYVj&PYOx!AS14$f-OA0#=0VFLR{Sa
zjw7Rvls7$#^Ak#RJRj#b5>2piLIj4^i5s3wiqbkEu6j5rkQPP9bK(N}Q5K3TLdPjt
zG@>@|Aj8?eN337e<DGY3YyR>JMjCuJhV>H%RB?X$Ur62kIjt^h+&fdP$w*uMlcMKk
zNwKFwh<j!VQG$E>>Q^||agL@57~;tj?@Y)@Qt9+uDx|yRd0dm>7;!?H0Hlc%?{r1f
z5#rWolj_+|lb`+G2!>rSzoSjxdz4G*pE7eoL_YAbl+{rouY5QmlW|A3J%dtoDRouJ
z7H1~q%(;#(;JNp8+`EWEe#QHv@Pru^mrYMc-uuRrD|RUH<`=G5yajzM-R4i%U-k!C
zC`VtUdO^oB1)cDe=<LO;p17Ay9?G@*mj0dfjw|R=7iHZX!8;f0EELuwI*)ZnUvGy<
zIqQn+(|_L=aD>-kyHKolRcB&k^<hYcJ)YM23Fzir0&^hAM^!wa@=qAAs;qpgU)k$W
zw6#4<n9(>eKK`_FL#-7{AIJMA9;d!3a0JoTgI!iOM#FHAk{A_if&t7=7ovP=&*1B2
z<Wd3Bz)i<a`gffJ+xIX?!L8Vezjy94SrdeE4j6cep+}^yj>AUOmTD3ftllWJ&sRo+
zX1qEY?f)208MG?0YAJ$7zThZo-A%GBc<W;iIyaT@!9r9KsCwL1I#?4+FldKt`Oyy;
ze`*qdAJ?O@Ng%-J212VJ>MCq#-H5^4pE%H@fdw<Zk&sGpR^rDTRBI0#%weftWvRHT
zTXq#>f45uz`GpC3$@o{_@V(EU@-su;e$bM7kwM*=gz@9!KP&gvK@_#^)hh*162{t1
zwvI25cFyfEv}tU^u03cDquIKtm|@V)(tDwsMx}-z1!dLhZKw-mFj%yiT&1?&Bf3~H
zfcv?l${#!XnR$MTiGH1feBkT9b^q7T`}H&b^?l2?SBH7JZmFkq!!ES9QbQihUoD{^
zC9cOGiBo`%nhtUxpLo+W4qq>Dpkby5UoWMPaFeWLktaNrwQa%J+O>-1r6@LMIR@5{
z&nYW{-o#u_Mbk14wio*kToqY<qD=Yjeg98`c;3ifr4qaP!hR*`KkY*K<$ATK=@Jw)
zcFGp0mee&Cmj2*qOXBk%B{hsQ{6{^(&{b58me_)MNmUh7YT0^=FfNSy46nv%9&F!%
z-%!V3O_@wLU+3qPANYe;aZ2wjE9RMob4Zg;1bN1az{fuT4DJN*`Enb=#5<G~g}hmZ
z&uo^<;pI;i4C&0_op}mUDfU6*L+@L((t&m@xq9hs7rM0P@Z7s-31rGcl2hxWvp0kK
zW<17o)&*?&6Hi;)4|dy8uWIWvR`h$cj_jmzBKOHGscS7%eDk>&7nuN7S_9>-o1*q5
zu7V@H4nGSeD>#JL<x?$DQnKP6ygG=Ei1}Pa`b|*5U;%TiFdlycq3Md|P&}l}E8BV$
zH0+RyYlzW-jUyp-)PGbX;5BKfkVrz)PBs)Zpfo^?X(Rn)W(lZ^fvJ+jb1JuhLyvAY
z4FWo~V32{#wy#o{R+LB+*=Wd29;zr#4b2*%$&X}GO`wYSuwY8~Uzy+z<I3B+`kgqW
zoQ%QEB=i~1paGIy1{!v`X-xNV*jd80@D@>k4!sl<HL{?*lzRLKXo$Z0@(4HWENjtY
zjUmR=Pyh<D$R9|JnrzrxEEu_0sL~UT_+pk^3Xht9>zsX02UOOvO}GMRXkSXNxxe=W
zt2&B)s5HZj!7vQ!qjbQyb&+XOwHpsmnM~1P&=$>bjayofiJ{Tv4Lu0snpf2-ZD?Y!
zh&3rdGqoLu42!YWO+e+NJy2UmOKh98O=|n(C4A;NF!=Ucfw+SO=a~Ba`@i?R1A5ux
z)qZ%k{Ar$}{iV{gpj9&lT^n;$7#Ni0b12B5Y!-5zVEiLtvli$=XxALwCXoO%Zs4%=
zfTwnsVw?a^H<4hhV+Rj9;WGj_#YXuI8fW0)pVZBA@GH>V$KZBGms(cy3H;s_fVG2t
zAnN)wLbRY(k0IX+{Tw_X{cl~YKC-CYNt+rrPi5$GL<)mmJ#bLC$qfnwB+($N#rY+w
zanm!&!6;!s4@Q{Ks(F!uTx761Hvyg-M)H@CmKTI(MJ9k-n1}0<H2odxo3-lypZ2rm
z-ncR#wqc-{+^4EesSZ7YtYJeN>L{*+&rVO1u&WYGH^@4Gw%sJ8<LixbkhfFt;Kc*B
zq>AhGRE50PcbE%V$OQ%2#QPGmQL&(^S^s-~PmnY8@Zb~RbJl0eIn1_&^JDL&nszp`
z-M9g}*>DwA`}TYR^V;B1jZ3ki`vz#Os-QtK0j1r(h8;Q!<%j~AhpB<j48r2Hi)D&8
zLZ$FDsHzz!cQ(BeT1*M3MJ+lrRq~?>C9BnnW-VdiabLpm%~z=6&Ml#K<8BaD-^)cE
zJHzI-5jbQQ%KlT=u0MUJ;m-*4A&r<e&7Lx4rX@4b@fZj~O^F9>ix|8$hqF%YP<#E7
z=|)wOnXHCr+=4ERI4oErp=&D+vzK51&GNuBg_jVCDQK3>U>|yhS`>z16Ea*?wa^&|
z@eF@qX(JE(0SYMxb;=STK@?+9t|=Y_vllaH-<reBuSnzaOg0KWXU`T19h+P5<tl(S
z%|h_$A_u&L&<*tHpeZiq(58t6pRWp{5DdZh%PEjTDNQ;^8$6OqOn)7{K#woqg8c7#
z0@TBFVL+wN*Zr)9&%FqmZGNv*n7aL?F%@)-UWx}!`=%*scNK$Ht%I;;tAwg5N=b2b
zM8B#;K$`*yUtrW@P>&$|xE9xd8ZcA37{zYOCA7o6`1mIUy*hFB@qAaO0_s#k)ZmCO
zBf?38|8LhXh5sfL1Ody`s!=vWSp|oIodc-FF=*Q=1wNXWgm@JF;?!{rcc`Km53pu7
zygL_Qc&{+Lg_e~5kIE6~{$8}uP=LR^)Pe!s12FSDI@n-;u-ywsnOd27FdnIY-L<=|
zeHhyO*co&<korka^MbABb>;mwJnE<Q{M!qm_n&;Z$ZzDk?S0Wj0s4K>#nWx##oRO=
zQl6~^VLrx_LKu=Gq{N7@psdE-KU!Lw<~cT0DvNdKm<FqM2&f^k<ryEgTZ<m34h()o
zYi3Y?8x}-=L%BSF@3!o%Wjt(@A4suSX-N<|G!MeNKPc$jJ^-`kBz04<`i!W(+wf4u
zL-+M>QNd_r!$*taIzw1LEhJ(0?f?`PC^i=@$pSnGeq5rPY#oZ6@@Zw7Eskz=x-<U8
zvtWNgoaP-HZLF5Cp$&esmbWI?b_<llqHqdqXEpF|WT70UHax{>Y0JX3s@Kz_A#+%{
z9^`hN8iPTy$X{SjYQ7dUbAW!x?Evaq_Y9G%BCtw-`Y;B{q`mZoQNlTUHgmj+0Ueae
zJ=U_ucD==#w=BWlsS2hj?xnKqfGpXOWb?K<@WLB53?3-p(Wg)=XlXzOD5Wb_YQb0Q
z9eDhC4(FZa!6Q$4P(=bGU<k-V!Tlu)n({fG1|;|x|Gi^djIp$I?SVMh2%~g95dCIY
zYQs94&0dp$_dm1Y>(g9#{zVi<t)<>ij$W9OT@2>$aA5ij3%YlgaP$2F+)Oez(}AZl
z*sz|%cbgsfZY6^S8&SZ`Lc!KPND1W3Bh_Zj+lQ-#TVVQ|B9FNzK+eLK;WD)XKEl_R
zDwWRT{bNN#PKSN$JYDv?{SMt<_g8zM|3(E<abXf}D3j*<RW8h4VXK@h#XesnVB@w3
zu#8+fE1-Ix4YQYf@XR|l+;{;xW}bFnUkx%8S{Dot)d;S`w|JO6@Cv%1+Pm<Vr!c5X
zfnGYSqya)GEHBL13I8M4W@`QCnpV1~oz?8*@c9ZC9)1J0?}iL+eI^D`MQN+4Iv0N5
zP8+^lpMa;|vSHL%1y8;nV_pt3bb$0$x+@4@Z*btrSA)>LqX&0B!3-TxF1^l*PKVk(
z>kl>>aw#yFGlzSn?Jl#r!y4gzy9HWMLP7H&uMG4A*6vb#-&MM`#jKP40<9yuROZpp
zw(h4}ma@2;kkyLacsB4GA7t{b2Nf?GTpJLL(t<3A6d`Orcb$MIKKIz-%`QCsSrF#W
zjf2%VKp+bWRS5WQi_6wkc*;eM`@7dUtik{=&r~|!+rdNflb@3C+<Rg8`*jMw{o(fy
zpji29+)KGc7whnlP{lhq`(djKFC&W_f3ypaKZ(jj5j_IeJXOLDJQzOT<iY#za5(W8
zfTy3v0A_Pb-?z|GT#x+r*-E78uNnMsngw&`2(Su+hp}$cJUrz5f8XwZZX|ty2XjW!
z9|yt}GWaD}gmDub0mRy23WWOdc>Hqed9r!J&t`XTLf&~G2qlF8d1tzi?++j!c<!>t
z!j)NrJXrd%^K<psp<VX)mqrV9_E$=HGDIo4(j})AI9320lR%<P-B5@_Vrvq35gKdT
zBVgfaEWmfV;&AN%(<w@J7WLS66wBc3XM7-T@{VgLu{UUvN~NoXsuY~3hwVEepRsBG
z>Mv!=>i+SIqVdFYkV<7B#F)DSg>K^@czbXRg<Ka9)W>b@kPY5$1tHYFk~<^78*ngC
zVP;wFAV$W~_)TrfAhs<DR>OdHe^a2`wyjz>en$hCb9n0)8kTq<>DkvnRV)Uf^f1KB
zD`7)HAs>cjT^$C#JSPfSp$t~H@pieQ{ofAuoSgI2gsScCr&PnFbJVH*X_(RaqUQju
znRGu55aqiakjyI~C^2-2P(O20CJ#un3lJpPZbGZUb=v0<Dvi<rDt_GtouGL#@M`%F
z>@4^nxN=WdnYC52!o&C_CA3q@pto1BK+`a|WhjKQNiV0AIi`<G4L7%oP=5lr-*KED
z-8KGg`Uz5{?_OMzLJOQ-b;ux=NxbBi$%;s|S=z>>1$7$_Qi<7P&ka1Q=ssDKj55bg
zg*?ku-?I=OtsGS+Z5EH#sH}`^7OT2Z{*-$^{2N!!Al0QhOROT%Ll_q5vxm}hbo=0(
z_mJC+5KJ)0qY<eR<d+wWXQA|oA}{6zO)-w-`o4_#8HYA1NfC6tAzhF%pfj5SpyBK6
zynym5l2%sh@b@+EvEgPE|H^l%Jzne^Yk1BgT_J`#h8@B+*Sv>3M!Z!R@YmdYlzj0z
zg}7x9+?@&Jt)M~1@^j58wNRkL!)}TO#h#?%O~Mw7E`D14(Ek$nH>z2!PID%(WY-#R
zOM`j8xY2XpDd->l8us=28DzZZjix;B*c0W-`yM^iitEEP$w!)+=boGLS;2$^w2tKY
zCkbkF%;m93xAGQeuGeVVRNXfR>3SA(A{l2d;b~p&@`d-|eWw7Eq@&$u0CiSC)#0i;
z!cnRoNec<zL4T~(G^kUSphdbydN(D0QUjNINwi)Y1kgc-a=T#&J;794;OBvB-zL5<
zl_?fLk2sovJR^XT$o2sqV+RlrQ$PRUm6o|bmlfURilfFsK}l$mitagzU|NQVn8t90
zU=u=o!S8C63epbw_x$?=jNDLZ$SoU#oQl;u0Ob+40ZZ0?`?y{G*$5s;3v+M#G_XH8
zieBfXtHv;~^>MI5K`XL)oUB<f{r8?z8^Ac6G-D-C09rj@rE?7Q2%UFtDoRbj*rOt+
zf*>*#9!hAAGD;6rra*?$g<bUV@<t&Y+(m{n!b|;JX{iNShW!5u#`}wldd1QBbfG2F
zm6`<QMpZjj0r!;zR0yPoU?eCoWi_^ST0L(Z#;J#ODqDTY0YS>q=cw?6H%UjuJ8Yg&
zpX)%iDTTjNiCI(mimajFSctP!@1JVl{O<I!Ed8Ljito4!?2NFgTHa6AR=ffK=H+M?
zfR5QqO6D$2;HIT0wJVDJXKTPoML|M>FjFDL?0nqY5Y9CZ>06l|>Qu&{i=Hw8!svsx
zQjtfpgGPAMn%F*GX(90^E_4B|M?xIXqvuyVN3Udec7N{mPaO$yFB;nhf3|6c;Vr$U
z^)!p`YZ5keS`^l>9tP^o{E(}aqgzm8`xFIDfgV5Hq=BCYT>lT5(&t8%o8@N;&D`HR
zhS`O$LH^#3{sc_XRc5;$DktSZBfOQVc>06uFa<dJ7urY0+g_VXRE&^h!k0q#&&WOy
zyvzD4c}hF#P@KzK&bt+U+R`A@GTD~5`t)AMP0d%;)&M@V?oZJBj~n0|c%ima??uzd
zq`Ij;y1glPl=<aSewmE<&+!bj5*UzLBcQ=Yyg{Ec-j}*)fa&5Ay@{qcg)ntMRm604
zpNuMveN3CnRjR*E|9S$eu!Q<9BILs*;Y=-0Z5`bXnD5}`J{9W_ULplqHS`+IMW=1}
zgp6-;U8w`H(yxB5N4*EK=JF34k%z<b3ERE3NB_XmqPwIj{{q&WyPW)W-uiCyr4pYr
zt8}-wyz7^+{p5Y{d-NbE1;h6_DpNTrT&6*rHL?4cl4enuZf)Wvm}y3#>M2_K;J-{a
z;wKlQ7HTB;>I<Qe1IeRX)`<Tne7OIyOBZ4KMx~D55!1Vr^R9H2Df8PQ)FX%}Kj2Bi
zP4~j7N815&PzkC~b-4yeru=fsLNf3&p#8#;9Oqzr!C_n15?DTb9=A4>$z)<SY#c=X
z77JD#w+hO4exX9Kjj*QYVvINKhJQ1^IFLnCGwmcaMyoKDw_G1OA#@4pnKM&}L+?Sl
zAb<vCvOC!RbBJ2~VqiCEFhi9tk^^5u)`{er|GbFM04prjItUz`;XxLh@0ppg{d+>%
zzUMHVQ%=f;W%~*m^WTT=JwbS-y3`hY1SAIaC#zPJ>PtXPrS<{A)5FrfF`zcH6B`hX
zLL%HtMBPz*K*=6BYDyOLtGk?cEsH=RhN0EbpRs;rJ1HK;y6xS=c-NV#JXXtl)q2ot
z`)vS!4776Co6FOzsUC~oh(~5ZrPkd5q2aef=R5FN4&3TVcQ_NSrP5mc8N#{kSdmpE
z(>h;99j$RQ`>0s;eNeM7<#4{w6V&Mjbh16i^(-oIb<nSIj_V5sM!Jt~NJG7x8yBE}
z#(-o|MpD@*$(g@_T8tzdj6P!+92u`gp+Hk!p=n2QiRzy5@nwpicXk?8ZSzx)SKKM)
z+yKo&`oYHMSI&c0n+Q3_b)Z>+qlI|$0?(L?yq=H<!plVkBL))9&7xdt<x@}OToV`-
z95l>H>T>YrdBW%&bnnQ-nJ-a44T<@gtzb>R#U|IA(gmLhz^eA2%B6*Ep!fcKarrw>
zGAgLnT68HhWQLLu#GTIx2}lVF17D?CLTPilK^i)-kP!;P2Gf!{LNTqwq98{`F3eJT
zo=x*S-4D8+92GvZsOmpgEAa1LJmBN*nTl-C)Rg4VFjs1YqG>MDA04*ftKfJtse}jl
z=+{;##2cl#`hBKUUl{=vPvHEKPFxF`G$4%BdO2gJop$hAOuuSR1?AEX&0$scSAP3u
zp+Oz?j`%?>NF$9rc)<IQ_zI-^J#eVH6dA|DQ#mhNpvw|i(?Z=E41TVL6p+p$5Jtar
zHgZf}h5_tGKZ|jVxh_lRF$i;^(rnUV0=l}EhmZrqmL($G8aE78pEy3X5K@0{TuO{G
zoM}Ql+LKBZlnpZzXfShVRfN1n{&7uGJ{%wJNns``Xs93+raPJ)neQE;LL@@eYLxAg
zTODZ<MMA{aHK)PhU*68rKw{lF_^*|g#W%>v7uUcV^rr=*pEB5V2H2?~Jk1_bwcE9u
zP(@ZxMaSwhjHRZt#OhOFU&9v;<!cUCfCuDHDd$3TMJtvT46Ep(?yx9j1a!LHQmb3%
zbG7$52-`8Wx?wu3$(fs&YtMmI&C?-Nv)kg%e6_S`CT#vJayVaT5z7<rp#Q9M0|6i0
zX+wKl^A~SGb7)IUr!rBBl0rtvsS>c}xfICR!{LX=(bu&Gt-TOcxRH+=BPm-Mtb92G
z)FJ^tJ>fxe3Fur=l;Cz@LGr^;e(2!>OWfZuhu@W*;D75ntn{|j(#QYqwRT@S*!Yx6
z(@<j?Bo_&%5$X+}JrIH>aSuMb6^-QeOba=Zc}TZl@A6>9>*>H&IIw&=(lqK$Ve}<a
z$voh})2$(g=dVqL5luaK<$5#?H*g~~NqEdUQb@H4uHALZJ<$HI?Ts6Yi1uO^nt$Fh
z(CO1FVCho#kDefg;38L;(}b#5)e-@79}ly@W(kWPWsp^CLm)+KQph+CQ*)xQ`gt1?
zOC8wzF1oNbF%=G*&Wu_sUG2i=SI{E)-i7rq;5=6`2&Gs?Yr})OmdhiY>wo?Vhrpvg
zh|EvQAdj`eAm;j4k>%#PuoZuMYbj7|8-)T7VS8&FHok@y*vdGpdl^Z1Ez^~zN*~!C
zs7*20_(lliN}4~O2g?Z0nE3$K7#y$q-BwDpHm=?L$-hJIl^yh6YLmN<3oX~T=S|<G
zb{7AUhH>GxIM^hCKBK>+*nz2|191L04p$$g;G&7RC}mt*lYt<fazD8+>+Vb_j9M`J
zP6;hAXvKx@M+8A?FtjKJAKjD2@=BHUw==EMw5p#jW2G<M9IBpmBkXzmde}GX+J22c
zxEhl0Ulm*L-SOKa@+I#2E==Rb>&jQ^jpISeUgWJADPV6#-g;a@as}u*3|%shywwz4
zD&Ien4!PwDKKMrpNDMTSU?)6WStg->3kA>qIRvAcDfZw+R95eQ<uo|V3s39f>&u<x
zeP$`Udao6>_Q2{hXTt6#N%*nhR<UZ(`z%GFcE0|7Sl@S!Mz7yG_D5N<_*=-sV{q-D
zSx}rpG5mkadOG+uL1pr0<&Wyd^7UzcbhWv<m(}t8ss1GPYfuHP7M}>M-kJ!9b@`QE
zC(Rhg$0*hL{HUl(2vJt6#IkKdCX$|PduFYKkuhDx*#6wOTvzOAn6CxvJZj!9dR!V8
zFih%x-5FyOa%;IGt80aLccClj{^VPe0(uIOIYp_0Q@0lW!GM0#^^-Gc_mglGD&a$2
z(dY7{s7x4$uSJ^$b-a>8u1IQ-0yaj<c4sE!%3@bmR7?5g5=S?nKk<&30dyEGWuI#?
z(4Qax1R>Y&61wUC@M}=5=;x@+lT`T;G<~<~*O3iSE_B*-tpB&sxZAHh7P`sg0qcFx
z=jS}4CfbA0{-mn89#Q%HR|yT3_URI#tLkRWp{iC-+Q(rqcSuaWFgvcRVQ0*7BwaT=
zZ@?6+$*xGly;!}^k<qx4A1^k0b@qJ*T!W97!XD|VHh)%+!~e+D<_Z<c8HMKXa92@}
z>Cn)K{Bd(!IykkD7kYZ1u6-K!xxWwZbv)kR;>prlA!q*R>id&#jhRZ#@k*wSh|75!
zajzpne!I%-^HDeB`t(6x#b{5YjdMkl^AFk&oa^ioyjT}E4uhO?%*)fX#vSTad@=M=
zQS;jG@9Dv>pLw_GpHvrnyi2{V#gx0FvJUrp+g>Smmw2)|?#aBP(HAlfRo5P#{QJ8R
ziSZlx-AYf!5>n1zo0Nh64$?lpr;{iD@=Ao@=fp<~l4{vTvHXw6G2);QfBmPaZfQrO
zMl=R}Hp7KzJ~bwbBaTeCQhuU&%ag|t4BlX>?3HrB<p~YB7De7%y3Wznvpvp@N*IXy
zGB6>BTwf<^6H@H0^2Dm0p0~Z!Q&#`^PaOE2hjICSSs&o0^O~Ru2GkdaeQW<*-Kk7~
zh<?+)cAl9IaOmm6e=x9%kkP06+8HgT?k`M>YPy?|;4a2zRH1e@A5AvuaAzir<`1iH
z=yE{%%oP0htUquDs9yvOLz7-PO7Sy4b2fPLmg@oLE_C4B;~0D5qYx}xj~YPO)xL1K
zEev;}#=Bt~p8Sm&EMKS8r*rXS&H>Xas+_Z9M|#j7!v^yf3TWLvpdNV^sk<ruB)}Wd
zv992&>A5v<n3pwt?ej9d<9WI{-A=*&dV>cG7Bd*ppTXzz6)ak3gA?*SY$X8aO!0I;
zD@1<9v>?3j4*CYO%?gQi5+1!r!b>j;xb`XwZofYOyIlb;dV&H0yFB?hFE~tJ9Hb6Z
zx5es8?*N%m34w4Xk8Rv1H+5*r2f0<MR;Hu*8?nMX8{ALM70V~TbkKR8rH+=nypK?o
zl4KABcP81APlM2FoCkB>55lnHF@oR8*1k>Z9@s6<fm_e#aO?dN=MsPmuNBH_V_{rD
zL9*I{(VZL^*PF2g%a!WZlfzw4;m+rA?H@&hng^<u-k)65_eS_1xQeE!)bg*KDmREa
zHrnML;ZroNg>z2MhPP(MVB+zq@K@Y7yQOh;C95Qy*vo~64F$#<EhuUcgh$`T{m(Fv
zZlYSj(fwWM)||u2jS^ZmVd{~WL1$3uSa5(V$!qiBlkBSB8V~P1_X-FOdQ?W72<rQ(
zETeX>oZFy@H88P9#Da~en>}O(Qdp9oBNnlj4{ese5>n*%oyKI=lxXkTeSsxbP)cus
zWOL@(F!=-r-k%kOlm5h^CYyrp=ySw?z1*CDrC$W0_lOuQ_%0O&4ad23MxVG~+9$3y
zOSS473kDqP@;e`}*IYd@&_z41sVHt5975q${WzIwJjm%$oM|mnj*{e_6MKN2FxG*_
zt%8uK6A)EFnDv>U3S!-G&BF-K12;<ea;}7<hbwsZ`v82u2*;F~#IbweEw|x~SA**I
zzs2F6`+{)EpDiAfOP{G**#A!eN8E~+<+fRnQJJ-q!O|(@dGM{OI~er5y&;H_8dy;n
z(*e0D__GywI8xFiv7vDL5q{s#U%dYx-FAErZMGfdFP_mt2X1ZyJ=_ZDRFkVGH^SGz
z+dX_C>%4CEZ$0PGuV0oi_nq>?c<7|mnGYsKJTAn_EsjVyo-D8PWTO+~5=Nos*SlO!
zxFsrGJpEU1^-#kVvbe&LO{d~cjzP_4a8mU9Q&jh+*to-!J5W=Px<Yh6uSO8kOJICF
z3dc-Kg(J8cAGh>HIEs2fB;?e)4OG}7v;Zp6QrJ?G6j?{rNHz*NzE46<_%ms(LT=tI
zWLc%BVY#|oNWB<HgGtB>AB$^H*Evg)vM%b$^*GL)vH02HNtJnwJR(Rn=(4kQM)%4g
ztQ&fzJFLDC27cF7zut33C+Jss5420f?XFeBp?$RI_a2jdwwlbxI*N@GT0`838gv3R
z>}8u==^+!{@B)srr)MD3E{MrGv?NN=(pbKkfNEVi>ISri2H|NmT8Unl#C6Y$O}muX
zQ;s^D^2ETa@cvMg1Oz}mN~l&RZF&g)N3Ov)s*La?*Ch>{G`hZ*#$-+0z=Lht>Bu-n
z_xfH!`{-(GYs_C`GLG|KwAPc`b~~~L39rXRQ4OufMk(3%^0<tmCcA#8l$-Y;z1Ac}
ztJ5)hH-x~kg-AU{h$ctX<Q{ZDjdwSImTz}sUA+kOj{gJNJlaI_OY^_BOzVPw_ZIPB
zo8_IM;I2QiDu3hhdCzYZQP4+?WuxN?TF1rxAEEk+(bvxwI1&Sr@~uU<-<_)^8yk~$
z-<bSnJrXazzGAbZF#+#*4SBOY-X9&4R*$$?ye%mbsO2u(;Hvo>+&xpK=)eFwKpQ;-
zd0}{<KOQV8$6&;9B+^vxq!@N(4EbBgZN*aVE%jtA?n%qjQTrc;8g^G#p8aq_TY@XM
z5L}y(<*1G4A4}FT{<N);mpoi6y`+*~EJ}(f3Ww=mpx>y=yr+L&lf%0FbZb03dU&sg
zI_>??ynH}!q9JGz7k)Ha|1m}B7@OVVtMNo12R!EwbI%Sg5L!&jPHXvkp>msc=c#-G
z<lasgeF|F5%(5b0XMA=p#8-8O4zJ`w{wx(7Hm|Fda^ZML>Ch+G`tvT(O&w|_9q)aS
z3bc6?{Xi2`XxfY0LnB5&s7?RJGKzXnOWkL+E#id=UcKKGQS_Y5b-<_Pcm-vNkdEB5
z>@duJF;2a~Vf6U`8R-gooXBBcZJPGUvNR5hzOrD?UIA0CP`YNk_i-+)TE{3Tt6Z1!
z{P2<aoA%YXQfCV`2&lKF1C&(bnQ@Lne=m9(Mgi0%E#vpiWia~<38gg(CSIw%chGH$
zfVEp~(<7vz4bMNNbmr5jD;WC4E$A}Xh3ceD8oP=)G5~Y#ILtAk%Vl-5Ep;n$f3&h8
zZhPA{!TjN?fJ(2Iov{`jtt+ftQR=PA`3^Ru75|=#rq0H&rN?x}MKr?T;WyEinuk8a
z&lx=Qu7LX=#5opnoi(|9Nf5qWBH@AurAAgc<}VDs{T|mki_)hY_-QtW6<Z`sy~KkE
z!6Ke2VDWN{Rj28kG7Qf#*s)g~(SiEkxYn(rQb)5-ELFndPi@$S9?B^<D=4YuF!E9b
zOIImftVR7$zM2t)vPuc(+=`Y;3Wr|kxLUa>po7&s1?T!z5Kzd#NmuIBCm1r7!?x`v
z-IA=EM8e}$xtW2342Qv<CKa&lq?M3XwJ)GHZG_ENnrxFDcWx8eJHLUd^=qBYJ=Q?!
zUrONjT_{?3wn4t5A3#^ph-t`w=Rj!M9e{kOY%gy;HNFR{b&yTF-v)GJ!dW*+*n&@<
zI@!TsBUxQY9JpsszARw@#+hzKK6nqU&)ffs@uwz~E{IWsfP`mXM-6x-z$@Q?TCk3V
zW^D!jOBL^sv`+n=pOyxwfuJeW%jN8Q+>_lEs7s#gKmf%;hv6RV+#_{=84E3;m+wP2
zIC|;&PbGgn-k(TdB$Ndf0J|B3r|t<tEz<V5sitP(q6;kuXIn=a09MfQg96@m;SA-u
zeI2`?XUbsj0{~4xvcDMkz6~wkJA=3W{&i6!5<LH?e}=l1JqNQ`gm>8e0%Q!mN0oVk
zb&Y+13f}}cgjNXlK?jh3;{|am<$kD+#ieL^6;Hk70$It@p}G64tm0E3Sy##O2Yk=m
z9<R!^=U(7u&s<5w$YZgDDjK&69Oq1Y&J6gYtMK!bElL(g-&7EYDc-2C2(}e?{GmTz
zVV`&fZf`XqR5^)2J1cO`BLZzY4re~jpe}{!6fBJVpin_tZ-oNmNf$~{HeEd3gHmb{
zYiXDq(`3JZsasL#tg1$r{R|H_Q5kQlrIY;`Px7)zn<En7oJFMo(@=*sW9sr}fkkkP
zm*W`fGAy0ztn)4?SdJ$4o$n~vf`ahsmn5viU<yxhb)RAi*@c_gaPH#*QVKYn`<M$J
z<<tgs_94@u{<=nosR`^a1_*fHvmEo!`o0-xW3FLupvC_Nv`}H#&Jw>{JYf6lNd3!k
z-B<2Z@YzaqS2e_d(0p8nMoIJ`1x&ge>Ju-2ui*RD64FtRoP(|*-oRo)Qg2WE>H-h$
z!@%Zp3=-Y^s)QBAIEoO{X?Hp;fKms<zQam4{cm0}L{_#i(uFpvP{6%!Gx%{6hbKOh
zupG^ENrg<hG#k}}A_0GS+lEaz)$3jb*g}$qjw79DgLA_*`|B*+e-!>Vzb0S<0o@UL
z6BWHs>M};wLz_PcMt^%azL1*|R15Ok82@HHP{6cc;>Y%10hQH38+>gu#W#L87@9gC
z8t!54R$<}Ex=`|Amlna-7+UHun(=$SMeE7#U@_OBG;N;Vn6Yynz`aB#&9%?tH@Dy#
zWlGm-SOT_IBHcfR?o7$yFSxI)6*@O5UzA!wphB{=M8Q1t$Tn>R@Zo%}MjQib&Jv)$
zLWgmgZLl*u?%833c}UH$nlrd_mIpgr8?JuV0i8fb!FHYIiY}g(49<F(K|IXh)PD*n
zSCnpOwo5_?g6$QYeYXoK%>d5*CqAzUWeWWpZj6j@DzK)Vl?diCuev%>Ru%+SZu7=N
z3RU^Owz!L_%B@Z&Q#R=?lFC_?<yiwVn3aWx`rZ~$y{yrpe9gfG0#eyb^vg^^8j!Wz
zseMT1FTVrkjKJ5B@;3Bo!!lZ~S8L}shpWEY4IkZZLB<`*irn&qaIGoRj^}yPX3er;
z&B=ZT>4RTgC;gDKh7Bo|3CHFbdf?^gkj_j+>4E|{3s{m)Z)(;~5KE;lSU4?F6JkMK
z@Iw1%%CBh;MJX<N9)4jZ1FOIYO{MwHq!Y<9{EY&Inzr*C8>GgsQq1D6C#>i4VfK}^
zaF|!1=eN(fjfbDl&^1CSi}Y+O9|;$=0XvV1drXqK?m3RyfS|q_`RFG`;l(qVCN6zx
ztVR4h9xzrO`t*?4sVG9D)nFVZU|SJ4`CSgoIjrt-eu)u|p?AfMENkvRYZe{5#F(MD
zpzRh8wLJG4v32l?K4bXr|JTd9SREradLL5CkFKhVk~T?A^_d<#3rQcnL+WByuhK>v
zje%E3obP9WdwRW1Ra_Z9vjOf|xo66${bYH{iB{ZZY3|<Vqu(~Z0R9KAW|LG-F+<%b
zF6hKp7PX+qeMZd>R5AzwnukXRkkI+@R=`3(H-jJ^#7+qck1W?T>C#1AVCbNVsW5&n
zu@^;LI{GD~X{@9(nnE@Y@fA(tANSbvd*ia&uYOjf6g&aT3zpaKX<mmd?aJ*9C&B88
z|2UMn6`ZD8m6mv0K;p7fksI=pAf!rkqq~IHsx%aXGTVcvGod5Ve$_GvVC=@F{Z~{L
zgP)3<BvK6?OGtAeBVXyzGYCt*xN&jLR-#-M&29uUr^o{wwudY*10x^l?WSM31PJ^a
zZ3N0R6Q~dwnqua+K2ZJsI>i5)w<rcd6`!WKM+w88lu0bhJjIdsWMu$&fz1Qui=Rp^
z>VN5eemV53zVbt{{)r`)sM+ByDLm0APgLcg7#obM5}7p=R-F7J{+)ua$D!@)6QFSX
zJMd$D?Mr>!@%O*zw=PLIZ>ZYi&O|<zHPv%{!69K5E_g;pG28jzt<b%3DNMT^?MHll
z&NNTN?w)B!zn?yh+McdCG~nWG!OVb8q19Qm7$C|){|BC&E^5cFLG6P2CikoXGKP!9
zktM)MYPqJ<tGR6%0g!8gM3AdYwVdQSe_V5gi$B?v?2oJ0z|tUS;1?3$AE+ueJTge5
z3}fl)f=?ot9L5Mei{(h>Q3pXv4MQ`HKp9Ad<vG$|b!M2JAEt;vPeK>^u`Ev)Jg^2t
zU<Sj5QtPxW0pG#lUWAbdZDt2inx2rT>)98YJd^?>@C!RnOXm#>I*CBPi7)~0Q?&f|
z&f17c_oemH!%m}oIy|H>NJJHx%CBr=y5bbqJri`rrk$k>e42i=AkZ;gz(a={C%KSk
z)4qc_XLLaZm8wEUZqfft9ymp|br{P(qjYn!Tmn+IQJ7Idj*s7{Oi?oJS}<1`FkVs^
zR6qx=jb~IN&L}GrbQQR+$h4?r)v%&YRV2hChaD`n(`2Eb>qBIAI0vQ8Kn)P!zaGyk
zoWS|m+x0uA?1$?*=!Mg$Z@i?dkzK;5M3PR1Fes^!xNW7Ot+=g=%2>K-%!MvFO`itB
z)YrtRPjiS!f%0XQX{W_ZivXRhM>w=WLDq<}Gf=$FT3cTM1&1573x<wz4cpL)Q8x!1
ziw>ybBXbRJ>708FDDKOL9D}+CS+r*c8c*ktV_+TkQn7qW_($y{7jNNxY3+|Wsl)Vx
z*Y}@c!9Dk%>Q$`1*8jW#nVvF>tJ0anp~_w3zdxa0&kZkveRGfXzmolt@TThz+y*1U
zurzBb>~8s)IVJR<ESQ@YmAkIL6XvuKP=DI=MxW){+rRcUkGu);Rr=2p|NSc^`4cy~
zA0-&0M8F8Wh5j<NkCIq?;88F@xf(#Y%E1E{=UWli)sE7K;i40k`YAvOMwL099hC_n
zO-bkZgD>c5_agZ2h{o#E(P^E?PwIW5>WBom7w}9Gp{b@cH8~ZY2K0rBBm}f<s`umg
z2THkvW5=bdjGHQKVi1kS!p%8f?wCZR8uHgMjfid#)rP}iUMiA(&JB<?A%Ot`H<{M-
zN#5$3DwxAOo^yMxDrxpKa2e;Z3Fwb2zvOqBC>Ko`9}r4If)VauRYK2AR2l0*_rvf@
zV+ra`?ThF`RN#78iq3N*0qHQNy>rVf?XSdO2B9PZ>@V3w7g-ekXIv<BF`v$uG^oR*
zWkWU7)&$Y2MLekA2u3jAGB~AvHDDz{tN9g%I;UUhe0OIb(-@Je+EbQa_N_~yC>g~$
zXdbwPZIh1X-=fN!Ks6@N?n%yXN6QiSwCwnrXe8}n<v9s9LMeOgkQ?9+3VHTW7|B0)
z_14B5JQEyKSQSP6Ex>g}vp#Ie6%uu*wI_%=hpaFaq;}2R%*Uek6i5?{_!DVc&zHW0
z8zDh!1$9!F-l1<={_L_ld{+e{Q&+FGU;A2LbBDa6i?0a*%J!2-m}$?T?~`00H(q4~
z&rDbE1wBZgQB=!;ZY^+;r)y9n&-l0Vumj26w{C)Mqj$j1g;f|lLKA({)bC;E=~eJ^
zlMEXsj3|aPzWP|Bn;qhHumSp~&71`ENq!DpBIC4*KSHZn9`t^{B_E(xK<Bj~Q(lPI
zQWi^Tx8W3fXw`dA#v;Fb&hHE$lx23A+8`j!PWuZ=)C!ADyD`AL@(7jjGOf9B&N5KI
zUvO@Kr8{YG)p;Ql05MY%OBw+Qxrl^2{)(q)NeWzYx~(xAHF_--$77(faX#axA1|!2
zBWylqn63>(34%Kxuu^rCh9kICIrEPxgPom<Prc<z4xuFayRSwoqJ$0~Wy-~gDIyMB
zdnt~s1pSB?g|w@MG1F$1vm|8T;dRLcLC8jGyXtJTG^m(><`_D%eBSc%A0H2~xg8)a
zJ0%$3cAKo2-cC2R*!6g8l`0-X(;zG>Hn)*w>t6d^Eu-2pfD6K)go{%272+DBApzH%
z?Lea}=_{aIA4=XH1$X~73?bBvt~m#(*9FrSfKw?m${utrOuNp7WEqG1ZVprbSifS`
zGVAI5dliKL$qVO=Zagh@k==BEcZH!}+(&^l$l#6}QZV)-b=ONHi#&88NxYAmUWI_`
z&!a=k2EU44>kD309B#WoL9!Iobr%VA3!3&0Iw(&^S8?&d2UPvuw|IEAVs;AS@io)r
z?#FwPMlN^%vwMo#cD)Lv27|FZ?Y+bYFZ|KmnnWptgfyyg@*HT}TELkn1)xQ~4JVGn
z;AAb+_@C6NOQP@|*&m>P*HoA|fWz3q5}c?GY~zC9|H_ka&go&uPf3RhP7ldc4|TKJ
z1lNs6kbd1d#?L-2$TQM78l)MARgwMcONm<Dse}|G)3yYaCP%?_m*YBP@ZirED{w3Q
z{h%{Zp~8nj%&RU!OQJdm7oC|7URfMWl^~L}E1+?%fOAjwpnKb(y5JNXb_qXHA9y_<
zInZO@^g!=DkHF7(m<pzSC#~Ll%b;!XFfC6t_&8cz?|yYWymM&<^_B7o=?{7S;BP2g
zk(S#0`$iaE9)`+yFKF~ha}?kbTD{m7l6|_#I_L%kDXmkR{#XPTEww_eUu~1L8Vnba
z?4dbhmNbKb4;|tLMf51b9M6Te9{g#v4c%LNaKU(t4pToPkNWm{5Om^j!VrMVCIn&3
z00HL=L4r$?R_AKrNCBW>om{wLTo49hXy>-m@W6}sNa>CY@^E5y-?r|+W`*HN9poot
zYd1VR8aBN!)OMd6Xw^Q~A6-L9ID(6%Am<XD;P;16_>S)Hz!@U~(6zCI^T$})nqbnT
z!gDtU-5Vz0#^VFfJ|D+;stsY%JT*|R2X;IL#|{*5`cNCDj=;4T8_=DPn06f_ndX-r
z4ndhzrXPn^C6^4|h`RV@E|z}}YcAdieeks3am6;U)_e`gimkBvwQaEZ?lRL;`q!5)
z)Kk!WF-|ljMFE*17alyvh6bpC-F<cd3R9%1Hr1{o1-WSwu9##)THJ+)kZIENU;^6O
zP%6n<H1XI?lWkUDd2q#X$lt2I7l__32sVWy+K>OnRh@wjIF1fG^4|wcOW5X(1pNI}
zn!g8sIoZ<Q18qT(*AeNqbAAG*O|hY4jtA4u3ZP4b7S2G#C{$EBHFV*I<7{Y|>%twU
zW5g#Z_vfCWb41l8jyYJp1cS|I)WXV?ZA@(2AXA#ohmBXP*X^4(-?&93S1*Ck?w!d+
zO*X=oOYoRI7>}EMb$G4PAkD}_8R+7;^f(4X+gote325(i;K1sU;iC#NMHFs0i9r*L
zcT77Spl3_c%!LWyqX0}333%*c8}d^nJaD09H^`8sJ%@+KHjI5TO0Il%1nitKxMuzH
z{k`aG{k+<Dh90I{;+KmcnoFHdMix4`qC6J{wNJv$CkCKfk%T{=fO;AFDw*zvNG0SB
zOz11%lJOSwZ<~Z`k3)robVEktNBQC<;l$pGjqJeSx?>~^?1&n>@*Ap6JN#ZKIXU-a
z1$%ApX!D$&u2a||*!Go<0MjjK_CqUcMxUdlD$IsJ#fi}Nnf|(hw)qRaxZ8FV@ceYE
z!+R$}qovg7>d2KC-m&HyHV9R<PIXnR8}8z;q@DmDtZG>w+_BE(C9Er&X??4|g#1g>
z*=T%E5B%v|7i9yL3J!{$@;md}pYz%NlrM_xW0h=wMqI@bp4_-g$aUL<EUT9C_*+nY
z>x&`rfl=A_@;Vty3ORR`kozj7EH0C>%LQ=>V`I7!ti`DbSy@Y;_vGqrp4?aN$pKd+
zBn-zfjqp^vGdEuJ`!k;AJIfF6%02q0XJHhs$1qQJyC@-(7|dL>#*-_z2w7ew<=7h>
zgLyf|lTD6~$>K^+uE+UNeso<#%2WOx*I1EM#n|q=grpqzZ<e@nZ>5mC_Byi9MO5J^
zRL<$L>Jak44{$rowDzy_Ky|=jO8>^^9QfKm|FwEtMSa!hteSnwJky)VN1|hJH2N+(
zN5spYC1fli<jgsqu6}#wJ(NI$J!v2B$<&daoWI7ARW+WR@ujCRGcS8Mp(_>b$*#y4
z@5mh`4(^qdvln?H;V5y*KT!e<Kyz!XE36ShH9f!NLHHlJTAYLN#-o#HfjWwhlOk`5
zCpMQka#x9z-~QytD9-Q7M^P#dB>dHcY;a6MZrdm2=H0Gbv{5203wi2Y2~&|f-jkt0
zj$FCbk=u|~e^};<Xk3U%f5G|p#rcmBB0Mqa!D%YzfFT^P?^Cq14Wmat@0G@+#r<n>
z!2ao&#;>n`g^R-gZL9D^R9$;}^8CjfT^0KN53a0BD7ko@D~nFR)A}f+&#no1^K&s>
zY5DpWRMG6orRx$RXFQJkD5QxluDI`AM^L5ZhYOWRxJsS*59bfC9*<mr_rFec3LlFy
zX^g9JHJhL1$nsht*KQYb>1x8flyd4Fj^V8lp6qp5Qr5<WT(A=PZ>J}VONAVI1yyR|
zz6?vqo|i^7cI($aNl_D1-cK8ZN*g-=p(7oq-DUeAJ{IL?H`Kt|M_t|%BLWzAg0bpW
zHUQ;8r-};bsU+{6GzI(p70OwO^0p$%`l8J0wfB&U*bbIP$Yf3Q83=qZ9qdy#<I(;X
zRXqDaZKloHUI4omw}J*!)+qS0u@~G`2W3yh)b2lL^1u}j@r=gDH;8^wP$CG9<F~RJ
z{KfEd9^#ufhh@Q7R$6JP=ROj!eK&&^jTEfh&f&f9F&5Gw9YmbL*0oje_?t<XGnd2l
z7cqF{8w=JHhtRy06bgrOG+CdYh3-_0bmyTrWGDI;7p_Ik4ugV8&ju$}Rr-tX|9PtZ
z_@*7vX;&BBgg%2F)IwJ6*aYmwPh42E1fWxQ2J1IS`0^*5LzwF<g{Ta|)9*QujN6bz
zx@wGp%C|m4?JP&?23?iKHhlO!z>GIgi$C3hCth~dlAU3&(sXs7{Qd5dI?N`5{a1IA
zxosZu`iCaMG=FaMA<nziJ;my_&lTI)41;h)QSY^58Be`O&1b#+&nL3GZ@;d3_beMK
zZn)Phi>Z=JxDX<JgoUZ#AO#+HyatAM&xWh-h(XgwQsAmP(dXEhnmP*zG-U9%=h4M*
z63+Kk7jn>#`t)<2PCpY4IwnJ?wLay+m`(t1f9<fklLG3w_bmuDK$DzOD$%6hyQ(;G
z2+MEiOScDP{u=DB=p))bpo;ig@$*NfG3edMf~9+f{`ViW3PU#*uO%0$#%}ajJfYyv
z|8(I5G=SgvCJ85vvEhj~Fn(7+0qP)l!8qLcj0ZhBc(7ng90s&bfw#V~AtjHX#&8$W
z-SpV20yWqmEZOO@rK^~l{RL`*8K!>5Rp>4(0bb|BmO<~ORv@#%4A}VPeeRx%{1Wt*
z32VsSSMcP0Au@-}(E@xsOJt1PF*r~mj;&nT>c)Si5BLQv8SSeRc2W}P1`6Z|_R;%H
ztvgo1jel|B{TTpf-R#1?DDD^XnB9=Wb8mWZ^@$SxIxPa-U&)4HCsng(K|1ho2vXWH
zm@!kpgf2o|e64`@p10tWdFl`P9vyj_-sX*arQ<fzP;QJXR*T>C_}c=ar7k!ae+n@N
z-ugUD)hc>-_mpy&^|gSnQKk$ZreOXO4nHiVOfaOkm<9VbJMjGy0XN_6!Tq;#cHu23
zn^e%<zh=|a;f$AgtD7%?)ku^b+>bLGq(*Azu~T%ju{G@P=tH>+df)CreC2U6<%!wa
z=N-AD(DKe6<)t)v2Nn~eJu=ZxM~>9<^CmZ0_&zk7Ipi0wH$&~9{g1O@#J6D+RW%iw
z*2tI6;+>X1Z{AuD{_y*LoEE39>;Qw6I{MEs-5ccV<x;wylHaZNWZ~q5?sEd&6Y{uQ
zQ9HobpL*BR)m|%6i*0fWYJFqz{-A0(@IrI{?XS)KcYknX{)zbc@tz7Cqg39cFDC!|
ztw(<H|N6=u_1=px#-MVKye6iry=H!cTB#%D56eB7e;ir}W2oPPC&%4n`k#Edz>{TY
zMJ!k+WOK9}V3eb^(+eL-XbtG4&pa7Ht?tPWU6DQ}PStrT>sYV4z6Zu{U(<N*=@pr&
zgG(nML8z22i<(034^yG@x9RDHa|>9HL=E(cewbePN`cnoTYgo@`^D~o9-b3w^>kYp
zxGOie&7+yTSK=q=kk~@SRl35~*ZOlOc~kgkSEJI0MmTcwJ|T-y1N~_OYMR@XJo6t3
zt%1ULC0n1FkkN=IH|#|1v%-^GcMI9?V!S`V^h;@da!gwvAO3)rQWa@LQlPb@QRxY_
zovgXMajWk8gQeHwN*%nu$Qs~zFk*v`;$Gid0tITDIZs%9%D?hoXZr(26CMrOL%pQc
ze$l!9vwoi*Caa9h6YvNdh4UZb%0|b>ar_=?b5gItTC^m3UxIXq>jJ}+>~#t5GZNvO
zpL?>lPRg$qxv~RVS8Nh$UZ~BsI1Mc|v^Kw3Y^<;)>s`_86rBGsLTPtJ;21|X>{*vj
zIedlVR-|S0+uZ<q3uX04p6>V6U@eIEdbrVG|I(YGH?_P#9vm^v&K?}Q2D-|Kp0D1!
zX}?>|hdk1jDt)1Ije6lD)3@cr?>!v9lFxjM^BEA6d=k#BcT&EtU#C7k68BfiYo0{k
zMUNWE#wKKVbW(2IBV}o&5I-&#q9!8Ll)uSY@L#$*U7YL`q+TfFk!DcK9)F9GA1{6A
zX$$@9#mHMHMopD-Unx($*Uarrln=ra^6O=;%sbkVY&6njw}iaqsigMgzwo&$YLn8t
z?rGfX-V5*1U-k#6^uK-i@9(zzq_i%}#{Tl&OpEtd)1mR3-Tn6(8QF4nd+1hv3mnGv
zM}s1h%-4iEBjK#^YoDfp-*nt>W2v<s>VINt4~mLYp_uye;fXck#c)V;{W4i;Sws3t
zcG59jt<qALE!$>$bJt@W0%MD=5RH?oY*@F@gN{QK>|Vy9N$WW9u4(%CvF$i`%WT-Z
z#)dX6C2Zb_zdOf(_e|AUDwIDime;T~3$vly(Gs@KW6&J^cf6~g#1cg3YUP~cVgAVX
z;Xi!w9`C;>8y$NN22qt*QwMXuPlLe&0Jf}?&>Fp1ysOTU0ULv~?y@8-o)?A@Co7oy
zz72zqOF%pW1DJsn2nI2rwNAk9B^EU4sbI^}0JLr%0p6eT)dLu>;!&^oxg1z}@j*KW
z21lzcPBpY*$%<OYXpm{ABrkEdf3TS~KKV;km587!mChPkAiu&e<OG$3eGpV$JjOCo
zQc+*M9I4@Ps7#{X7m#*3x76mDL%h<dbLrVBlhrBlYVQpUR!FE*?4pwdq@)J`&q}DQ
z67a?=bzrs3(E(ezlf#P-yYS>o76x<`+;ndeHtwV}PJ$duf?TEGL)5tcbREF#H<=oH
zssp7W2rP|)eAL<wL)N8Bo{&HFyZm>So;4U)UQ`{gL5EAL8J75Is^BH_VC958ls0MG
zI|j0}vmf$!O1@S5<tbjHJxgKExd~|TrxteZ6-{NZ(>FX)HO+Qcy`Jb+vJ+;Vd{8Ys
zx4+7)ZXzlmf;u?H<-`UTK73WN%We<A%a1BJ^~wa4P=0hORo&vx>KM%XItb&><?z)k
zl<DIYB#O}I8n$%Chgcg|-+g4kF{g3%%}3~KJ{D9wL#MLopd9W6#@_7$n8V8L?hD>i
zs{e69ChAbr&EPp0y{mq0ke6}xYE_y*M@JxxmW?aF=0R&fWlYp$q;T7dK~^}GRn9#_
z6bybVD>E^V@@AsdOkI64S1Wfh@3;X8cGDw)K-}iJ=qhd!2qsucod=8FO@m&;<M8Fj
zAsE~bnR=83aR(^}<7!Pp0v^6T1UKB_!Jn@HIPYu;fxZE7F<{T5wQ$Ukfa=sK6-vqk
z^|aw{eFGml-v*9_|H2hKzpjhBEp3$w;tB*LbC-CqdQkwn50bEHB|zKG5m4=eAbALa
zVGo?847Q_1-l7-4j^!Mh_ecWo5YmNwVLJhd6}DQwkVB7t3U;hvs(C91<9aI}NG=|5
zgK60J>s~Ft=<8IkDId`H>08@WDE&GWQ1_P-@Jr3QUeWbGOO45<Ilp@LZ(i(oUe^P)
z`qaEC_I~pq>^Xk<{?{9Rnr}7j{=O*NI2yK(Oc?+1G--8u><pEC{84gVlQYd@6w4oR
zM_PH{#tM+ZK!Z#PnPG;;jin+O(XNhiQ|cZ7X(Ma!x&(M(8_0R*Ar<Qy7M-~1fkmB%
z3BoB28695}DM1bIqFl3{1c_v$E6>5<1yLb$0wJnR&~s;Do2!y<PJl(D--G|~Wes@$
z1(7qEG&x1trU4ABqNfy6kl5oQj4zt<bJ`nfY#yLoTV!P0!7)<aBQue73bxwRlQ`~y
z2-#qxThYO289E&)ki_gPE9&m}T>;Kv!l!{yNwbkj-g$Of;_HUdyw)|aeLF_w*V?S<
zpSCbr_krB=@U?K+?J;=wffQiJOy#QeGcsVOLIq0O%yNraSAB{L+*rBq_J!U>ad>G&
zl882aoH`}qd2cW(f5q4q@(sAC;G|?Kh(}HCu=4Z8C|xUz|3@`UHoAtX5RrvUDkzu?
zI|$+)CNXf977{Az26U1+^Ffb6Slr5AJ6+7`a`Er2efU`QRdN@MghXW&vU1S@QTM8x
zpLrIv{kRoxGHHvf_9T;zwDMAIZ{Muuu;%2Q;o+tKNW}ARW=>@_OUVsF*o(?<?S{Ws
zs6hg}wwbCB)siHzMo6_{30+<v!g;x2TjxBZ>8O$E$?riBrXm&h5noGUfSQ1*bs7$#
z_~0`FNZc+Gen2KMT5A~~2xT%R2y!f)h4X7agDN=r`J7<wq(<JZg4JMcyH&cMJp~QR
zYhYJlE~H$rK0C*Gyn63jkHHz|R={&lH)_=W)U)@NXZ<BL@n+jtb#4s|tC3J~OeJ_$
zh`O;Cq8lfMM|n|W1)FvSjP9ol$WkDHyHJO`MQT|z0jfdR<WKvcC;<XxC_{@jEUChh
zHV+SQ<)`YRD2zM07r&il;{$EpxUu*CuGd4y!++sQ8=dSHOS4y~1Ql0Mu_t4JhzBkP
znNtG}MBK2JwTc-q3i5v0co4~S3__!!Bf<gD4O^&I1osDH)L=(l5ZM6;qfaI#Y>QVf
zdB|JT_qtyRaL_A;)^K?DxKE)n^ryszlx^S(+CaAz{ds!hdz16>MjSZaz+mTcsQfhH
zt~>5I*xwvWF>BDqMPhx^6QDA6SN$`z<y%$vIaEG%ChYoiF~GqK><;eUXmdq~0wF@B
zAICG=4JqoqB$fPydF_A92s8*63Aboaut7!(Xz|Z%vN6(ozK{>0(+A5~<8hfyp37}B
z;ZsWKhi3U#T9y~2`V3W3%`v#6L~)r=H8G+VbY4-?KLxQ-uqDG(up%Lj1mi0I*wLXy
zTOUns28u`|E|*GV(O*K*e9ibiTot`eX>18yUhjg*YeQ~vD0e^a-_7a#)#bxD#G)Ep
zhpKq!+mZy#8<Y?ee)^!0e%`OGnb=9ut>+<0`NKZaiN2VDm2!f*w<07hzwpCH4bhNR
z8SQ@02d7~6#AKjn(QYdk{WKcNu7o))lCT{GaM@)MsQ&(YX>a-*%Fuy14d1=;hA1RA
zuYmN}3|NYib31CM_?pTrTOF|XY=%{*SHVkkI2(!;0Xj*1I>IsQ0#n=%G_XO2xT*5d
z2d2rFj!`Z&?t??UnCV2;l~|?~Ii=z`q>ZLfT!22SOX5u7hjs#^Xe{jfM|t3Oq9=?C
zW^L#M;oJ;W`bD9fpK-R<j5bZ$F56y=&ghzNSvYmAHxwo0nkjpTF%oReZIHS>g{S6b
z%gV~L<+p)?KQcsV>vXP~GDtE6dFQ5~FiypNB*`F6p_!?=GV^u`FVyzwp&r^xnI$Bl
zNTC4oEhhth4S>o2Hkmk7BED<48P==|DxLBVx7m&PHr{mmLRf!!1<bi!P=-ms+OwhB
zi_U}1=auPr$L>q^RP0UPk&?b|S8T(n#ZYoo6yqPrKDfXH5gAZoAF5Iqf0P@xae`x&
zM)GR%)PHzs96YKN&A^+k$?zb|Q$@Ox$CS+BkfcJpprwTFAz@(EG$Ib}DHY35F_6?r
zMZv@B{eM`OtY)en(^8qL$|SYMpyV_1lo9xLeLW4*rXU<$!nnnuB2A))ODHP5BM=s%
zU5WeXWLlIZ3lXZSHAPClc@=h3Y3X~i8YH7xW9`&+y|a6~mrdW3(e8D0<K^^rq74Rz
z2YuZfn#@Zf8Jf}i!#o*{o#lncjZba=SdpfbRx`7p+nmlK(yoWqWY0J#`ZiBbrroZ_
zu=}xgjAx93^y4}~x48wsw+sgpYKrIIe+6qe0d0$Fu0ow2+sk{`kd|H1V(?lob>wnL
zl$E+x?{#+3r7uJK8`I<Y=VDwp`%mE1WY%^#zhc*NajxFnsvH7cA-dE>PE@QzaCI6D
zo~pjMu2^FxU5Qf6$Yn=`FG*m&aMMlxE$Xv@XM(g%F@*4Q+Wc)2;%DQAfnOP@HxD0-
zuJYz>i-Pc9xOxv6%}MJpa*a44h+_|%$?D=2Q4hPR$D=b#71sa|^)Otf-z}KoqE^QI
zrjJT9Jkz|Pr}X=knED$6JGSo1C``KrGJ4kwd+iHNOAlU_8cmz`b0!P^ZkV<vgYUQ&
zM)-ZhJF6g!EV{yJu<=;aVe;popwrNDnE|EI8I2l@6n_&4fhj^Uo2;|p^^~O6NOj7D
zZ4NIzXIu~6`T$JP57$lwM{BM+4Ua0IYzrFgJ!r(XUfO!p?lf7xxs-($yaZ{K{Ywiv
z)2!t5=`Q!)dk-pRzDMuVi#&&ZMo2o?RL#0KA?xe<QuW^r6j2_y5fnO|(+ADLeI_C%
zmxz}D4F^T9TQ<Qwp~lC-w1D8I36`NnQ^=%gmFqR4_vv~;ZjzvwUyxZ_@Rolf;v0{-
z$Z@`8t-VjjeCZc?=)H1}e`zqx&;Q)_bJL@3XRZBOd~Tx-`}eQwK542AEvi^X@?u7#
z4sxSl__QghNLCnkAB~CN(#(F+oRI_xPK^#RZG;%SS%M~1rk{nG8+|3-BghLntnv1L
zPk{4nYQOkWzP3l;UHUZQS}HK^pQ?IYEi{HL#ib9(K~>Ham8TzNHd#mL4YdO`N%2(D
z(8U@Z$gfW&RJ=v}l?WSGf|g$-lI%IFCOCOL9R-m_r<QoE=@Tkml}J>N+MYA2^NEni
z9UaX%2AxXbUa0n;kZf@I9%z4GL*C%1$02RRDsW4q!fNvzZ#is(ri#?O`&s%GYm{4E
z!h-F-gseeJ01jRddC)>0xnb9I6`fT8fh@s-rI)EHJUK8}srJ1xz!DpWK}vo>IJUT%
z7km9|*w81Iv*W(ZtYF1+R!UY~{@z&`$rcS>CSj34`K{s@n6fO=gvnc?E7d4@#HK1Q
zzy4a|TcU{*q7%_Y(>p=0nMx@w+No@taOPc8(U?NSMZ+iJq2rg*IZ2Qv@nI1HJz@IN
z41l6wXLan5tD6q(GRMWzAHD*fMnqy{1Z9)Z9H=OTM||`d<@xhqy3vmv^E66ONSdM;
zoy%$vbG6oEd#1X~PAFekXtBtDzY^0lzmHZqjjH#+a+q_6+<&B@083={Tbc;K-CCH9
z0MpxHPv)4~So6J9nW^8qhB@rZ+Rv@6J?5I%^krxyO5)l-g~%i&#;p;AW`ui*t`yR!
zEx%%xs%nY7swHj%E<c*(fgrE1#n<F0v>QTd7n5CsLR{}5X?jv0=DU6YV)yIxH+0$Q
z@^M^~Rg<dayn*M!%5ia%`skP5byn$e-Gxuc%~PiV)OR+-Id?`fnu0@K)9F-Lbn<-t
zjA^Pqh4i;o@q7U7-7)915e~vdcbU>vilHRa`QQ67GjaBUTz-_vPHwR}zv_4Y1EnTg
zUJDwJFAz7C#H=2F0pFTtB`xihqcLxqooe+&f7Rf!B2(l6X0P5kKc3TV%~T&O+=2tU
z*Uj<$sp$=ghy)Iv+gi+{+edqHaLh?#P3a0}Fz|n>j-beN?=rCK+dN2vC1+79_y{RW
z=r>0Hm&Li?c9v8$iRXi&=5qw@%z50#*vOjyDlj#xw@|@w2p!XwYY@0>T622AN3&vJ
zdLvm>c}YAN)!gWBs$bFX5%1wg91cO0K}8gB`^9DGFH(E!#SM0R+yq!odSR2@7qnn&
zyVE-4ta>ab;B3ALQggy-8Kn)Y=FOc219yIvy?u68AQaq)fr5|n(!WTD4J}J#;^Qk*
zc6`x{r50pyvGp2RJG%|hqKtfdu4=F+4})WcmbYaz2E#hQ?|4cM?pCO5TMNrhE@Q!(
zRWka;R@i)H8I<9iSDd}ai>lqs-nb;5C@+QO=T=ig+wu*6u5;`!*D!DMPi1RPj=;Qu
zI{2AvINKdKSO~G(Wy3nU@Y-z*1~ioL3<j{gV$Lj^Ydktx9)W%>9eDjN8@lESc<Ltf
zVQ)+7LIK(cQ7xbe2Kv5xQbK!F(!O~#$mDt#i1wK02wCHLryMPlXCANO*Pa8l9a^h8
zhA~3)M8uF9y{sn9>fpa|S=r|B*L^@8$d1**SJOFURlBh8c|3BK+hDMh@q|g@P<BON
z2L`a@IuEwKjmOz~6o4V$jE>epQ;ZqE|A2z-nF2ofCz`RFT=F(DU6(xP_X>IDc&yW^
z`EH`ecc?8Td6)Bd1cy~m4R-meeYk(c0vWd&NUPoC;J_V=V9qRM4JezzQd>QyyfoYD
zvE>JQP-I+iaP8f!F5E|@<h4ufDBp$4=QaYr(pFGbvTyXDGN;7iBz*on`f#^NSp9;8
zLPi*))cVEJg)VZQ3!6VfEp@E}yFNjIwG)NB&NfHw)JlL{;J})9@O|?I?EM<|dP_pL
z`P2tp5KY<5^M9j|XO=m526oD}yxS8nXj@ZX>-L+eEOqT3%Wh%qS1v{Y7x`J>vzR@&
zY;myjj+;pE!7QyA7!AMs=I-|QDC`EQeDjQd)%^Je$_G)@F-fCLb0(Nvl7Our;`mp1
zu<cU}mTlo+LK^5hOD37MDF)l##dTZaz}h$Q)pa(x6pZynLT_UPc71{SyG+1#46S=B
zNY;~b;~7o2<W!<6VRwJ(C~HB^gVIU`Ub^vi==9mi&|`TPZ~npGc&G`UkttJxUDuor
z`vYLV>Z`qWEfu*b5>O5*<70Yx@YoGO7}{FGofqQxw@W={653)-1a3Ju31=Mza1DB{
zFP%)VVknhy&Zxgiu}35xxyAK5ww3PpFQDtbI+;Kro<unwM@u8-l{oR~k6H1;u!=r<
z7x!W%J1XG6b+P{118MRsk^4j(_|_P#n1wE!<qm9m7inm{)Bqw{N2-oP5$Yt1pJk9&
zE8z2|aL+a%Zw08x8~3w32HkQbJbVL(<GR{#@0B*hccuN3-=>)_tDEy+dBwo^KDBNB
z#=;hS*|vpUOW<O#D=V+8O$~2bXH~AB7hU*N8El&1z|1Lb<>raCP`73&tNeCt$rtF>
zLU~Cp%J@a&_VQ%;Tq}?_A66Yr;2jJ$PsDZIR|~myAA7NsJy6_-dWsyj2JU~LMOZCr
zFc{XJX?mf|0h4*Mq5XEXxP4#POf74DGaF61`25oz_ExkV59go{;bimd&6{UKr>;`<
z=x4zbe+@zB798&WGlvrf0yJvtD$+n?4TGa6roxQ7!qC1UgJ*8D;I!cqn)FIXjTB8a
z45)PN?!lK&2cT7<4bR`ppie90y|Kv6buKlk3bbq!I(^Z%ft)YD=J`t(+Jy}j{*1Qs
zg>C0g;Gd`Om=5p5A(W;b?v+^-G)v$z)vmP-bKc5?);S7Ze27EujsX3R$HS*Kr~y}-
zpqJ~5S?Q3Dfv?w}=g<hlZj;YMe`>X@@iaSkNQL(v3qh*_T!X)H7}`-ni~dM_xP@sL
zcY$dKVq*SlQAR;t^Jg=PqVFn~2f{hIuW%75byBwpHyJ4-7#&oZDx5m21V*f7vU*Q8
zB$ZBYmdVPv@>syF*)~YAfFq?PlIa`L!=EJgTP-<JA-OIj#HsFc;BQZ*s^P71o{s^v
z#67w9Y7Ev@3f%+7!lUvP41wgKz@Gk;1r0H%b@gQ!7bvxKZzNvJ;jP&=G{Jblldmvn
zkRjpBOH<LB1TBvVRJM7e)C0`#`i2%Ki%{#k+gQ<}AtHi;Hkv*P`n=LbH(qNqF$nFx
z?kBAFJt4JAV`%?DH|RVo0EK6zLc0$;h-iKTk<zfY-QoU$(0gf$7LLvD8N?H{!|_>Q
zRm>R+4L|D)zmXH3g2r#iN=jV@k6sAdvEbbg!jOl)|L32>eM|#5^#T;a6+!*+qAaG~
zdp!)9s0qIQB7?R?HjJ2@FlFh2sW2XdZ_G$zY52!WuOc7h*wFWA54<X^2=WlR4>LOY
z+MlQ$9xUj0f{Hs1<n)_p<#awa#p;l$nohV_#G=X6%ohD*ke~H4O&oaP)548ZD1;7!
zDha)j=U)1200y@4;Gyd|oQ;AyzcV?(QN!7*;EXHM;i?l;;EZ7sE<KLJ<;O|LX(F`$
zPDsn{*E`bVsaHddSQRfi<rcePPGP7pE1wtUHVG6qXk!(2ZkJN{!nJ$yQVQ+-xBmti
z!zNF>^Y>F<kNj%a(GfvQA9i^DSgLWp4L{BfLql{CJ@+(+78sVEaH<V19zY8Dr&~7$
zUp*V3y@6LB;V`5lu#TfJNE=6OB<@1@-ki<28+ooRz|9ysAJ@}`#%)vnb?no?q!s2&
zL8toQ4lAcO{s}1MmQcy2sbKZ8aUY7E9f!k3w_92U(htf*cWu`*<<7}BgK7P1_6iRK
zu{wW<yEJPdm`;Vd{TD2~SHj|)V_;ijbgO``oc#86kQ~waDCs#4>o)OIW$%6feq!JF
zCY?)B{`A6<_adF34@~#{bgNN6JK5K2wu3if1nBC5{<+gaOBM%0D?SCNzD~l;(-ho%
zjfB%4v!K=?Z48aN2Eac5Fbw6V;2NMnIO_xk55FRyhWu^Rn$ix!+MklTFz5a6I9xCZ
z;DUbwY%2*VmL_#z$+KYFw%II6rcAMMJM5qIZ14*rOe78dlUFQW;OOEO49IQW%+=yG
zg8jIJLC-D>u6j_x<~;$R&U2JrwsWh1Ig66;<#!>#7!drkM8U%KXkw>pUpK5-5rmRD
z0e|_Yge%X-)qj;kRWzUoC?FQA&r;I!@E!aITu4ME)7cB@%@!=Mn}tq^{gClj6#F{D
zgHJz(k94*}dC50wb<>N<kE+(Qqv5!%<JgXj*=k+ialX|0g!NB+VO#M$Z(hf7TEX!%
zjJ%+wqgHwdnL&8{^&}iOECjdRDWKyE9Im|+_cFsQv4eXy>-{7&#`nGRnu6vH0A76)
zg&(2R<I|GCFns=v7FaOndyIwR{J#1gJ+BSO*~+zbUtW{)o82sBdcV6wsQ<}mt<<tm
z{tFN|Wu=0%x<lHnd90xSLRE(9q~p4*@R$`UwyFaZv}npwdw!{+aWt+&&3VJ?Pl8=<
zHlwW*?Js&C>N0axO?92j9WjG<Pp*|Sq4U3fD{3y~?J0nx{itrxX0LteYK!61uL)6}
z!#6(!Ay7!dFa*VwaW>~i3s!FMU|+d{QnXRm?h1jOF0>~+RwdxuIUZD(hScgU3TjFP
ztXqe^KQvKjQ%UIT>yQ7O^{wr#9(hZ~l#}jFtZG>;o3MWHZqvQ-X}BlTrWFP{Mcr_)
z>aWpx9bZPJE@&)^UtdenqkA6iji;7><HFw35S(+Zg0~)%aPrOMq_kLw+G-c!YtJX)
zucw9K)Qdg%<n;iY`DY9HO1pPhYA&eNYs%_kOY<wCzQE{Lg)L=<HW|!kYP()Gk|QU>
zf8#3O4P1A<B;zRH!S0;__30c5UxpYf-iyX;4Af8S(0!M!-B)bQY83FxJoWVw4wHs3
zcEy7dimSQqZoqjetXiA^2bHW#?gV)J?~I*!lMT^q9eziT8`^&42k-3j+!`=GQ>uR<
zuf#^bEOCyXL6VPuR~-;niQ+Q*wKDh&SATw%j?1`wuv^BG)#r;Pj8J<>VRE5xW|+5(
z)=0jwHO%X^1B{$LRCkoG(NP4o#f#Z|fLF&mSN<8bm^?apQroXD3iqrY4PDTS+2-CR
zS<QaPsfS<st*hu%l?UzP>Xk2&1S2KpEOtdjjS!zM^@KGzCfGzrKp!Elel{*5aVh7m
z^kjLpCzoz?WX4g*b4Q_Ls+W|f+?SC1N*(#tB2QM<xpM1XPi7yR6l|0$17nryeCh5U
z0KbN3`d2OWKYis)_~|JFspg8wx5Y#$j(uyfl)K72xf92mb8JE~n#T|+kGUhMOX)wJ
z>&f}69SsZD@qDD3QRtoPCFF%q$7LM#-z6&@xuew6@K2eOTmd76$~@Yu88Pi!d;cD(
z1E8<!f2R5VT+({>?@4_@!RG~V%>H5*OCJK)?@J3)kDH%QHS}+-YZ2=8T$^97Thnu6
zr?N4wqO$4qiLUr@MI04CCEohV(Lk}M-xHU#j|7?4{eqa>QtZgeS}8x6o0Ju}COru{
zZjh(Jn>(GGkUL8p{rdb>j;urNzTH_=(u^nZX!Nj-ld9<n>wcr3^|!X3SBseqp*ybm
zz(`l$f4#qLs@*GjJM@XJ`g!gqXv;e%)<L^1FaF|L^x5uZ?N}dtR?nRn<Dnv%DgUB%
z^}a}@W}TQ!z;N8Fk&b9}PEu^&=gH!7Dd(?D$Oz8A-_-;shx<H6$)Ptpa(l6>_ixF1
zPgd0l+2MSogR!{J!(G|s+?d?FD=CUAlvuOF6}!t^Q8a}>kK;6d6+Swu8cxwJ9dmV_
z84QnGdHS#V3$Z}^N6rlmTh`W0^#GbUkk%(W8nVVlBhbqgC*D%)RaCj+lZ8SgT_F~3
zNQlr#PX;IB*!wtg#@8|Fpf~dAw;fqiE#;H5aX<UHf{m9le4>)gkNRh$1J?Ebguf1U
z<zE}^nKBINaV+vje@`6!*SILgb=<y3h^6aYQB~)P4i_W^?uVcvIg%e$H9~$m-xGUE
zU9p+q3Xdjw#C7lD$t#|Y$z(!`FBW?!hlF_JtE6gnO7casw92H}9O};@tVMe3xdm4D
zrN={0C3v@;{|I!S*OOikG@sX#cbsu4^ia}jyZljT`Re4~d(J_>i1*)pGXxs{LsmxW
zAef$ErF$TL3@|=SmZ>V12ePhGg)(wc>w2zH!R{+-i&LiC8CiRkEmT?v!sT&DwRMZ=
zU|!5o$F;zS)#gu9q17bx3BDVGrehLN8FDeG9R`XF=VCym>^qyapW?x~nE_~fY!r52
zAVg4~M?8CiH7?Zs7=R{Y0rq@tL$9-<YJF7-cv`8pxy=^!a6j+A;<uCT|9e+p*ym5U
z>EkZt9x_5j6pFu1XT#4`u=q7J$Icb7tRjg=XMi%m!9u@y@n;;4I?sdmpA5sr_axw(
zja2HNPFYWog;Cy$Z)|9Ntbq0J2BH1rIw<yRjD?4pm8z13)l1to;``!uqb`<bwdBcK
zkgLm{ceD1SC>f4eDo<kc%x0aMWwG+4rzkOF^&X5g#<MZ9lY&M-ssgvzgHD&mQCm~+
zbMA9}w#oji6WE`hVAe5vig#vpHN1i@1SwHB{@a-z^y*;4_sb+}h34wbPefF;%GSUR
zXga}Hk1O{6Hw=y+!C=Oh4!rRV4uhqb7$*8+SH1yo$BPOcxY~m29#6ohXhbGd(C@~_
zSva}z(fD^AuKLYI@9|!CFlYG7PRaUnVeO#G1IKL-D<9=~v1Tx@*-JlLlK9wudoSm5
z!v=53h%bNftfs2S>QHg7DB1HTSlK=Lt2NM9{s@&`l?#=k#tkU+`T+*Zm(Jkq@%I^A
zdaMNxy%mS|<|>o=$;0SEO2S6m|8s6b&FujW$6n{b@^Z91gx@=UUmS|R45@Q(0eJ3j
z49>el!JJJA=8|<ywL%#1O<`*rML+Gl&x~L{pg=vpDyYvHp73cXb?d4ImdbYO66vBv
zFGtBOL6+YjVl7=KdCM+s*^boF+b~ER%1^}9rccAH6S^nY&asilB$ROze&rZI9@xTx
zuOCl`f#)XR&AY=e@Ki@tr&3?+5VO$23`O5;68rMh;$I4=|2~iX@-lmxIw0CBkrQ4@
zm7(-f2xGhyTRQeq4?cV<08_7z!u-7)5?-o78mRK12CbqF<6YSHRS0^VRtxJYLOOIy
zbI*y{u=o1_bUevZ>)sDS%Ly?qvIF0>DGHpow*pd|S`d-cgmW8MO^YC~Mx!4(mIFb^
zggOyp8KPTyZSI22nOOsRIVr1FS`9F+U~yqF6)oked4Zd{dbzj0ZVkGAWYTMJY>}%n
z9)M^fX{V!kn;~{2zY2BWP5yBQ<lk_C^kf>BZbSyxeh16?oqn*@IH(InmdyDl)V})!
zZ+%$_#D2O~tX=m!nduFeE^Y2+H5*nQ&!3$w-p{FK)rol3IW21w>WoQ4(d|(ifMZ8V
zxcxqfE=sPmbI{auD(w{e+UGqeN1=S>3;4SRgE<WYIxPv~BdihwH#fb8rcfP&yWhhA
zUoi@H(m}|cw$YCqw%{*spgCG+!A);Euxe`vc#Z){(4BURHyG}i=I3ku*Dqf<L|hv(
zbPOI6p&+~S9S>G*vf;M3U0A#|h-35>WqhkkJwfIGGP4c$eI{TwL6K#F&IFJ)gGiFY
z-)2eJS!=;R-p1hAZl<gP(}O`Jq`fbt@6MKez#ESKJ2d3s)9=ye96Mh{dg%lg-Lx><
z0rup>0QWu*(5EZFO@GG~B)!SfS#K8K@Wb<B7Q5(x0G~;$@F#V^1f?&_G_xl5-=!21
z3zqBz_;L+eAQ?)1xD4F@<gBrkpAT)r8*`KJ;kW1}OqVe0JN&#=pM_%f>*WOsK3!x%
zn{Pe%e1VM-vHBzs$_(I;43&frvhWO+A76uK$g%Kq=1BdxE${ohZ_GcnwNmfTw&kKm
zkNc<9f#xWOU94E_f-?_jX7(?%BT`Vuh&fE-<B?GvQ|yiJ9r$1=`dpg{cz*#33SBTl
zXPy90aCqQT35!Z?xM#M6g`3e=o8}t>6fH!j^kZL0_+|}<$G^kht1JyUrt=L=)fY>}
z!}n)MwfzU}ul5HZwdI6!;&Q^%RQCqx+!#L!R7GE4r%wR(r#pacqY?yExA9O^PF5<r
z;|+Wp9+H<mi|(Bg3}6<R7QPByu-hUEu6V|S+SDNY1$nVDfzG$IV11S=lhNp}GP(Y*
zh4%qh(&Z|EB;s+M6`6=~_Q-6Z7H;P7@JC6QvlJD-JR)y`8p1sZqFnh<z)lp@H{lwr
z+8zd$L&-CgGmb7w-1=Kyb)hVQ?|aLGJvAX0!yUu-mCG&Qd9Y<`9X$ACmb~L>VE?!l
z*a;_~W4#q6H%Zt>s3yB5y!L4-oOP3c%g?r9;so?&p&hHUWKs(Nc6c!S_-=4nv+nTN
zQ|N^Zu~s#O@HnhX@$C4@F^PrUzlK7UCU>*jVRxIqvA$D0DL?KAOHbVUtIEt@TnE#@
znXiy3tH+X0Sjjv0czf^u!8AcarpQ{^!jj8g5O<wD9<F4`+`e_4YYI|Vt6Jqr2YpUd
zLYZx$<PbV)Z`p!T8kJiD8j(hpCYjwZs0bCq<PU>^L@E)wX^yv#Ls}CB@ubpeR=UQ4
zkW7jb5Gb-Rh=vMf!?1=B)ZhXki-#&+=^vke_M!u|uK(_3z9%r?{b${r$rn&ktZg&q
z?M{GQNEtQ~?B=G_U;44r5N<<aH=)p=uXJA&4=74)@^h&1aT<yXb*?}W1~zx$a~jhc
znL-}&kyE<0NCE)>nDnnqyhk}<Oy?9c%H~nH{&uCSM40+=qyL*=+RS(jibBapkHPBW
zuKZbxI<&P4PgSQUD#Z*+m7uRo5=;$Ei{OPgF}m%0ZIu2RuYwb#8uLm3T0o`0T;RD>
z*kKvSFeGSnA%jzlhY!)nUQYw#>b(TNcp`!H(kb|yoX#$U|A8xag37F+&fX3Re<Z|U
zkiZxmEdUh3bmb%MYDgxjPf-g4X<ivOka#7InZITyu7!9g#8eWs!$2V(>U)v|-(_e-
zn%>k5o$9IH>W0y;yO#XX*fP#i=hf|j=RqbFWoD~7VQ@1%oACld`cX{PH@&8G>3zs!
z`4}_8@!LfK=268BN`I~~2`QlfC4M@k6XN|GTY0oGloA`}JeYW{RpN^axBX{%>~Npu
zYv5g--tks}B`WDrJ|hGIj5)hJf=W}~9$d{LZV<A#(kb{F(rquwjYh;{IJYKYgU$m6
zGzQN%ls_2H$Vb%(S3RW((zs{PqbT>^vZV5MQ|T~%eH?YpMm{nV)iL0+Ll}^E_7bn7
zs)NC5-iQ)ngMNM}(gN)QMJVFPlgi_{siH|mgOsws{7)X_A@N9Z%dwmH$F@eyv8<{^
zlf|A6Uqbn@zneXGa8P3{+n))D<$WgkF9p!~F5x2l%=B*C1#}+?SDvl?g&odJPb_-N
z0ZGZ(K`^<M`z=19C#rKW^K@!5<3%Y{g3Gka-Y?c6C?v>3HG)<(--CF<(i$804SDLP
z4-LcM5+~$?hJP|BUYz~sb4w2WLZ^kT&pMo-=O7gnhSB4LV=JP+Ju2+*^;it<k*q6_
z+NyxUR8#F`sr{NQRrs+&|LAO-N_|Esp<0<D2})BnN+4@s-j9?6(l1ZP6VL}QLg7!?
z6nYc^d?;xc0(=RH(o-Ff+j{7XW9Q&TmMSfP9n^ZrrDj=_V2r{?1`ObkF~&hNeYPPX
zyOC`Gok^+?LJQF`Mx3nz%YgV2wyAD&XmXBq+Ag6P6(4yk<p1==sgTF<A$gF;98x^;
z{5C*&22g-0gF8)c5iY@cF;nEyz%u;6fA;D*q}SvN4Z~(N4rud?bREixr@q{}PG--c
zjm^^i2S^47CAD23Yp^~aT`)ql<jUwdN?Ql40QZLkPb1UErrw6pKtpuK=4xUF)gVa4
zaf})bQDQgEEy%*wp|prRyz2-Lf&fWFou6w0=ah7c2PVo9290gCUwE731ygF#FreY!
zpfIRm@HE_^F8CoQ3({Tz(k3+($O9GkYmiL`N;;rXg(|X5O-BZ*rotCGl=_KZlO%Ae
zEcz2SFAaH5Zziz%_6Wj96jLbESscHjMT)9uhQpY3^cChoeg&frhK|6U8u_lTWc{X9
zSbzP2=&SF$p&#UFzv*-k2Ru&yYu}euu14jSxFQ7ZM3qo6%RrpzBurD}fEo-FF(Z+g
zXEaJb(cUzUCxI7X`kss!AX2kPzVb!~R2`UVzB+P3aeaVl3XR$De|!0amk9c0lVCJ3
zst~QA@@pIqwGQPbd75d^38q~}1g=acK2V{L?GvFsd!=s2>Qz$V68<|uTC`ap=9jQ@
z3>c_t^pm3bDACnoQ(B&`nlbQ&x>zGd-JtMeRLnra&;W;;?>WNK3gld&8%hwUD9sUt
zfK%hIf}_t80&`%@w0O`KlUF5mv6f1j>Nrz4VX}raS=6HDM9WvBOg#qk&vOF5?ef2a
z$Rk}{IB6^v-Souttx<aYaekFjgW}egbyGDXfgEV?Txyx%7j$VMuIETPF$#eSvP|)D
z5wgzwqON+DJ;aOAVoIYJp|D{ZgtgAndX2_P;imjb-=PnXbxgh)A}K>(X3?dtxCDW|
zWD&(V5oRR*=>6lSNG74Y|7#{Y=oJW%`$CxFClb0;^-4MPD1U+hD&}L_ss~l?OrSX+
z?N<4<KeeVfP}R#Hnm-j@R^et-MPZ$1c#tkCM)TPelD4k42FGB88tH8K7BCL49C9ZR
znsY$cLm11)(=tm&rCw87Z=FqWJKmhOzmV)eH<|nm_vUY2f26yb#{bjq_?fJT9!B0_
z<@J1{sNOfXb;m9VK?&IzE{r+~T|T(!M~(5Am$0Y?fay+CcuW;F@?hj(JP1)c8QKSl
zg(}!|j|f~HjEv<q@L=o+1$h|^MhvDDSk&r$Pz+kcRP?8gpQ!NpHXL^XYJX@h8eDl?
zzl8Yz!|)=!e|(I)7*0*V<l~htFgkVu%>nd=X`w~uf7F4q&Os)Lb2xP>jz6LOL)s5X
z&}tzR1e1=Z*Evi+O6WXz<U;D8M6+Z9W0F%(Gl$`6Qv{RbJjQ#BT3g_cKs9~bL~5L6
zvr!{)JW~2)+)(dgKC(+IFDA~Z8ND{i`t=o%oy+0qQ3_f$qFNEE7v)-3i&_Pfk0Eyg
zz|^DBB-Mh#RClB32d`Sfi6_!wz~PirQNVfR7Sa$a=pe*7&;A7dr>^>{M18s7)p&5m
zX=Hj^aN*fFCvtTu59%S+RKkIyj>f|n52Hy(llkNW8<W9^#3AEJIDQH~DPqAXlLhnQ
zzJT!cEtQizB)gKAT84h~9~{DA24g0n$&T*F@uP5@)kgDHMkcV_JjTY1Wvl?*vLlD!
zK1M9#!lPPW$ARV;$n4nz-M7sE`u9XDG66o0C;U%cZrxW>x7W}LxTOfDPsUL`9PMcs
z!s937UL<`B1567CTBa$d=&Eg)d^GY93TdryXugmTMuT<CF;pRK!K9;5zC;`}J|xqG
zjml}0h8Qy*E1?Nmjbn%5_r>(W==;j?Si=IB4ecjb%Oc4J_c6R{K-H;AJi$75by@q)
zHZ<$ZAhzs7Gm%Efs=Cz!{!H6XVD<4B_#>d1gAqx6DwVX-MX~kf)Z_FQG{F!Kjy5xN
zQj40<DSP%O>C3e!NI3Lrs^G7uSTL-$$1a+HkB(E0ES;A4{S^!@7#o1G?Ic`)!Omka
zz{V0xpMvxQ<qFOk&S6qFfOE$PII)*Sz9t`R6&V7xw6R?TTs0OChwc)tn}GMrJl!jV
zv`RN}P!#X~>ZLM^OwTP6q9O<#Gi-S9Oa`rDNtk{iu0gRcJIU0FC7`A4!K3E~p|CCi
z&;AKbvK>^x$Fz@*#RJfr3Y|_2z>ua6+<6LWKYNw#7DApHhQh8v(t?++upp=0fyXaG
z({D$8Zw_1r>Kd>^z-PCjdA!_%ukH%t^OXh|Hl_MFPVdMLI@>bVC+PkqNc39)W?dhE
z;64vtz5-3yO3(=51Tjj~!*?-w`vwc*t6g~G8Um?S5DXbjoJ!`y6)w!Y2LHXyfmg3a
z*IBXB9VfMKpM*uY>3_8h`*5zxbX`ZT=#157HTo7p=-YqxPq--SU3eOQyE~|rKtT7`
zU}#C^RXXtY^%gXaJMb1p93;j*0wF`|)H5dsEz~!!2|>8ZfoCs43g7Iz*8Fx1sX2*5
z(!<l5<Nvv&^W(aqLNfpZXZM_HLw_{)ubP05D62zd!qwHE5-oxg`zknZ2*8>6bKyv)
zd6f1<yDIlsaPMg;Fc^L0_npCDa8stO!1_?O6OI4Rh;i0vj38xbf2<wXt}zaB=Ji2H
zk2vu9Rp|EE?&+AZHa^iB?$=Vm9Vgh(H`9ZEo{hqP7g<im#|^a}3~R^WuG4H7*4BpW
z#^ZuiO6@|ShF4y>gp+$KcIp6&T`~^Xu|3I`NEOt&G8Y)e?{1nJhLP<!Ts}#{z~-D;
zbg0w!lk<DKg1gQLLY^bw-m~#IZM=x-)8mafs^1i6Rr;{HVJOJ`mIzD~6)nx>eU`6=
zW^Hwv0~|z%A54G?yVJhWe6V^{l&CbpQqIlmx%W2M&El=cITwZ9&Ucf=kh-?XldVrt
zgVF=>M2mC*Up*Frf;52F?g_x~P5@oIdXPky302sgbDRrzoCR=HKMuE?%i;8K3W|yx
z-IqXAAW@x#g75MmbVmZbeyRm$<4M}0HP^&W0MsW=PQtr?x1eoPfEWK_L%)s;jyj%D
zq!TPe7=^9X0a4ojyPVX5921<7xLF-qc(DAPFtxLWna_nF2Q7`0&%%?q8l9-FfR+ti
zSouXNxfS83FM|-q$oQ4lqBe>_6N#>&f&B&iFg*Y{=?dO^*oF?sK*t@QL=)Qxw!#bn
zyBFIK!63=E@7s`$0`Z*lJP>;w6aU(mfVrQcKMu#T@VlV)JKZu3wZPrRLZbj@)-TrS
z&@XhWOF}=<79$2&Uw_?(rWnZi>}d<K(`|U_8VB5BM|YF7s{}0nR#N{XSo)r&vr7JU
zgMj2N!%QKx#8-Y}K{Z+@3qB5NGym$V(SKQPzRN;0ziWro|DZ+n@6ki=tspaVsr#jF
zI;BELldI<7;e>m(_+t~_dFXBzWU*;X)ewV#%jcv+428zxj{>L_bGY&{2M;-Y^g$R+
z?Vn}`p)Mw2(MJ}fq*^ff6i3rJd1x~5^C{$iJA?~mGx|BmT_f4)lRfs$qXE{Wkg>NO
zXRLdBoAnuj^2Z_JEnvg|51zT6L+6$p?mUmdxB&p|IvI^r?iTQ;%NR@<i@bOuj%NhY
z)?|eiA^LN1Kd7l>tJb#qPp#>ZT|a;4;LacmvTSX^kqe_?h6h{b1awoo<+E+DQ!KdZ
z8VV+p>w?43K?3GJ!yy9=<`1U_p)tmqrk;Zzt;G8g7X}XWVD@7cG)JC&{eBMpx-jTE
zz|uw`S^5J9IB@@!D0kYEeByB07=_kKLc7bvJ_%P}9)PP(0+=`m;IiZK@SG}DPPVHp
zZ&~cY`AFZBhj6&<QuHqLu%LjSsRmA|$?cKfqRXPSfi4AUp<WFJKGhhtaGBQmiH60g
zYnn>v-WgKbWaoGOHvM2G&_OrB>N)Rx70>vK3U@42iL$sIF5BxZ@79&I{^@-dY|{zS
z(p#$PU3>F$)2@sqKAo53Q%YXC$5Q`%OsU(hW9-k50Ib7>v#9g{8Cb1w;oFZ;pj{~7
zy;m(b>U0Uwf*=NLP`M!?zS)DXXL6W&v49sJW^nqY0;*9kK$sZ=XqSTL9+dFR(*Sq<
z72u8s8O+^{Uh#AtV&*B^XY`1!IdjGTb&e_@weK|*%s&nFGey0WuQ*r2-c1<T?ZIIA
zk2u%G0gQ~BCRI?5^O}mnklf>_r8US#jpr5g15-8%YEfdhgeU(F@WyKrF29V!W6uNp
zxCb?Kj4uevF2SF(#(U5>(}KNK3ewQk^zbvdSIwjjh}sN=Dz4Tik4iZ1N(ukGiNnN;
za9qtXkSKJ<E4SqAd%ZbF-*mXq|EvqW6Kgi9w~>=&06&(x&t>1e8-PCJ9Qfgr5DXlR
zCTee6gP4U<6*NQN&I72S-*l%3H(e2eGp@wQf5)KyMluMxH%-F%BLeWwTmeIRGr09W
zT!)qxx)P~dA-Z8ATOOAS+Fk+wvFqQ+oIp2XAj_*nr6r6$L5Zd|>)g<RGe_F+_NNXU
zcU%~*y%SCF=A6*|(B~~+az76`x8<;Ai-NxR`!BCBNH5}$h*J;?U|eqxhIh1J!6pGs
zGZ{Sc0y>zQQCld~=+Zpipg7pDbRql0ER+T(t1~M0d9U&y@&fvA-~Oisk3Q$Z6coZQ
zyvSfNWo+e0oo*+#aQN_bjBH)u!KZHqVdD7-C=a7TVWWmg_UkGMD}F#rdN?W~KU&ar
z1fIQZq>i!LX(7h8Oz-Hdx_JG+wU$SG{gSVnOiXs&BkYxmqY8-h6m%7vfQL?NbPa9V
z;i0m_VfveBIW}Xu*OrVZxc6!WbH711%XkK}zXJGR8Lo8(SxorIQU)^~W$?tas7a%R
zd&m7AEUrQ2B1|zk^c(My@bS|woO!8)IWt2r>O2Q3b3!JBM*-+n9{lhngHhvMnEy=x
z`W}s1T2l-JQ?0A=m|DT%^A7@Q!f_JLy-M<DzY6B@Qs*+6RCib*Q7eR<8O&FEo$ta$
z!4Yb;8<m}*wze2@vXN?PUlt3p&Vj?Y_6IBYa1{#;F1cR+QDnNh<qY|<8S9OX(2Jfi
zd7&vUG`;k}IJFFxpDgsK;!=LMEGg5Eib?xe)WiBa@|CX=k}!=vUnJ12t>mnEu4F?T
zbHAS}AO0YrA(0ksG_Xx?&yPvo8y%%%QC;aN<>?O^xUrAt>Bq>8`#hO<yersIp5VAx
z&5zkU>Y-~?%7oKZ=IxKF%*pqvj2oZ-F#|f!Oo#R#WWb0u>4oDyPrK-uC8@nHT9SIq
zv?ZxPJ<gB8AAB7~;3?N_McVbBuShFA^YgSb?_ZHdf9w18Kixi0yZ#k(|Dl<?bX8o#
zQ`KiM0v(QnJ$alD>$Gr_Cq10w`n{fPbX>K8RKqoxaC1_ReeP-@<8dkX)p)Y^pKyL7
zsS?wZ7d#m^kXG}AuE<=q!<B_6QY9x<@F_X=TC)aAHcPY~rLNZObddpNg;5dN@VL0F
zjeBxSsgxyEQr6*joOWkiKp(2+q#vnrd%S($&kS)WT9kQD;W^3E_*gt;#tD%++7;W&
zTv<`0<g(2|Mj}#P_88jY18|&UmF#*>LOSTG*}6~3J>>*Y?a8q>#!!uMs4`BrKQ$^7
zNms7hEoDU=zOUSqJukv>4$}a+(w?ML>th!`eW+tQ^w<CB-fv&Md#lvUQ{A}PXIJ#R
zEG}pt7OYWn=RREPS}8}|hz{3bNxe@4u8iq@`fj<>K-+6KQ^jpU@`<R9jg_+Z#R-Ya
zBUf#cvb<W#wc9+|@>C3N48t`TEkwq6p$f0xS8ym}YlZ@xDs`bpLf$qbu9@SrB~m&<
z$*+G(iqxUCl8s0D>lu+ZK4s|hvqhf9GWc*_Oj-kyl1;#U!_U9BC?RoJ^2fCjUA9s_
z`!()Iw^|J}4Wr{~=#^^pLl4bMDI9ly+O!WpOof5S15@Uuz=&;O4X=p5iRbdCtVt(6
zA%4+(L+_#YBEL<WsnYY#QyG`eT$2u+@u%A>=6%G2#DA}Ro>qjP(fmb_fXCoZxBJte
z^AqX)uUL>d89&<}dA#*`@sXj4njSqEti+_h7~c9}nI~(I9=Db{vhC?H1F6<q%8Q;b
z_diA6LakV?FLq?(lN`y2H@hU{^{*J-`f8cbYcO}MD??*(KPOU^swZ!IA)(<PK3Obf
zWu21me;bp5Aqi<6WA4xTKB0O3n`OB6Nhx0Z8fm?^D{#*R8<3D6FHN9aRATuiA$FFy
zs`>G%Bhg}h=V|GzpYp<e)}Ez1Y+kek{ix3bvU|SPob^&FrPW8xv>Y<N@PE1fn3y|!
zI<8^3=f-`@8*Sfz^5TZ1zxUn1$niIQ2eX*SJL=U&<(p0_cD7h5m@U-itroN?Lihbx
z6OpI<=ipv+AH2t*+b9X&eriGQj%b#RLlXy2uTTihn4JK7zU5HV+lAHN1)yEi1lXg{
zH|kNQf&_Ot2Gw_RNY9p#sKa1Q0|xdWt|%Rdd7e;J4DP$pmfPw$J88ILS3W4!PV^7Q
zG9BHA1ViYmZJLA+@3GabC>q8Lk#Ny%s6-TS4T`E!8PE?KnP<Vk>j0iZzi#i7QCn)l
zl<C`zTJlE4%9e6ybq1*7*O<!a6;sdzXBP;vaM<FB#SUy*&Y^8T3}$ac?Fh{+)mmz=
z7G*2AOC8v}CI~%;0j&NJT};C~sKxp4^sx5TIX_7#--r?F=G6EpNPbY@11VK7Kwkmw
zG6s8AI?!$)X-YP99*uFD1{PRhlUAvA*TB8EWy6n4(Z@L%T}|&|EbtqqY)WaQb+T-(
z_I&sdtUdm^L(2pI`90w&>a;|;_ZkbJj|5#fe>%x!g^f6DM?az!wBh+@5)f#crqey;
zHh`BOMIZh1XsTbw;D!fr?>7o%6{G_BA>?Wfb3c}FI{Lt8zhT3m@ikC|?s|^C14%I<
ziNWu}T`!9_nw@hfWBcuUzxTRgzs%1118wq5mBvd%CFNyO$V{#U`0^vcE<zvo>rW{-
z?qUy0Tn~6w7;PMkKcFVN_{$_rz~Jl;7>n&bSb~GG4HgbT&_-9%G7igsNWxJkaQNtL
zbY<XP)nr8#gflUok2IH(<f;2o8%BRu12=QYxFUXD-HPDzb_Vjo!aCTzAq;I=NT@8~
zkeiLcJv8;nEpG>q&UVIN+x&EB+}wk$8<CD1qJ=zC>Ld!H&q53){qTYXqs~?EA|CT2
z2e>MLR+3KpL@$ik>#?<;OYiiXg<3G3LrPzC5j3LUtRO%H39BWqTFZIQivi|5#8nHN
zH*3pv+i@y2mfIw&TN-5jujKH~&93TrEDo%hA8sSd1+A6hC0zBqioyK*CA31918-w;
z9C*-U4Uz#i`;nl!Z<ge(3I)6S2?v=a)d~g`ch+!NHy6*T5e}>*-WY_g$)>pGnmv(E
zkhh{34@%1v5UmSBT9X8@Zl)t~Fo3S!1vXS6|L3$8P_xyBtOhoOP*x?AC}(ib?A-tx
zz5!^BF}gKNIJ9qB3w&gjNtMOePZ63hA3VZf;+X)?JkAsa_JhOFr9-WyJ;vHJK)?G{
zN<H`j28Vlde*ZI~O>${?i_SsJfByCS@#CH>o6+nC@CmcUh^p*e6}x8$wrnb_JnJ_r
zgaQ6ofFF?Fq7JNV^NHRs@$LCWQEJN*_7tWuRb0sx6>nA7QkgtsCW3&$78Ej>xQSH}
zTrloH9UgAV4(jMWN8$;g8JCXZtBo^AMPiFM0iE$=P-_GR$8d4cmssI&D9BV$T5IVp
z`y{w@E~n?QyxagpDaSHPvAs21Ig}I1Z0e7sC`*G9DH>-pD96vHg_5wZ6bX>3xlE@%
z-2=HzBMIC0a+Q|}Y<DS+F<{cWH1ZFcneAIj*n|g3`xc<qZPkDjI@^;F3K+VAa?wVq
zs9{i$E1(=B{1hbdd~^>=`EHUcVP~nO{n`5}sc6H~ha82-DVUj^!U5x(kcDeiRwoUz
z2s6bxv{{W&;1`$U_hd+@z=KS;Zlx4O^1cceGE?vns$<Zou>~bnmhR5#Ii}w@QYz=g
z?>{0}o^bWy3h=B8)YO_S-kZ1)k^)}28G=P{FR2k#P1FTKdr*F(e+mi}=5Q#j0m#q5
zy}}p=P&%4VE|h9nn9Xti78K=4Rb0yaTy+4GpQl&@&wj1qdv?YjkL{1<Q2*X~!F?$2
z|K*i8S!Gm7uTtn*c^n+NzX~#4R+0!qQ*@8*u3%uGyY#bhD=o;+RTMvj{IG(36-hrW
zAgIxLf=CkuIRf_LKIUZuloX>T8K4gbOqNQD#dE7;Mdd%F?LGK>%sjFtiHmBI{2AbQ
zKuQOB$b*<0fV}(wl*f(FUFZx)sr}d)_&pdlf>azzEv2>Te#{0tA~h8iBc?m^gIDKa
zd=u4pqCIl!So$rjc|(uwDX~>^40LY7fH_c_q(+TGTEvr}btA>L6kDoABgVGv!{gl2
z4X4Zwpt9Dwp$EIl1JER2vaP$ROF1`bj8y4@%g~}BV>?Rm^9?0zLxHQpdP#MFoWMg`
z6ymy4z})hnvJ&GGIx=j!L^j5?EUrRp5f!!K3c`p}24sa$0Fm|@rAyd@afrffJaA({
z4fr5+&|K(#?K!w6gb<aN0k9VXzQ9d}A{AKB+M#-)5vVfKI8;W3Nej??$sh~)4#gUs
zL&R{nc9dIgzJul;KrN7Zm8a$~NYr?|VNR&c=C@!g`n&@ey!7Kz^)hxpY5Owv;ML`S
zkk>g4nlw2-W%mWoCx7lQqDL(Y3-3=W83qZMg&vgPdhVbg-B}(4I_awtg!mCO`QLus
zNDN<#DFYmmaBO{Q8!$bl9sNm3eG5$5V=`guKE4JnS)*y7F!!J|B6Vs0-b%A6O8S5Y
zR0@nfz|tCnn6jf(myMeR(1Bf@iG!Xf3$~SWy+(Dl)Y#ewGGTrX8f2~wyC|M7U{{H!
zxCS9$IxwY$JQCCT?Y1taS+|X8%@@xN$`LbpR=8OeQ6e0H!pk7BQ0fL_ra*-x_^v9`
zFMA)Q7t-_Vw}7UL)<y*eeFG%C6O_Iq_v2-PL9T+`Rk$`N6v`>L7zMsQqx|o{MS~jh
zwc{bOyBy4ClsTMe4g75W!^$$Q7Zw=I;U?s*ba1pXYU|)*d6F17s0FhrL!g2X6j~^}
zEwmcS2=|nLPDFh=DCl+Hhldjj3WWzPSQv~Iw1hhE)|8|ttv`xk?$@OM>%Lg&R^l>d
z`1A^zYf7RtUJrIxhKz8Q29!kUf+cjRR@)lLdS8U=Zki@rLg{oh7x$_d=^zwBVMHxv
z(@=T|4NV36(PeU$9g=&9vcJGr5C|KsMi~0si-L@hulA=wb5jUd5mQ>I)Q~UUKHzak
zpm9`=9LogEJtR^Ch@$D63R5VXOl>c<bw$%g6y7Z8^M()m#{w2?-iz-?jdkm8q|Bg^
zJz52)`zUKSml&b86_q5Gf}i*N1PjVNMLOBGkCZJJwqn4Wh5af%Zt}J1Ih%J;$45me
zSBwQHH&vQ?8T@Zog{7_iy>++-G<UzCkP61Ac4@b!HQbXrORtfi9<CJ+Dl)5d4Fb`w
za;D<~rp`&{Zh?dJ>-Z%V<%Io2DU3dE(tp)4%2uJ2U-~}Vq(^HM5U!`7v3>Bvaq565
zEXYby?_~6nRs1GD{wm@3j{05v7h3;=G{R}JxKoq8*<X&NG(rqxQzr-}8;n@lp`!Wq
z5y+XYKi_reH36s%n24)(iAbIJuB%G?98$VRwjAlrrZ^zr=SUhMMetL)s8Xl>pzGiB
zG3_)kDG8qd^{n!l$kUDQb-N`h8uH7usf3w`hKDT5;{Q3PmY(nV2YtYl&8i@6n&rbh
znvHNtc36gBNMn>>4wQP-4^2x!p)0Dapn;Ln$@+S-^|**Wv04Uh%2X)&tS7linIs`+
z^Zkrt&KG7*NI`Q4Q~1FQVVgW(<pW1}DD0FL4!ZP`a?E{0NrNd^Cf`_VOtel~p!keN
z!aTr^sBTpx=twkKD3q0;OWl+y95Mx2cKtbtg#R<+ko!x|1xz|99k4{yy3k2?2%z+G
z(@uAPH4o*kr|?6_LOB%8`#*8znnwv!E>Cm=c8Z^$<{A|j44sk^rPJkctvuQ%F8%y(
z-}+$wGYA9L0lklQ&=`ukUShwYoO(zjv$BL&kIJX0=pqm{yuv+Q*{g++FJL+KS`To4
zt>yk!W%aqz`s^e=#67anvQnCd6f=09O4Fq_7D>5EGcb8t|KKLyS$CNY__$30Jzr)H
zE(SjECq5VH0eQm?ORWGflEId}pI7yvLi=y|0+{<epp2zSf|XiCfX}}^-!MwOBum{%
znzUI0fnmOKrr+Zqa>DQc>_1TTTKJNgs%SMDmaD5|!M9wP|2}RRZ^8Zo9zT5-{31Kr
zUy>~rDQ13deSP|_De2eXNZP9q%`Pwkqye}Y{r0R#8Lb9_0gcrkN^QThC^V*S1vGh{
zFo%69@~`xK@HE1f3x`67x!2(dky2CJ;nI{YUtbS%SR!Lc@kNg4`hXY1^JCS~cV$f3
zF=We*EXN}unMC1Jjf?0}4!44ofN!4ZFH*X{0wvFTXxfpvL5sos!VpfM$2b>5EtI0V
z49z=xe|sSVT}3H9sv?f>!GBbukDMT!$VJVy@~r#*$};*JkBN#TvqP5IsQrB^m`-&I
zq9#B&o|Z<d_0K9IT3XyH19wK%Y6Od>p-TK@fBGV-9#j!LTjR*6adNTgW(j7XQkb!!
z`$*?IS39QS5;u&5o<5AoB&!4sF-Dj%Hdz76pCi2$-5sjR(L$Meo&*B^BIuGm!{4&P
z)5NPvlSV**al;UyQDLJh6NUlG9Wp(sD$htprF>z3IF}KULb<+#R#4xY#;fx5!5}I?
zo41_%hbD5NZBfOks~K5TnuD1bQu$SX+OV$Vy8nwRN$QGH^L(xk<6zCdQ;GRog8RVN
z4mE)5zuN_0)2ly?nGw3WpES}?S%Toke4UAzd~S5J$P$NI9N;_!Q2!Jo#EeEp?k>46
zu9Xj3pOi4y0@jpJ9{OcP62`P)CZAgis<;7PR#h<r>8CMFna1Z7DBx6tid^s`F~?M5
z>PZ?B6V*}|pm=CGQE`%GTV_(!4+N#8tfst0i)pA=Wub4K@5j(1eF*Ps2w_z5@jb)`
z(q9mC#vqY+RgCzOxltqZ0|5c`)w^6*wI;QI)W5ZWxBSDw@E_%4Yt6nE55BOi36J>|
zu+%g_RV6eAtHAf!`>RaB$RQGsHNFX2BTdyZ^L1=uFG_Pqp4C=Cb<*4y=Aa{4A(Ob5
zXu(J-vqu+-K5x0{Z$q@NA`afeLm)wGr*xII7EWZ`lT3-YOjm>A8kU8@?L1;ldd||S
zCXr-OC$)QZYaPr*S4UC14S8O8+t6fHdbePpT@&c=c!PuO|3SIgE^N~QGMZncP*N+A
z(mlx;VLU-R5}pvLtn7=Ys8?1BQ_>>At_3*+qb{Irt_v^yGXR~l1-x;mg7`K|mvR%J
zs@$7|kpnqgbEXZ)_7`vsK26kU=anXGxvv@~4RPV7a}^wmXVG<MqgX2Ez7mQXQxk(C
zG_l@)E(4mV6qxlmdi%CS{UR2DZdDX%B`&P{0)5%LT$uMJZuUm1YSk(NZbkycf;w3E
zZh*zsO1A!EB&15kLMg^3wy0y-vMPA)9>rRq=J4Lb7VFWD3LFifnT3%ExvQE@7%AY-
z7cq9)7?)jriVN`yZU~L2#7RO%ECye^7KV%(rM`V34Bi@M{9q)!6ER>rYhm}744lmp
zHh+vXwMA(mroSXo1x-?2_yRvyl=NWslX&240|R(V!4TrQjSSY~9MvWdmVSiK-<0sH
zS)~qSCYIL0nop61R&rR20ercGG^U>mc{KF>5nMqYaKR_|0BS(qPab^ubO7?vZ29p;
z5AtzroZ<zjO$E?Q^%e?P{w^}o4i7eeh;uBHx{!r9#o}@B)+S*!&fi_B*s@QNnzzRM
zf+PG22mORyrGO*84)k~bo}1+mg?NsBrt$Uaeq0zJTjIg04^ap&$AIA1ArRY0k<{>H
zC>(JucDk_X%OHq#Nm%nP1~IpCEyPJPv(WRXw&Fg0k&5&7V9R?7VjGPi$28D49AXwY
z?n`x=G(CZEeANl)+z{ZE2RL*{x8cdZVi0XdLTi*XE*JS@L{|syz0QUS0|RjDrC|^y
z0j*im*v0x9xb8d;PC1IfO{WQ%aujk_)EqiQ<6=t%{OvNuCiVe%;6i}Y#^GmTmT}=>
za9XS?g}ZLz&?d!(*B(xTjzuY^MTU+GxZo_Uf_I*f&>V;S`NNX6FQUW3){0NSPJ*|z
zn!Wcz3M-6S?33qHS>p_<qd^}fYIFfB!MynqHs?+B<Lne{$(wi})FJ<dm{w*uRsA8Y
z&7Fm`w8B%HKIX_f!YE3_KhYR8kS=`tN&vE>OwE7E0(T23Qp&`sP-$w9ajWMavY~5^
z1=H_9-r8Di<PR!#0uSR+JtRE(X9g2`0^E85u1A@%NXhb-TLhePOb{+XU&Up|DL8Ku
zDs6SHw#q2B<*k?S_}>H2w^a~&^a{YBHg(C3q4p=#Y|Y$(^b$`5y1Z&x12>blT@q~e
zkrNvHCd4Xgor0k&tnly;V1Gx-U()Qs1h}18(BN5E+@yV=Fcmp+(dBaGsNR%D=q=AZ
zKDEi-aXbq}bJJ(r?wj4{sYa!c+Nz@k&;Bh4W7`0`=^O=v+u=s`bd*HDnk;wWgyU>@
z4hiQ}j4a=EF@tl*0i@^prcxD$@kgh^qn89>WIKS{P6N0Ai6^hI(JW;o0Ymz`@Zmo(
zc!<HV7ajyPq8)?AJ#h0-&=GialLit#M2}AEEDrbojX~dLHVi!)&BzF~@k2oz6YS0>
z1FS<nhg<)Q!N^87TyVMz$qKv|Lc^w9!JlqTVUxPsa0!0@gkAs_PXv9c)9EeB08X4@
z!9V}R*@=A_Tz@Ku3npODv60`13Ed+tn+M>%C)1&QI>6mGGByy$*mn|YEfFf@k<ci|
zgJ=F3M3*p!NB$<DWiE%2<IpOpX8L6B(!qim{|G_{3~oO$4RDifXxl4^r#jQxLq0zD
zX^eC?PO;!`w=(En1TbV0el;D0ILshw0FOS&p=~CIJ8$)%V<QHqOcBc4D~*+a3UT8W
zhb_Q0!K4%=tGF;`p<C&}6}JN%)m|Y(1N3VXgv(9=U0zPw6UJrX;b$atY0Th;3jkU*
z;BeYh^!?TZwYePdJh<l{3OeClKKy`$9{9d~BbY8mp@~{y1}!5W9ARbcuZ42G@UDkt
z`}N<4umBNIsif_py-!+V7@bMepA*n3%Z3O34$v~kh7+m1K_xZlibKnW3SNIU1kE!z
zJog|#yTSkr9h(HF&N8v&qz(7qpN6!`;Qm`NaMysT0i#_-u68=M(!=CHDL>d~elcbq
zGAPIjHNxIK6g+i<f+5Y2{xD2EriTR$D36=+lxscc*-OAZ7jqcbjl<v112}Jtgo4(t
zK2)iQ>a>dkaLM=}oY+gjrIP`!o+u$47KXe_fK8f`%FZ5b!{h+~XN&<jcNFz-F@a2p
ze&h454#Op*Y`APHz;P(#|8yLFmIO53r?t84<^YUoZ^6|kD;VC{f(yqvi~_<6X~Ny-
zvJ)>0!O)ffw<CWZ)rZ5ixTap6vB)IS*59A7p;sZmy*DxF-O`5hjwcvDjfoC9sSMtn
zZb8pH3-0}!U@ej6hK@v<!_QNHlD<7H_~c0&+8}Q{b*q4GEjV-=h~5H>Q3#B!_3I<x
z<-c1ns42>iYb6|oYnj(BsAD&>TEQ5c@6*>?Fs3ty+i>m98iD&%U@T=(>cW{9c<{iv
z9FFN{!Br<HIBgVK7c8l*V;3#rqfU0=++iF}A0sp_FyHE?xSv_CW`&>6Mw28h>}<PG
zI1e?a27)aU-;RLF=i9K92ANPZr={5Q&Uo;FN&aR34?-ngJu|TA@?)Upr|<Ni#dOT!
zVYdB~t$g{6(_qByS{k(J0q%CxG&4|>yy0#EX=paz{Dji|ttp_zP#c&xH$|U>(;o96
zgwgIhU*_5j)jv53)~-sypbNhKB>9=qZT}2vak{xb?q6CE)^14CLAwWMNOa8rdxQXE
zS-Li{cn~A*C<LiP*z2ERq!)t(ug#`l1lPd~YO3YndpE2P!sdMdtJgAEiD%vSODWjl
zqgQ8y*iQ??I`ietw=f`!0gtz+T>(YE3ClJ+pcbu2gLHIF{`G#!USc>GOP8<HDh6;)
z`}T&waRcz!n*s_k=Jmjv41<kSdPr7?jZt&78Zi3({x=vzEmiR5R{*;zO~8er?_=B6
zOrYLX_r2yqPPzpTzl9c0GNAo}0W{Sst5YBYzyIYAks)0RUjLHAw%zz))O<OrZ%O3l
zwQIt#qeQ}{?F_zM!eH?l>UBvDd9M5Rpvy%bOc?z3W!@4AuXm}GUwZ-Y09mlWhFutd
zdwC{<9T<>(_iLN7C$xVviB{E?EgY6_0N9B?bADp5Xhl#bS=e-6WJ07a05iXlP>%Ee
zXg&s>s*pZHWU6p&^~Mq%kFb>fz&Rakeuo$MOzog+ZK)NRLK4UM1z|^-4WHw<cNU{n
zI1htwyMpAm#{(<{_LiqWEe6uw{Z>L<91r#H7!;QW3|=U8n1~0_#16xYA4rJTarO2$
z0NeL!D0n@6-AFHO>>*hoj*Y}l?NCD@*uEnO>1h_+iHBzf3aW=t%Ot=QYDmLSE8e~;
z2>IDITy=|pFlw%UdkF<6w{*gQjju2GAr*2m0Umk^$AzxUJDx$^C&dSA&IrK9<*AT@
zbpPz54pc`J-2D`~0|Lyr39~I&y*?dk(KY(o+a9djt6<h=NE2a8_lsfK9G0$3ff`g)
zUVQ}vi6|7`{?OK$YC2IREfsdG$50v`M9;p0LGn64`VN4F-$!v25ln+6O9QYSU7vG*
zQm}X(@ozv;;FA)`s%z4q1Oxo9d<~ixp8XgD#5IPu>@)@2%TiEYpu+H`i(kdr{WHl6
zqD@MzbZlH1f-q|9|G>4&$qT?e&!UD7LG6yQGJ>#b4QlRaIoxoUgr=x?O~bY0fuNQh
z9Oc{m@52yIk#Of@Ld%1@pSRG(6E=!7#soLa3ql1R6tBzxShz!~FX#WLeMeQtTvVru
zU;0vX$y@<zsOR@ZVlx37H@T?9W^13uV0H<VO^W~=UManQoy?PSdwvSrZ`=na#RVwL
z2ZTUhd*&N3$9#VJy-$lX&TyeH58#Bc0G(PhHes;Csw>Dhh@MaMXJ2xjtJ8DFqUPNI
z<3C;73#cJqE;YbMVmN!MKn+vDsBxh3vzY4E4T+?fdPI_$W<%eB3L0hO{eGy?G*vLN
zw}RRl(~eapT<FzBLYsyX+Tj`2ya{TbEs=T9?Lu(@fhTYiG}q2R^Cla=d+2ZmO$$)F
z$P~J~oPr~n`0vxtkWh#k{Dk8bG|9vOT$Y2{W`f$IDj64W2A=qN=?q4V6guCaSsMo;
zXtt5Rk$Qnl9Ogmy)&RXbp$6FkU{qfZH_g$(L>X1kxwC}c-4*miE2B>@2E9579mvwb
zPF#b2BRy!-jLLWcnl-}rb#$S!#?t{O7k%<ajS$eim4abt!VT^zU{GfQg1|N6Nv+{`
zXe;5=<0Q#f7(SFi=T-oXTHul7`N2p0soIutfChT#mlEA=C6oF&8QDx-b~aU%DmdvF
zv@FmvXwnM(e@Q$<(OPJWmeUDi6*NX`XXr2-S2Oe%h8=3KjC;+YRgniLq4w9I34@XS
zLG^AUAR~h^sfffZ9du1f>)-5c^PkI3*}ZIzVzClMzT{*b?n`?QCJ)Aa?trv14EM2(
zf{HriNAxmD2TgFa-iDwC*BIRy?OI9b(}~U^1Nba4{xful2jlu94fkO%qCY^d_7sna
zn!qphvk4|;p!5*?Mmpr%!F9)RO`fEnRlb1X0|{uF!-xS%h*dh&WKG9*CQTNQjS9f=
zQ&79iq<JKvW}mAAcLL4*Q>HqQnTA#&@^BH}Z`)Ntv?O6#LF4$(KHq~hl(v&jKpsXu
zXxbJnSd7CEU8RN<9Cx&W0;Gi#PPCv)5r?L2Q2VS9`aZ?_&pH8l9EIuF2@)EhU@mCp
zD1kD75*YFd0RDWLf}%VQXPil}s|p%6p_m!yrgyE-a=dt|2TgOBnlRK-Z5yLkKLvRY
z`O?L>)X2Ur9Mz9Om(~ipc4jcRlMCgwLc4do8U_7(;AiuZ-umhkV3^onLKQXo!nKj8
z@QfIb78UN-xM9dMnZ&0qME04iBZ0g-<=CXA&IzLx<f0rJi{BToQYI#a_m4lGlrH3X
z)YNGWdZ4Q+UPHcn{8Ze7i?5a%%>1nL&?;{wSgH?h2n$jDsyuhR`)=N1Fu=y7U~!bK
zF?VU_OJIHzVvGZ#uD`tgK!DGb!9iP3g3d2CG!asLNvdqj&7V0QM);^8oeJbvvl$Wv
zhr3_LO~lQ(b9xXQ71DqVgq-u~923ZS6W@ofe3*g$PlXz{=b;INg8lO!O|IvMvrSO_
znHgbVsV3+}r|g<#NHl12KJdJNJUs3HK7)YZeS;aby5&E5xPUfHdt5@#4mRBOs0C3c
zp!@gIGxls(bP&Q@b0l=m$KPLb*t~;Ml{_7Bu0vVxpc`f7F5MUl=AcEfVi}&`X(qzV
zP%3`0i0Ot*A1^Vvpl`m7k}_TDj11D`=iup|jq>r)w-mH%gsz$w(A$|H-zj0jd9ZdK
zmBFKnXu5=Mtt|M<;|$8s_eSjm7&6w{c?=00;J!x`WaIm8eF(Jx3VJZJ2H$@!p(vZd
zU#8<h(TbqR6jVo3bx?=0XEv^rx}E0zvm|sX;PCY4s99`B?JM16Kv1A5p6>moFYS-6
z^b!$}fq)j^5hU13bScf-YUxac&z1r#T4n3BFM8^hO%%Jd;Dy=fMrjp*XFp@GdmoM=
z#W2iP^c&}*VepT)8MJSLjQbpiT_q;nkQy(N)l*xm{$m38-@Qh(pp?jLspIiD?lp@U
z6r#5E_Zb3;P$=AhnrJBo&2)c%G&I)zBp?gp4*x)ZZ$~_&uKEXqJs2w?aYFmNWC4SQ
z*#LieUO{Wzr`un&p`wD?N|-4pD{N&I9xRCat2Dv_lNv-I3}1bY3IVR&W6yceq!FMt
zi9E=uS33soGSNT$EeaV_P+s{6w*ocmN02@xry?)p5fm;<(PBec154MUWrTsa4?klX
zB9F3JJhTv(EvADNt=A0-O7I~5;@c3;M{53w({WoXVZ}~>@-hYs$O2r5s&xj^uP1b;
z=*<|vS-h1&U9|<@tpWAJBBaeM(vAd_qeWVY7W4A$012ewPgkJTwiG{~E_627&K+dP
zTIz+_Xz}CRo+O&ugAWZ0E%p{7Z|33}-1&?LeOjUi;3*rTDBP(x4_bDx@GFJNnS@&&
zlh7Ium+Kyt5Yd4KT)V6!{PYcjFdizTIfrnK?tTtMf2w7Y_we;^QEp|ROYD{JmChu)
z53K}``w2)W8&<4Ru&0W_Pb)YSqu_oUtz(v^+k`6gL&3`BlsbvlKgN#MZYAwM-R$FR
z+@iD>Z-CQwv@$78W?OSwp+lq3g3D0r^HJ%4TOqN2n@GTKE`A5FRu8XaQMOW*J-reN
zr=>xZIa!@<>r$OJ{QDL=U%IDy`v;!Q$7V+}x?S4<wc1%<pf!|>KESu7QW?@D($hI8
zBnzf`@WlcJRk&dveG$+o=9Ifir0qIFw;ufzoi&s?{Mk1c&CUsEbDEO&>nbd0-pqkl
zaO0Y{7VyvK(X`8A8Z3fb0}e*q8>8R*safbFZXw|Dx9}bb4BTCvrGW}gYQBW`(5&UC
zZ9n_5M3YMzh$~u3{Qe+X06(o)P=kT}xf?kAgl-m2o2WCvl8k(qVKk$@K!H^g6EJ%L
zvSfPD&nUt`RIQ6+K#SyK)Gmq~c<S{4ND7kbVgk|>Fxc13f@j_a)J_CEiie#`1gOXy
z6A;BQ<`j4^<8uodHIwkt`^XvT7PaNqX<<n;5u3Dj;0Y9bojWUd;B`D~Y|9k-P-+^U
zLfMUNn1#ev*wTf^-r`VR=jT^zH42{<Tf0ydzlEZG8l(OF<IB8{b-km9Q>RYS=|t#A
z%guAyr%ONwf8Uy;VDoNA`!Xq5CMqQ4qksN|Pf<H>B;n!rQQL`gW6Gmps%nv$&<c6x
zJqy~SCHBCJ35e_TLW7M#)AbT{OVy4?X2bu&b=*sK<#y|4G{J4kDsamj$ZP1ar{6_C
zDq2yGVURNB*9vHG0gMskH<$4I2ONr;DR_KF6hyi**;UB=Zo+~lXuUo0I?_o~0S}{6
z;sz+YBV;m_0vMC2VGlUl?uh^EV5S`)!0&)y^V@nSC7;X!5~5WuG(`XVTXQ%xE<zfA
z8`nIGV4OJ9U;<<XpyKh_0uoLF-kpv6MZNAQJrDOKi8Mx;D&MT5dIbjGpuopiml-#u
z)}f+6J$Tj@OIWpo!@OleyAQO_C*f#U1o2E|)P;GQ(Pgp*Urz~`3@|sT{lzObyHJZt
z)t8HduzptprE=KNX53>rg%*7913nWKw~rR$LAZ<QS_#nEFQ_0kM!E78YU_m<OM2gf
z(prk41u%wByn&W?TZ|pOgRv;|>pzOTAyUa5N5yn5M5{Su;pb+2#-Rbmt)6}Z*8r6z
z6NE%zjuvzQTIsKSpzywgnJ6DP#x^KxjGj;U3<3|cZ}AXwa4p~bi1PQj=>txMK*)o&
zXkjkeBw;IR_TT*|6iW>lvzM~x!Y-`dNDu%D7H&{%!;)2xLix-Z+C$a({kh>??)zT(
z{o4TsqK{y=m)Y*5?5N%A8w_CG3nfpJU?(HyUk>$yYGLW4_D+daW!)(~*}_UmiP*t?
zJCi>)?wL8-dsW2cxM+=NP|(CG52ghE!pom}cW26Zm9RIU?8Z1Jbhy}!r7m+fInkD>
z^T0p}&tps?188V8KP^tj2`NvT;I|3_N>)l1Y7)@y1>H@b@+;AF^Y)?!i~`WvMQt?E
zPp91vT<1Cm$jw0QAsb`BV-LQ+X+T#|8H+^fQemCdLK-ufPDmtLbM;}oC=#!`{*e>h
z&)f^5-_G$&@dZ7HpyDK@=%J5{ptOQba1P{EP$tWR{F`DY{%#Qju@4Vk49+DzKL?(w
zNzsAo?!tqrF&d-<`$T9pdbRx=Qi7F3pK7QnYGK=i3N#Di^J#oiC(~1H6wTdg%r*2{
zu&IHK5}t9xP{}XBNwHicJOY(yKoxXKX`P!+!hpqj=?9O<rN>_lhgk%Ze~NQXStWmw
zAl39dYjob0F@xv~%#c2uqtZTA7x#+3U*bCPY(stq*MnLNqrlpZ!lE%AaQm3j>rmhK
zoj3|ND-d1&l>0-kOX2XY{aMui$*ajjDy8&&Rpo?aka8hyJdC}a9^?5zkhL}h8`onB
zn8y7!#w%RhN2?+3(=H6kHuAKlrqldTK!#EKP3%GX!GN5zg&@^P&oQwS-9SIZ<@t$F
zVaXS)^j}Bw%L>%|5$gOhE}sKSD4j`y-^-iexX=fk)*LnJI0Z(H0>{yfFVQW)o1*58
z!M`B7Su~Oj_^Eu9!b?zjXyrjQ&Z7Z``tHLz#hucF$<u>Ysfy!1<Nmr--2$FY*OoP=
zvmrW@H9e<fG8K1qjRNYSs12h6quqJ*W&$(M;7SU^pBB2a1;JCN`dNp_uU0D2wn+oF
z0}N#uJ~qn$Xy}e`R39Z=onx&tJ%~4&86FDwkZKy~3;#jskkl;BLY@@6J+P6t^xTyB
zAs3O@iQ08b{MX(9gqjiZlJwITeIEwOFB@GS-d?2P#+Gs&^I1K2S_cYJ<C;JnJ`erm
zLNg}QI**nuwAPj`q~K}xLk)xMmN9k7il;p%1KsH&5y(+nV&A0o3k|FJz^k<e2p4VV
za3C58Y<(xWpu;7<MVkk8p(IL{?+tnDzp$+|CZjtSxn*VV((Cc~>K~kB?RPviY*lPs
z{E6JWdR;{_FT`-62t1d9mVu^{dXIw1$~P%)I@VVJ8ladp#EmCp3L$;rrakNEe9|Tz
zs*kvMjwwMk#b7or2L3L@(~kfU3IxPrrZijm@6o|T65hlFDA<HFN%KBeXa=)#Nr>Td
z8W^XX!2wf#k$@pgK+A^AQ4;X9ftp)%b(*DthoK==eS(H{a}tL5m@Wvyji)g*vCPI5
zDs-RtnlH@(wNE;*fC!6-q6kbGFRL#o@S(>VGRi{J?{gjF|E@o09db7n8H`H{KTph~
zaS)WrNA<{-Y=klf1H({2{a-y(#;@n#hcG<G>X{!7=hE&I<4)2{kxuJ{ff{rnSlM9m
z%XLnzrTf<qycOku+l5kBlxp}mzjw1sIH1i#6u`p0(xp5mUsnALJ|W$mhvnk&um6hM
zMXtxiBAW2&#Ur6qgo*|Q9UB^)3t3+aK#+2@ZH4AfjtYm6K_i$o3=#4c(lGIYt}SVS
zhnVf-qWT3Z6nRrM3lB2?Uu7YrfC1dpG>i%g9vYIgLfn^F%v1>)SVnvu1L?#Y1fK@T
z3q-$Uoz~X}kgLHaXKB#D_IZZ5z}S~uL%k7H9D%n$CNr>PzRQ;4NW?oDj3Z2eJ3OQu
zT|wis7`~o~G=x?)WCwiLqx6*};vM866nf;UB-*0y5U$^zfcTd%$r>0hG06d<DZQAw
zNXgRO6j>vtl^KR}a7o#cra(_;*$~b8_ldW>q+i*mmlWj-Wlo^tC8@x$2<;8m@Lhdc
zzU~51z)WBQ-Cl0euOwGK<}9ViQeP$1((Qb|-hujS(Av^J(@3G=dVT1tIyAn8M+2)@
z$<hz*;~^WFVdo6B<+XeDcdeWIIul!8hd^p7uUqr5D5-lF4sso|64P5V;m7!@URUru
z3{;2J3vxq`zeAfgA$MMn=?&zf%g_#z;`Bim7O(C)FKR`@`UFRH)U6?*Y*9f9v%{bp
z7-*e=s={#5WK5bI7spf^GQW~ZGq5x#JS9q~m<y&B(ywyVRRWS4IN*UBM-4dU1Cf}@
zFUsX4EnCBxk%}1eObwB)e)HRvP>3IcDjEbW>iLBkK0oL{4J80$K%BqZd**v0LTd}G
z9?MWyi3T(xJH(VRo#Mi;Q!<-vQ_iPlii9{#GU8~hygq_Rb0ia0>2y21fq^4#rf0ZW
z_YnbI2&7jn;-Y4u44xG;xxVD_AuUPgmDeV9aRpVH)Qb;YFj7rLNl4Lk2@Ny>^*{;w
zAUQ(cawd8Sv<9s-Q&8cG!snCbPk}jIji>8yjLJf;Y)bvo+DV<skJgo#rY00ZAsQ#`
zE{?yBay>mm17wF|(26%6d$<)x|Fz4l(uL}rm{F4)Wu}r;B-kxnXAgt*O!?KA$`p1G
z9SAh>H9f@5w5X6t(-YAG`IXVt5-|4}H-us=LL!Cq-y6}-Lfma(z)p$Kw5yGz1-jC>
zilEytsrf=P3O6u)lt~0Jf**6}B=P5?MU^fJqd>GG<%ldl*M~LKEg85j)}kUHO3Ndc
zqe{A_cvg?V!siF{T(vaCF`$Y{>%#nUP(z!^fZ-!*yr~h4K+_Bf$`BRuVBnFHl%<A1
z`>P$ntSK#474ihBwGlz?Wv0<iv>@k3*dop8qN?hoUm&FXmK@xiHMI$i2!%dSu>8v6
zpQ|iw?P|3sF(PJutNLnA`Yg^DB5}0D@g_R`b$v#CB`WQo<LIC&1@g(DwEUcYy*gy!
zqXojytw3&_9VHu>^F!B_a?kmHSILCr$);b$cU<%iMFyR+iEpJP5|2^Fme+dk<KDKu
zU&2A!o*c9i)BKvoQ@!fOqUN6;>TTY<nRG+8Z`s7MW{qA>+yCx5M^e2@0iODkCNapy
zfZdSJsQo3FUudH%O;|ymVgoTk-xSS|VLfn?gkwpItjks@iv=U$7~!Ts%h2BVQpD_^
zF0sddgi!;YIL3ys7lsojA?sHs_Irgi%oncfaVO%*jRBTp$AM0@(*+JBG^ox7eXpmT
zYH~|YJ&xm{=|diw_#Q^99T+o0=wQgikpQimbMoN$DfCKbtTaXc*vO$An&D|aasXA2
zy1rtnbV)czqCW?t=nxIUsYjz&s$@nuD{aE+y!BI$Cpaet=bVC?N6ctX`UjcH#&tOH
z1Y9@N@=iIH>8uTdX=z%Kct~KUOhpqu%Ha5M1c~MO>!<TKz`+Cb<S9r*wW)BzWMUMq
ztKnF^<t>j)OLZfV(5I1Kxh61vFbdZpE7OLN{n00!ZpcZQ{s!80GHRs88h{hWlS0OP
zMmL9MvI5|&(+OfO1jkMYg6#>Wt50?1GWuIp>i>)YS4k=g*Jh5fb{J)Ca5(7%f|d*7
zKB7XH@DF~oI=Bx4PCC{@e>a0uCX?b~nd(|fTO)HllE8gJnSh7!l!+)5sh5WG=~3ta
z|DjnRt_$_px1?p$xj1-e2*SxQj2l99CVeH;G<3>G%W?E549KC<H?$vW|J3J>DmC$k
z<WkEb4+iv>&=zUGduOx?9bdzsQhHQK2J{rrw>v<et{i%Fu#7_H^C0m;?_Ls`6a-+%
z01H~?Q}wj#(>8v-4q(z)4;rBbJbI9X>@03DWWn4|R8X&O0cj{m#}45-V@$89GQT~%
zf6OGLDRkwWG*Myf&_{2gLL(X?x^+%L{`b(Wb>S)G$`HQ%SGv}onr$72e6Q-lxOXX<
zcT6QX=ql|j)Sk~g30+TUrJr~d%C9<r`YL(K@}dT9!-t137#e~BB)=%)Td$=fzqV;@
zL)VTBI-q;Ee@9&Vq)t-Q;*Tm^`w#S>C^vw6;6W_4KF?pFKKfXGvg;?G8$Dn5W#l!D
z*A$1{*9u|wgoyvf-^@z-116cKs^{cX!{*152fV1)Wc!?R6EMvWf~Kd*Fi!Ns<1Lub
z1|z^z0ggfe&JwPEJC&ST<u2Te1Us&+1-Bu=_iE`sijj(GDXT6DXOC8JbhiLpI7Y&G
zgQ*3q@hy{In#U3_wugf2jt#@aK??pf2JMiVh=H(@1~8#VK@48~QxMt(9C+qZJWY3d
z#zjG!;3Xgfql7P983K-e?ALBUbE#aIa#?P|$$VD~UcB0dG!!l`UW>lXsB!t|;16o!
zfwCI-+f)X9n{asaVt}C?EmJyAy*yAjb0pwS`4N~lH3VI99QgZbC_u}TM$@O>F3AKm
zM-^rIWnpNHpL_Ityk9J|wyGspED9rW-R?L(2*X>r@Yj<uz*FIvz7F~f@Sr)mg`T?@
z1G=sUPhF1pi)#&_E+c}GkdutS8`q~m2#NFMYtS;=;~214O3p(;&qeAH3Glk6=zNJ9
zO^P&^0LC$1xh4pKZAtj(RvWAul<z@P^u#e37AlRyXSdl9*z3aEH{);AJ}flhsS=T)
zdXt6%?1jriV57$L#*HCxN@<?LNO^L-?fp^0|HxHdi%TD{bmuf`(?BXgW;}u8#&xc6
zVfqy*kSq~?**6uhIM9OQ{4NPXE187pm*BiBl<EIMTaEkBJcRczv!RjW!n0RmOr=B^
z=t<w-s%+;Ec+=OygT`#5LxIN}IIbVS4M*E>bRP-l4@Vw~pe9ZLs<fIB2^Wm=;LHI5
zxEPg-3x)};>1wNpQdxJ^!6O$a=!q_d`_8vvP)k#wrUf9<FE5M0gGhTV(M9+4B@8;|
zS*8gIy6Onil<lfUz6(GBx`<}{IRvSG9SF5iVyFpOyK7*^HMkbL9GHD)h^64+!h^;Y
z!adY%i|gP`q^Z!p1bp)MAO!1@x^6(v7NudhDgp1_5{3X;xNrU$51$fGSCDE2%uPV6
z3>TidI0f=iR{Zn4fNo`=d57FHXl-;aknq^KVd#?Oz(3AF`BCZvj+2Z+#p>k2s8kGM
zaQXlN=ZqxfCt>c9Vus4%r4vypY02Pk=U6bhE2{ov#Yod75q1+laOi}G&a;<u)-;ED
zzPNfb$>_DK9C-DnFy!L4-g}J&;p#a?c1}QN?$(=XVAjbL@vGl+1#`|xMpm9x3i~TC
z|1*~s-k}aZv}29eZ-JT04C11Avy1L_HK4=db)Kw?Nx5;WBO6StmTUq_*1l5y>3-8N
zefcI&H~ZhY&y(5X9l?)AUqnA4E_le%_rG6m00K%YJ=yd`bkdE+qjz9j4!ePDE+JQM
z6|$m6%IZ2PJDrWk|8TTZM<itHQxhn|rK~{L&dzcv6OJb*{TV+$2#?+I37IjxPHx@l
z$y$8&()9$mAmyDe$5HB|ujeRyU+0MYbcNK7?&q!Xbo2JN=U|kgCn2SxWb77`S3P0o
z@Y7}joltVi9!F+RN=h~s-!~#AJDuuD3~b2VrBZG$RyYPBCtV*iKnEieGH*gemPc{y
zIR2e`J&fNddCIN$-2;$2hQ?%vv!jw)?Qh!U$ts**WrdK#E=R5#VxHgP<d}>kY3`of
zup8%?5c15s@cDgl4UUS-v_X#CiDSa}f!tP%VL@DwOCP}Jcf+4?uCzu<HTt^Zhv5jW
z{5fhupa%vn#v-S8j*8cDZ9LbLUoQ4ENWi;apmgu!NIuDvp`o7Kiu)Uj3HjqHA%&3g
zFV99bFbAI`Wa=nKZpLx$t59;$8Yx|T!^JetK1eILmVC5S9Zy^RI2`s>-{a&z)x^qN
zO{S=noKr9|G0IhZf)J_W98nT+L@CnQ4=Zrbaenu|hI`Z-W06Sjg~ul3zA7P$%Z1!k
zB4rY3;`BRX8tj1`<;kq^p4?YWbmGZ{>*>CbQ|Nww)B<pQ8=j_A`^%$6hcdQCH>-<b
zIPS~fgdBKzOw;Z9?Vj9$>%R=?yxH-n`VB`_v}atLez)PV1^9X-A!TueBb%Ot`!WXU
zyJJM&{Djav_R|K#2dlRxWnh?Rc(`LyKK`Nffhr8>%HlPS4D`c!kHfLIO~_}z@$`M-
zFT=}7*In`16Oe~G$K-oInD1Y-*4%&P6WsG&^m(GuYWePbsjn}8GQXeug!nTl`NX8O
zdq?DgwXQ^xlN)e;L{m3ScQwtyQ8bU3mOGWTIR9;~#Q2rG=zjeEUigfmj%;(5kq<kO
zFLvy5kT<0qaXEf=Fphn&l%xL~({o?B5!WUz<=zq@Tb&lu^a%Z8a>CUH5aMg3_Zafv
zrk%+9M<)dCH?FM`|9CYi@bhBDW`UPd-!4Zw#x>{T@qPzaJpR7<{CCTw+*9qU(=J=v
zynYXZjlWxFPf_FH2(H5<bYzS!i<_jY)PB)G$G1b<?`s(tIjU}GO272aHYT?(c+*zL
zohf1Fvo@S`aZ;5Mk{dezbZN#W317U$Vd^CUzJC`@tkVTlQJ$pDbYK?tN%qMz7Myui
z65f1_!`XkfV3$XE#!_cTs=X1Ies2h7e!}63^B6q%42SPF3(6fv+t0z6hQ<DTW)R}I
z-nJhUyJv<Cb}m{sXx@fV6YAL*;G8LG@WMMDTyZkM8Gpt|d{d^o5K>pT)M5t~zLx?$
zMn+)n7irLYbP@t+5fJDE`On$b1T6e82qTV5z{>A}FaXW9QtB2@S~}8c3i`jUJ=caU
z+W^{jQm|>gg16=dz)nN64##DoES@?EX&nQ6JIj)go0$gp&j6i`;35s%H7?wJ9fNQ1
za6aQCfSK=G@cuG9;WMZkpnz0cz*H)-$g-dYc`}T@A9x7|pG%eiM%vLY*`u)qH=P%R
z=fCjam|hGny$k)!7&P`=@)_bBs=j$xE*X0b9Oh-+ppI7a#78oPN$S~=UFWc`W&~mA
zBo}`8#D<<@1q3>p7MsBo4y{r=xF5B&>+TZpkLzqW_EMZ*E7KT^Tvz>DOE_sbz?+|-
z3*l%9SN`3CU_*4R=)keXSY-Pna(?Tp;eX&7_>f9j{k2yWaa1s1GeuRgJ(?uhC6hTk
zJ2MI6N2bBe_en@=MS*6tK#(3Mpo!hB9oId#b2BWM_5z2LJai+($rXrmNB2@|)Yev(
zP>*_mhi0Mrl@Tx@!vN<g`=X7ai_`c0(b#e)s0%9{F`Yt_0W`K>yNkiYFS~FJT6ceY
zz=f67E(JyuL;q|r%GhTwr^2~cB;mDZ0&vmo64um&Oe_lHSJoC6mVTBF-6sp!^@9a%
z$DymI83y=tpB<*c6@o4M(1K0_;;{O=6zDK44tB?|>6MRL8`_Sa|0Dq2N5$dCFH)fI
z81%)r4{Ns*wH9uGF3Rs-4M6|n1k8WihE8Y=1Ueyqc_xFZIclu$JsO75sEmG$v^C&l
z)a;vu(0~vuh*oAh+l9yPN<&%^aK{zsF1;A}w=L*|h!o_XGmi#z=`q+_B_Kb`hKF83
z-pMvis;o#7t~;MY@kTsTdNNqNG6*y0p*5K%btV-<OZWAEa`@XL44%6S;L_UwexeL2
z>bywp+EM<@dL|vtMmnDTb^s=x=c$^UfR611so~rv57vHxd_O|M<{yL5vM;)K+mo$o
zX*Wey)Ma128iYZkB|P-JVwYYNY?j|^PF2mqWzA)ytCsM{syiGj`U0%ngZBT)|3)96
zKe&R!&|B9Hx1?ir86T`v&Or58lk;nGZ+z0hxTTU`EEFP=RN}=?5`qm#3N{`!wr&aW
z+^3G#4(9wMWE@ZbH@-%R)*q$H1iJ5uf4rI0$Nx7=rAWF;y!j38NN@ZZiyYlPA#ZpE
zH61)cznEv>pq6hFBJWrfy<_n6z3ar(ztIVZpU3a7j!Us>Q&O}(3s1nK(Eb_biFT-=
z$8ZQM@Pyr0u1{()@phz~K?+YvAqr1$Wo6Wpdn-^wScMh<p5(VYXW){oqsa>J<jbGM
zP`efKvmagktmz-(9QwM_o{0DRd-8-^eb}ZSP}8pya{W$MHaiVZ;-k#{DR-Lt^HwWa
zSwp9|kR8r-B_D@YLSIk*X?jv?v$Gd?T0>aBOUS0DB&0>3@2BMCX>qNY{D7KGb=;HN
zPz&#W6`mYpq-0~rVsT^~Uthl7Ky{VZdh+Cd;1~zs8jQxd3>T{LF>gO)cJlDF)RyO~
zDeNeu<S|l^=1~zrOAD=;H9I_6TBhU`4?Eh@g7HeWJ)0oaJgt2eqn25=Ps)+k;Qc|k
zpTni>aE_zru@trMJ!PKUgZqIN7VZ;{bF8N|@WxX%ACaZ-U%8G^scFYL2^fjAi1ae_
zMxr%OE}?bCecV+hWS>iLek1W`m?H;VO`IU)+@+qjmUa{i(eF~U^u`%zya_j%eg0{a
zlC@~1Y(;CN-MM%|k4zd!wW&%LjZk@qGPL|-opWI{%Kbh<-te4(CH!`Y(7g7;ilj^%
zoj}?^8tGCaZhBInER<sQ0wD;pZ{a#urXbw}k4F0I>ByHpj>#mNL!W<-T4qAY7d}Ip
z=_^F&7$Nu|A--Gd$Ovk=^VgF0F6G^?;r$+-44~DOJ^|^m(pZj5)+<>R5%QMlbRX&a
zC?&&VlX7R7BdY3@Sg^`iAU8hgYA8X13~X?0Qftrq@VQ%ed$PPr%IluQ_2?rA3Q)8=
zD<Q~|*|-(0yPX8nr{wX|Jgq&$Fey*C!|>J|)ZS}RzHCR@>u>=+do14XCZw@G2=Yv5
z+S{;O$mUZW;vE5<;^La8<Fshvy>C$iM+^3|1wvYbT--CH*{%`!@XVyPw7y<~@&|vv
z^l3sv1hVl`@cu%~Tb;!5DKUSA5S3LzJTj9kRgzDx;JuP!-a1#5;+*EAb-!u5P?PUf
zMWMdYOZWiXyN*>=thYz#NebF*%7??a4p#%`h236F`G4$v2Vfk<_4k|Ey`tVFTas<{
z-sNuNg6X{(2ni5MAO(_;kdTf^C?Sy01E%+4is`1<xEuH0t8B}%db@tRJM+Dn-IGqX
z3D}m6`G35`NSfQ*ot^ULz29rzxF1xx{OW>4cyDlQRAozD!}KJZa%26<FKm41M8fC1
zkNmD0rM8n)>HlhT0K~Kg$gF90IPDT0UPS5n%<*{oj#mj9d6*q>Foq}Cx;ZwKehrxY
z9^!9k46#i>8$TKj?G6os^C{Htq>z~s<gI=uB&TX%A8nUzr9!eamUhC{Rgq9S4q)>#
zG(e&OhE|!G#ss#gZ36Q8GXc2$VU$k)32^nT0luRJajK+fGv#I{8rx0|KrI4%v*)9<
zKF$XB{28&_p%F5Q%z^l>x<3f3r&AbnfezDOa$q03K^+$>(?p9z^8O_OSi4e%iV6yw
zwxHHof>IS4ZG{V;1K-iN5@6XJ+@ohB2Ka6SOgu*eeGm>%WE42jfa2Z2pnH`8u>*Bz
zZ$P{(B?yl3HWUC9S$iUY-`%`{Lj@YAcC1n%XN(uL0g+&jF)O3%I}uO4&w%?;x_as!
z1Fl5LcehL7_BccO`=ZsHvK{X|0=q8!B^+jTn)oY&S9b1GUZe;u@-9NIJj;*oX@@na
zSsAFMzWR~})ciQ%@e8aTrI>qz@Cs^6H(q4GJx}Pc2BkBa9Az4t*8(i~guqol2YCB=
zJfpABc&locK_S9-S0upYt{soUm;G7P_{b^!1|HeiV6^i9N9BPsw$=~ty#nOszo8WO
z1cQryO`t)fNRBuCpxIg%zF!2K^CJpNXHs4<HURzsqJXX)VRAGyuSUstAtGa!P+0UX
zhuSkJ_~X%#<5W%8x(Gjs-WQ$fT0vUBu5a-d@GCpJ^cU?ocEJ@c-n`Wbsl^)XU+;i{
zh-KR+i6oiA4yAE*s|VIBj)vlLloB_nkUKylw$oG@3};8>DW%KDKYALqr5`i6|34~R
zj1shMe5Cm~u9hO)bAP>7C3ifC`1%i3_|>)e`B<lPU!(#l8H!rpSQTEM?uStmBH_+k
zU0@#?g&M9%oy_@Fxb8F3RA?2(Kevrco$5jfJ_@AH+|1$bn{`;b7i~;v2%NK$^AFzg
zfRYn$hQse7@ZtkOc<^xr{&XuRe|=DgO?&)6Q{%yAV-Q$LV8>Do@<&prTZJ0nC^Up;
zQ(1UH`0WQ4aA-iyIDG(v#%2`;6zE{DM$ME_uF?Pmmm-Y43Hi$q9k%Xvl7e*X+bOZq
zl~T0_Ap-mLIU)y_{0!jve<}QwiO9c3s<Li@a9pS!gxL12Xn(j<gBuYe|LHYeP-<e#
z{Ng^e4UP%Im@-9bWGi-4I`bVhx6}^xU9oRQH~1$v+dan5A`?D)qkYLzx0V0<8`0rn
zh0?wfQMzF;O^kld6CFGYX5<GTed=Im>D9YM$^{l-<J2$8F^LdzL;7e6!<NIT0Gg_R
zqxz})H6q+7Wn~S^&qf5f#Go4G7mGm`rHdT0nvDpBB37hRq(8|0I3Y1nqUw)LCXY9h
z=bO2JW6^lo?Xf`=*T5~@E$mi_FB!5zAt}NS?V1WHkvNGRX5k1X97|<BUjh*}WON88
zN5>O_5(o%0l351K^zU`x`#7o2QIi&x$4S7U%P2@9{(+fuIVB<ht!|s_OIN@=y#$OT
zj43J}G_k4<Z5^mqBg1afR2j-I6Ywh{%N>D8G&Z}?_!EKF`)<Q#`l|~cTWNq~5K98k
zh3}piPoZ7dU=&5<=n!e7xqx}1P|fVd4V!@X6;*SD;gDH5jfD>*?R@_cw)}#_X5h(J
z@E^7|>o3cYKBR<b1IGv;%1)sR4UvZ3D*Yzzi2Y4YAkcw~Jw|wbb(@7SWZqL@tkpzW
zD-LbQ^x`5IZ|hcjD-X$(tqN5Fb^kTy=KKOq07|=ZO;melMZ4xVY_fI}uE$6`sysM9
z!lR-kU`E1fGDSa=9u)}=$~$l#;&8Y+(YPp5A#hPiKp6D73Q18Kbl~^Ins4tGc3YVh
zUp|jUQ4+OxD>CrHuV>)r@T*Ycd_imgG5>Mkhi-<3c!VB()Gn*o=)zG7=fsYT%q9wk
z;3*s_)~8=AePNkZrF*L#my(JGZ%z2|<NDL=B9=hRsVetJv`7=|6U81V1bqP_JR7(y
zYN1G%x>yJ9AB6Voc%9FW*GM-yV!8iQ9utB48xftjXbK%|c+fjF!nheVC%iynaX-2I
zVr>xK(nTb6W4aJinNQoP2Ei>Ns_}+0K*%ZFXYpvk_pzxQ(qeTP;-9Dlp~+)6i>(OH
zA5o+Nf5sEBCq>>mfNo-!iPsEW;pUn|2n-FOeq<SrfDODNO|3Axn=WF+VW-@t2T4S<
zjr(03JP7YH5kw?i;Ze}Dt7bq@6hcC{?{(bMhVY};O&84QD3Ea_aVTuHx*3h?vKP9R
zlC5GnMHlUTnb!=u*Yg@#3x`SSVP21KGfnYrD5=M8Pl7YK1Eyf_-gt}zOph8f+K5@s
zp|Zq~nG0KVUPDP#B#Aee%8BH>mfMvGfJB_R!!UEX2tP@}Lq3|~6;<i|=C-Ty5$&?1
zk;uWINDH{>KMc?n6wz6D9kZ<G+zb>j{q-5N;G`;cQ4UMujJW3nI%QUt5rGIET+jri
zpw1u{RhEdnhj8d*rk|kT$0DVT^yzirhU0dVTgj4BvN$rdh=T<eNSAQ!Q*9=j<mTr(
zKBrwoe>fSm3*R({89r_ndO-X)NaXzmkL;E{+on&wj8&H2h6WeGZp4ZA5e_~giM$~L
zg@pD929BM}FiW;|Xl9iYLrjeIn$p`QK)wQB``?k7b_a@0;;<8a!W(z^Re8G(lt7p$
zePzhg&OGbz(W2y=s;VOIK9DF8m}9!%NhXEk(=6N@ZIrk9RGI4qELTl1-QjVyHy@Lr
zoFk(O?4!uwW3Fd$sC#5=7llSQk^aKEe1Ai}AD%y4WX2T%8=V0h6PsDBim2u(kMbn6
zdTlbcs!J0%E0fWZ=GiC(4juz8aD9WG`9mf07!fB6&bv8BT?R4p=o6EPim^w)65(D&
z{@x|r1F1FT0^`Piez6~z&73EP%{t@FeJV7gZZDOLP%t}2?c6N&WCjNaFR)HoPlgho
zD352egdh32aDiv$_f-mQ!gWzZ&>JFR$Xbs0d6&p7F2+>6I5k~1Lw<ZBAWdX9715V6
z?Sgd6a)9Xrsi6r-fd-c<JzbkMv#gxCzpeNO{MjMAQN-S~s_cmDrQGDtvcGQWi;vH8
zYO;f3Pl^nvM2L{WQy1Ua?-up|)vQP*c7iC_fg3C!JiSD!2xRQStxyVGvRJ1shrs1A
z1KVV&MYL5BVcbQj9|zQS>y$xPPMIPHTJYn;%EEcLzP3aF>@fvf6V-`)Gx+KvV2a?l
zc=n6MB2IK%QQRNuypUdP@-f1XlZk3P9$e(z#9TaJmPC@_rsDhEW_Cakj6=do9+}aY
zW?o+=yduT@trBg(P2Xc#fkb#vdhwszl$gP)1!=AiQS}EU#TI-9PB0HpnLJCntP#Zu
z<iUHin65z#B><Z|!BI94nu7ek=$ptWhu67PvpgELN})-~%dCkgVE|i%tQBd7;Y!~z
zne@jjEr(xoq6JI%fXUKRrk^Xr6I&ESWx{<@oDxj60);{gSxhe;W?qp8T`{XTsUZyk
z%mpvBc+@Uru!Y-@d1T~R3FaUjG>)uLf}cjP&}*80=XfY-x)~%T#!#V_yKu+}#5CN>
zI5op!?2`4HQGKF%fy|O14q!cK1yxz^D))v<ffI<NsXa88A<{I-NOYg*aL~#X0HM+u
z;@rm96kOXTH+tw!VvIyIq#Pd^;A3t2(5>Z@V!lzogiE<q@{fo^Tm+JEuOSmlaapO!
z4APN`q<DshOQRm|whA2xPkoV~MQFZaa#2L(0yFGVWg!9?pkme#llfA($Q~%9Ut~z4
zs+sscu~Idt;s9$!F$D!6k!nI##F2w0U)Zd8)vlXcrQIy109M=pmubbB_`bQ9kx|OP
zA8Rbd{*VDWZD#Hu2nY$9nEXNVcu}TKm(nkl``IjO2-dojT@;05gr};AN;NDOWw4^5
zMa478v{7Sbs{DpoYsL!p6Z4EPtByh<a~YCfS*pEU6#^juH#Y;@Tp}BU>2fPi2HDM^
zto9?F?M3oCUr!il@U9QJ$1%z{8%*YXSg6S1Gw{Nem|#RyqV9)6XWiy_IBiXoLsp2S
zkXJ&;;4Dgq4QCWzfTCVQMGkzFR45B7w5FQVLj3&VON5XpGVEAI=FsYn2qQiHWI|ID
zReI^UxU^g{3zks&W%weR8fj56(32+u9W|WLNEx@zaIQp&6OO!9rInQ`9a>B1xn}@P
zj1{va#TiQMs{H4~i?6s`p{0X49bKbSlnSwb29?-`qEMqnr9ZyTPUD?~UVSMe!A4<Z
zR^+qAYG;0xo_(H;W~KwZ^n8svZD55MQNzp_fO`R%TDnM$iu0S1DEx0#lc6y)m;l8b
zRP}<=cReeO$qMGOWR%=yx=cNpk?I#A?>r|h$i?wthQm>V8x9&D%V^Cog^nJs(;-<>
z?8ng&@1aUPQ_(2>!Q>zvk_Pmo5h`UqQzVp}UM%?d#DuWv<cI$KU<!s3pIMt#RCtY1
z{oufbnjDAFjtGGU#nL7WS=K8B$3ekGE>e>^#6cz3I+M&_9QFgEH3_F=B#DSdGc4I;
z-uO?;IAIvL%`e!2S@TZdy%H8cAuTh_^smlJ!~Pp)9uyg?ZD<75HIj~)vEY5_Nh0Fb
zEKF&pe!%4t6zNTMS$-=sAxLCFTrgRUc#@&DextoPWJsqCnuw^HD~jUKabxYYc8rt$
z_(u*JDGFfX{@_$P=TqhZI;Muu++3Aja<NV+{$K1*$;fRu11N%?ewIp;Q&f864{_0p
zwIkiHgoK3bv)!QQT}WwUB&AoJAE3cDDyscb6xfirt5k0^=w(;p_Y*1o(PbzVw~D1L
zlIe@2`gW=}tMrGL+Yq^A^v73dRO=MamnE902xHcp2)*=jk;jtK^Uo$Ui2WrF{0#Rl
zx7nzH&->vIaPQ-0xcE#)nHND@P_3HZhV%qWcKT#lv%$$a$}H4^HqCO1!q+`L$u9(U
zT$4g@u;SdA36zL@N*O5{!h(dSC!k3ahmMJ&1ULqI2c@T+!f1R9qZgf{QKL)r*)GfN
z5M11b&qgPmuA-R3=?^YqRBN~D0}B4)LjKg^pyMVwDODn=BOcWVuam$9)8m~<&zyo5
zaaHeHf0|mpb{rxchsBc*7eZm`pyWAv7t}zftHGak#xBJh_$08o@=Vo!-lSnelY;x}
zRDE)mkKQ&jLUq7Aw2U+&tF|#88hLBeE`hEBAeR;T;PaUghC{7GOb!)umc@L?k%t$l
ziY)=?CDjT{U!WKRnT*c?JoHqJwWtG<64b)MU?jSDpso{_yc>~o&orBe4)NO+>e%jv
zlu;LGXO%eJ&6;i`uC`N;6R6);XAgFEMWn@Lk#n;Y7W8*QesF-XET{)!WAKFZZX`Bm
z1aD2uRxT*$P(NFrz|Y82wHFX<LmLV=Y^oumf;-y5UOsTM)9EUTyfnwKFIq}F5a++g
z8-P(bQ=A2YkboC1eLoh;Cj?;m^N5jF;w)AQ=7o$}tjGp5)O;2XgVEr#VwwtxwaDDi
zXcH9bp{ot@qn+^B@8aN(fAPbkf3d^Jvrs`R!nKDgZ|Z=~u^FBO_t*$cjT>ZF7i{iO
z+w~O)-k0L(?-ha`k4#Nr=jF!o&L)ji7Hh`h<&iqtNX5CLaAOCGEggHz6nBT23x$US
zOM#^#BsSj-@2*aSv(96%=1T+0F9B&x6;PQCjY8TN95!{wLQ+-`b~Pe?S#E%%fPmjC
z_Noi?WjbtVj)cSvoos1{<Wbpvu$78z45A(?ij^aB09L>WL24=TfcZEA(%c~`K{BFm
zps;;rG&s>Hwh0Z+&MfSIIW==~7<fAEM5FwScrvhBgB1%D7+5RD0L%n!!648*9$5Qv
z5)3R0!s4Yi$UuX)T7|}Vq3nr>ZRYz1k{Bn(K6rc7k6}aWb~V_s2Gn5F9!JpUQBsn!
ziQ%e)n7Bv;CYKm?=O}|HX+~}gu-q6gOe~I6Kl*Ts-Kj2ea1txZ(Q^-~$P=?K(1P7D
z#;JK;<E6Anmh2H(3fqzEw%J=q37=H#W9?0<alvq^zxrNB@S2hYV_yu=-OWI^Bu3h=
z7_LWd+d%oHnRe}Ebp=mwZYKg`<H1hS5nT!cJZ_SdIzgS3uNu$0cIyd=`_M@5gGhA}
zZ_3cvSY)tE2H4c<*iGt3?zOfkd$c(23>$R?JDewzv+@So-c8XJJEcPrGrUKDhazJ%
zC2peZx5NB*VxYVNjkVJwA-*UGj#^db=HXr)hD31q^npm2c%jCp|2G1LpX$cFWx7F%
z`mvM7Q#g541hnikK*59K{ulZFj52x^uh&VJs&<`S;L}?Ic5>xtr|ta@wkt7oox;g5
zMOF7gXZsd%M)FYDnpI|;nF9PZnX>79uJiMZnzJEbcs8)w!p*#X+qt|b(;xY9O6)H6
zox!ICa)wUhK86b-`^QSK>1>#?F&|-Ra@hOx8xn<4iz3vjt*6rAoI8uY%z_aQ$C{#(
zr91Qf4Wc-5>i>X_Ls7!HftTQ9gOl+AR(7SAwYm+~>0xZadR+zvjQObu6hNJDqRw(I
z^|HEFoppN*wsNZ(0CT<w<Qa!zfcXA3ovaZ*-?L9=>$dBLZWzX>pQBDZLgTULX`b5J
zskVN4r^60Y&-nwtn4TOk19^(Oj2CBkSqHwyjD>y~T=B(HHzOm2D*|KokskKhvLNgB
z>+Hitnso1)^1O=)moVWr8gq(|t=y?Gx1Zy6W>Ck~_uzZh8q$r9p3HdOIqy9JCkSOt
z;Lg}ff<Bn2apCe7af+X9+~b$QB=c4?Igda8w+KYSc|Ik`l27-r4ZAhg>|$)uS`n_L
zvrGT(k@HN>;4JmRAltkrz+7H~eZEY%w`uJ3Tk+Hq?w+SGBl9Pm)lTUCCT@gBuoez?
z{rs=%k4@mzH=&`w43wo`tZ^8Jn8_G78+3jL+uq7pM>k`0SDI_;qT56eo!DOn8-A0Q
zwc~hu5xQ8v19ukAUd1)I=0<zO{xVMgz02?ibYp+BVYGHJeLL<!GRm_C4tn1sp+k)k
z@7aUOaBiq&O{ZGz>ft=+h`dl>&}ZpNg5zZ)apzeg<P#uNt{g;B<zAW+0t`c^$+0?F
zzN!x5|GMUXUHc85XC}en$=C5|t=j^V6+Fm|eJcF&Mgz9&P@pUqjV5TYc>XiIEQU*4
zr%3hsvnx@e#;^N50kEe<!P9S}$}9q&&={z11$gKV4zIqh;eAy8&lerAX&+kZos6gs
z)fbGqGalZ&T|2tIA0hpPUqoi>Z<81*6Yr5-23a?kLRpOto0h9kI2JL>3RR{I&@=@#
zi2yuzhYHvH#(=y2sKO;T>D-nj40kBKyC@l(8-#Nv+Te@%2An#c!*5ZR66tXT0>MzH
zSG+qO(&y!!5P>}DQ+Z_b%ia#dZnq;!#S9maiKRZc@?s~v_=+FKof8RnK7<%>s$v?W
z+W;;ZqeD#rz~-IU9;L#IpP@}98PNn}EuL0FuAOW^5^5XGT{=WM34i=uk*&_mO;0sO
zBGP=RuGeB)q2K76uK%yvqlfZZ`X>ANaQEHUFs~^%LTGn$j?)C|o(rnZC~AbpeoC&s
zOo50v9A}h=ya>%b|0c2}gy#f8r0t~e$UO{ZEu}DFsKMV~XoGo6QQL{srR_^wrNb8=
zIpN2D26+2%!Y5n-ip`;~?_41CrbG4Vpm9^6*CK0LPpu1~w;-{_C;Re4rQnVW4RY=h
z*izE~hv^-51T<OceTY0QR7(PP^jz|=<((q_!Ezf+m|~qO{BR+g!=$e}xxyueqm>%W
z???Y|`71CUcWrHuU4OsV47J~;vwcklO5;J6CjxcO&}BINjSu-4p8Ra<9-TF|=rS0n
z>?c7p*Z`%s8y@w_AcLiwG^5*R7!94wNH_&0gmD2La{=#$3A5GkXCF^WdVpV`jMcf2
zprg;x453MQe2mRmt1&drvfn@Lm7(%v5@S_A@iTYOVBPrn#yV31zv3R0&PSjGekwDn
zt_`vvN~Mi$2HUnz1ZElR^gp3AG{y|7Qcq{R^upbLgA;@*u564-x=aLw;arX7#>ij#
z3=d*Ot!<3$Yt|XQDjRzXes;1h19c|-(a!=nESq*4Y)_NUI@~%dxyFa{j2Z??TOw>;
z49cc@owd0PqZ0=!bF#-E<8cfo8b;EkD1~3g6XBT9w;?efxbKcalAU5ou9I%%qasCM
z*+db_t{Ic>FvoOHBV%oyjQMn(mEMRa;Y8%-<vP3bEw9v=w%0QmjJL1TFjCJ88suc0
zlY)Tp_m^EF2Hse)MO?-7&sS?A{C^D`vj2zfo1^w$xsJ*2752S$3RR1~oB*d!9oXky
z6S(ReJ0+(tPn>etn(>iI;FYU0sA^xtv_ZpQZA`Ptz|mYca>hRlcf~1uea5Kp(<bIj
zV~eM0^&@O$?V~;S_&-9l`i&R(z)P<Zjz!w0Alb8$Lis5S_AatPS``O>rbyVMN~?5W
z3x~Qz0K+D6SU5w0lP)!&S=4z$Yk_bh4QxXT_9nb%iO!9UD6OU=@LnX&b2|<<?M4H3
z63ih-SnT&G>3V)X*~Q*foM@tSQ~2Yx1}V&>FmJ5^gOYIR-Qfo%KT3L*u_k~Iry4MI
zI>1dAbGY|K245^hm@mm8^I{vjIIQ>>Z}~e0Z#<&F`8WDtbBm}BV@Focr7<wsZfk$=
zC%)D<KW*TmJlLZz5Kc4D5ST)wwf~2w8IYBvLTwR;e@q2f*@#GKyGUs&(hhJKJ_O+B
zS5jENmBWrMoljp+q+2HyMYd3999N>l#bZ>&nh7jK>FeW_T>AY=#{txFCR7-3a-zzW
z7!77@%!{43JeUp<s_8Vf-GC(@0J-i~3eP=E;F>@CVZ(m3am1Sb)cQ6ZcH=yczYy&q
zDAg5@(V#s6#YBf9?REMp5A4SI9dS0mra2Uf#sD;l0wba%o$#JO12!+}OoAs9yWsy6
z^({sLM?|L7Y8$elS}Q17DO_(<yO6Ls?E8{J_1QtP>2npbM+CtwvLV{-(%U7tPKN+$
z#?DIIlWP@-D)MnY$Zm$Z<J8c49lYyRh^p0~ZHb*nXZn?x3fnr@Ok2g*OT{MtvlTbL
z#-d}gjAap{@SssqQ;>UAIh7km{if4lQ^`!o<PlI$e37TVmmUb7x6g2|h=LVEh3}m3
zNe;qc(&0+P1ZtN@sD3TWP%8(k+ItoH*#EA;ySQNYU(1d5yrDdLK#_A;%Xq&XR>HpL
zm52e)ml}SS%30B=P{G&0+B+7CEQj!ag%Z+4Vk<Pnp!PI`!j1pNg^-}aPyZbNUp$i=
z-q6j2@}d&TZ~hyE)_5EI_--AVxMngOLxCV_UG{8%3+@O)OtuOa{#Cd)aLcC@4GTiQ
z@y>xGq>v}LAk*1ZYEo~8+P>ERGzrh4Hq;QsyNH4ji#HiCeIbX$2m+rj#t(Bfd=JBP
zor)#!_(ujT+J=zAI~<m5M>RH)nMwbJCk`^<J6;xfI4IoqL;$vnw81e!kU5E&OuCJB
z9X;udrE1a+Ul#0d6)ruf=!&?kE-r&3R%|e!E?$8xdjR%z5}Br#$0(-WiW_!6_VuH+
zD(q|F&>kRW&T?YuwTRQyH86N*fg%}ZJpvU><i8G5Q?f90vU3mK)30)ejiV7(6II>K
zj)~xnG#&o<6ot+B>))QEu%#2<JIXLa2E;?s6}a|3Khz_1a^u4~v?U6+(jdON&8(-9
zN8q~qIW)&A@Z*0O$h?th+l2d^-K;;7gq-4&gcBy6ZvT;V`0F1SHAR#jDlwr);cb#h
z;1`bupv|fBtNyN$?l>lW<CuZ=S+prDxdbl1%K(~A;j~-vJIQ7l7&CqXm&{;*^Zw+A
z=phLE-HQ{ME2`4-Z{!ITpY?ofFx|h*@3kf1^0wKBxwhEmH;?m_%)OFERsEbb1~d{`
z__#6}0kcJ9s8YS_Ghb_Z4rhS?vE{C@jq$t|Tu6>c<2-CthMdM1@)j5kftF4hnG#Q9
zVS~Q&nxRVWGd|&eOoAdScV{G5wXt@ZkfBlX2KV4egu)M1(8A|h8Ux$U3c&vnq7&vk
zg@D}kBBquKS1d1La4{$mv>~<@%cRS+S&vFY)FUJJP>77<;6+A6BXEJS&{`JN$Q79<
zJTjJZAIe@zl*o;5NUoqpDQ<oL(@C)6#>1)BZfQGHsN>|@9}Dc+{wQqE-w<lI=QNfZ
zN!_;?%kr<YHq}>ZM~Oe@m$Yxx-vks|g!dE+$bfe+L}ex6*J?MvDz>MBr;>pT(}C|F
z=n_8PhFMBV22F73zsuYzI1?E7+eO_`W>$&m+1Cmek#~mA3?mR;844a0@_>-;x5D2U
z%p*yh8L`yz$LC;r`*9f)AcM+84gwKO7D24ica~ptkjNxOl4FW0QQ~j_vn(7@DB(ec
z6DzcW%J@sfOGSYXF5^kT2r9&mJT~aU&mGJx2^V5bqA-C^1qaS^pqq&5VInHeG@Qtc
zyHvh^R4QV%9f*B94YPC@F(VR5j7p;F=cKw;O#ELMc=(~)6RHKh*lYNq{cTWq|3du=
z>t8L-?25x#%Y7*FOkV9}ft7e7%5q;~P3kz-5%C;+9XLlZR;-}q2`?f^nM*PEq|2-g
zYF6wqD;mjw94`t{u_&#J(vNW>`>(zu_^BiBYY&~YHBst7`#+d5<V<Gxq807S&k{3+
z|Ehh@v<W=&w9A<-|1!clmXNkjXR`VqOi{Bx{=2TEWYgH8KO(^;FN3bmG&T=?0giwU
z+Yg)vH=eG#SB)nTDe+3{$0PODCr*YRKNmD+DTH)1yax$tH(#GhAU=Ib@Vtn(`0@y%
zBszkWbUnmYCEHQl`gS0IV@4sv1(6$EL|Mwc7%wt3TcP|`godG+p9heutI@((XEUpL
zSdn6~gjA#fLKw8iTUiFE8T}_5u_315a3vSin5NobatYD8*$qm9ztF@GZ;+aoGp@Ca
z>e*My#hE!R;(y+W_vXgegV;A@dLmPsElMz8n^|(pN{%n8n3D)|92~KDkU3>w6*svw
z<uXDpN)&vdW;r%$Mva<V+bm!qHXjuU{q5pjA{HrB!pbU9<rL$AkcKe)S%oId>K{Z#
zND>F$GhUT7P>I6`i>L+Z52zwTw;|&vxS>I0oD-3B)?q8(1@A8+NL6vT$UV+_Y*B^?
zUx=Zy5Sc1UgAudXhMCuam_a1s@D;%;G0d!tPON|s!AJx{5r-QdAR<qVVECr5zj*-S
zToYGL9Qn#QHAyEm#_EWPO&5V=)RU#*%vstpk&HKXKriz?-u4ocr%cA-8MR@PEw`Z-
z%$YR}d%0iK($kyQgfZ_U>tBOrp6(X9A%dcaD1#`5Gf|XQRIT7CB8S~9`DU0A(=jqX
zD#!pnS;|Y12ei<lL<wAyXst0(C$WeA2X5a~;nP<a{|0|s9-Ef9!Ps`rbuDvJ{Kn3k
zK4j}(y-JP68TM?rS1@mp7){@G*54p$%P&CG{G=m(YBKK|Y;Xj0_-fjmQnwy#-iF86
zel2cdJ*@p%Gi)#?f%3-Z$nN?7l-H%;uuU<gInw#wy{u!gRbhN`=p;V!KAb=#3)F-V
zGFiAm1GN)(pr(L`KDUc9O`!CIic>uRyhW3+nGNlJcGa{An?YS7&?f*C&$u93(N$cH
z5q8pd9UUGqN7@bdlRcAl=I%x-PT5=Z3qXYWNsXS&I=XG8FY3(iAt!ULri}h0{14j%
z;_s?CQ)Xzhg3_?wYH(Rr$}I{Rn_<ZzFH%_+uN@^zgaRpQ6J{0!0#+y|D1xE3h>~I`
zsrz-@L)JSo8PRG+?ge#OipnnXZ&(p^W^}F@Sn3SmSmW4;YB(}VFI0b29wx|_5mpi9
zCseN$5gLl@m1WDQS$r1f!6|A~%IBL5mYC6_#2z#websL49|X-{5y@v|B^V;$92tY+
zG0dn&Zl*-wBB)2lHjl{zh$wNVuu$n2GvEggWYR@se3go}OBr=Y%)C9K^HBlYSM3W9
zSxW~%&8AxJ?kHs4apP>oYeot<%vQOq+Ljb?7H_8mB8P7t3fVK$;E3!^M`h^bFzB^(
zSpG>V_)7{QMyrh&`}trwXjzYEsm|0%sxM_w^yp7h5sr<7Bc(_%i$%z;nkDLFQ5JWQ
zi1bMjC=A(Eb1j(J0B|h?a1J|NvVgkc;ouZ?EX`tJa{7ori0wX<#JSvioYOF2^MArV
z9BR3Z**9LBx_8F;kS85F46}2$)7X8F;4!`GGl`2kg<goz%#t5<vzF^(@hYpN($pgo
zY!8=tnmXt1GaC8o*mPJE(I7kXrrgzbBZ+*@O2<6`H{%PuY3VNbxlWTFf!*iL6fbGr
z1|`0|8IH;w1@Ij=Xv(Z9vVJp>DFmXs44D0j3UR2Wt$Y#p>1I=lmkEE6xzn8nEPm4g
ze4PgCrs3yXk;OR7gh3)_b236OGpE`}zKy|*`v~|pi$GLjCX|7>aJWP}9{3k;n_r8f
zuwCJM|4AF}KTo#rd+Z$Q-hMZVC3dCblT%dxC(rz^`-r^}VvaV-h`u}kuimdhe2c*s
zJ)uLYu*KR;Caj<>#+a+Y(wFd^>ly6Fqnqy+q0=%c2abdvj4v6ieV>AV1AhK7s=sx}
z<V7`e!9$rJ*m6Hv`vxJw1qRvuJ|X%hPDD;=xs62rl`TQo@eyh{n>4cVRfXtlDN!6!
z+abizh<(3@EPDg7nvINXdq*M078_AiYq#P=>1(~D4*R9A)M2l<&t?LSNU4|*67Ykw
z!3UeBAxyH}AnT^7psxp6*<6J8Q5qn|iXd#9ju6Qz23y}nC~2z=ZP6i(3;Va;14~{<
zzOl}L^>3iIvDt}gzJdse$gH6esOutIKjcK*ckAl}f}4mu1jSmCNK>2k)u(m}oQv4$
za&W{GO|$<(kI$VcnjLX@vs~TwU*V{NSIJvOBV(?H!>2IDeMC&0lcbD?Xxiy(!0-0y
zM&?xR96et!K$82@^@g+b-e9ZS;bxPX97?T7R(3@DpX_PoGG~&M>qXgEA5pgl$c7Ja
zJMPqB&pQMHIHnN}Fq6$`IyhPsc;f*lBq7A|@qclYwu?HQBGDS!PP!SX&a{z#-r|6B
zOF8`MTHMb~-_)pxt8xX=sB_<q^>KL@!*&t|5#PZ&ZRb4zaf1t_QS(iCy#bSW2`GPh
z8A{&l(cq7Sjzs#kbU~}*y;UiL5U{^X+Kn0Th<pLX)H(0qBxY<o<ZUVyF9~LH08TS(
zf74^qKkL2McT*A{nCPa`3ZfBGRDvw_-6+UORN(P{Q^-SOR`~=SG@qI5X&_p~pLx~}
zgAqP?b}EJ3R0YnwRFgRt5OamB!79vr!vUFyp+9mvkWobnl#SC7H|Hb*u{lV&{V*20
z>B8ju@;Ccn`?!_181CjR?=R4||L#lt%%*R-c_EG1wGg};cIm6moaNti{ciXla}XCV
zg8OAoTF_8({^?&ROe!Yijz17mm1BcHTpt9@WlEIPrNe!%*dP;C+5b#I18B4YzxW9Q
zt&^ImXV6OW)Tb(BAP)K8hbhG4&nvD(^;cww#M3SguX*APJN{JRzt0j#Lu21%H=x|w
zWg`UtpNbaMk3Wh)joC*2`zV3z0TjkgMkA_Qk(mdQq8L2+m=hAQFOU5fWrY+K#)>+m
zUYnFRVi7WV`#lvR5RAX)VFHQx{2%-R`F4jmDis)%slaFNM?f@6<@f)KLP0tqV=u9T
z?y<|nMv=I(pLreU)1km)4|5ojWP=N@3gA2{GBZRx8YN$SEfUfYJAdHc07aQ9oby9m
z2QHiR8jHmP`^6Wc!HE+0e;))gC{-b2FVOIFGcQO)v=1Vas=s<(vxYs(m)M2FGdP@G
zxA8BdqeWsl_sQ|e4&RDPc(l_7U#f(q%=ix+nUHoA#3^?V{1GE>MUtrK2&y(+<)0Zf
zM65a9d1C?%Zut?3k4ClUPFo;y&I2Mj9vlHx+?0T(0!yJo*>yk)&e<nU7>INE;^QhL
z#h|eg$JEy$_8x(}K?L4-j=<<F6&|}6V0<yby@g}$r!qIp*l`SA{U?Pn`9OY$Yi;rb
z2DU`)8`=;|jfHoQxj?n&-Ud^IJK!AzCfuPw?Kw_}9da!+46cIO8_dK|c{e+hmbJOW
znR_05*&PQHM0vF-N5sMV!7m$kO#JjX7+ilBp&7+IAa=l>J0bJUyOg#?=dienYq<;M
zx2XK5Y31&BSpwV-Ez4$dZ)`3nwp6ItvDiii{Y+b9Uj^Sm>gY(|RN%3=S$AxquxzCU
zTelG?&EfFC>k8DjD<+<b81BAZc4%${c)L}H9ebD*%~x$Qjd&t0%&rYi*j>lql@AQ~
z<y8c(zmGzLNQoiS+~Q$43UTB&ziH2iWi`AVJG0TIEl`upcHyoh)V8TMeZ^_w04<d&
z-*zc&d}SWuw$=_ew<SpRpT{|2=G!{_{1OI_J)*&xqaE<jiwFfoN&W+xJqEs*Yrq9n
z4BmZ<L1h-eJD=l;9)}AKv6KLbhWT@J7=TN5*&31Flft}Z$o%nO6H<0ZTNJF`phJ?K
z!;(cDqVe#WyBLjuNuqMO0<AtEUo5~e+=9<S?DNU@71*|0MFSPcq(ZH@X?Jeq(A>bl
z(`~@h9}w79hlfX`S)jeMBNEoHM%V?RmF{LnUYVuBf)&{HSbT<RkUe!ySi91I`ECXY
z_)h=AG2hmRYIc-RgzVt%#(7(9KqA^RR<398l#|2KwFni(n}+HRj}6wW2C0g-wla7E
zrNOm35ciHUq3%wX9d>Wm;N86pTF@B#@T<VrZ=@3Imr1~y(c(WE2m1Z5nAbNYzD;QJ
zv`4hT@ylg%G_tWNgvDhpu4`7Fdt5RV)8+ICp^zi>6v6LpN0=aPxedIFr&E8|7K;lS
zu;NK()SSK}DRRiPwwbpZVTSX=raki`xi4U*VifzUVW$n2E+?>PnI@82z{Bs@VC{C(
z79q-+?%3-P$pGP>uNW{6QTgBE2<_QRWfClrv}*B3xKDq|;m+p>fAIGNuK626dr=zm
zeUr|NY#c(B0lT0pUU!R>jMMPlia$+9Z2S%qIq)aU)!hLDt6rq~y-xsFK&Zb9iwsHO
zZOo%3a$m5M47#q3bZ!1SgDJPe5m5gG)+8)*5WQ?7D8U#a0L-+Gs~Pb>Y_OO_5@<^W
z7)(I-4J3MZ6|5n;y>QzeErJ(`O00@k*{7x2-0&Tx=!jG<@?wL_;OC#OkqgJ$VL7tO
zj8qP>XyE$SJIL@v+Dep8Pd&wetIx4PT|I^BVu1W12K@PXlmNO#URDm*pcFTLXavML
zb;uh`;kRgBe0M(H+)#;KQ~BY$?pSVH8%lJg_QS`FozAJyA#x52iQz^K25c*(DJw5y
z>+YBWUn6-%?^y2F2cIf3AtDaO;Ldwca*U&J%Pj;3Cjv~E7=))^z)gUXP)=q5?)jAp
zsrdU<SLjfYO(884H_STWZK6O;MF9SGy&Xh7+ekEajw<GG-x~(hZxvCTD%92n;SX0S
zpyR8@T?#O?n8AOt7&NWd!Kd0`(iniBPo~h`#%1Q>9K83x-!mk`Hkb+%M(OaAOBHBp
zM+R@8Jc0Pm?Jwi`gc7ul_doR{Km7a$PUz}JX&tqMVw4Z>nr6tN0-{ds<O>5Z`7}G!
zA%l%VNiGQwh9^G4zPFeL=kj75ZoYy-6msJfoa5Xq{QfJ5`MWsi0ToUfYQWDfRb>&4
z{2bH}a4kIWzKN&n2$9v61>wqbRj6;GqEHCWNYvrqAL!7z-#pYE@fz^e>en$g8>|1}
z?^rzucT*=ab&)~M-drzpO8*K+L>$yXI3kJqsNDQaro7@t{AI<(rlm3@G;DLg%KXJ`
z$S=VR{5!(_p;nWR+hz*^7jjsUyZ7QBFu3}BM5gu-X%x=HF~9$9v`2KIJqh>MPi|yz
zQn?C=xZZ{g0H`kE@Y-j>B{cwSKZhHB#(CDD7`W}nI%FnOxbz|pUp}m`Z!{i@r`9`%
zj7%r$`1ie$lnl>*<$`_64?F8Odj6(%H9W2-4qQoG+iznXDbvuntMD&BtgywOexBwa
zkExA~BQ!(<0gfy_raxc{0=w>N<{L#7NZ5ox?;5teau6)KvJJMEKf~8984a<*hP38t
zV{7^4VlsnU@~<U<z3-6$N{g{M>tdKkw!wE4Lh11AGBa|bboc4|GGQJ3;X$<Hq*7U_
zrQ4^OhAWir=FU~6N6M{_AuN!p!d3qOXl^qr%2Sk1-$vLV7S;dD?*K?mpm6>#G?^nD
z7bN!wj3Zg-6ehn(WqJdC_KlEk&o|XOtMY=wRm2^a{L!ocV*0#%)s4C)RoPgx=@6r%
z$g+Mj;d9q<zG;sQ-kM{;>#w7MDBesZxO<Nsnp!zLiiejI8PeS^Ar8F3FFi`c4c4qg
zX&oh>pZ|x!V1z#|zAXUTcH&-kFqyA;<zkekk<s7!Fz_J*ResIC5NF<|%g+Tc_r+%f
zoG42F_F*y33jAmahrRm^Y1tH*=z=*Q(-qu=s`8M53S9R$fc6e%=Ho&ocJ5p|1pNlw
zaF+pD2y<QicMba-z|WWnrr{sGLm?9TanpY&WF#wa>P-P?MA%4ZLZXPs`gL|tbqY64
zMI&^S3Rh1FK-2!901ssU7Jh-YD%|@wJ&d9YGJ|XG#{M-C%S91j)%+lM-Kb?v;e0?M
zhYN0|(1>Fzy=m|oFH^X`=_~#6LySF0D|YRMs_yfljtCJ#K$gMi(oau@n!0@e8-fR1
zf4s<IL?{jq-P0H`qJ1ow0V?=%`2i@JJDLn_--Pf&DDUJE^>4*)jk?_?noANCnDG`G
zwQ>A!xCaG_fht`3djncU(tJ@<Hy*Xx=eaa=U-fqa@$m{=bSsB0uXOI^G?nq`FWY2Q
zq96T3Borg?XIvBZ2;Vp4NmF$1?lbmBLEFm2$h|X`yz`^_`ZrMv*$~~R!I~Wkb+^(k
zZ4opk)XB^1&)uilnpYEBw@WK>uYrBVZAUr|{UCvd_zJ#t!ipPsE3*<$ht%;)4d|R*
z4FjMKHp_PDg26nG{{>oR{nHE|ox<RMsP88>iHgP&+61p(=XbuPkahc2cxefP)pe-C
z#hV6w5fTtoba-uv0*kf+JpF|MpD#w-Ho_E=1^e_NgZeWXv^;2QyXP%5t~H>^D;YV4
zj`v9;v`?OyZ$>P-aq=DRb?(0zs^SJR=5_KxW*3Jk$uK(50UkVdJVpl$4dO27ycU+h
zb6<5Mrza)atp;T-W{xwsem{jd+c*qJVDRC~47@gGrRNdukQ8QZVhEckaQW#5f94Yn
z{2~{$aI+J^K#2FhzAy-1tWx3GIU3AdhOZcDC9Re@tSP)aUx!Z?5vW2KX6BbVq7lMl
zKowz%a>YIT3BaOy0&gy5Fl&t>vYA=|aXN@1D^JX1unbk?XJ-fDvo$KPNT=nAj1n2D
z*e{^jZ|+7FURh|sr_0d@X$LbcscL{1ne!u`8nAr70@F|>-+=H7k23j^a0wJ!?U}hc
zd^BH$>H-FH)@ZVNlK^D72>(DS{Q)$PE=1Vm)x|n|x>N<trptE|dBqtrnyL8wm306Q
zeS${q4R}kL<kvD{5<ILuUnz}o$on`29Jz&{W~EZs=1FYu$J<~J*$8=$mIhefxkMY1
z%&V7-f{xw0pzhMIEsPBPoqq!{UU0q^59|l2!N%pWFyT2TOh9S-_4*{L#8q=666NO~
z4?=vn30Bk!l;W_1dpuhfQ=WAaKtPiRw-;rS$7Td!eUlwNSfcU8Xgo&25d>%^=2V<;
zcTZ=qWhaHZ-ZEhA7S3s+z{gcN=5Czd+n&|Ig96jNsEu{I0HWgUhk?&ej%ePId83r2
zWwa&8dPfK+dG+nYs&k3TtAM}6=c~w<_`-3f$4V&A^5IiIoz8LrpvCUh81Ue+xbp^4
zbHnIS;ma4q!@5LlD-o;M^khl<%n3sVJ7H;2Cjj|20}hUgY!l}^qp9PrMctgKD2eM0
zD5PcEK*Mb#s;md404{mF8OVcbbMz1n?majNNxJDeZ2c2yyBT8U_A~}TG%2csgjb>&
zK8X08ON)Oy5#Btkiq$0fB+me^0vW!xNMwg?57=8i{@CAm)m&Riuv&@mUF3HuzeRJ`
zsdn!RyS#gEZuqJjC0xUQ(6P&S6|sIMYKSsna1$mOX|6U1iQuL$ttidqq!1Jd`w<h?
z8aW!VMKPaHa(-@pjxwSnjY41_Y9Fb>SDKjam_(G<BcRn$t_(!Rim(P9pql0Nq_vpK
zLIHY{0!kWw-bg_iz+~-JumX96H;0DpwseGK@HsYoj%F~^;)Rc~Iq?3%D+a+mZ6Dr0
zm56{UF82@@Rq*ioz4&twAsR}~_H-gLz=Axvu!E||*@gF45yaPpR+1!uL)~&O<PzuC
z+R;vj^Y3rL_r%WwL9_A`z5-W8X|hHIYzX~mbp}4)tXL!fdg0GTA`zb1wlvkXc|_Zx
z=0X|Pd6^O!_e!wEuTiIi5U0^*EV5<5Fuk5=csE_wDPnHmU-VOB<EhWW|D<r{-9J&1
zv{t*DQ}vJB-R1^oQZ%sz*7Bv!N-~b`0~b%{L63{rqhm;x{(CmvcHfa4Ady9#wZ81w
z<vd_kNKqXs(VI9p(}DYUp}k>{2)vSRo6;*(xT6|4=V}Iy{XWiZgB6+j*YawWB@fwt
z9cT((-iC9VZlf_uaAU_Oj?%B`N-y-0zwYhi#7uANl7uUvC%M(f4m$eG4n|hx!9tm=
zN;q+7w4nWNmgFghF9%(C(0vYr`UgTWf9S-1*$fhU>2xUu^+@+msw94FJ7mTVwoV!0
zhhWgeynhf<v_6b^e>eTXiCOAVFa}+ek{T!qIpZcDz-1Js<VwUuCq!7Uf}7PRWR4`^
zwk+yCQ8RjjSW)C6<XrfLXAsGhh%9(1rXBy&vhgqv+$p4We$;;NocmUCyW!2x4=fbS
zTex#-8||z7{=FL_qM%FP60^v=_on?2mg4e2^7z0kB_v$raCT{oIh!_-a!Iv`94Ew#
zIOP)iRpO}p(>9REGIeH*jk!KW?sJ0Bgut(r3=woeduJctU1T#P8M0gl5X38m8VsSJ
zCd42_`8`1BLGVmSHv3}=aYSAt0*I7UCd2+o3K|71=4v|Ii+M7cw|G7oXi3$fKtbVU
zBbap>F$?Y_F|LaU%+TioLPDucFkQiK#38~%`%bbzyuX-u)V##uttL>jRwkIsKt`{M
zbufTSw^MmIi9M~-P|V5K5jB>@zY&~ER6-o0uF+2=^PYe>_%bz<5^@zWY>Kfm%5E|5
zZzx6fQ;54*7Hu#8op-zvN1RDfs(;ydKIHuxp`-FW&*yS~{pB<|+QGf=$Fg;gKWu8?
zmV^A^P~^MTe1ohvp$AbEN+etprTa3unNvpAVZl9yhHqJMWdIj*$zdQjnYVnRx%Qa2
zmpI5pH&Q{)xfc9J+l@mqkBJ%CG=@5|^4eT#nNs}8*-*Msfr3vem6Cy%a4(=lp8N|a
zYpTHObzAnd;mF=cfh(y7ie5Y&QktXT2yFrV!8B2iz9*TM&3g$)F&(t%LONvbD^U8T
z112oHiDVD^n0Me_OicPa<i2_}z?+PeeDW42QRm`|MMBBCx1eAaZrAT9gyORb9f-vu
zYJQ4n?7e2$C}S^5Z$d$WUU*qZsm3lJLcz$z_i9pFBQl$gD4e6p<4oVp%}OHsxeO7O
zK%p3&l#;`o<SFKuPQZtst0ZoDC;bB{0jv=CD*oJ1`i5^+^g#Sv7?l2}1Q6sNvlysw
zmm#7$3#I2@N@VqvGf&|}O5~Cw3Y<Yi9_pqRfxMlyh?0A%e0S6FRJ^W`jtMw~=S7n!
z%wh%kF!P+Si*R%_N;*&)W({1Hw+ofl6Ff;~J=rA!b#Scf@pHQsz#{@@tfVKbPM6(9
zxer9bBQw%Sh9*dD#}LxF6Zu=C8Hz25S)YsFg?1pcqCLoc6ib5UCKI=#l&=dZUU&xX
z<5DWO!r5f*8p;jM>SRf7U}By{X*&_hub^DW6dL1D=$H|d7G@EeK9HDIp+r?BQGH5O
z08UB#s=e8hrj&R;d06v)vQGXrM;Zjd@V>thg6};McKz3AY$VJjxSz5V)?MR=?b{Ku
z^Q@!luntRWWU{?`#TMdP@-b{V-woS;iAVkIa709_m>GO)9o#a;7xxw#p2gbY^`ayj
zk+m^J>IP9YP6l(;2k|<D0#VwwS>+660F|t=glnOh30Q_eJGas+d;?Mz4RLAF3pk0u
z4H{9xV#d7<%5yebMDee|Ui1_Xdb>$%+D)igJuM!nC!PK|u|<y|#Fk8>&i@dyQii}0
zQvXQ334e@aj^q&tZYCfHisA|RmEg%&p%KN*_^K39Jdo?`BuYn(kdc_NH4)sN9EmC^
z>WT$}WFflmC^1XZ5RrU>!9?PI`PbbjARvE!7L9L#I@48N3JXF_+ZTj;|Ai}~-3|}_
z3#Cb+w&9kQ5si3Vf}O)7XxxiK3E(bV+gdX-nYnTl{<(8*H(*ZJwUD|fN2qURBmNxI
zT0l?r{|Yz1EHM7RZV|OJYF4D$aHCV(ab;XY-DURZotI>H?7b{P*?UE<vG>ZD=uH<z
zN2whmnYUoxA|u~_Q8`u-34Hc`1`*Oz(q@L8(;#j%o&4>u2JyFYGVKX`Ker+eFq481
z*rmbL#}G<FfbHoAaAS4|-o`B^kG!fq2#-9BZ5=8+@oz+)>v>POx_~iAXAu7V5N^!<
z44!+)gggi}9f#2*3|fO9o_-LyTPKItk=^NS)GUrIa<!mjp|~`-2MuCsH{g4qG~R3l
z+{$qNAo%g{cpi<YS_i<(kKnwvi%f-znJxfDeAeiN2hmt9YB=7FLZ;RnI>4Rw)QFwG
zi{<OC&d}<9o&j|?q#AYC*n_)%<P2`V(ynj+VPp_~?B2hv`>SU|_=0l>+jZ8hu=$)7
z5>pi<ii~eLe=XZ_!LLj&k8c`L8P3Fyn#_YB>vlU|8C@A%2kT7>k!*Lsz6)0y8%JJf
z_79F2`vooCg6zzq&4Nj*0UiE%587Jrz<=zYxc8bxeN3^p%v1)dUm;@eIX!l`>n}Jb
z4IUZ&EDNZkww8t3-miX5p=^*He)3~3=KP!VjX=|w4X^@1bl$a6u>}|KrD$+jd!Juh
zGx$2A^Yug$6B*0>D@XFBDZ`<Z+xYUhIN+|gaPe+nE8=Wud)f%!o)HrdflUMvT_}Kx
zRy0SUOu9OKoQ3r~%Cnw(nxtIi<6Z1jzAbyRNMgemuQ;0)ZhnH%q!F+zWrWpvlY@Q7
zh}zqTnPbTS2kzgqMo~Del)y)Y3{J`wIWj~@u1zjBk>708FaxeS$qDaNYVf16D!I+!
zhoG)VDZr^{aM1+ZhXpEpIb4Hts+|0<!YIaNrFnAr5XuCc-#H@75?6!9R6V-$d}tPC
zmN{bcpfuE+!@DBxK@;Ue=JnIQDghGpEF;1g_9VzJn)JYI^XH=<m_K9B+<zM|oKxKo
z12R>(VyqMX{Wx-?2{!oaf6$Pmqt-7{3j{n+QDKK$PqD*mFX(V~m5K+S4qll#ih-hg
zV8|dFnOq$O|4BFCiqR_EVi(3mBBfY6_FzJd1J1?oy^<e*^M*R$*AW2-ih{HP(K0mr
zT!$alI^p#pK{%^Yg(y5h{M=Nf#ph#25x97$0#D^>a8{WL5h^1=B4V;AqE#A991ZZp
z;ZFFlAP5%^Q{g5`t*~niS&kP92iagkUIbJQ(BYy{cDOmh;N1wVFd_;B7%*z26RsOU
z;iU{e+<3AbZod!tI&*@85Q;i5_xU|flGaz>JM^qs?jv6@*JkQcs6)GO&YWdDirxk5
z$h$Jic?Jon!+j?kO%0Fp-B4sn)mAL|aV!2|LNRqbNQ&w{-~%??0&~i?Tm25esL!j3
ztL)EwJ-Gyqh%BhbmV(NRVJ3^?qO7JDCJh7l@ktTngGxVKRBMM{27-9j+og6K<J94t
zb5Id2w~-~M>2PYX3V#vt^uqSQ?GR-T!Y?kgL3XMNX{Vr!i4fom)ad)nL-(iWwR!vW
zhw}2`^)2S#rZk~$<J|Ses}P^lA)7at-bKv4=5?wp&oIAz91FAjPbyt77BW7nvQB>5
zqp#+DJ`!phBEzHs0)szHfYDP@zqyofVp7W4)1QG;&`@`hVH92yFkF7dmTfZFhI-Dn
z<G(RC1{jRdWl6Qvv%PFjt4KPpv(391Ywcp}j6dOLql3upgDmSRKl29}o4=m1b~nRo
z45RD@L{LX-Ean2k4L3|Z?1VS=@!DUZu*F46gFdM8`JsB#Ciy{8<4!2>bV0e%1vTA1
zDEss}I7&)Bd-D<)ALRB?9`@x%Cg1b3MLKhP8N2l<4d2sXw)2pUovgE!d$=rYv1lV_
z``Z}%(Vh7DNY3b)j73lIvsHBl+g#7s%%zOEyqsO}PccsTIes_ok^pP!=4|;!gKere
z*zWy|o%&lpjv-^@6rH7<7i5i{oUPi%*m^O}`1^%_2*~flM8*=%)>&f*V>|ciZ0&X(
zKWFT$+wl2g5WhKvv9ybI*5WaY<(rtX5$B+;fw2j<1ZA-X<%}SUJl)S$<9#>o(q&1t
z7VOK-58*rwMJvath7o&ez-Z`T#@4;e*uF;;eZc$wDJc7AJ4fR~ui-gxG<4R|0g(Pu
z4dikkJtOchNW629+(QL_EQ+k{yc=pzMM-*n7-T&*;9J;V6lz5gmkrTShDdW^$N5lu
zL!`+EK6XG}+v%jr2*3?^;7s5>z|-N<sOy5&5oe>7@?;$M@tTozmd|MHFpSOn7~9dv
z*=8K~NjHf#<CXhw#IJ%Zh~U*qTocXhxGw5AEBqmTKFVdlaF<d36SpBs<9)c8F^zHd
z#@rx}In`ytQ+>zpz~8O$<<8z_@q1|8m)m;p!L4FAJbWJ?Q4*^V^=E|~J8T%cz<Sw`
zlRh;QS}j}(Q%(Uetw2l|Het^>9U$a(xLv&XcQ(DO%QKjY{L?7b5m7?z(`5#%-GqB7
zM}ws+@Xc4EiWaBKP<aEK@YWY1k(01n1|c#+fzKDA${vfjsV4~T{S@Y{;_&_g2G^fY
z;NLHB;cqP?&4K|$$G7f3?2|fJzjS)Sz{>3%-SkC7j$fjk9SdbX1DpTf5S3V^xdT@^
z9kv_n{@g{~aCGDjieOI_Vunz7<|7@h7*FAm=l$USkrN(#8ikQ$8Ri9XXn35pNP|3t
zd1r6bpazHVjgLi!zM#yBZA(&N+NY?k6x-pGB|5aZQ8)P5j9BG{O{6A-8TkGEEea&Z
z>ab-ufzKD9wv!kTX>P$ls6>pjkj_xDhE~Mq-<^w4Rg?(SQKdidNApF{5Cxwf1tQc6
zW-K(MVOHkXK!ND9B|!Ef{FR6-aN|Zp&I^e!q#I>K0*CiL*HKy{uywZ|*6*>yf8Rt1
zJ5_i-P?_cM*$;Jy5vEU@s8o;hyaZKzk-7=rCAP5h=)A7lJ1(VJKYECDX@0g<`5hVZ
zt6%VT5=E7L^L<)mJTZbnD86ha+5gDz5j>dM%S?`oq=$G?$^+mT{7Yb69V8;|U7%An
zfhePKu?{*B@bPzclhyGe1^%UY{Wp#+4ySdET+@S!w6#cMBtn?)%|%EKwY10x4vlC(
znY|X@I2vCY=Xl3<3Lh>;BykCY$tYpJ^eM%4gP%t!gu4vhR<DxPIM4Sz%V2mhh5Hcx
z3OMbD8ZQo+w?rrd?mX34e%~i(XA*o)jIAH4UYp=dDCGXxWNz<xbAy%yZ)BeN@5AnK
z`z`($?&E*NDRl+)mlulo7lfiOUV!qhSLDl>FJ-{f^$zmk?|g9jiZn1iPN<9mtgJ_)
z=C-G-YpuTE%T4A=*ga2pigCy^cfkF4kQW+o{zye)X+M}~gVRq^Aq7=z$w~0@tV|t#
zei4PlSOPbkV~3(Fj!=Q=LdJ1p53Az*l%WL5GYJ$SQ@iLaLXzSPY5TI-aG4&q5fiof
z9b?vaEQo&1mW&E#`@DCwU8A3Y(|DA&F6%L^+c!sXcs2i*5ifRc%-en>C7r^_=4+N3
zWh}1S2Y#VSo4~!li-c$!gVGAb#ZlN1+2Yd@b-3jc70vMkrd+MSz##+*5prTdgo}Iu
zNQ%_pj%yvL`5O2+s<g=}l;(-gk-_6V%5a>oI^71PIRvgf*9N0d=Sv)5;5ZsGn`3T*
zAAWY8g7-m{`fL?O<xw1G#HDpJ+hgHC9j-kG=Ozx|h70X7)IS5~Mm`_!Uy_Zm%|r?V
z1_E4r3Wae9i=`%r9OHNm&SNsp$)B&aK_ngs*InX-{DB1WvxA_!{UBnmbJH07`3eQ1
zq9|N<mL00|DGU<cFaez~#A-LU#~%$;NMZ45kFrHLy39i$y8SPFRZJ9Ot9F+5)Ijc;
zcP@`m?0f-<V>^C16^?ls!vhKTaOdi~!8>yZ*y5Z#&~=Nw<IZBCk@NP?ig=*yA`%%-
zd1PG#bZ>mmTyux7A>>aC;!uj%11ecy(GU*ToU4F98h>!I4Mx|hFern{17GZ|igF4U
zj-gPVLt#vr9nK$*rn@+aaexTCxbSp<Vq7Ob!1+#yQTRm{5(pk#56P64o#oLG9r+$i
zE(s-~GWSjE*gx>j0e4u}T6+mQ8E1O}qK6DM|Gq;xaUhcr#r+|H7JYmxE$LWEiv3$)
z;G=(n!p$*|b?-<hm~lHn#sq^GJ`9P|PL=sa)89B3idvRJnXw;=W?Tdn_eIJ36f7?y
z<MG;pEuo6sC%kK+GJe*R<Say~Pe&v?wVi#k8CCJbAluQ6KL=^3(hId-W6J5MLJ#a<
zOHjpA2D#b1?S7_~>P$UdXY>q%+0O_Vkl`|RwxC*<8f05r@%n@Sqo?8Drx;wlh;{rg
zH@~kYQ*}#A!!a)1V3%sENNXt$O8l2n`dGB7${xL{Z9i$t5_$@%7x{+q_OgJHGd^HU
zTcjB&V>|{K-C@u(bc3FS?~|*u6?Fj?KRn3RG$15V?L&CN%gE^(zAvi0DQ-4*qn{;@
z2(lULG!{1s+fMT1IN>;+iQ|%Cu(b^cndAl8o~|IHML3418Rqv-MW`gBoz35h*JWyK
zeJi$Q<1<gj&rikiMhFCwJK1`KZ)j$aZNYJ-xp?nM0sKCGeinW|-DhlT#nYh3&l){=
z{UDqNoIiqdK~MJ?Fwkc#*%mNjhX#$MyEP-K%8f9W%OD7y;PVX_pc^aeyez8H&z3jf
z{W7~5jPuF*iwJpe7_%T9j+)RoH=^|+7_!02dSz9Q$$2ZErZ2k3%=_LSbtn(NU-AcH
z@}y+*E+~7^VqDhR&3b<%scd>1j*{$`@iH<==j1fQP|pk+kmfTM@523-=4NYgP6^JL
zfV=3KoH@?LIn4F4O&z!n61;4+n3FV(*>NqBQ#rGr>1DQ3A6vOI$n1F@W6l<lyUEAn
z&JC{ZeJAt163%H_MXG!)P~z^QWxg)8a^qhh^{F&k+15=eH33Qb=vcIJ=T1qb<?dVP
za6HlrUENU50x;aa0s5KxXHpAZO{OttF5!NAEFMzPVE1z#=P9909e-xg`Imslrw~V^
z4Ppc9`Hrcl)4?~j@h*}06SZ9@Raw{6TyXr%0o^N3AxX6l^I+rE;2N+1_K=-$f|G5+
zoTs$N@z+B@XTnGcU8sPgL0TlwW|5}xU6gzhdY-I1(27z+6v8S2G?+zG(<|OOk%cQA
z@4_P+4RW*-A(wa>TK2LckJd3K0p?6Rg1o_;s%OKgx_{qtn3>Vulfit%l4$U4%!7-r
zSslvVel*g7edLyv!N|O71#NlMgL)!rpcJJa!zselsad!IRb7XZ5kUKqA!2uY_&8At
zO~kkurdNR~BCp$Ud=NTPf)w;PRTy!tbl=RZanUWR7vSdte2X)a5@`mtJUa0{EnMb|
zR`GgGRk&~mMiwq|JcEJ;OCs{9I5fOJ!W?mS?4R)8HWfsX-e2(=phsa}agQ4goC_xW
z&V|puf%n8IXv4*e^Ninwpu_SokyR*!r#b@_`=v!9XypQ~tD0N~vXDd+qx!xDnXqQk
zJ~%2m6Jg337W63bSE0%)rk4@!tTVA|GaxJ->hYHP!Yl5Ca-kq}3OyC21k8HG&}r03
zn=8EWg==^~IOz)`CPHu`|GW+7)T4l&pvV-@rWZVsUV@|zwYV63q}vWONz5seSwdxy
zuW&AE3UHc$T2?pCYP?Eg<Na$prbksmSfEkP8Sh+Fw`0Iah#K`f8eH}}+Bx&Xpi#S5
z8Q?t|Eir$PRX%*LJp|6UcfjL8nLd96iy8A@@Yg+}khfPETW@^<`jPqvLfLvnJ6n;E
zi@RwZsQxv4RV;3u0rhNC$xonV!9Wrn6~lvjM)J8)!=V0_PPWJ{Tmj}0-noM<N1bxp
z&vz1I)9a8@@oygVcA;MQJWcoh7QQPaH?Httuz?{|Z3o9q%_KvT6+j4=8PCKH(vy*~
z<A&Fxg?EXlgUDsI5H178klDv0qrf52<Ac(p!U`S{zHJ0tTMzTVt+fm!gz*me1U9Z8
zW<}G8EXk;Xre8$(6^lg{J9C52IpWF@au{S$1ujdU>CwnMBe3g90*H1X^HzGsDu_%u
zAc8B9forl<nia)K%|IFhyQe3LiVe6S<3y;mVdgPW%<4B{-)RxL2-=6BQ+Vx}rR#{5
z+)e~iF|<1{dk})EF11+0Lgs|BD}(QFql$UbVs!jWx1#n;zhF^nD`*qYRS<m0vvsK`
zQ>m?+fkZZ(AM6X>J7D9z4)n5C8<Wc+AkA3#-B{@~j@OzY+t5wnv~x~Antf-j0c74q
z`}aYmsK_H>NGh54py{X4VVVaz-?Rc`zAY$nIfu$wFG6~&@P@H)Vr1UsuNFbU?!Up&
z+P&<iTRm99kz5mTB4q{6PrNS2Ud%&iZ;AXSnqbb@Zp3O<6sBSYPZ1Fy%Xz99S<m7%
zSyjqI4jeje+xf{w?=VNqBM`xL-Mit@V8fp_LldfHYc8Ayw0^guf3ya6{NzR0Fxdxn
z*Q{p48lI*khzsql*G%TU{HTnU2U7n8@`UQmkVTJj_uPAB>m17+O>ZGwn{y`wns<d=
zk7CKpCur-d|1p~;D|}ON6?AN_C6SSFJg_Z|EsneizHt=Uw?|BH7G~8OlR2WCAoBG~
z-)+r|)iopK&AlYt$WSChW@7{MduH&8h#X^PJ|?sjs37V@m?D$#b4B^#i0XB$&}_B)
zehEd}cNm>$-pQEwGObyIrd8r2qxXKveChY$BGzeT>pms#?JEH$9??@mL;{3{>XM0~
zReB4jEP$QwLIGNqN8!@%mW%RNn)n$6g=>gC8<O`?5@Lo#rfubhV)|wyLskfp72k;!
z?<37aIKDEyttsGI-?JFG=!%s>i5XT3dm)A?<~$IFW2}pND&|g??9L1{;@r9mYUD)t
zbZfd5iOH;arlJNp%DhCniL#&-sVPolDdS^@UC1%K$VOTX8~{$`ByzJTMn}UpN>ch&
z#37?QNqBrwB`t|U)OaYFi!ch&)uOw{L)_3)c>qrf*ZKKS^iC4=__-Z7PZUMMH>G%h
z(37u(NKcsw=b-u_5~+Dl%7)nVDPes&vOTT^t@mPP@Rh81r^ui=SxQaU<sKv!yOG+F
z*jI*W5)g;8{I*%4NyJW>d45EJWUH!1q<LhAlh_{=)|c0_(}@G>KDMgqh^J4r@r1(3
z#^sx?x4cZuoKSC0<}71R6x7|i+=P*8_5PfT{=}G7SaZ%hu;bk6y>2qt(fY{&ST*Ud
zuziHP7sH)ugH7kWZZ!SsNr2g^h|ZK-(r9Sq4*ybMZ9(W$EaJo^-c4C31X>lD&yWje
zq=^dT9I^*$l1a!w0d5xE6~%Nj2FUW|kd~mE)kHY!Ve}%8(V&4MEe0CV63rTrLe${G
z3nk`oyim+V!rhN-#Z%!O;&4*#ZJGrgU%V^YN!Nn8+`WAvsHzS8n_f2b?c3leNwLFz
zC5Co8>`JrVLE4`C4{0gMGMXR#2W!=uxrc=IlVEfL;*S(wBNWn;HFFHW6c<&q<Od|i
z1*M9co)|PswMhoc%<^S8bV*UTe-O?bm=utn9$*D_sIoem3Ihi+2`mgw2@tCk4iUhe
zO$2{1VVKl87jS5-#tE~Sya?nG_eTaFBXAG_VJFGzSmFqg&sW7Mi#$3N`z_`#J2TXO
z!6Y~{JT~ph%c=XM(a?F%Uz85JPFwMvniU6Wb|zET#@XwS%JV?U=r~!89WzfR&I0?-
zNX)P=M7v@8IZA;UH*>@15w(mIPuIE76Q+LLAQS_p>-Rw{?t5=XH;EqfD)|ChgcMFb
zzI{K$W_$=PZ?|;mto2?8M_71SE65>4oP$<muZh8NNJ|k~ErB7ax>*7b1Y>7lR_sIb
zTWV0s{;6?(nMziQ?jRK_QT7i8pvFjXZ6=`x91I?E$j~A`%?1y?Q4TOI?1CG0*t={X
zJULJ#mk1YxIBa}99cn*t031C`d7P-na1v%=4mYZVdpq=;Mxks+*0tXaFBGW!<Z*H)
z0wrj~Bx8d{(y%VJy_K`Xa-Hqi!=ypeb}s%rjWIgG#gvRz*6L@>J_HS&E!du-Guv4~
zVdykSbu$}rbtij&5o2fm)X$!siHp1l4Kb%{T)CKa9bWYkInF&E2#VM+CDSL#Kg^na
z0B5f~g_PBYGm|6NcqUjbsY1$<|G4#U3Y|Q8nlb?mrSweJ3@2;cc51f)(H^$PjeUyp
zvsN$uOl)U1G*Hqr7>);yOA@vVeA5wN``q|<TD$O}X2J+cPsTCL_p+^Rj71I(vTe;M
zVyAU7<!lt0&ordr*ICfXw&VBg8Gg3CDJTu2wzC8Ba~m4B)I2Zi2%tQc5isgnai`1A
zeT?Aq>3AQDsdBSTO$Lj~?qbWgV*k?JOg+ail+*D$ry{5l<u~>Q(9jv78R9-LpvzFt
z(nP5&o^fIKs0mZ1sHKyq*=uh=mDw7Ho`Rt!9qIb+*;Axk)0HCqYS|i^(;*wrBDKD-
zIh}m`wb(%`)79MBXFw%tBL(|!hy2fTWc%>>1yH*GHf#?-!IDZSUz-3&NVei&4V)I>
zWRma$N8|Wdml09WX*9SD!<HU2w(r9^N$fIk&JB7xGwApr8!*nxHa6&N@EAY)e1(|P
zW;BYU0b4jA)C7#PeybS|zO5M-|14nq?n#3?N`qFBnGoM9mBIB1r|~ivE2M?cel!ip
zWRzzm9lGritIdiopRJ;yl*7Q+LdM*08lZn75WaLNc6h@5$$c3({(fFd3{05q3}fb`
z@9!tN2a36gQcrs8aT&-n#&49~;5Qmw8uJDWwqT>qP;X-+uJbTBNq9jpmi+@STeBy~
z>XE_ES}8u~?1y(Fa~Xl3kMOdZpLVi_7M*R}qqFV!uf5wa2AuCRV1mx0FE_ei^5K@B
z3OgKs#uFg#;ZV*KFn@Aq^k_u>`gkn#H}&2#{-VH67_afj@jl~=EkVX~gMGRh&4UO!
zU;HOOgQ{)@r}$a?X+E}SSCIJwjJ>}Yufr>@yazw8?qo30%LZTRVVmo9=E09<uhJNf
zBs=9dIL@QQ_k%3u+#p-EBfz})`KQZ+;xX*ZTe=vG^y23lOGZY$9=|W{`^9=q1aKHb
zZ$MFdl#jtUKg++`&-QlcEP&r%yir`Iv*I5G<!9vdfDw1L$5^#TGXep__-wWL{p<fN
z0(o>pIfwHBlb#y}$AM_tyMKUTORa2qmUcT~dKToo^`E142|WtxnQuC@Z7<}kJjMLW
zI!MZza>-b2-l48P94frhGc@*GRCAGe!|0%qd6CQ5))c@w;l{!Z=A4ZGdBA|-9s|ap
znek>f+uLrib{AtyHkxau>`I)|vAAYNx!IWCxQuQuH+JsRjct1kW5re!n#TB+nNRCo
z!?bALBle-LO;BWLq-_5eP%?iqWImlps@5+irJntyG`NctuKZYzfBx$?l8U-nqyhzy
zQr9A-;+-d<pXpfohzkD-9X#tN68p`f)PZ#(akG8v-Y=kQ=pw{je`QYYn+9Z_<|K(f
z+sZpW907Z;6RAy4`0)C!Hq`esv7-?RZ1_?k&wt2Z#~u#Dt0+A9qz)_B;b-xp47Lq+
zZF0i1?=t9UH6T5O!AA=zO#fT~CBZz?R=yhntFI&Q^BcS{^CKr8c`*Z*%`OW@1T?~r
z;z;B0(E|yPG13p)!&*nx6Swa(#3rwWV@qaGL!gT=YDXBf%>hrohD)G=!=}9ei<dEY
z4}l#zK;$dYp|gp?{ZDW>V=RL&W&>=;@qFzSh75~JL*|~<c6ebXh4uypHAM`b$JMoX
z372VD3BnsKdkH-FGJ%vd252LNPZk2q`qBv`2C;U<fYx0E-uPGyxefzkIC<l91J-On
zyF{$0E^olLr37C4oI?Fx1B!|%-1Rhv?Yl%Eku;H#t`-9KJc`3th3(rkShAk-Y456_
zB+BB?;8O=0;qMK{hU~2Af`3Aje2(SifqQEX?8e#tEs%S}-acM?=YV}`V%uyv8Ptn&
zi{ibw&)28zzyTQtChrNQmp*K2+-76$X!$Il$XV();+lGeKo{s_a2kOJUJCMMqRd^a
zwC$1=v+OYYe1K<P3c_!$SKySJIBeY`_ASmEvZIAB*<jmGIh=PT?%7XmaMC3VVsaSk
zTzJ5PgBx3n?&xOftS;ce?LkFzX-3)*1KjSt5D{4n{+4c@klP`XbSXP*6ru@=C^!hV
zRBo$^gzpd$TG8;hQtDX_rDz4pZ+Q<=A0Gp0jZrXS_j4rQ-9$<Q+n~mH1Clq#K+cXh
zC|*+r)u?XdHjRdiCBgu60>dcgsT@Cc`ZGdphN^(^lLvfgk7I0GJ!9=%jCFf8R&Zqp
zg9&cL`+V%;e*~G3Cq-y>GfLW>L5&T$45hwFD1ldK>`!m_rPRK9W03iRhB0rmX4pre
zg>NEb(U%xU;0NAo@g^q=U;GbD2t~S}Ar-8?kd%AEENaI}-8RQ6@oaqu)M$L{Fa1VP
z(^+FXWBU+BGVp(6ZbAuqG)mdS-E727-BP-4YBg9x6H3B{!D@fzk-pZ5o3gY1;blP-
zj2oI5>+05}WR-dWj`2ji#~3#oev=Q!58GRX7K0aZoz?sdKOct@SB-~Vd<V{h#@POL
zF-MGPhQ@NQ(-@qJlG0E=yW}nn=h0vrc8Jdn=E8Z*x>We8qm(|(%|_qSEv5T9RL5J|
zg*3-l<@G3mpA<Bdvp64k+N^Qm@7=%DD_N6*H9H`E)@jzW%(*Vve<m5)(gERVD~^Z`
z%ZHpm;pTKG|1hD?cd{Q$gX*V;gu$o;YSI3c^H%=RY6zvbxho@2MhSczj(de>TzZGk
z2<qHeCsHGH37tu2CD#TFf|@Us1liRO`*EHbTfbFfZja8o5uQsr2O+gdsFfA?*p$~j
zVi_76>vSo-zqP=}VYGKi-=|KK@JIgOr8zJvl$uh$m)tjW6l<VEmfkO$Mp+5QvSvH!
zDPr$^5z>^tGl~0%k~?cADX!Z>%2|-4&RM6FZMzb(cEywOo%2YEz7LADc9Oqfwj79I
zU2l-e0Efbk22!cv-~|`KcYtX1^ylGp#+B0$b1U#8Qwp%e8ZYyDbv9%IVzwtEE_<rq
z3{V;5Vy)c<%bXZw%^e2I7>n5V$!^4D5z{?~v8XXYW*|9>d`18{h??m)=p<AFC+bW+
z|HuM)XzALUpkVRmq)gXIRp%;Fyy6}CLFLNVNLj-Q#3OyA$UO@NuR0Zu8JQc{aanK&
zMF;~1_>4UbK~{V+;@s^zD>&W9)RRS!jKRoh$Yciu+4j9bRx=rYBGgfKDdL!;5$8Nz
zGw2yO&Uu3Q;|8n=vTodrSvbaY5<_^ykij^R;byz)gDhi&#`d)#{Ba)I8Dzke$hCra
z`Cx=se2fhoiksPOut8^O%yEv+6tq=P{0Z59)`{)TQZMuSb(S{L$COjVJmUQ)VgJ$s
zY|p+RtC-|xb$c{cdbXP>W06^$DlmA?BPXpowh&4N&r}CLI*Ane15nlW01TczR<;j%
zVko4q{3nz%9~3`Z1IeC&a8&fQ47}&SC&T!5C~Eja@Am{o-!_-j_{@DA!syG|2GQ~1
z%<srhfT+`XC7g`>0_`EnX{h%UYKF(B8L`Da*5$%E8{uQNQ-g9%iC{U%4X}WY`zXhY
zj9h2YwSGec-x0*e)zf`O{74T970gH&sTpl<!=QN@kG<Tp6b>2>Q^-lEy)6zQ;NAc@
zkxVT8{Ya?zGzumQjVJ_5BJ5etb6~<0^)L>^Z%oG$CsT|alTP8Z{-+`xA8(#eZmiFL
z3F@wK^L07nxZSs%*t!?<ZDS|Oez4ddaXu%SM8^;0!4(Ctr)d&=2O=>+m(I!fe^l`^
zResA$9NOdUaQzb+>=rJ_BCoZ~Mu_U%U;?)w3RdsY;l{@e*e5(5?83E4;Y>p{D^cNB
zJrD#XONGgI>!1%H5OQuX0hBind*T%l@}i0a$coMb0hP3^5!I4_bT-)`U>Az70&0V*
z#x)+p!qO&;K!S?&%Z0%z-25!(oBSMZeulwzA2I!UEpIazLg9`#0ahct^6RG=Y-~ks
zF3!vaB;EDW2*2$)&f5ruo1X~69+4m10hXr<?ynph-1aKKK2+NO@EnIN?YeYQA*LT6
z&|CsHJY~RshYr^~ro&zj0g>llx^arnb5ywDNe=#44SxI|22ExzV7Vt{O4=+1{`4Ay
zb#4lOd>!u}pfVvcH>e47@#te)VJhW=^Ni%5%;XB?BoKQO#8$p2$2b1`XCa~FcM$aX
zA^M6hA+i2KIJSh0bNd)lzJD(F@+6|BT}LbTKMJL9Mv?M0p97C8<UwaPDc}7O#NEhf
z`G<cajLl#j+)YaN%z%Pc(Z3^eU3I-nh|?}7ReFJDQuygq2Hi1)-}s=$n;6bH(`4=)
zp@TSc6@JaX4Q?bF{QTQFciR*hn<4ftn!14uw8Q21=m^v4aQQzB;HhG+`2iZKSjTS~
zYVP_oy6k_x-3+R;ATp6-e^BAS)W+6PxJ|<Xs3zk=Av<Bt6#ZCu1RZ;bBL2B}$o^p-
ztg^3waJ*~q{!;MG3_#13+k3IXX$q|ze>dCv#$C|<%WkWGC$!5A9Xo$2iyU)<@HBPc
zCJu<a)d@Obts2l6;a94f#csij5M-^$pmA}C{MKrsY6gjjC>Cb&2-ax;O%!FFkf$Z9
zfKq|{t{O$WdiUJJjKmD3lNIWn8!?49&V~BxX5a%OgfBP@Uw1YMq)q2*QbU&UuSzG|
zFXXsT-x28K*@{ZJ(ZvZ()bTw<vM;*~(2@StAcHkQZ}J08V!%WliCDX+j3qa!jAz8d
zQg04`l7i#drhqL?L~;@$0)m9AA5}ytwg8T!0jvebGtDXe>IDNAGa-sF1otDm7r|0(
zL41xKm|)EKPvmSD<+n8ao{|tGhM33r2)w@xnU(xmQ3!sH_ZL-_y0FhNHeru86ZqIE
zb-LHqdgoWJgkwSidbk~AbW#OMmW=%z*4v-xiG0j!I-SHue8N}8hW7SR%xSo!_!Uei
zZ$mY4<Uff6P=)q^wZ!;xI@>b;pQP&c*SO}N1jN=!wMB2SipD?E-RJ$BYr!9Y<{Ziu
z|9lAgpM*`RZ@>|dZQ|})%{h2EAQUHE{B5EfA-=4r)YOW?RJ`;aG_#b5A|FB)YSBPR
zGQeoZb2iZ-=Uhhi3LkJBA=VuP5~Ts}ws9rirZ^JyRo*x4HGRgT_DNOsoc2c+Ip}w6
zr5YpKMB(sN(JFPE)(%?7zgWyWcf*PsEYS;&sSD?^mT(DlUek%pd-*}_dj@VWnRloU
z=3-%M(r$zHn_U)0cB1=BA_eqNC{xfcHn0ZLJ=dY&qQJE!qD+`s9#q7K5M<hh51By}
zH6^}Kkpi*DxGrPEnQj)rl;Uyk4AH}n#GGR>d(;nttPJvU=3C?Jmp^yDG>@xu^1|@Q
zV=6gPv=9n!Y#CpQ5;gN8&xsToh*_{j_7p@NP&6jSV+%ssBm&1t#O#SGD{?#F1{F!G
zqVT5|1)V4ZbX|nWLyxaL6Q?2?ESXRI#P0`1q^Hrdm<-f*Xe{1Op#PD?4D_-5?af7q
zOg{?Qkw?^o!x<72#d~dZvSeB`G6<iD76o(O%y15?u4mjaT(?tX$clJb+WqoB!86Z-
z8m+MPmZoha5cNP9^F4|={aT5U!uHZte1m-$iSh@Ct!WzDGU-k{U^rh*CX;wuJBidc
zu`T0%4{zQ}*;3~tJZQTdV(<uE6FbRd-V=_@k;37pA@(Tdj*C5`28iKD6;G6>Q*dpG
zYD`3yh?1!m#9A<d__zq08Rg7$84n;LZxtcJpj0lUC=$T?X`mfgQ>}EP&6avYP>;;I
zgL&Nw8G#QjZNFY!dd_f?d?r5GN4Ya;3W>VG2emhvdE1XM9qUYG{LsH|z|k$W)C{Sn
z2u36DrI4e0xa1u!L4+*VCl0ZsSSub^6ncT`as|3I0u==c%$R{{xY`?{E#$+&0|}%c
zb8_I{yIWArZx>>nA_H7lhXH4u<$zUNRXBSLz)SC$k-}gih7RzLJwlBM$8!a2Hh<@#
zgONh(zg*A?t^?dR`5}Jq9||I8Gox&1S{%U8VgOIj4!id=*jaDpg)t*9DDH6wOc-Z}
zEp-%PlL3~kq$2T%nY#j)OeUhcv2hMa#rv$^gRj!T%~c}C85weVq8+jZAv%P-XAkOf
zb$iUxqe5ITC?V;1&-7#p_J~MmYz5f4Uj|=_+so{bc|&l&N7x}FMTL3GIOz&nVfNxb
z$iQ<D=8BCWBn~HXa~+VTHY-p|R!(a?4u+~rDXV+)Pu3ryJwl<YVkhf@-@q}}rYy1;
z)D+6wVoP}ErcP^pi35i6_7x{VFko03wpkH+!@Z5X?7GU{Tg*A4{jB;ns9IEkSqU6T
zWE?zWB7trDDV#PG$aC-D-m_b^ESNlFNoffKpO2yu5@6wK25!H#FR{y77lYGI;V^rN
z6VADi!}Qnj3sKZcs%IUBx4&tSKg}vtA};+Ii%h$Yx4t_Rprct&u4sdn)%i5)+Al%t
ze3mu6_%LjFQai?8Nai@e@g<8XAoH%#zJQkf55r#aE`%yLr#D1G_Ktbr+CCoEp6;=(
zN268C1W+BLVRP)=aDtJ8tB-5Vdsh*@*wEZjO58wX0YN;7V>wm270sa{FsgxFWlUwN
zD$>vD$qHjm1jRes3GdvE+$J@b8g?h~(;$!3e8DJ|WJI_&+YAq(4%MbgdAvJAH#U?U
zX#^h{g=d#RTla3*0wJs$t?%zAgQGqc*8OZ3ZbGxQ_68fY{VECSN}Bo`VI#rrA3K9>
z8F<z?m7r>i)c4wrV7D5>siA^XgFuo>6*Y<m-Krxl)th1u`dje*BZ3W16&a{XA`mjL
zp{COTBMJ(^9;+J3t}Xidjd7ZDK%O%(hQ)XJ4HeD5E@*n+nVfD9`rKZZ(^Ji2qH{$y
zk|a;t2Bx>J@)nON^IbBoN?WvG6K}8EtU8I!Mo}$5Fh&pR5qgY9S-dk+k2h>IB4F5k
zK|E0?u>o;V7VHLRaIY_(Xudc-ojC(8!{)c6*p5b4qQ|ICcGOX=2M!&KekTPMt;M5e
ziY0fx$zkv-3BV9*s{c(WuLzUH6oM&(VBO%|2M9vPkZ#8*eI^MiYP(^M>@Jtgt81GI
z1?O_O68ka5>PKw@a@NdFI7$IQ^<`{TmF7FB;SQjoiHV$Jwm`QL5!lVtE<)5`g5lt)
zij1m7TY)%N6A@$cC@RZ@77_^^%m|7UXL>YHm($;Iig9KIbZuH2&;~ayQ=l~~2(k8t
zJ`cTgG8&V}My0Ck6E*0s(so?9BJ9)cq-N4aBhWn?w)}can4t83jMAqjL&28eP^xv1
zf~{{ufe3oQmra>A019`HAvMB{@XIlfw>Y*(GAwL;2&%l{+1pN#94W^=s_Jkdubu;%
zj0^@K>&*%Bk6O#+tg_{=q{!9O=No0-(PT`h`fuNR93>r>IZLZ(j2d{BZ^(h|@n>{o
zC7#(93&)N6C6LA%``Icz3FoA8Q-S%n2|JLXt=pi?|Dg3e^V-6?Y#5E#rY}zpzxLQr
zm`h`gCjdEX{%HPXt({`N9ID$sGTW@gYUMnK49EV}hFn~4IFjT}$HloJs@h!%6L@qV
z?~%!S6QRsiY+fPuQJ5DBoSk6hH&^@9)8xdWqFp!8Q5uJ0zn7G1oQ~<{veeRuhL5EC
zU{TwCsM0v8>H1VKcEp)9s9-@T^0mP@u`oAY1}6rY6BP4ap;9sHRhYcN-V@O{VTzNc
zzx)PNtjUyrPqVDqMUR}W4xIU*bUzX<6H~%d4ICq?;1|O%eFl{K-B5~#qk^FHSb);*
zxA72NLQ1_Iq@2%$iK|PYy6FX|3NC|U#Px@HzErAwSHpLLa13uS4<)7K%S%ax*Q`Gn
zHojzFbJxJLyM8U(#kI#Y`m`S@XZj>ky6HVq&J0r0GK-dOzD=wjn!n@~DAwAcsAUUO
zHopy7KXyXFl3Spta}E?EAY9!15mc-+eUgvKds_F){je5l^hKmJ;2~xHdQzp&hXD_#
zAfx^giha1pQC%w7G9AvuJzn6t0jl*SP~<hBoXw#XpZ~1Sy-p13J@AS+j~UfA+Wf=v
z>mIb=JUX6-K~rI+)J7uz%CEb~{A0p#K{t-Kn;wPDzkh~(X%orjTto>z!~D0}Vf&dH
z=nWTeeZfHDOdJ571=YOynF~PZVqNzP0AKsPL{)WY__P-E)pOv4plK9tSZ<5W8(Phk
zlYfw~(}xp$2g3Mw*kZQUMDxraUK+(c2~hf`4LZa)PodObF~P_jcfB-5-XXHK!LcX4
z!+`dcc3_GFj5eY~FOV<{fetjy8!<qf2;Oe(f^~~@@T~w}K%l>L5x?IM79HZ*Yk=?7
zqe`21Tq%7HS4RaFLd39#h-!C6ovv-MzcZ%<hRqrpaSq=^665X7jWK^$#`|~ReDtdH
zCpy_#8Uk_yO;lM;2AYxvbLOIqSCBzOl17M+0srnyP-{@y@#F(@r^!fXBanht+#)#E
zq`NtIT3UhHg-qfG*SvNxBIAf>Q6o`oZZlDPTO>4}$slG&CULK~gDpY_|8|ABXGFk>
zN4g_t+bzl{V+SEV-Q$gZOC9Bx89bHB?pcsH@=4b2<D|mh1Y=jDt%3Mq@bhCx(can6
zP5nSqZ-=VgZz2Of;S=#4716v$pM{iH&oKY8PT)j@O-|yAArDV*v)w#kvZq}MWy{xw
ze;rN$qQmyI(^_1%rR^Rv47G!tc^BJqmj8^7!nWe}76At-LtCYnfO;zTP!VNX>gp6K
zq^)ejPvO{8FN88yB(n-dVp_$KYkYT+8t;xi-zfR;Br-h6&A<aeQ;xTt<OqqYkz+R8
zr404WC1pmNGOXjraQgCrko8;<6wY}FH4&e^*7t(FYSm;J4ftJ<zI)~m4}SrRl<c;m
z`78*f)V~rc_P%PiS+H2)Yv~dK%X-d|3}sNsv3l3ueOP5Q(fsYd>+@-D!xv;Uf6MyI
z)IxK&4<e((19>*sPq=wVf9P^Y$*Om$NXAvX`gNN5_U}bA9r)rONu~cYgobolwedet
z^~L$}`keQMLh<U?NEvrQv1>V$E_&feOT~Rh=;JUey@=3~FG_kRRjRj#sNmcOa}FDv
zZ$%v@&cRD_l%mBqAVW5A!(>6`q6oQhN@olc4Bc5iYaHahm@4`eU-eu(Eo-@-4n=!;
z-p9F+^LZTfx0UcK3CCyTsw}iWL_&B%vE&6YkT)%*&-i7{j<=2G!_3;G-w7rcBDr?#
zCw1RVDm|7FF$|)r?RG_0%=vlW_7nZx!m@Xkd{Qc*#@^2;)b1Dz+3%%U?_>TG$>Z`q
zE|EVEFC6}8`blBfr-P&bW|iubW&2{MCBm2mF=6`};l*7}$eW%UHU}qIu%3m@BTS{#
zYTP#5V`dSYY(gmNpy{W<FdkNnqBk_2jOzA5$&4GV_W#2;xS;Ggr$W(u%P7;sJP^m5
zGB%8PoBwj(9R!*G$>_TnaZwNXU=$?J8+iN{Y9F$+gI9(q6%C*Fz6Vn2lxUOycR~95
zeQSH3G~>rg{?^aJ?s0tjD)8Rg<s+bUT3>@q-p47(81kS`-i)a>HE-$o?~s%lMraTd
z#w0Ur+0nz)L}+u`l~K}gb_4&8y_YbYVgGYp$%g~eGnY-xg{)lztix6@88}L`IiKa5
zdG?PR11FHasM>Tqu*O`hx%{O$aPr5wefn@7GW0>O59@n~eyej4CKQ(1`v^FBXFBBA
znl)o-53|mi;yk#r4t}1>bEPNU|6#`6n>%5Q?xoqQEI(E&xl;Oq!E~Zf|7M4&e@Hd;
zACMYtmi)c8S0X2)m<A==Z<c?QhUXtRZUd<FSmGxLV@8kW5FVUl{XRjJi+ZwESoru*
z?^p>hhTO-;SpBl{Qq<i?s(EAR68Yb(>G86#bY5Gg+5GW$Ci#vab!f{3wRGiQdRxr3
zK=ao;<QP8h?B2HT!X~pkH{w@ik%@isPs=rh5K281)!iqXGA$!p$rq(?QlC9^EDx-(
zTqwE+iW;v7?;jLyn@uWQ^X2cMTqv0<Du_%36(ZiRCB}}3%4Xk3Yny**{t-&ci<-jF
zh8ZwiCe?$U@ymPW7f{)D{~_)|zT)@)W0bY;au~&$peU%*a;=RH-LYP_S8jQOl(p}G
z!hjD-yZ1ug%DVx!IY`aMbx^K#K#8}76mMOD%r6-#UOI!6G_N3~x`&hoca!2hUz)kH
zkL$)XnQ%3~m{fYZ`+QRPUJR|(IgH>I6EqXSL;m|0(<*ORo`hrXTBlUBTn}ZgjikgI
zASM2NByZCvW|wv^$MI_+Wm*6#{p%p{sZ6NoydFyTZi7-ohmwXZP`vq0_|A}dklJfn
z?<AF)tEX*>wINFa9cpR2S?&*xgZEE=QN`{DNO9|zq)0bNS?dbOUvML2ypTjHo99Du
zu!EEY>TsTB%QO`EYwyLm+=Oigl<5nhcH3n0CSg)#e^dU<Q%P0lMpCA`aXsxOmHR&t
z<4*E-eTi*d_^*Rh)U6Tl53SttG?aUHW50t?*^d35_A~fa3D?ID7srxXUZ+%R^Pu9^
zC@FxAcsbUVy`++i#DgYdWu@uzD72etc2es80Qu1-%MH?ke!o3B{`eDj?gm%OXJ8`%
z9%$SE`@VQjw!62iC0bw^D0U|p?pfd{*bI3hs<m)2{<j0Ws&i$_0@(j-0NUf*iDuix
z@jslqHW6d_40!WW%eCjYl`GPr=)Ip1W8V)rk5C|c#y?;%;*_N`he5#cFRmeP_O#pq
zd2`Q0LroA$KmRqcO}df`L8)NP?U4V)2srkUa$xZJ+o-SZGm)?yO{=Skr^RI8-c6ry
z&KgBcObFI32D-}tzOj`;(o)>(*!lR)5S{OV?+TrHyG=Ql`!zlOHqdpIOu)@obj~U2
zON%B*?L*-XgT(%pjtTgoc7<{r*U3>4<<Txqe8^UqM*K<ZseQNt88JYNlm?)<CxCW>
zGoe97G5h0PMB&Xq?Hsgii`34?TMxKh|GzVF`iS9J0?g02p|=w6{w<JM5>KMi=5fQ{
z1dKP6z-RA6+?kBI3)T=4u~8;2@ojwpf_v9k-THQzV8yS8kkuo)xZj(}3^tZJ?sLP0
zIvWj+UZN!rU(Gu_tt7pAHF4Iy4cQN+khIB&eLK#^^_4?xwLvK3IRO6`gLS@|dR4A!
zkDJ!63#l!pdQ~#7MCKP5{9miolBr&iGXJMgx%W$}tygLlK|h7tF16Z^ySIc=S~s7R
zwKYI_&=2GIUMOF7Ce8Zj78uGqp%^9G;+FliVA)IZ+Wal^NriteDb_T{7~TYVFI^AE
zoI?4%Igu$mbKkUlTBn#ALBZ~qNO{xl&^7YM1*_tr9Iq{Iu~Lyv`;L@=LJ6tr-=po7
zT`xm9bE~=2PL`31qdrN5fgcTpQr1C7dLDtizg8a;N%WYIrMczseA9EoqRCbXuTuX$
zTG3!>N!A`ppH?UjtWnb}7d`$B)0iF!Ufx?FiqsfBC|r4M@4b);_sk|efjpsDi0!px
zs4F~|w)*WsTG)qkw<OaleWy~q_hTsid9>`OC<a}@M<QH{P~!R$81Zndggpm+mQM2B
zbD^kng@mXkd{;cQ`k!#K@py|tTlFu6p$-2Yghr3raNG_Du4rZw8ru?~k8u-KnCyp#
zL)x0CepHFcH)s$2Zen*8zLUvN-d9qs<&p9r%4^D%e_zXE<j=y*=LxsN-V0}k7C<;d
zp@)7hCtuT_L-aiqJ%$@?;73DD*RoKXP!$)aLH5kFKI1BajH>sfTY)a&<9di^hGYEy
z^F6-e_bK1ty}#+Zn)kBR_<o|~ZnNsBgaz{C>{tUO?Kk$ef8{d{r%wm=gM5SE;o$G|
zDWq}W;X<XWUGD6>zQITMd-}73pmcULgnM*|`Ac)9nnt#;J=8-})I-l{&l>oOIiGTf
zc?-M0SVtz*U>f|y`Wk+>V1!X&Oq#-(c+ix0CLH>?;bU^h@%Xym50?j+_K{-ui!jRg
zyVW1_Ugc{O5L(#*Bc4j@(_Ywo8w_fj2LGSap_xI<tI1IE(s>6-NZHeeL;lv{1Ed5B
z1q)7s0rOJ6hIxmdl3@lDWNN}tF-0y$+Gp{K_8!+pNmQP;W)ao{78+hx`+iudB<Ufe
zLhgU^VAS4-KKCtrCI(WbL?1%ZAyCZop?Y)rL6T4&TDD8}CLVNs*}4iy6PqJ!ED@uF
zq2A%v!PtBKnJ>pGxeLxTC8n@@r+-=m74vEi>QCthV|%UXVPh){QHA*2K1N#MCG_ba
z7}{LjcMS0PBhV09vbf~n`!wa+D%OlV=$%S83_wX|K(7z2_%}_lk7+A~!E)1w%`-Bp
zGjVMC6ne(@7KfE6B;0G%HU)zoJiN!fi$E66^QhLM0}c`*6Yy8^0yuD;rpz87D@TRT
zskleUh7l&C3M28%niUtpAUq6v#{^_u(rVv$WOk8#+Kac<K<V<U54o08XI4P&@(cQm
zxuBwt&VkJ4ygt`PtxJQl=|2i9HekM6*5@N3<Mng;-h)%6V&Uaz08O;oO#^&RdmNO#
zcP;c77_H}}uFX-3HeJ-)$KJjwxgTB*!>48U-Uq30S)o$&&vOr2U!oRn{<J^CfV)%r
z+~;!dAjo>-Hq#*>tUdefAyBb*#6j<0HhTipY|ra+ZRWHHr8;m)uMzj_DC|0E2=1BN
zaF^!LdbIZzrv9#IrpJfO2`}Dq3e*~55~?Mci16;J&N*gVuQWkw{08K2vMk?+3|+Mr
z`kX(KD*x<0ZGwjJdMIA?XY0P^MAq)fmFj9mqqQM-ne8L_nPe;vPbOt9?jrsJGMcsY
zHd`J7qw(}E{=^L34q4!%KP)CE^ML7YC9my0P%0XB(4oPnt@fV9K`MeiC|-A^)!q}i
zCejY5Wm``*|GL3s1}NFcz8B2Ou&$R?10j9+VA)<f)z;^^#f|SkxvSo4GshaQkwHmW
zyNY`Ivd!{Z@eZP6`;?NB?X;xnUvy-k3l10qC~JF*WH;~ZZ8O_xNy|&L!q<7w^+UaL
zmC|kRoBas)Hq!h`$;Usm2Fje5YF7$sK3pc`GVdYh$u`3HImv79>T_Rlk7{2F<hp*@
zXB^8vFPAw+N_)mzz7HAa`+^qxHkeIeFu@4k0u>ugU-Hu|hK*9E46-SlS7DBIgT<Jq
zP&%A*rD#WpX`0ukFOQU77-j1Qh4&k(+V3K@EZi7w2^L5>-M8VKc&+Pu1Pf9YbVFt5
zZDzaWv6BDkIOr27V~u0E_6{lPvXU=_tuJAyD|VkE|46np#gf&fGAB{*J<L89%)A<}
z4>Q8|GBNDC4~Fas`Po~LX#1Z?xhG6JwVsQ6OTs+aUszcQxjAMP&1cBxiUTD4`ttUB
z5u$16eSd2mm3!)GRhN}d+~NzRO9v=ojrJS@@Ks(eJ$!(i#MaUp-^+dOGvw`oa-M1r
z@Zu@+Y=lAe4_IIQ)^jouI3Wlnpy7X*32t5pI!y+ry8%2A{{`3QFGBvQOQGEskEQ}0
z;yU+0OY#JWUNDZR!~Y2$BO7dX7mp5Zg~gF49duiv(z#lz5rF<9QHG4>;Q1{yu6qxX
z+LNg=>|#y_+`+kb6NP#2vJGe6359R|5bS54MOefYoNs>yTpzs;dw=~tEqMP9W)zJE
zXZ}P=7u?T0W1oecWUG?5;Zp95xtNndXK=dz$Kap41X^BnL&QZxN#d1n6YhJT+Fh^e
zD+hlH!@igVomr=Yn*BRaI(`oJs5!9Gu?cb792j!NOVAdqAcO=V%C(sfnKco1)Sg44
zGye!}I3_knGg@;u@>S0Bl&n2J=84IFWqu_cxA$HW<=(}YB%Kb$9Zy4~b0YP!3}nUi
z9O^%X^@YEn#cQ8oO3_5nf`cH2HiK{PJ>XgNGD*F3C3x-0++Zq1K`XSqbrO)1F9&Dz
zuL&nfTqPbt{mb~8q|?Mu(yIOUG9&(6&{;M_lC7XOJr8Qzqa>oZj(0nqpldNCmTu$S
z`>sXf)J~E#;yvC?3vq?n2-Uan80YEWn8Os$m>EWZW&>yO#DV?np7jHuSuG?h`FYrv
zlmnU(3Hf9L+ELGeHm#7*T@Ucq+>wNKZ6sV@$Tp_^9CA0^MUr#Q;vKvkNc)%6-th)o
zSNbT;f8##8<IItMh^Ye4_8E{r|F^JmU?e2w{sC-x_#FRc@V&nXwqO2pD4F#jjT$+g
zyJ;mPIXCeAjrYTj0WXr1f*(VNGKPbpsF9xSdP~A-$kvCEc+cI?rQ~x(X(rLyTD~~y
zTxD46j~R>oGkA?Guse1^q-Q<<GUg(hzwkjGQ+^qE)Oc=>=u}nzdVN*IskCIz<6KQS
z8+<&8JDnP+b6$W|6Ms#Hw(J0JN(|>gCy5URc!O~o?2cb4BtnwfxQF{A9iS<ZB#!%d
z=Y~^3PxC`^%4~4kokS!tj)Yde+>uWzx2)v;%)x|El}9*ipiln=wAns{0h6|Z&*lV1
zIRqPhFg_!b&Y$s19y|JWd}I)fp$^KIZD;GpR6t4F3{dDWqT8L^5zxUK^B8PZ|3a&G
z)H5R^0s_cvBbg2z%PxVsiJw5pN0$=&xaYXvrV+(PAX?wfmpBmTZmQ#flsI69jW`V#
zZ=HS??Eb+jDE;_0!cV>f7}2<m5yD!R@(qJdCbh1WJfIYy9D&<FSGl9>KhXB+9VB`3
zejdQ{7S{!d<zC)CeG<f6)<`3Kn|YVRAyaP0Ywdj7TY2`f3m(<m)X6-EXHP^#r!9dz
z8k|Y~`IT%Zb8-YEOgoLl7|-CHw*$=oJFK4f2@FZPoW@Qb$9UR};NJNga3sA8#%2w8
z`_&M6#_x&Nynzz;L&m1OBPvGGpLC)ab13cDvyKFJEC;ZwVB7yPkWFjB9?+n5;Tu4d
z7T`uR?b<RO{GdU5YZGxTU(A&V!nMu~;A?*Okaz9!#zV}=xxll|;+hdlsN=t2pAiqr
z#9>U~e+Cv*36IR@>hNpKFPwG-G4#_p3HX2}o&ym@Qo`kqac6-#pbEICG>~@<*o`vL
z&LYxo<3{qioCQ&Wh<F8*(W4>Z_k&61HJ@-sZJayKHGDD8ifc(n-fhH|bTcrNRJ$Ax
zL(ZyS$wvk~5u|wzGH4s}jFv5=Y4uK66-}VC+Yh_8?B#Y`q`v(fq~&EPu^O?hd!c*F
z7eG{n7~NY)!#cBAhTpw}xR<SDDsFaT*Ba<tyj8Y$E?-K6Tjvv7qynAB^Wgn_Ex7Xy
z(y`-ZZisvj_HOE4`yK?><H6%z4cgX)oJQHeH}_-i+Y-`RfarVI5zqV$V2iX--`+LQ
zy}KS_KIFV{&x^o1cjDN(dF$>kAh@#?*rp)q+_@7})<l5%Nc)FhK=}$k)YSp+UbKfW
zy^T_vpLDNY1`(_a$VyJP?eK672SL?6eAUO@uw@H?^HUq&)9nI9(Qy(euyr!O1m(+v
zynS~QGEE>tQ1o_6iH*l!IxfJY1`(!l5}#BE>nfum-$(-8UjYmPh^D2J<V&;UJ%TNX
zq}$aA4kxFrTe`vfj1H55lDg#$pf`H4k3PNS{k;H7ka=uwhmNINxy?a{tG$`;o4G~K
zh0ohSJey~6;#48HZwqPJAZsWx=9@!2_0zc;fsC>HT^?NXjBNMJp3gn|U*wL6NYL6J
zhvtc|%YJvlAGoJ}9#QN%Z;$>p=*xG@L9Yjm1RZ|`y=@_=Q33Ai_#N;O`+&ynf^O%p
zh@vrI+A`u=_HQ8}QrD2bL2Tr6V6X`Ae{wDODwYC0*Q59&Z^k{e32eq%NY3~XJP$!e
zBR(Vk$XoH5(KP6KinQd)m<*+HKCY2{AAmhFf_D1v058ZOHDVw1bK35Flh}PY4^cNm
zcY&#)u$rY*js6*7c$8@VFKGLkN9FjsZGQxxYYFH+jVg{mfEKk^Uhj>4mt@;+K>;BO
zJYA0{_5pXvG3f4kn7WsLKy3C%uG#+v%>&<otSp_|oWCG}wpBok7V7J~22wAphgBbR
zlFki30zHU(LS4;UB5s9oS8BY;`52Ihd-2eWqMr441h+r=?*HUEjyrORWB)tcrN<G!
zuZ9G3--a`PXan`)Uo*pgHLe>sjUI3hMEZUKsp;|H9QG#&2JJxNE0|;8Lw(`9|G&vn
z6_<}CwVh$9Of5K~4AttYPOCyR5A$TvG^p&hRMdminO;?^vhLrc(x^Z1`%v7ykCraG
zMgAVbFl%2;mTKjM5H^-)s)IvUoex!77=&VZ2vjxRg{pja-{*={pJ>>ucKyS=g{4v!
zzm+djX_kE&QlEQqwBfE*P`vT42ey-ZJWL8b*Y@cPNUJ}GlId1%6EORl{(hu{O0r)K
z8D31)6d{$qDLkz)sHl4yD%#fdX%jxY!T?*yE$mj<5G;6V3@?<hMUQH2s_nGI_$jIO
z?CyCN3sa_*Ew4k-{-wS5x4u`s`){<eJv1M^IBiYKbW+^B%xdq2%BuW2l&rN5Suo*`
z5sPC*&Kam$6)*qJ{Euu`26bOchVOQT_d`-yTNC8D&7!;M*0>CtHlUAp2i$BzLZbsO
zL5;Dz@3>$;O8njQoc3Q>fA-9g>_@?lP$A>qITB-@zcN&z-fXX$9xtDnvB?S$vF7A7
z*CkNWxUaV_&}$$r*n2$;5AK2ksl?j`6|O1PU*>q_ZZ9Ka*&!;Xw@jtk&99qnVX)9>
zgay++lmdw`zRRD*h&hYAJtFALyocGx+>ft9SfQ=A1HHyqT4l6A!Jgk**PGufs=twx
zHHW1u4x7_)+=n=Imibqfxqe6S3{r*bI<#Lx_b+IgLPq&l!2zUHc$d*~*Av#g&G*gy
zG?j|1rKY_~b`1_qy|73{U^9#inC{G>+&>~pS?+_)F}>Fdo)f5pqRzX%=HCBb5|LgK
zgWgN;YsA6@IQYW^$Pf`xeXQRU@}9~x@ykQyUJf&y40%5rt@UI3wj&MtY$&9yN$shI
zD~(*sZEDGilc0|wRT!&yJQTh$1`aeb4PKk0md`)spvUJfo(P5S74~_iSeSWVo+m3;
z_w6Iajh7l0irm{?+nI~Ty4b$`!G%+_D$B}^LHhKw?A<|TvZ~NMtg)<|meKd#*q+Xl
zVK_39$sy)y8TrcQ4zi*}`x@~^A$DAdV|k!Qg1`x@X2<vSroelOd@tp%B=pUzGDYNm
zj}}Rn4tTBt)zea-V0Fep-WFB<eA6h!!@LbRjS#s&ru3O73KeUj&@NE`2YNMB2TEYT
zmst>QfE3KLVs_>M&m(B>$g+>*2OG^RUd|L4_Q6KaEjh9f#(`cNX)mVs1c8L#M|f5B
zF_Po8V!SI}jDmyRVW}L~ENP1g|4fmdSt9>VA1@5NZ^?fW4|t|3jhe!M+9xs-$6N%j
zgoomXeoDi9pOhA6B(dqqbU+{R?=)P~=4VRJy~Vp%Jr@rLxiaEs=6n)3(1XM@{42d<
zGtCTTmyQMDZhOK|jR%Zrptjnr^_BN>Y~S$>o2x#*TYEX<KbJz*w7!Y;#9pnO_ft4<
zzh~qA&3r2#P7pe=P7qI&iYix}tnkrG3~WIg*qC(^h7G7cDiJ(&kq2CF5$P=r7ODB6
zW9w!Jm%ha!MUW2-r(U?jstz&*|65y&aPIzn&^OS7Kx~r+M)z*$@mR6?q9=Fj-u$%(
zctcQ#3${U5Lc4jrb+5Q58K};+ur?`p(83_QV<2M3!75qXbQ|p2Y?J-#`OXx)-k%6@
zseP}XfSa0lbD&~mn1vk2Ci6?D@S*5?V=-oE)7rQ3z?7bdld>pi*+`)$M!|ZnP=a+D
z)pxw7aPY4fh-!YGsMsBLKr+bL83zpmBH_)@jl?+M^@C4QAP{ed(y$;15i@8g4v5;J
z!iGK@jYH@33<$<VL(dp+@vhX@wJ#c`yxI5KxSU96|62s~885uw&WC+)QLG4Tp%8kp
zTKuQAXTqEV_JI@BU|^RQ4rBoJG!C-;@#g#YtO5L2XNR__edl8G?F2He91BewQlU?6
z#1%M4z9IO&VaBy73^wgZgkW@q0IPb(oSW-1`5$S(_lP0_;elTU=xQ!#sWA{XQIOS=
z22r=1DWB83h7D-kmIL;oLh}nRVaA~KzVl$ihB)XckA^=pQHyZxuYtZ~z?1J~fO6>>
zW*@`$fcV={GzxrC13^^Q3f-qME)87iHNEc?_FPAI8D!QACLY#zWYV2WPlnnRy>le0
zy0^bG004z8n4<TN%TNvcgU3Sfy&|*SqSDE#lKjKVpma`D*tqmk!Iosy^znVCg!=D*
z(YL${#nrQWC4bz%+wU-7&A2D5F$}E_1$K>kAL=jJ1}98WnG=J|#hf>16df6^(pv2`
zfoI6j4huq=-K&NT<+>;kVg5DY5R!{U!`K{B+VrXUN0=Hnh8vK#`gHRz%j=|KZnjjN
zN~iSkOn|XnSJ29!rJ9QcWcGs=Z+U}^>YRP>GZ8|`U;BIW4-5K8X^xh8D$GoTNdM_&
zp5qXP$yyMqXwsX1q}uR7cHl?m9}PY3ilnxK!-x+otzx$6ZGsY(gnz1E3%RaYo)60k
z&0HEGsnn{1QtFus<refYISeY0ximhi>g|g)7DGC!$++<OnQB2O+y6y|8I8STV?kH>
zU9TynEun(eV#8R$99=ils>Y53uZLpSLde@YH~il6ivqT(Z3?;3neU2{o$QO0*uutm
zi0c<n9_;SDw{?$^%nfNDTg5;YncvCWk|B$PgyuTS@?6MmeH)5)gnY?+*HzipJ&?EQ
zcB{R2?uH4qf2oz~6?#2|uw5;j8ItUJyjDPXNo3w>c?wzUtFrN0Qq}D3xu^MD3+m$c
zkzxMbq1!@8ov&f7P}qE}b-j6??7y2K;5|VmA@7W~StP$<PM<bG!t0}G)2Kdu%y_*(
z-lNAg(t6j7ZC8@9Jd7D{>xGMk`MV%<$xY^8mgiR9r<Wk)66Uq?T#w71Tw@h$Oz0-G
z_p<pA3E%b1sR`lGk~MdeD(#^4LaREq&|<xBI^EJ~cIg$A_pz160{Vu$pTw8a;+?NU
zI8E@}4*9!7kY4W|9@)?cS&bvDzfMSoP2fbK>OD`OfukBo)KKDRUd-F({~Mf_eMI70
zUd8q*4vLdF>Q{4D)(?O`e=<az{b$e;O7Otn12L|8ST-9s%B6in({pwdKz!2M;EftU
zDAPG_+79ac^8jMbCww$A*SH~QfNUoA&JBEZ#yL>&#nTWhnFu5~gP_HfcddR3>Q8<Q
z@y)q}#S8{#QZmq8b=<B003pylkf47;e1r4w7_gIw{hN7b_W9s+7XfiS06e9LD8ZfF
z>01pel79$=d;U(;sPniMQvlSn9qi2?z}mt;L&l;>ke2rX1QOCf4|EX6zFmB6;Yeh1
zHxX$6IadY`0_OISz^09S=g9Gp9lVZ2*Wb#uA-TkG@8J<mOJHrm59!FJd$}ucHiz^f
z5a_I<5u3hb>rT3X4Bhe}_e2#D7?=Uh=AGQV^*QKdPmsZtUvggrN{99+ur)Nnu8+>3
zrI%d7y0jl*-*bU^_Yvo|t$a=GnPMo(@TTe9!>fR$q!UL&9rpzOgT~_*Nov9>?$1pi
zphR(7$4+o<xEO*>UPv7MA!q{!qIudzZ2Q`H!{(D9Mez_?v54~sl&I{nL=Uv{_75jR
zvPhLMb_US21Yo!km0dd_Xp97X``HjNY6?JXF44U$oa|i<o663D(vSZJeB@+cF$KiY
zy^^z-X^^z=5ojx#g>qsFDjS)cx>tZ}&9$I8GDvFv?K~Jaf^hc^P8-`{L(wE!vFCZl
zqDK%Goy)<yAGG=JLhL!Wf_LqD#LJR7pdr_>w-NTw9}CHoOVJAb3^CG@P(8uf-nSjr
z<PBG<KfcQFmfsE(-;;FL5qrx%zPj*KDE{bPVjukj(4rH$!di&EbsJxiaT+aKbRRQ{
zE&wAs1MET=*t!7L*IW!WjjO?<pmduYOKkf)c;~`vVE5!10v;q$I~H<RawdK!0U{fA
zLznwBFdCyt?67x{ui_zKba98P9abinlFH??xK><D3?2s&T99`}{SmY$J|xjUUc=QW
zl@LJdZdVt+LKWq^uH<pG{{*+kj-R2Cc<m}!Uwsl(20kRrJCX-&PH;vs@M_P(Hv6wh
z&d%LDDmxm2olzuK_3@7N7sB>YbD-$ei;45h2O$s@&uwY|Iy#$RZ(=Da*s__cS#c<9
z#}a2(JNJBY32eJ+36yU74N($q<AH=&aM(1W&)?2Bj;|r*`fM~-S970B1t&%ABJeN-
zmfT5F$JF!ASUVbP9VA8#^5!KYAfjD`q_Y-4Yrp|i36NA(<GWtXrwJ3LFeCAD(2Xdf
zG7nKaZ?H83P1n)v#c3q9{2AUIF_I`u<+j~>pljwyU_0}-c=nwRwxlA63`~cP6~9Bx
zK2C}17;o4oJqF(OF9DBv7j|ZS1ScS!Fc1o5?YOyx0Ta9A(m0Sd2e1`R(EK(|hz&UN
zaHDA(MB*03-3gkj3sjYX-`52Gx=yKT^$iR`uH){cTI5`0@@`<ZW*QN*8k&tDXy-N%
z!?}VpJXM*!iw8ZM<n`VJw05U07mI~MLX(ovZu+oB5BY%8n01^P4#M+R0pA(~+Z;x<
zxOJQdTtsztl7MR`Zg>i+-%U8(M--uY;o+~v2;&oO9d{!)oO^+)c2FF<!DHKR-aDoX
z^rRPn`CZ_MT2GAR&*VE8tJjcV`fI=q1!&9~;!OKOUhi4Hi9q%uys^ri&drKHMQRqT
zHD(#712++$KZ>R&tt9QqvXBJnNLUO!VKWC@v_Mxwa9{&KDiF=H4j5@993`qi<Wg{+
z*3Fu_c7x%l1B%i(k7?!J0qc8)65<wt7BAjK;T~-rs4MFsF3up1qWAIE`$1ItRXbmR
z?r|Q7-RPq{@e3fd16X?l(FZ;c*^_(_$kcdL{4`+Bowz{_9_9EH9GQ)vpVLKo{0G1T
z-GnLosV!$V7=?HyRP3NMeksl$b~C1pMmS7EmfngIw%Uxn5*3bhux<0eoC%z8G+weK
zg>$L{ZE6Rb2NzQp!?BIVHDl+Iv5eS_c5|-Nwh+zM4n$EA2Wtgm<YMT;#TP7km+Q_3
z;Zs4?tPdgc$^ZoSHd6OTPvSZxIDf0Dnk*yn4F9&3;LMzkzd6Jh6R?|Ug?)vyi9h~D
z?2rxg_NBZ#=^Z&o?oqSwx&@$kB8VQf0D@(vR@iDh12ky~FyTHk@Fj?~nbM#W7lJ<<
z?-}bNHeoy*^fAO}1_W}vBv$#D`*E0ot%cTIPsu&Bf6xnrMXumVgq?fp?gDMWm!KDR
z@Yof92cOo>weJ03cRdBs$$sYd&mrB@e-AWTl+1nyv|VO~y_T0B<enw36I)aibiDBx
zbie(9SdY|r_mAMKn+ZysLb_TXhSttHa~xw=k>H+}xG2fvcYg^npWh*x72E1x0dJlO
zJQ%=<d>ZJuW_i8Zyq+6z&w(0nf|q<iAYrO#=E2t<;2ksm1-6(daDDz5xL3~>mAZJ#
zCqJOj@+mTEh3n)6i0tZw*0?&Q>4V?k`sxNFxSKXD{4MOcqKmcBSEz5@qo77bard_8
zS^J`wdU%0Wtbs4m52}HCo9zdG0LR-NAgt?LLJ|vbpE2TDJQPSp3^=!)%Hk(J4qCtf
zXVFz;V8*l1KQ&JO&yuOqWo#Tts<netO%C<GP0BjHu-bZ6nG%E-&TS2;*6Kk<CySYr
z3in4eZ}p1@eqUPP3+7&JwVP^Ou|Hp`apl~!Vu#e~Jbpf@Z43|CF{`4K`QL)k-lYfK
zdn7_4Wq~`bcJm(P^An`%*kd6NQ^QZ<EwteCo2+Mrd7E@~!*I_9eeNSjcsSJP=URVR
zUMM`0j7D{Sn0tWPe2aPiy#1vxy8D3q6Jq>YUxLzhv-m*|gfi78)#se<kkMBdzD$Ur
zn2)rosaS`k=|MpYzWfi=_(GM~dm)kXuJ@o~OIWUStG#IFU8KCO>7e#uI~SmY_UVCR
ziExw#=X9NAwVU%)_G+3;dz<t5V5{8<5^22?YPwo_?`_do?o-P2>&!na6~Ah0l^L`p
zif#b(1oVvJZ$hod%Dpo=EM;oPKB(Dl!30ynf>_!DP}Fvs`BxZBP=NwK@uya>m6et^
zy&)3e91ht%25z&xqVaMlSrg`IBG<D83)H^`#qKRudv9=3#U2-wt+7%vTYD&T<#@R^
zdQ%pg*H?9Y4mImSe#>Edpxp&|3v>I7OX22hDBj88Tprn{j|DHDMTYzK_x3UDJ~crv
zE!%E+p;$phc^{omt6h70FR$&1>?EW742FCdDh_O}(_%i5RBR1{ZY;R8oc{t!ckJzb
z|4=0AmX%P|@nE06<ZW{xoWr5y-IB2OUf5}<(G1z^|7G6F;t!*nK7-QkHNE$@-l;O6
zL4KX(8TLH`|2jg=_pxXwSX%^eKrV!=+3`>?CArV!i4C6dPJwWpg9Af#&Cf~C_XR@~
z7V87OCvq32_Jmo7zArG!f<I>*bQqWx??^Z>2ZLbnW=MNqPlnQIgCX(Z*uM8cT(^iP
zg@rlyTIEF)oarUd*Ly&Cewe9pmEO-pF^dNVTH(UIhC1=DfG1m4`CcQF2(i!O2Ya|A
z{4)-6rp7_I_krl!pht#6ZNq`%YF6GB{SUX`hrCb<TVnc-4c<$5NSJ8}`aU-kG0wcU
z-sJzG=ZkSP53d6}OYTbzORC@7C;6^i>78%<mwtaT6nu~Y2f~AeYqB9__5o=Ou;00j
zsRwvHQRyWl(jN5jWSMPxLYUF4Ve4?RId^hS4_LP%8qma|!|sD~DLiG&XVRYemmVH+
zKIuVgPk3O7yfuBjLMSBS7)qDODPf)*(xWB%fW9blj^x-*>zj8)?u$O*;#T^BDUp50
zd$Q%7vfKuT(%cJIrXS!DL*=@ac=qIjU3^6<fhm2SYxRA$v+w&)G4CVRa8D`->zzd3
z&2d-y+&gR60Uk>s!nW#r(?z;xYdx9cUeHkqdHZVm@(}!4_UiqR_2hW?p1u*0ulQY&
zrN9bhX(pu))2n@ZpiGX_ci^d+H)9I@n)`mm?*|?N2ObRHu+PH9&s-#GA0{YW|N3lD
zau9>-^LtNUzM}nr1$yZI9O8W*KCrA^XfxR?w@Q=2edYTfvi&Ri^1t5if4x(9`+?UV
z$|a2Vb+bF<?_s%6;H$<aY%LwskAvu&tgl1Rp`Lf(_pIlpBQq^nlySgXQe<TqDS%A=
zIs@BRtnaVu5C58X2oWAqCA`!cqh5hR2nd<$MV=M<_0J6beNbP%YEA#|vCew6$jn>Q
z=XuD$`6M*jCRvAv$-oDEQ3`o8M)iGu_(3<}|J$sCM?<}vtctxuhBka`Hiu1UH8UW)
z!3vbH;DYo8gF$*+^!SV(&%y6qNGI`KC<*??{KHbsg?cw0F=v?pP`29+-Z)=(XnfO6
z^;O>u(_$)COo8h4?^~al<0_<@67GW`k6X#94prOl>-zY$eK?HwJ@7kULs`p<plsEI
zgW3nZHWbo#hWX_mE*;IdAL;!p#yoiLjWC9Xd8n8S5uv^%P_b`{)kff`ZCZytuT~*t
z6s`m`n77T!@nZ%#i9jw=+dU5s==Y(YcO>iLAnM)gBN28hY_>dr7KKvl5+Xc+iszXw
zk|D^fyzw)r_OJQsetu6!Mj7uULDlYip(L<_mgsw-Z1w%3<QL?;J`9RBOobBWCxvZq
zLGimXnv&-1_zmPC&R2})$)c^VK;D}3;CNH|^1-yc>93@ScR>N-j#XB&t@4$p&@#{6
zP-Jjg-0~6>zxVszFCEpQ{e~2FZ=nSgK9vnc?Q@~XyBi8-4ujJWHpuxP9|q07j8xzv
zAF}ZuQ2O?mzTXAtpMD;b_q1FQ>+gh;y6(Qu5jeHpM2ojPDVuv#_wN8zEV&*E{2xKF
z-bD+S{{?ay#-c`=Ov~G*k}{(SiUXUWWZ(4O$j;+TrMqr};^vi5r0G!7HV^VV*Gu84
ztocJytTo_X?0~XeUqI&UyuM%Tcjj$UiSbLQ(dwblt3#>255@-8%Jv%9bg1#}CdDon
zDKWYrZ`Y?Hb0Hb(ZiAAb3yOmtGB)5bp_K0qo!E<5jkFUr_7XyA65}ieX!6BikBtHv
zI{=i#lhJY<L@nqf&~r}_mvbjSnJC%A2@eJlP#+1(#=faMj|WB51g555#)+;G6)GS=
zgl{*YTGV-5_x_j=7UVR31dsuh$GvZo2nQc6A_K4AiQ_nq5G8{oOj-&nHx|;A@qZu*
zqh5xftD8g@{f?+-Ki~76e(kHcU+7;yQ7Kn(1MVTpfSZ5~pitSd7lv%AhP=8FD0Ovm
zkDkbBo;aNLz{*)EeS>RGRJy@N{4uuz)ysf02e;+?7}Q`TM2w^$tRtKuPOV0OBRv++
zqvO1eEb=bjPn4K8po9>u%L{xxO1rl+aH=}jIu#I^r6RHvu+<*`^L&%}KZ5n)erW}C
z2JZr!!$6&6wbDB0-?F`Z`5WNc^aar9XrADC2JEw+0%tYjZ6Ev%2W|%tUju1b`CI5*
z-U#1QzfcdJMryqukdp4XW^-5|P6hKpwL6q*)r{0ET|Cyx*AbE!ZO4&G_8y2MPy!#^
zF-86!DmW|hU<eO^yjhmjpWBbU<Q<|z;ELs2z9dB+)2m>D6)G*F)GCFVIV+UI!`3g7
z(J`mlqVUHJq+rDign+uBXx>ebc}oUl%uJ&BYkr4PR~r=h*U<7ee{Xt<oQUsmAXx_5
zyxEr=Pzczp$W!Ut0j2KethQdr@%WJmp%lEIEcaYbiU`XSr>yyHG<t97y__qD9`}A*
zQ@vg>!?_<yKevMPEH9e;wK>x3sK-Oa;w4pE--IeYH|##&fwl2nqTIQoVer(0bD3m4
zc{=2N5=!W9E{^os$xyQMq+UiPeopxs<K8i#!e!^dxVn&=l==Lef5y?AH-2h*1N1S-
zh2iuEc{B7Q9k5YK+OCDX{lDn#qcE7gA4yBvUxw7Ta{7MfglBl>7-#eA$*}EV36!j=
zD<utkY2LhN&89Frz==f%80M@#rv58eEm{&{M!oHMPfdUUkCwvmA@vZy_Z}J<BJ%M7
zgJUvJhx~Vnq1VWKoYqnJeh;e#Bz{f_^ZYT}!i@R5zF`rF@9A*p5FP}f!S8YZvRQ3r
z;vng|)#G+%UNhvSff7GIKK`6xeV*30R8?tnG)#DI0`$R@L1dh}5Qa6L+o$c=Qg{_1
z%VjRi_qcal4_M?UawU=}W+|^R_r~<qywDh!vLV`X)BF}|Fn%pj7|au(bXvH(quF06
z-SWP!hqYUhA+0eA`XqlkhBT=0a;RK!q4|e3ej;?eWX(ge3}0Ug>rZ$Rx?@V=F&>Rj
z*pr~jT)!fTm`I;d*5gEAUSHNR9ftFekNmfx$^8F9VgXp`H#1&HA}5Q<*cVF8YBHqU
zg_o1DR<xbjZmOHZ{5xnt%WGEKaW-Q0!WJ~I@fI{<`ocalJqjx77Lfwa=V5Kfei0Qd
z{{zih`h4#*v7hB1CXkZVJ0R8FXOYu_O;c#usuR5yAdw6(Jx~<pV{9GZ4aJZx-symY
z^TeQD#xqK5f-=u_=3kbVMDDwTWPT6H*k!u~f$i#m(&c}*+Kv?y@7*T_t_@JZcJ@Ax
z3!m!&q)MdIZML-DZ#id3_N?JBbni`2qH8q2?NuoH+;k!s{MfmWJ?}mN57OMZcS6A%
zXUTfHBkLX^CBA*6yn6?fth-faRs0Uocg$Tz7&V4!kn`ABaE|!_Z^8b%8m@xMw<qFf
zUZrU66+nlc&pT-Z<nH?&<V-7vyctn6Z}V;7rLkOzETwr%{{VwujXS<ZEbMpT`%$Et
zbudTjKRCouQt9b}j8Csd>wPt;F+7}SR&mun-Yhk>R-~)!KLg)E6bc&2FJ#e`6JeBa
zvw9Pyyw4)RWgi0e${dK@ks+^{0<vrwGm6GCQaB7sx)Nn@QUCR&znG3-9Gs@XRb+r|
z6-)`AU&2Wwn@gPw{$Z{m!2roI9N)tx15%qRXvxM0xtk{tj}6!Kry|d_PK!Rd3DmsD
zxJaWGsC))t!^<J($rxI}UjQS+271leFx34F<ZTzQ#$mkEHy(Ee#r#xKitCa_6_KDT
zOXBfkA(jkT^8qAfHGrqR8|*1_VFb*Bz8MpbJ5l?Fi*OB3L6fSF+3aV6t;CFmj+}TC
zi72}sf<X^ct9}B}XZ{pyiUYaEk3iuG+=xi0YSOI`xhWdHr(;Z2>lTqxpAYigU8LNP
z5=+C|qM1~6ZiUid2PyWuNwwPxrE{-_w9afg!qWmJJ{PIbI><<)1rkG2`*Eb&sWw`;
z<7c=LW<iN3Nb~*wf`KR%mVA<^<n6u`io5HeSX-tP{P)Z-f7)Y1gF16Xc0x4laZ(xx
z${LD8-l~T2fsctu<e%TrCTbI+8oC-vd9>KDq&&dU2<Vqapq%%I!3jksq(ExB-z3%k
zt)##ogsR{g$eULJB_EeSHD7`2r4yyHeP~?%v@axdf>5D;KFL|QiIf{b7_xB-<S&>l
zv<NbM-*i$O+y<pu09E}Rw50AnNL-Uiid<WuRQEuMcOR6rz8{{wv4082cJTZJsCcK0
z<au{MF`ExVUZ|F^NY-mv%8-Q@OSjYP{kOv4Kjgr-Msf}GrZ*6UAqqb-A(Rv=gJt$p
zX);ZQtStaNbysOw(>hYEhy2x#kM{fjFA01b7f;cbS+W3X?x$uRi%>p=f|l!{#tM1}
zMOz7~^=+aV`@@Y`$6Na_A(XN`_mj%b-qe^@4iZwjX%Wd@_SSLep9$v(&zQm;Zy{60
zgJa%6#O0mR09-I*7!h75nQx7NLaVq&?tQ6H*!?0hjBPOZzd2SRi4%xSXpNN2`y7e_
zn@9<FL-x#1Wa9k+)3cy><_9Q6`bcqL5iLi_cEaovEwZi`LMi1z7~5l5Hph9Gdw?u7
zol$T3dRuFztht?*dn^d$SZUK?xk0jK&Y)FwFNOC3G9FDLW!<<B-zht`{rEZx_pstb
znaFQ|l-UCy+-4?hV8zXUHgm0nd1K|QI~(`I_aXDgm6E1qK-r=vAnu+}VkmPm2Hjc)
z6*EE!s(L3W@zsl==9SvsYrl;^4pCVJ8D-wbvGVjcUH62M$_$A%D_}c%4T>Q;Mxng<
zUp`LCmxU#pLOQ8sAe1g_lUQ<(5e=#E?cbB4o#EG>U{Z?J&+_&Ef%3*sRr;R!Cqvsi
zXlc{mtcy=j=uj9d`6ZBya}fGl5aP15==Gb;O6$D_SSA12A3*lr3g}-Vefrb;FAO#l
zzlVe)Jm7_(G}-$7m{6z>;T3s8&H=Syng<W%b?G&<i#;a#7W!#kr$DbU`>WC~d{4)a
z!ql9vatY$jFe6s4dyw?W4tcEfTzmX{#j|FQgq)RTh`lToWi6nrc|V1;spVFG%#ASk
z@i9=k;CidAzxx-qaC>~c!@}l!^0+8{7P&co2l|Dd0B(6!Uk39W$lh6TP#?3N%Yx+h
zM6AGxbnwsvem`Iw&vf*R?-c9b@nAevJRY(Z{GlfkXXwDl`1mR)T6nS5X7)9`A(<9`
z{J7~2b1W#dzd>fqBxC(sVDQ5sKW@{&Ub65ZsM!Bn@AXL8FIAFSSG!rfB-Gcbkz_bW
z==HxA)N{gVV*ekJ$Y^)<<{v^uV_$VB`-yS1dg))xi$a?LC4>C8UxR`-PqNxA_3!hM
zwEXjX!md4rn>$pXwe5PulPyC}m?kik`5<f6udQ}7mqgjl7tzAMFRXvZSi-@7gPzZY
z3DffW9E=G&;voG`HP+v~bu2}_OEVkfiNe5D$#i<^Huk)ityel+evGi<BO&ZtW$;Ew
z@@DjD&fEBF$lKIcTNw1tEo3C$5_Z)w7;no(w1O9s^6<bMYmF8)Y$ip1Gk1=KA4Adn
zT4^`w$zIvtQmnPE2EIK6#?F`kWqJ^@m)s0x5126)c~4i9{HFO(#<oJ<OEof=Pv!^t
zv|!s5QlWDtZ`NeUT$BNWmgg#2+porcbDFpKkC6Lf8GKLQ3R$jI@1)AS)dlw_o6V;5
zP4m|Ln$-G2<-N>Qlv%T#q{{Dy+!gnk=|C+8UfTE%QpSBf*B)aZaWbNP50tVlDE0-Q
zIv9kk_b!JjZ8TH_d{E%?6OrG%prcM+TcfuF_KlQyG<+WeN_{88F{7|5<-@vWK>k*%
z0=Ttt^ZdE8)ZG-`C&Qo||GdRk$*HN|B4Z2-)+%fG6&VreI;g$2ehrlF`?=YETw($K
z7xgkZF@{+$j<EhR`&H=v2&#+?R_a<D|K~<RLF4PVR$HaJUd}(`;8;;DpAKb)3yQj3
zq}=a;@y0Wd`FI8yV|bz5z%`0%x0ZK7=6@o{sIE;=&io+qi<IdauH!$!v7%c3Ul4~%
zfxC+oGY(_;E>Q|kMmCpe1}Svw@*qilFAXYMSD+n7Cq<qvQm*0nzI6)}Z2J?fMy$Tn
z=Y=var$e`Gg74|uAyTpL11N3Zi;U1qN;|rs$oI1RV1(8IC3=A5<AM^_=EBd0Liv*4
zh~G(3z$+F29nJmn9w%`PN^l_*y4_HX7VB#MH#pW*u;L_I;C&5>bRU%MJ_j;x&xFBi
z6QH``VkppDP|6?c!8C`g8%>H@KS9Z&39_EO3<`NV97{@jt{iHb7DBPsLQ0JeQq{E`
zQXfnsrS-F*)V)!7L6F>in;~cY#Y)Z>7r{{XGEyAGG3;IpHTskAt&^y_e*g7Q*8Vz5
zk8UX5_$x?$dmzN1VYYJHEs*bRffCP0kpJ8jec`hsrK8l?Dms3R+Epv$w|C*#Hj&}p
z&4MW+W8zSx1)#til(kt$yqbmv_`Rg0D}Y8=H>vh{AoH&y;8@X+)e|9S`Q1_i&s_IQ
z$X+&FYFYU^u7F~FH!@E&WWRi~$lI+9T6Y;Ou74a47Ov!X{1^tjTmr|26p3Gp5_1(^
z4%ymi;SLHUSI2ehnr~hzs!0h=(tkRwLFO%t^P%WVgn6V3WcduM2I%)`V!stq@)un}
zi<@5%zNs{4%k7YH*ChEt{?rl3ke|l(MyT!>BE2PIc_I|^A$aOG(>&ub+#u;@4&dD-
zG<WS(Qsi|(URz0Tiq~UCmNdKUS~9%3zPH&_5lN*ueBQd&YO@T7fxnW9?qy;3ICd~a
z+Kbsxx$g}q4DKPtMmx!0^`<C1fU4*tP_%6^ZfJv)Z~GK7X5t2a^c+&uv;d_q9SS>l
zK+Vb*p?~Pe-!FZ6BpIQ%kYe2nIH#nRcR;~Ql`yC&mz1*oQ0(r2V!sPUxSM*?h#obC
z<Lrk?dD})o&Hmd-2@68O(nle8)|v7?LwGha%6U-kUn>u7S%?D{PifcRV5rd*c86o3
zMVOjF;iuW8B*5V`-WNhCS@}6sc7M>f%~b+pG=G?9(y`NS#JmlydmB>j38l|4$35ry
zzd`xxzxL@@`A6ln#P>`ecrWd~C|c9}2&6nV0KTVhjZEfNz>}$vRz}}B#B8=UWzG}7
zf#LfX9rUg8&W|ByMkt?(l_cox^GHb_Rq9x))=Ceo)B7y5FDcWa&8j0kMJsxx#H^6_
z!8b|Fe?-*#-j%LTpuBCa^$fGUYDfOT5DI{VP)b)>)$4CKN~!iJm|?gLq_p)mD0jK6
z_8wS_mbLGO0{_!y`{ZMQ(}w2fn?!nsK~^L8`=o$jlG)eNZI9wR%<S_Olx~$8ei<Bl
zGT&ju&9QyoVTzgT%v__Pwb*N8>R(vuP`Qgp-y#bk8^`Rh{3Sh(3*pB2UYpIgkrU~A
z`YOW79DIL?mER)d2@#%*Cd?xxe3CcV4`Psgzjqwy07f-rY7G?C7g(S5Cg95ZxY}|Z
z>kSLfoE!mz|C?|?d8z&)0@)u8f!ryn5bj|jHf_<}1#n;mo$6;s38|)^`f;=jyvO?h
z%9;;mbXiL;lX>Kinhw>!gS>LS<~@3@G2Kc{#uU0<?Y*YwQ2dJOLj6Kv_nXo;PfXtJ
zR@pn~O-YdWaV*+BV&NDIJ8F?@JZgohVNK?mD_oEsmS4#1=a8q0Vc_S*VSGTsD@xAu
zXN%Mj$6%j)PyI&+xUr@Gb1dX;Ja_{az5PcRG$*uy&1+NE=h4!+zkuUT*5(cMqq6-=
zQqsAi_cM@@n;@!(3|eDZ%S{b~RIvA8q_N$)QGa`;gd3$@Q+Fj@wEbeUW1F3hZKGow
z9dv9PCpocg+qOHlZQD-H&Aor&)=Q01^|JP;8nt%KH9?ysO5nWv_+!8j_KU&G^?_-y
zR+N|V;u&sNSzE9ejO*le`vw*MFI!+SpzUACJ3I0Dpi#0|`n5oC<Z9D<Z+C(bAs&Y7
z=g7x6-JV{z4b(!TY|AgWbGIHvcO`q`gZF6;kR{VSLD-)iGIY&_ZNzI8hxK*ELoJLg
zsx3LyZ6zl&9qs4DA6#(jpk)jyG_u)BcE(t3g{;?AjI{{nciuevWt*jxpWEjxjH2Fb
zGhR9S1Ut+(1AlN<o3WYy5@SI5DDH1lH&CfJcEM3z>6yFV3x_omm-FOcPJ~5TZX^He
z7bV#tC2!{tn%eT_qH^xdOI>6p3b|b#5MUj4mNkSvxZoOon`@yte3<G{t~;SqZZJ9(
zPEox~M=sJ~c%J*ZI^Sio6UG80v~k8ouIj|Zn~eb1bp6_@IOE2egN+QhT#a@9DamZ!
z^I@FvB(~_2Ac&*1I&m>*GGm6fB119U=b1ke7p~hP<v@u`&|~1No4>wMlNPms?n4fs
zeg&^ZFSZWp6=EQDkatWvl&*mozg3Gs5rh9^J~NDHK-j9^v^lj+UMaM7n12D#%KNMT
z1qu8H_D|ame0E1*y!x1vY)MLROaed!&fd67%%m0dl4F@t%9c2M<rj`y7K7oQl!{Dd
zY>CZs7@7>vQ0)1LX@SX~93S!WA+OKzD+u~W?aK(Jk)ppgAjur2Zz&j>e{5_mbI-4Z
zl|$#+obv6!`JSwGgg`I<gwz4R_kCvMx%?xe*&G?YLNN>KF346qgIfNIGQ4mcU?xpF
zk^Uf`lbg5A6b84iMhqFvFai!r{vkQOcf6|4K`i&7LDWq9qX)WF-m26kSL7yY-18ps
z;#QF{2LCG4Pm}jf8|ago9)|eK^x%bIOT)axS;g{D3})ff5U?b-r-zFh%l3!Dq#CPx
zrxjV_AkUpS5N5xg^m#ygWY@v|=kU_1tKdml%6~XuGY=Z1YwYM`H8Hzri^t%QZ2442
zs0D_Ikz<JQSElg0=}0sR2Nd-9=q*p6KJ<--Y|kV{*gP6$nCGCHLzUGnW*^R%bGM+q
zLH^lh7@lU^pr!u*T1Q}d!Sw*EpBwys99(}kzwvv@Eti~tGkgCUBed&}3*(n;d3Q3V
zlYL$7T7;r7!ygy|DzKx|gHk!G{kWLseOuB9>({{-?-Mj#dnuOY4#zptq%u7oZyvD=
zdXU2@o@r7Z$JUAMJ&8R)GFEY+z!5*CCkq<A>ZJJ<7hV}+gi1Riohs7FBpIr(Gd^K?
z_;o!NV#zdLQW>Ehk^w|y@hZK-{+$DptVebxLc9J~F&$XK&Cy)V7sw7>mI~up>?XyI
zVra3c%s)Lbp(eUN6w51jwtdHDj4A{Yl49;UIsjhuw0iVKVl3fqxl2WHWHtD7Yq%H}
zT*+Yr6HUnt`_|kN@%?N+cSZG%G7Ot_ez_f98i**hsKIt@lO}F;(igPBgr|#$|CC+%
zec(Zir9V4{SVc`)eOk)zZK-D^ZX>T^0=EA!UA4DCt^D8evolRS`h4XFZK4bCrZ)Ru
zQKD@ojE7suSWQ|&=KYCQq2uG!mX7QfM=ELnX$~Twl6V-1Z%9FY%}f^j`8$meNvk7T
z)Chh&mX7Wrv6(+Ol7~diXZIJ?MjL!FRf5b_!M`fMkV@JqJ3+1?x&x&JAI_(Wak{g-
z2O;6$06oPK;+9`u%~9ILbxaLi;N?N?GtStWR*NPqlzo!9fJ>B)ua#(<y=&II%1gHU
z7*vQHk)-_Nsc&%<_M7$26sg%`mN9q8OXfw%oLDaM1G8;Gtm0FOu9NM6vc<P3ACh~1
zub)(f_3dpSbIa>{zYfJi0=AGBsguW(*nkp;a6ljC{qOoyxC@~Ur6JkoVdnb3U44XR
zh_&~ekWOE;1MeqmO}_&L<)<h3k+&D{lY63V79{UGnUPQPkXOl-Oe_X>u=?$nS>elV
zs-&)T352s8!O~D6&rS1@!=B);lG>)Z20>&tWxs#f-^Lmfn~seb%`je(EroWx0Lol=
zrPkS&={FQkRibhJcYZ>_dJe0hOeK~a5d|HZgtbJ74+)3*B7<t@-LtHh32`*V+Veo;
z%J8%d5vi3$YZnEFm6;*hm3w>|7eeb${MmZM@a613U$fWo_N^_Wc|QQcF*$E_)44B#
zr@1C(q!x2q&*^rS))$=c#sd7>`Y*zAp2rLu#>E`yZ$QuOra>>(gDLnVan>B}gCM+8
zy>~M^gP*Xbs{7V7dVW{J&nMFYnC-sM1rL-yIZ>b?=PF>Pf6~U}8usfoMnX9uv8J*M
z3M~|UO(AA>&cO47U$kdxD2pzF&}_0|x|S2zfsZRCZns~|qFLMZcar8UnQ+(ipC^?G
zIX3elCKmY}Kwc*CU!sW271)x_oGJ`9Jt3Ld+VpuQEM)_^1pKO-A`#^aJxHi5E0Xug
z1QUCOxids|yML#OLlCjsT$pzPWdX**K_6|6XWiS6v#?Z7!O7>-!c&rYh~bVOiJfH$
zq+Y8@H#W077L+na5Q2bg0WF`YH}66kIcVS^!(0rTi57d+&E}RycvkUD-O#6EEloj7
z4@v5p0_pU#=!qbiVg&doU{zi@kA3!I$*bxG4lrWxgFV%SaS0A>(!(P5R<utfgs+U4
z2*V%SbH^Clxua>~ASP_#g^O|N7nS&$LBgm=XH4{`nL@NLq^_S7Ec_+Pj8F&d{&pL(
z@iUW*9s<do>tE!@pr~EHwHmFfpA22l?+Kv>i{TQ1lV@jdDOx>8e)%gi<%@6lN?+3Q
z>9;W{gWiMHh*cW$zjpjP^{p7LtN%vyT**}}4g6c1`+MS}t^LHeOf>Ix*)}eRpGa`m
zx=_Z{1tEt+N8FcFMmj$!rWcXb+QEu=iGt9xr6fGKXyKqy#}{+Q7#v#=^Gsdb;?DlV
z>*wiGB-k-g?V!P!jhPso<DmOEj$;XWW+F~Y`J>HN_2e{?ZbcNHe4C`&wiHX(Jp19R
zFt~L~qEgSG?ZQbr-%rLY$}Z_+o4$<>-=e<TYO07xxw_^|j|UYc0F*r1g4L#vbiB@{
zZ}^55FxA{cEL-)@1siN<1o70Mawzy36k+W}N%683SfY|mDDV)*U7`bp>Ct>>kNg5E
zukKCbOGR=J#&Ge<ZlB>g{n*PVbjU_<Y)2?GUu_v9g#sw|x09GU4`B+SmmTx)quK&U
zB4;_qebv3rV5=QyE-b|*qCYpEFb?D<i}nFvI7rK_oU(mZdVa@}f_bMPfBan#RRM!1
z!)!}8q8J#uweEm1xdC=Yie&P(6iuYaQ$9N7zDVxh128t%_}*&dTx4oEXHJoOV8@{x
zPm2%oT6dCI-MV|rTlJn+8)7sPt@mEf@J;U)9uZ;Me^u`VMvhaHwP-xADN2C*UdP&X
z&Ve&?@Crj>9l-;}4fb*AKl@}tR$mYx7G|)wMe%C&VL5e_i6^SRp0ODCc!?Kn$<=8t
z<YB27f4Xyt_lEf8ESn@wyg9Yot<I+Yz*@etOmv$S-C%LaUj^sm`8>-jmirF5=mpSK
z;X3|}2@KR~DjYfln+!3x+hbsw=s|%7u^zQ9idFGT2Hb8)=AH-;!J3=kFpX?`kR$5*
zVaiQBu-HZ5=TG_N#6C%AzFSkgq9WSkdSsep1{z-nPx#V;BzoPQ1lXD|?8`k#;{?Vt
zNK}|iuWH8sTW&W9V&zG0f&N|Vh9ayyL2y-uFJ%o~0=7@I_1`EH@WHNX{0#=&n^dW_
z<di5h%CHuIzVf`@RLl12(tSq+m8ryxYRwOWwH6K-n$Ri6a`L&fpdjObYi>pYUi8}R
z(3sa>x|heEWSzJ5x!xUlK;>R+f^W}*aL@XPEW{fSs?G$NLG^bwDOWG-iMV;r_39MI
z?{Ut7vElkHx=BA%8UnKhOffX=q7RHU)PH_51}h5Ky$QQ}84W1p*>6q1Jz!JvY2SV9
zE7p!Va-RPkt$!I{8L@NsPc%ogT>Ex+|MJFR;lzhm*OeMeMHZJ+Apup>(JmhOMB7K#
z;Zo*TDUK>|4h+WpfJ<sOza=ajxu>K>cBNJO0LIok|5s>@^B>d)wxYGOPyh&FWc$qv
z4vm1bzm4YgfFgbQ7Lj(}cEsZkjmb0~_-oEF&7rvpE!tIdhHc0~Pjn!wgIv)ze+Wh!
zM{NG*IEj^|l3&RwWfDV%#SlU<6?%L*Op6})VMj}v-?NCUiTOAkK}TI)O@Cc(B$Ap;
zlW)?i<aK+IxLqfmifQVlI$5hB67AzPQ-nRx=+QJofV}AZ_<8FAl3CeL;Zr;TGpuG5
zil>beC^dInGLwly#9jlpTlC^_IKS8>?e&vgw{T&?w|M43|5S_b)A|${SHmmx>7mDt
ztU__yGm4w<!7WGDOS0lAeVXwoB@SG*<oyVOx)5s}ULS>*3lcE*gq8>+q68R56RG={
z`R%$1Hn8pre8YK5Txe_(+WP7VethJ598aIVgW`;<Z_n}(7)#$PO!DH3y_Gh7X`-;(
z)M+$-9#~S7oS&|JjX&So8Xn04!VD!su(F0MEiHUK*usN+U(#V2=do5hwnbnnKXmxb
zt1|SB8(a7ru}i#jh@L>?@YB|2=cd{G*<ibie<#Gra5VLa8KKE2dol^hw5xM+BWjpx
zk<xjQ=>$?8ci0=tPX$a;H6EUDX+I<GbJzSpeb0PkqkyN*jx;fvgJAS4Uo)F}8{{+#
zCH?XD?^q8esl?I&IqM}XBwq7bf9fM?K+y9e7Y~sSy3dKJ>gjGI9a~89HK^|@Uy{)W
zMPCcN=v?8-2U&S?51!}jwr6}>)P<~qLv=QNC?yXxdRGY_Er!^QIp+mmn_9+Lj_(U$
zdY@CbHsK+?ii$MATQa^@w|f~pZ2%vnk@D0`c$@x}{dFBj*>}jFAu@#5A^MH_b7=j0
zs*oBDu`x2Jb);tOi9$qa?_YaguNFGUQ|kOyjgDP6ycKE&YiF73ZYV^!3j8GJ6!oYE
z%JvY`eKOp+rL`y1e>UuRZ0ClfU8<lNU!4obDG9>KxEg?O!y6IPwV33Z=s>|7QIEP;
z!rwKU5`mEH2pf~E>;n50YR>1go5rOp)cN6Q`P!e?d`}H(5_K-Tl2qT$-@UbOcc-Pe
zMSz@|Au4rC6@i>WX))hu(gm3BlB7bv3a!^-j@V$Ca{ZMujTo$aCpC*x{Iy>WMu(g5
z&^mfTic<Y5p{P{VO}}=g9n@tiquQ>6@M69}nx9WbT+jA=m{e=-cQbyvn-7JhC)(hK
z3qOY*3yyaIow9iisM5^y7>+b1klvq)wf%ShP2m=Q7o-T5_)h}*3mkV#_QVc7z5o_3
zS+i`Kep~|S(3s?SOPZyzYvq!BuVFS>L%6Ks_mS)9`P1lgY4)?qy~Jl9K|grzcY=V!
zywk{Ae>t+TEsgT*qrkzU4&`bzHGpN6&VK!tsqBnz1Ocl2<FT>yU2u1q2<A+#SiN68
zK740y%a_!YADi*G*0II~_K6%)v6VV2@`%tp;U<=>M_2+^KW;o^q1g`gJQ(AhuTZ&A
z^d|GS#Epb<<?eO0t=6{`CkNtFx}XgOm$iCy$+Z+~v5vzJyg(5jkIMHMN0H!WeB+zh
zX_^prq1R@6&zliyZ}Zd54;g}Jgsh<T+kLAmw#IA3zFP(U=l1+FhWuD+R>P^H-Y+5=
z(IeGrhLntN7N$s9Ucg8lGheS_eCp4|hcO1PS;OUkoYTVGBDgz29?Z9_o7XlF5oGXs
zHkr6KJz_hj-pjqnUbE(iH(3rw!)Ifm16?6#^}*qnRt}74q(-i)q_?LJC1N*q-uB{T
zIb{!aBoL#~ZI^0(gv+M7@`YbNv26ZRaSvsOY9ZHL4U2$t&y{83kqG0RQz(zf|L*gi
z#O;)1Buz_*uA>LAXUK^G<tl9Re6eMDJ{(Zbp*rf#QbZP^uSjmpmEgoB1Ik=*6vSZT
z5azz$Tk%2ul%|al7u^E(3_Z4GCZ0XU*4@!*xs;oWGaS4SQ&ak)JpJWDyp|8V(3m&(
zJ-_~^D>4NWbhx`=2g4|HPX=py^Wj8kEWefciw&i0H9R#UzxtV^#R}+s1c`w>rY{$C
zQ36b$Q!2LkCmwr32wA33G+R0BCo#r`a$xO^=jfUP{&{Be$p2|TLKj3>Z}t~$_iy@x
zdq~>Re4wHX-Zj<XW7bg-czkXAB{oBQkSZi!SIep0;*@sjDt-+a`~A<~UO41L<qW}r
zoW67GjD?Y)E%6Yqmd7qhL6)0^vbHfpfHVMPKl-JU_s1wrE8(tgKDTt&3E=2TV&<2f
zHh##3wzppR=UjI|*)?3XP;o6fa+ld;M}Z6i`|C>rhW2zL#3#d37lG-RAzIBbn;%Bz
z)1{E2Rew^8Po1T_5?k{7z0hO)p>10AN{P6-GA*o0y5T;Huej1!JuR8!<tJ9YA?LFs
z<}$#g{ML6?`?zk9p5T!a-y);5lV*A}dCI;tznA0(Yy@uAzFAjoUr{J`xzQ(9ovR$h
zE;PCd$v-zO<!rOwT$iDwA=vaz(kedP;^B1i<}I%P68kE0&9CKPeCYQ-oy^Dn#ynxj
z^Hbqixwq951)T@%UZAOGSeUS@Kyu|Oe8p#5#pK7Rc!s0K#%+3;vSoQF%+sjNJfLGV
z0`3@z8DWcnq(VxcJ<={ZT!23!IBMO{G#0)y?O(8*pk)h|yr=AQPd%P{PG2FJ=aBxz
z$?m1*;n_J)<Y2z__P$wyFBo?*Eh2(^MaSUE^g@wV4WMRC6TcNLVmmj1J8kEVm_lG#
z?X^PfT4f_<ynCx0)z2KR7&x60wu>y09(r{7$|SE{ucJ?X!ubA3&fRP<pN-pYG7ota
z2sLD%o|?{KBW121eR4|cp9(l^UgmZ=eLv}wIgdALpJVYwX|p{7EDCwff{y;P3(M{#
zcdgi>1`x7AzPVR=dn0}v4-AQ!%X2>?20=unrnMxAUiB}0vF;IxQQfC)s9c@zgiDx(
z48|g4u5Rr&IW52tij!BJLM<dDDfHS!m5r3bJk9n4lsYZH01%(uyRf0jKf8!oS~5+)
zy?1*iJTM!ZcSpOQGppifqjLH~HRj)RGv2oj8~^mFbS?Xs3XW)eeDV7zz|4VV7$~mB
zpOd)!o)S(u5_sgLF^7M>O^;yl*(4eKmlM>;?o&TO`|8Cg5qf0FWeJ~<I;KU9G1)`i
znRVp-WQSAiqGOZnHaUPyhM2VqVqja3>DI+&__||MZ2u=iX43VZIz2bb#V%^N=d<R7
zt&f~E{<n`guQo_TDrv5F5y+i(8LvcCm3O0vI28YDemh32bKO6`#Ink2l36}SM^0uV
zhj>OqCS-{*;G%86GJ~K@bu~lOOY=AX_lQOdQ50@w%QqnLQfs+{!OH=!Ojy*-MyjEL
zUpJutL4?km5gPuPU8wsVGfhQ&!$9gCs!AiyF@@B@#v_;S7$96zG@iNd;lgg_pYrXd
zERz9}ru%sBKRWU{`rv<r30D1W<)lu&rPIoNK(svmLB}V|)(;>XmG#@cNW(;z<Yacf
z^>GSP?bsrx<gJ>pk~}R>;ypG~wt<v30;VK75JrXTeRDe8TH?^J0?ArpR9QF=D)GxP
zrrTpx8$4;wp2(p$L@co;g9^w9GQt%Kq%6(_Xly<aSxVBbv)VY(9I*_3I&60GxBcfu
zUYMxS!54o-?ya=YjpCR*{OH%8rym-MRr&QTy<a9+vK1(SPSafaGY)l$bMR|gC$&QL
z7C(1lr?GG!jb>&7c8E`d_JH9Ph4yquv9n6zjRU(Y7Sf|e4MCJ}a_dHCL>m)Dl9edv
z_?U$Jlb06BT`GVBfy$;wsTtcAgn;L=EG(T1arexJ5@aClPj-pIw9o<x?+rb*=@r{@
z!o!7LuIbK#XEF<&4>hAWCVZfdHsJ~Rw{T-e5%nbg6oZAR6Dq`|o2tv^E`v80;Go=L
z9Mu{;q8GS)W^QPk6tXoz__y!bS@VHE`5}p7-1s!s?}<2%r8IyVRm|Z?9A|emn3!xn
z+XFZ9K!2~nV$jwPzI@$537uG#qlR)ydfY>!1&G+1k3@G~BFwNhImAK?$EC1qErk}z
z!b9rgO}2GBau0ClnBKcm_yvwfyraDd(|LPK57m&LMcA{4h!qg!9wuQ6<F=|_u(>Go
zu_l{e3f}FW(mt*aD9F>5A`L5P1KWfCFM>bKMD9sMT7yhlQA2nkw54}`1zstrS=8o;
zo(TqLwqj!=`HsHd*qEdWi#=rYGm~6=VljaR?Fz(S@Gs@28VpSlqZ3zoxkThGoPy?g
z8?t&33{{C)7`F-pYiW1w$0@>omm}+>096c=y4x8>VadW3TqsdP$vj}UyRjvaf2Tgv
z8+$HH_@)!@{VH>1aeZ)0`J6B~(Pq!KZ=?c@3kB;rf^G<kT8=H=*oNB;7(CXOYNbxw
z83>!#f)>t@xm>3`y?FT1k$_gffa(5wZdVW$Mg00CxDy{8ZePcv_w%Q<UIz4c1Zl7K
zTv*N*GT4CB7I;tq$dayc>XY40M+0mMgRe9>YM<9AGq%@*d=TAlUM2Ue*G-gQ@HP1I
zzzgof>r7Gxlpkw0{Q*TQB%PQ43YKWd2wgV<@KT}eAqa2!PkR!CgsU?NzlQ5gme^_=
zf=&!1@P#V8remoaX=*B5;Khf3u}ln<=N<DV=z_Vnf3_`s3?{*#x4Uc47#*4Fw!DWN
zBncMuc$$he1xe*Ws;tS`g$_QyBw}=M_I?|%8M5?41tTaH+45^iCCB!Zj|Ij~oGh{|
z`&syEkXte{@Alz-N{C-m#GUbHDW2RJ^>|bC%p$E$XF;~zJ8V3^*U1HWZ%T%6v}oHp
zeoDOvP(cb69Z~8&iup(S+eqZ8bC^%RlFUJ9FiNG|M4L-mr!VBHr*vF9hUWONp}X5r
zJ}X!Kfai0|@C(lEv0;pbzkU+1f#OSp?K$7_;F@T{fhNbC_J(IU{+P3Dxr-2V!J@5M
zpM|ML*Vc}5!#DY2>6zxg<EaLe7u#cxUE{tyFW4<~aMQ&xBOa>H0+^08HdYX!^aj2^
z@KLc%bO@Z)OA!z{AzgV}l2WU0ZXzv!g5pv2Q+5l*i^&YKI&s`DVp}OO2_DA7lY)zW
zqp(fEyu)$O*75!X3X7D>ayip9?s$~-EoCg|^xodObXg~F<^_TF5!mLEehJIzBBVC{
z+f1cLl!n6DK>Ou3Yc7FyLJe8@D;@=kSI{4VKOn@V3+$Dz<eEP^GqLlSY9JTr<aNbJ
z<D|rm;ltH#XK?$8&}`Dn>1U?dGk{p=Gf%sM%(B)WQVTD*d)36>^PFG=@_NhuqTbDy
z>*QV<+rn~0`W~B<Q}@j$GA&bobh?%!y}cO_=Q}TIXfMSK?#X-lnoSb@Cwet5(2Elx
z+hxRr(fpv|_+`I5L`1IHijbN+BZ2h1#NEuT9MZ{+r%c>=+iOPo9EMMFc^GGZK@;f_
zoVp%Ro$W>5-?8v+<wronZ#wO%2lb9qPAq_TO$=^&{wolSkMaT+axO(O-{_9|?ytMo
z)}AblReP;M#*0Rw0i+gd{mysM(TtC)hJ`VzO6-(dfuf$crHXRX`xY=v_Kh>-g@zJ&
z!IAD_RGM@Lr}iZCL_0D8mC*xgRg=Ez?fOC5AlrsAjWhBj+nUO5veVMv*=R5DDU90P
zr)U7pw_?)CG@eu}8{f9;=l87s)I&cq<jwALO);Y<&pgEWXOYX!05hjj_a~U;8G`Bg
z@5komJM7XT^0ldM2|<4-JbQ&da?_PVaQ0>=)P-jr47;|5TJCH@bwKAWh!4nP@epob
zv?W4syZ%g8b+PJdsaqN~7u2X1XdAMASBDSvQ`k-@-1?_cKkc8tSfb;nh2Xx3lh#oP
ztW>Rd^;!}gji;XAunID5$$~zN3aItUi0CT!f<fE`)vtBqUMNK%7Pg=J&@A9na2U*Y
zgYA9AAr*}e$2$bb#h#zWFHTvtC;MRD^TU%ls^qgt&;{v@aM^N>yTT!U>}n=<`^t`W
z@?c!j`1fVO&43Vfw-iQK9gs#hy=qhBX1j5j>?dmmYA%=m9#@S5_Np7CgZq;Di-|?X
zU|t;~$Nypr`yOW$4z>_mE@NrMJAwrKVk;0sI^EGQ&V@&;y7B7;lV}MSGCAb~`kzvy
z)0QCHI%+}&U4nL)!jjpx5yd-^;Jv|UjDMA~$nyD=b|ccYVKZOYma=aYcHXPJb{l)}
zCOV*CxO&VG?F9E3WFweHOpzM5qTG5A(;kvtk5*qNC_SS1Tn9Uvm<XLE6j;1=9}D5r
zaNX-Eu0GmXqxfsyG#>aG>PI6y*^FrNqs@V`VAVb_{Ra`5#-{wyA<|yNvXWb`q1o?Z
zb`%bn!hK*p-hUhJ&<81%dk}idpey?PT!7vZiqsLS^yx|wS#G1dr5DKUhslJ_Wi=vS
zh(-=v#y{|CnFKGHmqwgM-g)2R<mY@#;!^G80Sj61bnnd-f|d)2%;;K~B6&Sx7c-i6
zi0TlUTmui=^aJODPVyYOld*Nm?6V0giuE~0g)=U^r7@xTmn*K8kXop+tLi6!ha;*K
z0Ev8f@Aon&O_3!*FnfKM+p}p;)g$XT<$<!3;)>2~`(x^sGE<nq@m@}GfgkPdebe|7
zTjVT>5dsCWH`|?l5K94bQevY_0hRsBaVpYX3h#rUkhTfvWp$+0?QcoEA!?1BE3poo
zd5zUl_1gCPl7V<^LG$uPbpF+y)gsqrko`NVW=j^Ff%u14Wt8(oCsO;i4or7xQD@zi
zh`q#{wBahm%*VfJuwR$k@PgmJ%Fdc>HwE~4`No_Wd&RW3oWie;DrfXxAJWPfYthQJ
z5_fJkfQwBHkvj+o>D@C-nxyxeH@!mVdqlW#)eFCKP?H<cjRWTL7ie;GQAYbwzpA~w
z;@7I<0FDY$hyu7e(FZA@7u2_p77rv%q=*Ua1faV^hLSqNWLQEB8O}!<Z`cnEjdYEw
z)mPPP+blNo+SzJdZZ>7&tb6!xdkYf#H1hKDx?OE_9ZzLC9TEI_x)45$g)sdbXF3a;
zrSWcuU$s&nm@um|-KtUgycH=N_dNH5#8ppO;K`AkY(_5PYGh4h)AXTvmyKfMe3kVI
zq~ZOrG{-6<Y|M8&hG1G{H6f*=94>vk+g8GcWx`bEVDa2@DE^!G%9b42@+KX{>mN?a
zTlf)uNE|8rTA`wJUTnPqT%q&N598O2SW8G^jH2jmY7R@lJW)n;G`q*?p;me7rR7;D
zxBjCf@|C}Kk2W#o%XaZwUGyt^)Comz82Ve{{=8k<xyn!jofen&9VP(b7>C|>jW4?<
zQZAZji|~Hws+ZTP^7wWbQ#6i7Thyy1(-wbP{;|I<rI*55&(1PsBh1WCy+Xm2X&1Je
zAz{w*o$$N92!Jn-D}S9-=BBl#;Re)?7WVy1PSz{erof@FdUh$aRb0dl;V7&n_T-dF
zsURX!eMSO=k-)K<@Z(`u2c@`<&Q8R>lM&LI&!)AN;Sr3_yv(wnIV3(ctXD`6q$?x}
zDVNLbOyoCe{OL$hRm$*2q%}`0ERWyoPX!|9wcm47O2~HD|Jkh~Jl;o~>>b%JN|Ym#
z!jf6;3hOMnJ4BS`tXSr<nq>r(#~fwmMzKP6bSE_si=OryTH_t!K=D%NcV1JY4GYA@
z>EgULVU)a^XYOHfWuj`ATnuf*<w`%~eN3gNDRn$94l1UV>#MjLO5n9~XWB)$3TrI5
zK{zg#wg20h+_n*G@}p}Ekqe98Ud(rPHA_{L`-(A9<x>t&EXF^SH2CLS>Tz8hyoi+7
zb^3r-(*!QXCC`NE=gxg52&>Rf;(@Jd(|y6F3d<$z=Zpr*gH+Tmzbt9~I^AAje_-ib
z02SX!{E#g-eRrZc?~-L$hCNf^I(~?1D?QC3&>vZ&&84Mrmw*c_h76wz238Y33GfiI
zjdC|;|1^*&8%Ff(jWyzp&?TySU)-=2dJPC07B`dSO$4T2CEtkFZ?{>j%UMI`5WX?U
z=+kUU=q>Vc(xyc(Fo$NcA@<lFi)7sE6?{UnCX?WS^_!8rLGx%mioku=Iz406Qu>Jx
zqUZz1#GA%0B*?A5{qx};f!AEWNK~g9QgXw-h{(~M=~XQ5Q1YGC?DvBm_mir!B(yty
zCsU>h6|Qa~6-qbmP|GegU3G)8rfm~v93L-FOI;iLS&;Ka-0+tF?IxO)kVvUbhusC_
z<j(r)!W!i*IiXk-rBkey5dWkDKjbvKlO3jLr@s@Ov(F_yqAbr-ccCYEwD^@qK}qAm
zAYN6h>onh|%;G9l5MigWKpb4%F|%{6F)l)f;pF$<k8XJAs`z2<Vn_A34cARQ%L(F3
z=qgsnZi1<nFz<c3evW4s(`TKx`|@1n;J=6c@6tBcx!PEB8ozlqIyr-c>l5(@KgMvl
z$){V}`bL1B9%;5`snU4fK{CDrKg60Vv>y-_JTA(q{ef(}7+^CZ8mLaa5_G!1=6-4`
z9k-(VO?OWB*Y?A=%rvM2E}|_wet<&}($W<EOFj8wmX*&j%%9%>12W~(D{rTU6JNhl
z+5)JviR{Z1C*-)rY5RtQyHrO<K31FVyFez{Qcna#(Qp}>y<M3&A~$F(v__9Io2RF}
zjX#XF&hsuwF$M5++l3nzHz-~cFD!cbjSVruR5c?0<F^jEc*vcrS6n{O*!T=5#Lg=|
zhEnw?Q#8#9lX*{4X2xaw73hq7$iZuY_|V(<g)Ggfkj}rZWOFW_G%cOJ`8iRnRL)wJ
z9<2`g&uReNB1rX|lzWQLf?z`k58PGRs3{&A6wCBB^JC|uW*~(fq<Y{^N2J_sCm`L?
z9)!HoNpWwWL9+Z5NWfV%){<;^X0woCV#s=;e{fl0#5sz%5Z2{9BM`bk+!f<FEup?F
zo$fsz`t_zzcApxwvIZRt{hYz1S597GqmN@{TVShz!Tq10<z;;Ly*ndJiyhL&0cYq^
z1S%o1a*F8eKb;$<M}!(tYB3eyXOGeAg&o(tiFGJ7b2l{_QzB}YK%C-d!A*}^@X4cb
z=;G_ohgpHy9b58ufj5Ormhvpp87C<AbPR<sjwh0iv@+baBe(_LFL~0j596jgsrJhR
zLww4hcY_jN2SO>t0JnjX8J*4<x3I$FUYWgRV$wG*Mi(0cKwps0S>6fm{R=J6vVZr~
zGOde35MwSj1TaT<))1+3eJB=VTDF)Q4Gq)p7t)2hE>TSCp$e>Y4+dGMD)u9U@CvP<
zDj>V3ixjex7*$V~&w<w<@UW|?RKlO=^oyLg1{rct_|NJG$;R(Wu)1aljyo$d*t#18
zyFJZr?<n)_9pW%a?~s#7>BOt9-;D>;U_d7hvc#=-*14JcU#!(is?Jm5ua$mDf~D^7
z&opk<V%!=085;ai4~$MT52F|uj2_{Wp?ox}xABTEPd1L5fk-I@&iBTJ65&mCr)C&F
z<rG&{jZA70=L`$2s~73f61&ZrXzi$TNzsqIhHoc4hf(D@><oe_Y)BS9v(tq@87a-^
zV!Jqa$&wGAM(zJB@_n1FQGQJq*wdZXr&@+*ie8rfp+lr4k0JQ9J%t+4njt&%pim>C
zexCq_sj6O}mIRh7m)38{Xxm6Gd?Bw>1JVl^jVc?cRY8$<>Pp6&Ttrllz7<C=;o;?5
z#{q4er6NkzHa3#sop<Be28GG=XNCQ46(gFQ;!Z8)`pRxg9CO=wZzs))>+pqT%R%8a
zYYUDZYPd<DF&yD=5pz$q$xi1X{*3Pqh_8li@x~+?3y_(d7Y-`P7h(4MfVD(+EjJ~_
z9MjA}S@n{nzm_e>GxPXCagD`25Uy*`b~>it4K;aHWw{DxmQrrpWnvrOK54*N`6srM
z{h*ZrWFo5ax)et9^?8^sFggkY2!sJaVCF!(-NTXNbjkl|{t1Ps!$G7L&0YG0l<QCU
zJ6xI!7Y)HPL%OPj7_%FSX5GC{nrd*7phxb!PSiw!Xnq3`;GxBIw^W?>5zUu*is2f!
zfTS1L2uy<MkQn}z_<6J}<y%Fnip)*hJo9qMpL(MlSlqoAM*fM_Pn^v2+Cl<^K|Z^t
z)ZC10yOsH{m-~q^s>b4HyG6@y&z*UV7LKoWoBmTSomO1R)CZk<n}9T+95!XN;m^V#
z<k@82l<mZ2Uwa?EMuVyD6ucOjnaJ7s{+WaoVu`j}>&?oq%YnX{DgS4H%oK0%h$hB^
zxgwEBf%?&(%mc!LTf-3^JnF;5!O=FQ?`hhm3vbzK9^MOE!~WQ%p2+BwD`4uLIN{l)
z+xBM{>BUO?O?9Rk{;$HcnTnSezJGG^0@YU;a5uF8c<P%m3xwt}_K_iEVrs#QwIP6>
z&b_@NZPe|D5BV7kp6If^59;^QL*nHQVOe`YD*Z(ET-#m}_OA)eK{cINYLa%!<D$P0
zn1Q}<_q+EZkCZEjOBcR`!4VZAkGM%zC2&Z|f63N`X45$p8{eX9+pUu&hGqsv^tB5U
zE2>Q?t;R<^WRrft_jvNq1;jFymt+L*wGhqwN=eKci+qijlm1M-S^6@l{1^$fiIhqm
z&vwxCXIHVQEjmd+tqeycd^{C*bk}6CUZMjYPJ*~xT4g;MOnJw)4V7bl_{4+rIos%5
zOy^sQGyRw7m_2t?xO7#cXo>RXO22Pl(-X}0RE@Z(wnp;U!O2wcqG#FWh`dh}lZ3Qg
z;EScZOH<Jje|ab--&v>gXs$dYUs~c6EOWf8i0v^Ef6d~3dVh&-u@P@K=+A7$!%91;
zIG!3Vik7($?@g@>w8i_C^5GQ$k2ILu0WDBRB)q-j>Z;-;{R4b<+4!5;IbvpBVI2Fe
z$)lnh9Wd(*Mn|NSk6x_IF)+zG5X48yVaHQl0@cePfZ;m>>9d=}MTZy5^@dy=9!vI`
zHTCotjS@H}Rp7_}afOb@`3aO=tiwr}#Zx|g&*TY-x0rKL30r+`b}kpO+A%H1E@9cX
z>YS0v5lhZ|(fD`=l8Dk=^uS|wHLO}K+uuU(kzq=1i~dW-r!2UW#=-oQW$Zz~#hxk%
z!on_xfWT=wE%~;e%L%nw7k+;ur1;wNp*inCFqQO+PK@Z7Sw9xGRDns4=F2D8r(h<R
zNncb!2Z`n}TH>h~Nd+dBSzu8Mzx;&x%7lj187o4Ra`d4sK&iu0DqQ~kX5;F}gHb6v
zBqqt<$t|8+rSeeJecO8+J~rmLiTJc`2!GyjEqPgo8!t>C=Tj4(I>x;~cth6gP8*K3
zG3IORtL$RP@c1@el20m!v$-7*&mbGj8Dr-GLLPv6af2o!b93cS6M_I>$pr~?>B@^H
zJ&Q9uc`+uK{Z=hujc={fNRW|6`O;+j0pd)!z~2CS&y6zCWrI-z!?zk%5Evv0!~gU@
zF=h8GLC$ksTtt<Kp)Th2%9|z-H{YX_YFiKK6g(!|zUPuIT^HJH_GRvVP^y2Mv25c!
zJr;x@eFUQ#C$NvhmD=(_mQNvF{_pl36yk3is!S?#qtiWPn}gPF%z>H}^GWcX%vKQE
z>;Z7~Q5F?9pcV5$Y+~pEPx~zL>v4FxiTA!RCd4M=ID}z(9%S7umE?U7on$E!(t%>c
zrMI&Ygj)>R(R4+DZt03{O*H3P27wg}5{ByEp@ks#fTyD?L^ZEUDd?dbuVKPEe?{ZW
ze}{K&gk52q?H}ZYZoNYMv3}||iom=d-jIrxb2X-0;nKZfk?t^LbXj3wiuM8GP+b^n
zPzuFQ<3mpNq%5Muu4p5qTh;(tE$AEuZSn^V#Z<@seIXiQ%3kBeDZ9YTnr_JP>tjn#
zrAvGej-5@q%!uq30(waxoxK81Y*$uQqOg9J+z<y%F)E**+0NuA_@O#*fsUp15=t38
z4#Aa8LFua8uK6#Uo~gD9V#VYLMSeDB;O!BqmG?>?Kpv0N%r0h#f5giPJUkQ_-;L^2
zbPT=QL=IO5CWl1r3v8iPg4E6|Juw9xw_!}`u~#5byJ+G&Q$yK6nKAVlD_8z5cGV#a
zU0Cr^FQ>jIEEQs{G`u7MmYYp0b!WW~aLK!dvKnM1^sT|+edG$?YR?71u|Zm=?}M@q
zKe};P`Xr5>l$4L^rL(DNylT{lL{Eh^4_$KAF-$>kfta*hY28>p4!<norwl3}{C<V8
zxz=$Y1J+VyA59)e#1AJL6$KS!KyoIZ&R}w+NTQoevuPuGy8fdV!m1||!U-iZ=FTb@
z^TebY-TKO()_IoC1EttDO!MyQwqp2J1D)*I3lGnEl~&1XFycs5rgZU$+elV{Y4(Y&
zl$aUkkhB=qN=%*Ac)Xn)Ou(k~s#9`}JbNx`;Stk{JSVU-Hygg{&Z1{})h^KcjU!#`
zEeF1AgX%T1_;VS(&l&VwEkmlh%}Oe;(}y_UaJM1PQDXCgi|T+U79^`zEB9*f8qb$!
z(wDP<gZ0-?GVks4wg!{zyjs?L0LBDV1WP+j8T`oZ<;G6;F+b4lwbu-l>YKrs_%KPq
z?i>p@Ahx>0m2~QkpG;LS)&q0+$(Vnmz)j7dTXd~4V^|pzySqwJR%Gt}5o1{Vs6s$K
zx6p*Y>engEkDW#E`=2b5$m^~^q5$qf0KMmBd)IPq^ScvbOvIYR>Xw_*)9Um9Ub3nQ
zyHAhE7k1geF(s%D#>K(SNX#JYqjp*|9m%%!z+N7XQZqLGQ*u8Jb>fR0p(WJ%*Fe7*
zXJAX1!%M@@MgO92`X!EYUK#@>sU3_B2lgrrHDLPZdK0ezyFP|ZI-B+-nuF4TqfJN1
z{(91Q0ctlA|4$km2}GtMUv=l3lERCuY0=|?W}VuXA9;V4dxBGPm@oo4ViTA|h}lsZ
z7$v#f(r&Cc`Igou<Scn{&nh*^=zl``b3~}z<e_=kEbbp#cB%xHeSF!HRL7BQ=l%i?
za5n%TlYhBgveTr$Gg^8`y{LK_h%If<TDF~C)>6bQXeHCK{>Ck`t-6F(y?i5C;2^&)
z^JYn_PSN}5KYQBnpZ%N;eh#Warkej38)dn+&#y8Z2^eQXAuy%VVN(PQbupw1(ECBf
zWF!st;E^)&@5r>Iq8{D$jjgR%Yel!>99foWM70UIXDbrg7IFS2wMQG$%~CvX!#*Y$
zg?$WG`a|3Mda>cuF#u&!2J)0GbV3^y<3TaKuYtEB_xnwkCf0)-46ELyXc@B^)Bm{~
zG8C4?y2)Qgq#bzIJ*K#g+vaB>ws}O|w4GA6@`#U717ha_{oRq6Xb6W1u`^?)1aX|m
zxmDPuRsWcsW68m>Z$edZE<?|gzcXp$hSy?vy`hv1{KYFbl^^Ze@4V-L`l&_{J0I>4
zG<T;%eLntpjL{p2b$}8be=Zfx7H>2|m<nFv3qM34pKz|fU?eu$?EPTO@{s)7zAck8
zZUmg8K~CnK9S##%Kl5{1HR<w5IvP97tA#GrWS2%Jgtu_34*6)w3*#D1P0%haL8g9E
z_VPw7`b-U-0oVTau+)#*ym4$hVZ4ah=<q$9*GQX`k}y`}S)yz^&xAdDV28)$K7uZ_
zVwh4XXqVKvE#6cuge@a^h_bl^WAhI}yyKbTZ<Paw_Q=oW%W4V;(S(^+X3?u0)t1#{
z<OsX+ohqVffN#2Y^p7gq(CD&4js?>0<)5a-e<jqlP~?GoH6k)wAdUUthVy!1lrC}@
zhgp@KXgXE$udsN|a6=p)w0uk31UDg>?G#nMxdBePhNzQBY`WE>b;;<k0q%+&>=)~T
zesy8xJ+~R**>PJpFj^k|N<Rjy!FZj)7wPAIGbd82S*br3{?*tI=J3w`Y0pAg9AcCd
zWZ}O8vSld){8QQ~Ug2Pv&-TmgHviq6_yxQa|K6>AAmL&7@zsYdl(H#3S5vFx)r&&>
z7|+!w<#J`+N9@LlIf%Pp)G!d6DD=UBu$ev)S@zU5h^ry8OCT1=ENwq`EOs0(DfJ+J
zZg?}y+K`?hwi+{c6?IHn%pOHS^oH=5979^yZHu?L47Q)mK|s}#PztAF(dz~_3l|~X
zXqwha`z)O2aUwmtYh%RHs3nEIjpo(zg*^ya6Kmlq)Cf~;cz0bIi}jdhp6WyWgk>PA
zoN*mEtQdHb2X+!Ec`{ULrrh$Eo0X(d*{$aX^C;ZluZu#jU_9lnzs!r+2LH9pg9kBV
zLT@5_i<gJ4PPhN8t#d_+1+@O;x%psw0sRXdd}*^^Cmf6=2of^%w_X05U++YO7M?1<
z?Heia?=KpmPmbsDmaK9$w+zgNeyllv*gb+ONV%NJ{xXYA;C6Z8&#9=l3=bOg+et_x
zVzXo3!gTfcOm5U*2}M2gD<|T_YhdB_tgshQ>;#c)7Qr*zxankM3w%loDJLMuX5|O6
zQbbSE%s@xz&UVOFHr&m&A)4NAV)5-G<v}L6U4c7_OV19m>>?K*4&*<_?xb`aXm3pg
zGwkQUl^gD&y?A%hzFSzUS#cB)C0KHH(hWl=yd<xV6!?!V6DPVi!K{ER4Xzbk0eGTK
z1XOSQlaxUJGKa3cK98QF<mLL*|5$sQPmdd~Kf$#w9a^0T<QffrJJ(5by*P%szl_wN
zcCE_GrOE*fN%O5j-4i&-vb!RF_`nj70^Ei4#7LI5aJ&V$Nl17IPsaRF$(8G<@vF_X
zwq-9nhEQkYPy!H@td7l3p6ZeY=5S=PkYwqF!%&mxkqK~O2DC8BMmGmBx50dbBsa2?
z8n4Ta4>_!@uCO-7S0Tt4psEj_6&04F=D3uW^Tu}{WQBBf=_;$?-E(jm%FN7%GBx{_
zK}@sa=jQ)G<52yQ*wwgqczARlq=JD=IW*HQ7>`>d{t8~6ow!oEp=L>%%=TWpzgk>j
zS(D+-k^j5z@L%<pN8^2+b!F!w6_M@(<fWb>^<YWyK>Ly8!%4(lwX~(48cplRbKFWH
z&RR=3wBD&x-F`IT!$>l?$fZu$`WuwoT0&U#yIbJEuD3#&OK0#}&6e7h`9tA8AHHI{
z+~zHI<gSC80Pgt~ZHd5qvIbEHIwry~pef^BmlF3k3bBUU!dyl0SqyO~ACbkywb0Y~
zart5R7x(2YpYr>ySGs!A8w2oLb7G}Y<^p_tDqQ095BJ9_yKxl{?q3iN#E59OZ)k^5
zi^5i^Jsmdx)9=?xY-unNEjkhUnyxKiEk&6C4i=eS^sP2=bCjv}VF>aGPZtx}j7sg|
z3sSB8&_+7OXURPJI<xF+)Mu3!_8M5e&btXHGdec*q>EedV>XcaA~0*<+U~(qV`Vq8
zr%XN@P5lz3(NZE(*Kc(GNd^5xQ;v>Q@V;$!{Bq&2KelV%t#KkM43x+DOMWt%znBD1
zU5d|cjYxnsWoBb5S@l<Jqt<ZFtRT+VMa)w@m7R#z36nAHs7rd6h~|RN(XL8pY%8?)
zx9UuapqD`WUrMVt>B2~^H$GY{H!-2I4?zWq(R@d9V}R7>r~|e{t28|9{TMFMk0_YY
z+Gkn7@N|L0?mp88j|8i4-wGSvG?tBhmFpx9(8hTAfm~|kSc%$wa@U@V?iRr+HSUUC
zOd{9ntP|<S|IQICP$o&JXT-VuoMw7-(YSD(WJ`VbHFj;iRb@nzgW9Ly0k4@2`?_Ko
zN(UpzI?__N+Lk9Y0P0#r-Me%PQvh~2vdh&U)wMa)tDdTXl|1@H@0fJlCJ$S_U%54O
zC`fH~G9JMlsg0pI<a1fGjb=O<Xo4OansPTiA!8*qh~L}A?;zd3t|1SSjst5u_VQrW
z5XYH6!)L}L<wJg}Zv3FGfU~7$6}D;k#0Y|0rt3btR7KWWSHw^Vv8VL}IHb~f#n9Lc
zQYWE)Ci(s6TfxEL15|wBxuy<u>pmkDQPr@B)2s!YHmr+mQAL_P4L6?Pv}k)ykJ*LB
zf&LPAg!DEG--^V=b}53JjC6y4v9m5XW~G}8Q&gWo;iMW=HWN}_Ys%42^pfgEY;=?T
zqrCO_2LZGl0j6X|tW8RrTd6q8%Is=Cu2uz(J2idiSx}OCJT3ST!q8_yAFt3+w%zgt
zR(9;|&`k$ntHj#p!HGkRelHT@>)|+)AYNb7z|<&zMyTsk-E3rnWGm=7Y^r5Tc#P4l
zPn4fx2SzzRzieMKd1up)T+YS^wrk1vBw@aE*%#95N0CWy7N8JYIcGDx6`<NG@D8_8
ztPrQx7|G>5dh_jB-f4&WzMUC*cg|`w{PSf4iel}$coy!xE?ZV8?J-44=FM+Vz_3_k
zPs5t*lgKp|D8-=nU!S_<=ER5vlXZXZTLx+cLTu$x%k1&5T&39{DGcb@`(r0k*>_y#
zqfL>nuWt(^@iV<T=ng79DN8rTBHwwFml)T9)U4kh(N)e?B1jg6dTc^YyG;b7br#%-
zTsgf%t+;?R|1t~?tC35xv^t5k`$I7kw&MOOFXAU*7({6Y)Qw-xIQ!D{=Q*MD<~dFH
zaHDNf_BI3MT&!G~DuC%;ZtCGBOX6}u1~FY<-XDe*jdorQD;+zO&RB&0?@@Sr_-oP-
zUoOr&17yx7T4EK4ls+1EKlb7iU@yB+Jl3g48tiUo*!DK~g9ZmF&%C-@afUO0lUBM7
z)ZOuim)dd&yTU(R(&ud-8?&n6d)rl#DlykB;LpQY{RM7d-&PU*xxCC%qU9kYs_pL)
z8I}LB0_h$KJSh+lm3$JqnCWX+i`u&SRAo8|8@>X}cR+~x5`Uzfm!1c?!A3%#4IAuo
z2+*+$GvvquolGMrI(I+b{#b$z;8)-GS3*3wJZpaZQFbc*tMKFJIVB3Ah`0&D6NH~g
zWS?k9&xlCw;qR5^FQg>~s8G{%T!m-Zhkr6g5YEoeYsB-})wdL3aCXyEG7tFF0oy?Y
z$j5$Q;xi^~+RR3|f{k+eo6?$Z7a66i@81R}daKNfW13#r@LybVRTbVPw>8HJ%rGz_
zJT~l2+D^~j${jvk#j>y77qJkJ4?T;H|CqFEnSwJVX~SDE=?=@WWe&UF0nESTF!<G`
z^&4s=nHc@}D~T^yxlhzK@2Hw|nW?at2ToR|L}^-zDjpNxg6%ls;6!zR`$aI1Ym}^Z
zVguPwp(c@k(PZz}`p?Y1NFyR!TzeOCa0Ju|kb(Ep;=K-a0%ZFcfPdn%?$U~Ke5h0t
ziLJkOZ{_#a8seBa`!z=)b)U}2D5TLKn}+15Qs)KB6`dE-+vl#tX!jK~_0;u$Tg5fg
zUUNZ|VF=f9rvh2$5TL&8gw`Bj^Cx`^A760Gylut!Fn@J&f6s=H`Nf4XNM%K1fAk>#
zm_T!B1b1$sk_e~OcA7ZZk0}cqcJyA~-r?i=uFdHzRd;^2mWr%2IWfEHUL2$A@qXkE
zRrf!qZoiYh-Aqg=hxTDH(&7>@QB#dSEL})-Ud~)6MKhDp`Q44<fE5Q0CFM5j*dP<}
z!oTl8izTkiYXa}3K5ky7OL?(83)JCM-KTfGP);0XE)dxZ1f<ryU|+6VC@eHYJgMS&
zoQU-#KP>XG7jjO3(-iU(fh(y!i4IdEpH$c_o#kc%oN*aK^WcBc+A30&z7ae8o$NCm
zAc+fY2gvWz2VSdl&uZzhK+sKI%Y+*GJ*Es}f_|v~cSjyQZpgZDnQ!I?aNxT?{O`5@
f*Xj6u4D??F8+!3^V!-Bq--oogyjZn}Vc`D&g~*V0

literal 0
HcmV?d00001

diff --git a/web/public/illustrations/ip-access-denied.png b/web/public/illustrations/ip-access-denied.png
deleted file mode 100644
index 9987f78473a55b03659676a5925364f1521c0566..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10590
zcmb7qc|4Ts`#;Btibx7!MvhXpq?j_smZXx9wWPtM7+V;OtWn02p{$WT+t{}uF_dLw
z$&#^#?0fco``tt5bI$pF&*$~~{{ArLd7k^e=DF|tTHe?Dx_s5|C?7e@b(n^R=E%((
z*Y48L(Eb2_oCoQ_ofjw041j-!p5C};M?*t5PW_`TbiQj&LvxDe<~0Q^?8BMp{%nYD
z=-8@MN5=<;rxq4$L#G|S(+ZyMd~@cg@5L>SN`zEn=_{^~(xU-aJwwPhY>wFnLr=e-
zm@q1ts0y3*{c*sTVVI%95L(Mk`x57&dOL_`x)XnsjBhfHPL3E{({k0-p6Om5a*=Iq
zRsGrb@JXh2`cGNybaeKY0Pf3=`N&b$I|A=yUE!r`gNy?l<!efA2f;fF&COM^;L5jq
zcDYD%FL!wyX1dpPQNb3pZoAv=EW2AxyTV)B{kw|T)n1i>x=>*w*k*d+N$SK4(RV6|
zmOY;#jutG)^*Y_p;iRRcoLrk8cc$*&T$U%D^T|+W3nGe)?|O7GSDS;6ewao|o;iqa
zSl)-tYXSpDqIli6=GP<5&1c)#2drJE+;N&IcV4FJX19|j3$@**+B1zVzD-S|$;>5@
zppiL5BKyj87aPp7`}m|Mer?{z#)3Ao^)!QZU#S!l<v!=d`vM5rZE(N5J;W>K9gcL9
za#^oOGJkZKIc(q6*?BN_d-_Rbn5cf6mWNJ`+#K&_Cz)$IzQ4@b5xX&w!X3>x?!(KX
zU!@wj{X6GmKZi7fMdo&q`)0@7Xq2`0T%)y{9nriat1Cvv`EeA?5{+>xv!BwjGLkla
zS-?S8KOkTdQdn46Gxi&Nkj!6`tK_3#%ITFX6%oxy9Nnoe-<q;m0DIl!wvr!9AuTh3
zJ*3<svLNQ<BVwfNM#HKvUvH#`RC#UrIFeFrns_9C(o(NX-AH;eoevkI<z7(!b%2jE
zso-wD0>k_%xxr{L^!H230nWcuXC7?%8vZ4Amk#{Uv5OFW0|xJ#uTX)^gDnnj6&LRL
zKb`Jr7GLg5(OFVrU<&3WLm^d(Gg}@;dD5SAtyOTPYBR4%<MQ4oz5aYe{a$#GOgaK-
z^Pr`nfg4Vk-vF|k&x=%me~^mbz>=D2|92PR2Z{q!Q>Hwa2Nm4bnhr>Ucb5OPf^Q*F
zcXSU>7cdvgh{kiR?hUGvK@NMj*zYauKO4k~Im)uYe@z-`T0?yiTFoX`Gz+Sgb^?WG
z9?TV52VY3-nh?!dS9Em*Mt&nA(F>b#%ME;){h7<`6x+>@YJL7bPzvrtCJZyYksURc
zp(q^Tq@jtU>+}Kp7DuPIw^EM-d-wi#7h;T0xufoM>>b`eRv?W`7Q7stbr|l$us$Hi
z(e~#Fg9EHRk~npcdY^UHMPn#N3jLjb{1kLp*~fv@{0i)K99?qEW*f9w{Pq<qurZu{
z>lcq3ua&@z_ttg*?tO?HfDPiUlty}AWkNazKA;{SD~3t)ui?G}Q{6uH>U6+gjnlve
z!G4X?up83QcrY8%?%mtJNZq~4MpNKfCS2?|+qd4tec9@T+|~fgVr>0r!{hwc`HK*m
zW|@T+vlpB}bn~_q50#3?Vw@j4_PegO>T+33<G|qQ#>@Thb_<-8?AowznN1k3GSxnB
zMl%&3I1<F^d~)|C$HRkSq_x4;@QoRQ!^O7^Nj?^MF0rV@X&MiQ0U1M&s!q#+K=-Yo
z#ohBIt`<X6Q&R&Q%Tq~q-EFiqGoOEBYCfu8JB?n5cI->j_Sd#+D}I9K%D$LVt4ou5
z=Z$F5B-lvh{>93j?I*H}Z@YZi&Z0YvDPXhTCf1}kNI5MGe;*SNH$P^FIU0E3%~nM6
zcT9;8*lpJ)md#Z)ndP>vCmN#dR&@P#O)^IPBv%#bv`+1$fL_<t-o+2Dl-CovdXfS6
zg59m-ys)p%$O&b4LxJ(>z1+%ix7PJjQakoUw^nZbi`wCAp&3WHjh4VsyD)=$D@r(W
z|8a3;hWUg1Us%u;G$&FQcQP9r<)$C)#&&2(^eIEM`<3ZEY=?!w!Bqt+`!&hq<e=;6
zwF&9hw3Q7cAwtOy6_mHI@7I_xzn=)auv^_xzO%fpcB1)@KX0!M8I^B-btGK^9<Tes
zbUDXZuk&o#;(_{{*p=P%48`g;Vc_8ckH<d8#|?fe3L&|ftIVGqpCeb=RfkhF+!v$z
z+em1hVCEB=*>U`Ch`TQI@T+EsR9d=_9KE5Xc8x`DL#%lws!c(aGmd9nl%9_s)j(Uw
zVY_o!txURScw$Jq_4R}i%VatJ&@mlJdfVTwGF^X5=OA1Q3%z1LsWo7{@GW)+v+{|7
zS0wZK=+yg;Y-DVc0g;v-ZWWMT{T(J|b{BcgM}ZT|1PofZ{v{*F=axj}u^yrGl~#$}
zqHT*~O*p%;ucBqq=yK=HnIcB(!pCrnulm+y+WNTp0UR&;SO26T$MQ{swe4AVx!8_t
zxOH?<X1LKak(DO7T^FNiTAc$QZt+(cW=Q3%sbAaKohhI3Td8<Xw*XrP(|XIl+Zwdx
zy6^6E4OHUB<fbO|c&t^(37Pg7k(vyVn#r|ORi|D_?=S2%9bqLx^uh`}fPn1I95Z3O
z{Te@k>ApeEQ?h6Y7lMa%1$BjYbzf7Cj(~L;F!IqGMTiHn9W}n-$1^99Tl8!uc4sLi
zY5BW_crL@Mx=3h2Ccn4Xx+<&=HfXAkBXhjqeDS)*gX=;DQ;fh08nyf+#z}xj)}^>$
zLZJt4y!OWWt06H$)t|d2rFmfffMG+eHWxUL+UFUvX;$Ivlq-w6*^}DQF#C*1v4i3V
z`2%RVZ7NLDdam%9UqPnCKX24jow9r&DWmRCFre}}(+OG19juk>MbDB`_dQQYOm<E~
zxmf{G(hw*Vb-l{exc|}6p=IEgsL^G5TK{%W18+7kfEV=Z;+Z|y^qzyTV&XPzo=KqH
zeon^__Vr806@SblJ7y@NxPU&gYvD7a*b5G%i_HY~vGP4ty)IToT;3)BiFid^n4345
z`NZPZyMz*3zpZ&sAW7m+s~W#3htM_Gjyw`#APLK~dF+r1Cy>Jh;33gaWGF;v6bcbs
zAPWQIjaP6}r}NfO*P_d8wWvUctOOLAMQdpk;qO1j6=h{ib{rl_&#QE($a6=gd{VsE
z%W0TetKH2{HHYdWJU&h~@3bt%-4E!kd?gUnp5ZfB>q^rgCJ7kqv^oh}gX)aOV3oQ`
z&~U0rc=|D@26F@_iv^@w&i59Y>kj<EGjypYf&cm<HmTCwybF6<y6)P<TxYz?{3~*f
z;>4U^p1lRUj#NtCU^+8?PzdUxGBH&|yxsKZqS*|Xs7PU#(Y=35nILSK{oj6c&kidM
zzjW|(OnuNs`zuKf=oMbKZoHffxhG1zi6FQ=)^|7#=@GJb^dS9FUVW-6&RQxCw%&xi
zC+XB*kY)&6M=C1tsMm#eoVAAzijNyGr>gGc&$Gy`#pPH<P}sAP<qtd0#r<ty5a;&|
zc0>hDj($*=uwXq``IDisrdXD-uhII?qAr?4tpjNMBFUEzNDq<~A<iE0@<%x7Z)#ZP
zW(Zig7o>bMD;~m2e;%n1A9Mc^)qa1f^WGBkETP+GakR0Vhi!AVgv@T}Q(OP&1t%t&
zuFus^duY{*f#qwA^Un`mKrQa4LkKBxjVvD<@3+;;%B9pI&)mY1nMYKZ=6Tp=b4BY}
zfPuKx$lsCoQ5choizKF(#Fep`xsNx!le+W~GtoM|H1REy!rT}Zd{(Va^-QFMh&uH=
zYuQO`XYaJ-ed2$Nld&)%SK$LhKl{&S6HrmBDORONjgP{8KD9n(qH#?$quZG2DZ(l9
zx=MU^-`zF>fOJv6#nOn_IXYDjGiti5bk6*pAqi%7Hya4f(I@Rk5B*0DeQujGizvI{
z+Slv3_uqY!kfYh~dyvFx+-%R>Nr^D%O4V;RX&jn4+?nOl<1%xjYqAUb$L1;nGf%3k
ziuOdRv9bX-BF_{DNvsw&w71ag@;mBvREi$);y_td{)9WFX4aou_C5A#%B^4@Sk#fF
zYP?A*J#!37KZM_+oz^ualtB#GZsf4?JxC!sApZ;T4OH;kKyKxwlr*d?_?*EyO{)*}
zZ4~BJQgH?_p4(F}Rvlo^5?=!I;DnT1XHw0*wzXaq4tEg(mA;7dL+6V7m?-zmFLcJ^
z%Zl7Gr{@4H`^!*G-|!NWbxneI&u4qcI6NX1+>65hHC!NLdX5^EO@nybJdBPWmz1c5
zp>n$8Tzh!#HafP16K6ySh3s7enT5$&hmgfjjodQoxe)Jj*iO;ghOQih6RH&hoJUh_
z0+|%ZL6JmZX#}Z?YFAVXyQPT?fk2VQo#Lk<e}Z3yYOmxk{x^dYSPQvU8#IQXCq40e
zl9sv-SQlR-T<but;`(4{GU?o&9Mlc?9)wsuNVV+#yCrMw$u%+nRw#SNRocBAN@Gl(
zQ|cO+KjRJAQ$T;+$c=>QxwT`Jc)khsUtsNE(tI2}lNVu~uwl}{y~H7TY&>C<J6!-#
z6>*o%JN^{aAWxYv4`-XUNvB)NN=>u&6i$4Vo)vNFZXZ%1T>ov-4k4}$zw2{08Hxlt
zSQ7aBoySqH_fkg_&76h0KG=<w1~;vi?{0s7DZl=P@Y-X8NA0#MIZZQVl>321+7TG5
z+HDyU_zet?*T_dU8jMe`tVMT$%!ygjrWJN1RQEH0FS<P(Q7E_0CYVO-kZ;<yzVngs
z^|9F4@(s#?n22XCwBuapie|=z%@uYERK~8v(5A^KFuHz}({dv>WAvlxYTkYG*VdL@
zX>;9aqclsjPH$fw^*SyoLwVYJDP=-4N>!=rEk&L8*?9b2<lSyFqDcCL5c00yn6FhR
zH=6k>)76bV&toddP<o_8#tzRb*JoCy2Id$wMN8{Ws@#%pijmRpT#~OwgoZ%$1EXW4
zK;ZI4H9yp~r8yhZ{lr0~#SPZ-4OU0bUDT6M7p~=SpWka*$Fk*}toq~n1hM+aOG{rk
zJP@{_*L@VCq<)wc$5__HJ$yY;FFO7QvNY;?fhbfuM9lT$fy{@?lm67O=#HmlF;WoY
zeL(1Lj!Va({UXJ*=95%<v=<MIsDu-pVT0!ulEhd-XbWu5P-EQt<Zw$;HrD}(GCzxt
z8XjDMCOGA`C+GAjSP|)vRN=lY?AuK7n3JZHjPTF5$f)~8zB#{vyy~W^m^svaZEj$$
z;ZoE0H~wAkfU7$XQ438WIJxwNCydUEPtV24@`s73&dhB&OON81A@|WwU{)VAhgC94
zo@yeQFc}VrUsy9WidS$dSang0l1!o87m-FJ?9WtBz?YqMH|_*4%E~p$AZa-ME&)y;
ztgpm-k7XtbA-%PfXH>SI<;Lh!!m}(GYWa1|0^<_zBlgw*1}`SHdoU==)O*k$_*sA5
zxigjs#Gm>t1eH*IcsufVKq`fbw^zaFS7`$q>MrwCBRoucAAo!EEA<4{XDw*pVy?MA
z*R@$Z*?UTHz8ZyFs1{y(1B1rwWw)%D7p+(jw1<yVrU()bW>vPWYDvc_+39Pop);tJ
z13HX*2vginzN|8;9G>sAxjGvT#|^6Vrq>?7D1cm<=?Ne9wE|J#@gA-^D#@UgzvNQ6
z+`qF@lwXNsX%YzbZR>GFMz(2a*6O*uy_2%|F8BM%60sYc_DqvyH(8o#C?dU9haMm4
z0E)+b{$c5r-QH$bK{T|Vqh_$aG3xSI_St(sBN`P~4%8fxG`xXFhmkTKc67)Et$ntk
zHT5jLy{~7Msa8ctW^{~$Q!e&|@vT#xLo3J0V6hu|N&6cAj?N^T9~+tUgyrD!!1K4c
zYkU4<NHUlctRpDrqPSl7E80^qlc+b&lOJJZbg-+T$ewq?!lKkZMYuetT+M1dC~g`_
z7o*Bo$0gj!^ASC<L7a(j(Qv@JPE=|SMYt$@uB-CE<rp4So!;C!%1&Ae6o+tdUe1S|
zt|_{Sd36bj4&L3u_Vh@?LWM{egGKEG3+*A-kBmkiz7fU5ZI42X3g*W%=y?)jJn=R)
ziMNIv%?VbGlyFxaO=;sGg0Jgg?_rg$+#>P%ll9R=SKrrO<DAwAL_>EFXFo_xzhXNn
z-i}cfBqXiweA1Utox>;Ji1i8o*dKW?F#vZAT@h6J{28(3dT7mTOu!;XRDqac<NPaK
z%dI|dF@Fc9-f&K`sJB=hvq$H(dlM}hqR@SRe)=VT8a-6y%a$}-9Yz^ybB^gda-nW|
zZd~2r{lb}-_z==NgwtJU(Q#5p*Xv0a-}qm_B91>5+brQEZgy89L1$kV1u>noGl64M
z+2th6H)pk>Rf{_<*p-tUVh=?uY-25J=4!aD+uGx&Z;YrMh6uW@FK4?O6f0c6g%nZt
zm*uCdA5+Bb2NVTm_4yzAw>bK{e;LnVNY{y11_mOVbW>(qF^w9!_f2M<lAE84&7&e0
ziaUE*vpl|STOJh7^5VLHxl5PTEz+y${2+tv*_5Za{SOt8h9b_ldGJZ*i>q+=-v>FY
zRVLXfMqM;gQwc|4Oh7%DpBoNr9XRoI%B_Z<NqP8%0;8nQPBl2ERlrG!W`5CbiJ$Zw
z=hQ`r=!!fMah#mIVShf3zu;J4{Ef1rCWfj%lc}OCK%N!Pr?#&34tG6?EgQ)vjGsdn
z<H4a<E_}0n3`}7l>*G&C5<lgGAvFv1{*9{olv%L#?EP#y%W#l4N33f&veN&ufMA}S
zNPO=?eve1}BwV|1QA@H6X0MednvnPm(WcpKIXO2h2)zH+zAc2%iAN?mPkCBS)^;3e
zVU>d_6?PtnBb)%lxex+i*Gcd={evLp(a<O(Akq{Y%`}x^DYqHqx%UzrRoe=ynXVHr
zOAgF*nJV;dSZXSV>Nk(4LRsuLi&Y^p2td2}@X$d&dk#N}I;Uk879%5(2<rfOH}IMO
zKp9-%&ac9zaYJl|;$bySf$0HP5b!o{7V6F|=vLX=zlU=)v)=b5t3O(j{K2Uj+QNDn
zs?AlduW4_dMOwS3jX5s)K$(1H$Y|Y63iUx#SD9e<NgjY}Cf}}zGc`qmn5qC=5xc&Q
zd1gZ5_+bXf&@0?o_Yk}mpariA&vW_#k9Q|h96R}8UCMv?gT<x5ggtNgHvbBqsw<Pl
z!{$|OUVJAsNH%}-%|N{<-i6Q7H5V7H-u%c-w1li3lS@v+`#0u>y;V}X={!Am<M7|`
z5C7NEj`37>mOa)(=FL^y_6|iC8C|y0ZJzJCxk5pQS;6rTX;^s4{Ec`z<RDpsVw2ln
zwzDy%66KDa`KPddxN~4aYjiA#3(gB)&OVWL{FwoKD6p!ihi3{i|0Af&fGf+xRUAO7
zy}U*7Sn@ZsPNJoLvF%8mOA%jF&APv8*X9ik6xQWrpG`bHlfeaZ#kEmIgr6;c`o7+?
z36mploj^t+ETgXOd7jl_H4&uo@G1Cb)1iT*Qt@F=XJfI)N4$#!JuS1WRVn^xTXEZr
zG!VXT4y_))cp6!UFWdfVTVtDI`S)r0*5It4Ahcx8%k`}a{}3Wcd}zJJSEnP{NB+OP
z)w^j(qqu|$nFG%#&o(R+aMTNCXL!4@6*ugkS2?7Dd~}<1$|%(M)LD>hQFu5t^OyeN
z{NHlEBAujL;{7;+2zxxCxIhJwNn)?QaOjEtH(@5m6^eSzT>^(treSz79u5zIJ*5XR
z(DGIJ6%rsOzCL90nNf)~4+L)<bGI$GNQOKknaH>1`64uc78vTCQ17YLK4<Gr02y01
z9`bTI0(VT^5T-BTc_{0inC{ut*?zf$NW;R{=@M6&j7Q~(hdhDfPB8Fm(^ltoomdQQ
z4|17*NXznx<8+1vQ!1^Z?IcWP7G>wnw|TcMC(cjIpiA~Km><+HAmfQg&;P=}uFdh2
zHtXr3#G>Q}Cy)q-bI4LpF|(n8lY0o9>M(usCnWyD@=FRhbXZLPgYubCru2V@93W2~
z)Q{TtxD#H?h2o?!w5T^EefVDh${qkOvo!sYHeqj|+&C>}emdS|qHZN&V>uz(pY+{n
zEP9|dNo8PrwLf;(J=UCLLc*MI^gy_n59mM0CQ+VcebriA(;|Vac##xhpad(d<e$8x
zb^8*Mv|2XXi06^I_;GusM?Y85*Dvi)lodHf&MY4$$;_WqArKe&`$Y^WXZ^XdQWnnS
zFE5PLtIRCH+^o@5h?pAjv-hJTX^jL9CqH&~Yiv>1wL1sMG9!@;!gy6@0R4TiaWS!-
zAPTteL@U6h1iEIc5gebCIqbhmNTz;~RkX~;cw&CXL+4Bm@zu7j`oX?7X5f#TFUWy&
z5=+%ro+(K#(o>e?CTz66>@~4(Q_{bLwCXE8Nwny?*#EX+=c8~>I^vT0unLC*orq%A
zAV3wD7_=Z1&DdA=N&pG;Z9M831o_dMyQNJ`AqF!m)l?#CmzT~{fvKdCRxKZ+9ow+P
zBj;ASlG$>cG&~iqI@O_C1+d+jBmmmA*?va-!qttOadwF8yiU=|qJFoJOYQN>YCY$;
zExr$_2uaIr%~gI7b%-LG-r+r$Z_*NOVlxvgM&q=0{W=r8k=B~cx#=D0yXX15Z#6TM
zQ}H<HWPy}R-<|ww3!#z&y-Cs9Rto9g)$Kr{bc_r@PaKDcY;i%c%}yRJDy(tBv((_B
zba<oLW_*STi-Bl&S%#6q-xC)q0|=5aY$OeKbSX(TZMtE!U<S9rlbz|Bn(sWVMU@N3
z(;B44I}S%Bao0yCjYX05d$XICZ;tpkzP&Aw*&#?7!y0!J1E2`;<+b0M8TJf1MCylA
z<~2(X@dDjP)2sE9IpRvL__N8bgnX7WazN%`V?dES^DWY-7{qo+4kUD=c)4$4xw)9c
zll_MbI*<I|t1G&X(enR=F;03iHzl*?qTN(o0nGb<Wv)2$N>jnVT>i!1A&O{d_FkUK
zoK(4oz5kR$4#Mmgm{<Xm%tA`S%x9|pnP20^4wHM9;w*n9)qwY+GGIw*0G0)ciBEIB
zVcriZo_KXGKx1DRk9?}bQTlY?^A@BjD+;P*cHHoN!8iTInUVpe*U@hwE6{AnR9@uM
z!_u_I6-Df%>gAvMnF0DU+2g*wLiV5X(l47RHwddPe?>>BP1ocl?okuuzF;}1Gy+h8
ztdS#sS=jM)qjEWi>COjXjT-g}P4wGf%-v+Lwv?7@n!f*`8_v2T9I&8J#4k}Fct4$Z
z9N34z`he?`!qoGrHDwOi_qPF$)buWSaGj~?9dT$R7vRMOG73lKJFj|eQS<ossqK;d
z$a@syO&vC?{Pu1R>B%-188Yl;G>zq{@)5qOxG5fWYUb+-kNyfc&MVTc8<_M$o#o8S
zNPp2h{zZyaW|+YzLGHS}{i_Npg*aF+L*No}I@<WmqEY{&Ud`qEJRE`n5%7B*SJrH2
zE^6hwT~i~-Lpsr!g|`;h{*XqnoD|f6Q+=uNjXq{+m~tRA+I1<BHxpwav;G_ispPy(
z84;J~t>rot5)f`PQWrW`C!GBPxjm^nP`26^b=lh5|DwJ{gH?EpoV#r4a=ZSbeyS2F
zY&~5ah<&u!UA5F->U8PBM+ec;`5Nwlk#Hn4pbUPB+C`2s$RqbcM9Ej$W%Ym}!H>P(
z#B`C(E{dq>;sD^x?F36?-ZiE<1ICKV#Q5^Xpax}#lkvj9VZ>BZbCIA_?<u8#-=}wr
zEPL3`BT0yIWAw+aii^@5a)5;rjA@!{Fq<j{99)+76ja}X?+;y2S6UKfKuF%vR$gu}
z6WSZ`pHFqWwkubeKFb?FH9u?aL2Ib1u)^h6hR@3wc!rE5qV^b0mJ6r%Y>_nLL0}w3
zT5E8t6|CPs=1>)ggRg*upUxLVNlp=mBrP3|2AIW#I#`SzPoRN*1MJfcGi41(p&vwB
zE?-pI4{zx(jp{tqd_p4za}9{@^!{C+Xz^B6fX(>4anht`Ou*R?=2>r+Nx^YWhjaUf
zgqZiC(n}{s>N_#Vw|jloPu^-~)j~Yr{+U(viH7FjB()ddx(c;kW6@h;zp~!s?zR&g
z5l*h#IoBg_gqU`%H+e=7whmZ@V|zAx=K43LK*(F>o{YpV^g?yv;uASyvyR_wloOTo
zT)ma4!q>uDJFG1oj&%*zpLn|1oiKJwxLRO0cY2TP1g1O4TFI=<w&J&7VgY9_TCy0r
z6cWcDQUlVESKi5m?Tj4f8>alUxvo5t{F*Q?-~h|5OiaAfsJos%ofDZ^U3^ou6Lq#i
z{f9nd|KRo2OdSJOXSBaIM&g5?7TmaVpe5cSzzFB}K^d3#ZI6fF+$vrU|6X(!YI0NZ
z#a3+xyZ>Y=LH4cn@#e>D&Pn{<5GbUsozo#TVr)zzO_f@x=EubH7V20E0wU626gP%e
zrJSV{JK`6#f01jbbY)y*V$Gsm@oy{sb>e|>{HFr}x4|juU)XN4Tt^7#FI(=;bJWs~
zE;u5Mfcsfk_TUqSjMW!k=JM;>yx@Gr#{f7t!o2ei;XdVl%YZ*_te9HHx%{6pj@d`_
zR!p{V`hD{#_(EYPC)^L6DTu-18G*9hK*?XC*E>1Al2Ul8AXaI}q|^LXlkBENXZ{nl
z;;F2UVX$1a_{y3Y;>`Nu*w}8r7S6ZpQIQYFSV3l`-2<AMS5(^ff;Uf&eze2OBr64H
zuJW;{&N1GCbFHuYkH_Qj)$`N+<mOz?z=n1K_+(Xxelr~R`T}v!Iq1FR(R*Mxy^>nS
zp2!~I5@4r6Cb@1t#<B3m%=DL+6PeW@lHPbF{i$)iSN9&`8grw2+dDeAErWePGKJq0
z!D-3dnPBK&omXA;(d-2wxVv1&d1ZQ<EVpB035kKDnII-aofZxDOXe3AYWV{jU@(}~
zNktz8y?EeRw#_`mQQ2g~d=;BfN0vd+s}T?fz19F-wNm$L`@!|(%7>I(`bB$t&J}CR
zhf(l`raxq~F%j9Ls~3sZ{ZJ}q+C7vrxnG%Td|us?Xn%Q8J^M_2C5Ihw5-0pXO^W84
z>ARdOeeb&}A~4NYXye|U>%T!w3k7BAAe6y)t^=uDraOMv+we&%>xmP;Dx&~QKDFco
zNNIlP_28vuKot-)JkT)pB--sDOq=E0kG~BBX*#mJFbR}RL1ZPY*I3BQorXN1owCcc
z9<u~hR^@X6K%G1eQ>UdBp2x3hFa)sC41T5tt1s4hF6o&ZEKS-81mRUB+yaHF<ipCf
z#!sgXeRg#o)Nt?&;@!bwC*K2xgfyXW7@{O;G?K0hLP>34Q1y>?wini^Rf*HT^T}<^
z&pmJ=+)v+wv+Gh1XgS7q@`mamw1cc@Dp}_NZ4X%7uVyzjiDPjbaju}@;F*u8H&HdY
za8;l9_GQ2rZ-h{!W-=X3$;+}h>a#4dvZdBi>!&SixhV4I`605(SjYs8hm{d6{Wzb4
z$&{IK_9%_K`vALyJc~wApv?09B<ke-eg;sH|M!j!1JR0=g7=^Y!0cPHItPY{4bKg_
zOS~OPOfNY}Spj-v7h0n3i5Rzyi5x&a{Erbop&yt(7!@dkc7=grR+a@6cC23gw0E{S
zfBPrr3eb7r>U1zYz`56cujONF%oCWm3@APX@y>q@H>-2*)!yr7`TGN#CJv|A68x`0
z9KSFKwR_}+=@_Hrejfur^Z#gP_(yNUf4#_JH!L(Nz==;p+!h!h_E<&jzL21n>h(gm
z^v+CMkJr>(Pb^O|XEpBA1q~P8Eq>w?dPpQo?AGwvF*!cfh86{c&KWr!UqBh+HfPJ-
zck=7^I!vgWQ1c!IFapfF4-s`+!1nyHv!g(R(%<l=pI#}#piqe|{jG%u#b?u*BgMha
zERFDGz<%2Qm+p~S`+skYah-$%tfb&pC5`;EltJw!Nr)EP@6_=KxB_Iu|G(N;_FG>{
z?t4(YTc8^WbpO^oWW|{|?$69AAdZ&-)t#Po+R8_cFHrqqd#4ZPoP5k=%;OC37jcpL
zz5NfKO&Dgsp+$_vsL&?+BQw>UaJvscXfI~i>*fKiEvio0AE_M~|9tRs{f}AAj{TOO
zzV(Ft63w2S9i4G`i&*>Nm5<z62seV|?=k>AfC0XDz%F+4L4@0Ky4uTVX-8Prk&~dA
z1btY3%D4A-?fiKU&_o7K+z3=87h`D*3_ld*=C+(;$hR{h;~@k7$Svat*@as7!?9~s
zXFqq4Rtm2d@=1SK`Pthuewxm-WX-CdRMv86Fs<ucGjLcdBRc>%4XMatYAlO-*`Y3T
zpVm1(35<DW77|C@1{inGya3%a4W#)1>jv57G&M=W5mkZUu8ob2t&~Ur2#K~8=<}+!
z>J$qEwYx3iPD(z|r^|36KrKg%4W)|rUd}S0pm2qEciz3hVkTOwLN}Xq*?DW8{6yMe
z+Vnlo-+Jtd&(ITz;0;|@I#Gd5Sr5zLNRP9N+E-r8?QHHscP3(Yo?s`E!apaegnted
z*2P|61Z_q}X4Cw<>$Rnbl`6JfnXTUb?II`9uC@B#-pzlNc4x{aZMat!m2b~H9c_5~
zM>No>qjl>`DRPh)mxc6!*UHdCtG%n2-6dCcX;|Ns6YP@BzJM{z7$rT7ruActqmiu%
a&2_UUmPRqTVJPr~=BCn}YgtzfJ^v3RZn|~=

diff --git a/web/service/__tests__/ip-access-denied.spec.ts b/web/service/__tests__/ip-access-denied.spec.ts
index 4c1f5e0e5f1a5f..95b6b901e970fc 100644
--- a/web/service/__tests__/ip-access-denied.spec.ts
+++ b/web/service/__tests__/ip-access-denied.spec.ts
@@ -2,13 +2,18 @@ import { toast } from '@langgenius/dify-ui/toast'
 import { waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
 import {
-  captureIpAccessScope,
-  ipAccessDeniedAtom,
-  ipAccessStore,
-  isIpAccessDeniedError,
-} from '@/features/webapp-ip-access/state'
+  appAccessErrorAtom,
+  appAccessStore,
+  beginTrialAppAccess,
+  captureAppAccessScope,
+  endTrialAppAccess,
+  isAppAccessError,
+  trialAppAccessErrorAtom,
+} from '@/features/app-access-error/state'
+import { markAppDeletionFailed, markAppDeletionStarted } from '../app-deletion'
 // oxlint-disable-next-line no-restricted-imports -- This integration spec exercises public WebApp transport error handling.
 import { request, sseGet, ssePost, upload } from '../base'
+import { consoleClient } from '../console'
 import * as webAppAuth from '../webapp-auth'
 
 const refreshAccessTokenOrReLogin = vi.hoisted(() => vi.fn())
@@ -61,10 +66,10 @@ const transitionWhileRequestIsPending = async (transition: 'denied' | 'navigated
     const error = await request('/parameters', {}, { isPublicAPI: true }).catch(
       (caught: unknown) => caught,
     )
-    expect(isIpAccessDeniedError(error)).toBe(true)
+    expect(isAppAccessError(error)).toBe(true)
   } else {
     window.history.replaceState({}, '', '/environment/chat/another-app')
-    captureIpAccessScope()
+    captureAppAccessScope()
   }
 }
 
@@ -72,14 +77,14 @@ describe('WebApp IP access denial transport', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     window.history.replaceState({}, '', '/chat/ip-restricted-app')
   })
 
   afterEach(() => {
     vi.restoreAllMocks()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
   })
 
   it.each(['/site', '/webapp/access-mode', '/login/status', '/passport'])(
@@ -96,8 +101,8 @@ describe('WebApp IP access denial transport', () => {
       }
 
       expect(error).toBeInstanceOf(Response)
-      expect(isIpAccessDeniedError(error)).toBe(true)
-      expect(ipAccessStore.get(ipAccessDeniedAtom)?.clientIp).toBe(denial.client_ip)
+      expect(isAppAccessError(error)).toBe(true)
+      expect(appAccessStore.get(appAccessErrorAtom)?.clientIp).toBe(denial.client_ip)
       await expect((error as Response).json()).resolves.toEqual(denial)
       expect(fetch).toHaveBeenCalledOnce()
       expect(window.location.href).toBe(url)
@@ -116,7 +121,7 @@ describe('WebApp IP access denial transport', () => {
       { isPublicAPI: true },
     ).catch((caught: unknown) => caught)
 
-    expect(isIpAccessDeniedError(error)).toBe(true)
+    expect(isAppAccessError(error)).toBe(true)
     expect(toast.error).not.toHaveBeenCalled()
     expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
   })
@@ -128,11 +133,11 @@ describe('WebApp IP access denial transport', () => {
     await waitFor(() => expect(globalThis.fetch).toHaveBeenCalledOnce())
 
     window.history.replaceState({}, '', '/chat/another-app')
-    captureIpAccessScope()
+    captureAppAccessScope()
     pending.resolve(createResponse(denial))
 
-    expect(isIpAccessDeniedError(await response)).toBe(true)
-    expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
+    expect(isAppAccessError(await response)).toBe(true)
+    expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
     expect(toast.error).not.toHaveBeenCalled()
   })
 
@@ -162,7 +167,7 @@ describe('WebApp IP access denial transport', () => {
 
         await transitionWhileRequestIsPending(transition)
         const url = window.location.href
-        const currentDenial = ipAccessStore.get(ipAccessDeniedAtom)
+        const currentDenial = appAccessStore.get(appAccessErrorAtom)
         pending.resolve(
           code
             ? createResponse({ code, message: 'Late authorization error' }, status)
@@ -171,7 +176,7 @@ describe('WebApp IP access denial transport', () => {
 
         expect(await response).toBeInstanceOf(Response)
         expect(window.location.href).toBe(url)
-        expect(ipAccessStore.get(ipAccessDeniedAtom)).toBe(currentDenial)
+        expect(appAccessStore.get(appAccessErrorAtom)).toBe(currentDenial)
         expect(beginRecovery).not.toHaveBeenCalled()
         expect(clearPassport).not.toHaveBeenCalled()
         expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
@@ -266,8 +271,8 @@ describe('WebApp IP access denial transport', () => {
       )
 
       expect(error).toBeInstanceOf(Response)
-      expect(isIpAccessDeniedError(error)).toBe(false)
-      expect(ipAccessStore.get(ipAccessDeniedAtom)).toBeNull()
+      expect(isAppAccessError(error)).toBe(false)
+      expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
       await expect((error as Response).json()).resolves.toEqual(data)
       expect(toast.error).toHaveBeenCalledWith(data.message)
       expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
@@ -323,7 +328,7 @@ describe('WebApp IP access denial transport', () => {
 
       await expect(upload({ xhr, data: new FormData() }, true, path)).rejects.toBe(xhr)
 
-      expect(isIpAccessDeniedError(xhr)).toBe(true)
+      expect(isAppAccessError(xhr)).toBe(true)
       expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
       expect(toast.error).not.toHaveBeenCalled()
     },
@@ -334,6 +339,203 @@ describe('WebApp IP access denial transport', () => {
 
     await expect(upload({ xhr, data: new FormData() }, true)).rejects.toBe(xhr)
 
-    expect(isIpAccessDeniedError(xhr)).toBe(false)
+    expect(isAppAccessError(xhr)).toBe(false)
   })
 })
+
+describe('application not-found transport', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureAppAccessScope()
+  })
+  afterEach(() => vi.restoreAllMocks())
+
+  it.each([
+    ['/chat/app', '/site', true],
+    ['/completion/app', '/parameters', true],
+    ['/workflow/app', '/passport', true],
+    ['/environment/agent/app', '/login/status', true],
+    ['/agent/app', '/webapp/access-mode?appCode=app', true],
+    ['/app/app/workflow', '/apps/app', false],
+    ['/agents/app/access', '/agent/app', false],
+    ['/installed/app', '/installed-apps/app', false],
+  ])(
+    'handles an identity 404 at %s without consuming the error or retrying',
+    async (route, url, isPublicAPI) => {
+      window.history.replaceState({}, '', route)
+      const body = { code: 'not_found', message: 'App not found', client_ip: '203.0.113.8' }
+      const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(createResponse(body, 404))
+      const error = await request(url, {}, { isPublicAPI }).catch((error) => error)
+      expect(isAppAccessError(error)).toBe(true)
+      expect(error).toBeInstanceOf(Response)
+      expect(await (error as Response).json()).toEqual(body)
+      expect(appAccessStore.get(appAccessErrorAtom)).toMatchObject({
+        reason: 'app_not_found',
+        clientIp: '203.0.113.8',
+      })
+      expect(toast.error).not.toHaveBeenCalled()
+      await request(url, {}, { isPublicAPI }).catch(() => undefined)
+      expect(fetch).toHaveBeenCalledTimes(1)
+    },
+  )
+
+  it.each([
+    ['/chat/app', '/conversations/gone', true, 404, 'not_found'],
+    ['/app/app/workflow', '/apps/app/workflows/draft', false, 404, 'not_found'],
+    ['/app/app/workflow', '/apps/other', false, 404, 'app_not_found'],
+    ['/form/token', '/form/human_input/token', true, 404, 'not_found'],
+    ['/chat/app', '/site', true, 503, 'policy_unavailable'],
+    ['/agents/app/access', '/agent/app', false, 403, 'forbidden'],
+  ])('preserves unrelated errors at %s for %s', async (route, url, isPublicAPI, status, code) => {
+    window.history.replaceState({}, '', route)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      createResponse({ code, message: 'Existing error' }, status),
+    )
+    const error = await request(url, {}, { isPublicAPI }).catch((error) => error)
+    expect(isAppAccessError(error)).toBe(false)
+    expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+  })
+})
+
+it.each([
+  ['/app/deleting/workflow', '/apps/deleting', 'deleting'],
+  ['/agents/deleting/access', '/agent/deleting', 'agent:deleting'],
+  ['/installed/deleting', '/installed-apps/deleting', 'installed:deleting'],
+])('does not replace %s during intentional deletion', async (route, url, key) => {
+  window.history.replaceState({}, '', '/')
+  captureAppAccessScope()
+  window.history.replaceState({}, '', route)
+  markAppDeletionStarted(key)
+  try {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(createResponse({ code: 'app_not_found' }, 404))
+    const error = await request(url).catch((error) => error)
+    expect(isAppAccessError(error)).toBe(false)
+    expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+  } finally {
+    markAppDeletionFailed(key)
+    vi.restoreAllMocks()
+  }
+})
+
+it('ignores a console authorization failure arriving after the application 404', async () => {
+  vi.clearAllMocks()
+  window.history.replaceState({}, '', '/')
+  captureAppAccessScope()
+  window.history.replaceState({}, '', '/app/missing/workflow')
+  const late = createPendingResponse()
+  const fetch = vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(late.promise)
+  const pending = request('/apps/missing/workflows/draft').catch((error) => error)
+  await waitFor(() => expect(fetch).toHaveBeenCalledOnce())
+  fetch.mockResolvedValueOnce(createResponse({ code: 'app_not_found' }, 404))
+  await request('/apps/missing').catch(() => undefined)
+  late.resolve(createResponse({ code: 'unauthorized', message: 'Unauthorized' }, 401))
+  await pending
+  expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+  expect(window.location.pathname).toBe('/app/missing/workflow')
+  vi.restoreAllMocks()
+})
+
+it.each(['agent', 'installed'] as const)(
+  'connects the generated %s detail client to the page boundary',
+  async (kind) => {
+    vi.clearAllMocks()
+    window.history.replaceState({}, '', '/')
+    captureAppAccessScope()
+    window.history.replaceState(
+      {},
+      '',
+      kind === 'agent' ? '/agents/missing/access' : '/installed/missing',
+    )
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(createResponse({ code: 'not_found' }, 404))
+    try {
+      const promise =
+        kind === 'agent'
+          ? consoleClient.agent.byAgentId.get({ params: { agent_id: 'missing' } })
+          : consoleClient.installedApps.byInstalledAppId.get({
+              params: { installed_app_id: 'missing' },
+            })
+      await promise.catch(() => undefined)
+      expect(appAccessStore.get(appAccessErrorAtom)).toMatchObject({ reason: 'app_not_found' })
+      expect(toast.error).not.toHaveBeenCalled()
+    } finally {
+      vi.restoreAllMocks()
+    }
+  },
+)
+
+describe('trial application error isolation', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    window.history.replaceState({}, '', '/explore/apps')
+    captureAppAccessScope()
+  })
+  afterEach(() => vi.restoreAllMocks())
+
+  it.each(['/trial-apps/missing', '/trial-apps/missing/parameters'])(
+    'handles a trial identity 404 at %s without replacing the explore page',
+    async (path) => {
+      const scope = beginTrialAppAccess('missing')
+      const fetch = vi
+        .spyOn(globalThis, 'fetch')
+        .mockResolvedValue(createResponse({ message: 'Not found' }, 404))
+      try {
+        const error = await request(path).catch((error: unknown) => error)
+        expect(isAppAccessError(error)).toBe(true)
+        expect(appAccessStore.get(trialAppAccessErrorAtom)?.scope).toBe(scope)
+        expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+        await expect(request(path)).rejects.toMatchObject({ name: 'AbortError' })
+        expect(fetch).toHaveBeenCalledOnce()
+        expect(toast.error).not.toHaveBeenCalled()
+      } finally {
+        endTrialAppAccess(scope)
+      }
+    },
+  )
+
+  it('ignores a late response after closing and reopening the same trial', async () => {
+    const first = beginTrialAppAccess('missing')
+    const pending = createPendingResponse()
+    vi.spyOn(globalThis, 'fetch').mockReturnValueOnce(pending.promise)
+    const result = request('/trial-apps/missing').catch((error: unknown) => error)
+    await waitFor(() => expect(globalThis.fetch).toHaveBeenCalledOnce())
+    endTrialAppAccess(first)
+    const next = beginTrialAppAccess('missing')
+    try {
+      pending.resolve(createResponse({ code: 'app_not_found' }, 404))
+      expect(isAppAccessError(await result)).toBe(true)
+      expect(appAccessStore.get(trialAppAccessErrorAtom)).toBeNull()
+      expect(toast.error).not.toHaveBeenCalled()
+    } finally {
+      endTrialAppAccess(next)
+    }
+  })
+
+  it.each([true, false])(
+    'handles explicit app_not_found before SSE starts (public=%s)',
+    async (isPublicAPI) => {
+      const scope = isPublicAPI ? null : beginTrialAppAccess('missing')
+      if (isPublicAPI) window.history.replaceState({}, '', '/chat/missing')
+      const error = { code: 'app_not_found', message: 'App not found' }
+      const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(createResponse(error, 404))
+      const onError = vi.fn()
+      const onNotifyError = vi.fn()
+      const path = isPublicAPI ? '/chat-messages' : '/trial-apps/missing/chat-messages'
+      try {
+        await ssePost(path, {}, { isPublicAPI, onError, onNotifyError })
+        await waitFor(() =>
+          expect(onError).toHaveBeenCalledExactlyOnceWith(error.message, error.code),
+        )
+        expect(
+          appAccessStore.get(isPublicAPI ? appAccessErrorAtom : trialAppAccessErrorAtom)?.reason,
+        ).toBe('app_not_found')
+        expect(onNotifyError).not.toHaveBeenCalled()
+        expect(toast.error).not.toHaveBeenCalled()
+        await ssePost(path, {}, { isPublicAPI })
+        expect(fetch).toHaveBeenCalledOnce()
+      } finally {
+        if (scope) endTrialAppAccess(scope)
+      }
+    },
+  )
+})
diff --git a/web/service/__tests__/share-human-input-upload.spec.ts b/web/service/__tests__/share-human-input-upload.spec.ts
index 68c108e150d949..1e8b8fca3680c4 100644
--- a/web/service/__tests__/share-human-input-upload.spec.ts
+++ b/web/service/__tests__/share-human-input-upload.spec.ts
@@ -1,4 +1,4 @@
-import { captureIpAccessScope, handleIpAccessDenied } from '@/features/webapp-ip-access/state'
+import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 
 const mockPostPublic = vi.hoisted(() => vi.fn())
 const mockUpload = vi.hoisted(() => vi.fn())
@@ -26,7 +26,7 @@ describe('human input form upload services', () => {
     mockPostPublic.mockReset()
     mockUpload.mockReset()
     window.history.replaceState({}, '', '/')
-    captureIpAccessScope()
+    captureAppAccessScope()
     vi.useFakeTimers()
     vi.setSystemTime(new Date('2026-05-06T00:00:00Z'))
   })
@@ -128,7 +128,7 @@ describe('human input form upload services', () => {
   it('should cancel local upload before requesting a token when the form is already denied', async () => {
     const { uploadHumanInputFormLocalFile } = await import('../share')
     window.history.replaceState({}, '', '/form/already-denied')
-    handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+    handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope())
     const onErrorCallback = vi.fn()
     const onSuccessCallback = vi.fn()
 
@@ -166,7 +166,7 @@ describe('human input form upload services', () => {
       expect(mockPostPublic).toHaveBeenCalledTimes(1)
 
       if (interruption === 'IP denial')
-        handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope())
+        handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope())
       else window.history.replaceState({}, '', '/form/another-form')
 
       finishToken({
@@ -217,7 +217,7 @@ describe('human input form upload services', () => {
     window.history.replaceState({}, '', '/form/token-denied')
     const tokenError = new Response(null, { status: 403 })
     mockPostPublic.mockImplementationOnce(async () => {
-      handleIpAccessDenied(403, { code: 'ip_access_denied' }, captureIpAccessScope(), tokenError)
+      handleAppAccessError(403, { code: 'ip_access_denied' }, captureAppAccessScope(), tokenError)
       throw tokenError
     })
 
diff --git a/web/service/base.ts b/web/service/base.ts
index c9b65d99bb055a..3d9dd83c602d73 100644
--- a/web/service/base.ts
+++ b/web/service/base.ts
@@ -1,6 +1,6 @@
 import type { FetchOptionType, ResponseError } from './fetch'
 import type { MessageEnd, MessageReplace, ThoughtItem } from '@/app/components/base/chat/chat/type'
-import type { IpAccessScope } from '@/features/webapp-ip-access/state'
+import type { AppAccessScope } from '@/features/app-access-error/state'
 import type { VisionFile } from '@/types/app'
 import type {
   DataSourceNodeCompletedResponse,
@@ -41,11 +41,13 @@ import {
   WEB_APP_SHARE_CODE_HEADER_NAME,
 } from '@/config'
 import {
-  captureIpAccessScope,
-  handleIpAccessDenied,
-  hasIpAccessDenied,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessRequest,
+  captureAppAccessScope,
+  handleAppAccessError,
+  hasAppAccessError,
+  isAppAccessScopeCurrent,
+  throwIfAppAccessBlocked,
+} from '@/features/app-access-error/state'
 import { asyncRunSafe } from '@/utils'
 import { isClient } from '@/utils/client'
 import { resolveLoginRedirectTarget } from '@/utils/login-redirect'
@@ -62,8 +64,8 @@ import {
 
 const TIME_OUT = 100000
 
-const canRecoverWebAppAuthorization = (scope: IpAccessScope | null) =>
-  isIpAccessScopeCurrent(scope) && !hasIpAccessDenied(scope)
+const canRecoverWebAppAuthorization = (scope: AppAccessScope | null) =>
+  isAppAccessScopeCurrent(scope) && !hasAppAccessError(scope)
 
 const isWebAppAuthorizationEndpoint = (url: string) =>
   /\/(?:login(?:\/|\?|$)|passport(?:\?|$))/.test(url)
@@ -160,12 +162,34 @@ const reportStreamResponseError = async (
   }
 }
 
+const handleAppStreamResponseError = async (
+  response: Response,
+  scope: AppAccessScope | null,
+  onError: IOnError | undefined,
+  onCompleted: IOnCompleted | undefined,
+) => {
+  if (!scope) return false
+  const data = await response
+    .clone()
+    .json()
+    .catch(() => undefined)
+  if (
+    !handleAppAccessError(response.status, data, scope, response) &&
+    canRecoverWebAppAuthorization(scope)
+  )
+    return false
+  const message = typeof data?.message === 'string' ? data.message : 'App not accessible'
+  if (onError) onError(message, typeof data?.code === 'string' ? data.code : undefined)
+  else onCompleted?.(true, message)
+  return true
+}
+
 const handlePublicStreamResponseError = async (
   response: Response,
   onError: IOnError | undefined,
   onNotifyError: IOnError | undefined,
   silent: boolean | undefined,
-  ipAccessScope: IpAccessScope | null,
+  appAccessScope: AppAccessScope | null,
   onCompleted: IOnCompleted | undefined,
 ) => {
   let data: { code?: string; message?: string; reason?: string } | undefined
@@ -173,13 +197,13 @@ const handlePublicStreamResponseError = async (
     data = (await response.clone().json()) as typeof data
   } catch {}
 
-  if (data && handleIpAccessDenied(response.status, data, ipAccessScope, response)) {
+  if (data && handleAppAccessError(response.status, data, appAccessScope, response)) {
     const message = data.message || 'IP access denied'
-    if (onError) onError(message, 'ip_access_denied')
+    if (onError) onError(message, data.code)
     else onCompleted?.(true, message)
     return
   }
-  if (!canRecoverWebAppAuthorization(ipAccessScope)) {
+  if (!canRecoverWebAppAuthorization(appAccessScope)) {
     const message = data?.message || 'Server Error'
     if (onError) onError(message, typeof data?.code === 'string' ? data.code : undefined)
     else onCompleted?.(true, message)
@@ -618,7 +642,8 @@ export const upload = async (
   url?: string,
   searchParams?: string,
 ): Promise<UploadResponse> => {
-  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+  const appAccessScope = isPublicAPI ? captureAppAccessScope() : null
+  throwIfAppAccessBlocked(appAccessScope)
   const address = resolveWebAppAddress()
   const shareCode = address?.code
   const publicApiPrefix = PUBLIC_API_PREFIX
@@ -653,11 +678,11 @@ export const upload = async (
       if (xhr.readyState === 4) {
         if (xhr.status === 201) resolve(xhr.response)
         else {
-          if (handleIpAccessDenied(xhr.status, xhr.response, ipAccessScope, xhr)) {
+          if (handleAppAccessError(xhr.status, xhr.response, appAccessScope, xhr)) {
             reject(xhr)
             return
           }
-          if (isPublicAPI && !canRecoverWebAppAuthorization(ipAccessScope)) {
+          if (isPublicAPI && !canRecoverWebAppAuthorization(appAccessScope)) {
             reject(new DOMException('The upload is no longer active.', 'AbortError'))
             return
           }
@@ -722,7 +747,11 @@ export const ssePost = async (
     onUnhandledEvent,
     silent,
   } = otherOptions
-  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+  const { scope: appAccessScope } = captureAppAccessRequest(url, isPublicAPI, 'POST')
+  if (hasAppAccessError(appAccessScope)) {
+    onCompleted?.(true, 'App not accessible')
+    return
+  }
   const abortController = new AbortController()
 
   // No need to get token from localStorage, cookies will be sent automatically
@@ -757,8 +786,9 @@ export const ssePost = async (
 
   globalThis
     .fetch(urlWithPrefix, options as RequestInit)
-    .then((res) => {
+    .then(async (res) => {
       if (!/^[23]\d{2}$/.test(String(res.status))) {
+        if (await handleAppStreamResponseError(res, appAccessScope, onError, onCompleted)) return
         if (res.status === 401 || (res.status === 403 && isPublicAPI)) {
           if (isPublicAPI) {
             void handlePublicStreamResponseError(
@@ -766,7 +796,7 @@ export const ssePost = async (
               onError,
               onNotifyError,
               silent,
-              ipAccessScope,
+              appAccessScope,
               onCompleted,
             )
           } else {
@@ -891,7 +921,11 @@ export const sseGet = async (
     onUnhandledEvent,
     silent,
   } = otherOptions
-  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+  const { scope: appAccessScope } = captureAppAccessRequest(url, isPublicAPI, 'GET')
+  if (hasAppAccessError(appAccessScope)) {
+    onCompleted?.(true, 'App not accessible')
+    return
+  }
   const abortController = new AbortController()
 
   const baseOptions = getBaseOptions()
@@ -920,8 +954,9 @@ export const sseGet = async (
 
   globalThis
     .fetch(urlWithPrefix, options as RequestInit)
-    .then((res) => {
+    .then(async (res) => {
       if (!/^[23]\d{2}$/.test(String(res.status))) {
+        if (await handleAppStreamResponseError(res, appAccessScope, onError, onCompleted)) return
         if (res.status === 401 || (res.status === 403 && isPublicAPI)) {
           if (isPublicAPI) {
             void handlePublicStreamResponseError(
@@ -929,7 +964,7 @@ export const sseGet = async (
               onError,
               onNotifyError,
               silent,
-              ipAccessScope,
+              appAccessScope,
               onCompleted,
             )
           } else {
@@ -1121,13 +1156,17 @@ export const request = async <T>(url: string, options = {}, otherOptions?: IOthe
   try {
     const otherOptionsForBaseFetch = otherOptions || {}
     const { isPublicAPI = false, silent } = otherOptionsForBaseFetch
-    const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+    const { scope: appAccessScope, appIdentity } = captureAppAccessRequest(
+      url,
+      isPublicAPI,
+      otherOptions?.request?.method || (options as RequestInit).method,
+    )
     const [err, resp] = await asyncRunSafe<T>(baseFetch(url, options, otherOptionsForBaseFetch))
     if (err === null) {
       const address = resolveWebAppAddress()
       if (
         isPublicAPI &&
-        canRecoverWebAppAuthorization(ipAccessScope) &&
+        canRecoverWebAppAuthorization(appAccessScope) &&
         address?.kind === 'environment' &&
         !isWebAppAuthorizationEndpoint(url)
       )
@@ -1135,13 +1174,20 @@ export const request = async <T>(url: string, options = {}, otherOptions?: IOthe
       return resp
     }
     const errResp: Response = err as any
+    if (errResp.status === 403 || errResp.status === 404) {
+      const data = await errResp
+        .clone()
+        .json()
+        .catch(() => undefined)
+      if (handleAppAccessError(errResp.status, data, appAccessScope, errResp, appIdentity))
+        return Promise.reject(err)
+    }
     if (errResp.status === 401 || (errResp.status === 403 && isPublicAPI)) {
       if (!isClient) return Promise.reject(err)
 
       const [parseErr, errRespData] = await asyncRunSafe<ResponseError>(errResp.clone().json())
-      if (!parseErr && handleIpAccessDenied(errResp.status, errRespData, ipAccessScope, errResp))
+      if (appAccessScope && !canRecoverWebAppAuthorization(appAccessScope))
         return Promise.reject(err)
-      if (isPublicAPI && !canRecoverWebAppAuthorization(ipAccessScope)) return Promise.reject(err)
       if (parseErr) {
         if (errResp.status === 401) {
           discardRegistrationStateForConsoleAuthBoundary(otherOptionsForBaseFetch)
diff --git a/web/service/console/query-policies.ts b/web/service/console/query-policies.ts
index 35b41dd1bb06c9..46036ee649b309 100644
--- a/web/service/console/query-policies.ts
+++ b/web/service/console/query-policies.ts
@@ -8,6 +8,11 @@ import type { RouterUtils } from '@orpc/tanstack-query'
 import type { InfiniteData, QueryClient, QueryKey } from '@tanstack/react-query'
 import type { ConsoleClient } from './index'
 import { createTanstackQueryUtils } from '@orpc/tanstack-query'
+import {
+  markAppDeletionFailed,
+  markAppDeletionStarted,
+  markAppDeletionSucceeded,
+} from '../app-deletion'
 
 export function createConsoleQuery(consoleClient: ConsoleClient) {
   const consoleQuery: RouterUtils<ConsoleClient> = createTanstackQueryUtils(consoleClient, {
@@ -626,7 +631,14 @@ export function createConsoleQuery(consoleClient: ConsoleClient) {
           },
           delete: {
             mutationOptions: {
+              onMutate: (variables) => {
+                markAppDeletionStarted(`installed:${variables.params.installed_app_id}`)
+              },
+              onError: (_error, variables) => {
+                markAppDeletionFailed(`installed:${variables.params.installed_app_id}`)
+              },
               onSuccess: (_response, variables, _onMutateResult, context) => {
+                markAppDeletionSucceeded(`installed:${variables.params.installed_app_id}`)
                 context.client.removeQueries({
                   queryKey: consoleQuery.installedApps.byInstalledAppId.get.queryKey({
                     input: {
@@ -836,7 +848,14 @@ export function createConsoleQuery(consoleClient: ConsoleClient) {
           },
           delete: {
             mutationOptions: {
+              onMutate: (variables) => {
+                markAppDeletionStarted(`agent:${variables.params.agent_id}`)
+              },
+              onError: (_error, variables) => {
+                markAppDeletionFailed(`agent:${variables.params.agent_id}`)
+              },
               onSuccess: (_data, variables, _onMutateResult, context) => {
+                markAppDeletionSucceeded(`agent:${variables.params.agent_id}`)
                 context.client.removeQueries({
                   queryKey: consoleQuery.agent.byAgentId.key({
                     input: {
diff --git a/web/service/fetch.ts b/web/service/fetch.ts
index bd24aa56235b7b..03921ff2244c05 100644
--- a/web/service/fetch.ts
+++ b/web/service/fetch.ts
@@ -1,6 +1,6 @@
 import type { AfterResponseHook, BeforeRequestHook, Hooks } from 'ky'
 import type { IOtherOptions } from './base'
-import type { IpAccessScope } from '@/features/webapp-ip-access/state'
+import type { AppAccessScope } from '@/features/app-access-error/state'
 import Cookies from 'js-cookie'
 import ky, { HTTPError } from 'ky'
 import {
@@ -15,11 +15,12 @@ import {
   WEB_APP_SHARE_CODE_HEADER_NAME,
 } from '@/config'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessDeniedResponse,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessRequest,
+  hasAppAccessError,
+  isAppAccessErrorResponse,
+  isAppAccessScopeCurrent,
+  throwIfAppAccessBlocked,
+} from '@/features/app-access-error/state'
 import { shouldSuppressAppDeletionErrorToast } from './app-deletion'
 import { clearRequestErrorToasts, notifyRequestError } from './request-error-toast'
 import { getWebAppPublicApiPath, resolveWebAppAddress } from './webapp-address'
@@ -79,7 +80,8 @@ const createResponseFromHTTPError = (error: HTTPError): Response => {
 
 const afterResponseErrorCode = (
   otherOptions: IOtherOptions,
-  ipAccessScope: IpAccessScope | null,
+  appAccessScope: AppAccessScope | null,
+  appIdentity: boolean,
 ): AfterResponseHook => {
   return async ({ request, response }) => {
     if (!/^[23]\d{2}$/.test(String(response.status))) {
@@ -93,10 +95,14 @@ const afterResponseErrorCode = (
         errorData &&
         !otherOptions.silent &&
         !(
-          ipAccessScope &&
-          (!isIpAccessScopeCurrent(ipAccessScope) || hasIpAccessDenied(ipAccessScope))
+          appAccessScope &&
+          (!isAppAccessScopeCurrent(appAccessScope) || hasAppAccessError(appAccessScope))
+        ) &&
+        !(
+          appAccessScope &&
+          (response.status !== 404 || !appAccessScope.key.startsWith('form:')) &&
+          isAppAccessErrorResponse(response.status, errorData, appIdentity)
         ) &&
-        !(ipAccessScope && isIpAccessDeniedResponse(response.status, errorData)) &&
         !shouldSuppressAppDeletionErrorToast(request.url, response.status)
 
       const errorMessage = errorData?.message || errorData?.error
@@ -174,7 +180,12 @@ async function base<T>(
     fetchCompat = false,
     request,
   } = otherOptions
-  const ipAccessScope = isPublicAPI ? captureIpAccessScope() : null
+  const { scope: appAccessScope, appIdentity } = captureAppAccessRequest(
+    url,
+    isPublicAPI,
+    request?.method || init.method,
+  )
+  throwIfAppAccessBlocked(appAccessScope)
 
   const headers = new Headers(headersFromProps || {})
 
@@ -208,7 +219,7 @@ async function base<T>(
       ].filter((h): h is BeforeRequestHook => Boolean(h)),
       afterResponse: [
         ...(baseHooks.afterResponse || []),
-        afterResponseErrorCode(otherOptions, ipAccessScope),
+        afterResponseErrorCode(otherOptions, appAccessScope, appIdentity),
       ],
     },
   })
diff --git a/web/service/share.ts b/web/service/share.ts
index a4a4e06b7093ff..bace673f5b101e 100644
--- a/web/service/share.ts
+++ b/web/service/share.ts
@@ -6,11 +6,11 @@ import type { AccessMode } from '@/models/access-control'
 import type { AppConversationData, AppData, AppMeta, ConversationItem } from '@/models/share'
 import { WEB_APP_SHARE_CODE_HEADER_NAME } from '@/config'
 import {
-  captureIpAccessScope,
-  hasIpAccessDenied,
-  isIpAccessDeniedError,
-  isIpAccessScopeCurrent,
-} from '@/features/webapp-ip-access/state'
+  captureAppAccessScope,
+  hasAppAccessError,
+  isAppAccessError,
+  isAppAccessScopeCurrent,
+} from '@/features/app-access-error/state'
 import {
   del as consoleDel,
   get as consoleGet,
@@ -528,9 +528,9 @@ const uploadHumanInputFormFile = async (
   formData: FormData,
   onProgress?: (e: ProgressEvent) => void,
 ) => {
-  const scope = captureIpAccessScope()
+  const scope = captureAppAccessScope()
   const ensureCanUpload = () => {
-    if (!isIpAccessScopeCurrent(scope) || hasIpAccessDenied(scope))
+    if (!isAppAccessScopeCurrent(scope) || hasAppAccessError(scope))
       throw new DOMException('The form upload is no longer active.', 'AbortError')
   }
   ensureCanUpload()
@@ -539,7 +539,7 @@ const uploadHumanInputFormFile = async (
   try {
     uploadToken = await getHumanInputFormUploadToken(formToken)
   } catch (error) {
-    if (!isIpAccessDeniedError(error)) ensureCanUpload()
+    if (!isAppAccessError(error)) ensureCanUpload()
     throw error
   }
   ensureCanUpload()

From c1944ca09ab630c424023f00278a005078dcd864 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:05:04 +0800
Subject: [PATCH 042/108] fix(web): align IP access control copy with product
 specification

---
 .../__tests__/config-panel.spec.tsx           |  89 +++++++++---
 .../access-control/__tests__/index.spec.tsx   |  74 +++-------
 .../access-control/chip-affix.tsx             |   2 +-
 .../access-control/config-panel.tsx           |  37 ++++-
 .../app/access-point/access-control/index.tsx |   4 +-
 .../access-control/policy-field.tsx           | 128 ++++++++++--------
 .../access-control/status-panel.tsx           |   4 +-
 .../ip-policies-page/__tests__/index.spec.tsx |  71 +++-------
 .../ip-policies-page/policy-dialog.tsx        |   3 +
 .../ip-policies-page/policy-item.tsx          |  57 ++++----
 web/i18n/ar-TN/common.json                    |  13 +-
 web/i18n/ar-TN/deployments.json               |   9 +-
 web/i18n/de-DE/common.json                    |  13 +-
 web/i18n/de-DE/deployments.json               |   9 +-
 web/i18n/en-US/common.json                    |  17 +--
 web/i18n/en-US/deployments.json               |  15 +-
 web/i18n/es-ES/common.json                    |  13 +-
 web/i18n/es-ES/deployments.json               |   9 +-
 web/i18n/fa-IR/common.json                    |  13 +-
 web/i18n/fa-IR/deployments.json               |   9 +-
 web/i18n/fr-FR/common.json                    |  13 +-
 web/i18n/fr-FR/deployments.json               |   9 +-
 web/i18n/hi-IN/common.json                    |  13 +-
 web/i18n/hi-IN/deployments.json               |   9 +-
 web/i18n/id-ID/common.json                    |  13 +-
 web/i18n/id-ID/deployments.json               |   9 +-
 web/i18n/it-IT/common.json                    |  13 +-
 web/i18n/it-IT/deployments.json               |   9 +-
 web/i18n/ja-JP/common.json                    |  23 ++--
 web/i18n/ja-JP/deployments.json               |  17 ++-
 web/i18n/ko-KR/common.json                    |  13 +-
 web/i18n/ko-KR/deployments.json               |   9 +-
 web/i18n/lo-LA/common.json                    |  13 +-
 web/i18n/lo-LA/deployments.json               |   9 +-
 web/i18n/nl-NL/common.json                    |  13 +-
 web/i18n/nl-NL/deployments.json               |   9 +-
 web/i18n/pl-PL/common.json                    |  13 +-
 web/i18n/pl-PL/deployments.json               |   9 +-
 web/i18n/pt-BR/common.json                    |  13 +-
 web/i18n/pt-BR/deployments.json               |   9 +-
 web/i18n/ro-RO/common.json                    |  13 +-
 web/i18n/ro-RO/deployments.json               |   9 +-
 web/i18n/ru-RU/common.json                    |  13 +-
 web/i18n/ru-RU/deployments.json               |   9 +-
 web/i18n/sl-SI/common.json                    |  13 +-
 web/i18n/sl-SI/deployments.json               |   9 +-
 web/i18n/th-TH/common.json                    |  13 +-
 web/i18n/th-TH/deployments.json               |   9 +-
 web/i18n/tr-TR/common.json                    |  13 +-
 web/i18n/tr-TR/deployments.json               |   9 +-
 web/i18n/uk-UA/common.json                    |  13 +-
 web/i18n/uk-UA/deployments.json               |   9 +-
 web/i18n/vi-VN/common.json                    |  13 +-
 web/i18n/vi-VN/deployments.json               |   9 +-
 web/i18n/zh-Hans/agent-v-2.json               |   6 +-
 web/i18n/zh-Hans/common.json                  |  25 ++--
 web/i18n/zh-Hans/deployments.json             |  33 +++--
 web/i18n/zh-Hans/permission-keys.json         |   8 +-
 web/i18n/zh-Hant/common.json                  |  13 +-
 web/i18n/zh-Hant/deployments.json             |   9 +-
 60 files changed, 595 insertions(+), 480 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index b6782ac2a97955..e17b601a4753cc 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -29,39 +29,33 @@ const translations = vi.hoisted(() => ({
   'mcp.server.title': 'MCP Server',
   'settings.ipPolicies': 'IP Policies',
   'settings.trigger': 'Trigger',
-  'studio.accessControl.addressCount': '{{count}} addresses',
-  'studio.accessControl.applyTo': 'Apply to',
-  'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
-  'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
-  'studio.accessControl.entryLabel': 'Access Control',
-  'studio.accessControl.ipPolicy': 'IP Policy',
-  'studio.accessControl.lockoutWarning':
-    "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  'studio.accessControl.manageIpPolicies': 'Manage IP policies',
-  'studio.accessControl.policySummaryMany': 'Allows {{listed}} and {{count}} more addresses',
-  'studio.accessControl.policySummaryOne': 'Allows {{address}}',
-  'studio.accessControl.selectAccessPoint': 'Select at least one access point to protect.',
-  'studio.accessControl.selectPolicy': 'Select a policy',
 }))
 
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  return createReactI18nextMock(translations)
+  const { default: deploymentTranslations } = await import('@/i18n/en-US/deployments.json')
+  return createReactI18nextMock({ ...translations, ...deploymentTranslations })
 })
 
 function PanelHarness({
   currentIp,
   initialDraft = createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
   onSave = vi.fn(),
+  onCreatePolicy = vi.fn(),
+  onManagePolicies = vi.fn(),
+  canManagePolicies = true,
+  readOnly = false,
 }: {
   currentIp?: string
   initialDraft?: AccessControlDraft
   onSave?: () => void
+  onCreatePolicy?: () => void
+  onManagePolicies?: () => void
+  canManagePolicies?: boolean
+  readOnly?: boolean
 }) {
   const [draft, setDraft] = useState(initialDraft)
   const onCancel = vi.fn()
-  const onCreatePolicy = vi.fn()
-  const onManagePolicies = vi.fn()
 
   return (
     <Popover open>
@@ -71,7 +65,8 @@ function PanelHarness({
           draft={draft}
           availableAccessPoints={ACCESS_POINT_ORDER}
           appIcon={{}}
-          canManagePolicies
+          canManagePolicies={canManagePolicies}
+          readOnly={readOnly}
           policies={policies}
           currentIp={currentIp}
           onCancel={onCancel}
@@ -90,6 +85,9 @@ describe('AccessControlConfigPanel', () => {
     render(<PanelHarness />)
 
     expect(await screen.findByRole('option', { name: /Internal Network/ })).toBeInTheDocument()
+    expect(screen.getByRole('group', { name: 'IP Policy' })).toHaveAccessibleDescription(
+      'Please select an IP policy.',
+    )
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
     expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
       'aria-disabled',
@@ -116,6 +114,7 @@ describe('AccessControlConfigPanel', () => {
 
     await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
 
+    expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
     expect(
       screen.getByText('Allows 203.0.113.42/32, 198.51.100.0/24 and 2 more addresses'),
     ).toBeInTheDocument()
@@ -129,6 +128,60 @@ describe('AccessControlConfigPanel', () => {
     expect(onSave).toHaveBeenCalledTimes(1)
   })
 
+  it.each([null, 'internal-network'])(
+    'opens policy creation from the policy list with selected policy %s',
+    async (selectedPolicyId) => {
+      const user = userEvent.setup()
+      const onCreatePolicy = vi.fn()
+      const onManagePolicies = vi.fn()
+      render(
+        <PanelHarness
+          initialDraft={{
+            ...createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
+            selectedPolicyId,
+          }}
+          onCreatePolicy={onCreatePolicy}
+          onManagePolicies={onManagePolicies}
+        />,
+      )
+
+      if (selectedPolicyId) {
+        await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+        await user.click(await screen.findByRole('option', { name: 'Add IP Policy' }))
+      } else {
+        await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
+      }
+
+      expect(onCreatePolicy).toHaveBeenCalledOnce()
+      expect(onManagePolicies).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each([{ canManagePolicies: false }, { readOnly: true }])(
+    'keeps policy creation unavailable without edit permission: %j',
+    (permissions) => {
+      render(<PanelHarness {...permissions} />)
+
+      expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Manage IP policies' })).toBeEnabled()
+    },
+  )
+
+  it('hides required-selection messages while access control is disabled', () => {
+    render(
+      <PanelHarness
+        initialDraft={{
+          enabled: false,
+          selectedPolicyId: null,
+          scopes: { webApp: false, serviceApi: false, mcp: false, trigger: false },
+        }}
+      />,
+    )
+
+    expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
+    expect(screen.queryByText('Please choose at least one access point.')).not.toBeInTheDocument()
+  })
+
   it('warns and disables save when every access point is off', async () => {
     const user = userEvent.setup()
     render(<PanelHarness />)
@@ -139,7 +192,7 @@ describe('AccessControlConfigPanel', () => {
     await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
     await user.click(screen.getByRole('switch', { name: 'Trigger' }))
 
-    expect(screen.getByText('Select at least one access point to protect.')).toBeInTheDocument()
+    expect(screen.getByText('Please choose at least one access point.')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
 
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 433b3dc6185c62..922742844ab43f 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -41,44 +41,7 @@ const accessControlTranslations = vi.hoisted(() => ({
   'settings.ipPolicyNewTitle': 'New IP Policy',
   'settings.ipPolicyRemoveEntry': 'Remove entry',
   'settings.trigger': 'Trigger',
-  'studio.accessControl.addressCount': '{{count}} addresses',
-  'studio.accessControl.applyTo': 'Apply to',
-  'studio.accessControl.applyToHelp': 'Choose which access points to protect.',
-  'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.',
-  'studio.accessControl.createIpPolicy': 'Create an IP policy',
-  'studio.accessControl.downgradeDescription': 'Access control needs the Pro plan.',
-  'studio.accessControl.downgradeTitle': 'This app is no longer protected',
-  'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
-  'studio.accessControl.chipOff': 'Off',
-  'studio.accessControl.chipOn': 'ON',
-  'studio.accessControl.chipPartial': '{{n}} of {{m}}',
-  'studio.accessControl.entryLabel': 'Access Control',
-  'studio.accessControl.ipPolicy': 'IP Policy',
-  'studio.accessControl.manageIpPolicies': 'Manage IP policies',
-  'studio.accessControl.notEnabled': 'Not enabled',
-  'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.',
-  'studio.accessControl.paywallTitle': 'Access Control',
-  'studio.accessControl.policySummaryOne': 'Allows {{address}}',
-  'studio.accessControl.previewAppName': 'Code Companion',
-  'studio.accessControl.previewCaption':
-    "This app is only available on your organization's network.",
-  'studio.accessControl.proBadge': 'PRO',
-  'studio.accessControl.protectsCoverage': 'Protects {{n}} of {{m}} access points',
-  'studio.accessControl.readyToResume': 'Ready to resume',
-  'studio.accessControl.selectPolicy': 'Select a policy',
-  'studio.accessControl.tooltipOff': 'Not set up',
-  'studio.accessControl.tooltipPro': 'Access control requires the Pro plan',
-  'studio.accessControl.turnOn': 'Turn on Access Control',
-  'studio.accessControl.restrictByIp': 'Restrict by IP address',
-  'studio.accessControl.restrictedTo': 'Restricted to {{name}}',
-  'studio.accessControl.excluded': 'Excluded',
-  'studio.accessControl.protectingAll': 'Protecting all {{count}} access points in service.',
-  'studio.accessControl.protectingPartial': 'Protecting {{n}} of {{m}} access points in service.',
-  'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
   'operation.edit': 'Edit',
-  'studio.accessControl.turnOffTitle': 'Turn off access control?',
-  'studio.accessControl.turnOffDescription': '{{points}} will be reachable from any IP.',
-  'studio.accessControl.turnOffConfirm': 'Turn off',
 }))
 
 vi.mock('nuqs', async (importOriginal) => {
@@ -94,7 +57,8 @@ vi.mock('nuqs', async (importOriginal) => {
 
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  return createReactI18nextMock(accessControlTranslations)
+  const { default: deploymentTranslations } = await import('@/i18n/en-US/deployments.json')
+  return createReactI18nextMock({ ...accessControlTranslations, ...deploymentTranslations })
 })
 
 const renderEntry = ({
@@ -186,7 +150,7 @@ describe('AccessControlEntry', () => {
     expect(screen.getByText('Protects 3 of 3 access points')).toBeInTheDocument()
     expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
-    expect(screen.queryByRole('switch', { name: 'Restrict by IP address' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('switch', { name: 'Enable access control' })).not.toBeInTheDocument()
 
     await user.click(screen.getByRole('button', { name: 'Turn on Access Control' }))
     expect(mockSetPricing).toHaveBeenCalledWith('open')
@@ -284,7 +248,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
 
     expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
     expect(mockSetSettingsDestination).not.toHaveBeenCalled()
@@ -295,7 +259,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
     await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Cancel' }))
 
     await waitFor(() => {
@@ -330,7 +294,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
     await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
     await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
     await user.click(screen.getByRole('button', { name: 'Create' }))
@@ -397,7 +361,7 @@ describe('AccessControlEntry', () => {
     expect(within(getChip()).getByText('ON')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
   })
 
   it('keeps the saved chip state until a turned-off draft is saved', async () => {
@@ -419,7 +383,7 @@ describe('AccessControlEntry', () => {
     })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
     await user.click(screen.getByRole('button', { name: 'Turn off' }))
 
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
@@ -626,7 +590,7 @@ describe('AccessControlEntry', () => {
     })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
     await user.click(screen.getByRole('button', { name: 'Turn off' }))
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
 
@@ -769,7 +733,7 @@ describe('supported access points and binding permission', () => {
     const user = userEvent.setup()
     const { unmount } = renderEntry({ plan: 'professional', role: 'editor' })
     await user.click(getChip())
-    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
     await user.click(screen.getByRole('button', { name: 'Manage IP policies' }))
     expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
     unmount()
@@ -832,7 +796,7 @@ describe('supported access points and binding permission', () => {
     try {
       renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()], binding })
       await user.click(getChip())
-      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
       expect(screen.getByRole('alertdialog')).toHaveTextContent(
         'Web App, MCP Server will be reachable from any IP.',
       )
@@ -851,8 +815,8 @@ describe('supported access points and binding permission', () => {
       await waitFor(() =>
         expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
       )
-      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
-      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      expect(screen.getByRole('switch', { name: 'Enable access control' })).not.toBeChecked()
+      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
       await user.click(screen.getByRole('button', { name: 'Save' }))
       await waitFor(() => expect(payloads).toHaveLength(2))
       expect(payloads[1]).toEqual({
@@ -881,7 +845,7 @@ describe('supported access points and binding permission', () => {
       })
       await user.click(getChip())
       expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
-      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
+      expect(screen.getByRole('switch', { name: 'Enable access control' })).toHaveAttribute(
         'aria-disabled',
         'true',
       )
@@ -891,7 +855,7 @@ describe('supported access points and binding permission', () => {
       expect(
         screen.queryByRole('button', { name: 'Turn on Access Control' }),
       ).not.toBeInTheDocument()
-      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
       expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
       expect(fetchSpy).not.toHaveBeenCalled()
     } finally {
@@ -923,7 +887,7 @@ describe('supported access points and binding permission', () => {
     expect(screen.getByText('Protecting all 3 access points in service.')).toBeInTheDocument()
     expect(screen.queryByText('Office')).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Enable access control' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
@@ -948,19 +912,19 @@ describe('supported access points and binding permission', () => {
       binding: createBinding(),
     })
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
     expect(screen.getByRole('alertdialog')).toBeInTheDocument()
 
     rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={false} />)
     await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
     await user.click(getChip())
-    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
 
     rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />)
     await user.click(getChip())
     expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
   })
 
diff --git a/web/app/components/app/access-point/access-control/chip-affix.tsx b/web/app/components/app/access-point/access-control/chip-affix.tsx
index 842f72ea1c1d3d..614d34f0264453 100644
--- a/web/app/components/app/access-point/access-control/chip-affix.tsx
+++ b/web/app/components/app/access-point/access-control/chip-affix.tsx
@@ -53,7 +53,7 @@ export function AccessControlChipAffix({
             status={kind === 'off' ? 'disabled' : kind === 'paused' ? 'warning' : 'success'}
           />
         </span>
-        <span className="system-xs-semibold text-text-tertiary uppercase">{statusLabel}</span>
+        <span className="system-xs-semibold text-text-tertiary">{statusLabel}</span>
       </span>
     </>
   )
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 716cb7008b6610..a22cdcc458691f 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -8,7 +8,8 @@ import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
-import { PopoverTitle } from '@langgenius/dify-ui/popover'
+import { PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
+import { useId } from 'react'
 import { useTranslation } from 'react-i18next'
 import { canSaveAccessControl, hasSelectedAccessPoint } from './draft'
 import { AccessControlPolicyField } from './policy-field'
@@ -52,9 +53,13 @@ export function AccessControlConfigPanel({
   onSave,
 }: AccessControlConfigPanelProps) {
   const { t } = useTranslation()
+  const policyErrorId = useId()
+  const accessPointErrorId = useId()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
   const hasPersistableSelection = hasSelectedAccessPoint(draft, availableAccessPoints)
+  const showPolicyError = draft.enabled && !hasSelectedPolicy
+  const showAccessPointError = draft.enabled && !hasPersistableSelection
   const canSave = !readOnly && canSaveAccessControl({ draft, baseline, availableAccessPoints })
 
   const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
@@ -84,11 +89,25 @@ export function AccessControlConfigPanel({
           <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
             {title}
           </PopoverTitle>
+          <IconButton
+            type="button"
+            size="lg"
+            aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+            onClick={onCancel}
+          >
+            <span aria-hidden className="i-ri-close-line size-4" />
+          </IconButton>
         </div>
       </div>
+      <PopoverDescription className="px-4 pb-2 system-sm-regular text-text-tertiary">
+        {t(($) => $['studio.accessControl.description'], { ns: 'deployments' })}
+      </PopoverDescription>
 
       <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
-        <Fieldset className="flex w-full flex-col gap-1">
+        <Fieldset
+          className="flex w-full flex-col gap-1"
+          aria-describedby={showPolicyError ? policyErrorId : undefined}
+        >
           <FieldsetLegend className="mb-0 py-0">
             {t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })}
           </FieldsetLegend>
@@ -105,9 +124,17 @@ export function AccessControlConfigPanel({
               onDraftChange({ ...draft, selectedPolicyId: policyId })
             }}
           />
+          {showPolicyError && (
+            <p id={policyErrorId} className="system-xs-regular text-text-warning">
+              {t(($) => $['studio.accessControl.selectPolicyRequired'], { ns: 'deployments' })}
+            </p>
+          )}
         </Fieldset>
 
-        <Fieldset className="flex w-full flex-col gap-1">
+        <Fieldset
+          className="flex w-full flex-col gap-1"
+          aria-describedby={showAccessPointError ? accessPointErrorId : undefined}
+        >
           <FieldsetLegend className="mb-0 py-0">
             {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
           </FieldsetLegend>
@@ -123,8 +150,8 @@ export function AccessControlConfigPanel({
             readOnly={readOnly}
             onDraftChange={onDraftChange}
           />
-          {hasSelectedPolicy && draft.enabled && !hasPersistableSelection && (
-            <p className="system-xs-regular text-text-warning">
+          {showAccessPointError && (
+            <p id={accessPointErrorId} className="system-xs-regular text-text-warning">
               {t(($) => $['studio.accessControl.selectAccessPoint'], { ns: 'deployments' })}
             </p>
           )}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index fc5bba54ddcb70..a3ead66883ae32 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -154,14 +154,12 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
         : chip.kind === 'on'
           ? t(($) => $['studio.accessControl.tooltipOn'], {
               ns: 'deployments',
-              name: chip.policyName ?? '',
             })
           : chip.kind === 'partial'
             ? t(($) => $['studio.accessControl.tooltipPartial'], {
                 ns: 'deployments',
-                name: chip.policyName ?? '',
                 n: chip.coveredCount,
-                m: chip.inServiceCount,
+                total: chip.inServiceCount,
               })
             : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 56223105522dab..6805384df2c3f8 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -14,13 +14,14 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@langgenius/dify-ui/select'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useTranslation } from 'react-i18next'
 import {
   policyIncludesIp,
   splitPolicySummary,
 } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 
-const MANAGE_POLICIES_VALUE = '__manage-ip-policies__'
+const CREATE_POLICY_VALUE = '__create-ip-policy__'
 
 type AccessControlPolicyFieldProps = {
   policies: readonly AccessControlPolicy[]
@@ -53,6 +54,20 @@ export function AccessControlPolicyField({
     !policyIncludesIp(selectedPolicy.allowed_cidrs, currentIp)
   const selectLabel = t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })
   const placeholder = t(($) => $['studio.accessControl.selectPolicy'], { ns: 'deployments' })
+  const canCreatePolicy = canManagePolicies && !readOnly
+  const manageLabel = t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })
+  const manageButton = (
+    <Tooltip>
+      <TooltipTrigger
+        render={
+          <IconButton type="button" size="lg" aria-label={manageLabel} onClick={onManagePolicies}>
+            <span aria-hidden className="i-ri-equalizer-2-line size-4" />
+          </IconButton>
+        }
+      />
+      <TooltipContent>{manageLabel}</TooltipContent>
+    </Tooltip>
+  )
 
   if (policies.length === 0) {
     return (
@@ -60,7 +75,7 @@ export function AccessControlPolicyField({
         <p className="w-full text-center system-sm-medium text-text-secondary">
           {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
         </p>
-        {canManagePolicies && !readOnly ? (
+        {canCreatePolicy ? (
           <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
             {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
           </Button>
@@ -87,12 +102,16 @@ export function AccessControlPolicyField({
           <SelectItemIndicator />
         </SelectItem>
       ))}
-      <SelectSeparator />
-      <SelectItem value={MANAGE_POLICIES_VALUE}>
-        <SelectItemText>
-          {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
-        </SelectItemText>
-      </SelectItem>
+      {canCreatePolicy && (
+        <>
+          <SelectSeparator />
+          <SelectItem value={CREATE_POLICY_VALUE}>
+            <SelectItemText>
+              {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
+            </SelectItemText>
+          </SelectItem>
+        </>
+      )}
     </>
   )
 
@@ -114,50 +133,45 @@ export function AccessControlPolicyField({
               className="i-ri-arrow-down-s-line size-4 shrink-0 text-text-quaternary"
             />
           </div>
-          <IconButton
-            size="lg"
-            aria-label={t(($) => $['settings.ipPolicies'], { ns: 'common' })}
-            onClick={onManagePolicies}
-          >
-            <span aria-hidden className="i-ri-equalizer-2-line size-4" />
-          </IconButton>
+          {manageButton}
         </div>
-        <div
-          role="listbox"
-          aria-label={selectLabel}
-          className="rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg p-1 shadow-xs"
-        >
-          {policies.map((policy) => (
-            <button
-              key={policy.id}
-              type="button"
-              role="option"
-              aria-selected={false}
-              disabled={readOnly}
-              className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-              onClick={() => {
-                if (!readOnly) onSelectPolicy(policy.id)
-              }}
-            >
-              <span className="min-w-0 flex-1 truncate px-1">{policy.name}</span>
-              <span className="shrink-0 system-xs-regular text-text-tertiary">
-                {t(($) => $['studio.accessControl.addressCount'], {
-                  ns: 'deployments',
-                  count: policy.allowed_cidrs.length,
-                })}
-              </span>
-            </button>
-          ))}
-          <div className="my-1 h-px bg-divider-subtle" />
-          <button
-            type="button"
-            className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
-            onClick={onManagePolicies}
-          >
-            <span className="px-1">
-              {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
-            </span>
-          </button>
+        <div className="rounded-xl border-[0.5px] border-components-panel-border bg-components-panel-bg p-1 shadow-xs">
+          <div role="listbox" aria-label={selectLabel}>
+            {policies.map((policy) => (
+              <button
+                key={policy.id}
+                type="button"
+                role="option"
+                aria-selected={false}
+                disabled={readOnly}
+                className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+                onClick={() => {
+                  if (!readOnly) onSelectPolicy(policy.id)
+                }}
+              >
+                <span className="min-w-0 flex-1 truncate px-1">{policy.name}</span>
+                <span className="shrink-0 system-xs-regular text-text-tertiary">
+                  {t(($) => $['studio.accessControl.addressCount'], {
+                    ns: 'deployments',
+                    count: policy.allowed_cidrs.length,
+                  })}
+                </span>
+              </button>
+            ))}
+          </div>
+          {canCreatePolicy && (
+            <>
+              <div className="my-1 h-px bg-divider-subtle" />
+              <Button
+                type="button"
+                variant="ghost"
+                className="w-full justify-start"
+                onClick={onCreatePolicy}
+              >
+                {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
+              </Button>
+            </>
+          )}
         </div>
       </div>
     )
@@ -171,8 +185,8 @@ export function AccessControlPolicyField({
           disabled={readOnly}
           onValueChange={(value) => {
             if (readOnly) return
-            if (value === MANAGE_POLICIES_VALUE) {
-              onManagePolicies()
+            if (value === CREATE_POLICY_VALUE) {
+              if (canCreatePolicy) onCreatePolicy()
               return
             }
             if (value) onSelectPolicy(value)
@@ -187,13 +201,7 @@ export function AccessControlPolicyField({
             {policyOptions}
           </SelectContent>
         </Select>
-        <IconButton
-          size="lg"
-          aria-label={t(($) => $['settings.ipPolicies'], { ns: 'common' })}
-          onClick={onManagePolicies}
-        >
-          <span aria-hidden className="i-ri-equalizer-2-line size-4" />
-        </IconButton>
+        {manageButton}
       </div>
       {summary && (
         <p className="system-xs-regular text-text-tertiary">
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index ede80770a31a80..2617fe8fbfc322 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -115,7 +115,9 @@ export function AccessControlStatusPanel({
           <Switch
             checked={enabled}
             disabled={updating || readOnly}
-            aria-label={t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
+            aria-label={t(($) => $['studio.accessControl.enableAccessControl'], {
+              ns: 'deployments',
+            })}
             onCheckedChange={(next) => {
               if (readOnly || updating) return
               if (next) {
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 61b38166cc6910..c5bf41554886fe 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -3,6 +3,8 @@ import userEvent from '@testing-library/user-event'
 import { createInstance } from 'i18next'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { initReactI18next } from 'react-i18next'
+import commonTranslations from '@/i18n/en-US/common.json'
+import deploymentTranslations from '@/i18n/en-US/deployments.json'
 import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
 import {
   createNetworkAccessGroupFixture,
@@ -11,47 +13,6 @@ import {
 import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
 import IpPoliciesPage from '..'
 
-const translations = vi.hoisted(() => ({
-  'operation.cancel': 'Cancel',
-  'operation.close': 'Close',
-  'operation.delete': 'Delete',
-  'operation.edit': 'Edit',
-  'operation.moreActionsFor': 'More actions for {{name}}',
-  'operation.save': 'Save',
-  'settings.ipPolicies': 'IP Policies',
-  'settings.ipPoliciesDescription':
-    'Reusable rules that control which IP addresses or ranges can access your apps',
-  'settings.ipPolicyAddEntry': 'Add',
-  'settings.ipPolicyAllowlist': 'Allowlist',
-  'settings.ipPolicyAllowlistHelp':
-    'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
-  'settings.ipPolicyColumnEnforcing': 'Enforcing',
-  'settings.ipPolicyColumnIpEntries': 'IP entries',
-  'settings.ipPolicyColumnName': 'Name',
-  'settings.ipPolicyColumnUpdatedAt': 'Updated at',
-  'settings.ipPolicyCreate': 'Create',
-  'settings.ipPolicyEnforcingMany': '{{count}} apps',
-  'settings.ipPolicyEnforcingNone': '0 apps',
-  'settings.ipPolicyEnforcingOne': '1 app',
-  'settings.ipPolicyDeleteBound': 'This policy is in use',
-  'settings.ipPolicyDeleteBoundDescription':
-    'Delete <policyName>{{name}}</policyName>? These apps will allow access from any IP address. This cannot be undone.',
-  'settings.ipPolicyDeleteConfirm': 'Delete IP policy?',
-  'settings.ipPolicyDeleteDescription':
-    'Delete <policyName>{{name}}</policyName>? This cannot be undone.',
-  'settings.ipPolicyUsedBy': 'Used by {{count}} apps',
-  'settings.ipPolicyUsedByLabel': 'Used by',
-  'settings.ipPolicyDialogDescription':
-    'Specify which IP addresses or ranges can access your apps.',
-  'settings.ipPolicyEditTitle': 'Edit IP Policy',
-  'settings.ipPolicyName': 'Name',
-  'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
-  'settings.ipPolicyNewTitle': 'New IP Policy',
-  'settings.ipPolicyRemoveEntry': 'Remove entry',
-  'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet',
-  'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}',
-}))
-
 vi.unmock('react-i18next')
 
 describe('IpPoliciesPage', () => {
@@ -65,7 +26,7 @@ describe('IpPoliciesPage', () => {
         defaultNS: 'common',
         keySeparator: false,
         interpolation: { escapeValue: false },
-        resources: { 'en-US': { common: translations, deployments: translations } },
+        resources: { 'en-US': { common: commonTranslations, deployments: deploymentTranslations } },
       })
   })
 
@@ -349,8 +310,8 @@ describe('IpPoliciesPage', () => {
 
     expect(screen.getByText('Internal Network')).toBeInTheDocument()
     expect(screen.getByText('Name')).toBeInTheDocument()
-    expect(screen.getByText('IP entries')).toBeInTheDocument()
-    expect(screen.getByText('Enforcing')).toBeInTheDocument()
+    expect(screen.getByText('IP Entries')).toBeInTheDocument()
+    expect(screen.getByText('Used by')).toBeInTheDocument()
     expect(screen.getByText('2')).toBeInTheDocument()
     expect(screen.getByText('0 apps')).toBeInTheDocument()
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
@@ -398,7 +359,10 @@ describe('IpPoliciesPage', () => {
 
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
     await user.click(screen.getByRole('menuitem', { name: 'Edit' }))
-    expect(screen.getByText('Used by')).toBeInTheDocument()
+    expect(within(screen.getByRole('dialog')).getByText('Used by')).toBeInTheDocument()
+    expect(
+      screen.getByText('Changes take effect immediately wherever this policy is applied.'),
+    ).toBeInTheDocument()
     expect(screen.getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
       'href',
       '/app/app-a/overview',
@@ -445,12 +409,11 @@ describe('IpPoliciesPage', () => {
 
     await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
     await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
-    const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
+    const dialog = screen.getByRole('alertdialog', { name: 'Delete “Internal Network”?' })
     expect(dialog).toHaveAccessibleDescription(
-      /Delete Internal Network\s*\? These apps will allow access from any IP address\. This cannot be undone\./,
+      'Apps using this policy will become accessible from any IP address. This can’t be undone.',
     )
-    expect(within(dialog).getByText('Internal Network', { selector: 'strong' })).toBeInTheDocument()
-    expect(within(dialog).getByText('Used by 2 apps')).toBeInTheDocument()
+    expect(within(dialog).getByText('Still used by 2 apps')).toBeInTheDocument()
     expect(globalThis.fetch).not.toHaveBeenCalled()
     expect(within(dialog).getByRole('button', { name: 'Delete' })).toBeEnabled()
     expect(within(dialog).getByRole('link', { name: 'Support Bot' })).toHaveAttribute(
@@ -474,11 +437,9 @@ describe('IpPoliciesPage', () => {
 
       await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
       await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
-      const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
-      expect(dialog).toHaveAccessibleDescription(
-        /Delete Internal Network\s*\? This cannot be undone\./,
-      )
-      expect(within(dialog).queryByText(/Used by/)).not.toBeInTheDocument()
+      const dialog = screen.getByRole('alertdialog', { name: 'Delete “Internal Network”?' })
+      expect(dialog).toHaveAccessibleDescription('This can’t be undone.')
+      expect(within(dialog).queryByText(/Still used by/)).not.toBeInTheDocument()
       await user.click(within(dialog).getByRole('button', { name: button }))
 
       await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
@@ -518,7 +479,7 @@ describe('IpPoliciesPage', () => {
 
       await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
       await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
-      const dialog = screen.getByRole('alertdialog', { name: 'Delete IP policy?' })
+      const dialog = screen.getByRole('alertdialog', { name: 'Delete “Internal Network”?' })
       const deleteButton = within(dialog).getByRole('button', { name: 'Delete' })
       await user.click(deleteButton)
 
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 886234f4412ca1..77241b49905e55 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -172,6 +172,9 @@ export function IpPolicyDialog({
                 <FieldLabel>
                   {t(($) => $['settings.ipPolicyUsedByLabel'], { ns: 'common' })}
                 </FieldLabel>
+                <p className="system-xs-regular text-text-tertiary">
+                  {t(($) => $['settings.ipPolicyEditUsedBy'], { ns: 'common' })}
+                </p>
                 <PolicyReferencedApps apps={referencedApps} usedByCount={usedByCount} />
               </Field>
             )}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 91d4c504e4393d..4c647e51bf93df 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -19,9 +19,10 @@ import {
   DropdownMenuTrigger,
 } from '@langgenius/dify-ui/dropdown-menu'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
+import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
-import { Trans, useTranslation } from 'react-i18next'
+import { useTranslation } from 'react-i18next'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { consoleQuery } from '@/service/console'
 import { PolicyReferencedApps } from './referenced-apps'
@@ -99,20 +100,29 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
       <div className={policyActionsColClassName}>
         {canMutate && (
           <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>
-            <DropdownMenuTrigger
-              render={
-                <IconButton
-                  size="md"
-                  aria-label={t(($) => $['operation.moreActionsFor'], {
-                    ns: 'common',
-                    name: group.name,
-                  })}
-                  className="data-popup-open:bg-state-base-hover"
-                >
-                  <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
-                </IconButton>
-              }
-            />
+            <Tooltip>
+              <TooltipTrigger
+                render={
+                  <DropdownMenuTrigger
+                    render={
+                      <IconButton
+                        size="md"
+                        aria-label={t(($) => $['operation.moreActionsFor'], {
+                          ns: 'common',
+                          name: group.name,
+                        })}
+                        className="data-popup-open:bg-state-base-hover"
+                      >
+                        <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
+                      </IconButton>
+                    }
+                  />
+                }
+              />
+              <TooltipContent>
+                {t(($) => $['settings.ipPolicyMore'], { ns: 'common' })}
+              </TooltipContent>
+            </Tooltip>
             <DropdownMenuContent placement="bottom-end" sideOffset={4} className="min-w-35">
               <DropdownMenuItem
                 disabled={!canMutate}
@@ -152,8 +162,8 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
           className="flex w-120 flex-col gap-6 p-6 shadow-xl"
         >
           <div className="flex items-start gap-4">
-            <AlertDialogTitle className="min-w-0 flex-1 title-2xl-semi-bold text-text-primary">
-              {t(($) => $['settings.ipPolicyDeleteConfirm'], { ns: 'common' })}
+            <AlertDialogTitle className="min-w-0 flex-1 title-2xl-semi-bold wrap-anywhere text-text-primary">
+              {t(($) => $['settings.ipPolicyDeleteConfirm'], { ns: 'common', name: group.name })}
             </AlertDialogTitle>
             <IconButton
               size="lg"
@@ -166,16 +176,9 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
           </div>
           <div className="flex flex-col gap-4">
             <AlertDialogDescription className="text-sm leading-5.5 wrap-anywhere text-text-tertiary">
-              <Trans
-                ns="common"
-                i18nKey={
-                  isBound
-                    ? ($) => $['settings.ipPolicyDeleteBoundDescription']
-                    : ($) => $['settings.ipPolicyDeleteDescription']
-                }
-                values={{ name: group.name }}
-                components={{ policyName: <strong className="font-semibold" /> }}
-              />
+              {isBound
+                ? t(($) => $['settings.ipPolicyDeleteBoundDescription'], { ns: 'common' })
+                : t(($) => $['settings.ipPolicyDeleteDescription'], { ns: 'common' })}
             </AlertDialogDescription>
             {isBound && (
               <div className="flex flex-col gap-3">
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index d1447f738d7d9c..231116dd993451 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "هل تريد حذف <policyName>{{name}}</policyName>؟ ستسمح هذه التطبيقات بالوصول من أي عنوان IP. لا يمكن التراجع عن هذا الإجراء.",
-  "settings.ipPolicyDeleteConfirm": "حذف سياسة IP؟",
-  "settings.ipPolicyDeleteDescription": "هل تريد حذف <policyName>{{name}}</policyName>؟ لا يمكن التراجع عن هذا الإجراء.",
+  "settings.ipPolicyDeleteBoundDescription": "ستسمح هذه التطبيقات بالوصول من أي عنوان IP. لا يمكن التراجع عن هذا الإجراء.",
+  "settings.ipPolicyDeleteConfirm": "هل تريد حذف “{{name}}”؟",
+  "settings.ipPolicyDeleteDescription": "لا يمكن التراجع عن هذا الإجراء.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "تسري التغييرات فورًا في كل مكان تُطبّق فيه هذه السياسة.",
   "settings.ipPolicyEnforcingMany": "{{count}} تطبيقات",
   "settings.ipPolicyEnforcingNone": "0 تطبيقات",
   "settings.ipPolicyEnforcingOne": "تطبيق واحد",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "المزيد",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "لا تزال مستخدمة في {{count}} من التطبيقات",
   "settings.ipPolicyUsedByLabel": "مستخدم بواسطة",
-  "settings.ipPolicyUsedBy_one": "يستخدمه {{count}} تطبيق",
+  "settings.ipPolicyUsedBy_one": "لا تزال مستخدمة في {{count}} من التطبيقات",
   "settings.members": "الأعضاء",
   "settings.permissionSet": "مجموعة الأذونات",
   "settings.permissionSetDescription": "قم بتكوين مجموعات الأذونات لاستخدامها مع التطبيقات وقواعد المعرفة. مجموعة الأذونات هي مجموعة قابلة لإعادة الاستخدام من أذونات عمليات الموارد يمكن تعيينها للأعضاء لموارد محددة.",
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index ad2ff201b6366b..67ec14c0f5c19c 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "إضافة سياسة IP",
+  "studio.accessControl.description": "تحكّم في الوصول إلى هذا التطبيق بتطبيق سياسة IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "تفعيل التحكم في الوصول",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "يرجى اختيار سياسة IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 76ea7a6f60d340..759b67d71ddbd3 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> löschen? Diese Apps erlauben dann den Zugriff von jeder IP-Adresse. Dies kann nicht rückgängig gemacht werden.",
-  "settings.ipPolicyDeleteConfirm": "IP-Richtlinie löschen?",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> löschen? Dies kann nicht rückgängig gemacht werden.",
+  "settings.ipPolicyDeleteBoundDescription": "Diese Apps erlauben dann den Zugriff von jeder IP-Adresse. Dies kann nicht rückgängig gemacht werden.",
+  "settings.ipPolicyDeleteConfirm": "“{{name}}” löschen?",
+  "settings.ipPolicyDeleteDescription": "Dies kann nicht rückgängig gemacht werden.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Änderungen werden überall dort sofort wirksam, wo diese Richtlinie angewendet wird.",
   "settings.ipPolicyEnforcingMany": "{{count}} Apps",
   "settings.ipPolicyEnforcingNone": "0 Apps",
   "settings.ipPolicyEnforcingOne": "1 App",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Mehr",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Noch von {{count}} Apps verwendet",
   "settings.ipPolicyUsedByLabel": "Verwendet von",
-  "settings.ipPolicyUsedBy_one": "Von {{count}} App verwendet",
+  "settings.ipPolicyUsedBy_one": "Noch von {{count}} App verwendet",
   "settings.members": "Mitglieder",
   "settings.permissionSet": "Berechtigungssatz",
   "settings.permissionSetDescription": "Konfigurieren Sie Berechtigungssätze zur Verwendung mit Apps und Wissensdatenbanken. Ein Berechtigungssatz ist eine wiederverwendbare Sammlung von Berechtigungen für Ressourcenoperationen, die Mitgliedern für bestimmte Ressourcen zugewiesen werden kann.",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index c5bac7fc530fa5..e4601c34639e0d 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "IP-Richtlinie hinzufügen",
+  "studio.accessControl.description": "Steuern Sie den Zugriff auf diese App durch Anwenden einer IP-Richtlinie.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Zugriffskontrolle aktivieren",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Bitte wählen Sie eine IP-Richtlinie aus.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 99f72fb6f345c9..09aa5bab7da4ca 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -564,19 +564,19 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Enforcing",
-  "settings.ipPolicyColumnIpEntries": "IP entries",
+  "settings.ipPolicyColumnEnforcing": "Used by",
+  "settings.ipPolicyColumnIpEntries": "IP Entries",
   "settings.ipPolicyColumnName": "Name",
   "settings.ipPolicyColumnUpdatedAt": "Updated at",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Delete <policyName>{{name}}</policyName>? These apps will allow access from any IP address. This cannot be undone.",
-  "settings.ipPolicyDeleteConfirm": "Delete IP policy?",
-  "settings.ipPolicyDeleteDescription": "Delete <policyName>{{name}}</policyName>? This cannot be undone.",
+  "settings.ipPolicyDeleteBoundDescription": "Apps using this policy will become accessible from any IP address. This can’t be undone.",
+  "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "This can’t be undone.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Changes take effect immediately wherever this policy is applied.",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "More",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Still used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Used by",
-  "settings.ipPolicyUsedBy_one": "Used by {{count}} app",
+  "settings.ipPolicyUsedBy_one": "Still used by {{count}} app",
   "settings.members": "Members",
   "settings.permissionSet": "Permission Set",
   "settings.permissionSetDescription": "Configure permission sets for use with applications and knowledge bases. A permission set is a reusable collection of resource operation permissions that can be assigned to members for specific resources.",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index c3989be72470f1..62c4453760740d 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -35,15 +35,17 @@
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
   "studio.accessControl.addressCount": "{{count}} addresses",
   "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
+  "studio.accessControl.applyToHelp": "Choose which access points this policy protects.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Add IP Policy",
+  "studio.accessControl.description": "Control access to this app by applying an IP policy.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Enable access control",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -67,11 +69,12 @@
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectAccessPoint": "Please choose at least one access point.",
+  "studio.accessControl.selectPolicy": "Select an IP policy",
+  "studio.accessControl.selectPolicyRequired": "Please select an IP policy.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "All access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 8efc98c6a91d13..99a54d0d05ce18 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "¿Eliminar <policyName>{{name}}</policyName>? Estas aplicaciones permitirán el acceso desde cualquier dirección IP. Esta acción no se puede deshacer.",
-  "settings.ipPolicyDeleteConfirm": "¿Eliminar la política de IP?",
-  "settings.ipPolicyDeleteDescription": "¿Eliminar <policyName>{{name}}</policyName>? Esta acción no se puede deshacer.",
+  "settings.ipPolicyDeleteBoundDescription": "Estas aplicaciones permitirán el acceso desde cualquier dirección IP. Esta acción no se puede deshacer.",
+  "settings.ipPolicyDeleteConfirm": "¿Eliminar “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Esta acción no se puede deshacer.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Los cambios se aplican de inmediato donde se utilice esta política.",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Más",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Todavía la usan {{count}} aplicaciones",
   "settings.ipPolicyUsedByLabel": "Usado por",
-  "settings.ipPolicyUsedBy_one": "Usada por {{count}} aplicación",
+  "settings.ipPolicyUsedBy_one": "Todavía la usa {{count}} aplicación",
   "settings.members": "Miembros",
   "settings.permissionSet": "Conjunto de permisos",
   "settings.permissionSetDescription": "Configura conjuntos de permisos para usarlos con aplicaciones y bases de conocimiento. Un conjunto de permisos es una colección reutilizable de permisos de operaciones sobre recursos que se puede asignar a miembros para recursos específicos.",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 6624fe93722306..8028719fbc8078 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Añadir política de IP",
+  "studio.accessControl.description": "Controla el acceso a esta aplicación aplicando una política de IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Activar el control de acceso",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Selecciona una política de IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 592198de2a0727..33f03ab1fc9f38 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "آیا <policyName>{{name}}</policyName> حذف شود؟ این برنامه‌ها دسترسی از هر نشانی IP را مجاز خواهند کرد. این اقدام قابل بازگشت نیست.",
-  "settings.ipPolicyDeleteConfirm": "خط‌مشی IP حذف شود؟",
-  "settings.ipPolicyDeleteDescription": "آیا <policyName>{{name}}</policyName> حذف شود؟ این اقدام قابل بازگشت نیست.",
+  "settings.ipPolicyDeleteBoundDescription": "این برنامه‌ها دسترسی از هر نشانی IP را مجاز خواهند کرد. این اقدام قابل بازگشت نیست.",
+  "settings.ipPolicyDeleteConfirm": "آیا “{{name}}” حذف شود؟",
+  "settings.ipPolicyDeleteDescription": "این اقدام قابل بازگشت نیست.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "تغییرات بلافاصله در هر جایی که این خط‌مشی اعمال شده است، اجرا می‌شوند.",
   "settings.ipPolicyEnforcingMany": "{{count}} برنامه",
   "settings.ipPolicyEnforcingNone": "۰ برنامه",
   "settings.ipPolicyEnforcingOne": "۱ برنامه",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "بیشتر",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "هنوز در {{count}} برنامه استفاده می‌شود",
   "settings.ipPolicyUsedByLabel": "استفاده‌شده توسط",
-  "settings.ipPolicyUsedBy_one": "استفاده‌شده توسط {{count}} برنامه",
+  "settings.ipPolicyUsedBy_one": "هنوز در {{count}} برنامه استفاده می‌شود",
   "settings.members": "اعضا",
   "settings.permissionSet": "مجموعه مجوزها",
   "settings.permissionSetDescription": "مجموعه‌های مجوز را برای استفاده با برنامه‌ها و پایگاه‌های دانش پیکربندی کنید. مجموعه مجوز، مجموعه‌ای قابل استفاده مجدد از مجوزهای عملیات منبع است که می‌توان آن را برای منابع مشخص به اعضا اختصاص داد.",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index 04eb777567e70c..eed09640ceb237 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "افزودن خط‌مشی IP",
+  "studio.accessControl.description": "با اعمال یک خط‌مشی IP، دسترسی به این برنامه را کنترل کنید.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "فعال‌سازی کنترل دسترسی",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "لطفاً یک خط‌مشی IP انتخاب کنید.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index bdc908f5eb2ac5..4af27aa343784d 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Supprimer <policyName>{{name}}</policyName> ? Ces applications autoriseront l’accès depuis n’importe quelle adresse IP. Cette action est irréversible.",
-  "settings.ipPolicyDeleteConfirm": "Supprimer la politique IP ?",
-  "settings.ipPolicyDeleteDescription": "Supprimer <policyName>{{name}}</policyName> ? Cette action est irréversible.",
+  "settings.ipPolicyDeleteBoundDescription": "Ces applications autoriseront l’accès depuis n’importe quelle adresse IP. Cette action est irréversible.",
+  "settings.ipPolicyDeleteConfirm": "Supprimer “{{name}}” ?",
+  "settings.ipPolicyDeleteDescription": "Cette action est irréversible.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Les modifications prennent effet immédiatement partout où cette politique est appliquée.",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Plus",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Encore utilisée par {{count}} applications",
   "settings.ipPolicyUsedByLabel": "Utilisé par",
-  "settings.ipPolicyUsedBy_one": "Utilisée par {{count}} application",
+  "settings.ipPolicyUsedBy_one": "Encore utilisée par {{count}} application",
   "settings.members": "Membres",
   "settings.permissionSet": "Ensemble d’autorisations",
   "settings.permissionSetDescription": "Configurez des ensembles d’autorisations à utiliser avec les apps et les bases de connaissances. Un ensemble d’autorisations est une collection réutilisable d’autorisations d’opérations sur les ressources pouvant être attribuée aux membres pour des ressources spécifiques.",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index e857c33fe4b38a..aef3bba279a52e 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Ajouter une politique IP",
+  "studio.accessControl.description": "Contrôlez l’accès à cette application en appliquant une politique IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Activer le contrôle d’accès",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Veuillez sélectionner une politique IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 1317dc3a2caf17..87007acbd7c364 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> हटाएं? ये ऐप किसी भी IP पते से एक्सेस की अनुमति देंगे। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
-  "settings.ipPolicyDeleteConfirm": "IP नीति हटाएं?",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> हटाएं? इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
+  "settings.ipPolicyDeleteBoundDescription": "ये ऐप किसी भी IP पते से एक्सेस की अनुमति देंगे। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
+  "settings.ipPolicyDeleteConfirm": "“{{name}}” हटाएं?",
+  "settings.ipPolicyDeleteDescription": "इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "यह नीति जहाँ भी लागू है, वहाँ बदलाव तुरंत प्रभावी होंगे।",
   "settings.ipPolicyEnforcingMany": "{{count}} ऐप",
   "settings.ipPolicyEnforcingNone": "0 ऐप",
   "settings.ipPolicyEnforcingOne": "1 ऐप",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "अधिक",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "अभी भी {{count}} ऐप में उपयोग की जा रही है",
   "settings.ipPolicyUsedByLabel": "इनके द्वारा उपयोग",
-  "settings.ipPolicyUsedBy_one": "{{count}} ऐप द्वारा उपयोग में",
+  "settings.ipPolicyUsedBy_one": "अभी भी {{count}} ऐप में उपयोग की जा रही है",
   "settings.members": "सदस्य",
   "settings.permissionSet": "अनुमति सेट",
   "settings.permissionSetDescription": "ऐप्लिकेशन और नॉलेज बेस के साथ उपयोग के लिए अनुमति सेट कॉन्फ़िगर करें। अनुमति सेट संसाधन संचालन अनुमतियों का पुन: उपयोग योग्य संग्रह है, जिसे विशिष्ट संसाधनों के लिए सदस्यों को असाइन किया जा सकता है।",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index abf643a0cf79b1..ca3ebaccc42341 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "IP नीति जोड़ें",
+  "studio.accessControl.description": "IP नीति लागू करके इस ऐप तक पहुँच नियंत्रित करें।",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "पहुँच नियंत्रण सक्षम करें",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "कृपया एक IP नीति चुनें।",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index f98414a7ddbd80..32bd54689d8578 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Hapus <policyName>{{name}}</policyName>? Aplikasi ini akan mengizinkan akses dari alamat IP mana pun. Tindakan ini tidak dapat dibatalkan.",
-  "settings.ipPolicyDeleteConfirm": "Hapus kebijakan IP?",
-  "settings.ipPolicyDeleteDescription": "Hapus <policyName>{{name}}</policyName>? Tindakan ini tidak dapat dibatalkan.",
+  "settings.ipPolicyDeleteBoundDescription": "Aplikasi ini akan mengizinkan akses dari alamat IP mana pun. Tindakan ini tidak dapat dibatalkan.",
+  "settings.ipPolicyDeleteConfirm": "Hapus “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Tindakan ini tidak dapat dibatalkan.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Perubahan langsung berlaku di mana pun kebijakan ini diterapkan.",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikasi",
   "settings.ipPolicyEnforcingNone": "0 aplikasi",
   "settings.ipPolicyEnforcingOne": "1 aplikasi",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Lebih",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Masih digunakan oleh {{count}} aplikasi",
   "settings.ipPolicyUsedByLabel": "Digunakan oleh",
-  "settings.ipPolicyUsedBy_one": "Digunakan oleh {{count}} aplikasi",
+  "settings.ipPolicyUsedBy_one": "Masih digunakan oleh {{count}} aplikasi",
   "settings.members": "Anggota",
   "settings.permissionSet": "Kumpulan Izin",
   "settings.permissionSetDescription": "Konfigurasikan kumpulan izin untuk digunakan dengan aplikasi dan basis pengetahuan. Kumpulan izin adalah koleksi izin operasi sumber daya yang dapat digunakan kembali dan dapat ditetapkan kepada anggota untuk sumber daya tertentu.",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index fe241448b25fd2..173bd42184757b 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Tambah kebijakan IP",
+  "studio.accessControl.description": "Kontrol akses ke aplikasi ini dengan menerapkan kebijakan IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Aktifkan kontrol akses",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Pilih kebijakan IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index a00507835a54b7..82e023693039a9 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Eliminare <policyName>{{name}}</policyName>? Queste app consentiranno l’accesso da qualsiasi indirizzo IP. Questa azione non può essere annullata.",
-  "settings.ipPolicyDeleteConfirm": "Eliminare la policy IP?",
-  "settings.ipPolicyDeleteDescription": "Eliminare <policyName>{{name}}</policyName>? Questa azione non può essere annullata.",
+  "settings.ipPolicyDeleteBoundDescription": "Queste app consentiranno l’accesso da qualsiasi indirizzo IP. Questa azione non può essere annullata.",
+  "settings.ipPolicyDeleteConfirm": "Eliminare “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Questa azione non può essere annullata.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Le modifiche hanno effetto immediato ovunque sia applicata questa policy.",
   "settings.ipPolicyEnforcingMany": "{{count}} app",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Di più",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Ancora utilizzata da {{count}} app",
   "settings.ipPolicyUsedByLabel": "Usato da",
-  "settings.ipPolicyUsedBy_one": "Usata da {{count}} app",
+  "settings.ipPolicyUsedBy_one": "Ancora utilizzata da {{count}} app",
   "settings.members": "Membri",
   "settings.permissionSet": "Set di autorizzazioni",
   "settings.permissionSetDescription": "Configura set di autorizzazioni da usare con app e basi di conoscenza. Un set di autorizzazioni è una raccolta riutilizzabile di autorizzazioni per operazioni sulle risorse che può essere assegnata ai membri per risorse specifiche.",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index f0ae9641e0c124..2642b7c0b8f5c6 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Aggiungi policy IP",
+  "studio.accessControl.description": "Controlla l’accesso a questa app applicando una policy IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Abilita il controllo degli accessi",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Seleziona una policy IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 9a28f184c3b56f..b144ff25f6aae7 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -564,22 +564,22 @@
   "settings.ipPolicyAllowlist": "許可リスト",
   "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "適用中",
+  "settings.ipPolicyColumnEnforcing": "使用中のアプリ",
   "settings.ipPolicyColumnIpEntries": "IP エントリ",
   "settings.ipPolicyColumnName": "名前",
   "settings.ipPolicyColumnUpdatedAt": "更新日時",
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> を削除しますか？これらのアプリは任意の IP アドレスからアクセスできるようになります。この操作は取り消せません。",
-  "settings.ipPolicyDeleteConfirm": "IP ポリシーを削除しますか？",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> を削除しますか？この操作は取り消せません。",
+  "settings.ipPolicyDeleteBoundDescription": "このポリシーを使用しているアプリには、すべての IP アドレスからアクセスできるようになります。この操作は元に戻せません。",
+  "settings.ipPolicyDeleteConfirm": "「{{name}}」を削除しますか？",
+  "settings.ipPolicyDeleteDescription": "この操作は元に戻せません。",
   "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
-  "settings.ipPolicyEnforcingMany": "{{count}} 件のアプリ",
-  "settings.ipPolicyEnforcingNone": "0 件のアプリ",
-  "settings.ipPolicyEnforcingOne": "1 件のアプリ",
+  "settings.ipPolicyEditUsedBy": "変更は、このポリシーが適用されているすべての箇所に即時反映されます。",
+  "settings.ipPolicyEnforcingMany": "{{count}} 個のアプリ",
+  "settings.ipPolicyEnforcingNone": "0 個のアプリ",
+  "settings.ipPolicyEnforcingOne": "1 個のアプリ",
   "settings.ipPolicyEntryInvalidIpv6": "有効な IPv6 アドレスではありません",
   "settings.ipPolicyEntryLeadingZeros": "先頭のゼロは使用できません",
   "settings.ipPolicyEntryMultipleSlashes": "「/」は 1 つだけ使用できます",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "プレフィックス長は数値で指定してください",
   "settings.ipPolicyEntryPrefixRange": "プレフィックス長は 0〜{{max}} の範囲で指定してください",
   "settings.ipPolicyEntryUnsupported": "IPv4 / IPv6 アドレスと CIDR 範囲のみサポートしています",
+  "settings.ipPolicyMore": "その他",
   "settings.ipPolicyName": "名前",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "例：社内ネットワーク",
   "settings.ipPolicyNewTitle": "IP ポリシーを作成",
   "settings.ipPolicyRemoveEntry": "エントリを削除",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
-  "settings.ipPolicyUsedByLabel": "使用中",
-  "settings.ipPolicyUsedBy_one": "{{count}} 個のアプリで使用中",
+  "settings.ipPolicyUsedBy": "まだ {{count}} 個のアプリで使用中",
+  "settings.ipPolicyUsedByLabel": "使用中のアプリ",
+  "settings.ipPolicyUsedBy_one": "まだ {{count}} 個のアプリで使用中",
   "settings.members": "メンバー",
   "settings.permissionSet": "権限セット",
   "settings.permissionSetDescription": "アプリとナレッジベースで使用する権限セットを設定します。権限セットは、特定のリソースに対してメンバーに割り当てられる、リソース操作権限の再利用可能なコレクションです。",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 6d793a07280eeb..255dc085cfced1 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -35,15 +35,17 @@
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
   "studio.accessControl.addressCount": "{{count}} 件のアドレス",
   "studio.accessControl.applyTo": "適用先",
-  "studio.accessControl.applyToHelp": "保護するアクセスポイントを選択します。",
+  "studio.accessControl.applyToHelp": "このポリシーで保護するアクセスポイントを選択します。",
   "studio.accessControl.applyToHelpSelected": "このポリシーで保護するアクセスポイントを選択します。",
-  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.chipOff": "オフ",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
-  "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
+  "studio.accessControl.createIpPolicy": "IP ポリシーを追加",
+  "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
   "studio.accessControl.downgradeDescription": "アクセス制御には Pro プランが必要です。",
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
+  "studio.accessControl.enableAccessControl": "アクセス制御を有効にする",
   "studio.accessControl.entryLabel": "アクセス制御",
   "studio.accessControl.excluded": "対象外",
   "studio.accessControl.ipPolicy": "IP ポリシー",
@@ -67,11 +69,12 @@
   "studio.accessControl.restrictedTo": "{{name}} に制限",
   "studio.accessControl.saveAnyway": "保存する",
   "studio.accessControl.saveWithoutOwnIp": "自分の IP を含めずに保存しますか？",
-  "studio.accessControl.selectAccessPoint": "保護するアクセスポイントを少なくとも 1 つ選択してください。",
-  "studio.accessControl.selectPolicy": "ポリシーを選択",
+  "studio.accessControl.selectAccessPoint": "少なくとも 1 つのアクセスポイントを選択してください。",
+  "studio.accessControl.selectPolicy": "IP ポリシーを選択",
+  "studio.accessControl.selectPolicyRequired": "IP ポリシーを選択してください。",
   "studio.accessControl.tooltipOff": "未設定",
-  "studio.accessControl.tooltipOn": "{{name}}、すべてのアクセスポイント",
-  "studio.accessControl.tooltipPartial": "{{name}}、{{n}} / {{m}} のアクセスポイント",
+  "studio.accessControl.tooltipOn": "すべてのアクセスポイント",
+  "studio.accessControl.tooltipPartial": "アクセスポイント {{total}} 個中 {{n}} 個",
   "studio.accessControl.tooltipPaused": "一時停止 — {{name}} は設定済みですが適用されていません",
   "studio.accessControl.tooltipPro": "アクセス制御には Pro プランが必要です",
   "studio.accessControl.turnOffConfirm": "オフにする",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 3048cd38ae072e..543a0d863f5d53 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName>을(를) 삭제하시겠습니까? 이 앱들은 모든 IP 주소에서 접근할 수 있게 됩니다. 이 작업은 되돌릴 수 없습니다.",
-  "settings.ipPolicyDeleteConfirm": "IP 정책을 삭제하시겠습니까?",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName>을(를) 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
+  "settings.ipPolicyDeleteBoundDescription": "이 앱들은 모든 IP 주소에서 접근할 수 있게 됩니다. 이 작업은 되돌릴 수 없습니다.",
+  "settings.ipPolicyDeleteConfirm": "“{{name}}”을(를) 삭제하시겠습니까?",
+  "settings.ipPolicyDeleteDescription": "이 작업은 되돌릴 수 없습니다.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "이 정책이 적용된 모든 곳에 변경 사항이 즉시 반영됩니다.",
   "settings.ipPolicyEnforcingMany": "앱 {{count}}개",
   "settings.ipPolicyEnforcingNone": "앱 0개",
   "settings.ipPolicyEnforcingOne": "앱 1개",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "더 많은",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "아직 {{count}}개의 앱에서 사용 중",
   "settings.ipPolicyUsedByLabel": "사용 중",
-  "settings.ipPolicyUsedBy_one": "{{count}}개 앱에서 사용 중",
+  "settings.ipPolicyUsedBy_one": "아직 {{count}}개의 앱에서 사용 중",
   "settings.members": "멤버",
   "settings.permissionSet": "권한 세트",
   "settings.permissionSetDescription": "앱과 지식 베이스에서 사용할 권한 세트를 구성합니다. 권한 세트는 특정 리소스에 대해 멤버에게 할당할 수 있는 재사용 가능한 리소스 작업 권한 모음입니다.",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index b9a6f539ffaafe..6b6a006facf970 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "IP 정책 추가",
+  "studio.accessControl.description": "IP 정책을 적용하여 이 앱에 대한 접근을 제어합니다.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "접근 제어 활성화",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "IP 정책을 선택하세요.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index d5ab2d84dcdf33..e9e78ff4372bb2 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "ລຶບ <policyName>{{name}}</policyName> ຫຼືບໍ່? ແອັບເຫຼົ່ານີ້ຈະອະນຸຍາດໃຫ້ເຂົ້າເຖິງຈາກທີ່ຢູ່ IP ໃດກໍໄດ້. ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
-  "settings.ipPolicyDeleteConfirm": "ລຶບນະໂຍບາຍ IP ຫຼືບໍ່?",
-  "settings.ipPolicyDeleteDescription": "ລຶບ <policyName>{{name}}</policyName> ຫຼືບໍ່? ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
+  "settings.ipPolicyDeleteBoundDescription": "ແອັບເຫຼົ່ານີ້ຈະອະນຸຍາດໃຫ້ເຂົ້າເຖິງຈາກທີ່ຢູ່ IP ໃດກໍໄດ້. ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
+  "settings.ipPolicyDeleteConfirm": "ລຶບ “{{name}}” ຫຼືບໍ່?",
+  "settings.ipPolicyDeleteDescription": "ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "ການປ່ຽນແປງຈະມີຜົນທັນທີໃນທຸກບ່ອນທີ່ນຳໃຊ້ນະໂຍບາຍນີ້.",
   "settings.ipPolicyEnforcingMany": "{{count}} ແອັບ",
   "settings.ipPolicyEnforcingNone": "0 ແອັບ",
   "settings.ipPolicyEnforcingOne": "1 ແອັບ",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "ເພີ່ມເຕີມ",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "ຍັງມີ {{count}} ແອັບທີ່ໃຊ້ຢູ່",
   "settings.ipPolicyUsedByLabel": "ຖືກໃຊ້ໂດຍ",
-  "settings.ipPolicyUsedBy_one": "ຖືກໃຊ້ໂດຍ {{count}} ແອັບ",
+  "settings.ipPolicyUsedBy_one": "ຍັງມີ {{count}} ແອັບທີ່ໃຊ້ຢູ່",
   "settings.members": "ສະມາຊິກ",
   "settings.permissionSet": "ຊຸດການອະນຸຍາດ",
   "settings.permissionSetDescription": "ຕັ້ງຄ່າຊຸດການອະນຸຍາດສຳລັບໃຊ້ກັບແອັບ ແລະ ຖານຄວາມຮູ້. ຊຸດການອະນຸຍາດແມ່ນການລວມເອົາສິດການດຳເນີນການຊັບພະຍາກອນທີ່ສາມາດນຳມາໃຊ້ຄືນໄດ້ ເຊິ່ງສາມາດມອບໝາຍໃຫ້ສະມາຊິກສຳລັບຊັບພະຍາກອນສະເພາະ.",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index def724d64cd88a..7f24b956f1a054 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "ເພີ່ມນະໂຍບາຍ IP",
+  "studio.accessControl.description": "ຄວບຄຸມການເຂົ້າເຖິງແອັບນີ້ໂດຍນຳໃຊ້ນະໂຍບາຍ IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "ກະລຸນາເລືອກນະໂຍບາຍ IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 2c98a328a46197..3c18334f979ffa 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> verwijderen? Deze apps staan dan toegang vanaf elk IP-adres toe. Dit kan niet ongedaan worden gemaakt.",
-  "settings.ipPolicyDeleteConfirm": "IP-beleid verwijderen?",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> verwijderen? Dit kan niet ongedaan worden gemaakt.",
+  "settings.ipPolicyDeleteBoundDescription": "Deze apps staan dan toegang vanaf elk IP-adres toe. Dit kan niet ongedaan worden gemaakt.",
+  "settings.ipPolicyDeleteConfirm": "“{{name}}” verwijderen?",
+  "settings.ipPolicyDeleteDescription": "Dit kan niet ongedaan worden gemaakt.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Wijzigingen worden onmiddellijk van kracht overal waar dit beleid wordt toegepast.",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "More",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Nog in gebruik door {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Gebruikt door",
-  "settings.ipPolicyUsedBy_one": "Gebruikt door {{count}} app",
+  "settings.ipPolicyUsedBy_one": "Nog in gebruik door {{count}} apps",
   "settings.members": "Members",
   "settings.permissionSet": "Set met rechten",
   "settings.permissionSetDescription": "Configureer sets met rechten voor gebruik met apps en kennisbanken. Een set met rechten is een herbruikbare verzameling rechten voor resourcebewerkingen die aan leden kan worden toegewezen voor specifieke resources.",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index ddbc5c0585d974..6683e74c44f43a 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "IP-beleid toevoegen",
+  "studio.accessControl.description": "Beheer de toegang tot deze app door een IP-beleid toe te passen.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Toegangsbeheer inschakelen",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Selecteer een IP-beleid.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 988fe693672a9d..e0fb110a0664e0 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Usunąć <policyName>{{name}}</policyName>? Te aplikacje będą zezwalać na dostęp z dowolnego adresu IP. Tej operacji nie można cofnąć.",
-  "settings.ipPolicyDeleteConfirm": "Usunąć politykę IP?",
-  "settings.ipPolicyDeleteDescription": "Usunąć <policyName>{{name}}</policyName>? Tej operacji nie można cofnąć.",
+  "settings.ipPolicyDeleteBoundDescription": "Te aplikacje będą zezwalać na dostęp z dowolnego adresu IP. Tej operacji nie można cofnąć.",
+  "settings.ipPolicyDeleteConfirm": "Usunąć “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Tej operacji nie można cofnąć.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Zmiany obowiązują natychmiast wszędzie tam, gdzie stosowana jest ta polityka.",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacji",
   "settings.ipPolicyEnforcingNone": "0 aplikacji",
   "settings.ipPolicyEnforcingOne": "1 aplikacja",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Więcej",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Liczba aplikacji nadal korzystających z tej polityki: {{count}}",
   "settings.ipPolicyUsedByLabel": "Używane przez",
-  "settings.ipPolicyUsedBy_one": "Używana przez {{count}} aplikację",
+  "settings.ipPolicyUsedBy_one": "Liczba aplikacji nadal korzystających z tej polityki: {{count}}",
   "settings.members": "Członkowie",
   "settings.permissionSet": "Zestaw uprawnień",
   "settings.permissionSetDescription": "Skonfiguruj zestawy uprawnień do użycia z aplikacjami i bazami wiedzy. Zestaw uprawnień to wielokrotnego użytku zbiór uprawnień do operacji na zasobach, który można przypisywać członkom dla konkretnych zasobów.",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 23c3978a1d9389..e77af8370887c0 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Dodaj politykę IP",
+  "studio.accessControl.description": "Kontroluj dostęp do tej aplikacji, stosując politykę IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Włącz kontrolę dostępu",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Wybierz politykę IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index ee9613cc6a115e..dc04f0e7886ce0 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Excluir <policyName>{{name}}</policyName>? Esses aplicativos permitirão o acesso de qualquer endereço IP. Esta ação não pode ser desfeita.",
-  "settings.ipPolicyDeleteConfirm": "Excluir política de IP?",
-  "settings.ipPolicyDeleteDescription": "Excluir <policyName>{{name}}</policyName>? Esta ação não pode ser desfeita.",
+  "settings.ipPolicyDeleteBoundDescription": "Esses aplicativos permitirão o acesso de qualquer endereço IP. Esta ação não pode ser desfeita.",
+  "settings.ipPolicyDeleteConfirm": "Excluir “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Esta ação não pode ser desfeita.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "As alterações entram em vigor imediatamente onde esta política estiver aplicada.",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Mais",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Ainda usada por {{count}} aplicativos",
   "settings.ipPolicyUsedByLabel": "Usado por",
-  "settings.ipPolicyUsedBy_one": "Usada por {{count}} aplicativo",
+  "settings.ipPolicyUsedBy_one": "Ainda usada por {{count}} aplicativo",
   "settings.members": "Membros",
   "settings.permissionSet": "Conjunto de permissões",
   "settings.permissionSetDescription": "Configure conjuntos de permissões para uso com apps e bases de conhecimento. Um conjunto de permissões é uma coleção reutilizável de permissões de operações de recursos que pode ser atribuída a membros para recursos específicos.",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index a0e62c5dd94841..1ef90629eed226 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Adicionar política de IP",
+  "studio.accessControl.description": "Controle o acesso a este aplicativo aplicando uma política de IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Ativar controle de acesso",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Selecione uma política de IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 2cef8176e76648..abaefcb955cf76 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Ștergeți <policyName>{{name}}</policyName>? Aceste aplicații vor permite accesul de la orice adresă IP. Această acțiune nu poate fi anulată.",
-  "settings.ipPolicyDeleteConfirm": "Ștergeți politica IP?",
-  "settings.ipPolicyDeleteDescription": "Ștergeți <policyName>{{name}}</policyName>? Această acțiune nu poate fi anulată.",
+  "settings.ipPolicyDeleteBoundDescription": "Aceste aplicații vor permite accesul de la orice adresă IP. Această acțiune nu poate fi anulată.",
+  "settings.ipPolicyDeleteConfirm": "Ștergeți “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Această acțiune nu poate fi anulată.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Modificările se aplică imediat oriunde este utilizată această politică.",
   "settings.ipPolicyEnforcingMany": "{{count}} aplicații",
   "settings.ipPolicyEnforcingNone": "0 aplicații",
   "settings.ipPolicyEnforcingOne": "1 aplicație",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Mai mult",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Numărul de aplicații care încă folosesc politica: {{count}}",
   "settings.ipPolicyUsedByLabel": "Folosit de",
-  "settings.ipPolicyUsedBy_one": "Utilizată de {{count}} aplicație",
+  "settings.ipPolicyUsedBy_one": "Numărul de aplicații care încă folosesc politica: {{count}}",
   "settings.members": "Membri",
   "settings.permissionSet": "Set de permisiuni",
   "settings.permissionSetDescription": "Configurați seturi de permisiuni pentru utilizare cu aplicații și baze de cunoștințe. Un set de permisiuni este o colecție reutilizabilă de permisiuni pentru operațiuni asupra resurselor, care poate fi atribuită membrilor pentru resurse specifice.",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 1932cc6d2bca85..6bacd33a8f756c 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Adăugați o politică IP",
+  "studio.accessControl.description": "Controlați accesul la această aplicație aplicând o politică IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Activați controlul accesului",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Selectați o politică IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 8bea0b21adce0a..d8d58135d0b9ca 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Удалить <policyName>{{name}}</policyName>? Эти приложения станут доступны с любого IP-адреса. Это действие нельзя отменить.",
-  "settings.ipPolicyDeleteConfirm": "Удалить IP-политику?",
-  "settings.ipPolicyDeleteDescription": "Удалить <policyName>{{name}}</policyName>? Это действие нельзя отменить.",
+  "settings.ipPolicyDeleteBoundDescription": "Эти приложения станут доступны с любого IP-адреса. Это действие нельзя отменить.",
+  "settings.ipPolicyDeleteConfirm": "Удалить “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Это действие нельзя отменить.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Изменения вступают в силу немедленно везде, где применяется эта политика.",
   "settings.ipPolicyEnforcingMany": "{{count}} приложений",
   "settings.ipPolicyEnforcingNone": "0 приложений",
   "settings.ipPolicyEnforcingOne": "1 приложение",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Больше",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Количество приложений, всё ещё использующих политику: {{count}}",
   "settings.ipPolicyUsedByLabel": "Используется",
-  "settings.ipPolicyUsedBy_one": "Используется {{count}} приложением",
+  "settings.ipPolicyUsedBy_one": "Количество приложений, всё ещё использующих политику: {{count}}",
   "settings.members": "Участники",
   "settings.permissionSet": "Набор разрешений",
   "settings.permissionSetDescription": "Настройте наборы разрешений для использования с приложениями и базами знаний. Набор разрешений — это многократно используемая коллекция разрешений на операции с ресурсами, которую можно назначать участникам для конкретных ресурсов.",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index 5e874c30d12b90..530a6c28c12611 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Добавить IP-политику",
+  "studio.accessControl.description": "Управляйте доступом к этому приложению с помощью IP-политики.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Включить контроль доступа",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Выберите IP-политику.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 810d24437fdbc8..e134c85acfacf0 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Izbrišem <policyName>{{name}}</policyName>? Te aplikacije bodo dovolile dostop s katerega koli naslova IP. Tega dejanja ni mogoče razveljaviti.",
-  "settings.ipPolicyDeleteConfirm": "Izbrišem pravilnik IP?",
-  "settings.ipPolicyDeleteDescription": "Izbrišem <policyName>{{name}}</policyName>? Tega dejanja ni mogoče razveljaviti.",
+  "settings.ipPolicyDeleteBoundDescription": "Te aplikacije bodo dovolile dostop s katerega koli naslova IP. Tega dejanja ni mogoče razveljaviti.",
+  "settings.ipPolicyDeleteConfirm": "Izbrišem “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Tega dejanja ni mogoče razveljaviti.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Spremembe začnejo veljati takoj povsod, kjer se uporablja ta pravilnik.",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacij",
   "settings.ipPolicyEnforcingNone": "0 aplikacij",
   "settings.ipPolicyEnforcingOne": "1 aplikacija",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Več",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Število aplikacij, ki še uporabljajo pravilnik: {{count}}",
   "settings.ipPolicyUsedByLabel": "Uporablja",
-  "settings.ipPolicyUsedBy_one": "Uporablja jo {{count}} aplikacija",
+  "settings.ipPolicyUsedBy_one": "Število aplikacij, ki še uporabljajo pravilnik: {{count}}",
   "settings.members": "Člani",
   "settings.permissionSet": "Nabor dovoljenj",
   "settings.permissionSetDescription": "Konfigurirajte nabore dovoljenj za uporabo z aplikacijami in bazami znanja. Nabor dovoljenj je ponovno uporabna zbirka dovoljenj za operacije nad viri, ki jo je mogoče dodeliti članom za določene vire.",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 11386219a976b9..10a367955d0282 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Dodaj pravilnik IP",
+  "studio.accessControl.description": "Nadzirajte dostop do te aplikacije z uporabo pravilnika IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Omogoči nadzor dostopa",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Izberite pravilnik IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 89942ee87b9a68..95ad2134ef7f05 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "ลบ <policyName>{{name}}</policyName> หรือไม่? แอปเหล่านี้จะอนุญาตให้เข้าถึงจากที่อยู่ IP ใดก็ได้ การดำเนินการนี้ไม่สามารถยกเลิกได้",
-  "settings.ipPolicyDeleteConfirm": "ลบนโยบาย IP หรือไม่?",
-  "settings.ipPolicyDeleteDescription": "ลบ <policyName>{{name}}</policyName> หรือไม่? การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "settings.ipPolicyDeleteBoundDescription": "แอปเหล่านี้จะอนุญาตให้เข้าถึงจากที่อยู่ IP ใดก็ได้ การดำเนินการนี้ไม่สามารถยกเลิกได้",
+  "settings.ipPolicyDeleteConfirm": "ลบ “{{name}}” หรือไม่?",
+  "settings.ipPolicyDeleteDescription": "การดำเนินการนี้ไม่สามารถยกเลิกได้",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "การเปลี่ยนแปลงจะมีผลทันทีในทุกที่ที่ใช้นโยบายนี้",
   "settings.ipPolicyEnforcingMany": "{{count}} แอป",
   "settings.ipPolicyEnforcingNone": "0 แอป",
   "settings.ipPolicyEnforcingOne": "1 แอป",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "มากขึ้น",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "ยังมี {{count}} แอปที่ใช้นโยบายนี้อยู่",
   "settings.ipPolicyUsedByLabel": "ถูกใช้โดย",
-  "settings.ipPolicyUsedBy_one": "ใช้งานโดย {{count}} แอป",
+  "settings.ipPolicyUsedBy_one": "ยังมี {{count}} แอปที่ใช้นโยบายนี้อยู่",
   "settings.members": "สมาชิก",
   "settings.permissionSet": "ชุดสิทธิ์",
   "settings.permissionSetDescription": "กำหนดค่าชุดสิทธิ์สำหรับใช้กับแอปและฐานความรู้ ชุดสิทธิ์คือชุดสิทธิ์การดำเนินการกับทรัพยากรที่นำกลับมาใช้ซ้ำได้ และสามารถกำหนดให้สมาชิกสำหรับทรัพยากรเฉพาะได้",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index fe8296fda02d81..12d57095cf8c93 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "เพิ่มนโยบาย IP",
+  "studio.accessControl.description": "ควบคุมการเข้าถึงแอปนี้โดยใช้นโยบาย IP",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "เปิดใช้งานการควบคุมการเข้าถึง",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "โปรดเลือกนโยบาย IP",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 76b9096f66011f..54522a58c36b4d 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "<policyName>{{name}}</policyName> silinsin mi? Bu uygulamalar herhangi bir IP adresinden erişime izin verecek. Bu işlem geri alınamaz.",
-  "settings.ipPolicyDeleteConfirm": "IP politikası silinsin mi?",
-  "settings.ipPolicyDeleteDescription": "<policyName>{{name}}</policyName> silinsin mi? Bu işlem geri alınamaz.",
+  "settings.ipPolicyDeleteBoundDescription": "Bu uygulamalar herhangi bir IP adresinden erişime izin verecek. Bu işlem geri alınamaz.",
+  "settings.ipPolicyDeleteConfirm": "“{{name}}” silinsin mi?",
+  "settings.ipPolicyDeleteDescription": "Bu işlem geri alınamaz.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Değişiklikler bu politikanın uygulandığı her yerde hemen geçerli olur.",
   "settings.ipPolicyEnforcingMany": "{{count}} uygulama",
   "settings.ipPolicyEnforcingNone": "0 uygulama",
   "settings.ipPolicyEnforcingOne": "1 uygulama",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Daha fazla",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Hâlâ {{count}} uygulama tarafından kullanılıyor",
   "settings.ipPolicyUsedByLabel": "Kullanan",
-  "settings.ipPolicyUsedBy_one": "{{count}} uygulama tarafından kullanılıyor",
+  "settings.ipPolicyUsedBy_one": "Hâlâ {{count}} uygulama tarafından kullanılıyor",
   "settings.members": "Üyeler",
   "settings.permissionSet": "İzin Seti",
   "settings.permissionSetDescription": "Uygulamalar ve bilgi tabanlarıyla kullanılacak izin setlerini yapılandırın. İzin seti, belirli kaynaklar için üyelere atanabilen yeniden kullanılabilir kaynak işlem izinleri koleksiyonudur.",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index e45ac100f34c4b..c7aa51ebc2f0f1 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "IP politikası ekle",
+  "studio.accessControl.description": "Bir IP politikası uygulayarak bu uygulamaya erişimi denetleyin.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Erişim denetimini etkinleştir",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Lütfen bir IP politikası seçin.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index b13ad3f6455379..1e1babdfae7727 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Видалити <policyName>{{name}}</policyName>? Ці застосунки дозволятимуть доступ із будь-якої IP-адреси. Цю дію неможливо скасувати.",
-  "settings.ipPolicyDeleteConfirm": "Видалити IP-політику?",
-  "settings.ipPolicyDeleteDescription": "Видалити <policyName>{{name}}</policyName>? Цю дію неможливо скасувати.",
+  "settings.ipPolicyDeleteBoundDescription": "Ці застосунки дозволятимуть доступ із будь-якої IP-адреси. Цю дію неможливо скасувати.",
+  "settings.ipPolicyDeleteConfirm": "Видалити “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Цю дію неможливо скасувати.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Зміни набувають чинності негайно всюди, де застосовується ця політика.",
   "settings.ipPolicyEnforcingMany": "{{count}} застосунків",
   "settings.ipPolicyEnforcingNone": "0 застосунків",
   "settings.ipPolicyEnforcingOne": "1 застосунок",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Більше",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Кількість застосунків, які досі використовують політику: {{count}}",
   "settings.ipPolicyUsedByLabel": "Використовується",
-  "settings.ipPolicyUsedBy_one": "Використовується {{count}} застосунком",
+  "settings.ipPolicyUsedBy_one": "Кількість застосунків, які досі використовують політику: {{count}}",
   "settings.members": "Учасники",
   "settings.permissionSet": "Набір дозволів",
   "settings.permissionSetDescription": "Налаштуйте набори дозволів для використання із застосунками та базами знань. Набір дозволів — це багаторазова колекція дозволів на операції з ресурсами, яку можна призначати учасникам для конкретних ресурсів.",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 46fb5339c61182..5e27f75f55ebd0 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Додати IP-політику",
+  "studio.accessControl.description": "Керуйте доступом до цього застосунку за допомогою IP-політики.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Увімкнути контроль доступу",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Виберіть IP-політику.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index b757865f7d5ebe..b325400c353dfc 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
-  "settings.ipPolicyDeleteBoundDescription": "Xóa <policyName>{{name}}</policyName>? Các ứng dụng này sẽ cho phép truy cập từ mọi địa chỉ IP. Không thể hoàn tác thao tác này.",
-  "settings.ipPolicyDeleteConfirm": "Xóa chính sách IP?",
-  "settings.ipPolicyDeleteDescription": "Xóa <policyName>{{name}}</policyName>? Không thể hoàn tác thao tác này.",
+  "settings.ipPolicyDeleteBoundDescription": "Các ứng dụng này sẽ cho phép truy cập từ mọi địa chỉ IP. Không thể hoàn tác thao tác này.",
+  "settings.ipPolicyDeleteConfirm": "Xóa “{{name}}”?",
+  "settings.ipPolicyDeleteDescription": "Không thể hoàn tác thao tác này.",
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
-  "settings.ipPolicyEditUsedBy": "This policy is used by {{count}} apps. Saving updates the allowlist for all of them.",
+  "settings.ipPolicyEditUsedBy": "Các thay đổi có hiệu lực ngay lập tức ở mọi nơi áp dụng chính sách này.",
   "settings.ipPolicyEnforcingMany": "{{count}} ứng dụng",
   "settings.ipPolicyEnforcingNone": "0 ứng dụng",
   "settings.ipPolicyEnforcingOne": "1 ứng dụng",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "Prefix length must be a number",
   "settings.ipPolicyEntryPrefixRange": "Prefix length must be 0–{{max}}",
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
+  "settings.ipPolicyMore": "Hơn",
   "settings.ipPolicyName": "Name",
   "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
-  "settings.ipPolicyUsedBy": "Used by {{count}} apps",
+  "settings.ipPolicyUsedBy": "Vẫn được {{count}} ứng dụng sử dụng",
   "settings.ipPolicyUsedByLabel": "Được dùng bởi",
-  "settings.ipPolicyUsedBy_one": "Được {{count}} ứng dụng sử dụng",
+  "settings.ipPolicyUsedBy_one": "Vẫn được {{count}} ứng dụng sử dụng",
   "settings.members": "Thành viên",
   "settings.permissionSet": "Bộ quyền",
   "settings.permissionSetDescription": "Định cấu hình các bộ quyền để sử dụng với ứng dụng và cơ sở kiến thức. Bộ quyền là tập hợp có thể tái sử dụng các quyền thao tác trên tài nguyên, có thể được gán cho thành viên đối với các tài nguyên cụ thể.",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 73fe36b584073d..8ee219a94ce087 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
-  "studio.accessControl.createIpPolicy": "Create an IP policy",
+  "studio.accessControl.createIpPolicy": "Thêm chính sách IP",
+  "studio.accessControl.description": "Kiểm soát quyền truy cập ứng dụng này bằng cách áp dụng chính sách IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.enableAccessControl": "Bật kiểm soát truy cập",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
   "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
   "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.selectPolicyRequired": "Vui lòng chọn chính sách IP.",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "{{name}}, all access points",
-  "studio.accessControl.tooltipPartial": "{{name}}, {{n}} of {{m}} access points",
+  "studio.accessControl.tooltipOn": "all access points",
+  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/zh-Hans/agent-v-2.json b/web/i18n/zh-Hans/agent-v-2.json
index 094c924d878d4d..660f5fe6a19ab2 100644
--- a/web/i18n/zh-Hans/agent-v-2.json
+++ b/web/i18n/zh-Hans/agent-v-2.json
@@ -13,7 +13,7 @@
   "agentDetail.access.status.inService": "服务中",
   "agentDetail.access.status.outOfService": "已停用",
   "agentDetail.access.status.unavailable": "不可用",
-  "agentDetail.access.title": "访问点",
+  "agentDetail.access.title": "访问入口",
   "agentDetail.access.toggleSurface": "切换 {{name}} 访问状态",
   "agentDetail.access.webApp.accessUrl": "访问 URL",
   "agentDetail.access.webApp.actions.customFrontend": "自定义前端",
@@ -311,7 +311,7 @@
   "agentDetail.metadata.sourceLabel": "来源",
   "agentDetail.monitoring.change": "较上一周期 {{value}}",
   "agentDetail.monitoring.dateRangeLabel": "日期范围",
-  "agentDetail.monitoring.description": "跟踪该 Agent 在所有访问点上的活动、成本与交互质量。",
+  "agentDetail.monitoring.description": "跟踪该 Agent 在所有访问入口上的活动、成本与交互质量。",
   "agentDetail.monitoring.learnMore": "了解更多",
   "agentDetail.monitoring.loadFailed": "监控数据加载失败",
   "agentDetail.monitoring.metrics.activeUsers.explanation": "与该 Agent 交互过的独立终端用户数。",
@@ -342,7 +342,7 @@
   "agentDetail.monitoring.units.tokenPerSecond": "Token/秒",
   "agentDetail.navigationLabel": "Agent 导航",
   "agentDetail.publish": "发布",
-  "agentDetail.sections.access": "访问点",
+  "agentDetail.sections.access": "访问入口",
   "agentDetail.sections.access-config": "访问权限",
   "agentDetail.sections.configure": "配置",
   "agentDetail.sections.logs": "日志",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index f6a34ea7c1dae9..e04fb4873ac932 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -96,7 +96,7 @@
   "apiBasedExtension.title": "Custom Endpoints 提供集中式 API 管理，简化配置，方便在 Dify 的应用中使用。",
   "apiBasedExtension.type": "类型",
   "apiBasedExtensionPage.description": "通过 API 扩展 Dify 的模块能力——为应用接入自定义内容审核或外部数据工具。",
-  "appMenus.accessPoint": "访问点",
+  "appMenus.accessPoint": "访问入口",
   "appMenus.annotations": "标注",
   "appMenus.apiAccess": "访问 API",
   "appMenus.apiAccessTip": "此知识库可通过服务 API 访问",
@@ -564,22 +564,22 @@
   "settings.ipPolicyAllowlist": "允许列表",
   "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
   "settings.ipPolicyCidrMax": "一条策略最多包含 {{max}} 个地址",
-  "settings.ipPolicyColumnEnforcing": "生效中",
+  "settings.ipPolicyColumnEnforcing": "生效应用",
   "settings.ipPolicyColumnIpEntries": "IP 条目",
   "settings.ipPolicyColumnName": "名称",
   "settings.ipPolicyColumnUpdatedAt": "更新时间",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "该策略正在使用中",
-  "settings.ipPolicyDeleteBoundDescription": "确定删除 <policyName>{{name}}</policyName>？这些应用将允许从任意 IP 地址访问。此操作无法撤销。",
-  "settings.ipPolicyDeleteConfirm": "删除 IP 策略？",
-  "settings.ipPolicyDeleteDescription": "确定删除 <policyName>{{name}}</policyName>？此操作无法撤销。",
+  "settings.ipPolicyDeleteBoundDescription": "正在引用此策略的应用将完全开放访问。此操作无法撤销。",
+  "settings.ipPolicyDeleteConfirm": "删除“{{name}}”？",
+  "settings.ipPolicyDeleteDescription": "此操作无法撤销。",
   "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
-  "settings.ipPolicyEditUsedBy": "该策略已被 {{count}} 个应用使用。保存后会更新所有这些应用的允许列表。",
-  "settings.ipPolicyEnforcingMany": "{{count}} 个应用",
-  "settings.ipPolicyEnforcingNone": "0 个应用",
-  "settings.ipPolicyEnforcingOne": "1 个应用",
+  "settings.ipPolicyEditUsedBy": "修改将立即对所有引用此策略的应用生效。",
+  "settings.ipPolicyEnforcingMany": "{{count}} 个",
+  "settings.ipPolicyEnforcingNone": "0 个",
+  "settings.ipPolicyEnforcingOne": "1 个",
   "settings.ipPolicyEntryInvalidIpv6": "不是有效的 IPv6 地址",
   "settings.ipPolicyEntryLeadingZeros": "不允许前导零",
   "settings.ipPolicyEntryMultipleSlashes": "只能包含一个“/”",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "前缀长度必须为数字",
   "settings.ipPolicyEntryPrefixRange": "前缀长度必须在 0–{{max}} 之间",
   "settings.ipPolicyEntryUnsupported": "仅支持 IPv4 / IPv6 地址和 CIDR 网段",
+  "settings.ipPolicyMore": "更多",
   "settings.ipPolicyName": "名称",
   "settings.ipPolicyNameMax": "名称不能超过 {{max}} 个字符",
   "settings.ipPolicyNamePlaceholder": "例：内部网络",
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
-  "settings.ipPolicyUsedBy": "已被 {{count}} 个应用使用",
-  "settings.ipPolicyUsedByLabel": "被用于",
-  "settings.ipPolicyUsedBy_one": "已被 {{count}} 个应用使用",
+  "settings.ipPolicyUsedBy": "仍有 {{count}} 个应用在引用",
+  "settings.ipPolicyUsedByLabel": "生效中",
+  "settings.ipPolicyUsedBy_one": "仍有 {{count}} 个应用在引用",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",
   "settings.permissionSetDescription": "配置可供应用和知识库使用的权限集。权限集是一组可复用的资源操作权限，可针对特定资源分配给成员。",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index b2adeeaa57e11a..44f86892ebb938 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -35,15 +35,17 @@
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
   "studio.accessControl.addressCount": "{{count}} 个地址",
   "studio.accessControl.applyTo": "应用于",
-  "studio.accessControl.applyToHelp": "选择要保护的访问点。",
-  "studio.accessControl.applyToHelpSelected": "选择此策略要保护的访问点。",
-  "studio.accessControl.chipOff": "Off",
+  "studio.accessControl.applyToHelp": "选择此策略保护的访问入口。",
+  "studio.accessControl.applyToHelpSelected": "选择此策略保护的访问入口。",
+  "studio.accessControl.chipOff": "关闭",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
-  "studio.accessControl.createIpPolicy": "创建 IP 策略",
+  "studio.accessControl.createIpPolicy": "添加 IP 策略",
+  "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
   "studio.accessControl.downgradeDescription": "访问控制需要 Pro 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
+  "studio.accessControl.enableAccessControl": "启用访问控制",
   "studio.accessControl.entryLabel": "访问控制",
   "studio.accessControl.excluded": "未覆盖",
   "studio.accessControl.ipPolicy": "IP 策略",
@@ -59,19 +61,20 @@
   "studio.accessControl.previewAppName": "代码助手",
   "studio.accessControl.previewCaption": "此应用仅允许在组织网络中访问。",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个在服务中的访问点。",
-  "studio.accessControl.protectingPartial": "正在保护 {{n}} / {{m}} 个在服务中的访问点。",
-  "studio.accessControl.protectsCoverage": "保护 {{n}} / {{m}} 个访问点",
+  "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个在服务中的访问入口。",
+  "studio.accessControl.protectingPartial": "正在保护 {{n}} / {{m}} 个在服务中的访问入口。",
+  "studio.accessControl.protectsCoverage": "保护 {{n}} / {{m}} 个访问入口",
   "studio.accessControl.readyToResume": "可恢复",
   "studio.accessControl.restrictByIp": "按 IP 地址限制",
   "studio.accessControl.restrictedTo": "已限制为 {{name}}",
   "studio.accessControl.saveAnyway": "仍要保存",
   "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情况下保存？",
-  "studio.accessControl.selectAccessPoint": "请至少选择一个要保护的访问点。",
-  "studio.accessControl.selectPolicy": "选择策略",
+  "studio.accessControl.selectAccessPoint": "请至少选择一个访问入口。",
+  "studio.accessControl.selectPolicy": "选择 IP 策略",
+  "studio.accessControl.selectPolicyRequired": "请选择一条 IP 策略。",
   "studio.accessControl.tooltipOff": "尚未配置",
-  "studio.accessControl.tooltipOn": "{{name}}，覆盖全部访问点",
-  "studio.accessControl.tooltipPartial": "{{name}}，{{n}} / {{m}} 个访问点",
+  "studio.accessControl.tooltipOn": "全部访问入口",
+  "studio.accessControl.tooltipPartial": "{{total}} 个访问入口中的 {{n}} 个",
   "studio.accessControl.tooltipPaused": "已暂停 — {{name}} 已配置但未生效",
   "studio.accessControl.tooltipPro": "访问控制需要 Pro 套餐",
   "studio.accessControl.turnOffConfirm": "关闭",
@@ -79,11 +82,11 @@
   "studio.accessControl.turnOffTitle": "关闭访问控制？",
   "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
-  "studio.accessPoint.description": "此应用的所有访问方式。访问点仅对应当前运行版本。",
+  "studio.accessPoint.description": "此应用的所有访问方式。访问入口仅对应当前运行版本。",
   "studio.accessPoint.embedIntoSite": "嵌入网站",
   "studio.accessPoint.goToPublish": "去发布",
   "studio.accessPoint.mcpDescription": "将应用作为工具提供给 Agent 和 AI 应用",
-  "studio.accessPoint.noPublishedDescription": "发布一个版本后即可使用内置访问点。",
+  "studio.accessPoint.noPublishedDescription": "发布一个版本后即可使用内置访问入口。",
   "studio.accessPoint.noPublishedTitle": "尚未发布任何版本",
   "studio.accessPoint.notSupported": "不支持",
   "studio.accessPoint.open": "打开",
@@ -92,7 +95,7 @@
   "studio.accessPoint.triggerExclusiveNotice": "使用触发器时，Web 应用、API 访问和 MCP 服务不可用。",
   "studio.accessPoint.unsupportedInDeployedEnvironment": "仅在内置环境中可用。",
   "studio.accessPoint.webAppDescription": "通过托管网页使用应用",
-  "studio.accessPoints": "访问点",
+  "studio.accessPoints": "访问入口",
   "studio.activity.deploy": "部署 {{target}}",
   "studio.activity.deployFailed": "部署 {{target}} 失败",
   "studio.activity.deploySucceeded": "部署 {{target}} 成功",
@@ -126,7 +129,7 @@
   "studio.publisher.noPublishedDescription": "发布草稿后即可在此部署。",
   "studio.publisher.notDeployedYet": "尚未部署",
   "studio.retryVersion": "重试 {{version}}",
-  "studio.undeployConfirmDesc": "该应用将停止在此环境中运行，其所有访问点都将无法使用。",
+  "studio.undeployConfirmDesc": "该应用将停止在此环境中运行，其所有访问入口都将无法使用。",
   "studio.undeployConfirmTitle": "从 {{envName}} 下线 {{versionName}}",
   "studio.updatedAtBy": "{{name}} 于 {{time}} 更新",
   "studio.versionValue": "版本值",
diff --git a/web/i18n/zh-Hans/permission-keys.json b/web/i18n/zh-Hans/permission-keys.json
index 7b69fca42ab843..af2485011ff2e9 100644
--- a/web/i18n/zh-Hans/permission-keys.json
+++ b/web/i18n/zh-Hans/permission-keys.json
@@ -1,7 +1,7 @@
 {
   "agent.acl.access_config": "查看与管理访问权限",
-  "agent.acl.access_point_manage": "管理访问点",
-  "agent.acl.access_point_view": "查看访问点",
+  "agent.acl.access_point_manage": "管理访问入口",
+  "agent.acl.access_point_view": "查看访问入口",
   "agent.acl.delete": "删除 Agent",
   "agent.acl.edit": "编辑 Agent 信息与配置",
   "agent.acl.import_export_dsl": "导入与导出 Agent DSL",
@@ -14,8 +14,8 @@
   "api_extension.manage": "管理API扩展",
   "app.access_config": "配置应用访问权限",
   "app.acl.access_config": "查看与管理访问权限",
-  "app.acl.access_point_manage": "管理访问点",
-  "app.acl.access_point_view": "查看访问点",
+  "app.acl.access_point_manage": "管理访问入口",
+  "app.acl.access_point_view": "查看访问入口",
   "app.acl.delete": "删除应用",
   "app.acl.deploy": "部署应用",
   "app.acl.edit": "编辑应用信息与编排应用",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 8e2c4ec7968c6d..35380afe34ff14 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -571,12 +571,12 @@
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "該策略正在使用中",
-  "settings.ipPolicyDeleteBoundDescription": "確定刪除 <policyName>{{name}}</policyName>？這些應用程式將允許從任何 IP 位址存取。此操作無法復原。",
-  "settings.ipPolicyDeleteConfirm": "刪除 IP 原則？",
-  "settings.ipPolicyDeleteDescription": "確定刪除 <policyName>{{name}}</policyName>？此操作無法復原。",
+  "settings.ipPolicyDeleteBoundDescription": "這些應用程式將允許從任何 IP 位址存取。此操作無法復原。",
+  "settings.ipPolicyDeleteConfirm": "確定刪除 “{{name}}”？",
+  "settings.ipPolicyDeleteDescription": "此操作無法復原。",
   "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
-  "settings.ipPolicyEditUsedBy": "該策略已被 {{count}} 個應用使用。儲存後會更新所有這些應用的允許清單。",
+  "settings.ipPolicyEditUsedBy": "修改將立即對所有套用此原則的應用程式生效。",
   "settings.ipPolicyEnforcingMany": "{{count}} 個應用",
   "settings.ipPolicyEnforcingNone": "0 個應用",
   "settings.ipPolicyEnforcingOne": "1 個應用",
@@ -587,14 +587,15 @@
   "settings.ipPolicyEntryPrefixNotNumber": "前置碼長度必須為數字",
   "settings.ipPolicyEntryPrefixRange": "前置碼長度必須在 0–{{max}} 之間",
   "settings.ipPolicyEntryUnsupported": "僅支援 IPv4 / IPv6 位址和 CIDR 網段",
+  "settings.ipPolicyMore": "更多",
   "settings.ipPolicyName": "名稱",
   "settings.ipPolicyNameMax": "名稱不能超過 {{max}} 個字元",
   "settings.ipPolicyNamePlaceholder": "例：內部網路",
   "settings.ipPolicyNewTitle": "新增 IP 策略",
   "settings.ipPolicyRemoveEntry": "刪除條目",
-  "settings.ipPolicyUsedBy": "已被 {{count}} 個應用使用",
+  "settings.ipPolicyUsedBy": "仍有 {{count}} 個應用程式在使用",
   "settings.ipPolicyUsedByLabel": "被用於",
-  "settings.ipPolicyUsedBy_one": "已被 {{count}} 個應用使用",
+  "settings.ipPolicyUsedBy_one": "仍有 {{count}} 個應用程式在使用",
   "settings.members": "成員",
   "settings.permissionSet": "權限集",
   "settings.permissionSetDescription": "配置可供應用和知識庫使用的權限集。權限集是一組可重複使用的資源操作權限，可針對特定資源分配給成員。",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 901d1b947dc1c2..9bbe0d13bf7ce2 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -40,10 +40,12 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
-  "studio.accessControl.createIpPolicy": "建立 IP 策略",
+  "studio.accessControl.createIpPolicy": "新增 IP 原則",
+  "studio.accessControl.description": "透過套用 IP 原則來控制對此應用程式的存取。",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
+  "studio.accessControl.enableAccessControl": "啟用存取控制",
   "studio.accessControl.entryLabel": "Access Control",
   "studio.accessControl.excluded": "未涵蓋",
   "studio.accessControl.ipPolicy": "IP 策略",
@@ -69,9 +71,10 @@
   "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情況下儲存？",
   "studio.accessControl.selectAccessPoint": "請至少選擇一個要保護的存取點。",
   "studio.accessControl.selectPolicy": "選擇策略",
+  "studio.accessControl.selectPolicyRequired": "請選擇一項 IP 原則。",
   "studio.accessControl.tooltipOff": "尚未設定",
-  "studio.accessControl.tooltipOn": "{{name}}，涵蓋全部存取點",
-  "studio.accessControl.tooltipPartial": "{{name}}，{{n}} / {{m}} 個存取點",
+  "studio.accessControl.tooltipOn": "涵蓋全部存取點",
+  "studio.accessControl.tooltipPartial": "{{n}} / {{total}} 個存取點",
   "studio.accessControl.tooltipPaused": "已暫停 — {{name}} 已設定但未生效",
   "studio.accessControl.tooltipPro": "存取控制需要 Pro 方案",
   "studio.accessControl.turnOffConfirm": "關閉",

From bbfca74704b7601a91e05e0c38f2403aa114ec2b Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:27:40 +0800
Subject: [PATCH 043/108] fix(web): open IP policies for editing from rows
 (SNP-833)

---
 .../ip-policies-page/__tests__/index.spec.tsx | 25 ++++++++++++
 .../ip-policies-page/index.tsx                |  2 +-
 .../ip-policies-page/policy-item.tsx          | 38 +++++++++----------
 3 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index c5bf41554886fe..44df2502c99435 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -516,4 +516,29 @@ describe('IpPoliciesPage', () => {
       }
     },
   )
+  it.each(['owner', 'admin'] as const)(
+    'opens edit directly from the policy row for %s',
+    async (role) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { groups: [createNetworkAccessGroupFixture()] })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+      await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+      expect(screen.getByRole('dialog', { name: 'Edit IP Policy' })).toBeInTheDocument()
+      expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Internal Network')
+      await user.keyboard('{Escape}')
+      await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+      expect(screen.getByRole('menuitem', { name: 'Delete' })).toBeInTheDocument()
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    },
+  )
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index b18d2c9c216747..be919086ca95f4 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -156,7 +156,7 @@ export default function IpPoliciesPage() {
               key={group.id}
               group={group}
               canMutate={canMutate}
-              onView={(group) => setDialogState({ mode: 'view', group })}
+              onView={(group) => setDialogState({ mode: canMutate ? 'edit' : 'view', group })}
               onEdit={(group) => {
                 if (!canMutate) return
                 setDialogState({ mode: 'edit', group })
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 4c647e51bf93df..572c546281ab7c 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -78,25 +78,25 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
 
   return (
     <div className={`${policyRowClassName} border-b border-divider-subtle py-3`}>
-      <div className={policyNameColClassName}>
-        <Button
-          variant="ghost"
-          size="small"
-          className="h-auto max-w-full justify-start p-0 text-text-secondary"
-          onClick={() => onView(group)}
-        >
-          <span className="truncate">{group.name}</span>
-        </Button>
-      </div>
-      <p className={`${policyIpEntriesColClassName} system-sm-regular text-text-tertiary`}>
-        {group.allowed_cidrs.length}
-      </p>
-      <p className={`${policyEnforcingColClassName} system-sm-regular text-text-tertiary`}>
-        {enforcingLabel}
-      </p>
-      <p className={`${policyUpdatedColClassName} system-sm-regular text-text-tertiary`}>
-        {formatTimeFromNow(Date.parse(group.updated_at))}
-      </p>
+      <Button
+        variant="ghost"
+        aria-label={group.name}
+        className="h-auto min-w-0 flex-1 justify-start gap-0 rounded-none p-0 text-left"
+        onClick={() => onView(group)}
+      >
+        <span className={`${policyNameColClassName} system-sm-medium text-text-secondary`}>
+          {group.name}
+        </span>
+        <span className={`${policyIpEntriesColClassName} system-sm-regular text-text-tertiary`}>
+          {group.allowed_cidrs.length}
+        </span>
+        <span className={`${policyEnforcingColClassName} system-sm-regular text-text-tertiary`}>
+          {enforcingLabel}
+        </span>
+        <span className={`${policyUpdatedColClassName} system-sm-regular text-text-tertiary`}>
+          {formatTimeFromNow(Date.parse(group.updated_at))}
+        </span>
+      </Button>
       <div className={policyActionsColClassName}>
         {canMutate && (
           <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>

From 94a15b17d6dd9c6722df289339430cb895956fc5 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:28:19 +0800
Subject: [PATCH 044/108] fix(web): label IP policy counts as total references
 (SNP-828)

---
 .../ip-policies-page/__tests__/index.spec.tsx | 26 +++++++++++++++++++
 .../ip-policies-page/index.tsx                |  8 +++---
 .../ip-policies-page/policy-item.tsx          |  8 +++---
 web/i18n/ar-TN/common.json                    |  2 +-
 web/i18n/de-DE/common.json                    |  2 +-
 web/i18n/en-US/common.json                    |  2 +-
 web/i18n/es-ES/common.json                    |  2 +-
 web/i18n/fa-IR/common.json                    |  2 +-
 web/i18n/fr-FR/common.json                    |  2 +-
 web/i18n/hi-IN/common.json                    |  2 +-
 web/i18n/id-ID/common.json                    |  2 +-
 web/i18n/it-IT/common.json                    |  2 +-
 web/i18n/ja-JP/common.json                    |  2 +-
 web/i18n/ko-KR/common.json                    |  2 +-
 web/i18n/lo-LA/common.json                    |  2 +-
 web/i18n/nl-NL/common.json                    |  2 +-
 web/i18n/pl-PL/common.json                    |  2 +-
 web/i18n/pt-BR/common.json                    |  2 +-
 web/i18n/ro-RO/common.json                    |  2 +-
 web/i18n/ru-RU/common.json                    |  2 +-
 web/i18n/sl-SI/common.json                    |  2 +-
 web/i18n/th-TH/common.json                    |  2 +-
 web/i18n/tr-TR/common.json                    |  2 +-
 web/i18n/uk-UA/common.json                    |  2 +-
 web/i18n/vi-VN/common.json                    |  2 +-
 web/i18n/zh-Hans/common.json                  |  2 +-
 web/i18n/zh-Hant/common.json                  |  2 +-
 27 files changed, 58 insertions(+), 32 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 44df2502c99435..b8822d6aec54b3 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -541,4 +541,30 @@ describe('IpPoliciesPage', () => {
       expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     },
   )
+
+  it.each([0, 1])(
+    'shows total references under Used by even when only %s apps enforce the policy',
+    (enforcingCount) => {
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, {
+        groups: [
+          createNetworkAccessGroupFixture({ used_by_count: 2, enforcing_count: enforcingCount }),
+        ],
+      })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+      expect(screen.getByText('Used by')).toBeInTheDocument()
+      expect(
+        within(screen.getByRole('button', { name: 'Internal Network' })).getByText('2 apps'),
+      ).toBeInTheDocument()
+      expect(screen.queryByText('Enforcing')).not.toBeInTheDocument()
+    },
+  )
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index be919086ca95f4..f6735586f8eace 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -21,12 +21,12 @@ import { consoleQuery } from '@/service/console'
 import { IpPolicyDialog } from './policy-dialog'
 import {
   policyActionsColClassName,
-  policyEnforcingColClassName,
   policyIpEntriesColClassName,
   PolicyItem,
   policyNameColClassName,
   policyRowClassName,
   policyUpdatedColClassName,
+  policyUsedByColClassName,
 } from './policy-item'
 
 type DialogState =
@@ -47,7 +47,7 @@ function IpPoliciesListSkeleton() {
             </SkeletonRow>
           </SkeletonContainer>
           <SkeletonRectangle className={`${policyIpEntriesColClassName} h-4 animate-pulse`} />
-          <SkeletonRectangle className={`${policyEnforcingColClassName} h-4 animate-pulse`} />
+          <SkeletonRectangle className={`${policyUsedByColClassName} h-4 animate-pulse`} />
           <SkeletonRectangle className={`${policyUpdatedColClassName} h-4 animate-pulse`} />
           <div className={policyActionsColClassName} />
         </div>
@@ -143,8 +143,8 @@ export default function IpPoliciesPage() {
             <div className={policyIpEntriesColClassName}>
               {t(($) => $['settings.ipPolicyColumnIpEntries'], { ns: 'common' })}
             </div>
-            <div className={policyEnforcingColClassName}>
-              {t(($) => $['settings.ipPolicyColumnEnforcing'], { ns: 'common' })}
+            <div className={policyUsedByColClassName}>
+              {t(($) => $['settings.ipPolicyColumnUsedBy'], { ns: 'common' })}
             </div>
             <div className={policyUpdatedColClassName}>
               {t(($) => $['settings.ipPolicyColumnUpdatedAt'], { ns: 'common' })}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 572c546281ab7c..512e5f4858f7ec 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -30,7 +30,7 @@ import { PolicyReferencedApps } from './referenced-apps'
 export const policyRowClassName = 'flex items-center pl-3 pr-1'
 export const policyNameColClassName = 'min-w-0 flex-1 truncate'
 export const policyIpEntriesColClassName = 'w-30 shrink-0'
-export const policyEnforcingColClassName = 'w-32 shrink-0'
+export const policyUsedByColClassName = 'w-32 shrink-0'
 export const policyUpdatedColClassName = 'w-52 shrink-0'
 export const policyActionsColClassName = 'flex w-8 shrink-0 items-center justify-center'
 
@@ -50,7 +50,7 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
     consoleQuery.workspaces.current.networkAccessGroups.byGroupId.delete.mutationOptions(),
   )
   const isBound = group.used_by_count > 0
-  const enforcingLabel =
+  const usedByLabel =
     group.used_by_count <= 0
       ? t(($) => $['settings.ipPolicyEnforcingNone'], { ns: 'common' })
       : group.used_by_count === 1
@@ -90,8 +90,8 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
         <span className={`${policyIpEntriesColClassName} system-sm-regular text-text-tertiary`}>
           {group.allowed_cidrs.length}
         </span>
-        <span className={`${policyEnforcingColClassName} system-sm-regular text-text-tertiary`}>
-          {enforcingLabel}
+        <span className={`${policyUsedByColClassName} system-sm-regular text-text-tertiary`}>
+          {usedByLabel}
         </span>
         <span className={`${policyUpdatedColClassName} system-sm-regular text-text-tertiary`}>
           {formatTimeFromNow(Date.parse(group.updated_at))}
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index 231116dd993451..d539b465c50a0c 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "ساري",
   "settings.ipPolicyColumnIpEntries": "إدخالات IP",
   "settings.ipPolicyColumnName": "الاسم",
   "settings.ipPolicyColumnUpdatedAt": "آخر تحديث",
+  "settings.ipPolicyColumnUsedBy": "مستخدمة في",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 759b67d71ddbd3..2ee75494d14e2a 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Aktiv",
   "settings.ipPolicyColumnIpEntries": "IP-Einträge",
   "settings.ipPolicyColumnName": "Name",
   "settings.ipPolicyColumnUpdatedAt": "Aktualisiert",
+  "settings.ipPolicyColumnUsedBy": "Verwendet von",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 09aa5bab7da4ca..255fc1bc49f227 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Used by",
   "settings.ipPolicyColumnIpEntries": "IP Entries",
   "settings.ipPolicyColumnName": "Name",
   "settings.ipPolicyColumnUpdatedAt": "Updated at",
+  "settings.ipPolicyColumnUsedBy": "Used by",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index 99a54d0d05ce18..bd93463e067af6 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "En vigor",
   "settings.ipPolicyColumnIpEntries": "Entradas IP",
   "settings.ipPolicyColumnName": "Nombre",
   "settings.ipPolicyColumnUpdatedAt": "Actualizado",
+  "settings.ipPolicyColumnUsedBy": "Usada por",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index 33f03ab1fc9f38..d88fba7c3a8d34 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "در حال اعمال",
   "settings.ipPolicyColumnIpEntries": "ورودی‌های IP",
   "settings.ipPolicyColumnName": "نام",
   "settings.ipPolicyColumnUpdatedAt": "به‌روزرسانی",
+  "settings.ipPolicyColumnUsedBy": "استفاده‌شده توسط",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 4af27aa343784d..7a29c35f95e380 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "En vigueur",
   "settings.ipPolicyColumnIpEntries": "Entrées IP",
   "settings.ipPolicyColumnName": "Nom",
   "settings.ipPolicyColumnUpdatedAt": "Mis à jour",
+  "settings.ipPolicyColumnUsedBy": "Utilisée par",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 87007acbd7c364..70a8b48d929266 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "लागू",
   "settings.ipPolicyColumnIpEntries": "IP प्रविष्टियाँ",
   "settings.ipPolicyColumnName": "नाम",
   "settings.ipPolicyColumnUpdatedAt": "अपडेट किया गया",
+  "settings.ipPolicyColumnUsedBy": "उपयोगकर्ता ऐप",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index 32bd54689d8578..bf5065d9374d72 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Berlaku",
   "settings.ipPolicyColumnIpEntries": "Entri IP",
   "settings.ipPolicyColumnName": "Nama",
   "settings.ipPolicyColumnUpdatedAt": "Diperbarui",
+  "settings.ipPolicyColumnUsedBy": "Digunakan oleh",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 82e023693039a9..13534cdeda38ea 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "In vigore",
   "settings.ipPolicyColumnIpEntries": "Voci IP",
   "settings.ipPolicyColumnName": "Nome",
   "settings.ipPolicyColumnUpdatedAt": "Aggiornato",
+  "settings.ipPolicyColumnUsedBy": "Utilizzata da",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index b144ff25f6aae7..bdd89f69c084b3 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "許可リスト",
   "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "使用中のアプリ",
   "settings.ipPolicyColumnIpEntries": "IP エントリ",
   "settings.ipPolicyColumnName": "名前",
   "settings.ipPolicyColumnUpdatedAt": "更新日時",
+  "settings.ipPolicyColumnUsedBy": "使用中のアプリ",
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index 543a0d863f5d53..b0574c9299539f 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "적용 중",
   "settings.ipPolicyColumnIpEntries": "IP 항목",
   "settings.ipPolicyColumnName": "이름",
   "settings.ipPolicyColumnUpdatedAt": "업데이트",
+  "settings.ipPolicyColumnUsedBy": "사용 중인 앱",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index e9e78ff4372bb2..fe18c6e335ea05 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "ກຳລັງນຳໃຊ້",
   "settings.ipPolicyColumnIpEntries": "ລາຍການ IP",
   "settings.ipPolicyColumnName": "ຊື່",
   "settings.ipPolicyColumnUpdatedAt": "ອັບເດດ",
+  "settings.ipPolicyColumnUsedBy": "ນຳໃຊ້ໂດຍ",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 3c18334f979ffa..2237db959bc052 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Actief",
   "settings.ipPolicyColumnIpEntries": "IP-vermeldingen",
   "settings.ipPolicyColumnName": "Naam",
   "settings.ipPolicyColumnUpdatedAt": "Bijgewerkt",
+  "settings.ipPolicyColumnUsedBy": "Gebruikt door",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index e0fb110a0664e0..420b500ed0ce2b 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Wymuszane",
   "settings.ipPolicyColumnIpEntries": "Wpisy IP",
   "settings.ipPolicyColumnName": "Nazwa",
   "settings.ipPolicyColumnUpdatedAt": "Zaktualizowano",
+  "settings.ipPolicyColumnUsedBy": "Używana przez",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index dc04f0e7886ce0..e5935c980aa8fd 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Em vigor",
   "settings.ipPolicyColumnIpEntries": "Entradas de IP",
   "settings.ipPolicyColumnName": "Nome",
   "settings.ipPolicyColumnUpdatedAt": "Atualizado em",
+  "settings.ipPolicyColumnUsedBy": "Usada por",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index abaefcb955cf76..6695bec7dd988c 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "În vigoare",
   "settings.ipPolicyColumnIpEntries": "Intrări IP",
   "settings.ipPolicyColumnName": "Nume",
   "settings.ipPolicyColumnUpdatedAt": "Actualizat",
+  "settings.ipPolicyColumnUsedBy": "Utilizată de",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index d8d58135d0b9ca..83a3d3f4555ac8 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Применяется",
   "settings.ipPolicyColumnIpEntries": "IP-записи",
   "settings.ipPolicyColumnName": "Название",
   "settings.ipPolicyColumnUpdatedAt": "Обновлено",
+  "settings.ipPolicyColumnUsedBy": "Используется",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index e134c85acfacf0..5c0a5ddde4e2f8 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "V veljavi",
   "settings.ipPolicyColumnIpEntries": "IP vnosi",
   "settings.ipPolicyColumnName": "Ime",
   "settings.ipPolicyColumnUpdatedAt": "Posodobljeno",
+  "settings.ipPolicyColumnUsedBy": "Uporabljajo",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 95ad2134ef7f05..1ccc41c6c01111 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "กำลังบังคับใช้",
   "settings.ipPolicyColumnIpEntries": "รายการ IP",
   "settings.ipPolicyColumnName": "ชื่อ",
   "settings.ipPolicyColumnUpdatedAt": "อัปเดตเมื่อ",
+  "settings.ipPolicyColumnUsedBy": "ใช้งานโดย",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 54522a58c36b4d..5b1b711cd70416 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Uygulanıyor",
   "settings.ipPolicyColumnIpEntries": "IP kayıtları",
   "settings.ipPolicyColumnName": "Ad",
   "settings.ipPolicyColumnUpdatedAt": "Güncellendi",
+  "settings.ipPolicyColumnUsedBy": "Kullanan uygulamalar",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index 1e1babdfae7727..d4846344bad5e3 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Застосовується",
   "settings.ipPolicyColumnIpEntries": "IP-записи",
   "settings.ipPolicyColumnName": "Назва",
   "settings.ipPolicyColumnUpdatedAt": "Оновлено",
+  "settings.ipPolicyColumnUsedBy": "Використовується",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index b325400c353dfc..8dac2c4e41bc26 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
   "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
-  "settings.ipPolicyColumnEnforcing": "Đang áp dụng",
   "settings.ipPolicyColumnIpEntries": "Mục IP",
   "settings.ipPolicyColumnName": "Tên",
   "settings.ipPolicyColumnUpdatedAt": "Cập nhật",
+  "settings.ipPolicyColumnUsedBy": "Được sử dụng bởi",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyDeleteBound": "This policy is in use",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index e04fb4873ac932..f3ba706da4498a 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "允许列表",
   "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
   "settings.ipPolicyCidrMax": "一条策略最多包含 {{max}} 个地址",
-  "settings.ipPolicyColumnEnforcing": "生效应用",
   "settings.ipPolicyColumnIpEntries": "IP 条目",
   "settings.ipPolicyColumnName": "名称",
   "settings.ipPolicyColumnUpdatedAt": "更新时间",
+  "settings.ipPolicyColumnUsedBy": "生效应用",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "该策略正在使用中",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 35380afe34ff14..24ceadb93c832d 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -564,10 +564,10 @@
   "settings.ipPolicyAllowlist": "允許清單",
   "settings.ipPolicyAllowlistHelp": "支援單一地址（203.0.113.42）或 CIDR 網段（10.0.0.0/8），IPv4 與 IPv6 皆可。",
   "settings.ipPolicyCidrMax": "一條策略最多包含 {{max}} 個地址",
-  "settings.ipPolicyColumnEnforcing": "生效中",
   "settings.ipPolicyColumnIpEntries": "IP 項目",
   "settings.ipPolicyColumnName": "名稱",
   "settings.ipPolicyColumnUpdatedAt": "更新時間",
+  "settings.ipPolicyColumnUsedBy": "使用中的應用程式",
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
   "settings.ipPolicyDeleteBound": "該策略正在使用中",

From e58d4f3ff6290853d89bff4b2bc1232f68c28fde Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:28:27 +0800
Subject: [PATCH 045/108] fix(web): route IP policy references to bound agents
 (SNP-829)

---
 .../ip-policies-page/__tests__/index.spec.tsx | 61 +++++++++++++++++++
 .../ip-policies-page/referenced-apps.tsx      |  6 +-
 2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index b8822d6aec54b3..a4935daa693504 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -567,4 +567,65 @@ describe('IpPoliciesPage', () => {
       expect(screen.queryByText('Enforcing')).not.toBeInTheDocument()
     },
   )
+
+  it.each(['view', 'edit', 'delete'] as const)(
+    'links agent and regular app references correctly in %s',
+    async (mode) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, {
+        groups: [
+          createNetworkAccessGroupFixture({
+            used_by_count: 2,
+            enforcing_count: 1,
+            apps: [
+              {
+                id: 'backing-app',
+                bound_agent_id: 'agent-1',
+                name: 'New Agent',
+                mode: 'workflow',
+                icon: null,
+                icon_type: null,
+                icon_background: null,
+              },
+              {
+                id: 'app-2',
+                name: 'Workflow',
+                mode: 'workflow',
+                icon: null,
+                icon_type: null,
+                icon_background: null,
+              },
+            ],
+          }),
+        ],
+      })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role: mode === 'view' ? 'editor' : 'owner' },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+      if (mode === 'delete') {
+        await user.click(screen.getByRole('button', { name: 'More actions for Internal Network' }))
+        await user.click(screen.getByRole('menuitem', { name: 'Delete' }))
+        expect(screen.getByText('Still used by 2 apps')).toBeInTheDocument()
+      } else {
+        await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+      }
+      expect(screen.getByRole('link', { name: 'New Agent' })).toHaveAttribute(
+        'href',
+        '/agents/agent-1/configure',
+      )
+      expect(screen.getByRole('link', { name: 'New Agent' })).toHaveAttribute('target', '_blank')
+      expect(screen.getByRole('link', { name: 'Workflow' })).toHaveAttribute(
+        'href',
+        '/app/app-2/overview',
+      )
+    },
+  )
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
index de2788e000aabb..bbfa533eb6a54d 100644
--- a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
@@ -32,7 +32,11 @@ export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedApps
       {apps.map((app) => (
         <li key={app.id} className="max-w-full min-w-0">
           <a
-            href={`/app/${app.id}/overview`}
+            href={
+              app.bound_agent_id
+                ? `/agents/${app.bound_agent_id}/configure`
+                : `/app/${app.id}/overview`
+            }
             target="_blank"
             rel="noreferrer"
             className="flex min-h-7 max-w-full items-center gap-1.5 rounded-md border border-components-panel-border-subtle bg-background-default py-1 pr-1.5 pl-1 outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"

From e44f95b2fdd07f7e84c83fcc2d66514ab43755c5 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:28:35 +0800
Subject: [PATCH 046/108] fix(web): accept IPv4-mapped IPv6 policy entries
 (SNP-830)

---
 .../__tests__/policy-dialog.spec.tsx          | 25 ++++++++++++++++++
 .../__tests__/validate-ip-entry.spec.ts       | 26 +++++++++++++++++++
 .../ip-policies-page/validate-ip-entry.ts     | 11 ++++++--
 3 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
index d139e3a0a1bf9a..15c17c3b6063f7 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -111,3 +111,28 @@ describe('IpPolicyDialog', () => {
     })
   })
 })
+
+describe('trusted current IP and allowlist editing', () => {
+  it.each(['create', 'edit'] as const)(
+    'accepts a mapped IPv6 address in %s mode and submits it to the server',
+    async (mode) => {
+      const user = userEvent.setup()
+      const onSubmit = vi.fn()
+      render(
+        <IpPolicyDialog
+          open
+          mode={mode}
+          initialName="Office"
+          initialEntries={['::ffff:203.0.113.42/128']}
+          onOpenChange={vi.fn()}
+          onSubmit={onSubmit}
+        />,
+      )
+      await user.click(screen.getByRole('button', { name: mode === 'create' ? 'Create' : 'Save' }))
+      expect(onSubmit).toHaveBeenCalledWith({
+        name: 'Office',
+        allowed_cidrs: ['::ffff:203.0.113.42/128'],
+      })
+    },
+  )
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
index 7013432893bdbc..c9256cde97a131 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
@@ -71,6 +71,32 @@ describe('validateIpEntry', () => {
     expect(validateIpEntry('10.0.0.*')).toEqual({ kind: 'invalid', code: 'unsupported' })
     expect(validateIpEntry('office.example.com')).toEqual({ kind: 'invalid', code: 'unsupported' })
   })
+
+  it.each([
+    '::ffff:203.0.113.42/128',
+    '::ffff:203.0.113.0/120',
+    '0:0:0:0:0:ffff:203.0.113.42',
+    '::ffff:cb00:712a/128',
+    '2001:db8::192.0.2.1/128',
+    '::/0',
+  ])('accepts valid IPv6 notation also accepted by the backend: %s', (entry) => {
+    expect(validateIpEntry(entry)).toEqual({ kind: 'valid' })
+    expect(canSubmitIpPolicy('Office', [entry])).toBe(true)
+  })
+
+  it.each([
+    '::ffff:203.0.113.256',
+    '::ffff:203.0.113.01',
+    '::ffff:203.0.113',
+    '::ffff::203.0.113.42',
+    '1:2:3:4:5:6:7:203.0.113.42',
+    '::ffff:203.0.113.42:1',
+    '::ffff:203.0.113.42/129',
+    '::ffff:203.0.113.42/128/1',
+  ])('blocks malformed embedded IPv4 or CIDR: %s', (entry) => {
+    expect(validateIpEntry(entry).kind).toBe('invalid')
+    expect(canSubmitIpPolicy('Office', [entry])).toBe(false)
+  })
 })
 
 describe('canSubmitIpPolicy', () => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
index fdcc592e01384e..6885d52c1a9eaa 100644
--- a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -37,7 +37,15 @@ function parseIpv4(address: string): 'valid' | 'leadingZeros' | 'octetRange' | '
 }
 
 function parseIpv6(address: string): boolean {
-  if (address.includes('.')) return false
+  if (address.includes('.')) {
+    const lastColon = address.lastIndexOf(':')
+    const embeddedIpv4 = address.slice(lastColon + 1)
+    if (parseIpv4(embeddedIpv4) !== 'valid') return false
+    const octets = embeddedIpv4.split('.').map(Number)
+    const high = ((octets[0] ?? 0) * 256 + (octets[1] ?? 0)).toString(16)
+    const low = ((octets[2] ?? 0) * 256 + (octets[3] ?? 0)).toString(16)
+    address = `${address.slice(0, lastColon + 1)}${high}:${low}`
+  }
 
   const sides = address.split('::')
   if (sides.length > 2) return false
@@ -138,7 +146,6 @@ export function splitPolicySummary(addresses: readonly string[]): {
   if (addresses.length <= 2) return { listed: addresses, moreCount: 0 }
   return { listed: addresses.slice(0, 2), moreCount: addresses.length - 2 }
 }
-
 function ipv4ToInt(ip: string): number | null {
   const parts = ip.split('.')
   if (parts.length !== 4) return null

From b2a7219076316161ad2af688dc364c37e428823c Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:29:46 +0800
Subject: [PATCH 047/108] fix(web): add trusted current IP to policy allowlists
 (SNP-835)

---
 .../access-control/__tests__/index.spec.tsx   | 31 ++++++-
 .../ip-policies-page/__tests__/index.spec.tsx | 10 ++-
 .../__tests__/policy-dialog.spec.tsx          | 82 ++++++++++++++++++-
 .../__tests__/validate-ip-entry.spec.ts       | 19 +++++
 .../ip-policies-page/allowlist-field.tsx      | 43 ++++++++--
 .../ip-policies-page/policy-dialog.tsx        | 29 ++++++-
 .../ip-policies-page/validate-ip-entry.ts     | 20 +++++
 web/i18n/ar-TN/common.json                    |  2 +
 web/i18n/de-DE/common.json                    |  2 +
 web/i18n/en-US/common.json                    |  2 +
 web/i18n/es-ES/common.json                    |  2 +
 web/i18n/fa-IR/common.json                    |  2 +
 web/i18n/fr-FR/common.json                    |  2 +
 web/i18n/hi-IN/common.json                    |  2 +
 web/i18n/id-ID/common.json                    |  2 +
 web/i18n/it-IT/common.json                    |  2 +
 web/i18n/ja-JP/common.json                    |  2 +
 web/i18n/ko-KR/common.json                    |  2 +
 web/i18n/lo-LA/common.json                    |  2 +
 web/i18n/nl-NL/common.json                    |  2 +
 web/i18n/pl-PL/common.json                    |  2 +
 web/i18n/pt-BR/common.json                    |  2 +
 web/i18n/ro-RO/common.json                    |  2 +
 web/i18n/ru-RU/common.json                    |  2 +
 web/i18n/sl-SI/common.json                    |  2 +
 web/i18n/th-TH/common.json                    |  2 +
 web/i18n/tr-TR/common.json                    |  2 +
 web/i18n/uk-UA/common.json                    |  2 +
 web/i18n/vi-VN/common.json                    |  2 +
 web/i18n/zh-Hans/common.json                  |  2 +
 web/i18n/zh-Hant/common.json                  |  2 +
 31 files changed, 267 insertions(+), 15 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 922742844ab43f..661b99953a4e04 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -104,6 +104,18 @@ const renderEntry = ({
   )
 }
 
+const metadataResponse = (request: Request) => {
+  if (request.url.endsWith('/network-access-groups/current-ip'))
+    return Response.json({ client_ip: '203.0.113.42' })
+}
+
+beforeEach(() => {
+  const fallback = vi.mocked(globalThis.fetch).getMockImplementation()!
+  vi.mocked(globalThis.fetch).mockImplementation(
+    async (input, init) => metadataResponse(new Request(input, init)) ?? fallback(input, init),
+  )
+})
+
 const getChip = () => screen.getByRole('button', { name: /Access Control/ })
 
 describe('AccessControlEntry', () => {
@@ -279,6 +291,8 @@ describe('AccessControlEntry', () => {
     const posted: Array<{ method: string; url: string; body: unknown }> = []
     vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
       const request = input instanceof Request ? input : new Request(String(input), init)
+      const metadata = metadataResponse(request)
+      if (metadata) return metadata
       const bodyText =
         request.method === 'GET' || request.method === 'HEAD' ? '' : await request.text()
       posted.push({
@@ -286,10 +300,19 @@ describe('AccessControlEntry', () => {
         url: request.url,
         body: bodyText ? JSON.parse(bodyText) : null,
       })
-      return new Response(JSON.stringify({ group: created }), {
-        status: 201,
-        headers: { 'content-type': 'application/json' },
-      })
+      if (request.method === 'GET') {
+        return request.url.endsWith('/network-access-groups')
+          ? Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [created] })
+          : Response.json({
+              tenant_id: 'workspace-1',
+              app_id: 'app-1',
+              entitled: true,
+              binding: null,
+              available_access_points: ['webapp', 'service_api', 'mcp'],
+              effective_enabled: false,
+            })
+      }
+      return Response.json({ group: created }, { status: 201 })
     })
     renderEntry({ plan: 'professional' })
 
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index a4935daa693504..824c6ace354746 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -18,6 +18,9 @@ vi.unmock('react-i18next')
 describe('IpPoliciesPage', () => {
   beforeEach(async () => {
     vi.clearAllMocks()
+    vi.mocked(globalThis.fetch).mockImplementation(async () =>
+      Response.json({ client_ip: '203.0.113.42' }),
+    )
     await createInstance()
       .use(initReactI18next)
       .init({
@@ -207,7 +210,11 @@ describe('IpPoliciesPage', () => {
         expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
         expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
       }
-      expect(globalThis.fetch).not.toHaveBeenCalled()
+      expect(
+        vi
+          .mocked(globalThis.fetch)
+          .mock.calls.filter(([input, init]) => new Request(input, init).method !== 'GET'),
+      ).toHaveLength(0)
     },
   )
 
@@ -516,6 +523,7 @@ describe('IpPoliciesPage', () => {
       }
     },
   )
+
   it.each(['owner', 'admin'] as const)(
     'opens edit directly from the policy row for %s',
     async (role) => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
index 15c17c3b6063f7..e1376f42683fb3 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -1,7 +1,7 @@
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useState } from 'react'
-import { render } from '@/test/console/render'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { IpPolicyDialog } from '../policy-dialog'
 
 const translations = vi.hoisted(() => ({
@@ -26,7 +26,8 @@ const translations = vi.hoisted(() => ({
 
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  return createReactI18nextMock(translations)
+  const { default: commonTranslations } = await import('@/i18n/en-US/common.json')
+  return createReactI18nextMock({ ...commonTranslations, ...translations })
 })
 
 function DialogHarness({
@@ -49,6 +50,11 @@ function DialogHarness({
 }
 
 describe('IpPolicyDialog', () => {
+  beforeEach(() => {
+    vi.mocked(globalThis.fetch).mockImplementation(async () =>
+      Response.json({ client_ip: '203.0.113.42' }),
+    )
+  })
   it('keeps Create disabled until the name and a valid entry are filled', async () => {
     const user = userEvent.setup()
     render(<DialogHarness />)
@@ -113,6 +119,78 @@ describe('IpPolicyDialog', () => {
 })
 
 describe('trusted current IP and allowlist editing', () => {
+  beforeEach(() => {
+    vi.mocked(globalThis.fetch).mockImplementation(async () =>
+      Response.json({ client_ip: '203.0.113.42' }),
+    )
+  })
+
+  it('loads the current IP without an existing policy and preserves input when adding it', async () => {
+    const user = userEvent.setup()
+    const onSubmit = vi.fn()
+    render(<DialogHarness onSubmit={onSubmit} />)
+    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+    expect(await screen.findByText('Your current IP is 203.0.113.42')).toBeInTheDocument()
+    const request = new Request(vi.mocked(globalThis.fetch).mock.calls[0]![0])
+    expect(request.method).toBe('GET')
+    expect(request.url).toBe(
+      'http://localhost:5001/console/api/workspaces/current/network-access-groups/current-ip',
+    )
+    await user.click(screen.getByRole('button', { name: 'Add it' }))
+    expect(
+      screen.getAllByPlaceholderText('10.0.0.0/8').map((row) => (row as HTMLInputElement).value),
+    ).toEqual(['10.0.0.0/8', '203.0.113.42'])
+    expect(screen.getByRole('button', { name: 'Add it' })).toBeDisabled()
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    expect(onSubmit).not.toHaveBeenCalled()
+  })
+
+  it('shows a retryable error instead of a guessed IP when the trusted endpoint returns 503', async () => {
+    const user = userEvent.setup()
+    vi.mocked(globalThis.fetch).mockResolvedValueOnce(
+      Response.json({ message: 'IP unavailable' }, { status: 503 }),
+    )
+    render(<DialogHarness />)
+    expect(
+      await screen.findByText('Unable to check your IP address. Please try again.'),
+    ).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Add it' })).not.toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Retry' }))
+    expect(await screen.findByText('Your current IP is 203.0.113.42')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add it' })).toBeEnabled()
+  })
+
+  it.each(['203.0.113.42/32', '::ffff:203.0.113.42/128'])(
+    'does not duplicate the current IP already stored as %s',
+    async (entry) => {
+      render(
+        <IpPolicyDialog
+          open
+          mode="edit"
+          initialName="Office"
+          initialEntries={[entry]}
+          onOpenChange={vi.fn()}
+        />,
+      )
+      expect(await screen.findByRole('button', { name: 'Add it' })).toBeDisabled()
+    },
+  )
+
+  it('does not append an IP beyond the 100 entry limit', async () => {
+    render(
+      <IpPolicyDialog
+        open
+        mode="edit"
+        initialName="Office"
+        initialEntries={Array.from({ length: 100 }, (_, i) => `10.0.0.${i}/32`)}
+        onOpenChange={vi.fn()}
+      />,
+    )
+    expect(await screen.findByRole('button', { name: 'Add it' })).toBeDisabled()
+    expect(screen.getByRole('button', { name: 'Add' })).toBeDisabled()
+    expect(screen.getAllByPlaceholderText('10.0.0.0/8')).toHaveLength(100)
+  })
+
   it.each(['create', 'edit'] as const)(
     'accepts a mapped IPv6 address in %s mode and submits it to the server',
     async (mode) => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
index c9256cde97a131..1ad5c99d1a9d39 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
@@ -4,6 +4,7 @@ import {
   collectIpAddresses,
   IP_POLICY_CIDR_MAX_COUNT,
   IP_POLICY_NAME_MAX_LENGTH,
+  isSameIpAddress,
   toAllowedCidr,
   validateIpEntry,
 } from '../validate-ip-entry'
@@ -99,6 +100,24 @@ describe('validateIpEntry', () => {
   })
 })
 
+describe('isSameIpAddress', () => {
+  it.each([
+    ['203.0.113.42/32', '203.0.113.42'],
+    ['::ffff:203.0.113.42/128', '203.0.113.42'],
+    ['::ffff:cb00:712a', '203.0.113.42'],
+    ['2001:0DB8:0:0:0:0:0:1/128', '2001:db8::1'],
+  ])('recognizes duplicate host entries %s and %s', (entry, ip) => {
+    expect(isSameIpAddress(entry, ip)).toBe(true)
+  })
+
+  it('keeps ranges and distinct addresses separate from host entries', () => {
+    expect(isSameIpAddress('203.0.113.0/24', '203.0.113.42')).toBe(false)
+    expect(isSameIpAddress('2001:db8::/32', '2001:db8::1')).toBe(false)
+    expect(isSameIpAddress('203.0.113.43', '203.0.113.42')).toBe(false)
+    expect(isSameIpAddress('invalid', '203.0.113.42')).toBe(false)
+  })
+})
+
 describe('canSubmitIpPolicy', () => {
   it('requires a name and at least one valid entry', () => {
     expect(canSubmitIpPolicy('', ['10.0.0.0/8'])).toBe(false)
diff --git a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
index e712ba6648a583..f6a75f01721491 100644
--- a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
@@ -8,15 +8,23 @@ import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { Input } from '@langgenius/dify-ui/input'
 import { useTranslation } from 'react-i18next'
 import { createAllowlistRow } from './allowlist-row'
-import { validateIpEntry } from './validate-ip-entry'
+import { IP_POLICY_CIDR_MAX_COUNT, isSameIpAddress, validateIpEntry } from './validate-ip-entry'
 
 type AllowlistFieldProps = {
   entries: AllowlistRow[]
   currentIp?: string
+  currentIpStatus?: 'loading' | 'error'
+  onRetryCurrentIp?: () => void
   onEntriesChange: (entries: AllowlistRow[]) => void
 }
 
-export function AllowlistField({ entries, currentIp, onEntriesChange }: AllowlistFieldProps) {
+export function AllowlistField({
+  entries,
+  currentIp,
+  currentIpStatus,
+  onRetryCurrentIp,
+  onEntriesChange,
+}: AllowlistFieldProps) {
   const { t } = useTranslation()
 
   const errorMessage = (code: IpEntryErrorCode, max?: 32 | 128) => {
@@ -54,13 +62,14 @@ export function AllowlistField({ entries, currentIp, onEntriesChange }: Allowlis
 
   const addCurrentIp = () => {
     if (!currentIp) return
-    if (entries.some((entry) => entry.value.trim() === currentIp)) return
+    if (entries.some((entry) => isSameIpAddress(entry.value, currentIp))) return
     const emptyRow = entries.find((entry) => entry.value.trim() === '')
     if (emptyRow) {
       updateEntry(emptyRow.id, currentIp)
       return
     }
-    onEntriesChange([...entries, createAllowlistRow(currentIp)])
+    if (entries.length < IP_POLICY_CIDR_MAX_COUNT)
+      onEntriesChange([...entries, createAllowlistRow(currentIp)])
   }
 
   return (
@@ -119,22 +128,42 @@ export function AllowlistField({ entries, currentIp, onEntriesChange }: Allowlis
         variant="secondary"
         size="small"
         className="shrink-0 self-start"
+        disabled={entries.length >= IP_POLICY_CIDR_MAX_COUNT}
         onClick={() => onEntriesChange([...entries, createAllowlistRow()])}
       >
         <span aria-hidden className="i-ri-add-line size-4" />
         {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
       </Button>
 
+      {currentIpStatus && (
+        <p role="status" className="system-xs-regular text-text-tertiary">
+          {currentIpStatus === 'loading'
+            ? t(($) => $['settings.ipPolicyCurrentIpLoading'], { ns: 'common' })
+            : t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
+          {currentIpStatus === 'error' && onRetryCurrentIp && (
+            <Button type="button" variant="ghost" size="small" onClick={onRetryCurrentIp}>
+              {t(($) => $['operation.retry'], { ns: 'common' })}
+            </Button>
+          )}
+        </p>
+      )}
+
       {currentIp && (
         <p className="flex shrink-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
           <span>{t(($) => $['settings.ipPolicyCurrentIp'], { ns: 'common', ip: currentIp })}</span>
-          <button
+          <Button
             type="button"
-            className="system-xs-medium text-text-accent outline-hidden hover:underline focus-visible:ring-2 focus-visible:ring-state-accent-solid"
+            variant="ghost-accent"
+            size="small"
+            disabled={
+              entries.some((entry) => isSameIpAddress(entry.value, currentIp)) ||
+              (entries.length >= IP_POLICY_CIDR_MAX_COUNT &&
+                entries.every((entry) => entry.value.trim() !== ''))
+            }
             onClick={addCurrentIp}
           >
             {t(($) => $['settings.ipPolicyAddCurrentIp'], { ns: 'common' })}
-          </button>
+          </Button>
         </p>
       )}
     </Field>
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 77241b49905e55..09c2996a9b512b 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -12,8 +12,10 @@ import {
 import { Field, FieldLabel } from '@langgenius/dify-ui/field'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { Input } from '@langgenius/dify-ui/input'
+import { useQuery } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { consoleQuery } from '@/service/console'
 import { AllowlistField } from './allowlist-field'
 import { createAllowlistRow } from './allowlist-row'
 import { PolicyReferencedApps } from './referenced-apps'
@@ -54,6 +56,23 @@ export function IpPolicyDialog({
   onSubmit,
 }: IpPolicyDialogProps) {
   const { t } = useTranslation()
+  const currentIpQuery = useQuery(
+    consoleQuery.workspaces.current.networkAccessGroups.currentIp.get.queryOptions({
+      enabled: open && mode !== 'view' && currentIp === undefined,
+      retry: false,
+      staleTime: 0,
+      gcTime: 0,
+      context: { silent: true },
+    }),
+  )
+  const resolvedCurrentIp =
+    currentIp ?? (currentIpQuery.isSuccess ? currentIpQuery.data.client_ip : undefined)
+  const currentIpStatus =
+    currentIp !== undefined || currentIpQuery.isSuccess
+      ? undefined
+      : currentIpQuery.isError
+        ? 'error'
+        : 'loading'
   const [name, setName] = useState(initialName)
   const [entries, setEntries] = useState(() =>
     initialEntries && initialEntries.length > 0
@@ -165,7 +184,15 @@ export function IpPolicyDialog({
               />
             </Field>
 
-            <AllowlistField entries={entries} currentIp={currentIp} onEntriesChange={setEntries} />
+            <AllowlistField
+              entries={entries}
+              currentIp={resolvedCurrentIp}
+              currentIpStatus={currentIpStatus}
+              onRetryCurrentIp={() => {
+                void currentIpQuery.refetch()
+              }}
+              onEntriesChange={setEntries}
+            />
 
             {mode === 'edit' && usedByCount > 0 && (
               <Field className="flex shrink-0 flex-col gap-3">
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
index 6885d52c1a9eaa..3dd3d102dc42e9 100644
--- a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -139,6 +139,26 @@ export function collectAllowedCidrs(entries: readonly string[]) {
   return collectIpAddresses(entries).map(toAllowedCidr)
 }
 
+/** Compare host entries, including compressed and IPv4-mapped IPv6, without matching ranges. */
+export function isSameIpAddress(entry: string, ip: string): boolean {
+  const normalize = (raw: string) => {
+    const value = raw.trim()
+    if (validateIpEntry(value).kind !== 'valid') return null
+    const [address = '', prefix] = value.split('/')
+    const ipv6 = address.includes(':')
+    if (prefix !== undefined && Number(prefix) !== (ipv6 ? 128 : 32)) return null
+    if (!ipv6) return address
+    const canonical = new URL(`http://[${address}]/`).hostname.slice(1, -1)
+    const mapped = /^::ffff:([0-9a-f]+):([0-9a-f]+)$/.exec(canonical)
+    if (!mapped) return canonical
+    const high = Number.parseInt(mapped[1] ?? '', 16)
+    const low = Number.parseInt(mapped[2] ?? '', 16)
+    return [high >> 8, high & 255, low >> 8, low & 255].join('.')
+  }
+  const address = normalize(entry)
+  return address !== null && address === normalize(ip)
+}
+
 export function splitPolicySummary(addresses: readonly string[]): {
   listed: readonly string[]
   moreCount: number
diff --git a/web/i18n/ar-TN/common.json b/web/i18n/ar-TN/common.json
index d539b465c50a0c..bf94a78223c695 100644
--- a/web/i18n/ar-TN/common.json
+++ b/web/i18n/ar-TN/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "مستخدمة في",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "تعذّر التحقق من عنوان IP الخاص بك. يرجى المحاولة مرة أخرى.",
+  "settings.ipPolicyCurrentIpLoading": "جارٍ التحقق من عنوان IP الخاص بك…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ستسمح هذه التطبيقات بالوصول من أي عنوان IP. لا يمكن التراجع عن هذا الإجراء.",
   "settings.ipPolicyDeleteConfirm": "هل تريد حذف “{{name}}”؟",
diff --git a/web/i18n/de-DE/common.json b/web/i18n/de-DE/common.json
index 2ee75494d14e2a..c0c620db0e30eb 100644
--- a/web/i18n/de-DE/common.json
+++ b/web/i18n/de-DE/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Verwendet von",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Ihre IP-Adresse konnte nicht überprüft werden. Bitte versuchen Sie es erneut.",
+  "settings.ipPolicyCurrentIpLoading": "Ihre IP-Adresse wird überprüft…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Diese Apps erlauben dann den Zugriff von jeder IP-Adresse. Dies kann nicht rückgängig gemacht werden.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” löschen?",
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index 255fc1bc49f227..f252004ea1f622 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Used by",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Unable to check your IP address. Please try again.",
+  "settings.ipPolicyCurrentIpLoading": "Checking your IP address…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Apps using this policy will become accessible from any IP address. This can’t be undone.",
   "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
diff --git a/web/i18n/es-ES/common.json b/web/i18n/es-ES/common.json
index bd93463e067af6..aca771c90e0681 100644
--- a/web/i18n/es-ES/common.json
+++ b/web/i18n/es-ES/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Usada por",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "No se pudo comprobar tu dirección IP. Inténtalo de nuevo.",
+  "settings.ipPolicyCurrentIpLoading": "Comprobando tu dirección IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Estas aplicaciones permitirán el acceso desde cualquier dirección IP. Esta acción no se puede deshacer.",
   "settings.ipPolicyDeleteConfirm": "¿Eliminar “{{name}}”?",
diff --git a/web/i18n/fa-IR/common.json b/web/i18n/fa-IR/common.json
index d88fba7c3a8d34..3ea55ce31a6c47 100644
--- a/web/i18n/fa-IR/common.json
+++ b/web/i18n/fa-IR/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "استفاده‌شده توسط",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "بررسی نشانی IP شما ممکن نیست. لطفاً دوباره تلاش کنید.",
+  "settings.ipPolicyCurrentIpLoading": "در حال بررسی نشانی IP شما…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "این برنامه‌ها دسترسی از هر نشانی IP را مجاز خواهند کرد. این اقدام قابل بازگشت نیست.",
   "settings.ipPolicyDeleteConfirm": "آیا “{{name}}” حذف شود؟",
diff --git a/web/i18n/fr-FR/common.json b/web/i18n/fr-FR/common.json
index 7a29c35f95e380..9d401e9c3bb9aa 100644
--- a/web/i18n/fr-FR/common.json
+++ b/web/i18n/fr-FR/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Utilisée par",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Impossible de vérifier votre adresse IP. Veuillez réessayer.",
+  "settings.ipPolicyCurrentIpLoading": "Vérification de votre adresse IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Ces applications autoriseront l’accès depuis n’importe quelle adresse IP. Cette action est irréversible.",
   "settings.ipPolicyDeleteConfirm": "Supprimer “{{name}}” ?",
diff --git a/web/i18n/hi-IN/common.json b/web/i18n/hi-IN/common.json
index 70a8b48d929266..9bf45d42b93ef3 100644
--- a/web/i18n/hi-IN/common.json
+++ b/web/i18n/hi-IN/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "उपयोगकर्ता ऐप",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "आपके IP पते की जाँच नहीं हो सकी। कृपया फिर से प्रयास करें।",
+  "settings.ipPolicyCurrentIpLoading": "आपके IP पते की जाँच की जा रही है…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ये ऐप किसी भी IP पते से एक्सेस की अनुमति देंगे। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” हटाएं?",
diff --git a/web/i18n/id-ID/common.json b/web/i18n/id-ID/common.json
index bf5065d9374d72..e67f831cfc1c5d 100644
--- a/web/i18n/id-ID/common.json
+++ b/web/i18n/id-ID/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Digunakan oleh",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Alamat IP Anda tidak dapat diperiksa. Coba lagi.",
+  "settings.ipPolicyCurrentIpLoading": "Memeriksa alamat IP Anda…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Aplikasi ini akan mengizinkan akses dari alamat IP mana pun. Tindakan ini tidak dapat dibatalkan.",
   "settings.ipPolicyDeleteConfirm": "Hapus “{{name}}”?",
diff --git a/web/i18n/it-IT/common.json b/web/i18n/it-IT/common.json
index 13534cdeda38ea..da5054c874cd45 100644
--- a/web/i18n/it-IT/common.json
+++ b/web/i18n/it-IT/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Utilizzata da",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Impossibile verificare il tuo indirizzo IP. Riprova.",
+  "settings.ipPolicyCurrentIpLoading": "Verifica dell’indirizzo IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Queste app consentiranno l’accesso da qualsiasi indirizzo IP. Questa azione non può essere annullata.",
   "settings.ipPolicyDeleteConfirm": "Eliminare “{{name}}”?",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index bdd89f69c084b3..e172a372ea4e11 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "使用中のアプリ",
   "settings.ipPolicyCreate": "作成",
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
+  "settings.ipPolicyCurrentIpError": "IP アドレスを確認できません。もう一度お試しください。",
+  "settings.ipPolicyCurrentIpLoading": "IP アドレスを確認しています…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "このポリシーを使用しているアプリには、すべての IP アドレスからアクセスできるようになります。この操作は元に戻せません。",
   "settings.ipPolicyDeleteConfirm": "「{{name}}」を削除しますか？",
diff --git a/web/i18n/ko-KR/common.json b/web/i18n/ko-KR/common.json
index b0574c9299539f..07d8d1b9917b02 100644
--- a/web/i18n/ko-KR/common.json
+++ b/web/i18n/ko-KR/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "사용 중인 앱",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "IP 주소를 확인할 수 없습니다. 다시 시도하세요.",
+  "settings.ipPolicyCurrentIpLoading": "IP 주소 확인 중…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "이 앱들은 모든 IP 주소에서 접근할 수 있게 됩니다. 이 작업은 되돌릴 수 없습니다.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}”을(를) 삭제하시겠습니까?",
diff --git a/web/i18n/lo-LA/common.json b/web/i18n/lo-LA/common.json
index fe18c6e335ea05..5e4fa955821757 100644
--- a/web/i18n/lo-LA/common.json
+++ b/web/i18n/lo-LA/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "ນຳໃຊ້ໂດຍ",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "ບໍ່ສາມາດກວດສອບທີ່ຢູ່ IP ຂອງທ່ານໄດ້. ກະລຸນາລອງໃໝ່.",
+  "settings.ipPolicyCurrentIpLoading": "ກຳລັງກວດສອບທີ່ຢູ່ IP ຂອງທ່ານ…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ແອັບເຫຼົ່ານີ້ຈະອະນຸຍາດໃຫ້ເຂົ້າເຖິງຈາກທີ່ຢູ່ IP ໃດກໍໄດ້. ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
   "settings.ipPolicyDeleteConfirm": "ລຶບ “{{name}}” ຫຼືບໍ່?",
diff --git a/web/i18n/nl-NL/common.json b/web/i18n/nl-NL/common.json
index 2237db959bc052..da413a49fe3ad9 100644
--- a/web/i18n/nl-NL/common.json
+++ b/web/i18n/nl-NL/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Gebruikt door",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Je IP-adres kan niet worden gecontroleerd. Probeer het opnieuw.",
+  "settings.ipPolicyCurrentIpLoading": "Je IP-adres wordt gecontroleerd…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Deze apps staan dan toegang vanaf elk IP-adres toe. Dit kan niet ongedaan worden gemaakt.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” verwijderen?",
diff --git a/web/i18n/pl-PL/common.json b/web/i18n/pl-PL/common.json
index 420b500ed0ce2b..f7c2193dde8289 100644
--- a/web/i18n/pl-PL/common.json
+++ b/web/i18n/pl-PL/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Używana przez",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Nie można sprawdzić Twojego adresu IP. Spróbuj ponownie.",
+  "settings.ipPolicyCurrentIpLoading": "Sprawdzanie Twojego adresu IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Te aplikacje będą zezwalać na dostęp z dowolnego adresu IP. Tej operacji nie można cofnąć.",
   "settings.ipPolicyDeleteConfirm": "Usunąć “{{name}}”?",
diff --git a/web/i18n/pt-BR/common.json b/web/i18n/pt-BR/common.json
index e5935c980aa8fd..cc5a3cbc091f16 100644
--- a/web/i18n/pt-BR/common.json
+++ b/web/i18n/pt-BR/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Usada por",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Não foi possível verificar seu endereço IP. Tente novamente.",
+  "settings.ipPolicyCurrentIpLoading": "Verificando seu endereço IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Esses aplicativos permitirão o acesso de qualquer endereço IP. Esta ação não pode ser desfeita.",
   "settings.ipPolicyDeleteConfirm": "Excluir “{{name}}”?",
diff --git a/web/i18n/ro-RO/common.json b/web/i18n/ro-RO/common.json
index 6695bec7dd988c..2ff4b866aa116e 100644
--- a/web/i18n/ro-RO/common.json
+++ b/web/i18n/ro-RO/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Utilizată de",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Adresa IP nu poate fi verificată. Încercați din nou.",
+  "settings.ipPolicyCurrentIpLoading": "Se verifică adresa IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Aceste aplicații vor permite accesul de la orice adresă IP. Această acțiune nu poate fi anulată.",
   "settings.ipPolicyDeleteConfirm": "Ștergeți “{{name}}”?",
diff --git a/web/i18n/ru-RU/common.json b/web/i18n/ru-RU/common.json
index 83a3d3f4555ac8..cdeec4b3d47d6e 100644
--- a/web/i18n/ru-RU/common.json
+++ b/web/i18n/ru-RU/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Используется",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Не удалось проверить ваш IP-адрес. Повторите попытку.",
+  "settings.ipPolicyCurrentIpLoading": "Проверка вашего IP-адреса…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Эти приложения станут доступны с любого IP-адреса. Это действие нельзя отменить.",
   "settings.ipPolicyDeleteConfirm": "Удалить “{{name}}”?",
diff --git a/web/i18n/sl-SI/common.json b/web/i18n/sl-SI/common.json
index 5c0a5ddde4e2f8..3dd1e6a974a0f5 100644
--- a/web/i18n/sl-SI/common.json
+++ b/web/i18n/sl-SI/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Uporabljajo",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Vašega naslova IP ni mogoče preveriti. Poskusite znova.",
+  "settings.ipPolicyCurrentIpLoading": "Preverjanje vašega naslova IP…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Te aplikacije bodo dovolile dostop s katerega koli naslova IP. Tega dejanja ni mogoče razveljaviti.",
   "settings.ipPolicyDeleteConfirm": "Izbrišem “{{name}}”?",
diff --git a/web/i18n/th-TH/common.json b/web/i18n/th-TH/common.json
index 1ccc41c6c01111..c1db7089dd88d5 100644
--- a/web/i18n/th-TH/common.json
+++ b/web/i18n/th-TH/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "ใช้งานโดย",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "ไม่สามารถตรวจสอบที่อยู่ IP ของคุณได้ โปรดลองอีกครั้ง",
+  "settings.ipPolicyCurrentIpLoading": "กำลังตรวจสอบที่อยู่ IP ของคุณ…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "แอปเหล่านี้จะอนุญาตให้เข้าถึงจากที่อยู่ IP ใดก็ได้ การดำเนินการนี้ไม่สามารถยกเลิกได้",
   "settings.ipPolicyDeleteConfirm": "ลบ “{{name}}” หรือไม่?",
diff --git a/web/i18n/tr-TR/common.json b/web/i18n/tr-TR/common.json
index 5b1b711cd70416..1c43df0bc8821c 100644
--- a/web/i18n/tr-TR/common.json
+++ b/web/i18n/tr-TR/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Kullanan uygulamalar",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "IP adresiniz kontrol edilemiyor. Lütfen tekrar deneyin.",
+  "settings.ipPolicyCurrentIpLoading": "IP adresiniz kontrol ediliyor…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Bu uygulamalar herhangi bir IP adresinden erişime izin verecek. Bu işlem geri alınamaz.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” silinsin mi?",
diff --git a/web/i18n/uk-UA/common.json b/web/i18n/uk-UA/common.json
index d4846344bad5e3..491046ae38e65e 100644
--- a/web/i18n/uk-UA/common.json
+++ b/web/i18n/uk-UA/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Використовується",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Не вдалося перевірити вашу IP-адресу. Спробуйте ще раз.",
+  "settings.ipPolicyCurrentIpLoading": "Перевірка вашої IP-адреси…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Ці застосунки дозволятимуть доступ із будь-якої IP-адреси. Цю дію неможливо скасувати.",
   "settings.ipPolicyDeleteConfirm": "Видалити “{{name}}”?",
diff --git a/web/i18n/vi-VN/common.json b/web/i18n/vi-VN/common.json
index 8dac2c4e41bc26..7582ba5c113c21 100644
--- a/web/i18n/vi-VN/common.json
+++ b/web/i18n/vi-VN/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "Được sử dụng bởi",
   "settings.ipPolicyCreate": "Create",
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
+  "settings.ipPolicyCurrentIpError": "Không thể kiểm tra địa chỉ IP của bạn. Vui lòng thử lại.",
+  "settings.ipPolicyCurrentIpLoading": "Đang kiểm tra địa chỉ IP của bạn…",
   "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Các ứng dụng này sẽ cho phép truy cập từ mọi địa chỉ IP. Không thể hoàn tác thao tác này.",
   "settings.ipPolicyDeleteConfirm": "Xóa “{{name}}”?",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index f3ba706da4498a..8c0cd1355982a5 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "生效应用",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
+  "settings.ipPolicyCurrentIpError": "无法检查您的 IP 地址，请重试。",
+  "settings.ipPolicyCurrentIpLoading": "正在检查您的 IP 地址…",
   "settings.ipPolicyDeleteBound": "该策略正在使用中",
   "settings.ipPolicyDeleteBoundDescription": "正在引用此策略的应用将完全开放访问。此操作无法撤销。",
   "settings.ipPolicyDeleteConfirm": "删除“{{name}}”？",
diff --git a/web/i18n/zh-Hant/common.json b/web/i18n/zh-Hant/common.json
index 24ceadb93c832d..f25cfef572b4b0 100644
--- a/web/i18n/zh-Hant/common.json
+++ b/web/i18n/zh-Hant/common.json
@@ -570,6 +570,8 @@
   "settings.ipPolicyColumnUsedBy": "使用中的應用程式",
   "settings.ipPolicyCreate": "建立",
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
+  "settings.ipPolicyCurrentIpError": "無法檢查您的 IP 位址，請重試。",
+  "settings.ipPolicyCurrentIpLoading": "正在檢查您的 IP 位址…",
   "settings.ipPolicyDeleteBound": "該策略正在使用中",
   "settings.ipPolicyDeleteBoundDescription": "這些應用程式將允許從任何 IP 位址存取。此操作無法復原。",
   "settings.ipPolicyDeleteConfirm": "確定刪除 “{{name}}”？",

From c5a9e9bb0cb148cd5dc1a6f0d22f7fd3b4c196f9 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:30:01 +0800
Subject: [PATCH 048/108] fix(web): check current IP before saving access
 control (SNP-826)

---
 .../app/access-point/__tests__/index.spec.tsx |  46 +++-
 .../__tests__/config-panel.spec.tsx           |  11 +-
 .../access-control/__tests__/draft.spec.ts    |  16 +-
 .../access-control/__tests__/index.spec.tsx   | 237 ++++++++++++++++--
 .../access-control/config-panel.tsx           |  26 +-
 .../app/access-point/access-control/index.tsx | 174 +++++++++++--
 .../access-control/policy-field.tsx           |  35 ++-
 web/app/components/app/access-point/index.tsx |   6 +
 .../ip-policies-page/validate-ip-entry.ts     |  36 ---
 .../access/__tests__/page.spec.tsx            |  27 +-
 .../agent-v2/agent-detail/access/page.tsx     |   1 +
 web/i18n/ar-TN/deployments.json               |   1 +
 web/i18n/de-DE/deployments.json               |   1 +
 web/i18n/en-US/deployments.json               |   1 +
 web/i18n/es-ES/deployments.json               |   1 +
 web/i18n/fa-IR/deployments.json               |   1 +
 web/i18n/fr-FR/deployments.json               |   1 +
 web/i18n/hi-IN/deployments.json               |   1 +
 web/i18n/id-ID/deployments.json               |   1 +
 web/i18n/it-IT/deployments.json               |   1 +
 web/i18n/ja-JP/deployments.json               |   1 +
 web/i18n/ko-KR/deployments.json               |   1 +
 web/i18n/lo-LA/deployments.json               |   1 +
 web/i18n/nl-NL/deployments.json               |   1 +
 web/i18n/pl-PL/deployments.json               |   1 +
 web/i18n/pt-BR/deployments.json               |   1 +
 web/i18n/ro-RO/deployments.json               |   1 +
 web/i18n/ru-RU/deployments.json               |   1 +
 web/i18n/sl-SI/deployments.json               |   1 +
 web/i18n/th-TH/deployments.json               |   1 +
 web/i18n/tr-TR/deployments.json               |   1 +
 web/i18n/uk-UA/deployments.json               |   1 +
 web/i18n/vi-VN/deployments.json               |   1 +
 web/i18n/zh-Hans/deployments.json             |   1 +
 web/i18n/zh-Hant/deployments.json             |   1 +
 35 files changed, 523 insertions(+), 116 deletions(-)

diff --git a/web/app/components/app/access-point/__tests__/index.spec.tsx b/web/app/components/app/access-point/__tests__/index.spec.tsx
index c2fdb7b9c9b461..af13c684b810d9 100644
--- a/web/app/components/app/access-point/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/index.spec.tsx
@@ -8,6 +8,11 @@ import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { consoleQuery } from '@/service/console'
 import { seedAccountProfileQuery } from '@/test/console/account-profile'
 import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
+import {
+  createNetworkAccessGroupFixture,
+  seedAppNetworkAccessGroup,
+  seedNetworkAccessGroups,
+} from '@/test/console/network-access'
 import { seedSystemFeatures } from '@/test/console/query-data'
 import { QueryClientTestProvider } from '@/test/console/query-provider'
 import { render } from '@/test/console/render'
@@ -16,6 +21,7 @@ import { AppACLPermission } from '@/utils/permission'
 import AccessPoint from '..'
 
 let appMode = 'workflow'
+let appPublished = false
 let appPermissionKeys: string[] = [AppACLPermission.AccessPointView]
 const accessPointMocks = vi.hoisted(() => ({
   builtIn: vi.fn(),
@@ -28,7 +34,10 @@ const mockConsoleState = vi.hoisted(() => ({
 
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  const { default: translations } = await import('@/i18n/en-US/deployments.json')
   return createReactI18nextMock({
+    ...translations,
+    'operation.save': 'Save',
     'workflow.nodes.common.memories.builtIn': 'Built-in',
   })
 })
@@ -39,6 +48,8 @@ vi.mock('@/app/components/app/store', () => ({
       appDetail: {
         id: 'app-1',
         mode: appMode,
+        workflow: appPublished ? { id: 'published-workflow' } : null,
+        model_config: appPublished ? { id: 'published-config' } : null,
         maintainer: 'user-2',
         permission_keys: appPermissionKeys,
       },
@@ -103,14 +114,20 @@ const appEnvironments: AppEnvironment[] = [
 const renderAccessPoint = ({
   environments = appEnvironments,
   searchParams = '',
+  cloud = false,
 }: {
   environments?: AppEnvironment[]
   searchParams?: string
+  cloud?: boolean
 } = {}) => {
   const queryClient = createTestQueryClient()
   seedAccountProfileQuery(queryClient, mockConsoleState.userProfile)
   seedCurrentWorkspaceQuery(queryClient)
-  seedSystemFeatures(queryClient)
+  seedSystemFeatures(queryClient, { deployment_edition: cloud ? 'CLOUD' : 'COMMUNITY' })
+  if (cloud) {
+    seedNetworkAccessGroups(queryClient, { groups: [createNetworkAccessGroupFixture()] })
+    seedAppNetworkAccessGroup(queryClient, 'app-1')
+  }
   const queryOptions =
     consoleQuery.enterprise.appDeploy.deploymentService.listAppEnvironments.queryOptions({
       input: {
@@ -140,6 +157,7 @@ describe('AccessPoint', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     appMode = 'workflow'
+    appPublished = false
     appPermissionKeys = [AppACLPermission.AccessPointView]
   })
 
@@ -307,4 +325,30 @@ describe('AccessPoint', () => {
       }),
     )
   })
+
+  it.each(['workflow', 'advanced-chat', 'chat', 'agent-chat', 'completion'])(
+    'checks published %s apps before applying a policy that excludes the current IP',
+    async (mode) => {
+      const user = userEvent.setup()
+      appMode = mode
+      appPublished = true
+      appPermissionKeys = [AppACLPermission.AccessPointManage]
+      vi.mocked(globalThis.fetch).mockImplementation(async () =>
+        Response.json({ allowed: false, client_ip: '203.0.113.42', policy_version: 1 }),
+      )
+      renderAccessPoint({ cloud: true })
+      await user.click(screen.getByRole('button', { name: /Access Control/ }))
+      await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      expect(
+        await screen.findByRole('alertdialog', { name: 'Save without your own IP?' }),
+      ).toBeInTheDocument()
+      expect(
+        vi
+          .mocked(globalThis.fetch)
+          .mock.calls.every(([input, init]) => new Request(input, init).method === 'GET'),
+      ).toBe(true)
+    },
+  )
 })
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index e17b601a4753cc..ba8a353c933e85 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -1,3 +1,4 @@
+import type { NetworkAccessGroupCurrentIpCheckResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { AccessControlDraft, AccessControlPolicy } from '../draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { screen } from '@testing-library/react'
@@ -38,7 +39,7 @@ vi.mock('react-i18next', async () => {
 })
 
 function PanelHarness({
-  currentIp,
+  ipCheck,
   initialDraft = createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
   onSave = vi.fn(),
   onCreatePolicy = vi.fn(),
@@ -46,7 +47,7 @@ function PanelHarness({
   canManagePolicies = true,
   readOnly = false,
 }: {
-  currentIp?: string
+  ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
   initialDraft?: AccessControlDraft
   onSave?: () => void
   onCreatePolicy?: () => void
@@ -68,7 +69,7 @@ function PanelHarness({
           canManagePolicies={canManagePolicies}
           readOnly={readOnly}
           policies={policies}
-          currentIp={currentIp}
+          ipCheck={ipCheck}
           onCancel={onCancel}
           onCreatePolicy={onCreatePolicy}
           onManagePolicies={onManagePolicies}
@@ -198,7 +199,9 @@ describe('AccessControlConfigPanel', () => {
 
   it('shows a lockout warning when the current IP is outside the selected policy', async () => {
     const user = userEvent.setup()
-    render(<PanelHarness currentIp="203.0.113.42" />)
+    render(
+      <PanelHarness ipCheck={{ allowed: false, client_ip: '203.0.113.42', policy_version: 1 }} />,
+    )
 
     await user.click(await screen.findByRole('option', { name: /Office VPN/ }))
 
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
index 62628686c96404..0657069025247e 100644
--- a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -1,8 +1,5 @@
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
-import {
-  policyIncludesIp,
-  splitPolicySummary,
-} from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
+import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 import {
   canSaveAccessControl,
   createDefaultAccessControlDraft,
@@ -122,17 +119,6 @@ describe('splitPolicySummary', () => {
   })
 })
 
-describe('policyIncludesIp', () => {
-  it('matches an exact address and a covering CIDR', () => {
-    expect(policyIncludesIp(['203.0.113.42', '198.51.100.0/24'], '203.0.113.42')).toBe(true)
-    expect(policyIncludesIp(['198.51.100.0/24'], '198.51.100.20')).toBe(true)
-  })
-
-  it('does not match an address outside the policy', () => {
-    expect(policyIncludesIp(['198.51.100.0/24'], '203.0.113.42')).toBe(false)
-  })
-})
-
 describe('available access points', () => {
   it.each([
     { available: ['webApp', 'serviceApi', 'mcp', 'trigger'] as const, selected: 4 },
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 661b99953a4e04..92f4bbc38c52b1 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -58,7 +58,12 @@ vi.mock('nuqs', async (importOriginal) => {
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
   const { default: deploymentTranslations } = await import('@/i18n/en-US/deployments.json')
-  return createReactI18nextMock({ ...accessControlTranslations, ...deploymentTranslations })
+  const { default: commonTranslations } = await import('@/i18n/en-US/common.json')
+  return createReactI18nextMock({
+    ...commonTranslations,
+    ...accessControlTranslations,
+    ...deploymentTranslations,
+  })
 })
 
 const renderEntry = ({
@@ -69,6 +74,7 @@ const renderEntry = ({
   availableAccessPoints = ['webapp', 'service_api', 'mcp'],
   role = 'owner',
   canEditBinding = true,
+  isPublished = false,
 }: {
   plan?: CloudPlan
   deploymentEdition?: 'CLOUD' | 'COMMUNITY' | 'ENTERPRISE'
@@ -77,6 +83,7 @@ const renderEntry = ({
   availableAccessPoints?: AppNetworkAccessGroupResponse['available_access_points']
   role?: GetWorkspacesCurrentSummaryResponse['role']
   canEditBinding?: boolean
+  isPublished?: boolean
 } = {}) => {
   const queryClient = createConsoleQueryClient()
   const entitled = plan === 'professional' || plan === 'team'
@@ -88,7 +95,12 @@ const renderEntry = ({
   })
 
   return renderWithConsoleQuery(
-    <AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={canEditBinding} />,
+    <AccessControlEntry
+      appId="app-1"
+      appIcon={{}}
+      isPublished={isPublished}
+      canEditBinding={canEditBinding}
+    />,
     {
       queryClient,
       currentWorkspace: { role },
@@ -105,6 +117,8 @@ const renderEntry = ({
 }
 
 const metadataResponse = (request: Request) => {
+  if (request.url.endsWith('/check-current-ip'))
+    return Response.json({ allowed: true, client_ip: '203.0.113.42', policy_version: 1 })
   if (request.url.endsWith('/network-access-groups/current-ip'))
     return Response.json({ client_ip: '203.0.113.42' })
 }
@@ -484,7 +498,7 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
     expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     expect(within(getChip()).getByText('ON')).toBeInTheDocument()
   })
 
@@ -593,7 +607,6 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
   })
-
   it('reopens the edit layer after dismissing a paused draft with Escape', async () => {
     const user = userEvent.setup()
     renderEntry({
@@ -674,6 +687,8 @@ describe('supported access points and binding permission', () => {
       const requests: Record<string, unknown>[] = []
       const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
         const request = new Request(input, init)
+        const metadata = metadataResponse(request)
+        if (metadata) return metadata
         if (request.method === 'PUT') {
           const payload = await request.json()
           requests.push(payload)
@@ -760,12 +775,14 @@ describe('supported access points and binding permission', () => {
     await user.click(screen.getByRole('button', { name: 'Manage IP policies' }))
     expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
     unmount()
-    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      Response.json({
-        binding: createBinding(),
-        available_access_points: ['webapp', 'service_api', 'mcp'],
-        effective_enabled: true,
-      }),
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(
+      async (input, init) =>
+        metadataResponse(new Request(input, init)) ??
+        Response.json({
+          binding: createBinding(),
+          available_access_points: ['webapp', 'service_api', 'mcp'],
+          effective_enabled: true,
+        }),
     )
     try {
       renderEntry({
@@ -776,8 +793,14 @@ describe('supported access points and binding permission', () => {
       await user.click(getChip())
       await user.click(screen.getByRole('option', { name: /Internal Network/ }))
       await user.click(screen.getByRole('button', { name: 'Save' }))
-      await waitFor(() => expect(fetchSpy).toHaveBeenCalled())
-      const [input, init] = fetchSpy.mock.calls[0]!
+      await waitFor(() =>
+        expect(
+          fetchSpy.mock.calls.some(([input, init]) => new Request(input, init).method === 'PUT'),
+        ).toBe(true),
+      )
+      const [input, init] = fetchSpy.mock.calls.find(
+        ([input, init]) => new Request(input, init).method === 'PUT',
+      )!
       expect(new Request(input, init).method).toBe('PUT')
     } finally {
       fetchSpy.mockRestore()
@@ -901,9 +924,11 @@ describe('supported access points and binding permission', () => {
     await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
     await user.click(screen.getByRole('option', { name: /Office/ }))
     await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
 
-    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={false} />)
+    rendered.rerender(
+      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding={false} />,
+    )
     await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
@@ -915,7 +940,9 @@ describe('supported access points and binding permission', () => {
       'true',
     )
 
-    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />)
+    rendered.rerender(
+      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+    )
     await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
@@ -938,13 +965,17 @@ describe('supported access points and binding permission', () => {
     await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
     expect(screen.getByRole('alertdialog')).toBeInTheDocument()
 
-    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding={false} />)
+    rendered.rerender(
+      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding={false} />,
+    )
     await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
     await user.click(getChip())
     expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
 
-    rendered.rerender(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />)
+    rendered.rerender(
+      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+    )
     await user.click(getChip())
     expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
     expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
@@ -986,8 +1017,10 @@ describe('supported access points and binding permission', () => {
     await user.click(getChip())
     await user.click(screen.getByRole('option', { name: /Internal Network/ }))
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    rendered.rerender(<AccessControlEntry appId="app-2" appIcon={{}} canEditBinding />)
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    rendered.rerender(
+      <AccessControlEntry appId="app-2" appIcon={{}} isPublished={false} canEditBinding />,
+    )
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByRole('switch', { name: 'Web App' })).toBeChecked()
@@ -1018,10 +1051,13 @@ describe('supported access points and binding permission', () => {
     seedNetworkAccessGroups(queryClient, { entitled: true })
     const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => response())
     try {
-      renderWithConsoleQuery(<AccessControlEntry appId="app-1" appIcon={{}} canEditBinding />, {
-        queryClient,
-        systemFeatures: { deployment_edition: 'CLOUD' },
-      })
+      renderWithConsoleQuery(
+        <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+        {
+          queryClient,
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
       await waitFor(() =>
         expect(
           queryClient.getQueryState(
@@ -1038,3 +1074,158 @@ describe('supported access points and binding permission', () => {
     }
   })
 })
+
+const setupBindingServer = (initialBinding: AppNetworkAccessGroupBindingResponse | null = null) => {
+  const state = {
+    binding: initialBinding,
+    groups: [createNetworkAccessGroupFixture()],
+    check: { allowed: false, client_ip: '203.0.113.42', policy_version: 1 },
+    checkStatus: 200,
+    checks: 0,
+    writes: [] as Record<string, unknown>[],
+    put: undefined as (() => Promise<Response>) | undefined,
+    createStatus: 201,
+  }
+  vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+    const request = new Request(input, init)
+    if (request.url.endsWith('/check-current-ip')) {
+      state.checks += 1
+      return Response.json(
+        state.checkStatus === 200 ? state.check : { message: 'IP unavailable' },
+        { status: state.checkStatus },
+      )
+    }
+    if (request.url.endsWith('/current-ip'))
+      return Response.json({ client_ip: state.check.client_ip })
+    if (request.method === 'PUT') {
+      const payload = await request.json()
+      state.writes.push(payload)
+      if (state.put) return state.put()
+      state.binding = createBinding({ ...payload, version: (state.binding?.version ?? 0) + 1 })
+      return Response.json({ binding: state.binding, effective_enabled: state.binding.enabled })
+    }
+    if (request.url.endsWith('/network-access-groups')) {
+      if (request.method === 'POST') {
+        if (state.createStatus !== 201)
+          return Response.json({ message: 'Creation failed' }, { status: state.createStatus })
+        const group = createNetworkAccessGroupFixture({
+          ...(await request.json()),
+          id: 'new-policy',
+        })
+        state.groups.push(group)
+        return Response.json({ group }, { status: 201 })
+      }
+      return Response.json({ tenant_id: 'workspace-1', entitled: true, groups: state.groups })
+    }
+    return Response.json({
+      tenant_id: 'workspace-1',
+      app_id: 'app-1',
+      entitled: true,
+      binding: state.binding,
+      effective_enabled: state.binding?.enabled ?? false,
+      available_access_points: ['webapp', 'service_api', 'mcp'],
+    })
+  })
+  return state
+}
+
+const openSelectedConfig = async (user: ReturnType<typeof userEvent.setup>) => {
+  await user.click(getChip())
+  await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+}
+
+const lockoutWarning = "Your IP (203.0.113.42) isn't in this policy. You may lose access."
+
+describe('trusted IP checks before saving', () => {
+  it.each([true, false])(
+    'uses the server match result and only confirms a published denial (allowed: %s)',
+    async (allowed) => {
+      const user = userEvent.setup()
+      const server = setupBindingServer()
+      server.check.allowed = allowed
+      renderEntry({ plan: 'professional', groups: server.groups, isPublished: true })
+      await openSelectedConfig(user)
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+      expect(Boolean(screen.queryByText(lockoutWarning))).toBe(!allowed)
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      if (allowed) {
+        await waitFor(() => expect(server.writes).toHaveLength(1))
+        expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+      } else {
+        const dialog = await screen.findByRole('alertdialog', { name: 'Save without your own IP?' })
+        expect(within(dialog).getByText(lockoutWarning)).toBeInTheDocument()
+        expect(server.writes).toHaveLength(0)
+        await user.click(within(dialog).getByRole('button', { name: 'Cancel' }))
+        expect(await screen.findByRole('button', { name: 'Save' })).toBeInTheDocument()
+        expect(server.writes).toHaveLength(0)
+        await user.click(screen.getByRole('button', { name: 'Save' }))
+        await user.click(await screen.findByRole('button', { name: 'Save anyway' }))
+        await waitFor(() => expect(server.writes).toHaveLength(1))
+      }
+    },
+  )
+
+  it('warns but saves an unpublished draft without confirmation', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    renderEntry({ plan: 'professional', groups: server.groups })
+    await openSelectedConfig(user)
+    expect(await screen.findByText(lockoutWarning)).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() => expect(server.writes).toHaveLength(1))
+    expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+    expect(server.checks).toBeGreaterThanOrEqual(2)
+  })
+
+  it('requires renewed confirmation when the policy changes before Save anyway', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    renderEntry({ plan: 'professional', groups: server.groups, isPublished: true })
+    await openSelectedConfig(user)
+    await screen.findByText(lockoutWarning)
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await screen.findByRole('alertdialog')
+    server.check.policy_version = 2
+    await user.click(screen.getByRole('button', { name: 'Save anyway' }))
+    expect(
+      await screen.findByText('This policy changed. Review the warning before saving again.'),
+    ).toBeInTheDocument()
+    expect(server.writes).toHaveLength(0)
+    await user.click(screen.getByRole('button', { name: 'Save anyway' }))
+    await waitFor(() => expect(server.writes).toHaveLength(1))
+  })
+
+  it('blocks saving on an unavailable IP check and recovers through Retry', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    server.checkStatus = 503
+    renderEntry({ plan: 'professional', groups: server.groups, isPublished: true })
+    await openSelectedConfig(user)
+    expect(
+      await screen.findByText('Unable to check your IP address. Please try again.'),
+    ).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(server.writes).toHaveLength(0)
+    server.checkStatus = 200
+    server.check.allowed = true
+    await user.click(screen.getByRole('button', { name: 'Retry' }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() => expect(server.writes).toHaveLength(1))
+  })
+
+  it('does not write when the fresh save check fails after a successful initial check', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    server.check.allowed = true
+    renderEntry({ plan: 'professional', groups: server.groups, isPublished: true })
+    await openSelectedConfig(user)
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    server.checkStatus = 503
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    expect(
+      await screen.findByText('Unable to check your IP address. Please try again.'),
+    ).toBeInTheDocument()
+    expect(server.writes).toHaveLength(0)
+  })
+})
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index a22cdcc458691f..a4a7f6f5627cf9 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { NetworkAccessGroupCurrentIpCheckResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { FormEvent } from 'react'
 import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import type { AccessControlAppIcon } from './index'
@@ -18,7 +19,9 @@ import { AccessControlScopeList } from './scope-list'
 type AccessControlConfigPanelProps = {
   draft: AccessControlDraft
   policies: readonly AccessControlPolicy[]
-  currentIp?: string
+  ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
+  ipCheckStatus?: 'loading' | 'error'
+  onRetryIpCheck?: () => void
   availableAccessPoints: readonly AccessPoint[]
   appIcon: AccessControlAppIcon
   readOnly?: boolean
@@ -37,7 +40,9 @@ type AccessControlConfigPanelProps = {
 export function AccessControlConfigPanel({
   draft,
   policies,
-  currentIp,
+  ipCheck,
+  ipCheckStatus,
+  onRetryIpCheck,
   availableAccessPoints,
   appIcon,
   readOnly = false,
@@ -60,7 +65,12 @@ export function AccessControlConfigPanel({
   const hasPersistableSelection = hasSelectedAccessPoint(draft, availableAccessPoints)
   const showPolicyError = draft.enabled && !hasSelectedPolicy
   const showAccessPointError = draft.enabled && !hasPersistableSelection
-  const canSave = !readOnly && canSaveAccessControl({ draft, baseline, availableAccessPoints })
+  const canSave =
+    !readOnly &&
+    !saving &&
+    ipCheckStatus === undefined &&
+    hasSelectedPolicy &&
+    canSaveAccessControl({ draft, baseline, availableAccessPoints })
 
   const handleSubmit = (event: FormEvent<HTMLFormElement>) => {
     event.preventDefault()
@@ -114,8 +124,10 @@ export function AccessControlConfigPanel({
           <AccessControlPolicyField
             policies={policies}
             selectedPolicyId={draft.selectedPolicyId}
-            currentIp={currentIp}
-            readOnly={readOnly}
+            ipCheck={ipCheck}
+            ipCheckStatus={ipCheckStatus}
+            onRetryIpCheck={onRetryIpCheck}
+            readOnly={readOnly || saving}
             canManagePolicies={canManagePolicies}
             onCreatePolicy={onCreatePolicy}
             onManagePolicies={onManagePolicies}
@@ -147,7 +159,7 @@ export function AccessControlConfigPanel({
             draft={draft}
             appIcon={appIcon}
             availableAccessPoints={availableAccessPoints}
-            readOnly={readOnly}
+            readOnly={readOnly || saving}
             onDraftChange={onDraftChange}
           />
           {showAccessPointError && (
@@ -162,7 +174,7 @@ export function AccessControlConfigPanel({
             {t(($) => $['operation.cancel'], { ns: 'common' })}
           </Button>
           {!readOnly && (
-            <Button type="submit" variant="primary" disabled={!canSave || saving} loading={saving}>
+            <Button type="submit" variant="primary" disabled={!canSave} loading={saving}>
               {t(($) => $['operation.save'], { ns: 'common' })}
             </Button>
           )}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index a3ead66883ae32..0c901b9566bc7f 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -4,12 +4,21 @@ import type { ComponentProps } from 'react'
 import type { AccessControlAssignment } from './chip-status'
 import type { AccessControlDraft } from './draft'
 import type AppIcon from '@/app/components/base/app-icon'
+import {
+  AlertDialog,
+  AlertDialogActions,
+  AlertDialogCancelButton,
+  AlertDialogConfirmButton,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogTitle,
+} from '@langgenius/dify-ui/alert-dialog'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
-import { useState } from 'react'
+import { useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import {
   pricingQueryParamName,
@@ -48,6 +57,7 @@ type AccessControlEntryProps = {
   appId: string
   appIcon: AccessControlAppIcon
   canEditBinding: boolean
+  isPublished: boolean
 }
 
 type GtagHandler = (command: 'event', action: 'click_upgrade_btn', payload: { loc: string }) => void
@@ -56,7 +66,12 @@ export function AccessControlEntry(props: AccessControlEntryProps) {
   return <AccessControlSession key={`${props.appId}:${props.canEditBinding}`} {...props} />
 }
 
-function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlEntryProps) {
+function AccessControlSession({
+  appId,
+  appIcon,
+  canEditBinding,
+  isPublished,
+}: AccessControlEntryProps) {
   const { t } = useTranslation()
   const queryClient = useQueryClient()
   const canRead = useAtomValue(canReadNetworkAccessAtom)
@@ -92,6 +107,31 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
   const [createPolicyOpen, setCreatePolicyOpen] = useState(false)
+  const [confirmation, setConfirmation] = useState<{
+    draft: AccessControlDraft
+    clientIp: string
+    policyVersion: number
+    changed: boolean
+  } | null>(null)
+  const saveAttemptRef = useRef(0)
+  const selectedPolicyId = draft ? draft.selectedPolicyId : bindingQuery.data?.binding?.group_id
+  const checkCurrentIp =
+    consoleQuery.workspaces.current.networkAccessGroups.byGroupId.checkCurrentIp.get
+  const ipCheck = useQuery(
+    checkCurrentIp.queryOptions({
+      input: selectedPolicyId ? { params: { group_id: selectedPolicyId } } : skipToken,
+      enabled:
+        canFetchNetworkAccess &&
+        canEditBinding &&
+        bindingQuery.data?.entitled === true &&
+        open &&
+        view === 'config',
+      context: { silent: true },
+      staleTime: 0,
+      retry: false,
+    }),
+  )
+  const saveCheck = useMutation(checkCurrentIp.mutationOptions({ context: { silent: true } }))
 
   const bindingErrorStatus = getNetworkAccessErrorStatus(bindingQuery.error)
   const hideForUnsupportedApp =
@@ -129,10 +169,6 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
       }
     : null
   const dirty = !isAccessControlDraftEqual(resolvedDraft, baseline, availableAccessPoints)
-  const persistableAccessPoints = accessPointsFromScopes(
-    resolvedDraft.scopes,
-    availableAccessPoints,
-  )
   const canSave = canSaveAccessControl({
     draft: resolvedDraft,
     baseline,
@@ -170,6 +206,9 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
   }
 
   const discardDraft = () => {
+    saveAttemptRef.current += 1
+    saveCheck.reset()
+    setConfirmation(null)
     setDraft(null)
     setShowBack(false)
   }
@@ -246,18 +285,59 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
     )
   }
 
-  const handleSave = () => {
-    if (!canMutate || !canSave || !resolvedDraft.selectedPolicyId) return
-
+  const saveDraft = (nextDraft: AccessControlDraft) => {
     persistBinding(
       {
-        enabled: resolvedDraft.enabled,
-        groupId: resolvedDraft.selectedPolicyId,
-        accessPoints: persistableAccessPoints,
+        enabled: nextDraft.enabled,
+        groupId: nextDraft.selectedPolicyId,
+        accessPoints: accessPointsFromScopes(nextDraft.scopes, availableAccessPoints),
       },
       () => {
         discardDraft()
         setView('status')
+        setOpen(true)
+      },
+    )
+  }
+
+  const handleSave = (acceptedVersion?: number) => {
+    const nextDraft = confirmation?.draft ?? resolvedDraft
+    if (
+      !canMutate ||
+      !canSave ||
+      !nextDraft.selectedPolicyId ||
+      saveCheck.isPending ||
+      updateBinding.isPending
+    )
+      return
+    if (!nextDraft.enabled) {
+      saveDraft(nextDraft)
+      return
+    }
+    const groupId = nextDraft.selectedPolicyId
+    const attempt = ++saveAttemptRef.current
+    saveCheck.mutate(
+      { params: { group_id: groupId } },
+      {
+        onSuccess: (check) => {
+          if (saveAttemptRef.current !== attempt) return
+          queryClient.setQueryData(
+            checkCurrentIp.queryKey({ input: { params: { group_id: groupId } } }),
+            check,
+          )
+          if (isPublished && !check.allowed && acceptedVersion !== check.policy_version) {
+            setConfirmation({
+              draft: nextDraft,
+              clientIp: check.client_ip,
+              policyVersion: check.policy_version,
+              changed: acceptedVersion !== undefined,
+            })
+            setOpen(false)
+            return
+          }
+          setConfirmation(null)
+          saveDraft(nextDraft)
+        },
       },
     )
   }
@@ -275,6 +355,8 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
           onOpenChange={(nextOpen) => {
             setOpen(nextOpen)
             if (!nextOpen) {
+              saveAttemptRef.current += 1
+              saveCheck.reset()
               if (!dirty) discardDraft()
               return
             }
@@ -341,18 +423,34 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
                 availableAccessPoints={availableAccessPoints}
                 policies={policies}
                 readOnly={!canMutate}
+                ipCheck={ipCheck.isSuccess && !ipCheck.isFetching ? ipCheck.data : undefined}
+                ipCheckStatus={
+                  saveCheck.isPending || ipCheck.isFetching
+                    ? 'loading'
+                    : saveCheck.isError || ipCheck.isError
+                      ? 'error'
+                      : undefined
+                }
+                onRetryIpCheck={() => {
+                  saveCheck.reset()
+                  void ipCheck.refetch()
+                }}
                 canManagePolicies={canManagePolicies}
                 baseline={baseline}
                 showBack={showBack}
-                saving={updateBinding.isPending}
+                saving={updateBinding.isPending || saveCheck.isPending}
                 onBack={handleBack}
                 onCancel={handleCancel}
                 onCreatePolicy={handleCreatePolicy}
                 onManagePolicies={handleManagePolicies}
                 onDraftChange={(nextDraft) => {
-                  if (canMutate) setDraft(nextDraft)
+                  if (canMutate) {
+                    saveAttemptRef.current += 1
+                    saveCheck.reset()
+                    setDraft(nextDraft)
+                  }
                 }}
-                onSave={handleSave}
+                onSave={() => handleSave()}
               />
             )}
           </PopoverContent>
@@ -401,6 +499,50 @@ function AccessControlSession({ appId, appIcon, canEditBinding }: AccessControlE
           }}
         />
       )}
+      <AlertDialog
+        open={confirmation !== null}
+        onOpenChange={(nextOpen) => {
+          if (nextOpen) return
+          saveAttemptRef.current += 1
+          saveCheck.reset()
+          setConfirmation(null)
+          setOpen(true)
+        }}
+      >
+        <AlertDialogContent className="w-100">
+          <AlertDialogTitle>
+            {t(($) => $['studio.accessControl.saveWithoutOwnIp'], { ns: 'deployments' })}
+          </AlertDialogTitle>
+          <AlertDialogDescription>
+            {t(($) => $['studio.accessControl.lockoutWarning'], {
+              ns: 'deployments',
+              ip: confirmation?.clientIp,
+            })}
+          </AlertDialogDescription>
+          {confirmation?.changed && (
+            <p role="status" className="system-sm-regular text-text-warning">
+              {t(($) => $['studio.accessControl.policyChanged'], { ns: 'deployments' })}
+            </p>
+          )}
+          {saveCheck.isError && (
+            <p role="alert" className="system-sm-regular text-text-warning">
+              {t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
+            </p>
+          )}
+          <AlertDialogActions>
+            <AlertDialogCancelButton>
+              {t(($) => $['operation.cancel'], { ns: 'common' })}
+            </AlertDialogCancelButton>
+            <AlertDialogConfirmButton
+              loading={saveCheck.isPending || updateBinding.isPending}
+              disabled={!canMutate}
+              onClick={() => handleSave(confirmation?.policyVersion)}
+            >
+              {t(($) => $['studio.accessControl.saveAnyway'], { ns: 'deployments' })}
+            </AlertDialogConfirmButton>
+          </AlertDialogActions>
+        </AlertDialogContent>
+      </AlertDialog>
     </>
   )
 }
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 6805384df2c3f8..fafb5cd89a318b 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { NetworkAccessGroupCurrentIpCheckResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { AccessControlPolicy } from './draft'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
@@ -16,17 +17,16 @@ import {
 } from '@langgenius/dify-ui/select'
 import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/tooltip'
 import { useTranslation } from 'react-i18next'
-import {
-  policyIncludesIp,
-  splitPolicySummary,
-} from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
+import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
 
 const CREATE_POLICY_VALUE = '__create-ip-policy__'
 
 type AccessControlPolicyFieldProps = {
   policies: readonly AccessControlPolicy[]
   selectedPolicyId: string | null
-  currentIp?: string
+  ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
+  ipCheckStatus?: 'loading' | 'error'
+  onRetryIpCheck?: () => void
   readOnly?: boolean
   canManagePolicies: boolean
   onCreatePolicy: () => void
@@ -37,7 +37,9 @@ type AccessControlPolicyFieldProps = {
 export function AccessControlPolicyField({
   policies,
   selectedPolicyId,
-  currentIp,
+  ipCheck,
+  ipCheckStatus,
+  onRetryIpCheck,
   readOnly = false,
   canManagePolicies,
   onCreatePolicy,
@@ -47,11 +49,6 @@ export function AccessControlPolicyField({
   const { t } = useTranslation()
   const selectedPolicy = policies.find((policy) => policy.id === selectedPolicyId)
   const summary = selectedPolicy ? splitPolicySummary(selectedPolicy.allowed_cidrs) : undefined
-  const showLockout =
-    Boolean(selectedPolicy && currentIp) &&
-    selectedPolicy !== undefined &&
-    currentIp !== undefined &&
-    !policyIncludesIp(selectedPolicy.allowed_cidrs, currentIp)
   const selectLabel = t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })
   const placeholder = t(($) => $['studio.accessControl.selectPolicy'], { ns: 'deployments' })
   const canCreatePolicy = canManagePolicies && !readOnly
@@ -225,11 +222,23 @@ export function AccessControlPolicyField({
                   })}
         </p>
       )}
-      {showLockout && currentIp && (
+      {ipCheckStatus && (
+        <p role="status" className="system-xs-regular text-text-warning">
+          {ipCheckStatus === 'loading'
+            ? t(($) => $['settings.ipPolicyCurrentIpLoading'], { ns: 'common' })
+            : t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
+          {ipCheckStatus === 'error' && onRetryIpCheck && (
+            <Button type="button" variant="ghost" size="small" onClick={onRetryIpCheck}>
+              {t(($) => $['operation.retry'], { ns: 'common' })}
+            </Button>
+          )}
+        </p>
+      )}
+      {!ipCheckStatus && ipCheck && !ipCheck.allowed && (
         <p className="system-xs-regular text-text-warning">
           {t(($) => $['studio.accessControl.lockoutWarning'], {
             ns: 'deployments',
-            ip: currentIp,
+            ip: ipCheck.client_ip,
           })}
         </p>
       )}
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index c8a89aa4f881d9..9da81793a9999c 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -78,6 +78,12 @@ function AccessPointContent({
             </h1>
             <AccessControlEntry
               appId={appId}
+              isPublished={Boolean(
+                appInfo &&
+                (appInfo.mode === AppModeEnum.WORKFLOW || appInfo.mode === AppModeEnum.ADVANCED_CHAT
+                  ? appInfo.workflow?.id
+                  : appInfo.model_config),
+              )}
               appIcon={{
                 iconType: appInfo?.icon_type,
                 icon: appInfo?.icon,
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
index 3dd3d102dc42e9..7563cdc6994631 100644
--- a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -166,39 +166,3 @@ export function splitPolicySummary(addresses: readonly string[]): {
   if (addresses.length <= 2) return { listed: addresses, moreCount: 0 }
   return { listed: addresses.slice(0, 2), moreCount: addresses.length - 2 }
 }
-function ipv4ToInt(ip: string): number | null {
-  const parts = ip.split('.')
-  if (parts.length !== 4) return null
-
-  let value = 0
-  for (const part of parts) {
-    if (!/^\d+$/.test(part)) return null
-    const octet = Number(part)
-    if (octet > 255) return null
-    value = (value << 8) + octet
-  }
-
-  return value >>> 0
-}
-
-function ipv4InCidr(ip: string, network: string, prefix: number): boolean {
-  const ipInt = ipv4ToInt(ip)
-  const networkInt = ipv4ToInt(network)
-  if (ipInt === null || networkInt === null) return false
-  if (prefix === 0) return true
-  const mask = prefix === 32 ? 0xffffffff : ~((1 << (32 - prefix)) - 1) >>> 0
-  return (ipInt & mask) === (networkInt & mask)
-}
-
-export function policyIncludesIp(addresses: readonly string[], ip: string): boolean {
-  return addresses.some((entry) => {
-    const cidr = toAllowedCidr(entry)
-    const slash = cidr.indexOf('/')
-    const network = slash === -1 ? cidr : cidr.slice(0, slash)
-    const prefix = slash === -1 ? (cidr.includes(':') ? 128 : 32) : Number(cidr.slice(slash + 1))
-    if (network.includes(':')) return cidr === ip || network === ip
-    if (entry === ip || network === ip) return true
-    if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false
-    return ipv4InCidr(ip, network, prefix)
-  })
-}
diff --git a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
index c7ff3bb316eaed..16a81aac19916a 100644
--- a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
+++ b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
@@ -24,7 +24,9 @@ vi.mock('../components/workflow-references-table', () => ({ WorkflowReferencesTa
 
 vi.mock('react-i18next', async () => {
   const { createReactI18nextMock } = await import('@/test/i18n-mock')
+  const { default: translations } = await import('@/i18n/en-US/deployments.json')
   return createReactI18nextMock({
+    ...translations,
     'studio.accessControl.entryLabel': 'Access Control',
     'studio.accessControl.chipOff': 'Off',
     'studio.accessControl.chipOn': 'ON',
@@ -105,6 +107,8 @@ describe('Agent IP access configuration', () => {
     const writes: Array<{ url: string; body: unknown }> = []
     vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
       const request = input instanceof Request ? input : new Request(String(input), init)
+      if (request.url.endsWith('/check-current-ip'))
+        return Response.json({ allowed: true, client_ip: '203.0.113.42', policy_version: 1 })
       if (request.method === 'PUT') {
         const body = await request.json()
         writes.push({ url: request.url, body })
@@ -120,6 +124,7 @@ describe('Agent IP access configuration', () => {
     expect(screen.queryByRole('switch', { name: 'MCP Server' })).not.toBeInTheDocument()
     expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
     await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     await user.click(screen.getByRole('button', { name: 'Save' }))
 
     await waitFor(() =>
@@ -155,7 +160,7 @@ describe('Agent IP access configuration', () => {
     expect(screen.getByText('Protecting all 2 access points.')).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
-    const toggle = screen.getByRole('switch', { name: 'Restrict by IP address' })
+    const toggle = screen.getByRole('switch', { name: 'Enable access control' })
     expect(toggle).toHaveAttribute('aria-disabled', 'true')
     await user.click(toggle)
     expect(toggle).toBeChecked()
@@ -189,4 +194,24 @@ describe('Agent IP access configuration', () => {
     expect(screen.getByRole('switch', { name: 'Backend Service API' })).toBeChecked()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
+
+  it('requires lockout confirmation for an Agent with a published snapshot', async () => {
+    const user = userEvent.setup()
+    setup({ access_ready: true })
+    vi.mocked(globalThis.fetch).mockImplementation(async () =>
+      Response.json({ allowed: false, client_ip: '203.0.113.42', policy_version: 1 }),
+    )
+    await user.click(screen.getByRole('button', { name: /Access Control/ }))
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    expect(
+      await screen.findByRole('alertdialog', { name: 'Save without your own IP?' }),
+    ).toBeInTheDocument()
+    expect(
+      vi
+        .mocked(globalThis.fetch)
+        .mock.calls.every(([input, init]) => new Request(input, init).method === 'GET'),
+    ).toBe(true)
+  })
 })
diff --git a/web/features/agent-v2/agent-detail/access/page.tsx b/web/features/agent-v2/agent-detail/access/page.tsx
index 0de9770a2ab4e6..ab7e9467e5c9da 100644
--- a/web/features/agent-v2/agent-detail/access/page.tsx
+++ b/web/features/agent-v2/agent-detail/access/page.tsx
@@ -60,6 +60,7 @@ export function AgentAccessPage({ agentId }: AgentAccessPageProps) {
         {agent?.app_id && !agent.hidden_app_backed && capabilities.canViewAccessPoint && (
           <AccessControlEntry
             appId={agent.app_id}
+            isPublished={agent.access_ready === true}
             appIcon={{
               iconType:
                 agent.icon_type === 'image' || agent.icon_type === 'link' ? 'image' : 'emoji',
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 67ec14c0f5c19c..e1f5932bcd5c46 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "تغيّرت هذه السياسة. راجع التحذير قبل الحفظ مجددًا.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index e4601c34639e0d..dfbf5c2fbea762 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Diese Richtlinie wurde geändert. Prüfen Sie die Warnung, bevor Sie erneut speichern.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index 62c4453760740d..832d801cf17d4a 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "This policy changed. Review the warning before saving again.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 8028719fbc8078..66e257563fde66 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Esta política ha cambiado. Revisa la advertencia antes de volver a guardar.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index eed09640ceb237..46f3eabb591ec2 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "این خط‌مشی تغییر کرده است. پیش از ذخیره مجدد، هشدار را بررسی کنید.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index aef3bba279a52e..9f7f821bf81b27 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Cette politique a changé. Vérifiez l’avertissement avant d’enregistrer à nouveau.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index ca3ebaccc42341..f902f5f3346ad2 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "यह नीति बदल गई है। दोबारा सहेजने से पहले चेतावनी की समीक्षा करें।",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 173bd42184757b..e23685a658986f 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Kebijakan ini telah berubah. Tinjau peringatan sebelum menyimpan lagi.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 2642b7c0b8f5c6..a4b1ac1affe627 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Questa policy è cambiata. Controlla l’avviso prima di salvare di nuovo.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 255dc085cfced1..86c910b9a6b395 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "未有効",
   "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
   "studio.accessControl.paywallTitle": "アクセス制御",
+  "studio.accessControl.policyChanged": "このポリシーは変更されました。警告を確認してから再度保存してください。",
   "studio.accessControl.policySummaryMany": "{{listed}} とさらに {{count}} 件のアドレスを許可",
   "studio.accessControl.policySummaryNone": "許可するアドレスはありません",
   "studio.accessControl.policySummaryOne": "{{address}} を許可",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 6b6a006facf970..a8dee70f8adf77 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "이 정책이 변경되었습니다. 다시 저장하기 전에 경고를 확인하세요.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 7f24b956f1a054..18d2b2e34d33c8 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "ນະໂຍບາຍນີ້ໄດ້ປ່ຽນແປງແລ້ວ. ກວດເບິ່ງຄຳເຕືອນກ່ອນບັນທຶກອີກຄັ້ງ.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 6683e74c44f43a..5053760b31d8fa 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Dit beleid is gewijzigd. Bekijk de waarschuwing voordat je opnieuw opslaat.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index e77af8370887c0..62cc47d1568203 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Ta polityka uległa zmianie. Sprawdź ostrzeżenie przed ponownym zapisaniem.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 1ef90629eed226..e3a865cfb3714d 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Esta política mudou. Revise o aviso antes de salvar novamente.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 6bacd33a8f756c..cbeecb0c74a2b6 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Această politică s-a modificat. Verificați avertismentul înainte de a salva din nou.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index 530a6c28c12611..c8624de660cae2 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Эта политика изменилась. Прочитайте предупреждение перед повторным сохранением.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 10a367955d0282..2caa7bef98f3ca 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Ta pravilnik se je spremenil. Pred ponovnim shranjevanjem preglejte opozorilo.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 12d57095cf8c93..1f818ac3f209fb 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "นโยบายนี้มีการเปลี่ยนแปลง โปรดตรวจสอบคำเตือนก่อนบันทึกอีกครั้ง",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index c7aa51ebc2f0f1..faaa30eba12074 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Bu politika değişti. Yeniden kaydetmeden önce uyarıyı inceleyin.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 5e27f75f55ebd0..6b8f6774f6f6c7 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Цю політику змінено. Перегляньте попередження перед повторним збереженням.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 8ee219a94ce087..1e2c76acdb2dfb 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "Not enabled",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "Chính sách này đã thay đổi. Hãy xem lại cảnh báo trước khi lưu lại.",
   "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 44f86892ebb938..5d8dbcae2a61f5 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "未启用",
   "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
   "studio.accessControl.paywallTitle": "访问控制",
+  "studio.accessControl.policyChanged": "此策略已发生变化，请确认风险提示后再次保存。",
   "studio.accessControl.policySummaryMany": "允许 {{listed}} 以及另外 {{count}} 个地址",
   "studio.accessControl.policySummaryNone": "未允许任何地址",
   "studio.accessControl.policySummaryOne": "允许 {{address}}",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 9bbe0d13bf7ce2..8c63866838187e 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -54,6 +54,7 @@
   "studio.accessControl.notEnabled": "未啟用",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.policyChanged": "此原則已變更，請確認風險提示後再次儲存。",
   "studio.accessControl.policySummaryMany": "允許 {{listed}} 以及另外 {{count}} 個地址",
   "studio.accessControl.policySummaryNone": "未允許任何地址",
   "studio.accessControl.policySummaryOne": "允許 {{address}}",

From f6c9869f0dd6bba261915ebd2d3980bd8c253730 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:30:25 +0800
Subject: [PATCH 049/108] fix(web): disable scopes until a valid IP policy is
 selected (SNP-831)

---
 .../__tests__/config-panel.spec.tsx           | 42 ++++++++++++++-----
 .../access-control/__tests__/index.spec.tsx   | 27 ++++++------
 .../access-control/config-panel.tsx           |  4 +-
 3 files changed, 49 insertions(+), 24 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index ba8a353c933e85..ad59d816b7aa75 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -90,22 +90,16 @@ describe('AccessControlConfigPanel', () => {
       'Please select an IP policy.',
     )
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
-    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
-    expect(screen.getByRole('switch', { name: 'Trigger' })).not.toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
+    expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
   })
 
   it('enables save after a policy is selected', async () => {
@@ -230,3 +224,31 @@ describe('AccessControlConfigPanel', () => {
     expect(screen.getByRole('switch', { name: 'Trigger' })).not.toBeChecked()
   })
 })
+
+it('ignores pointer and keyboard scope changes until a policy is selected', async () => {
+  const user = userEvent.setup()
+  render(<PanelHarness />)
+  const scope = screen.getByRole('switch', { name: 'Web App' })
+  await user.click(scope)
+  expect(scope).toBeChecked()
+  expect(scope).toHaveAttribute('tabindex', '-1')
+  scope.focus()
+  await user.keyboard(' {Enter}')
+  expect(scope).toBeChecked()
+  await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+  await user.click(scope)
+  expect(scope).not.toBeChecked()
+})
+
+it('requires a policy that is still present in the workspace before enabling configuration', () => {
+  render(
+    <PanelHarness
+      initialDraft={{
+        ...createDefaultAccessControlDraft(ACCESS_POINT_ORDER),
+        selectedPolicyId: 'deleted-policy',
+      }}
+    />,
+  )
+  expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+  expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+})
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 92f4bbc38c52b1..9b017fc757e3e8 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -253,15 +253,12 @@ describe('AccessControlEntry', () => {
     ).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
-    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
-    expect(screen.getByRole('switch', { name: 'Backend Service API' })).not.toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(screen.getByRole('switch', { name: 'Backend Service API' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
-    expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'MCP Server' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
@@ -429,14 +426,16 @@ describe('AccessControlEntry', () => {
 
   it('discards an unsaved first-time draft on Cancel', async () => {
     const user = userEvent.setup()
-    renderEntry({ plan: 'professional' })
+    renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()] })
 
     await user.click(getChip())
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
     await user.click(screen.getByRole('button', { name: 'Cancel' }))
 
     await waitFor(() => {
-      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
     })
 
     await user.click(getChip())
@@ -446,22 +445,26 @@ describe('AccessControlEntry', () => {
 
   it('restores an unsaved first-time draft after Escape', async () => {
     const user = userEvent.setup()
-    renderEntry({ plan: 'professional' })
+    renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()] })
 
     await user.click(getChip())
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
     expect(screen.getByRole('switch', { name: 'Web App' })).not.toBeChecked()
 
     await user.keyboard('{Escape}')
     await waitFor(() => {
-      expect(screen.queryByText('No IP policies in this workspace yet')).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
     })
 
     await user.click(getChip())
-    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
+    expect(screen.getByRole('combobox', { name: 'IP Policy' })).toHaveTextContent(
+      'Internal Network',
+    )
     expect(screen.getByRole('switch', { name: 'Web App' })).not.toBeChecked()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
   })
 
   it('restores an unsaved edit after Escape and keeps the saved chip', async () => {
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index a4a7f6f5627cf9..922171e3317a91 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -61,7 +61,7 @@ export function AccessControlConfigPanel({
   const policyErrorId = useId()
   const accessPointErrorId = useId()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
-  const hasSelectedPolicy = Boolean(draft.selectedPolicyId)
+  const hasSelectedPolicy = policies.some((policy) => policy.id === draft.selectedPolicyId)
   const hasPersistableSelection = hasSelectedAccessPoint(draft, availableAccessPoints)
   const showPolicyError = draft.enabled && !hasSelectedPolicy
   const showAccessPointError = draft.enabled && !hasPersistableSelection
@@ -159,7 +159,7 @@ export function AccessControlConfigPanel({
             draft={draft}
             appIcon={appIcon}
             availableAccessPoints={availableAccessPoints}
-            readOnly={readOnly || saving}
+            readOnly={readOnly || saving || !hasSelectedPolicy}
             onDraftChange={onDraftChange}
           />
           {showAccessPointError && (

From df65412336534e8e192e26f89f148a5e592e066b Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:30:37 +0800
Subject: [PATCH 050/108] fix(web): persist access control pause and resume
 immediately (SNP-827)

---
 .../access-control/__tests__/index.spec.tsx   | 131 +++++++++---------
 .../app/access-point/access-control/index.tsx |  26 ++--
 .../access-control/status-panel.tsx           |  49 ++-----
 3 files changed, 100 insertions(+), 106 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 9b017fc757e3e8..f3c9e51db36de1 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -7,7 +7,7 @@ import type {
   GetWorkspacesCurrentSummaryResponse,
   NetworkAccessGroupResponse,
 } from '@dify/contracts/api/console/workspaces/types.gen'
-import { screen, waitFor, within } from '@testing-library/react'
+import { act, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { consoleQuery } from '@/service/console'
 import {
@@ -398,32 +398,6 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
   })
 
-  it('keeps the saved chip state until a turned-off draft is saved', async () => {
-    const user = userEvent.setup()
-    renderEntry({
-      plan: 'professional',
-      groups: [createNetworkAccessGroupFixture()],
-      binding: {
-        id: 'binding-1',
-        tenant_id: 'workspace-1',
-        app_id: 'app-1',
-        enabled: true,
-        group_id: 'group-1',
-        access_points: ['webapp', 'service_api', 'mcp'],
-        version: 2,
-        created_at: '2026-01-01T00:00:00Z',
-        updated_at: '2026-01-01T00:00:00Z',
-      },
-    })
-
-    await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
-    await user.click(screen.getByRole('button', { name: 'Turn off' }))
-
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
-  })
-
   it('discards an unsaved first-time draft on Cancel', async () => {
     const user = userEvent.setup()
     renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()] })
@@ -610,41 +584,6 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
   })
-  it('reopens the edit layer after dismissing a paused draft with Escape', async () => {
-    const user = userEvent.setup()
-    renderEntry({
-      plan: 'professional',
-      groups: [createNetworkAccessGroupFixture()],
-      binding: {
-        id: 'binding-1',
-        tenant_id: 'workspace-1',
-        app_id: 'app-1',
-        enabled: true,
-        group_id: 'group-1',
-        access_points: ['webapp', 'service_api', 'mcp'],
-        version: 2,
-        created_at: '2026-01-01T00:00:00Z',
-        updated_at: '2026-01-01T00:00:00Z',
-      },
-    })
-
-    await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
-    await user.click(screen.getByRole('button', { name: 'Turn off' }))
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-
-    await user.keyboard('{Escape}')
-    await waitFor(() => {
-      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
-    })
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
-
-    await user.click(getChip())
-    expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Back' })).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
-  })
 })
 
 const capabilityCases = [
@@ -817,6 +756,8 @@ describe('supported access points and binding permission', () => {
     const payloads: unknown[] = []
     const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
       const request = new Request(input, init)
+      const metadata = metadataResponse(request)
+      if (metadata) return metadata
       if (request.url.endsWith('/workspaces/current/network-access-groups'))
         return Response.json({
           tenant_id: 'workspace-1',
@@ -850,7 +791,6 @@ describe('supported access points and binding permission', () => {
         'Web App, MCP Server will be reachable from any IP.',
       )
       await user.click(screen.getByRole('button', { name: 'Turn off' }))
-      await user.click(screen.getByRole('button', { name: 'Save' }))
       await waitFor(() =>
         expect(payloads).toEqual([
           {
@@ -865,8 +805,12 @@ describe('supported access points and binding permission', () => {
         expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
       )
       expect(screen.getByRole('switch', { name: 'Enable access control' })).not.toBeChecked()
+      expect(
+        screen.getByText('Paused — Internal Network is configured but not enforcing'),
+      ).toBeInTheDocument()
+      expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
       await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
-      await user.click(screen.getByRole('button', { name: 'Save' }))
       await waitFor(() => expect(payloads).toHaveLength(2))
       expect(payloads[1]).toEqual({
         enabled: true,
@@ -1232,3 +1176,62 @@ describe('trusted IP checks before saving', () => {
     expect(server.writes).toHaveLength(0)
   })
 })
+
+describe('immediate pause and resume', () => {
+  it('cancels pause without writing or changing the saved status', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer(createBinding())
+    renderEntry({ plan: 'professional', groups: server.groups, binding: server.binding })
+    await user.click(getChip())
+    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+    await user.click(
+      within(screen.getByRole('alertdialog')).getByRole('button', { name: 'Cancel' }),
+    )
+    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
+    expect(server.writes).toHaveLength(0)
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+  })
+
+  it.each([500, 409])(
+    'keeps the saved state and prevents duplicate requests when pause fails (%s)',
+    async (status) => {
+      const user = userEvent.setup()
+      const server = setupBindingServer(createBinding({ access_points: ['webapp', 'mcp'] }))
+      let finish!: (response: Response) => void
+      server.put = () =>
+        new Promise<Response>((resolve) => {
+          finish = resolve
+        })
+      renderEntry({ plan: 'professional', groups: server.groups, binding: server.binding })
+      await user.click(getChip())
+      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+      await user.click(screen.getByRole('button', { name: 'Turn off' }))
+      const toggle = screen.getByRole('switch', { name: 'Enable access control' })
+      await waitFor(() => expect(toggle).toHaveAttribute('aria-disabled', 'true'))
+      await user.click(toggle)
+      expect(server.writes).toEqual([
+        {
+          enabled: false,
+          group_id: 'group-1',
+          access_points: ['webapp', 'mcp'],
+          expected_version: 2,
+        },
+      ])
+      if (status === 409)
+        server.binding = createBinding({ version: 3, access_points: ['webapp', 'mcp'] })
+      await act(async () => finish(Response.json({ message: 'Unable to pause' }, { status })))
+      await waitFor(() => expect(toggle).not.toHaveAttribute('aria-disabled', 'true'))
+      expect(toggle).toBeChecked()
+      expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+      if (status === 409) {
+        await user.click(toggle)
+        await user.click(screen.getByRole('button', { name: 'Turn off' }))
+        await waitFor(() => expect(server.writes[1]).toMatchObject({ expected_version: 3 }))
+        await act(async () =>
+          finish(Response.json({ message: 'Unable to pause' }, { status: 500 })),
+        )
+      }
+    },
+  )
+})
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 0c901b9566bc7f..1f4fbd6309c597 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -256,7 +256,7 @@ function AccessControlSession({
     },
     onSuccess?: () => void,
   ) => {
-    if (!canMutate) return
+    if (!canMutate || updateBinding.isPending) return
 
     updateBinding.mutate(
       {
@@ -269,7 +269,15 @@ function AccessControlSession({
         },
       },
       {
-        onSuccess,
+        onSuccess: (data) => {
+          queryClient.setQueryData(
+            consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
+              input: { params: { app_id: appId } },
+            }),
+            (current) => (current ? { ...current, ...data } : current),
+          )
+          onSuccess?.()
+        },
         onError: (error) => {
           if (getNetworkAccessErrorStatus(error) !== 409) return
           void queryClient.invalidateQueries({
@@ -343,8 +351,14 @@ function AccessControlSession({
   }
 
   const handleEnabledChange = (enabled: boolean) => {
-    if (!canMutate) return
-    setDraft({ ...resolvedDraft, enabled })
+    if (!canMutate || updateBinding.isPending || !binding?.group_id) return
+    persistBinding(
+      { enabled, groupId: binding.group_id, accessPoints: binding.access_points },
+      () => {
+        discardDraft()
+        setView('status')
+      },
+    )
   }
 
   return (
@@ -403,12 +417,8 @@ function AccessControlSession({
                 policies={policies}
                 enabled={resolvedDraft.enabled}
                 updating={updateBinding.isPending}
-                dirty={dirty}
-                canSave={canSave}
                 readOnly={!canMutate}
                 onEnabledChange={handleEnabledChange}
-                onCancel={handleCancel}
-                onSave={handleSave}
                 onEdit={() => {
                   if (!canMutate) return
                   setDraft(resolvedDraft)
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index 2617fe8fbfc322..f9323bac1c6e9d 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -36,11 +36,7 @@ type AccessControlStatusPanelProps = {
   enabled: boolean
   onEdit: () => void
   updating?: boolean
-  dirty?: boolean
-  canSave?: boolean
   readOnly?: boolean
-  onCancel?: () => void
-  onSave?: () => void
   onEnabledChange: (enabled: boolean) => void
 }
 
@@ -52,11 +48,7 @@ export function AccessControlStatusPanel({
   enabled,
   onEdit,
   updating = false,
-  dirty = false,
-  canSave = false,
   readOnly = false,
-  onCancel,
-  onSave,
   onEnabledChange,
 }: AccessControlStatusPanelProps) {
   const { t } = useTranslation()
@@ -79,7 +71,7 @@ export function AccessControlStatusPanel({
     <div className="flex w-100 flex-col">
       <div className="flex items-center justify-between gap-2 overflow-hidden px-4 pt-4 pb-3">
         <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
-          {policyName
+          {policyName && enabled
             ? t(($) => $['studio.accessControl.restrictedTo'], {
                 ns: 'deployments',
                 name: policyName,
@@ -87,7 +79,7 @@ export function AccessControlStatusPanel({
             : t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })}
         </PopoverTitle>
         {!readOnly && (
-          <Button type="button" variant="ghost" size="small" onClick={onEdit}>
+          <Button type="button" variant="ghost" size="small" disabled={updating} onClick={onEdit}>
             {t(($) => $['operation.edit'], { ns: 'common' })}
           </Button>
         )}
@@ -100,16 +92,21 @@ export function AccessControlStatusPanel({
               {t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
             </p>
             <p className="system-xs-regular text-text-tertiary">
-              {coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
-                ? t(($) => $['studio.accessControl.protectingAll'], {
+              {!enabled
+                ? t(($) => $['studio.accessControl.tooltipPaused'], {
                     ns: 'deployments',
-                    count: coverage.inServiceCount,
+                    name: policyName ?? '',
                   })
-                : t(($) => $['studio.accessControl.protectingPartial'], {
-                    ns: 'deployments',
-                    n: coverage.coveredCount,
-                    m: coverage.inServiceCount,
-                  })}
+                : coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
+                  ? t(($) => $['studio.accessControl.protectingAll'], {
+                      ns: 'deployments',
+                      count: coverage.inServiceCount,
+                    })
+                  : t(($) => $['studio.accessControl.protectingPartial'], {
+                      ns: 'deployments',
+                      n: coverage.coveredCount,
+                      m: coverage.inServiceCount,
+                    })}
             </p>
           </div>
           <Switch
@@ -205,22 +202,6 @@ export function AccessControlStatusPanel({
             )
           })}
         </div>
-        {dirty && !readOnly && (
-          <div className="flex items-center justify-end gap-2 pt-5">
-            <Button type="button" variant="secondary" onClick={onCancel}>
-              {t(($) => $['operation.cancel'], { ns: 'common' })}
-            </Button>
-            <Button
-              type="button"
-              variant="primary"
-              disabled={!canSave || updating}
-              loading={updating}
-              onClick={onSave}
-            >
-              {t(($) => $['operation.save'], { ns: 'common' })}
-            </Button>
-          </div>
-        )}
       </div>
 
       <AlertDialog open={confirmPause} onOpenChange={setConfirmPause}>

From 0f487e51bf57b8a10701de64d8981e37ccfc6e7a Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:30:48 +0800
Subject: [PATCH 051/108] fix(web): preserve drafts and expand newly created
 policies (SNP-834)

---
 .../access-control/__tests__/index.spec.tsx   | 52 +++++++++++++++++++
 .../access-control/config-panel.tsx           |  6 +++
 .../app/access-point/access-control/index.tsx |  9 ++--
 .../access-control/policy-field.tsx           | 11 +++-
 4 files changed, 73 insertions(+), 5 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index f3c9e51db36de1..f7fa1b7d095c63 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -344,6 +344,13 @@ describe('AccessControlEntry', () => {
         },
       })
     })
+    expect(await screen.findByRole('option', { name: /Office/ })).toHaveAttribute(
+      'aria-selected',
+      'false',
+    )
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+    expect(posted.filter((request) => request.method === 'PUT')).toHaveLength(0)
     expect(mockSetSettingsDestination).not.toHaveBeenCalled()
   })
 
@@ -1235,3 +1242,48 @@ describe('immediate pause and resume', () => {
     },
   )
 })
+
+describe('returning from policy creation', () => {
+  it.each(['create', 'cancel', 'failure'] as const)(
+    'preserves the selected policy and scope draft after %s',
+    async (action) => {
+      const user = userEvent.setup()
+      const server = setupBindingServer()
+      renderEntry({ plan: 'professional', groups: server.groups })
+      await openSelectedConfig(user)
+      await screen.findByText(lockoutWarning)
+      await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+      await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+      await user.click(screen.getByRole('option', { name: 'Add IP Policy' }))
+      const dialog = await screen.findByRole('dialog')
+      if (action !== 'cancel') {
+        await user.type(within(dialog).getByRole('textbox', { name: 'Name' }), 'New Office')
+        await user.type(within(dialog).getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
+        if (action === 'failure') server.createStatus = 500
+        await user.click(within(dialog).getByRole('button', { name: 'Create' }))
+      }
+      if (action === 'failure') {
+        await waitFor(() =>
+          expect(within(dialog).getByRole('button', { name: 'Create' })).not.toHaveAttribute(
+            'aria-disabled',
+            'true',
+          ),
+        )
+        expect(dialog).toBeInTheDocument()
+      }
+      if (action !== 'create')
+        await user.click(within(dialog).getByRole('button', { name: 'Cancel' }))
+      const select = await screen.findByRole('combobox', { name: 'IP Policy' })
+      expect(select).toHaveTextContent('Internal Network')
+      if (action === 'create') {
+        expect(await screen.findByRole('option', { name: /New Office/ })).toHaveAttribute(
+          'aria-selected',
+          'false',
+        )
+        await user.keyboard('{Escape}')
+      }
+      expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
+      expect(server.writes).toHaveLength(0)
+    },
+  )
+})
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 922171e3317a91..54b88ebccc1ca0 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -22,6 +22,8 @@ type AccessControlConfigPanelProps = {
   ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
   ipCheckStatus?: 'loading' | 'error'
   onRetryIpCheck?: () => void
+  policySelectOpen?: boolean
+  onPolicySelectOpenChange?: (open: boolean) => void
   availableAccessPoints: readonly AccessPoint[]
   appIcon: AccessControlAppIcon
   readOnly?: boolean
@@ -43,6 +45,8 @@ export function AccessControlConfigPanel({
   ipCheck,
   ipCheckStatus,
   onRetryIpCheck,
+  policySelectOpen,
+  onPolicySelectOpenChange,
   availableAccessPoints,
   appIcon,
   readOnly = false,
@@ -127,6 +131,8 @@ export function AccessControlConfigPanel({
             ipCheck={ipCheck}
             ipCheckStatus={ipCheckStatus}
             onRetryIpCheck={onRetryIpCheck}
+            open={policySelectOpen}
+            onOpenChange={onPolicySelectOpenChange}
             readOnly={readOnly || saving}
             canManagePolicies={canManagePolicies}
             onCreatePolicy={onCreatePolicy}
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 1f4fbd6309c597..b5c0c57690c764 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -107,6 +107,7 @@ function AccessControlSession({
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
   const [createPolicyOpen, setCreatePolicyOpen] = useState(false)
+  const [policySelectOpen, setPolicySelectOpen] = useState(false)
   const [confirmation, setConfirmation] = useState<{
     draft: AccessControlDraft
     clientIp: string
@@ -209,6 +210,7 @@ function AccessControlSession({
     saveAttemptRef.current += 1
     saveCheck.reset()
     setConfirmation(null)
+    setPolicySelectOpen(false)
     setDraft(null)
     setShowBack(false)
   }
@@ -445,6 +447,8 @@ function AccessControlSession({
                   saveCheck.reset()
                   void ipCheck.refetch()
                 }}
+                policySelectOpen={policySelectOpen}
+                onPolicySelectOpenChange={setPolicySelectOpen}
                 canManagePolicies={canManagePolicies}
                 baseline={baseline}
                 showBack={showBack}
@@ -496,12 +500,9 @@ function AccessControlSession({
                       }
                     },
                   )
-                  setDraft({
-                    ...resolvedDraft,
-                    selectedPolicyId: data.group.id,
-                  })
                   setCreatePolicyOpen(false)
                   setView('config')
+                  setPolicySelectOpen(true)
                   setOpen(true)
                 },
               },
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index fafb5cd89a318b..2162d14e05dfb1 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -27,6 +27,8 @@ type AccessControlPolicyFieldProps = {
   ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
   ipCheckStatus?: 'loading' | 'error'
   onRetryIpCheck?: () => void
+  open?: boolean
+  onOpenChange?: (open: boolean) => void
   readOnly?: boolean
   canManagePolicies: boolean
   onCreatePolicy: () => void
@@ -40,6 +42,8 @@ export function AccessControlPolicyField({
   ipCheck,
   ipCheckStatus,
   onRetryIpCheck,
+  open,
+  onOpenChange,
   readOnly = false,
   canManagePolicies,
   onCreatePolicy,
@@ -143,7 +147,10 @@ export function AccessControlPolicyField({
                 disabled={readOnly}
                 className="flex h-8 w-full cursor-pointer items-center rounded-lg px-2 text-left system-sm-medium text-text-secondary outline-hidden hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid"
                 onClick={() => {
-                  if (!readOnly) onSelectPolicy(policy.id)
+                  if (!readOnly) {
+                    onSelectPolicy(policy.id)
+                    onOpenChange?.(false)
+                  }
                 }}
               >
                 <span className="min-w-0 flex-1 truncate px-1">{policy.name}</span>
@@ -179,6 +186,8 @@ export function AccessControlPolicyField({
       <div className="flex w-full items-center gap-1">
         <Select
           value={selectedPolicyId}
+          open={open}
+          onOpenChange={onOpenChange}
           disabled={readOnly}
           onValueChange={(value) => {
             if (readOnly) return

From 94b4591c8ef20e0976bf54012f610c1c8cc59443 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:31:00 +0800
Subject: [PATCH 052/108] test(web): guard shared IP policy edit warnings
 (SNP-832)

---
 .../__tests__/policy-dialog.spec.tsx          | 26 ++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
index e1376f42683fb3..4d077dc9d158f6 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -1,4 +1,4 @@
-import { screen } from '@testing-library/react'
+import { screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { useState } from 'react'
 import { renderWithConsoleQuery as render } from '@/test/console/query-data'
@@ -213,4 +213,28 @@ describe('trusted current IP and allowlist editing', () => {
       })
     },
   )
+
+  it.each([
+    { mode: 'edit', count: 0 },
+    { mode: 'view', count: 2 },
+  ] as const)(
+    'does not show an immediate-effect warning in $mode with $count references',
+    async ({ mode, count }) => {
+      render(
+        <IpPolicyDialog
+          open
+          mode={mode}
+          initialName="Office"
+          initialEntries={['10.0.0.0/8']}
+          usedByCount={count}
+          onOpenChange={vi.fn()}
+        />,
+      )
+      await waitFor(() =>
+        expect(
+          screen.queryByText('Changes take effect immediately wherever this policy is applied.'),
+        ).not.toBeInTheDocument(),
+      )
+    },
+  )
 })

From 26016744b07dfdc3e9a8779e6a07c59fb69e8b43 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 17:40:28 +0800
Subject: [PATCH 053/108] fix(web): add sign-in entry to inaccessible app page

---
 .../app-access-error/__tests__/page.spec.tsx  | 39 ++++++++++++++++---
 web/features/app-access-error/locale-menu.tsx |  3 +-
 .../app-access-error/page.stories.tsx         |  5 ++-
 web/features/app-access-error/page.tsx        | 34 ++++++++++++++--
 .../illustrations/sign-in-avatar-person.svg   | 16 ++++++++
 5 files changed, 87 insertions(+), 10 deletions(-)
 create mode 100644 web/public/illustrations/sign-in-avatar-person.svg

diff --git a/web/features/app-access-error/__tests__/page.spec.tsx b/web/features/app-access-error/__tests__/page.spec.tsx
index da25ed139b24c9..d301b5aee4c7b6 100644
--- a/web/features/app-access-error/__tests__/page.spec.tsx
+++ b/web/features/app-access-error/__tests__/page.spec.tsx
@@ -2,15 +2,23 @@ import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { createInstance } from 'i18next'
 import { I18nextProvider } from 'react-i18next'
+import enLogin from '@/i18n/en-US/login.json'
 import enShare from '@/i18n/en-US/share.json'
+import jaLogin from '@/i18n/ja-JP/login.json'
 import jaShare from '@/i18n/ja-JP/share.json'
+import zhLogin from '@/i18n/zh-Hans/login.json'
 import zhShare from '@/i18n/zh-Hans/share.json'
 import { getBrowserLocale } from '../locale'
 import AppNotAccessible from '../page'
 
 vi.unmock('react-i18next')
+vi.mock('@/next/navigation', () => ({
+  usePathname: () => window.location.pathname,
+  useSearchParams: () => new URLSearchParams(window.location.search),
+}))
 
 beforeEach(() => {
+  window.history.replaceState({}, '', '/chat/app')
   vi.spyOn(navigator, 'languages', 'get').mockReturnValue(['en-US'])
   document.title = 'Previous title'
   document.cookie = 'locale=zh-Hans'
@@ -18,10 +26,10 @@ beforeEach(() => {
 afterEach(() => vi.restoreAllMocks())
 
 it.each([
-  ['en-GB', enShare],
-  ['zh-CN', zhShare],
-  ['ja', jaShare],
-])('uses browser language %s for exact page and document copy', async (language, copy) => {
+  ['en-GB', enShare, enLogin],
+  ['zh-CN', zhShare, zhLogin],
+  ['ja', jaShare, jaLogin],
+])('uses browser language %s for exact page and document copy', async (language, copy, login) => {
   vi.spyOn(navigator, 'languages', 'get').mockReturnValue([language])
   const parent = createInstance()
   await parent.init({ lng: 'zh-Hans' })
@@ -34,6 +42,10 @@ it.each([
     await screen.findByRole('heading', { name: copy['appNotAccessible.title'] }),
   ).toBeInTheDocument()
   expect(screen.getByText(copy['appNotAccessible.description'])).toBeInTheDocument()
+  expect(screen.getByRole('link', { name: login.signBtn })).toHaveAttribute(
+    'href',
+    '/signin?redirect_url=%2Fchat%2Fapp',
+  )
   expect(screen.getByText('2001:db8::12', { selector: 'code' }).closest('p')?.textContent).toBe(
     copy['appNotAccessible.ipAddress'].replace('<ip>{{ip}}</ip>', '2001:db8::12'),
   )
@@ -47,7 +59,7 @@ it.each([undefined, '', 'unknown', '203.0.113.1, 192.0.2.1', '999.1.1.1'])(
     render(<AppNotAccessible clientIp={clientIp} />)
     await screen.findByRole('heading', { name: enShare['appNotAccessible.title'] })
     expect(screen.queryByText(/Your IP address/)).not.toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: /sign in|retry/i })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: /retry/i })).not.toBeInTheDocument()
   },
 )
 
@@ -61,11 +73,28 @@ it('changes only the error-page language, retaining the IP and restoring the tit
   ).toBeInTheDocument()
   await waitFor(() => expect(document.title).toBe(jaShare['appNotAccessible.documentTitle']))
   expect(screen.getByText('203.0.113.8', { selector: 'code' })).toBeInTheDocument()
+  expect(screen.getByRole('link', { name: jaLogin.signBtn })).toHaveAttribute(
+    'href',
+    '/signin?redirect_url=%2Fchat%2Fapp',
+  )
   expect(document.cookie).toContain('locale=zh-Hans')
   unmount()
   expect(document.title).toBe('Previous title')
 })
 
+it.each([
+  '/environment/workflow/app?conversation=123&name=%E6%B5%8B%E8%AF%95',
+  '/agents/app/access',
+  '/form/test-token',
+])('keeps the current access address %s as the sign-in return target', async (path) => {
+  window.history.replaceState({}, '', path)
+  render(<AppNotAccessible />)
+  const link = await screen.findByRole('link', { name: enLogin.signBtn })
+  const destination = new URL(link.getAttribute('href')!, window.location.origin)
+  expect(destination.pathname).toBe('/signin')
+  expect(destination.searchParams.get('redirect_url')).toBe(path)
+})
+
 it.each([
   [['zh-TW'], 'zh-Hant'],
   [['zh-SG'], 'zh-Hans'],
diff --git a/web/features/app-access-error/locale-menu.tsx b/web/features/app-access-error/locale-menu.tsx
index 41fc2e3785c319..ae2f908c925cc1 100644
--- a/web/features/app-access-error/locale-menu.tsx
+++ b/web/features/app-access-error/locale-menu.tsx
@@ -33,7 +33,8 @@ export default function LocaleMenu({
         }
       >
         <span aria-hidden className="i-ri-global-line size-4 shrink-0" />
-        <span>{selectedLanguageName}</span>
+        {/* oxlint-disable-next-line dify/require-title-for-truncated-text -- The language menu exposes the full selected label through pointer, keyboard, and touch. */}
+        <span className="truncate">{selectedLanguageName}</span>
         <span aria-hidden className="i-ri-arrow-down-s-line size-4 shrink-0" />
       </DropdownMenuTrigger>
       <DropdownMenuContent placement="bottom-end" className="max-h-80 w-60 overflow-y-auto">
diff --git a/web/features/app-access-error/page.stories.tsx b/web/features/app-access-error/page.stories.tsx
index cc19a1a9dd143a..fa8e36869ab5a2 100644
--- a/web/features/app-access-error/page.stories.tsx
+++ b/web/features/app-access-error/page.stories.tsx
@@ -5,7 +5,10 @@ import AppNotAccessible from './page'
 const meta = {
   title: 'App/App Not Accessible',
   component: AppNotAccessible,
-  parameters: { layout: 'fullscreen' },
+  parameters: {
+    layout: 'fullscreen',
+    nextjs: { appDirectory: true, navigation: { pathname: '/chat/app' } },
+  },
   decorators: [
     (Story) => (
       <ThemeProvider attribute="data-theme" defaultTheme="light">
diff --git a/web/features/app-access-error/page.tsx b/web/features/app-access-error/page.tsx
index 0b5c263b92b73b..74961f4143379e 100644
--- a/web/features/app-access-error/page.tsx
+++ b/web/features/app-access-error/page.tsx
@@ -11,6 +11,8 @@ import { DifyLogo } from '@/app/components/base/logo/dify-logo'
 import ThemeSelector from '@/app/components/base/theme-selector'
 import { loadI18nResource } from '@/i18n-config/load-resource'
 import { getInitOptions } from '@/i18n-config/settings'
+import Link from '@/next/link'
+import { usePathname, useSearchParams } from '@/next/navigation'
 import { basePath } from '@/utils/var'
 import { getBrowserLocale } from './locale'
 import LocaleMenu from './locale-menu'
@@ -23,7 +25,11 @@ type AppNotAccessibleProps = {
 }
 
 function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
-  const { t, i18n } = useTranslation('share')
+  const { t, i18n } = useTranslation(['share', 'login'])
+  const pathname = usePathname()
+  const searchParams = useSearchParams()
+  const query = searchParams.toString()
+  const returnTo = `${pathname}${query ? `?${query}` : ''}`
   const [copyrightYear] = useState(() => new Date().getFullYear())
   const title = t(($) => $['appNotAccessible.documentTitle'])
   const ip = getClientIp({ client_ip: clientIp })
@@ -49,7 +55,7 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
       <div className="flex min-h-full min-w-0 flex-col rounded-lg border border-effects-highlight bg-background-default-subtle">
         <header className="flex shrink-0 items-center justify-between gap-2 pt-4 pr-3 pb-3 pl-6">
           <DifyLogo alt="Dify" size="large" className="w-15.75 shrink-0" />
-          <div className="flex min-w-0 items-center gap-2">
+          <div className="flex min-w-0 items-center gap-1">
             <LocaleMenu
               locale={i18n.language as Locale}
               onChange={(value) => {
@@ -57,6 +63,28 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
               }}
             />
             <ThemeSelector />
+            <span aria-hidden className="h-3.5 w-px shrink-0 bg-divider-regular" />
+            <Link
+              href={{ pathname: '/signin', query: { redirect_url: returnTo } }}
+              prefetch={false}
+              className="inline-flex shrink-0 items-center rounded-full p-0.5 text-components-button-secondary-text hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
+            >
+              <span
+                aria-hidden
+                className="relative size-6 shrink-0 overflow-hidden rounded-full border-[0.5px] border-divider-regular bg-util-colors-gray-gray-300"
+              >
+                <img
+                  src={`${basePath}/illustrations/sign-in-avatar-person.svg`}
+                  width={18}
+                  height={29.1429}
+                  alt=""
+                  className="absolute top-[21.43%] left-[12.5%] w-3/4 max-w-none"
+                />
+              </span>
+              <span className="px-2 system-sm-medium whitespace-nowrap">
+                {t(($) => $.signBtn, { ns: 'login' })}
+              </span>
+            </Link>
           </div>
         </header>
         <Content className="flex flex-1 items-center justify-center px-6 pt-12 pb-12 md:pb-30">
@@ -108,7 +136,7 @@ export default function AppNotAccessible(props: AppNotAccessibleProps) {
     void instance.use(resourcesToBackend(loadI18nResource)).init({
       ...getInitOptions(),
       lng: getBrowserLocale(typeof navigator === 'undefined' ? [] : navigator.languages),
-      ns: ['share', 'common'],
+      ns: ['share', 'common', 'login'],
       defaultNS: 'share',
     })
     return instance
diff --git a/web/public/illustrations/sign-in-avatar-person.svg b/web/public/illustrations/sign-in-avatar-person.svg
new file mode 100644
index 00000000000000..133e2dfe060599
--- /dev/null
+++ b/web/public/illustrations/sign-in-avatar-person.svg
@@ -0,0 +1,16 @@
+<svg preserveAspectRatio="none" overflow="visible" style="display: block;" width="18" height="29.1429" viewBox="0 0 18 29.1429" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g id="People">
+<circle id="Head" cx="9" cy="4.71429" r="4.71429" fill="url(#paint0_radial_0_56)"/>
+<circle id="Body" cx="9" cy="20.1429" r="9" fill="url(#paint1_radial_0_56)"/>
+</g>
+<defs>
+<radialGradient id="paint0_radial_0_56" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(6.85714 1.92857) rotate(54.6375) scale(8.14568)">
+<stop stop-color="white" stop-opacity="0.9"/>
+<stop offset="1" stop-color="white" stop-opacity="0.3"/>
+</radialGradient>
+<radialGradient id="paint1_radial_0_56" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(6.21429 13.9286) rotate(62.1524) scale(12.8446)">
+<stop stop-color="white" stop-opacity="0.7"/>
+<stop offset="1" stop-color="white" stop-opacity="0.3"/>
+</radialGradient>
+</defs>
+</svg>

From cce856864cacdb92cd5a3b7dd1ee0a5df2b8b5d4 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 18:14:07 +0800
Subject: [PATCH 054/108] fix(web): clarify Chinese IP policy reference labels
 (SNP-828)

---
 web/i18n/zh-Hans/common.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 8c0cd1355982a5..3b088e62c1aabf 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -567,7 +567,7 @@
   "settings.ipPolicyColumnIpEntries": "IP 条目",
   "settings.ipPolicyColumnName": "名称",
   "settings.ipPolicyColumnUpdatedAt": "更新时间",
-  "settings.ipPolicyColumnUsedBy": "生效应用",
+  "settings.ipPolicyColumnUsedBy": "引用应用",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyCurrentIpError": "无法检查您的 IP 地址，请重试。",
@@ -596,7 +596,7 @@
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
   "settings.ipPolicyUsedBy": "仍有 {{count}} 个应用在引用",
-  "settings.ipPolicyUsedByLabel": "生效中",
+  "settings.ipPolicyUsedByLabel": "引用应用",
   "settings.ipPolicyUsedBy_one": "仍有 {{count}} 个应用在引用",
   "settings.members": "成员",
   "settings.permissionSet": "权限集",

From 04f3ed744b17a67e9552099f3452a4884000059c Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Sun, 20 Sep 2026 19:00:55 +0800
Subject: [PATCH 055/108] fix(api): include trusted client IP in app access 404
 errors

Refs SNP-837. Preserve existing error semantics and restrict request-local, non-cacheable IP metadata to Web/Console app access errors.
---
 api/controllers/API_SCHEMA_GUIDE.md           |  38 ++
 api/controllers/common/app_access_error.py    |  79 ++++
 api/controllers/console/__init__.py           |   2 +
 api/controllers/web/__init__.py               |   2 +
 .../common/test_app_access_error.py           | 367 ++++++++++++++++++
 5 files changed, 488 insertions(+)
 create mode 100644 api/controllers/common/app_access_error.py
 create mode 100644 api/tests/unit_tests/controllers/common/test_app_access_error.py

diff --git a/api/controllers/API_SCHEMA_GUIDE.md b/api/controllers/API_SCHEMA_GUIDE.md
index b9587b9f8f8e69..65d9ca9310b956 100644
--- a/api/controllers/API_SCHEMA_GUIDE.md
+++ b/api/controllers/API_SCHEMA_GUIDE.md
@@ -224,6 +224,44 @@ return dump_response(WorkflowRunDetailResponse, workflow_run)
 Use manual `model_validate(...).model_dump(...)` only when the endpoint needs behavior that `dump_response(...)` does
 not provide, such as returning a non-dict payload, intentionally excluding fields, or composing a `(body, status)` tuple.
 
+## App-access 404 metadata
+
+The Web and Console blueprints add optional request-local `client_ip` metadata
+to their existing JSON app-not-found responses. This is transport error metadata,
+not an App property, a new endpoint, or a field in successful response DTOs.
+
+- Preserve the original HTTP status, error `code`, `message`, and any other fields.
+- A typed `app_not_found` 404 is eligible. Generic 404s are eligible only for
+  matched GET app-identity routes: Web bootstrap (`site`, `parameters`, `meta`,
+  `passport`, `login/status`, `webapp/access-mode`) and Console App/Agent,
+  installed-App detail/parameters/meta, and trial-App detail/parameters.
+- The field is a single normalized IP resolved using the configured trusted
+  proxy boundary. Do not accept a caller's query/body IP or use unverified
+  forwarding headers. If trust configuration or resolution is unavailable,
+  omit `client_ip` instead of guessing a proxy address or changing the 404 to 503.
+- These eligible errors use `Cache-Control: no-store`, because their IP metadata
+  must not be shared between callers through URL-based error caching.
+- Leave HITL/form 404s, ordinary resource 404s, unmatched routes, non-JSON/streamed
+  responses, other status codes, and Service/Inner API contracts unchanged.
+  In particular, do not turn a trial 403 or a Gateway `policy_unavailable` 503
+  into an app 404.
+
+For example, a Web passport `not_found` response may become:
+
+```json
+{
+  "code": "not_found",
+  "message": "App not found.",
+  "status": 404,
+  "client_ip": "203.0.113.42"
+}
+```
+
+The existing frontend error transport already accepts optional `client_ip`;
+success OpenAPI/TypeScript/Zod/oRPC contracts do not change for this enrichment.
+Add coverage at the final serialized-response boundary, including exceptions
+with their own `data`, so Flask-RESTX cannot silently discard the metadata.
+
 ## Legacy Flask-RESTX Patterns
 
 Avoid adding these patterns to new or migrated endpoints:
diff --git a/api/controllers/common/app_access_error.py b/api/controllers/common/app_access_error.py
new file mode 100644
index 00000000000000..3f0b590ce2a9f0
--- /dev/null
+++ b/api/controllers/common/app_access_error.py
@@ -0,0 +1,79 @@
+"""Attach request-local IP metadata to Web and Console app-not-found responses.
+
+This transport hook runs after Flask-RESTX has formatted errors, including errors
+with their own ``data`` payload. It deliberately does not change error ownership,
+authentication, status codes, or unmatched-route handling.
+"""
+
+from typing import Literal
+
+from flask import Blueprint, Response, current_app, request
+
+from configs import dify_config
+from core.network_access.client_ip import NetworkAccessClientIPUnavailableError, resolve_network_access_client_ip
+
+_APP_IDENTITY_ROUTES = {
+    "web": frozenset({"/site", "/parameters", "/meta", "/passport", "/login/status", "/webapp/access-mode"}),
+    "console": frozenset(
+        {
+            "/apps/<uuid:app_id>",
+            "/agent/<uuid:agent_id>",
+            "/installed-apps/<uuid:installed_app_id>",
+            "/installed-apps/<uuid:installed_app_id>/parameters",
+            "/installed-apps/<uuid:installed_app_id>/meta",
+            "/trial-apps/<uuid:app_id>",
+            "/trial-apps/<uuid:app_id>/parameters",
+        }
+    ),
+}
+
+
+def register_app_access_error_metadata(blueprint: Blueprint, *, surface: Literal["web", "console"]) -> None:
+    """Enrich only typed app 404s and GET app-identity 404s on this blueprint.
+
+    Use matched route rules instead of caller-supplied paths or IDs. A missing
+    app does not have an App model, and unrelated resource/form 404s must retain
+    their existing response contracts. This hook is not registered on Service,
+    Inner, or other APIs.
+    """
+    prefix = (blueprint.url_prefix or "").rstrip("/")
+    identity_rules = frozenset(prefix + route for route in _APP_IDENTITY_ROUTES[surface])
+
+    @blueprint.after_request
+    def add_app_access_error_metadata(response: Response) -> Response:
+        if (
+            response.status_code != 404
+            or response.is_streamed
+            or response.direct_passthrough
+            or not response.is_json
+            or request.url_rule is None
+            # HITL forms own their expiry/not-found UI, even if an underlying
+            # app lookup happened to produce the typed app error.
+            or request.url_rule.rule.startswith((prefix + "/form/human_input/", prefix + "/human-input-forms/"))
+        ):
+            return response
+
+        payload = response.get_json(silent=True)
+        if not isinstance(payload, dict):
+            return response
+        is_app_identity = request.method == "GET" and request.url_rule.rule in identity_rules
+        if payload.get("code") != "app_not_found" and not is_app_identity:
+            return response
+
+        # An app 404 can be cached by URL, but its client address cannot be.
+        response.headers["Cache-Control"] = "no-store"
+        # This hook owns the metadata: never preserve an unverified address
+        # supplied by an existing payload when trusted resolution is unavailable.
+        payload.pop("client_ip", None)
+        trusted_proxy_cidrs = dify_config.NETWORK_ACCESS_TRUSTED_PROXY_CIDRS
+        # Never mislabel an internal Docker/ALB peer as the user's address when
+        # deployment trust configuration is missing.
+        if trusted_proxy_cidrs.strip():
+            try:
+                payload["client_ip"] = resolve_network_access_client_ip(request.environ, trusted_proxy_cidrs)
+            except NetworkAccessClientIPUnavailableError:
+                # Optional display metadata must not turn a genuine 404 into 503.
+                pass
+
+        response.set_data(current_app.json.dumps(payload))
+        return response
diff --git a/api/controllers/console/__init__.py b/api/controllers/console/__init__.py
index c11309fbac26fc..e508092623ae7e 100644
--- a/api/controllers/console/__init__.py
+++ b/api/controllers/console/__init__.py
@@ -4,10 +4,12 @@
 from flask import Blueprint, current_app, got_request_exception
 from flask_restx import Namespace
 
+from controllers.common.app_access_error import register_app_access_error_metadata
 from libs.external_api import ExternalApi
 from machinery.errors import ActiveWorkspaceRequiredError
 
 bp = Blueprint("console", __name__, url_prefix="/console/api")
+register_app_access_error_metadata(bp, surface="console")
 
 api = ExternalApi(
     bp,
diff --git a/api/controllers/web/__init__.py b/api/controllers/web/__init__.py
index d4b0829dea3027..99e151326bbb49 100644
--- a/api/controllers/web/__init__.py
+++ b/api/controllers/web/__init__.py
@@ -1,9 +1,11 @@
 from flask import Blueprint
 from flask_restx import Namespace
 
+from controllers.common.app_access_error import register_app_access_error_metadata
 from libs.external_api import ExternalApi
 
 bp = Blueprint("web", __name__, url_prefix="/api")
+register_app_access_error_metadata(bp, surface="web")
 
 api = ExternalApi(
     bp,
diff --git a/api/tests/unit_tests/controllers/common/test_app_access_error.py b/api/tests/unit_tests/controllers/common/test_app_access_error.py
new file mode 100644
index 00000000000000..28f86195696c48
--- /dev/null
+++ b/api/tests/unit_tests/controllers/common/test_app_access_error.py
@@ -0,0 +1,367 @@
+import json
+from collections.abc import Callable, Iterator
+from typing import Literal
+from uuid import UUID
+
+import pytest
+from flask import Blueprint, Flask, Response
+from flask.typing import ResponseReturnValue
+from flask_restx import Resource
+from werkzeug.exceptions import NotFound
+from werkzeug.middleware.proxy_fix import ProxyFix
+
+from configs import dify_config
+from controllers.common.app_access_error import register_app_access_error_metadata
+from libs.exception import BaseHTTPException
+from libs.external_api import ExternalApi
+
+APP_ID = "9d6e3fb3-94ce-48f9-a958-58ca80b1c02e"
+TRUSTED = "172.18.0.0/16,10.0.0.0/8,2400:cb00::/32"
+WEB_IDENTITIES = ("/site", "/parameters", "/meta", "/passport", "/login/status", "/webapp/access-mode")
+CONSOLE_IDENTITIES = (
+    "/apps/<uuid:app_id>",
+    "/agent/<uuid:agent_id>",
+    "/installed-apps/<uuid:installed_app_id>",
+    "/installed-apps/<uuid:installed_app_id>/parameters",
+    "/installed-apps/<uuid:installed_app_id>/meta",
+    "/trial-apps/<uuid:app_id>",
+    "/trial-apps/<uuid:app_id>/parameters",
+)
+OTHER_ROUTES = (
+    "/chat-messages",
+    "/form/human_input/<string:form_token>",
+    "/form/human_input/<string:form_token>/upload-token",
+    "/human-input-forms/files",
+    "/conversations/<uuid:conversation_id>",
+    "/apps/<uuid:app_id>/workflows/<uuid:workflow_id>",
+    "/agent/<uuid:agent_id>/versions/<uuid:version_id>",
+    "/installed-apps/<uuid:installed_app_id>/conversations",
+    "/trial-apps/<uuid:app_id>/workflows",
+)
+
+
+class AppNotFoundError(BaseHTTPException):
+    error_code = "app_not_found"
+    code = 404
+    description = "App not found."
+
+
+class AgentNotFoundError(NotFound):
+    description = "Agent not found."
+
+
+def _missing_app() -> ResponseReturnValue:
+    raise NotFound("App not found.")
+
+
+def _create_app(responder: Callable[[], ResponseReturnValue] = _missing_app, *, use_proxy_fix: bool = False) -> Flask:
+    app = Flask(__name__)
+    app.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
+    if use_proxy_fix:
+        app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1)
+    for surface, prefix in (("web", "/api"), ("console", "/console/api"), ("service", "/v1")):
+        bp = Blueprint(surface, __name__, url_prefix=prefix)
+        if surface == "web":
+            register_app_access_error_metadata(bp, surface="web")
+        elif surface == "console":
+            register_app_access_error_metadata(bp, surface="console")
+        api = ExternalApi(bp)
+
+        class AppResource(Resource):
+            def get(self, **_kwargs: str | UUID) -> ResponseReturnValue:
+                return responder()
+
+            def post(self, **_kwargs: str | UUID) -> ResponseReturnValue:
+                return responder()
+
+        # Include the opposite surface's identity paths to prove the allowlists
+        # are independent, not broad suffix/path matches.
+        api.add_resource(AppResource, *WEB_IDENTITIES, *CONSOLE_IDENTITIES, *OTHER_ROUTES)
+        app.register_blueprint(bp)
+    return app
+
+
+def _path(rule: str) -> str:
+    for name in ("app_id", "agent_id", "installed_app_id", "workflow_id", "conversation_id", "version_id"):
+        rule = rule.replace(f"<uuid:{name}>", APP_ID)
+    return rule.replace("<string:form_token>", "missing-form-token")
+
+
+@pytest.fixture(autouse=True)
+def _trusted_proxies(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", TRUSTED)
+
+
+@pytest.mark.parametrize("rule", WEB_IDENTITIES)
+def test_web_app_identity_404s_receive_metadata(rule: str) -> None:
+    response = _create_app().test_client().get("/api" + rule, environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    assert response.status_code == 404
+    assert response.get_json() == {
+        "code": "not_found",
+        "message": "App not found.",
+        "status": 404,
+        "client_ip": "203.0.113.42",
+    }
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("rule", CONSOLE_IDENTITIES)
+def test_console_app_identity_404s_receive_metadata(rule: str) -> None:
+    response = (
+        _create_app().test_client().get("/console/api" + _path(rule), environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    )
+    assert response.status_code == 404
+    assert response.get_json()["client_ip"] == "203.0.113.42"
+    assert response.get_json()["code"] == "not_found"
+
+
+@pytest.mark.parametrize("prefix", ["/api", "/console/api"])
+@pytest.mark.parametrize("method", ["GET", "POST"])
+def test_typed_app_not_found_keeps_exception_payload_after_restx_formatting(prefix: str, method: str) -> None:
+    def missing() -> ResponseReturnValue:
+        error = AppNotFoundError()
+        assert error.data is not None
+        error.data["detail"] = {"reason": "unavailable"}
+        raise error
+
+    response = (
+        _create_app(missing)
+        .test_client()
+        .open(prefix + "/chat-messages", method=method, environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    )
+    assert response.status_code == 404
+    assert response.get_json() == {
+        "code": "app_not_found",
+        "message": "App not found.",
+        "status": 404,
+        "detail": {"reason": "unavailable"},
+        "client_ip": "203.0.113.42",
+    }
+
+
+def test_agent_error_code_is_not_reclassified() -> None:
+    def missing() -> ResponseReturnValue:
+        raise AgentNotFoundError()
+
+    response = (
+        _create_app(missing)
+        .test_client()
+        .get(f"/console/api/agent/{APP_ID}", environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    )
+    assert response.status_code == 404
+    assert response.get_json()["code"] == "agent_not_found_error"
+    assert response.get_json()["message"] == "Agent not found."
+    assert response.get_json()["client_ip"] == "203.0.113.42"
+
+
+@pytest.mark.parametrize(
+    ("peer", "forwarded", "expected"),
+    [
+        ("203.0.113.42", "192.0.2.1, invalid", "203.0.113.42"),
+        ("2001:db8::42", "192.0.2.1", "2001:db8::42"),
+        ("::ffff:203.0.113.42", "192.0.2.1", "203.0.113.42"),
+        ("172.18.0.2", "192.0.2.1, 203.0.113.42, 10.2.3.4", "203.0.113.42"),
+        ("172.18.0.2", "2001:0db8::42, 2400:cb00::1, 10.2.3.4", "2001:db8::42"),
+        ("::ffff:172.18.0.2", "::ffff:203.0.113.42, ::ffff:10.2.3.4", "203.0.113.42"),
+    ],
+)
+@pytest.mark.parametrize("use_proxy_fix", [False, True])
+def test_trust_boundary_ignores_spoofed_arguments_and_headers(
+    peer: str, forwarded: str, expected: str, use_proxy_fix: bool
+) -> None:
+    response = (
+        _create_app(use_proxy_fix=use_proxy_fix)
+        .test_client()
+        .get(
+            "/api/site?client_ip=192.0.2.123&app_code=does-not-exist",
+            json={"client_ip": "192.0.2.124"},
+            headers={"X-Forwarded-For": forwarded, "X-Real-IP": "192.0.2.125", "CF-Connecting-IP": "192.0.2.126"},
+            environ_overrides={"REMOTE_ADDR": peer},
+        )
+    )
+    assert response.status_code == 404
+    assert response.get_json()["client_ip"] == expected
+
+
+@pytest.mark.parametrize("config", ["", " ", "not-a-cidr", "172.18.0.1/16", "172.18.0.0/16,"])
+def test_missing_or_invalid_trust_configuration_preserves_original_404(
+    monkeypatch: pytest.MonkeyPatch, config: str
+) -> None:
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", config)
+    response = (
+        _create_app()
+        .test_client()
+        .get("/api/site", environ_overrides={"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": "203.0.113.42"})
+    )
+    assert response.status_code == 404
+    assert response.get_json() == {"code": "not_found", "message": "App not found.", "status": 404}
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("forwarded", [None, "", "unknown", "192.0.2.1, invalid", "10.2.3.4", "192.0.2.1," * 33])
+def test_unavailable_client_ip_never_exposes_internal_peer_or_changes_status(forwarded: str | None) -> None:
+    environ = {"REMOTE_ADDR": "172.18.0.2"}
+    if forwarded is not None:
+        environ["HTTP_X_FORWARDED_FOR"] = forwarded
+    response = _create_app().test_client().get("/api/site", environ_overrides=environ)
+    assert response.status_code == 404
+    assert "client_ip" not in response.get_json()
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("config", ["", "not-a-cidr", TRUSTED])
+def test_unavailable_client_ip_removes_existing_unverified_metadata(
+    monkeypatch: pytest.MonkeyPatch, config: str
+) -> None:
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", config)
+    payload = {
+        "code": "app_not_found",
+        "message": "missing",
+        "status": 404,
+        "client_ip": "192.0.2.123",
+        "extra": "kept",
+    }
+    response = (
+        _create_app(lambda: (payload, 404))
+        .test_client()
+        .get("/api/site", environ_overrides={"REMOTE_ADDR": "172.18.0.2"})
+    )
+    assert response.status_code == 404
+    assert response.get_json() == {"code": "app_not_found", "message": "missing", "status": 404, "extra": "kept"}
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("prefix", ["/api", "/console/api"])
+@pytest.mark.parametrize("rule", [rule for rule in OTHER_ROUTES if "human_input" in rule or "human-input" in rule])
+def test_typed_app_not_found_on_human_input_forms_is_unchanged(prefix: str, rule: str) -> None:
+    def missing() -> ResponseReturnValue:
+        raise AppNotFoundError()
+
+    response = _create_app(missing).test_client().get(prefix + _path(rule))
+    assert response.status_code == 404
+    assert response.get_json() == {"code": "app_not_found", "message": "App not found.", "status": 404}
+    assert "Cache-Control" not in response.headers
+
+
+def test_response_metadata_is_request_local_and_disables_shared_caching() -> None:
+    payload = {"code": "app_not_found", "message": "missing", "status": 404, "extra": ["kept"]}
+    client = _create_app(
+        lambda: (payload, 404, {"Cache-Control": "public, max-age=600", "X-Custom": "kept"})
+    ).test_client()
+    for peer in ("203.0.113.42", "2001:db8::43", "172.18.0.2"):
+        response = client.get("/api/site", environ_overrides={"REMOTE_ADDR": peer})
+        assert response.get_json().get("client_ip") == (None if peer == "172.18.0.2" else peer)
+        assert response.get_json()["extra"] == ["kept"]
+        assert response.headers["Cache-Control"] == "no-store"
+        assert response.headers["X-Custom"] == "kept"
+    assert "client_ip" not in payload
+
+
+@pytest.mark.parametrize("prefix", ["/api", "/console/api"])
+@pytest.mark.parametrize("rule", OTHER_ROUTES)
+def test_unrelated_resource_and_human_input_form_404s_are_unchanged(prefix: str, rule: str) -> None:
+    response = _create_app().test_client().get(prefix + _path(rule))
+    assert response.status_code == 404
+    assert response.get_json() == {"code": "not_found", "message": "App not found.", "status": 404}
+    assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize("prefix", ["/api", "/console/api"])
+@pytest.mark.parametrize("status", [200, 400, 401, 403, 503])
+def test_success_and_non_404_errors_are_unchanged(prefix: str, status: int) -> None:
+    # Even an inconsistent error code cannot override the HTTP status contract.
+    payload = {"code": "app_not_found", "message": "unchanged", "status": status}
+    response = _create_app(lambda: (payload, status)).test_client().get(prefix + "/site")
+    assert response.status_code == status
+    assert response.get_json() == payload
+    assert "Cache-Control" not in response.headers
+
+
+def test_trial_forbidden_is_not_reclassified_as_missing_app() -> None:
+    payload = {"code": "forbidden", "message": "App unavailable", "status": 403}
+    response = _create_app(lambda: (payload, 403)).test_client().get(f"/console/api/trial-apps/{APP_ID}")
+    assert response.status_code == 403
+    assert response.get_json() == payload
+    assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize("prefix", ["/api", "/console/api"])
+def test_non_get_untyped_identity_404_is_unchanged(prefix: str) -> None:
+    response = _create_app().test_client().post(prefix + "/site")
+    assert response.status_code == 404
+    assert "client_ip" not in response.get_json()
+    assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize(
+    "path", ["/api/unknown", "/console/api/unknown", "/api/site/unknown", "/console/api/apps/not-a-uuid", "/elsewhere"]
+)
+def test_unknown_routes_preserve_default_html_not_found(path: str) -> None:
+    response = _create_app().test_client().get(path)
+    assert response.status_code == 404
+    assert response.mimetype == "text/html"
+    assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize("path", [f"/api/apps/{APP_ID}", "/console/api/site", "/v1/site", f"/v1/apps/{APP_ID}"])
+def test_identity_allowlist_does_not_leak_between_surfaces(path: str) -> None:
+    response = _create_app().test_client().get(path)
+    assert response.status_code == 404
+    assert "client_ip" not in response.get_json()
+    assert "Cache-Control" not in response.headers
+
+
+def test_typed_service_api_error_is_unchanged() -> None:
+    def missing() -> ResponseReturnValue:
+        raise AppNotFoundError()
+
+    response = _create_app(missing).test_client().get("/v1/chat-messages")
+    assert response.status_code == 404
+    assert response.get_json()["code"] == "app_not_found"
+    assert "client_ip" not in response.get_json()
+    assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize("kind", ["stream", "passthrough", "html", "list", "null", "invalid-json"])
+def test_non_json_object_and_streamed_responses_are_not_consumed(kind: str) -> None:
+    consumed: list[bool] = []
+
+    def respond() -> Response:
+        if kind in {"stream", "passthrough"}:
+
+            def stream() -> Iterator[str]:
+                consumed.append(True)
+                yield '{"code":"app_not_found"}'
+
+            return Response(stream(), 404, mimetype="application/json", direct_passthrough=kind == "passthrough")
+        if kind == "html":
+            return Response("<h1>Missing</h1>", 404, mimetype="text/html")
+        data = {"list": json.dumps([{"code": "app_not_found"}]), "null": "null", "invalid-json": "{"}[kind]
+        return Response(data, 404, mimetype="application/json")
+
+    app = _create_app(respond)
+    with app.test_request_context("/api/site", environ_overrides={"REMOTE_ADDR": "203.0.113.42"}):
+        response = app.full_dispatch_request()
+        assert response.status_code == 404
+        assert "Cache-Control" not in response.headers
+        assert not consumed
+
+
+@pytest.mark.parametrize("surface", ["web", "console"])
+def test_production_blueprints_register_metadata_hook_and_all_identity_rules(
+    surface: Literal["web", "console"],
+) -> None:
+    if surface == "web":
+        from controllers.web import bp
+
+        routes = WEB_IDENTITIES
+    else:
+        from controllers.console import bp
+
+        routes = CONSOLE_IDENTITIES
+    assert any(hook.__name__ == "add_app_access_error_metadata" for hook in bp.after_request_funcs[None])
+    app = Flask(__name__)
+    app.register_blueprint(bp)
+    actual_rules = {rule.rule for rule in app.url_map.iter_rules()}
+    assert bp.url_prefix is not None
+    assert {bp.url_prefix + route for route in routes} <= actual_rules

From 19dd94b2499239968ad13cd76aa4f683f8b6b2c4 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 22:26:20 +0800
Subject: [PATCH 056/108] fix: show upgrade status when IP access control
 expires

---
 .../__tests__/chip-status.spec.ts             |  6 +-
 .../access-control/__tests__/index.spec.tsx   | 69 +++++++++++--------
 .../access-control/chip-status.ts             |  2 +-
 .../app/access-point/access-control/index.tsx |  2 +-
 4 files changed, 44 insertions(+), 35 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
index c2353c2216ac98..285bdf563d08c1 100644
--- a/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/chip-status.spec.ts
@@ -35,14 +35,14 @@ describe('getAccessControlChipState', () => {
     ).toBe('pro')
   })
 
-  it('keeps the saved assignment visible when the workspace is not entitled', () => {
+  it.each([true, false])('returns pro for an expired assignment (enabled: %s)', (enabled) => {
     expect(
       getAccessControlChipState({
         availableAccessPoints: ACCESS_POINT_ORDER,
         entitled: false,
-        assignment,
+        assignment: { ...assignment, enabled },
       }).kind,
-    ).toBe('on')
+    ).toBe('pro')
   })
 
   it('returns off when the app has never been configured', () => {
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index f7fa1b7d095c63..7be0a1e48e8b29 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -149,38 +149,47 @@ describe('AccessControlEntry', () => {
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
   })
 
-  it('shows a resume paywall for a saved assignment on Cloud sandbox', async () => {
-    const user = userEvent.setup()
-    renderEntry({
-      plan: 'sandbox',
-      groups: [createNetworkAccessGroupFixture()],
-      binding: {
-        id: 'binding-1',
-        tenant_id: 'workspace-1',
-        app_id: 'app-1',
-        enabled: true,
-        group_id: 'group-1',
-        access_points: ['webapp', 'service_api', 'mcp'],
-        version: 2,
-        created_at: '2026-01-01T00:00:00Z',
-        updated_at: '2026-01-01T00:00:00Z',
-      },
-    })
+  it.each([
+    { enabled: true, accessPoints: ['webapp', 'service_api', 'mcp'], coverage: '3 of 3' },
+    { enabled: true, accessPoints: ['webapp'], coverage: '1 of 3' },
+    { enabled: false, accessPoints: ['webapp', 'service_api', 'mcp'], coverage: '3 of 3' },
+  ] as const)(
+    'shows PRO and the saved resume configuration on Cloud sandbox (%j)',
+    async ({ enabled, accessPoints, coverage }) => {
+      const user = userEvent.setup()
+      renderEntry({
+        plan: 'sandbox',
+        groups: [createNetworkAccessGroupFixture()],
+        binding: {
+          id: 'binding-1',
+          tenant_id: 'workspace-1',
+          app_id: 'app-1',
+          enabled,
+          group_id: 'group-1',
+          access_points: [...accessPoints],
+          version: 2,
+          created_at: '2026-01-01T00:00:00Z',
+          updated_at: '2026-01-01T00:00:00Z',
+        },
+      })
 
-    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
-    await user.click(getChip())
-    expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
-    expect(screen.getByText('Access control needs the Pro plan.')).toBeInTheDocument()
-    expect(screen.getByText('Ready to resume')).toBeInTheDocument()
-    expect(screen.getByText('Internal Network')).toBeInTheDocument()
-    expect(screen.getByText('Protects 3 of 3 access points')).toBeInTheDocument()
-    expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
-    expect(screen.queryByRole('switch', { name: 'Enable access control' })).not.toBeInTheDocument()
+      expect(within(getChip()).getByText('PRO')).toBeInTheDocument()
+      await user.click(getChip())
+      expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
+      expect(screen.getByText('Access control needs the Pro plan.')).toBeInTheDocument()
+      expect(screen.getByText('Ready to resume')).toBeInTheDocument()
+      expect(screen.getByText('Internal Network')).toBeInTheDocument()
+      expect(screen.getByText(`Protects ${coverage} access points`)).toBeInTheDocument()
+      expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
+      expect(
+        screen.queryByRole('switch', { name: 'Enable access control' }),
+      ).not.toBeInTheDocument()
 
-    await user.click(screen.getByRole('button', { name: 'Turn on Access Control' }))
-    expect(mockSetPricing).toHaveBeenCalledWith('open')
-  })
+      await user.click(screen.getByRole('button', { name: 'Turn on Access Control' }))
+      expect(mockSetPricing).toHaveBeenCalledWith('open')
+    },
+  )
 
   it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
     renderEntry({ plan: 'sandbox' })
diff --git a/web/app/components/app/access-point/access-control/chip-status.ts b/web/app/components/app/access-point/access-control/chip-status.ts
index 66084fba01172d..00ab735bb1121c 100644
--- a/web/app/components/app/access-point/access-control/chip-status.ts
+++ b/web/app/components/app/access-point/access-control/chip-status.ts
@@ -38,8 +38,8 @@ export function getAccessControlChipState({
   assignment: AccessControlAssignment | null
   availableAccessPoints: readonly AccessPoint[]
 }): AccessControlChipState {
+  if (entitled === false) return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
   if (!assignment) {
-    if (entitled === false) return { kind: 'pro', coveredCount: 0, inServiceCount: 0 }
     return { kind: 'off', coveredCount: 0, inServiceCount: 0 }
   }
 
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index b5c0c57690c764..5cba4f1dcf47ca 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -176,7 +176,7 @@ function AccessControlSession({
     availableAccessPoints,
   })
   const chip = getAccessControlChipState({ entitled, assignment, availableAccessPoints })
-  const showPaywall = chip.kind === 'pro'
+  const showPaywall = chip.kind === 'pro' && !assignment
   const showDowngrade = Boolean(assignment) && !entitled
   const showStatus = Boolean(assignment) && entitled && (!canMutate || view === 'status')
 

From d9d92fad51267dea70c7909111cc303ad282381e Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 22:28:11 +0800
Subject: [PATCH 057/108] fix: resume IP access control when saving paused
 settings

---
 .../__tests__/config-panel.spec.tsx           |  9 ++--
 .../access-control/__tests__/draft.spec.ts    | 10 ++---
 .../access-control/__tests__/index.spec.tsx   | 42 +++++++++++++++++++
 .../access-control/config-panel.tsx           |  4 +-
 .../app/access-point/access-control/draft.ts  |  1 -
 .../app/access-point/access-control/index.tsx |  6 +--
 6 files changed, 56 insertions(+), 16 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index ad59d816b7aa75..5fb83a2faa16b9 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -162,19 +162,22 @@ describe('AccessControlConfigPanel', () => {
     },
   )
 
-  it('hides required-selection messages while access control is disabled', () => {
+  it('requires access points when editing a paused policy', () => {
     render(
       <PanelHarness
         initialDraft={{
           enabled: false,
-          selectedPolicyId: null,
+          selectedPolicyId: 'internal-network',
           scopes: { webApp: false, serviceApi: false, mcp: false, trigger: false },
         }}
       />,
     )
 
     expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
-    expect(screen.queryByText('Please choose at least one access point.')).not.toBeInTheDocument()
+    expect(screen.getByRole('group', { name: 'Apply to' })).toHaveAccessibleDescription(
+      'Please choose at least one access point.',
+    )
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
 
   it('warns and disables save when every access point is off', async () => {
diff --git a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
index 0657069025247e..403ee4141d3c41 100644
--- a/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
+++ b/web/app/components/app/access-point/access-control/__tests__/draft.spec.ts
@@ -21,13 +21,13 @@ describe('canSaveAccessControl', () => {
     ).toBe(false)
   })
 
-  it('disables save when every access point is off', () => {
+  it.each([true, false])('disables save with no access points (enabled: %s)', (enabled) => {
     expect(
       canSaveAccessControl({
         availableAccessPoints: ACCESS_POINT_ORDER,
         draft: {
           selectedPolicyId: 'policy-1',
-          enabled: true,
+          enabled,
           scopes: {
             webApp: false,
             serviceApi: false,
@@ -86,12 +86,12 @@ describe('canSaveAccessControl', () => {
     ).toBe(false)
   })
 
-  it('allows saving a pause when a policy is already selected', () => {
+  it('allows editing a paused configuration with a policy and access points', () => {
     expect(
       canSaveAccessControl({
         availableAccessPoints: ACCESS_POINT_ORDER,
-        draft: { ...selectedDraft, enabled: false },
-        baseline: selectedDraft,
+        draft: { ...selectedDraft, enabled: false, selectedPolicyId: 'policy-2' },
+        baseline: { ...selectedDraft, enabled: false },
       }),
     ).toBe(true)
   })
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 7be0a1e48e8b29..afa7c09a62bce8 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -1100,6 +1100,48 @@ const openSelectedConfig = async (user: ReturnType<typeof userEvent.setup>) => {
 const lockoutWarning = "Your IP (203.0.113.42) isn't in this policy. You may lose access."
 
 describe('trusted IP checks before saving', () => {
+  it.each([true, false])(
+    'enables a paused policy after saving edits with a fresh IP check (allowed: %s)',
+    async (allowed) => {
+      const user = userEvent.setup()
+      const server = setupBindingServer(createBinding({ enabled: false }))
+      server.check.allowed = allowed
+      renderEntry({
+        plan: 'professional',
+        groups: server.groups,
+        binding: server.binding,
+        isPublished: true,
+      })
+      await user.click(getChip())
+      await user.click(screen.getByRole('button', { name: 'Edit' }))
+      expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+      await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+      expect(within(getChip()).getByText('Off')).toBeInTheDocument()
+      expect(server.writes).toHaveLength(0)
+      const checksBeforeSave = server.checks
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      if (!allowed) {
+        const dialog = await screen.findByRole('alertdialog', { name: 'Save without your own IP?' })
+        expect(server.writes).toHaveLength(0)
+        await user.click(within(dialog).getByRole('button', { name: 'Save anyway' }))
+      }
+      await waitFor(() =>
+        expect(server.writes).toEqual([
+          {
+            enabled: true,
+            group_id: 'group-1',
+            access_points: ['webapp', 'service_api'],
+            expected_version: 2,
+          },
+        ]),
+      )
+      expect(server.checks).toBeGreaterThan(checksBeforeSave)
+      expect(await screen.findByRole('switch', { name: 'Enable access control' })).toBeChecked()
+      expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument()
+    },
+  )
+
   it.each([true, false])(
     'uses the server match result and only confirms a published denial (allowed: %s)',
     async (allowed) => {
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 54b88ebccc1ca0..9b1bd16fc2ff64 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -67,8 +67,8 @@ export function AccessControlConfigPanel({
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
   const hasSelectedPolicy = policies.some((policy) => policy.id === draft.selectedPolicyId)
   const hasPersistableSelection = hasSelectedAccessPoint(draft, availableAccessPoints)
-  const showPolicyError = draft.enabled && !hasSelectedPolicy
-  const showAccessPointError = draft.enabled && !hasPersistableSelection
+  const showPolicyError = !hasSelectedPolicy
+  const showAccessPointError = !hasPersistableSelection
   const canSave =
     !readOnly &&
     !saving &&
diff --git a/web/app/components/app/access-point/access-control/draft.ts b/web/app/components/app/access-point/access-control/draft.ts
index 49d6ebb61be736..fd528ff48bfb51 100644
--- a/web/app/components/app/access-point/access-control/draft.ts
+++ b/web/app/components/app/access-point/access-control/draft.ts
@@ -51,7 +51,6 @@ export function canSaveAccessControl({
 }) {
   if (!availableAccessPoints.length) return false
   if (baseline && isAccessControlDraftEqual(draft, baseline, availableAccessPoints)) return false
-  if (!draft.enabled) return Boolean(draft.selectedPolicyId)
   if (!draft.selectedPolicyId) return false
   return hasSelectedAccessPoint(draft, availableAccessPoints)
 }
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index 5cba4f1dcf47ca..a4ab86dff4b37a 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -298,7 +298,7 @@ function AccessControlSession({
   const saveDraft = (nextDraft: AccessControlDraft) => {
     persistBinding(
       {
-        enabled: nextDraft.enabled,
+        enabled: true,
         groupId: nextDraft.selectedPolicyId,
         accessPoints: accessPointsFromScopes(nextDraft.scopes, availableAccessPoints),
       },
@@ -320,10 +320,6 @@ function AccessControlSession({
       updateBinding.isPending
     )
       return
-    if (!nextDraft.enabled) {
-      saveDraft(nextDraft)
-      return
-    }
     const groupId = nextDraft.selectedPolicyId
     const attempt = ++saveAttemptRef.current
     saveCheck.mutate(

From ec41661d671afc1301c30c648fb93b6c5ba56489 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sun, 20 Sep 2026 22:31:19 +0800
Subject: [PATCH 058/108] fix: preserve access control drafts when closing the
 panel

---
 .../access-control/__tests__/index.spec.tsx   | 77 +++++++++++++++----
 .../access-control/config-panel.tsx           | 21 ++---
 2 files changed, 74 insertions(+), 24 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index afa7c09a62bce8..d932bc3e539a4a 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -132,6 +132,21 @@ beforeEach(() => {
 
 const getChip = () => screen.getByRole('button', { name: /Access Control/ })
 
+const createBinding = (
+  overrides: Partial<AppNetworkAccessGroupBindingResponse> = {},
+): AppNetworkAccessGroupBindingResponse => ({
+  id: 'binding-1',
+  tenant_id: 'workspace-1',
+  app_id: 'app-1',
+  enabled: true,
+  group_id: 'group-1',
+  access_points: ['webapp', 'service_api', 'mcp'],
+  version: 2,
+  created_at: '2026-01-01T00:00:00Z',
+  updated_at: '2026-01-01T00:00:00Z',
+  ...overrides,
+})
+
 describe('AccessControlEntry', () => {
   beforeEach(() => {
     vi.clearAllMocks()
@@ -531,6 +546,53 @@ describe('AccessControlEntry', () => {
     expect(screen.getByRole('button', { name: 'Edit' })).toBeInTheDocument()
   })
 
+  it.each([false, true])(
+    'closes and restores a draft with the Close button (configured: %s)',
+    async (configured) => {
+      const user = userEvent.setup()
+      renderEntry({
+        plan: 'professional',
+        groups: [createNetworkAccessGroupFixture()],
+        binding: configured ? createBinding() : null,
+      })
+
+      await user.click(getChip())
+      if (configured) await user.click(screen.getByRole('button', { name: 'Edit' }))
+      else await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+      await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+
+      await user.click(screen.getByRole('button', { name: 'Close' }))
+      await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+      expect(within(getChip()).getByText(configured ? 'ON' : 'Off')).toBeInTheDocument()
+
+      await user.click(getChip())
+      expect(screen.getByRole('combobox', { name: 'IP Policy' })).toHaveTextContent(
+        'Internal Network',
+      )
+      expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    },
+  )
+
+  it('closes a clean edit and reopens the saved preview with the Close button', async () => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: createBinding(),
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    await user.click(screen.getByRole('button', { name: 'Close' }))
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+
+    await user.click(getChip())
+    expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
+  })
+
   it('discards an unsaved edit on Back', async () => {
     const user = userEvent.setup()
     renderEntry({
@@ -620,21 +682,6 @@ const capabilityCases = [
   labels: string[]
 }[]
 
-const createBinding = (
-  overrides: Partial<AppNetworkAccessGroupBindingResponse> = {},
-): AppNetworkAccessGroupBindingResponse => ({
-  id: 'binding-1',
-  tenant_id: 'workspace-1',
-  app_id: 'app-1',
-  enabled: true,
-  group_id: 'group-1',
-  access_points: ['webapp', 'service_api', 'mcp'],
-  version: 2,
-  created_at: '2026-01-01T00:00:00Z',
-  updated_at: '2026-01-01T00:00:00Z',
-  ...overrides,
-})
-
 describe('supported access points and binding permission', () => {
   beforeEach(() => vi.clearAllMocks())
 
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 9b1bd16fc2ff64..5a9b8bbfe7091b 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -9,7 +9,7 @@ import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
 import { IconButton } from '@langgenius/dify-ui/icon-button'
-import { PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
+import { PopoverClose, PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
 import { useId } from 'react'
 import { useTranslation } from 'react-i18next'
 import { canSaveAccessControl, hasSelectedAccessPoint } from './draft'
@@ -103,14 +103,17 @@ export function AccessControlConfigPanel({
           <PopoverTitle className="min-w-0 flex-1 system-md-semibold text-text-primary">
             {title}
           </PopoverTitle>
-          <IconButton
-            type="button"
-            size="lg"
-            aria-label={t(($) => $['operation.close'], { ns: 'common' })}
-            onClick={onCancel}
-          >
-            <span aria-hidden className="i-ri-close-line size-4" />
-          </IconButton>
+          <PopoverClose
+            render={
+              <IconButton
+                type="button"
+                size="lg"
+                aria-label={t(($) => $['operation.close'], { ns: 'common' })}
+              >
+                <span aria-hidden className="i-ri-close-line size-4" />
+              </IconButton>
+            }
+          />
         </div>
       </div>
       <PopoverDescription className="px-4 pb-2 system-sm-regular text-text-tertiary">

From b3fb4e7560ba744d68019413093ee59172354c46 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Mon, 21 Sep 2026 16:48:09 +0800
Subject: [PATCH 059/108] fix(api): align access failures with native endpoint
 contracts

---
 api/controllers/API_SCHEMA_GUIDE.md           |  61 ++-
 api/controllers/common/access_response.py     | 135 +++++++
 api/controllers/common/app_access_error.py    |  78 +++-
 api/controllers/mcp/mcp.py                    |  55 +--
 api/controllers/openapi/__init__.py           |   2 +
 api/controllers/service_api/__init__.py       |   2 +
 api/controllers/service_api/wraps.py          |  18 +-
 api/controllers/trigger/trigger.py            |   6 +-
 api/controllers/trigger/webhook.py            |  11 +-
 .../web/human_input_file_upload.py            |   4 +-
 api/controllers/web/login.py                  |  13 +-
 api/controllers/web/site.py                   |   4 +-
 api/controllers/web/wraps.py                  |  10 +-
 api/openapi/markdown/web-openapi.md           |   2 +
 .../webapp_access_query_repository.py         |  41 +-
 api/services/webapp_access_query_service.py   |  20 +-
 .../controllers/web/test_wraps.py             |  10 +-
 .../common/test_access_response.py            | 357 ++++++++++++++++++
 .../common/test_app_access_error.py           |  64 +++-
 .../unit_tests/controllers/mcp/test_mcp.py    |  28 +-
 .../controllers/service_api/test_wraps.py     |   2 +-
 .../controllers/trigger/test_trigger.py       |  13 +-
 .../controllers/trigger/test_webhook.py       |  10 +-
 .../web/test_human_input_file_upload.py       |  19 +
 .../unit_tests/controllers/web/test_site.py   |  58 ++-
 .../controllers/web/test_web_login.py         | 124 +++++-
 .../unit_tests/controllers/web/test_wraps.py  |  98 ++++-
 .../test_webapp_access_query_repository.py    |  53 ++-
 .../test_webapp_access_query_service.py       |  60 +++
 .../contracts/generated/api/web/types.gen.ts  |   2 +
 .../try-app/__tests__/app-not-found.spec.tsx  |   4 +
 .../__tests__/ip-access-denied.spec.ts        |  89 +++++
 32 files changed, 1322 insertions(+), 131 deletions(-)
 create mode 100644 api/controllers/common/access_response.py
 create mode 100644 api/tests/unit_tests/controllers/common/test_access_response.py

diff --git a/api/controllers/API_SCHEMA_GUIDE.md b/api/controllers/API_SCHEMA_GUIDE.md
index 65d9ca9310b956..f0c6eea6050b8b 100644
--- a/api/controllers/API_SCHEMA_GUIDE.md
+++ b/api/controllers/API_SCHEMA_GUIDE.md
@@ -224,13 +224,54 @@ return dump_response(WorkflowRunDetailResponse, workflow_run)
 Use manual `model_validate(...).model_dump(...)` only when the endpoint needs behavior that `dump_response(...)` does
 not provide, such as returning a non-dict payload, intentionally excluding fields, or composing a `(body, status)` tuple.
 
-## App-access 404 metadata
+## Public access-error contracts
+
+IP-policy denials must be indistinguishable from each surface's native
+authentication/not-found errors. The Gateway terminates denied requests before
+execution; Core owns the corresponding native error baselines. Keep their JSON
+bytes (sorted keys, compact separators, no trailing newline), status and
+application-owned headers aligned. Do not add policy names, internal reasons,
+`ip_access_denied`, or a policy-specific response header.
+
+| Surface | Error contract |
+| --- | --- |
+| Service API | 401 `unauthorized`, `Access token is invalid`; missing/malformed Bearer uses `Authorization header must be provided and start with 'Bearer'` |
+| OAuth OpenAPI | Its own 401 `unauthorized` / `invalid_token`, not the Service API's token message |
+| MCP | 404 JSON-RPC `-32600` / `Server Not Found`, echoing a string/number request ID or null |
+| Workflow Webhook | 404 standard Werkzeug `NotFound()` HTML without capability ID/private detail; not JSON |
+| Plugin callback | 404 JSON `{"error":"Endpoint not found"}`; not the Workflow Webhook HTML |
+| WebApp | Canonical 404 `app_not_found` / `App not found.`, with optional trusted `client_ip` |
+| HITL form / upload | Native form 404 / invalid-upload-token 403, not a WebApp error page |
+
+These errors use `Cache-Control: no-store`. JSON uses `Content-Type:
+application/json`; Workflow Webhook uses `text/html; charset=utf-8`. Service API
+401 also includes `WWW-Authenticate: Bearer realm="api"`; OpenAPI preserves its
+native challenge/extra fields. For callers: if an API key is confirmed correct,
+contact the App administrator to check whether the source IP is allowed.
+
+MCP resolves unavailable identity before validating an invocation. Its error-only
+ID parser accepts at most 64 KiB of strict UTF-8 JSON, nesting depth 64; absent,
+invalid or oversized IDs become null. Numeric lexemes retain precision. Allowed
+requests retain their existing body and protocol-validation path. Do not create
+EndUsers or execute tools just to construct a not-found response.
+
+Real dependency failures stay fail-closed errors, not a missing-policy allow.
+The Gateway can present an unresolved canonical WebApp reference as opaque404
+while still terminating the request; it must never forward it because the
+read-side miss could be replication lag. Internal audit/metrics retain the true
+policy-denied or resolution-failure reason even though the public response does
+not disclose it.
+
+### WebApp and Console 404 metadata
 
 The Web and Console blueprints add optional request-local `client_ip` metadata
-to their existing JSON app-not-found responses. This is transport error metadata,
+to their JSON app-not-found responses. This is transport error metadata,
 not an App property, a new endpoint, or a field in successful response DTOs.
 
-- Preserve the original HTTP status, error `code`, `message`, and any other fields.
+- Public WebApp errors use only `code: app_not_found`, `message: App not found.`,
+  `status: 404` and optional `client_ip`. Strip exception-specific details that
+  would reveal whether an App exists. Authenticated Console management errors
+  preserve their original code/message/extra fields.
 - A typed `app_not_found` 404 is eligible. Generic 404s are eligible only for
   matched GET app-identity routes: Web bootstrap (`site`, `parameters`, `meta`,
   `passport`, `login/status`, `webapp/access-mode`) and Console App/Agent,
@@ -241,16 +282,18 @@ not an App property, a new endpoint, or a field in successful response DTOs.
   omit `client_ip` instead of guessing a proxy address or changing the 404 to 503.
 - These eligible errors use `Cache-Control: no-store`, because their IP metadata
   must not be shared between callers through URL-based error caching.
-- Leave HITL/form 404s, ordinary resource 404s, unmatched routes, non-JSON/streamed
-  responses, other status codes, and Service/Inner API contracts unchanged.
-  In particular, do not turn a trial 403 or a Gateway `policy_unavailable` 503
-  into an app 404.
+- Known unavailable/unpublished WebApp identity errors use this same404; arbitrary
+  400s, auth errors and dependency503s do not. Public login/status and access-mode
+  must validate a supplied App reference even when user authentication is disabled.
+- HITL keeps its own canonical form/token error; no App IP is attached. Ordinary
+  resource404s, unmatched routes, streams and Inner API contracts are unchanged.
+  In particular, an authenticated Console trial403 is not converted to404.
 
-For example, a Web passport `not_found` response may become:
+For example, either an unavailable Web passport or a Gateway WebApp denial is:
 
 ```json
 {
-  "code": "not_found",
+  "code": "app_not_found",
   "message": "App not found.",
   "status": 404,
   "client_ip": "203.0.113.42"
diff --git a/api/controllers/common/access_response.py b/api/controllers/common/access_response.py
new file mode 100644
index 00000000000000..844de7a2e4549a
--- /dev/null
+++ b/api/controllers/common/access_response.py
@@ -0,0 +1,135 @@
+"""Native, non-cacheable access errors shared with the public gateway.
+
+Keep these byte-level contracts local to their owning surfaces: Service API and
+OpenAPI authentication, unavailable MCP identities, and missing trigger endpoints.
+Successful responses and other APIs retain their existing serialization.
+"""
+
+import json
+from dataclasses import dataclass
+from typing import Any
+
+from flask import Blueprint, Response, request
+from werkzeug.exceptions import HTTPException, NotFound
+from werkzeug.wrappers import Response as WerkzeugResponse
+
+MCP_ERROR_BODY_LIMIT = 64 * 1024
+MCP_ERROR_MAX_DEPTH = 64
+MISSING_BEARER_MESSAGE = "Authorization header must be provided and start with 'Bearer'"
+
+
+def _json(value: Any) -> str:
+    # Match Go's non-HTML-escaping JSON encoder, including its JS-safe separators.
+    return (
+        json.dumps(value, ensure_ascii=False, separators=(",", ":"), sort_keys=True, allow_nan=False)
+        .replace("\u2028", "\\u2028")
+        .replace("\u2029", "\\u2029")
+    )
+
+
+def register_auth_error_response(blueprint: Blueprint, *, www_authenticate: str | None = None) -> None:
+    """Canonicalize local final 401 bodies, preserving native message/extra fields.
+
+    The Service API supplies its Bearer challenge explicitly. OpenAPI retains its
+    own challenge and OAuth error fields; other surfaces do not register this hook.
+    """
+
+    @blueprint.after_request
+    def auth_error_response(response: Response) -> Response:
+        if response.status_code != 401 or not response.is_json or response.is_streamed:
+            return response
+        payload = response.get_json(silent=True)
+        if not isinstance(payload, dict):
+            return response
+        response.set_data(_json(payload))
+        response.headers["Content-Type"] = "application/json"
+        response.headers["Cache-Control"] = "no-store"
+        if www_authenticate is not None:
+            response.headers["WWW-Authenticate"] = www_authenticate
+        return response
+
+
+@dataclass(frozen=True)
+class _JSONNumber:
+    """An already-validated JSON number lexeme, without float/int conversion."""
+
+    value: str
+
+
+def _within_json_depth(body: bytes) -> bool:
+    """Match the gateway's bounded parser; brackets inside strings do not count."""
+    depth = 0
+    in_string = False
+    escaped = False
+    for char in body:
+        if in_string:
+            if escaped:
+                escaped = False
+            elif char == 92:  # backslash
+                escaped = True
+            elif char == 34:  # quote
+                in_string = False
+        elif char == 34:
+            in_string = True
+        elif char in (91, 123):  # array or object
+            depth += 1
+            if depth > MCP_ERROR_MAX_DEPTH:
+                return False
+        elif char in (93, 125):
+            depth -= 1
+    return True
+
+
+def _invalid_constant(_value: str) -> None:
+    raise ValueError("Non-JSON numeric constant")
+
+
+def _mcp_request_id() -> str:
+    """Read at most the bounded denied request, returning serialized ID or null."""
+    try:
+        if request.content_length is not None and request.content_length > MCP_ERROR_BODY_LIMIT:
+            return "null"
+        body = request.stream.read(MCP_ERROR_BODY_LIMIT + 1)
+        if len(body) > MCP_ERROR_BODY_LIMIT or not _within_json_depth(body):
+            return "null"
+        payload = json.loads(
+            body.decode("utf-8"),
+            parse_int=_JSONNumber,
+            parse_float=_JSONNumber,
+            parse_constant=_invalid_constant,
+        )
+        if not isinstance(payload, dict):
+            return "null"
+        request_id = payload.get("id")
+        if isinstance(request_id, _JSONNumber):
+            return request_id.value
+        if isinstance(request_id, str):
+            # Reject unpaired surrogates instead of creating invalid UTF-8.
+            request_id.encode("utf-8")
+            return _json(request_id)
+    except (HTTPException, ValueError, UnicodeError, RecursionError):
+        pass
+    return "null"
+
+
+def mcp_server_not_found_response() -> Response:
+    """Opaque MCP lookup failure; no app/server identity or policy is disclosed."""
+    body = '{"error":{"code":-32600,"message":"Server Not Found"},"id":' + _mcp_request_id() + ',"jsonrpc":"2.0"}'
+    return Response(body, status=404, content_type="application/json", headers={"Cache-Control": "no-store"})
+
+
+def webhook_not_found_response() -> WerkzeugResponse:
+    """Use Werkzeug's normal HTML 404 without caller IDs or internal detail."""
+    response = NotFound().get_response()
+    response.headers["Cache-Control"] = "no-store"
+    return response
+
+
+def plugin_endpoint_not_found_response() -> Response:
+    """Plugin callbacks own a JSON not-found shape, unlike native Webhooks."""
+    return Response(
+        _json({"error": "Endpoint not found"}),
+        status=404,
+        content_type="application/json",
+        headers={"Cache-Control": "no-store"},
+    )
diff --git a/api/controllers/common/app_access_error.py b/api/controllers/common/app_access_error.py
index 3f0b590ce2a9f0..1c2b1b736288c1 100644
--- a/api/controllers/common/app_access_error.py
+++ b/api/controllers/common/app_access_error.py
@@ -1,10 +1,12 @@
-"""Attach request-local IP metadata to Web and Console app-not-found responses.
+"""Keep public App failures indistinguishable from Gateway policy denials.
 
 This transport hook runs after Flask-RESTX has formatted errors, including errors
-with their own ``data`` payload. It deliberately does not change error ownership,
-authentication, status codes, or unmatched-route handling.
+with their own ``data`` payload. Web App identity errors use a minimal canonical
+404; Console keeps its existing error ownership and only receives IP metadata.
+Unrelated resources and authentication failures retain their own contracts.
 """
 
+from collections.abc import Mapping
 from typing import Literal
 
 from flask import Blueprint, Response, current_app, request
@@ -27,39 +29,79 @@
     ),
 }
 
+_UNAVAILABLE_APP_CODES = frozenset({"app_unavailable", "agent_not_published"})
+
+
+def _canonical_json(response: Response, payload: Mapping[str, object]) -> Response:
+    """Match Gateway JSON bytes as well as its error status/header contract."""
+    response.headers["Cache-Control"] = "no-store"
+    response.headers["Content-Type"] = "application/json"
+    response.set_data(current_app.json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=False))
+    return response
+
 
 def register_app_access_error_metadata(blueprint: Blueprint, *, surface: Literal["web", "console"]) -> None:
-    """Enrich only typed app 404s and GET app-identity 404s on this blueprint.
+    """Normalize Web App identity failures, without masking dependency errors.
 
     Use matched route rules instead of caller-supplied paths or IDs. A missing
-    app does not have an App model, and unrelated resource/form 404s must retain
-    their existing response contracts. This hook is not registered on Service,
-    Inner, or other APIs.
+    app does not have an App model. HITL keeps its native form/token errors rather
+    than being reclassified as an App error. This hook is not registered on
+    Service, Inner, or other APIs.
     """
     prefix = (blueprint.url_prefix or "").rstrip("/")
     identity_rules = frozenset(prefix + route for route in _APP_IDENTITY_ROUTES[surface])
 
     @blueprint.after_request
     def add_app_access_error_metadata(response: Response) -> Response:
-        if (
-            response.status_code != 404
-            or response.is_streamed
-            or response.direct_passthrough
-            or not response.is_json
-            or request.url_rule is None
-            # HITL forms own their expiry/not-found UI, even if an underlying
-            # app lookup happened to produce the typed app error.
-            or request.url_rule.rule.startswith((prefix + "/form/human_input/", prefix + "/human-input-forms/"))
-        ):
+        if response.is_streamed or response.direct_passthrough or not response.is_json or request.url_rule is None:
             return response
 
         payload = response.get_json(silent=True)
         if not isinstance(payload, dict):
             return response
+        rule = request.url_rule.rule
+        # Preserve HITL's dedicated expiry/token UI and do not expose an App IP
+        # or policy-specific marker through these capability endpoints.
+        if rule.startswith((prefix + "/form/human_input/", prefix + "/human-input-forms/")):
+            if (
+                surface == "web"
+                and rule.startswith(prefix + "/form/human_input/")
+                and response.status_code == 404
+                and payload.get("code") == "not_found"
+            ):
+                return _canonical_json(response, {"code": "not_found", "message": "Form not found", "status": 404})
+            if (
+                surface == "web"
+                and rule == prefix + "/human-input-forms/files"
+                and response.status_code == 403
+                and payload.get("code") == "invalid_upload_token"
+            ):
+                return _canonical_json(
+                    response,
+                    {"code": "invalid_upload_token", "message": "Upload token is invalid or expired.", "status": 403},
+                )
+            return response
         is_app_identity = request.method == "GET" and request.url_rule.rule in identity_rules
+        if (
+            surface == "web"
+            and is_app_identity
+            and response.status_code == 400
+            and payload.get("code") in _UNAVAILABLE_APP_CODES
+        ):
+            # A known unavailable/unpublished App is the same public state as a
+            # missing one. Never apply this to arbitrary 400s or dependency503s.
+            response.status_code = 404
+        if response.status_code != 404:
+            return response
         if payload.get("code") != "app_not_found" and not is_app_identity:
             return response
 
+        if surface == "web":
+            # Do not preserve exception-specific data that would disclose why
+            # an App is unavailable (or whether it exists) to an unauthenticated
+            # visitor. Console's authenticated management errors are unchanged.
+            payload = {"code": "app_not_found", "message": "App not found.", "status": 404}
+
         # An app 404 can be cached by URL, but its client address cannot be.
         response.headers["Cache-Control"] = "no-store"
         # This hook owns the metadata: never preserve an unverified address
@@ -75,5 +117,7 @@ def add_app_access_error_metadata(response: Response) -> Response:
                 # Optional display metadata must not turn a genuine 404 into 503.
                 pass
 
+        if surface == "web":
+            return _canonical_json(response, payload)
         response.set_data(current_app.json.dumps(payload))
         return response
diff --git a/api/controllers/mcp/mcp.py b/api/controllers/mcp/mcp.py
index 95aa2be8218bf7..b17db3682ac00c 100644
--- a/api/controllers/mcp/mcp.py
+++ b/api/controllers/mcp/mcp.py
@@ -6,6 +6,7 @@
 from sqlalchemy import select
 from sqlalchemy.orm import Session, sessionmaker
 
+from controllers.common.access_response import mcp_server_not_found_response
 from controllers.common.schema import register_response_schema_models, register_schema_model
 from controllers.mcp import mcp_ns
 from core.mcp import types as mcp_types
@@ -26,6 +27,13 @@ def __init__(self, error_code: int, message: str):
         super().__init__(message)
 
 
+class MCPServerNotFoundError(MCPRequestError):
+    """An unavailable server, backing app, or inactive server is one opaque identity failure."""
+
+    def __init__(self):
+        super().__init__(mcp_types.INVALID_REQUEST, "Server Not Found")
+
+
 class MCPRequestPayload(BaseModel):
     jsonrpc: str = Field(description="JSON-RPC version (should be '2.0')")
     method: str = Field(description="The method to invoke")
@@ -43,7 +51,7 @@ class MCPJSONRPCResponse(RootModel[mcp_types.JSONRPCResponse | mcp_types.JSONRPC
 
 @mcp_ns.route("/server/<string:server_code>/mcp")
 class MCPAppApi(Resource):
-    @mcp_ns.expect(mcp_ns.models[MCPRequestPayload.__name__])
+    @mcp_ns.expect(mcp_ns.models[MCPRequestPayload.__name__], validate=False)
     @mcp_ns.doc("handle_mcp_request")
     @mcp_ns.doc(description="Handle Model Context Protocol (MCP) requests for a specific server")
     @mcp_ns.doc(params={"server_code": "Unique identifier for the MCP server"})
@@ -67,25 +75,28 @@ def post(self, server_code: str):
             ValidationError: Invalid request format or parameters
         """
         # response-contract:ignore MCP route returns Flask Response from JSON-RPC handler
-        args = MCPRequestPayload.model_validate(mcp_ns.payload or {})
-        request_id: Union[int, str] | None = args.id
-        mcp_request = self._parse_mcp_request(args.model_dump(exclude_none=True))
-
-        # Resolve the negotiated protocol version from the MCP-Protocol-Version header.
-        is_initialize = isinstance(mcp_request.root, mcp_types.InitializeRequest)
-        header_value = request.headers.get("MCP-Protocol-Version")
-        protocol_version = negotiate_protocol_version(header_value, is_initialize)
-        if protocol_version is None:
-            # A notification never receives a response, even with an unsupported header.
-            if isinstance(mcp_request, mcp_types.ClientNotification):
-                protocol_version = mcp_types.DEFAULT_NEGOTIATED_VERSION
-            else:
-                return self._protocol_version_error_response(request_id, header_value)
-
         with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
-            # Get MCP server and app
-            mcp_server, app = self._get_mcp_server_and_app(server_code, session)
-            self._validate_server_status(mcp_server)
+            # Resolve identity before parsing the body: missing identities have
+            # one bounded response even for malformed or oversized JSON.
+            try:
+                mcp_server, app = self._get_mcp_server_and_app(server_code, session)
+                self._validate_server_status(mcp_server)
+            except MCPServerNotFoundError:
+                return mcp_server_not_found_response()
+
+            args = MCPRequestPayload.model_validate(mcp_ns.payload or {})
+            request_id: Union[int, str] | None = args.id
+            mcp_request = self._parse_mcp_request(args.model_dump(exclude_none=True))
+
+            # Allowed identities retain the existing protocol validation path.
+            is_initialize = isinstance(mcp_request.root, mcp_types.InitializeRequest)
+            header_value = request.headers.get("MCP-Protocol-Version")
+            protocol_version = negotiate_protocol_version(header_value, is_initialize)
+            if protocol_version is None:
+                if isinstance(mcp_request, mcp_types.ClientNotification):
+                    protocol_version = mcp_types.DEFAULT_NEGOTIATED_VERSION
+                else:
+                    return self._protocol_version_error_response(request_id, header_value)
 
             # Get user input form
             user_input_form = self._get_user_input_form(app)
@@ -118,18 +129,18 @@ def _get_mcp_server_and_app(self, server_code: str, session: Session) -> tuple[A
         """Get and validate MCP server and app in one query session"""
         mcp_server = session.scalar(select(AppMCPServer).where(AppMCPServer.server_code == server_code).limit(1))
         if not mcp_server:
-            raise MCPRequestError(mcp_types.INVALID_REQUEST, "Server Not Found")
+            raise MCPServerNotFoundError()
 
         app = session.scalar(select(App).where(App.id == mcp_server.app_id).limit(1))
         if not app:
-            raise MCPRequestError(mcp_types.INVALID_REQUEST, "App Not Found")
+            raise MCPServerNotFoundError()
 
         return mcp_server, app
 
     def _validate_server_status(self, mcp_server: AppMCPServer):
         """Validate MCP server status"""
         if mcp_server.status != AppMCPServerStatus.ACTIVE:
-            raise MCPRequestError(mcp_types.INVALID_REQUEST, "Server is not active")
+            raise MCPServerNotFoundError()
 
     def _process_mcp_message(
         self,
diff --git a/api/controllers/openapi/__init__.py b/api/controllers/openapi/__init__.py
index 681f93e49ba343..d4e4cef28025c8 100644
--- a/api/controllers/openapi/__init__.py
+++ b/api/controllers/openapi/__init__.py
@@ -1,6 +1,7 @@
 from flask import Blueprint
 from flask_restx import Namespace
 
+from controllers.common.access_response import register_auth_error_response
 from controllers.openapi._errors import ErrorBody, OpenApiErrorCode, OpenApiErrorFormatter
 from controllers.openapi._version_gate import attach_version_gate
 from libs.device_flow_security import attach_anti_framing
@@ -9,6 +10,7 @@
 bp = Blueprint("openapi", __name__, url_prefix="/openapi/v1")
 attach_anti_framing(bp)
 attach_version_gate(bp)
+register_auth_error_response(bp)
 
 api = ExternalApi(
     bp,
diff --git a/api/controllers/service_api/__init__.py b/api/controllers/service_api/__init__.py
index 5b44247685bfa9..2d9c043361178b 100644
--- a/api/controllers/service_api/__init__.py
+++ b/api/controllers/service_api/__init__.py
@@ -1,9 +1,11 @@
 from flask import Blueprint
 from flask_restx import Namespace
 
+from controllers.common.access_response import register_auth_error_response
 from libs.external_api import ExternalApi
 
 bp = Blueprint("service_api", __name__, url_prefix="/v1")
+register_auth_error_response(bp, www_authenticate='Bearer realm="api"')
 
 api = ExternalApi(
     bp,
diff --git a/api/controllers/service_api/wraps.py b/api/controllers/service_api/wraps.py
index 77201f96f0c60d..298ec2872b0eee 100644
--- a/api/controllers/service_api/wraps.py
+++ b/api/controllers/service_api/wraps.py
@@ -16,6 +16,7 @@
 from werkzeug.exceptions import Forbidden, NotFound, ServiceUnavailable, Unauthorized
 
 from configs import dify_config
+from controllers.common.access_response import MISSING_BEARER_MESSAGE
 from controllers.service_api.schema import (
     USER_FETCH_FROM_ATTR,
     USER_FORM_PARAM,
@@ -390,15 +391,14 @@ def validate_and_get_api_token(scope: str | None = None):
     The last_used_at field is updated asynchronously via Celery task
     to avoid blocking the request.
     """
-    auth_header = request.headers.get("Authorization")
-    if auth_header is None or " " not in auth_header:
-        raise Unauthorized("Authorization header must be provided and start with 'Bearer'")
-
-    auth_scheme, auth_token = auth_header.split(None, 1)
-    auth_scheme = auth_scheme.lower()
-
-    if auth_scheme != "bearer":
-        raise Unauthorized("Authorization scheme must be 'Bearer'")
+    # HTTP whitespace is SP/HTAB, not Python's wider Unicode whitespace set.
+    # Match the Gateway parser so a raw Latin-1 NBSP/control separator cannot
+    # skip policy identity resolution and then authenticate successfully here.
+    auth_header = request.headers.get("Authorization") or ""
+    auth_parts = [part for part in auth_header.replace("\t", " ").split(" ") if part]
+    if len(auth_parts) != 2 or auth_parts[0].lower() != "bearer":
+        raise Unauthorized(MISSING_BEARER_MESSAGE)
+    auth_token = auth_parts[1]
 
     # Try to get token from cache first
     # Returns a CachedApiToken (plain Python object), not a SQLAlchemy model
diff --git a/api/controllers/trigger/trigger.py b/api/controllers/trigger/trigger.py
index 203bfdf895d5de..26197d8411276e 100644
--- a/api/controllers/trigger/trigger.py
+++ b/api/controllers/trigger/trigger.py
@@ -2,8 +2,8 @@
 import re
 
 from flask import jsonify, request
-from werkzeug.exceptions import NotFound
 
+from controllers.common.access_response import plugin_endpoint_not_found_response
 from controllers.trigger import bp
 from services.trigger.trigger_service import TriggerService
 from services.trigger.trigger_subscription_builder_service import TriggerSubscriptionBuilderService
@@ -21,7 +21,7 @@ def trigger_endpoint(endpoint_id: str):
     """
     # endpoint_id must be UUID
     if not UUID_MATCHER.match(endpoint_id):
-        raise NotFound("Invalid endpoint ID")
+        return plugin_endpoint_not_found_response()
     handling_chain = [
         TriggerService.process_endpoint,
         TriggerSubscriptionBuilderService.process_builder_validation_endpoint,
@@ -34,7 +34,7 @@ def trigger_endpoint(endpoint_id: str):
                 break
         if not response:
             logger.info("Endpoint not found for %s", endpoint_id)
-            return jsonify({"error": "Endpoint not found"}), 404
+            return plugin_endpoint_not_found_response()
         return response
     except ValueError as e:
         return jsonify({"error": "Endpoint processing failed", "message": str(e)}), 400
diff --git a/api/controllers/trigger/webhook.py b/api/controllers/trigger/webhook.py
index 7715090b967c41..d7d1dfd0aa83af 100644
--- a/api/controllers/trigger/webhook.py
+++ b/api/controllers/trigger/webhook.py
@@ -2,8 +2,9 @@
 import time
 
 from flask import jsonify, request
-from werkzeug.exceptions import NotFound, RequestEntityTooLarge
+from werkzeug.exceptions import RequestEntityTooLarge
 
+from controllers.common.access_response import webhook_not_found_response
 from controllers.trigger import bp
 from core.trigger.debug.event_bus import TriggerDebugEventBus
 from core.trigger.debug.events import WebhookDebugEvent, build_webhook_pool_key
@@ -83,8 +84,8 @@ def handle_webhook(webhook_id: str):
                 "message": _get_quota_exceeded_message(error.feature),
             }
         ), 429
-    except ValueError as error:
-        raise NotFound(str(error))
+    except ValueError:
+        return webhook_not_found_response()
     except RequestEntityTooLarge:
         raise
     except Exception as e:
@@ -154,8 +155,8 @@ def handle_webhook_debug(webhook_id: str):
         response_data, status_code = WebhookService.generate_webhook_response(node_config)
         return jsonify(response_data), status_code
 
-    except ValueError as e:
-        raise NotFound(str(e))
+    except ValueError:
+        return webhook_not_found_response()
     except RequestEntityTooLarge:
         raise
     except Exception as e:
diff --git a/api/controllers/web/human_input_file_upload.py b/api/controllers/web/human_input_file_upload.py
index 6b00b60c484cb1..c0b015abf9edbb 100644
--- a/api/controllers/web/human_input_file_upload.py
+++ b/api/controllers/web/human_input_file_upload.py
@@ -88,7 +88,9 @@ def _extract_hitl_upload_token() -> str:
     if authorization is None:
         raise InvalidUploadTokenUnauthorizedError()
 
-    parts = authorization.split()
+    # Keep capability identity parsing identical to the Gateway's HTTP OWS
+    # boundary; Unicode/control separators must not bypass IP enforcement.
+    parts = [part for part in authorization.replace("\t", " ").split(" ") if part]
     if len(parts) != 2:
         raise InvalidUploadTokenUnauthorizedError()
 
diff --git a/api/controllers/web/login.py b/api/controllers/web/login.py
index b95178327de857..89bbfb00cf5022 100644
--- a/api/controllers/web/login.py
+++ b/api/controllers/web/login.py
@@ -30,8 +30,10 @@
     setup_required,
 )
 from controllers.web import web_ns
+from controllers.web.error import WebAppAccessServiceUnavailableError, WebAppNotFoundError
 from controllers.web.wraps import decode_jwt_token
 from enums import DeploymentEdition
+from extensions.ext_application_services import application_services
 from extensions.ext_database import db
 from libs.helper import EmailStr, extract_remote_ip
 from libs.passport import PassportService
@@ -41,9 +43,9 @@
     extract_webapp_access_token,
 )
 from services.account_service import AccountService
-from services.app_service import AppService
 from services.entities.auth_audit_entities import LoginFailureReason
 from services.entities.auth_entities import LoginPayloadBase
+from services.webapp_access_query_service import WebAppAccessAppNotFoundError, WebAppAccessUnavailableError
 from services.webapp_auth_service import WebAppAuthService
 
 logger = logging.getLogger(__name__)
@@ -138,6 +140,8 @@ class LoginStatusApi(Resource):
         responses={
             200: "Login status",
             401: "Login status",
+            404: "App not found",
+            503: "Web app access service unavailable",
         }
     )
     @web_ns.response(200, "Login status", web_ns.models[LoginStatusResponse.__name__])
@@ -148,7 +152,12 @@ def get(self, query: LoginStatusQuery):
         token = extract_webapp_access_token(request)
         if not app_code:
             return LoginStatusResponse(logged_in=bool(token), app_logged_in=False).model_dump(mode="json")
-        app_id = AppService.get_app_id_by_code(app_code, session=db.session())
+        try:
+            app_id = application_services().webapp_access.resolve_app_id(app_code=app_code)
+        except WebAppAccessAppNotFoundError:
+            raise WebAppNotFoundError() from None
+        except WebAppAccessUnavailableError:
+            raise WebAppAccessServiceUnavailableError() from None
         is_public = (
             dify_config.DEPLOYMENT_EDITION != DeploymentEdition.ENTERPRISE
             or not WebAppAuthService.is_app_require_permission_check(app_id=app_id, session=db.session())
diff --git a/api/controllers/web/site.py b/api/controllers/web/site.py
index 7b2afe16bccefe..dce26a3f985495 100644
--- a/api/controllers/web/site.py
+++ b/api/controllers/web/site.py
@@ -1,11 +1,11 @@
 from typing import Any, Self
 
 from pydantic import AliasChoices, Field
-from werkzeug.exceptions import Forbidden
 
 from configs import dify_config
 from controllers.common.schema import register_response_schema_models
 from controllers.web import web_ns
+from controllers.web.error import WebAppNotFoundError
 from controllers.web.wraps import WebApiResource
 from enums import DeploymentEdition
 from extensions.ext_application_services import application_services
@@ -145,7 +145,7 @@ def get(self, app_model: App, end_user: EndUser):
         try:
             bootstrap = application_services().web_app_runtime.get_bootstrap(app_model.id)
         except WebAppRuntimeUnavailableError:
-            raise Forbidden() from None
+            raise WebAppNotFoundError() from None
 
         return dump_response(
             WebAppSiteResponse,
diff --git a/api/controllers/web/wraps.py b/api/controllers/web/wraps.py
index d6aac7e97c67c3..9af99821d4a814 100644
--- a/api/controllers/web/wraps.py
+++ b/api/controllers/web/wraps.py
@@ -6,10 +6,10 @@
 from flask import request
 from flask_restx import Resource
 from sqlalchemy import select
-from werkzeug.exceptions import BadRequest, NotFound, Unauthorized
+from werkzeug.exceptions import NotFound, Unauthorized
 
 from constants import HEADER_NAME_APP_CODE
-from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError
+from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError, WebAppNotFoundError
 from core.db.session_factory import session_factory
 from core.logging.context import set_identity_context
 from extensions.ext_database import db
@@ -59,11 +59,11 @@ def decode_jwt_token(app_code: str | None = None, user_id: str | None = None) ->
             app_model = session.scalar(select(App).where(App.id == app_id))
             site = session.scalar(select(Site).where(Site.code == app_code))
             if not app_model:
-                raise NotFound()
+                raise WebAppNotFoundError()
             if not app_code or not site:
-                raise BadRequest("Site URL is no longer valid.")
+                raise WebAppNotFoundError()
             if app_model.enable_site is False:
-                raise BadRequest("Site is disabled.")
+                raise WebAppNotFoundError()
             end_user_id = decoded.get("end_user_id")
             end_user = session.scalar(select(EndUser).where(EndUser.id == end_user_id))
             if not end_user:
diff --git a/api/openapi/markdown/web-openapi.md b/api/openapi/markdown/web-openapi.md
index 1f6d7a8e723090..b43a8480bbac51 100644
--- a/api/openapi/markdown/web-openapi.md
+++ b/api/openapi/markdown/web-openapi.md
@@ -469,6 +469,8 @@ Check login status
 | ---- | ----------- | ------ |
 | 200 | Login status | **application/json**: [LoginStatusResponse](#loginstatusresponse)<br> |
 | 401 | Login status |  |
+| 404 | App not found |  |
+| 503 | Web app access service unavailable |  |
 
 ### [POST] /logout
 Logout user from web application
diff --git a/api/repositories/webapp_access_query_repository.py b/api/repositories/webapp_access_query_repository.py
index cb29ce2603e803..37347b398a444d 100644
--- a/api/repositories/webapp_access_query_repository.py
+++ b/api/repositories/webapp_access_query_repository.py
@@ -1,12 +1,14 @@
 """Database repository for web-app access queries."""
 
 from typing import override
+from uuid import UUID
 
 from sqlalchemy import select
 from sqlalchemy.exc import DBAPIError, TimeoutError
 from sqlalchemy.orm import Session, sessionmaker
 
-from models.model import Site
+from models.enums import AppStatus
+from models.model import App, Site
 from services.webapp_access_query_service import WebAppAccessQuery, WebAppAccessUnavailableError
 
 
@@ -18,7 +20,42 @@ def __init__(self, *, session_factory: sessionmaker[Session]) -> None:
     def find_app_id_by_code(self, app_code: str) -> str | None:
         try:
             with self._session_factory() as session:
-                app_id = session.scalar(select(Site.app_id).where(Site.code == app_code).limit(1))
+                app_id = session.scalar(
+                    select(App.id)
+                    .join(Site, Site.app_id == App.id)
+                    .where(
+                        Site.code == app_code,
+                        Site.status == AppStatus.NORMAL,
+                        App.status == AppStatus.NORMAL,
+                        App.enable_site.is_(True),
+                    )
+                    .limit(1)
+                )
                 return app_id if app_id is not None else None
         except (DBAPIError, TimeoutError) as e:
             raise WebAppAccessUnavailableError from e
+
+    @override
+    def is_app_available(self, app_id: str) -> bool:
+        try:
+            canonical_id = str(UUID(app_id))
+        except ValueError:
+            return False
+        try:
+            with self._session_factory() as session:
+                return (
+                    session.scalar(
+                        select(App.id)
+                        .join(Site, Site.app_id == App.id)
+                        .where(
+                            App.id == canonical_id,
+                            Site.status == AppStatus.NORMAL,
+                            App.status == AppStatus.NORMAL,
+                            App.enable_site.is_(True),
+                        )
+                        .limit(1)
+                    )
+                    is not None
+                )
+        except (DBAPIError, TimeoutError) as e:
+            raise WebAppAccessUnavailableError from e
diff --git a/api/services/webapp_access_query_service.py b/api/services/webapp_access_query_service.py
index 1228d0affbddba..8291bcd7fb5fdf 100644
--- a/api/services/webapp_access_query_service.py
+++ b/api/services/webapp_access_query_service.py
@@ -11,6 +11,8 @@
 class WebAppAccessQuery(Protocol):
     def find_app_id_by_code(self, app_code: str) -> str | None: ...
 
+    def is_app_available(self, app_id: str) -> bool: ...
+
 
 class WebAppAccessReferenceRequiredError(ValueError):
     """Raised when neither an app ID nor an app code was provided."""
@@ -38,18 +40,26 @@ def __init__(
         self._access_mode_for_app = access_mode_for_app
         self._is_user_allowed_for_app = is_user_allowed_for_app
 
-    def get_access_mode(self, *, app_id: str | None, app_code: str | None) -> WebAppAccessMode:
-        if not self._webapp_auth_enabled:
-            return WebAppAccessMode.PUBLIC
-
+    def resolve_app_id(self, *, app_id: str | None = None, app_code: str | None = None) -> str:
+        """Resolve a live public App identity without loading authentication settings."""
         if app_code:
             app_id = self._access.find_app_id_by_code(app_code)
             if app_id is None:
                 raise WebAppAccessAppNotFoundError
-
+        elif app_id and not self._access.is_app_available(app_id):
+            raise WebAppAccessAppNotFoundError
         if not app_id:
             raise WebAppAccessReferenceRequiredError("appId or appCode must be provided")
+        return app_id
 
+    def get_access_mode(self, *, app_id: str | None, app_code: str | None) -> WebAppAccessMode:
+        # Preserve the auth-disabled, reference-free bootstrap shortcut. Supplied
+        # references must still resolve to a live App regardless of auth settings.
+        if not self._webapp_auth_enabled and not app_id and not app_code:
+            return WebAppAccessMode.PUBLIC
+        app_id = self.resolve_app_id(app_id=app_id, app_code=app_code)
+        if not self._webapp_auth_enabled:
+            return WebAppAccessMode.PUBLIC
         return self._access_mode_for_app(app_id)
 
     def requires_permission_check(self, app_id: str) -> bool:
diff --git a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
index 5bda3738af5fc4..c0cdf0e1b5e31c 100644
--- a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
+++ b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
@@ -10,9 +10,9 @@
 import pytest
 from flask import Flask
 from sqlalchemy.orm import Session
-from werkzeug.exceptions import BadRequest, NotFound, Unauthorized
+from werkzeug.exceptions import NotFound, Unauthorized
 
-from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError
+from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError, WebAppNotFoundError
 from controllers.web.wraps import (
     _validate_user_accessibility,
     _validate_webapp_token,
@@ -323,13 +323,13 @@ def test_missing_app_raises_not_found(
         mock_features.return_value = False
 
         with app.test_request_context("/", headers={"X-App-Code": "code1"}):
-            with pytest.raises(NotFound):
+            with pytest.raises(WebAppNotFoundError):
                 decode_jwt_token()
 
     @patch("controllers.web.wraps.SystemFeatureService.is_webapp_auth_enabled")
     @patch("controllers.web.wraps.PassportService")
     @patch("controllers.web.wraps.extract_webapp_passport")
-    def test_disabled_site_raises_bad_request(
+    def test_disabled_site_raises_app_not_found(
         self,
         mock_extract: MagicMock,
         mock_passport_cls: MagicMock,
@@ -348,7 +348,7 @@ def test_disabled_site_raises_bad_request(
         mock_features.return_value = False
 
         with app.test_request_context("/", headers={"X-App-Code": site.code}):
-            with pytest.raises(BadRequest, match="Site is disabled"):
+            with pytest.raises(WebAppNotFoundError):
                 decode_jwt_token()
 
     @patch("controllers.web.wraps.SystemFeatureService.is_webapp_auth_enabled")
diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
new file mode 100644
index 00000000000000..0df7bf8f7ce2ca
--- /dev/null
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -0,0 +1,357 @@
+"""Final Flask response contracts; all database/token/execution boundaries are isolated."""
+
+import io
+import json
+from types import SimpleNamespace
+from typing import Literal, Never, override
+from unittest.mock import MagicMock
+
+import pytest
+from flask import Blueprint, Flask, Response, jsonify, request
+from flask.testing import FlaskClient
+from flask_restx import Namespace, Resource
+from werkzeug.exceptions import NotFound, Unauthorized
+
+import controllers.service_api.wraps as token_wraps
+import controllers.trigger.trigger as plugin_trigger
+import services.api_token_service as token_service
+from controllers.common.access_response import (
+    MCP_ERROR_BODY_LIMIT,
+    MISSING_BEARER_MESSAGE,
+    mcp_server_not_found_response,
+    register_auth_error_response,
+)
+from controllers.mcp import mcp
+from controllers.trigger import webhook
+from libs.external_api import ExternalApi
+from models.engine import db
+from models.enums import AppMCPServerStatus
+
+type TokenClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
+type MCPClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
+
+
+@pytest.fixture
+def http_app() -> Flask:
+    app = Flask(__name__)
+    app.config.update(TESTING=True, RESTX_ERROR_404_HELP=False, SQLALCHEMY_DATABASE_URI="sqlite:///:memory:")
+    db.init_app(app)
+    return app
+
+
+@pytest.fixture
+def token_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> TokenClient:
+    bp = Blueprint("service_test", __name__, url_prefix="/v1")
+    register_auth_error_response(bp, www_authenticate='Bearer realm="api"')
+    api = ExternalApi(bp)
+
+    class TokenResource(Resource):
+        def get(self) -> dict[str, bool]:
+            token_wraps.validate_and_get_api_token("app")
+            return {"ok": True}
+
+    api.add_resource(TokenResource, "/info")
+    http_app.register_blueprint(bp)
+    other = Blueprint("other_test", __name__, url_prefix="/other")
+    other_api = ExternalApi(other)
+
+    class OtherResource(Resource):
+        def get(self) -> Never:
+            raise Unauthorized("Other API authentication")
+
+    other_api.add_resource(OtherResource, "/info")
+    http_app.register_blueprint(other)
+    cache_get = MagicMock(return_value=None)
+    fetch = MagicMock(side_effect=Unauthorized("Access token is invalid"))
+    usage = MagicMock()
+    monkeypatch.setattr(token_wraps.ApiTokenCache, "get", cache_get)
+    monkeypatch.setattr(token_wraps, "fetch_token_with_single_flight", fetch)
+    monkeypatch.setattr(token_wraps, "record_token_usage", usage)
+    return http_app.test_client(), cache_get, fetch, usage
+
+
+@pytest.mark.parametrize(
+    "header",
+    [
+        None,
+        "",
+        "Bearer",
+        "Bearer ",
+        "Bearer\t",
+        " ",
+        "Basic abc",
+        "Bearer a b",
+        "Bearer\xa0valid-token",
+        "Bearer\x1cvalid-token",
+        "Bearer\vvalid-token",
+        "Bearer\u2003valid-token",
+    ],
+)
+def test_bad_bearer_final_response_never_looks_up_or_records_token(
+    token_client: TokenClient, header: str | None
+) -> None:
+    client, cache_get, fetch, usage = token_client
+    response = client.get("/v1/info", headers={} if header is None else {"Authorization": header})
+    assert response.status_code == 401
+    expected = {"code": "unauthorized", "message": MISSING_BEARER_MESSAGE, "status": 401}
+    assert response.data == json.dumps(expected, separators=(",", ":"), sort_keys=True).encode()
+    assert response.headers["Content-Type"] == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+    assert response.headers["WWW-Authenticate"] == 'Bearer realm="api"'
+    cache_get.assert_not_called()
+    fetch.assert_not_called()
+    usage.assert_not_called()
+
+
+def test_invalid_token_final_response_and_no_usage(token_client: TokenClient) -> None:
+    client, _cache_get, fetch, usage = token_client
+    response = client.get("/v1/info", headers={"Authorization": "Bearer missing-token"})
+    assert response.status_code == 401
+    assert response.data == b'{"code":"unauthorized","message":"Access token is invalid","status":401}'
+    assert response.headers["Content-Type"] == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+    assert response.headers["WWW-Authenticate"] == 'Bearer realm="api"'
+    fetch.assert_called_once_with("missing-token", "app")
+    usage.assert_not_called()
+
+
+def test_invalid_token_database_path_does_not_record_usage(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
+    session = MagicMock()
+    session.scalar.return_value = None
+    maker = MagicMock()
+    maker.return_value.__enter__.return_value = session
+    usage = MagicMock()
+    monkeypatch.setattr(token_service, "Session", maker)
+    monkeypatch.setattr(token_service.ApiTokenCache, "set", MagicMock())
+    monkeypatch.setattr(token_service, "record_token_usage", usage)
+    with http_app.app_context(), pytest.raises(Unauthorized, match="Access token is invalid"):
+        token_service.query_token_from_db("missing-token", "app")
+    usage.assert_not_called()
+    session.add.assert_not_called()
+
+
+def test_success_token_and_other_surface_are_not_rewritten(token_client: TokenClient) -> None:
+    client, cache_get, _fetch, usage = token_client
+    cache_get.return_value = SimpleNamespace(id="existing")
+    response = client.get("/v1/info", headers={"Authorization": "bEaReR\tvalid-token"})
+    assert response.status_code == 200
+    assert response.get_json() == {"ok": True}
+    assert "Cache-Control" not in response.headers
+    usage.assert_called_once_with("valid-token", "app")
+    other = client.get("/other/info")
+    assert other.status_code == 401
+    assert other.get_json()["message"] == "Other API authentication"
+    assert "Cache-Control" not in other.headers
+
+
+@pytest.fixture
+def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
+    bp = Blueprint("mcp_test", __name__, url_prefix="/mcp")
+    api = ExternalApi(bp)
+    namespace = Namespace("mcp_test", path="/")
+    namespace.add_resource(mcp.MCPAppApi, "/server/<string:server_code>/mcp")
+    api.add_namespace(namespace)
+    http_app.register_blueprint(bp)
+    monkeypatch.setattr(mcp, "mcp_ns", namespace)
+    session = MagicMock()
+    maker = MagicMock()
+    maker.return_value.begin.return_value.__enter__.return_value = session
+    monkeypatch.setattr(mcp, "sessionmaker", maker)
+    execute = MagicMock()
+    end_user = MagicMock()
+    monkeypatch.setattr(mcp, "handle_mcp_request", execute)
+    monkeypatch.setattr(mcp.MCPAppApi, "_retrieve_end_user", end_user)
+    return http_app.test_client(), session, execute, end_user
+
+
+@pytest.mark.parametrize("identity", ["missing-server", "missing-app", "inactive"])
+@pytest.mark.parametrize(
+    ("body", "expected_id"),
+    [
+        (b'{"id":17}', b"17"),
+        (b'{"id":-0}', b"-0"),
+        (b'{"id":1.2500}', b"1.2500"),
+        (b'{"id":1e+90}', b"1e+90"),
+        (b'{"id":900719925474099312345678901234567890}', b"900719925474099312345678901234567890"),
+        (b'{"id":"request-1"}', b'"request-1"'),
+        ('{"id":"<>&雪\u2028\u2029"}'.encode(), '"<>&雪\\u2028\\u2029"'.encode()),
+        (b'{"id":true}', b"null"),
+        (b'{"id":[]}', b"null"),
+        (b'{"id":{}}', b"null"),
+        (b'{"id":null}', b"null"),
+        (b"{}", b"null"),
+        (b'[{"id":1}]', b"null"),
+        (b'{"id":NaN}', b"null"),
+        (b'{"id":Infinity}', b"null"),
+        (b'{"id":', b"null"),
+        (b'{"id":1}{}', b"null"),
+        (b'\xef\xbb\xbf{"id":1}', b"null"),
+        ('{"id":1}'.encode("utf-16"), b"null"),
+        (b'{"id":"\xff"}', b"null"),
+        (b'{"id":"\\ud800"}', b"null"),
+        (b'{"id":"\\udfff"}', b"null"),
+        (b'{"id":"\\ud83d\\ude00"}', '"😀"'.encode()),
+        (b'{"id":"\\\\ud800"}', b'"\\\\ud800"'),
+        (b'{"id":1,"params":' + b"[" * 63 + b"0" + b"]" * 63 + b"}", b"1"),
+        (b'{"id":1,"params":' + b"[" * 64 + b"0" + b"]" * 64 + b"}", b"null"),
+        (b'{"id":1,"params":"' + b"[" * 100 + b'\\"}"}', b"1"),
+        (b'{"id":1}' + b" " * MCP_ERROR_BODY_LIMIT, b"null"),
+    ],
+)
+def test_mcp_missing_identity_final_response_is_bounded_and_opaque(
+    mcp_client: MCPClient,
+    identity: Literal["missing-server", "missing-app", "inactive"],
+    body: bytes,
+    expected_id: bytes,
+) -> None:
+    client, session, execute, end_user = mcp_client
+    server = SimpleNamespace(app_id="private-app", status=AppMCPServerStatus.ACTIVE)
+    if identity == "missing-server":
+        session.scalar.side_effect = [None]
+    elif identity == "missing-app":
+        session.scalar.side_effect = [server, None]
+    else:
+        server.status = "inactive"
+        session.scalar.side_effect = [server, SimpleNamespace(id="private-app")]
+    response = client.post("/mcp/server/missing-fixture/mcp", data=body, content_type="application/json")
+    assert response.status_code == 404
+    assert (
+        response.data
+        == b'{"error":{"code":-32600,"message":"Server Not Found"},"id":' + expected_id + b',"jsonrpc":"2.0"}'
+    )
+    assert response.headers["Content-Type"] == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+    execute.assert_not_called()
+    end_user.assert_not_called()
+    session.add.assert_not_called()
+    session.execute.assert_not_called()
+
+
+def test_mcp_unknown_length_stream_read_is_capped(http_app: Flask) -> None:
+    class RecordingStream(io.BytesIO):
+        requested: list[int | None] = []
+
+        @override
+        def read(self, size: int | None = -1) -> bytes:
+            self.requested.append(size)
+            return super().read(size)
+
+    stream = RecordingStream(b'{"id":1}' + b" " * MCP_ERROR_BODY_LIMIT)
+    with http_app.test_request_context(
+        "/", method="POST", environ_overrides={"wsgi.input": stream, "wsgi.input_terminated": True}
+    ):
+        response = mcp_server_not_found_response()
+    assert stream.requested == [MCP_ERROR_BODY_LIMIT + 1]
+    assert response.get_json()["id"] is None
+
+
+def test_existing_mcp_keeps_normal_large_payload_and_response(
+    mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, session, _execute, _end_user = mcp_client
+    session.scalar.side_effect = [
+        SimpleNamespace(app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
+        SimpleNamespace(id="existing-app"),
+    ]
+    monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", MagicMock(return_value=[]))
+    expected_body = b'{"id":2,"jsonrpc":"2.0","result":{}}'
+    process = MagicMock(return_value=Response(expected_body, status=200, content_type="application/json"))
+    monkeypatch.setattr(mcp.MCPAppApi, "_process_mcp_message", process)
+    payload = {
+        "jsonrpc": "2.0",
+        "method": "initialize",
+        "id": 2,
+        "params": {
+            "protocolVersion": "2024-11-05",
+            "capabilities": {"experimental": {"fixture": {"padding": "x" * (MCP_ERROR_BODY_LIMIT + 1)}}},
+            "clientInfo": {"name": "fixture", "version": "1"},
+        },
+    }
+    response = client.post("/mcp/server/existing-fixture/mcp", json=payload)
+    assert response.status_code == 200
+    assert response.data == expected_body
+    assert "Cache-Control" not in response.headers
+    process.assert_called_once()
+
+
+def test_existing_mcp_still_validates_malformed_payload(mcp_client: MCPClient) -> None:
+    client, session, execute, end_user = mcp_client
+    session.scalar.side_effect = [
+        SimpleNamespace(app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
+        SimpleNamespace(id="existing-app"),
+    ]
+    response = client.post("/mcp/server/existing-fixture/mcp", data=b"{", content_type="application/json")
+    assert response.status_code == 400
+    execute.assert_not_called()
+    end_user.assert_not_called()
+
+
+@pytest.mark.parametrize("route", ["webhook", "webhook-debug"])
+def test_webhook_missing_identity_uses_native_html_without_disclosing_id(
+    http_app: Flask, monkeypatch: pytest.MonkeyPatch, route: Literal["webhook", "webhook-debug"]
+) -> None:
+    monkeypatch.setattr(webhook, "request", request)
+    monkeypatch.setattr(webhook, "jsonify", jsonify)
+    lookup = MagicMock(side_effect=ValueError("Webhook not found: private-fixture"))
+    execute = MagicMock()
+    monkeypatch.setattr(webhook.WebhookService, "get_webhook_trigger_and_workflow", lookup)
+    monkeypatch.setattr(webhook.WebhookService, "trigger_workflow_execution", execute)
+    handler = webhook.handle_webhook if route == "webhook" else webhook.handle_webhook_debug
+    http_app.add_url_rule(f"/triggers/{route}/<string:webhook_id>", view_func=handler, methods=["POST"])
+    response = http_app.test_client().post(f"/triggers/{route}/private-fixture", json={})
+    assert response.status_code == 404
+    assert response.data == NotFound().get_body().encode()
+    assert response.headers["Content-Type"] == "text/html; charset=utf-8"
+    assert response.headers["Cache-Control"] == "no-store"
+    assert b"private-fixture" not in response.data
+    execute.assert_not_called()
+
+
+@pytest.mark.parametrize("endpoint", ["123e4567-e89b-42d3-a456-426614174000", "invalid-id"])
+def test_plugin_callback_retains_its_json_error_contract(
+    http_app: Flask, monkeypatch: pytest.MonkeyPatch, endpoint: str
+) -> None:
+    monkeypatch.setattr(plugin_trigger, "request", request)
+    monkeypatch.setattr(plugin_trigger, "jsonify", jsonify)
+    monkeypatch.setattr(plugin_trigger.TriggerService, "process_endpoint", MagicMock(return_value=None))
+    monkeypatch.setattr(
+        plugin_trigger.TriggerSubscriptionBuilderService,
+        "process_builder_validation_endpoint",
+        MagicMock(return_value=None),
+    )
+    http_app.add_url_rule(
+        "/triggers/plugin/<string:endpoint_id>", view_func=plugin_trigger.trigger_endpoint, methods=["POST"]
+    )
+    response = http_app.test_client().post(f"/triggers/plugin/{endpoint}", json={})
+    assert response.status_code == 404
+    assert response.data == b'{"error":"Endpoint not found"}'
+    assert response.mimetype == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+
+
+@pytest.mark.parametrize("status", [401, 403, 429])
+def test_openapi_local_hook_preserves_native_details_and_oauth_challenge(http_app: Flask, status: int) -> None:
+    payload = {
+        "code": "unauthorized",
+        "message": "invalid_token",
+        "status": status,
+        "hint": "native hint",
+        "details": [{"type": "native", "loc": ["header"], "msg": "detail"}],
+    }
+    bp = Blueprint("openapi_test", __name__, url_prefix="/openapi/v1")
+    register_auth_error_response(bp)
+
+    @bp.route("/fixture")
+    def fixture() -> tuple[Response, int, dict[str, str]]:
+        return jsonify(payload), status, {"WWW-Authenticate": 'Bearer realm="native-openapi", error="invalid_token"'}
+
+    http_app.register_blueprint(bp)
+    response = http_app.test_client().get("/openapi/v1/fixture")
+    assert response.status_code == status
+    assert response.get_json() == payload
+    assert response.headers["WWW-Authenticate"] == 'Bearer realm="native-openapi", error="invalid_token"'
+    if status == 401:
+        assert response.data == json.dumps(payload, separators=(",", ":"), sort_keys=True).encode()
+        assert response.headers["Cache-Control"] == "no-store"
+    else:
+        assert "Cache-Control" not in response.headers
diff --git a/api/tests/unit_tests/controllers/common/test_app_access_error.py b/api/tests/unit_tests/controllers/common/test_app_access_error.py
index 28f86195696c48..4d6c145b5efeab 100644
--- a/api/tests/unit_tests/controllers/common/test_app_access_error.py
+++ b/api/tests/unit_tests/controllers/common/test_app_access_error.py
@@ -97,7 +97,7 @@ def test_web_app_identity_404s_receive_metadata(rule: str) -> None:
     response = _create_app().test_client().get("/api" + rule, environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
     assert response.status_code == 404
     assert response.get_json() == {
-        "code": "not_found",
+        "code": "app_not_found",
         "message": "App not found.",
         "status": 404,
         "client_ip": "203.0.113.42",
@@ -130,13 +130,15 @@ def missing() -> ResponseReturnValue:
         .open(prefix + "/chat-messages", method=method, environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
     )
     assert response.status_code == 404
-    assert response.get_json() == {
+    expected: dict[str, object] = {
         "code": "app_not_found",
         "message": "App not found.",
         "status": 404,
-        "detail": {"reason": "unavailable"},
         "client_ip": "203.0.113.42",
     }
+    if prefix == "/console/api":
+        expected["detail"] = {"reason": "unavailable"}
+    assert response.get_json() == expected
 
 
 def test_agent_error_code_is_not_reclassified() -> None:
@@ -194,7 +196,7 @@ def test_missing_or_invalid_trust_configuration_preserves_original_404(
         .get("/api/site", environ_overrides={"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": "203.0.113.42"})
     )
     assert response.status_code == 404
-    assert response.get_json() == {"code": "not_found", "message": "App not found.", "status": 404}
+    assert response.get_json() == {"code": "app_not_found", "message": "App not found.", "status": 404}
     assert response.headers["Cache-Control"] == "no-store"
 
 
@@ -227,7 +229,7 @@ def test_unavailable_client_ip_removes_existing_unverified_metadata(
         .get("/api/site", environ_overrides={"REMOTE_ADDR": "172.18.0.2"})
     )
     assert response.status_code == 404
-    assert response.get_json() == {"code": "app_not_found", "message": "missing", "status": 404, "extra": "kept"}
+    assert response.get_json() == {"code": "app_not_found", "message": "App not found.", "status": 404}
     assert response.headers["Cache-Control"] == "no-store"
 
 
@@ -251,7 +253,7 @@ def test_response_metadata_is_request_local_and_disables_shared_caching() -> Non
     for peer in ("203.0.113.42", "2001:db8::43", "172.18.0.2"):
         response = client.get("/api/site", environ_overrides={"REMOTE_ADDR": peer})
         assert response.get_json().get("client_ip") == (None if peer == "172.18.0.2" else peer)
-        assert response.get_json()["extra"] == ["kept"]
+        assert "extra" not in response.get_json()
         assert response.headers["Cache-Control"] == "no-store"
         assert response.headers["X-Custom"] == "kept"
     assert "client_ip" not in payload
@@ -262,8 +264,54 @@ def test_response_metadata_is_request_local_and_disables_shared_caching() -> Non
 def test_unrelated_resource_and_human_input_form_404s_are_unchanged(prefix: str, rule: str) -> None:
     response = _create_app().test_client().get(prefix + _path(rule))
     assert response.status_code == 404
-    assert response.get_json() == {"code": "not_found", "message": "App not found.", "status": 404}
-    assert "Cache-Control" not in response.headers
+    if prefix == "/api" and rule.startswith("/form/human_input/"):
+        assert response.get_json() == {"code": "not_found", "message": "Form not found", "status": 404}
+        assert response.headers["Cache-Control"] == "no-store"
+    else:
+        assert response.get_json() == {"code": "not_found", "message": "App not found.", "status": 404}
+        assert "Cache-Control" not in response.headers
+
+
+@pytest.mark.parametrize("code", ["app_unavailable", "agent_not_published"])
+@pytest.mark.parametrize("route", WEB_IDENTITIES)
+def test_web_unavailable_and_unpublished_identity_uses_same_404(code: str, route: str) -> None:
+    payload = {"code": code, "message": "private configuration details", "status": 400, "app_name": "private"}
+    response = (
+        _create_app(lambda: (payload, 400))
+        .test_client()
+        .get("/api" + route, environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    )
+    assert response.status_code == 404
+    assert response.headers["Content-Type"] == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+    assert response.data == (
+        b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+    )
+
+
+@pytest.mark.parametrize("code", ["not_found", "app_not_found", "agent_not_found_error"])
+def test_web_missing_identity_has_one_minimal_canonical_wire_contract(code: str) -> None:
+    payload = {"code": code, "message": "private cause", "status": 404, "policy_id": "private", "app_name": "private"}
+    response = (
+        _create_app(lambda: (payload, 404))
+        .test_client()
+        .get("/api/passport", environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    )
+    assert response.data == (
+        b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+    )
+    assert response.headers["Content-Type"] == "application/json"
+
+
+def test_hitl_upload_invalid_token_keeps_native_contract_without_ip() -> None:
+    payload = {"code": "invalid_upload_token", "message": "private cause", "status": 403, "client_ip": "192.0.2.1"}
+    response = _create_app(lambda: (payload, 403)).test_client().post("/api/human-input-forms/files")
+    assert response.status_code == 403
+    assert response.data == (
+        b'{"code":"invalid_upload_token","message":"Upload token is invalid or expired.","status":403}'
+    )
+    assert response.headers["Cache-Control"] == "no-store"
+    assert response.headers["Content-Type"] == "application/json"
 
 
 @pytest.mark.parametrize("prefix", ["/api", "/console/api"])
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp.py b/api/tests/unit_tests/controllers/mcp/test_mcp.py
index 03679199403f93..6485f36f7f1b06 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp.py
@@ -229,13 +229,17 @@ def test_inactive_server(self):
 
         post_fn = unwrap(api.post)
 
-        with pytest.raises(module.MCPRequestError):
-            post_fn("server-1")
+        response = post_fn("server-1")
+        assert response.status_code == 404
+        assert response.get_json()["error"]["message"] == "Server Not Found"
 
     def test_invalid_payload(self):
         fake_payload({"invalid": "data"})
 
         api = module.MCPAppApi()
+        api._get_mcp_server_and_app = MagicMock(
+            return_value=(_server(module.AppMCPServerStatus.ACTIVE), _app(module.AppMode.WORKFLOW))
+        )
         post_fn = unwrap(api.post)
 
         with pytest.raises(ValidationError):
@@ -277,15 +281,13 @@ def test_server_not_found(self):
         )
 
         api = module.MCPAppApi()
-        api._get_mcp_server_and_app = MagicMock(
-            side_effect=module.MCPRequestError(module.mcp_types.INVALID_REQUEST, "Server Not Found")
-        )
+        api._get_mcp_server_and_app = MagicMock(side_effect=module.MCPServerNotFoundError())
 
         post_fn = unwrap(api.post)
 
-        with pytest.raises(module.MCPRequestError) as exc_info:
-            post_fn("server-1")
-        assert "Server Not Found" in str(exc_info.value)
+        response = post_fn("server-1")
+        assert response.status_code == 404
+        assert response.get_json()["error"]["message"] == "Server Not Found"
 
     def test_app_not_found(self):
         """Test when app associated with server doesn't exist"""
@@ -303,15 +305,13 @@ def test_app_not_found(self):
         )
 
         api = module.MCPAppApi()
-        api._get_mcp_server_and_app = MagicMock(
-            side_effect=module.MCPRequestError(module.mcp_types.INVALID_REQUEST, "App Not Found")
-        )
+        api._get_mcp_server_and_app = MagicMock(side_effect=module.MCPServerNotFoundError())
 
         post_fn = unwrap(api.post)
 
-        with pytest.raises(module.MCPRequestError) as exc_info:
-            post_fn("server-1")
-        assert "App Not Found" in str(exc_info.value)
+        response = post_fn("server-1")
+        assert response.status_code == 404
+        assert response.get_json()["error"]["message"] == "Server Not Found"
 
     def test_app_unavailable_no_workflow(self):
         """Test when app has no workflow (ADVANCED_CHAT mode)"""
diff --git a/api/tests/unit_tests/controllers/service_api/test_wraps.py b/api/tests/unit_tests/controllers/service_api/test_wraps.py
index 997017fddaaf04..e549089f89c59c 100644
--- a/api/tests/unit_tests/controllers/service_api/test_wraps.py
+++ b/api/tests/unit_tests/controllers/service_api/test_wraps.py
@@ -123,7 +123,7 @@ def test_invalid_auth_scheme(self, app: Flask):
             # Act & Assert
             with pytest.raises(Unauthorized) as exc_info:
                 validate_and_get_api_token("app")
-            assert "Authorization scheme must be 'Bearer'" in str(exc_info.value)
+            assert "Authorization header must be provided and start with 'Bearer'" in str(exc_info.value)
 
     @patch("controllers.service_api.wraps.record_token_usage")
     @patch("controllers.service_api.wraps.ApiTokenCache")
diff --git a/api/tests/unit_tests/controllers/trigger/test_trigger.py b/api/tests/unit_tests/controllers/trigger/test_trigger.py
index c7079d332c1d28..d42f4249465da7 100644
--- a/api/tests/unit_tests/controllers/trigger/test_trigger.py
+++ b/api/tests/unit_tests/controllers/trigger/test_trigger.py
@@ -2,7 +2,6 @@
 from unittest.mock import patch
 
 import pytest
-from werkzeug.exceptions import NotFound
 
 import controllers.trigger.trigger as module
 
@@ -23,8 +22,9 @@ def mock_jsonify():
 
 class TestTriggerEndpoint:
     def test_invalid_uuid(self):
-        with pytest.raises(NotFound):
-            module.trigger_endpoint(INVALID_UUID)
+        response = module.trigger_endpoint(INVALID_UUID)
+        assert response.status_code == 404
+        assert response.data == b'{"error":"Endpoint not found"}'
 
     @patch.object(module.TriggerService, "process_endpoint")
     @patch.object(module.TriggerSubscriptionBuilderService, "process_builder_validation_endpoint")
@@ -53,10 +53,9 @@ def test_no_handler_returns_response(self, mock_builder, mock_trigger):
         mock_trigger.return_value = None
         mock_builder.return_value = None
 
-        response, status = module.trigger_endpoint(VALID_UUID)
-
-        assert status == 404
-        assert response["error"] == "Endpoint not found"
+        response = module.trigger_endpoint(VALID_UUID)
+        assert response.status_code == 404
+        assert response.data == b'{"error":"Endpoint not found"}'
 
     @patch.object(module.TriggerService, "process_endpoint", side_effect=ValueError("bad input"))
     def test_value_error(self, mock_trigger):
diff --git a/api/tests/unit_tests/controllers/trigger/test_webhook.py b/api/tests/unit_tests/controllers/trigger/test_webhook.py
index 7cfd0306ff2d48..5972f22c043f76 100644
--- a/api/tests/unit_tests/controllers/trigger/test_webhook.py
+++ b/api/tests/unit_tests/controllers/trigger/test_webhook.py
@@ -150,8 +150,9 @@ def test_rate_limited(self, mock_get):
 
     @patch.object(module.WebhookService, "get_webhook_trigger_and_workflow", side_effect=ValueError("missing"))
     def test_value_error_not_found(self, mock_get):
-        with pytest.raises(NotFound):
-            module.handle_webhook("wh-1")
+        response = module.handle_webhook("wh-1")
+        assert response.status_code == 404
+        assert response.data == NotFound().get_body().encode()
 
     @patch.object(module.WebhookService, "get_webhook_trigger_and_workflow", side_effect=RequestEntityTooLarge())
     def test_request_entity_too_large(self, mock_get):
@@ -228,8 +229,9 @@ def test_debug_bad_request(self, mock_extract, mock_get):
 
     @patch.object(module.WebhookService, "get_webhook_trigger_and_workflow", side_effect=ValueError("missing"))
     def test_debug_not_found(self, mock_get):
-        with pytest.raises(NotFound):
-            module.handle_webhook_debug("wh-1")
+        response = module.handle_webhook_debug("wh-1")
+        assert response.status_code == 404
+        assert response.data == NotFound().get_body().encode()
 
     @patch.object(module.WebhookService, "get_webhook_trigger_and_workflow", side_effect=RequestEntityTooLarge())
     def test_debug_request_entity_too_large(self, mock_get):
diff --git a/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py b/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
index a3d2c8d188a1dd..4a7203f13a2986 100644
--- a/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
+++ b/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
@@ -142,6 +142,25 @@ def test_local_upload_requires_authorization_before_reading_files(app: Flask) ->
             HumanInputFileUploadApi().post()
 
 
+@pytest.mark.parametrize("separator", ["\xa0", "\x1c", "\v", "\u2003"])
+def test_non_http_whitespace_cannot_bypass_gateway_upload_identity(
+    monkeypatch: pytest.MonkeyPatch, app: Flask, separator: str
+) -> None:
+    service = MagicMock()
+    _patch_upload_service(monkeypatch, service)
+    with app.test_request_context(
+        "/api/human-input-forms/files",
+        method="POST",
+        headers={"Authorization": f"Bearer{separator}hitl_upload_token-1"},
+        content_type="multipart/form-data",
+    ):
+        with pytest.raises(InvalidUploadTokenUnauthorizedError):
+            HumanInputFileUploadApi().post()
+    service.validate_upload_token.assert_not_called()
+    service.upload_local_file.assert_not_called()
+    service.upload_remote_file.assert_not_called()
+
+
 def test_local_upload_delegates_to_human_input_upload_service(monkeypatch: pytest.MonkeyPatch, app: Flask) -> None:
     service = MagicMock()
     context = _upload_context()
diff --git a/api/tests/unit_tests/controllers/web/test_site.py b/api/tests/unit_tests/controllers/web/test_site.py
index 8090a8707852d8..0ea59a277ca652 100644
--- a/api/tests/unit_tests/controllers/web/test_site.py
+++ b/api/tests/unit_tests/controllers/web/test_site.py
@@ -2,9 +2,13 @@
 from unittest.mock import MagicMock, patch
 
 import pytest
-from werkzeug.exceptions import Forbidden
+from flask import Blueprint, Flask
+from werkzeug.exceptions import Forbidden, ServiceUnavailable
 
+from controllers.common.app_access_error import register_app_access_error_metadata
 from controllers.web import site as site_module
+from controllers.web.error import WebAppNotFoundError
+from libs.external_api import ExternalApi
 from services.app_definition_query_service import AppSiteConfiguration
 from services.web_app_runtime_query_service import (
     WebAppBootstrap,
@@ -70,7 +74,7 @@ def test_app_site_api_queries_the_admitted_app_runtime() -> None:
     web_app_runtime.get_bootstrap.assert_called_once_with("app-id")
 
 
-def test_app_site_api_maps_unavailable_runtime_to_forbidden() -> None:
+def test_app_site_api_maps_unavailable_runtime_to_app_not_found() -> None:
     web_app_runtime = MagicMock()
     web_app_runtime.get_bootstrap.side_effect = WebAppRuntimeUnavailableError
 
@@ -80,6 +84,54 @@ def test_app_site_api_maps_unavailable_runtime_to_forbidden() -> None:
             "application_services",
             return_value=SimpleNamespace(web_app_runtime=web_app_runtime),
         ),
-        pytest.raises(Forbidden),
+        pytest.raises(WebAppNotFoundError),
     ):
         site_module.AppSiteApi().get(MagicMock(id="app-id"), MagicMock(id="end-user-id"))
+
+
+@pytest.mark.parametrize(
+    ("failure", "status"),
+    [
+        (WebAppRuntimeUnavailableError("Site not found"), 404),
+        (ServiceUnavailable("dependency unavailable"), 503),
+        (Forbidden("business permission denied"), 403),
+        (RuntimeError("programming bug"), 500),
+    ],
+)
+def test_site_final_response_only_reclassifies_terminal_runtime_failure(
+    failure: Exception, status: int, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    from configs import dify_config
+    from controllers.web import wraps
+
+    app = Flask(__name__)
+    app.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
+    bp = Blueprint("site_fixture", __name__, url_prefix="/api")
+    register_app_access_error_metadata(bp, surface="web")
+    api = ExternalApi(bp)
+    api.add_resource(site_module.AppSiteApi, "/site")
+    app.register_blueprint(bp)
+    runtime = MagicMock()
+    runtime.get_bootstrap.side_effect = failure
+    monkeypatch.setattr(site_module, "application_services", lambda: SimpleNamespace(web_app_runtime=runtime))
+    monkeypatch.setattr(
+        wraps,
+        "decode_jwt_token",
+        lambda: (
+            SimpleNamespace(id="fixture-app"),
+            SimpleNamespace(id="fixture-user", tenant_id="fixture-tenant", type="browser"),
+        ),
+    )
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    response = app.test_client().get("/api/site", environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
+    assert response.status_code == status
+    if status == 404:
+        assert (
+            response.data
+            == b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+        )
+        assert response.headers["Content-Type"] == "application/json"
+        assert response.headers["Cache-Control"] == "no-store"
+    else:
+        assert response.get_json()["code"] != "app_not_found"
+        assert "client_ip" not in response.get_json()
diff --git a/api/tests/unit_tests/controllers/web/test_web_login.py b/api/tests/unit_tests/controllers/web/test_web_login.py
index b1adb66f2a9364..a972f1b9b0f7a6 100644
--- a/api/tests/unit_tests/controllers/web/test_web_login.py
+++ b/api/tests/unit_tests/controllers/web/test_web_login.py
@@ -6,6 +6,7 @@
 import pytest
 from flask import Flask
 from jwt import InvalidTokenError
+from sqlalchemy import text
 from sqlalchemy.engine import Engine
 from sqlalchemy.orm import Session, scoped_session, sessionmaker
 from werkzeug.exceptions import Unauthorized
@@ -15,8 +16,15 @@
 from controllers.web.login import EmailCodeLoginApi, EmailCodeLoginSendEmailApi, LoginApi, LoginStatusApi, LogoutApi
 from enums import DeploymentEdition
 from models.account import Account
-from models.model import DifySetup
+from models.enums import CustomizeTokenStrategy
+from models.model import App, DifySetup, Site
+from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
 from services.entities.auth_audit_entities import LoginFailureReason
+from services.webapp_access_query_service import (
+    WebAppAccessAppNotFoundError,
+    WebAppAccessQueryService,
+    WebAppAccessUnavailableError,
+)
 
 pytestmark = pytest.mark.parametrize("sqlite_session", [(DifySetup,)], indirect=True)
 
@@ -243,6 +251,34 @@ def test_email_code_login_logs_banned_account(
 
 
 class TestLoginStatusApi:
+    @patch("controllers.web.login.decode_jwt_token")
+    @patch("controllers.web.login.application_services")
+    @patch("controllers.web.login.extract_webapp_access_token", return_value=None)
+    def test_missing_app_is_final_canonical_404_without_private_details(
+        self,
+        mock_extract: MagicMock,
+        mock_app_id: MagicMock,
+        mock_decode: MagicMock,
+        app: Flask,
+        monkeypatch: pytest.MonkeyPatch,
+    ) -> None:
+        from configs import dify_config
+        from controllers.web import bp
+
+        mock_app_id.return_value.webapp_access.resolve_app_id.side_effect = WebAppAccessAppNotFoundError("private code")
+        monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+        app.register_blueprint(bp)
+        response = app.test_client().get(
+            "/api/login/status?app_code=missing", environ_overrides={"REMOTE_ADDR": "203.0.113.42"}
+        )
+        assert response.status_code == 404
+        assert response.data == (
+            b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+        )
+        assert response.headers["Content-Type"] == "application/json"
+        assert response.headers["Cache-Control"] == "no-store"
+        mock_decode.assert_not_called()
+
     @patch("controllers.web.login.extract_webapp_access_token", return_value=None)
     def test_no_app_code_returns_logged_in_false(self, mock_extract: MagicMock, app: Flask) -> None:
         with app.test_request_context("/web/login/status"):
@@ -254,7 +290,7 @@ def test_no_app_code_returns_logged_in_false(self, mock_extract: MagicMock, app:
     @patch("controllers.web.login.decode_jwt_token")
     @patch("controllers.web.login.PassportService")
     @patch("controllers.web.login.WebAppAuthService.is_app_require_permission_check", return_value=False)
-    @patch("controllers.web.login.AppService.get_app_id_by_code", return_value="app-1")
+    @patch("controllers.web.login.application_services")
     @patch("controllers.web.login.extract_webapp_access_token", return_value="tok")
     def test_public_app_user_logged_in(
         self,
@@ -265,6 +301,7 @@ def test_public_app_user_logged_in(
         mock_decode: MagicMock,
         app: Flask,
     ) -> None:
+        mock_app_id.return_value.webapp_access.resolve_app_id.return_value = "app-1"
         mock_decode.return_value = (MagicMock(), MagicMock())
 
         with app.test_request_context("/web/login/status?app_code=code1"):
@@ -276,7 +313,7 @@ def test_public_app_user_logged_in(
     @patch("controllers.web.login.decode_jwt_token", side_effect=Exception("bad"))
     @patch("controllers.web.login.PassportService")
     @patch("controllers.web.login.WebAppAuthService.is_app_require_permission_check", return_value=True)
-    @patch("controllers.web.login.AppService.get_app_id_by_code", return_value="app-1")
+    @patch("controllers.web.login.application_services")
     @patch("controllers.web.login.extract_webapp_access_token", return_value="tok")
     def test_private_app_passport_fails(
         self,
@@ -287,6 +324,7 @@ def test_private_app_passport_fails(
         mock_decode: MagicMock,
         app: Flask,
     ) -> None:
+        mock_app_id.return_value.webapp_access.resolve_app_id.return_value = "app-1"
         mock_passport_cls.return_value.verify.side_effect = Exception("bad")
 
         with app.test_request_context("/web/login/status?app_code=code1"):
@@ -295,6 +333,86 @@ def test_private_app_passport_fails(
         assert result["logged_in"] is False
         assert result["app_logged_in"] is False
 
+    @pytest.mark.parametrize(
+        "condition", ["missing-site", "dangling-site", "app-disabled", "site-disabled", "app-status-disabled"]
+    )
+    def test_unavailable_public_identity_is_final_404_before_authentication(
+        self, condition: str, app: Flask, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        from configs import dify_config
+        from controllers.web import bp
+        from controllers.web import login as login_module
+
+        app_id = "11111111-1111-1111-1111-111111111111"
+        with sqlite_session_factory.begin() as session:
+            if condition != "dangling-site":
+                session.add(
+                    App(
+                        id=app_id,
+                        tenant_id=app_id,
+                        name="Private fixture",
+                        mode="chat",
+                        enable_site=condition != "app-disabled",
+                        enable_api=True,
+                    )
+                )
+            if condition != "missing-site":
+                session.add(
+                    Site(
+                        app_id=app_id,
+                        code="private-fixture",
+                        title="Private fixture",
+                        default_language="en-US",
+                        customize_token_strategy=CustomizeTokenStrategy.UUID,
+                    )
+                )
+            session.flush()
+            # Exercise historical non-normal rows without bypassing EnumText in production.
+            if condition == "site-disabled":
+                session.execute(text("UPDATE sites SET status='disabled' WHERE app_id=:app_id"), {"app_id": app_id})
+            elif condition == "app-status-disabled":
+                session.execute(text("UPDATE apps SET status='disabled' WHERE id=:app_id"), {"app_id": app_id})
+        modes = MagicMock()
+        service = WebAppAccessQueryService(
+            access=WebAppAccessQueryRepository(session_factory=sqlite_session_factory),
+            webapp_auth_enabled=False,
+            access_mode_for_app=modes,
+            is_user_allowed_for_app=MagicMock(),
+        )
+        monkeypatch.setattr(login_module, "application_services", lambda: SimpleNamespace(webapp_access=service))
+        decode = MagicMock()
+        monkeypatch.setattr(login_module, "decode_jwt_token", decode)
+        monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+        app.register_blueprint(bp)
+        response = app.test_client().get(
+            "/api/login/status?app_code=private-fixture", environ_overrides={"REMOTE_ADDR": "203.0.113.42"}
+        )
+        assert response.status_code == 404
+        assert (
+            response.data
+            == b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+        )
+        assert response.headers["Cache-Control"] == "no-store"
+        modes.assert_not_called()
+        decode.assert_not_called()
+
+    @pytest.mark.parametrize(
+        ("failure", "status"),
+        [(WebAppAccessUnavailableError("private dependency"), 503), (TypeError("private bug"), 500)],
+    )
+    @patch("controllers.web.login.application_services")
+    def test_identity_dependency_or_bug_is_not_hidden_as_app_404(
+        self, services: MagicMock, failure: Exception, status: int, app: Flask
+    ) -> None:
+        from controllers.web import bp
+
+        services.return_value.webapp_access.resolve_app_id.side_effect = failure
+        app.register_blueprint(bp)
+        response = app.test_client().get("/api/login/status?app_code=fixture")
+        assert response.status_code == status
+        assert "client_ip" not in response.get_json()
+        assert response.get_json()["code"] != "app_not_found"
+
 
 class TestLogoutApi:
     @patch("controllers.web.login.clear_webapp_access_token_from_cookie")
diff --git a/api/tests/unit_tests/controllers/web/test_wraps.py b/api/tests/unit_tests/controllers/web/test_wraps.py
index b3c35d70aa33e6..bc7999263fad3a 100644
--- a/api/tests/unit_tests/controllers/web/test_wraps.py
+++ b/api/tests/unit_tests/controllers/web/test_wraps.py
@@ -1,10 +1,11 @@
+from typing import Never
 from unittest import mock
 from uuid import uuid4
 
 import pytest
-from flask import Flask
+from flask import Blueprint, Flask
 from sqlalchemy.orm import Session
-from werkzeug.exceptions import Unauthorized
+from werkzeug.exceptions import NotFound, Unauthorized
 
 from core.logging.context import clear_request_context, get_identity_context
 from models import App, EndUser
@@ -105,3 +106,96 @@ def test_decode_jwt_token_uses_shared_session_factory(sqlite_session: Session) -
 
     assert result_app.id == app_model.id
     assert result_end_user.id == end_user.id
+
+
+@pytest.mark.parametrize("missing", ["app", "site", "code", "disabled", "end_user", "resource"])
+def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
+    sqlite_session: Session, monkeypatch: pytest.MonkeyPatch, missing: str
+) -> None:
+    from configs import dify_config
+    from controllers.common.app_access_error import register_app_access_error_metadata
+    from controllers.web import wraps
+    from libs.external_api import ExternalApi
+    from models.enums import EndUserType
+    from models.model import AppMode, CustomizeTokenStrategy, Site
+
+    app_id, tenant_id, end_user_id = str(uuid4()), str(uuid4()), str(uuid4())
+    if missing != "app":
+        sqlite_session.add(
+            App(
+                id=app_id,
+                tenant_id=tenant_id,
+                name="fixture",
+                mode=AppMode.CHAT,
+                enable_site=missing != "disabled",
+                enable_api=True,
+            )
+        )
+    if missing != "site":
+        sqlite_session.add(
+            Site(
+                app_id=app_id,
+                code="fixture-code",
+                title="fixture",
+                default_language="en-US",
+                customize_token_strategy=CustomizeTokenStrategy.NOT_ALLOW,
+            )
+        )
+    if missing == "resource":
+        sqlite_session.add(
+            EndUser(
+                id=end_user_id,
+                tenant_id=tenant_id,
+                app_id=app_id,
+                type=EndUserType.BROWSER,
+                session_id="fixture-session",
+            )
+        )
+    sqlite_session.commit()
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    app = Flask(__name__)
+    app.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
+    bp = Blueprint("web_post_fixture", __name__, url_prefix="/api")
+    register_app_access_error_metadata(bp, surface="web")
+    api = ExternalApi(bp)
+    calls: list[str] = []
+
+    class ProtectedResource(wraps.WebApiResource):
+        def post(self, _app: App, _end_user: EndUser) -> Never:
+            calls.append("view")
+            raise NotFound("Conversation not found.")
+
+    api.add_resource(ProtectedResource, "/chat-messages")
+    app.register_blueprint(bp)
+    with (
+        mock.patch.object(wraps, "extract_webapp_passport", return_value="fixture-passport"),
+        mock.patch.object(wraps, "PassportService") as passport,
+        mock.patch.object(wraps.SystemFeatureService, "is_webapp_auth_enabled", return_value=False),
+    ):
+        passport.return_value.verify.return_value = {
+            "app_code": None if missing == "code" else "fixture-code",
+            "app_id": app_id,
+            "end_user_id": end_user_id,
+        }
+        response = app.test_client().post(
+            "/api/chat-messages",
+            json={},
+            headers={"X-App-Code": "fixture-code"},
+            environ_overrides={"REMOTE_ADDR": "203.0.113.42"},
+        )
+
+    assert response.status_code == 404
+    if missing in {"app", "site", "code", "disabled"}:
+        assert (
+            response.data
+            == b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+        )
+        assert response.headers["Content-Type"] == "application/json"
+        assert response.headers["Cache-Control"] == "no-store"
+    else:
+        assert response.get_json()["code"] == "not_found"
+        assert "client_ip" not in response.get_json()
+        assert "Cache-Control" not in response.headers
+        if missing == "resource":
+            assert response.get_json()["message"] == "Conversation not found."
+    assert calls == (["view"] if missing == "resource" else [])
diff --git a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
index 02c7d3d7546767..7111f99058097f 100644
--- a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
+++ b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
@@ -4,8 +4,8 @@
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm import Session, sessionmaker
 
-from models.enums import CustomizeTokenStrategy
-from models.model import Site
+from models.enums import AppStatus, CustomizeTokenStrategy
+from models.model import App, Site
 from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
 from services.webapp_access_query_service import WebAppAccessUnavailableError
 
@@ -14,6 +14,7 @@
 
 def test_find_app_id_by_code_returns_matching_site_app(sqlite_session_factory: sessionmaker[Session]) -> None:
     with sqlite_session_factory.begin() as session:
+        session.add(App(id=_APP_ID, tenant_id=_APP_ID, name="Test App", mode="chat", enable_site=True, enable_api=True))
         session.add(
             Site(
                 app_id=_APP_ID,
@@ -27,6 +28,54 @@ def test_find_app_id_by_code_returns_matching_site_app(sqlite_session_factory: s
     repository = WebAppAccessQueryRepository(session_factory=sqlite_session_factory)
 
     assert repository.find_app_id_by_code("site-code") == _APP_ID
+    assert repository.is_app_available(_APP_ID) is True
+
+
+@pytest.mark.parametrize("disabled", ["app", "deleted-app"])
+def test_inactive_or_dangling_site_does_not_resolve_as_public_app(
+    sqlite_session_factory: sessionmaker[Session], disabled: str
+) -> None:
+    with sqlite_session_factory.begin() as session:
+        if disabled != "deleted-app":
+            session.add(
+                App(
+                    id=_APP_ID,
+                    tenant_id=_APP_ID,
+                    name="Test App",
+                    mode="chat",
+                    enable_site=disabled != "app",
+                    enable_api=True,
+                )
+            )
+        session.add(
+            Site(
+                app_id=_APP_ID,
+                code="hidden",
+                title="Hidden",
+                status=AppStatus.NORMAL,
+                default_language="en-US",
+                customize_token_strategy=CustomizeTokenStrategy.UUID,
+            )
+        )
+    repository = WebAppAccessQueryRepository(session_factory=sqlite_session_factory)
+    assert repository.find_app_id_by_code("hidden") is None
+    assert repository.is_app_available(_APP_ID) is False
+
+
+def test_malformed_app_id_is_not_a_database_error() -> None:
+    factory = MagicMock()
+    repository = WebAppAccessQueryRepository(session_factory=factory)
+    assert repository.is_app_available("not-an-app-id") is False
+    factory.assert_not_called()
+
+
+def test_app_id_database_failure_remains_unavailable() -> None:
+    database_error = OperationalError("select", {}, RuntimeError("connection failed"))
+    session = MagicMock()
+    session.__enter__.return_value.scalar.side_effect = database_error
+    repository = WebAppAccessQueryRepository(session_factory=MagicMock(return_value=session))
+    with pytest.raises(WebAppAccessUnavailableError):
+        repository.is_app_available(_APP_ID)
 
 
 def test_find_app_id_by_code_returns_none_for_missing_code(
diff --git a/api/tests/unit_tests/services/test_webapp_access_query_service.py b/api/tests/unit_tests/services/test_webapp_access_query_service.py
index 36007fccaeba34..c1fb2e68bd0578 100644
--- a/api/tests/unit_tests/services/test_webapp_access_query_service.py
+++ b/api/tests/unit_tests/services/test_webapp_access_query_service.py
@@ -8,6 +8,7 @@
     WebAppAccessQuery,
     WebAppAccessQueryService,
     WebAppAccessReferenceRequiredError,
+    WebAppAccessUnavailableError,
 )
 
 
@@ -41,12 +42,43 @@ def test_disabled_auth_returns_public_before_resolving_app() -> None:
     access_mode_for_app.assert_not_called()
 
 
+@pytest.mark.parametrize("enabled", [True, False])
+@pytest.mark.parametrize("reference", ["code", "id"])
+def test_public_identity_resolution_does_not_load_authentication_settings(enabled: bool, reference: str) -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    access.find_app_id_by_code.return_value = "resolved-id"
+    access.is_app_available.return_value = True
+    service, mode_lookup, user_lookup = _service(access=access, enabled=enabled)
+    result = service.resolve_app_id(**({"app_code": "site-code"} if reference == "code" else {"app_id": "resolved-id"}))
+    assert result == "resolved-id"
+    mode_lookup.assert_not_called()
+    user_lookup.assert_not_called()
+
+
+def test_public_identity_requires_a_reference_even_when_auth_disabled() -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    service, _, _ = _service(access=access, enabled=False)
+    with pytest.raises(WebAppAccessReferenceRequiredError):
+        service.resolve_app_id()
+
+
+def test_public_identity_dependency_failure_preserves_its_type() -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    failure = WebAppAccessUnavailableError("dependency")
+    access.find_app_id_by_code.side_effect = failure
+    service, _, _ = _service(access=access, enabled=False)
+    with pytest.raises(WebAppAccessUnavailableError) as raised:
+        service.resolve_app_id(app_code="site-code")
+    assert raised.value is failure
+
+
 def test_enabled_auth_reads_access_mode_by_app_id() -> None:
     access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
     service, access_mode_for_app, _ = _service(access=access)
 
     assert service.get_access_mode(app_id="app-1", app_code=None) is WebAppAccessMode.PRIVATE
     access.find_app_id_by_code.assert_not_called()
+    access.is_app_available.assert_called_once_with("app-1")
     access_mode_for_app.assert_called_once_with("app-1")
 
 
@@ -71,6 +103,34 @@ def test_missing_app_code_raises_not_found() -> None:
     access_mode_for_app.assert_not_called()
 
 
+@pytest.mark.parametrize("enabled", [True, False])
+def test_supplied_missing_app_id_is_not_public_when_auth_disabled(enabled: bool) -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    access.is_app_available.return_value = False
+    service, access_mode_for_app, _ = _service(access=access, enabled=enabled)
+    with pytest.raises(WebAppAccessAppNotFoundError):
+        service.get_access_mode(app_id="missing-app", app_code=None)
+    access_mode_for_app.assert_not_called()
+
+
+def test_disabled_auth_resolves_supplied_missing_code_before_public_shortcut() -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    access.find_app_id_by_code.return_value = None
+    service, access_mode_for_app, _ = _service(access=access, enabled=False)
+    with pytest.raises(WebAppAccessAppNotFoundError):
+        service.get_access_mode(app_id=None, app_code="missing-code")
+    access_mode_for_app.assert_not_called()
+
+
+def test_disabled_auth_returns_public_for_existing_code_without_enterprise_lookup() -> None:
+    access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
+    access.find_app_id_by_code.return_value = "resolved-id"
+    service, access_mode_for_app, _ = _service(access=access, enabled=False)
+    assert service.get_access_mode(app_id=None, app_code="existing-code") is WebAppAccessMode.PUBLIC
+    access_mode_for_app.assert_not_called()
+    access.is_app_available.assert_not_called()
+
+
 def test_enabled_auth_requires_app_id_or_code() -> None:
     access: MagicMock = create_autospec(WebAppAccessQuery, instance=True, spec_set=True)
     service, access_mode_for_app, _ = _service(access=access)
diff --git a/packages/contracts/generated/api/web/types.gen.ts b/packages/contracts/generated/api/web/types.gen.ts
index 09672af5c97e4a..47329f115bfb65 100644
--- a/packages/contracts/generated/api/web/types.gen.ts
+++ b/packages/contracts/generated/api/web/types.gen.ts
@@ -1501,6 +1501,8 @@ export type GetLoginStatusData = {
 
 export type GetLoginStatusErrors = {
   401: unknown
+  404: unknown
+  503: unknown
 }
 
 export type GetLoginStatusResponses = {
diff --git a/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx b/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
index 87bc444e36820d..2eebfb07b89d13 100644
--- a/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
+++ b/web/app/components/explore/try-app/__tests__/app-not-found.spec.tsx
@@ -16,6 +16,10 @@ import enShare from '@/i18n/en-US/share.json'
 import TryApp from '../index'
 
 vi.unmock('react-i18next')
+vi.mock('@/next/navigation', () => ({
+  usePathname: () => window.location.pathname,
+  useSearchParams: () => new URLSearchParams(window.location.search),
+}))
 vi.mock('../app', () => ({ default: () => null }))
 vi.mock('../preview', () => ({ default: () => null }))
 vi.mock('../app-info', () => ({ default: () => null }))
diff --git a/web/service/__tests__/ip-access-denied.spec.ts b/web/service/__tests__/ip-access-denied.spec.ts
index 95b6b901e970fc..db409bb7b3ed5a 100644
--- a/web/service/__tests__/ip-access-denied.spec.ts
+++ b/web/service/__tests__/ip-access-denied.spec.ts
@@ -351,6 +351,95 @@ describe('application not-found transport', () => {
   })
   afterEach(() => vi.restoreAllMocks())
 
+  it('handles the opaque Gateway 404 on a non-identity runtime request without an auth retry', async () => {
+    window.history.replaceState({}, '', '/chat/app')
+    const body = {
+      code: 'app_not_found',
+      message: 'App not found.',
+      status: 404,
+      client_ip: '203.0.113.8',
+    }
+    const fetch = vi.spyOn(globalThis, 'fetch').mockResolvedValue(createResponse(body, 404))
+    const error = await request(
+      '/chat-messages',
+      { method: 'POST', body: {} },
+      { isPublicAPI: true },
+    ).catch((error) => error)
+    expect(isAppAccessError(error)).toBe(true)
+    expect(await (error as Response).json()).toEqual(body)
+    expect(appAccessStore.get(appAccessErrorAtom)).toMatchObject({
+      reason: 'app_not_found',
+      clientIp: '203.0.113.8',
+    })
+    expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+    expect(toast.error).not.toHaveBeenCalled()
+    expect(fetch).toHaveBeenCalledOnce()
+    expect(window.location.pathname).toBe('/chat/app')
+  })
+
+  it('handles an opaque Gateway upload 404 through the same App error boundary', async () => {
+    window.history.replaceState({}, '', '/chat/app')
+    const body = {
+      code: 'app_not_found',
+      message: 'App not found.',
+      status: 404,
+      client_ip: '2001:db8::12',
+    }
+    const xhr = createXhr(body, 404)
+    await expect(upload({ xhr, data: new FormData() }, true, '/files/upload')).rejects.toBe(xhr)
+    expect(isAppAccessError(xhr)).toBe(true)
+    expect(appAccessStore.get(appAccessErrorAtom)?.clientIp).toBe('2001:db8::12')
+    expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+  })
+
+  it.each([
+    { name: 'POST', stream: ssePost, path: '/chat-messages' },
+    { name: 'GET', stream: sseGet, path: '/workflow/run-id/events' },
+  ])(
+    'settles an opaque Gateway 404 before opening an SSE $name stream',
+    async ({ stream, path }) => {
+      window.history.replaceState({}, '', '/chat/app')
+      const body = {
+        code: 'app_not_found',
+        message: 'App not found.',
+        status: 404,
+        client_ip: '203.0.113.8',
+      }
+      vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce(createResponse(body, 404))
+      const onData = vi.fn()
+      const onError = vi.fn()
+      const onCompleted = vi.fn()
+      await stream(path, {}, { isPublicAPI: true, onData, onError, onCompleted })
+      await waitFor(() => expect(onError).toHaveBeenCalledExactlyOnceWith(body.message, body.code))
+      expect(onData).not.toHaveBeenCalled()
+      expect(onCompleted).not.toHaveBeenCalled()
+      expect(appAccessStore.get(appAccessErrorAtom)?.clientIp).toBe('203.0.113.8')
+      expect(refreshAccessTokenOrReLogin).not.toHaveBeenCalled()
+      expect(toast.error).not.toHaveBeenCalled()
+    },
+  )
+
+  it.each([
+    ['/form/human_input/token', 404, 'not_found', 'Form not found'],
+    [
+      '/human-input-forms/files',
+      403,
+      'invalid_upload_token',
+      'Upload token is invalid or expired.',
+    ],
+  ])(
+    'leaves the native HITL unavailable response to its form owner: %s',
+    async (path, status, code, message) => {
+      window.history.replaceState({}, '', '/form/token')
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        createResponse({ code, message, status }, status),
+      )
+      const error = await request(path, {}, { isPublicAPI: true }).catch((error) => error)
+      expect(isAppAccessError(error)).toBe(false)
+      expect(appAccessStore.get(appAccessErrorAtom)).toBeNull()
+    },
+  )
+
   it.each([
     ['/chat/app', '/site', true],
     ['/completion/app', '/parameters', true],

From e8f8728f9afaa074b50a08927b5145b9affed69f Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 22 Sep 2026 10:22:47 +0800
Subject: [PATCH 060/108] fix: distinguish paused access control from off

---
 .../access-control/__tests__/index.spec.tsx        |  4 +++-
 .../app/access-point/access-control/chip-affix.tsx | 14 ++++++++++++--
 web/i18n/ar-TN/deployments.json                    |  1 +
 web/i18n/de-DE/deployments.json                    |  1 +
 web/i18n/en-US/deployments.json                    |  1 +
 web/i18n/es-ES/deployments.json                    |  1 +
 web/i18n/fa-IR/deployments.json                    |  1 +
 web/i18n/fr-FR/deployments.json                    |  1 +
 web/i18n/hi-IN/deployments.json                    |  1 +
 web/i18n/id-ID/deployments.json                    |  1 +
 web/i18n/it-IT/deployments.json                    |  1 +
 web/i18n/ja-JP/deployments.json                    |  1 +
 web/i18n/ko-KR/deployments.json                    |  1 +
 web/i18n/lo-LA/deployments.json                    |  1 +
 web/i18n/nl-NL/deployments.json                    |  1 +
 web/i18n/pl-PL/deployments.json                    |  1 +
 web/i18n/pt-BR/deployments.json                    |  1 +
 web/i18n/ro-RO/deployments.json                    |  1 +
 web/i18n/ru-RU/deployments.json                    |  1 +
 web/i18n/sl-SI/deployments.json                    |  1 +
 web/i18n/th-TH/deployments.json                    |  1 +
 web/i18n/tr-TR/deployments.json                    |  1 +
 web/i18n/uk-UA/deployments.json                    |  1 +
 web/i18n/vi-VN/deployments.json                    |  1 +
 web/i18n/zh-Hans/deployments.json                  |  1 +
 web/i18n/zh-Hant/deployments.json                  |  1 +
 26 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index d932bc3e539a4a..79d2d5aab4caa6 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -871,6 +871,7 @@ describe('supported access points and binding permission', () => {
       expect(
         screen.getByText('Paused — Internal Network is configured but not enforcing'),
       ).toBeInTheDocument()
+      expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
       expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
       await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
@@ -881,6 +882,7 @@ describe('supported access points and binding permission', () => {
         access_points: ['webapp', 'mcp'],
         expected_version: 3,
       })
+      await waitFor(() => expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument())
       await waitFor(() =>
         expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
       )
@@ -1164,7 +1166,7 @@ describe('trusted IP checks before saving', () => {
       expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
       await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
       await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
-      expect(within(getChip()).getByText('Off')).toBeInTheDocument()
+      expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
       expect(server.writes).toHaveLength(0)
       const checksBeforeSave = server.checks
       await user.click(screen.getByRole('button', { name: 'Save' }))
diff --git a/web/app/components/app/access-point/access-control/chip-affix.tsx b/web/app/components/app/access-point/access-control/chip-affix.tsx
index 614d34f0264453..58b5daa25f851b 100644
--- a/web/app/components/app/access-point/access-control/chip-affix.tsx
+++ b/web/app/components/app/access-point/access-control/chip-affix.tsx
@@ -1,6 +1,7 @@
 'use client'
 
 import type { AccessControlChipKind } from './chip-status'
+import { cn } from '@langgenius/dify-ui/cn'
 import { StatusDot } from '@langgenius/dify-ui/status-dot'
 import { useTranslation } from 'react-i18next'
 import PremiumBadge from '@/app/components/base/premium-badge'
@@ -41,7 +42,9 @@ export function AccessControlChipAffix({
             n: coveredCount,
             m: inServiceCount,
           })
-        : t(($) => $['studio.accessControl.chipOff'], { ns: 'deployments' })
+        : kind === 'paused'
+          ? t(($) => $['studio.accessControl.chipPaused'], { ns: 'deployments' })
+          : t(($) => $['studio.accessControl.chipOff'], { ns: 'deployments' })
 
   return (
     <>
@@ -53,7 +56,14 @@ export function AccessControlChipAffix({
             status={kind === 'off' ? 'disabled' : kind === 'paused' ? 'warning' : 'success'}
           />
         </span>
-        <span className="system-xs-semibold text-text-tertiary">{statusLabel}</span>
+        <span
+          className={cn(
+            'system-xs-semibold uppercase',
+            kind === 'paused' ? 'text-text-warning' : 'text-text-tertiary',
+          )}
+        >
+          {statusLabel}
+        </span>
       </span>
     </>
   )
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index e1f5932bcd5c46..cab6ce11431527 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "متوقف مؤقتًا",
   "studio.accessControl.createIpPolicy": "إضافة سياسة IP",
   "studio.accessControl.description": "تحكّم في الوصول إلى هذا التطبيق بتطبيق سياسة IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index dfbf5c2fbea762..a0a2966a8a17bf 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Pausiert",
   "studio.accessControl.createIpPolicy": "IP-Richtlinie hinzufügen",
   "studio.accessControl.description": "Steuern Sie den Zugriff auf diese App durch Anwenden einer IP-Richtlinie.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index 832d801cf17d4a..f9144094145b3f 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Pause",
   "studio.accessControl.createIpPolicy": "Add IP Policy",
   "studio.accessControl.description": "Control access to this app by applying an IP policy.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 66e257563fde66..8393323825c5eb 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "En pausa",
   "studio.accessControl.createIpPolicy": "Añadir política de IP",
   "studio.accessControl.description": "Controla el acceso a esta aplicación aplicando una política de IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index 46f3eabb591ec2..e15c0e10850be5 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "توقف موقت",
   "studio.accessControl.createIpPolicy": "افزودن خط‌مشی IP",
   "studio.accessControl.description": "با اعمال یک خط‌مشی IP، دسترسی به این برنامه را کنترل کنید.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index 9f7f821bf81b27..a2e38ebfa79c83 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "En pause",
   "studio.accessControl.createIpPolicy": "Ajouter une politique IP",
   "studio.accessControl.description": "Contrôlez l’accès à cette application en appliquant une politique IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index f902f5f3346ad2..7833bfa0fa8ca9 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "रुका हुआ",
   "studio.accessControl.createIpPolicy": "IP नीति जोड़ें",
   "studio.accessControl.description": "IP नीति लागू करके इस ऐप तक पहुँच नियंत्रित करें।",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index e23685a658986f..db29a8af22e3f2 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Dijeda",
   "studio.accessControl.createIpPolicy": "Tambah kebijakan IP",
   "studio.accessControl.description": "Kontrol akses ke aplikasi ini dengan menerapkan kebijakan IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index a4b1ac1affe627..a98b615c7230b0 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "In pausa",
   "studio.accessControl.createIpPolicy": "Aggiungi policy IP",
   "studio.accessControl.description": "Controlla l’accesso a questa app applicando una policy IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 86c910b9a6b395..204d52b61c9ab5 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "オフ",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
+  "studio.accessControl.chipPaused": "一時停止",
   "studio.accessControl.createIpPolicy": "IP ポリシーを追加",
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
   "studio.accessControl.downgradeDescription": "アクセス制御には Pro プランが必要です。",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index a8dee70f8adf77..79968e45b3b51e 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "일시 중지",
   "studio.accessControl.createIpPolicy": "IP 정책 추가",
   "studio.accessControl.description": "IP 정책을 적용하여 이 앱에 대한 접근을 제어합니다.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index 18d2b2e34d33c8..dd58e30dca05c7 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "ຢຸດຊົ່ວຄາວ",
   "studio.accessControl.createIpPolicy": "ເພີ່ມນະໂຍບາຍ IP",
   "studio.accessControl.description": "ຄວບຄຸມການເຂົ້າເຖິງແອັບນີ້ໂດຍນຳໃຊ້ນະໂຍບາຍ IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 5053760b31d8fa..0e077f2d85ae25 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Gepauzeerd",
   "studio.accessControl.createIpPolicy": "IP-beleid toevoegen",
   "studio.accessControl.description": "Beheer de toegang tot deze app door een IP-beleid toe te passen.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 62cc47d1568203..907351fc7ca27a 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Wstrzymane",
   "studio.accessControl.createIpPolicy": "Dodaj politykę IP",
   "studio.accessControl.description": "Kontroluj dostęp do tej aplikacji, stosując politykę IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index e3a865cfb3714d..96a67a2115a5b5 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Pausado",
   "studio.accessControl.createIpPolicy": "Adicionar política de IP",
   "studio.accessControl.description": "Controle o acesso a este aplicativo aplicando uma política de IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index cbeecb0c74a2b6..82764b20886eff 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Pauză",
   "studio.accessControl.createIpPolicy": "Adăugați o politică IP",
   "studio.accessControl.description": "Controlați accesul la această aplicație aplicând o politică IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index c8624de660cae2..f66734dbacb3b4 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Пауза",
   "studio.accessControl.createIpPolicy": "Добавить IP-политику",
   "studio.accessControl.description": "Управляйте доступом к этому приложению с помощью IP-политики.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 2caa7bef98f3ca..51cc550884f30b 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Začasno ustavljeno",
   "studio.accessControl.createIpPolicy": "Dodaj pravilnik IP",
   "studio.accessControl.description": "Nadzirajte dostop do te aplikacije z uporabo pravilnika IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 1f818ac3f209fb..3128544e4ef187 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "หยุดชั่วคราว",
   "studio.accessControl.createIpPolicy": "เพิ่มนโยบาย IP",
   "studio.accessControl.description": "ควบคุมการเข้าถึงแอปนี้โดยใช้นโยบาย IP",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index faaa30eba12074..82abf6476683da 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Duraklatıldı",
   "studio.accessControl.createIpPolicy": "IP politikası ekle",
   "studio.accessControl.description": "Bir IP politikası uygulayarak bu uygulamaya erişimi denetleyin.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 6b8f6774f6f6c7..d93289d59ee316 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Призупинено",
   "studio.accessControl.createIpPolicy": "Додати IP-політику",
   "studio.accessControl.description": "Керуйте доступом до цього застосунку за допомогою IP-політики.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 1e2c76acdb2dfb..60d701afe4d07f 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.chipPaused": "Tạm dừng",
   "studio.accessControl.createIpPolicy": "Thêm chính sách IP",
   "studio.accessControl.description": "Kiểm soát quyền truy cập ứng dụng này bằng cách áp dụng chính sách IP.",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 5d8dbcae2a61f5..a634fcef24fd98 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "关闭",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
+  "studio.accessControl.chipPaused": "暂停",
   "studio.accessControl.createIpPolicy": "添加 IP 策略",
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
   "studio.accessControl.downgradeDescription": "访问控制需要 Pro 套餐。",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 8c63866838187e..588469f6476df0 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -40,6 +40,7 @@
   "studio.accessControl.chipOff": "Off",
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
+  "studio.accessControl.chipPaused": "暫停",
   "studio.accessControl.createIpPolicy": "新增 IP 原則",
   "studio.accessControl.description": "透過套用 IP 原則來控制對此應用程式的存取。",
   "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",

From c721ec5ff7b40d193f24f7f12cde26ea31e07c1f Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 22 Sep 2026 11:03:21 +0800
Subject: [PATCH 061/108] fix: complete access control translations and plan
 messaging

---
 .../access-control/__tests__/index.spec.tsx   |  4 +-
 web/i18n/ar-TN/deployments.json               | 86 +++++++++----------
 web/i18n/de-DE/deployments.json               | 86 +++++++++----------
 web/i18n/en-US/deployments.json               |  4 +-
 web/i18n/es-ES/deployments.json               | 86 +++++++++----------
 web/i18n/fa-IR/deployments.json               | 86 +++++++++----------
 web/i18n/fr-FR/deployments.json               | 86 +++++++++----------
 web/i18n/hi-IN/deployments.json               | 86 +++++++++----------
 web/i18n/id-ID/deployments.json               | 86 +++++++++----------
 web/i18n/it-IT/deployments.json               | 86 +++++++++----------
 web/i18n/ja-JP/deployments.json               |  6 +-
 web/i18n/ko-KR/deployments.json               | 86 +++++++++----------
 web/i18n/lo-LA/deployments.json               | 86 +++++++++----------
 web/i18n/nl-NL/deployments.json               | 86 +++++++++----------
 web/i18n/pl-PL/deployments.json               | 86 +++++++++----------
 web/i18n/pt-BR/deployments.json               | 86 +++++++++----------
 web/i18n/ro-RO/deployments.json               | 86 +++++++++----------
 web/i18n/ru-RU/deployments.json               | 86 +++++++++----------
 web/i18n/sl-SI/deployments.json               | 86 +++++++++----------
 web/i18n/th-TH/deployments.json               | 86 +++++++++----------
 web/i18n/tr-TR/deployments.json               | 86 +++++++++----------
 web/i18n/uk-UA/deployments.json               | 86 +++++++++----------
 web/i18n/vi-VN/deployments.json               | 86 +++++++++----------
 web/i18n/zh-Hans/deployments.json             |  6 +-
 web/i18n/zh-Hant/deployments.json             | 24 +++---
 25 files changed, 883 insertions(+), 881 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 79d2d5aab4caa6..a10a53fd677796 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -191,7 +191,9 @@ describe('AccessControlEntry', () => {
       expect(within(getChip()).getByText('PRO')).toBeInTheDocument()
       await user.click(getChip())
       expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
-      expect(screen.getByText('Access control needs the Pro plan.')).toBeInTheDocument()
+      expect(
+        screen.getByText('Access control is available on Professional and Team plans.'),
+      ).toBeInTheDocument()
       expect(screen.getByText('Ready to resume')).toBeInTheDocument()
       expect(screen.getByText('Internal Network')).toBeInTheDocument()
       expect(screen.getByText(`Protects ${coverage} access points`)).toBeInTheDocument()
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index cab6ce11431527..decc92154e3cbc 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} من العناوين",
+  "studio.accessControl.applyTo": "تطبيق على",
+  "studio.accessControl.applyToHelp": "اختر نقاط الوصول التي تحميها هذه السياسة.",
+  "studio.accessControl.applyToHelpSelected": "اختر نقاط الوصول التي تحميها هذه السياسة.",
+  "studio.accessControl.chipOff": "متوقف",
+  "studio.accessControl.chipOn": "مفعّل",
+  "studio.accessControl.chipPartial": "{{n}} من {{m}}",
   "studio.accessControl.chipPaused": "متوقف مؤقتًا",
   "studio.accessControl.createIpPolicy": "إضافة سياسة IP",
   "studio.accessControl.description": "تحكّم في الوصول إلى هذا التطبيق بتطبيق سياسة IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
+  "studio.accessControl.downgradeTitle": "لم يعد هذا التطبيق محميًا",
+  "studio.accessControl.emptyPoliciesTitle": "لا توجد سياسات IP في مساحة العمل هذه بعد",
   "studio.accessControl.enableAccessControl": "تفعيل التحكم في الوصول",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "التحكّم في الوصول",
+  "studio.accessControl.excluded": "مستبعد",
+  "studio.accessControl.ipPolicy": "سياسة IP",
+  "studio.accessControl.lockoutWarning": "عنوان IP الخاص بك ({{ip}}) غير مشمول بهذه السياسة. قد تفقد إمكانية الوصول.",
+  "studio.accessControl.manageIpPolicies": "إدارة سياسات IP",
+  "studio.accessControl.notEnabled": "غير مفعّل",
+  "studio.accessControl.paywallDescription": "اسمح بالوصول إلى هذا التطبيق من عناوين IP التي تثق بها فقط.",
+  "studio.accessControl.paywallTitle": "التحكّم في الوصول",
   "studio.accessControl.policyChanged": "تغيّرت هذه السياسة. راجع التحذير قبل الحفظ مجددًا.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryNone": "لا يسمح بأي عناوين",
+  "studio.accessControl.policySummaryOne": "يسمح بـ {{address}}",
+  "studio.accessControl.policySummaryTwo": "يسمح بـ {{first}} و{{second}}",
+  "studio.accessControl.previewAppName": "مساعد البرمجة",
+  "studio.accessControl.previewCaption": "هذا التطبيق متاح فقط على شبكة مؤسستك.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "تتم حماية جميع نقاط الوصول قيد الخدمة، وعددها {{count}}.",
+  "studio.accessControl.protectingPartial": "تتم حماية {{n}} من أصل {{m}} من نقاط الوصول قيد الخدمة.",
+  "studio.accessControl.protectsCoverage": "يحمي {{n}} من أصل {{m}} من نقاط الوصول",
+  "studio.accessControl.readyToResume": "جاهز للاستئناف",
+  "studio.accessControl.restrictByIp": "تقييد حسب عنوان IP",
+  "studio.accessControl.restrictedTo": "الوصول مقيّد بسياسة {{name}}",
+  "studio.accessControl.saveAnyway": "الحفظ على أي حال",
+  "studio.accessControl.saveWithoutOwnIp": "هل تريد الحفظ دون تضمين عنوان IP الخاص بك؟",
+  "studio.accessControl.selectAccessPoint": "يرجى اختيار نقطة وصول واحدة على الأقل.",
+  "studio.accessControl.selectPolicy": "اختر سياسة IP",
   "studio.accessControl.selectPolicyRequired": "يرجى اختيار سياسة IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "لم يتم الإعداد",
+  "studio.accessControl.tooltipOn": "جميع نقاط الوصول",
+  "studio.accessControl.tooltipPartial": "{{n}} من أصل {{total}} من نقاط الوصول",
+  "studio.accessControl.tooltipPaused": "متوقف مؤقتًا — تم إعداد {{name}} ولكنها غير مطبّقة",
+  "studio.accessControl.tooltipPro": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
+  "studio.accessControl.turnOffConfirm": "إيقاف",
+  "studio.accessControl.turnOffDescription": "ستصبح {{points}} متاحة من أي عنوان IP.",
+  "studio.accessControl.turnOffTitle": "هل تريد إيقاف التحكّم في الوصول؟",
+  "studio.accessControl.turnOn": "تفعيل التحكم في الوصول",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
   "studio.accessPoint.embedIntoSite": "تضمين في الموقع",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index a0a2966a8a17bf..07a6a9e76edbe7 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} Adressen",
+  "studio.accessControl.applyTo": "Anwenden auf",
+  "studio.accessControl.applyToHelp": "Wählen Sie aus, welche Zugangspunkte diese Richtlinie schützt.",
+  "studio.accessControl.applyToHelpSelected": "Wählen Sie aus, welche Zugangspunkte diese Richtlinie schützt.",
+  "studio.accessControl.chipOff": "Aus",
+  "studio.accessControl.chipOn": "Ein",
+  "studio.accessControl.chipPartial": "{{n}} von {{m}}",
   "studio.accessControl.chipPaused": "Pausiert",
   "studio.accessControl.createIpPolicy": "IP-Richtlinie hinzufügen",
   "studio.accessControl.description": "Steuern Sie den Zugriff auf diese App durch Anwenden einer IP-Richtlinie.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
+  "studio.accessControl.downgradeTitle": "Diese App ist nicht mehr geschützt",
+  "studio.accessControl.emptyPoliciesTitle": "In diesem Arbeitsbereich gibt es noch keine IP-Richtlinien",
   "studio.accessControl.enableAccessControl": "Zugriffskontrolle aktivieren",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Zugriffskontrolle",
+  "studio.accessControl.excluded": "Ausgeschlossen",
+  "studio.accessControl.ipPolicy": "IP-Richtlinie",
+  "studio.accessControl.lockoutWarning": "Ihre IP-Adresse ({{ip}}) ist nicht in dieser Richtlinie enthalten. Sie könnten den Zugriff verlieren.",
+  "studio.accessControl.manageIpPolicies": "IP-Richtlinien verwalten",
+  "studio.accessControl.notEnabled": "Nicht aktiviert",
+  "studio.accessControl.paywallDescription": "Beschränken Sie den Zugriff auf diese App auf vertrauenswürdige IP-Adressen.",
+  "studio.accessControl.paywallTitle": "Zugriffskontrolle",
   "studio.accessControl.policyChanged": "Diese Richtlinie wurde geändert. Prüfen Sie die Warnung, bevor Sie erneut speichern.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Erlaubt {{listed}} und {{count}} weitere Adressen",
+  "studio.accessControl.policySummaryNone": "Erlaubt keine Adressen",
+  "studio.accessControl.policySummaryOne": "Erlaubt {{address}}",
+  "studio.accessControl.policySummaryTwo": "Erlaubt {{first}} und {{second}}",
+  "studio.accessControl.previewAppName": "Code-Assistent",
+  "studio.accessControl.previewCaption": "Diese App ist nur im Netzwerk Ihrer Organisation verfügbar.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Alle {{count}} aktiven Zugangspunkte sind geschützt.",
+  "studio.accessControl.protectingPartial": "{{n}} von {{m}} aktiven Zugangspunkten sind geschützt.",
+  "studio.accessControl.protectsCoverage": "Schützt {{n}} von {{m}} Zugangspunkten",
+  "studio.accessControl.readyToResume": "Bereit zum Fortsetzen",
+  "studio.accessControl.restrictByIp": "Nach IP-Adresse einschränken",
+  "studio.accessControl.restrictedTo": "Beschränkt auf {{name}}",
+  "studio.accessControl.saveAnyway": "Trotzdem speichern",
+  "studio.accessControl.saveWithoutOwnIp": "Ohne Ihre eigene IP-Adresse speichern?",
+  "studio.accessControl.selectAccessPoint": "Bitte wählen Sie mindestens einen Zugangspunkt aus.",
+  "studio.accessControl.selectPolicy": "IP-Richtlinie auswählen",
   "studio.accessControl.selectPolicyRequired": "Bitte wählen Sie eine IP-Richtlinie aus.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Nicht eingerichtet",
+  "studio.accessControl.tooltipOn": "Alle Zugangspunkte",
+  "studio.accessControl.tooltipPartial": "{{n}} von {{total}} Zugangspunkten",
+  "studio.accessControl.tooltipPaused": "Pausiert — {{name}} ist konfiguriert, wird aber nicht angewendet",
+  "studio.accessControl.tooltipPro": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
+  "studio.accessControl.turnOffConfirm": "Deaktivieren",
+  "studio.accessControl.turnOffDescription": "{{points}} sind dann von jeder IP-Adresse aus erreichbar.",
+  "studio.accessControl.turnOffTitle": "Zugriffskontrolle deaktivieren?",
+  "studio.accessControl.turnOn": "Zugriffskontrolle aktivieren",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
   "studio.accessPoint.embedIntoSite": "In Website einbetten",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index f9144094145b3f..1cc8ae53218bb1 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipPaused": "Pause",
   "studio.accessControl.createIpPolicy": "Add IP Policy",
   "studio.accessControl.description": "Control access to this app by applying an IP policy.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
+  "studio.accessControl.downgradeDescription": "Access control is available on Professional and Team plans.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.enableAccessControl": "Enable access control",
@@ -78,7 +78,7 @@
   "studio.accessControl.tooltipOn": "All access points",
   "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
+  "studio.accessControl.tooltipPro": "Access control is available on Professional and Team plans.",
   "studio.accessControl.turnOffConfirm": "Turn off",
   "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
   "studio.accessControl.turnOffTitle": "Turn off access control?",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 8393323825c5eb..28a6120fba7f8a 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} direcciones",
+  "studio.accessControl.applyTo": "Aplicar a",
+  "studio.accessControl.applyToHelp": "Elige qué puntos de acceso protege esta política.",
+  "studio.accessControl.applyToHelpSelected": "Elige qué puntos de acceso protege esta política.",
+  "studio.accessControl.chipOff": "Desactivado",
+  "studio.accessControl.chipOn": "Activado",
+  "studio.accessControl.chipPartial": "{{n}} de {{m}}",
   "studio.accessControl.chipPaused": "En pausa",
   "studio.accessControl.createIpPolicy": "Añadir política de IP",
   "studio.accessControl.description": "Controla el acceso a esta aplicación aplicando una política de IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "El control de acceso está disponible en los planes Professional y Team.",
+  "studio.accessControl.downgradeTitle": "Esta aplicación ya no está protegida",
+  "studio.accessControl.emptyPoliciesTitle": "Aún no hay políticas de IP en este espacio de trabajo",
   "studio.accessControl.enableAccessControl": "Activar el control de acceso",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Control de acceso",
+  "studio.accessControl.excluded": "Excluido",
+  "studio.accessControl.ipPolicy": "Política de IP",
+  "studio.accessControl.lockoutWarning": "Tu IP ({{ip}}) no está incluida en esta política. Podrías perder el acceso.",
+  "studio.accessControl.manageIpPolicies": "Gestionar políticas de IP",
+  "studio.accessControl.notEnabled": "No habilitado",
+  "studio.accessControl.paywallDescription": "Restringe el acceso a esta aplicación a direcciones IP de confianza.",
+  "studio.accessControl.paywallTitle": "Control de acceso",
   "studio.accessControl.policyChanged": "Esta política ha cambiado. Revisa la advertencia antes de volver a guardar.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Permite {{listed}} y {{count}} direcciones más",
+  "studio.accessControl.policySummaryNone": "No permite ninguna dirección",
+  "studio.accessControl.policySummaryOne": "Permite {{address}}",
+  "studio.accessControl.policySummaryTwo": "Permite {{first}} y {{second}}",
+  "studio.accessControl.previewAppName": "Asistente de código",
+  "studio.accessControl.previewCaption": "Esta aplicación solo está disponible en la red de tu organización.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Se protegen los {{count}} puntos de acceso en servicio.",
+  "studio.accessControl.protectingPartial": "Se protegen {{n}} de {{m}} puntos de acceso en servicio.",
+  "studio.accessControl.protectsCoverage": "Protege {{n}} de {{m}} puntos de acceso",
+  "studio.accessControl.readyToResume": "Listo para reanudar",
+  "studio.accessControl.restrictByIp": "Restringir por dirección IP",
+  "studio.accessControl.restrictedTo": "Restringido a {{name}}",
+  "studio.accessControl.saveAnyway": "Guardar de todos modos",
+  "studio.accessControl.saveWithoutOwnIp": "¿Guardar sin incluir tu propia IP?",
+  "studio.accessControl.selectAccessPoint": "Elige al menos un punto de acceso.",
+  "studio.accessControl.selectPolicy": "Selecciona una política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecciona una política de IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Sin configurar",
+  "studio.accessControl.tooltipOn": "Todos los puntos de acceso",
+  "studio.accessControl.tooltipPartial": "{{n}} de {{total}} puntos de acceso",
+  "studio.accessControl.tooltipPaused": "En pausa — {{name}} está configurada, pero no se aplica",
+  "studio.accessControl.tooltipPro": "El control de acceso está disponible en los planes Professional y Team.",
+  "studio.accessControl.turnOffConfirm": "Desactivar",
+  "studio.accessControl.turnOffDescription": "Se podrá acceder a {{points}} desde cualquier IP.",
+  "studio.accessControl.turnOffTitle": "¿Desactivar el control de acceso?",
+  "studio.accessControl.turnOn": "Activar el control de acceso",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
   "studio.accessPoint.embedIntoSite": "Insertar en el sitio",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index e15c0e10850be5..b8cf35bb5e4ae8 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} نشانی",
+  "studio.accessControl.applyTo": "اعمال روی",
+  "studio.accessControl.applyToHelp": "انتخاب کنید این خط‌مشی از کدام نقاط دسترسی محافظت کند.",
+  "studio.accessControl.applyToHelpSelected": "انتخاب کنید این خط‌مشی از کدام نقاط دسترسی محافظت کند.",
+  "studio.accessControl.chipOff": "خاموش",
+  "studio.accessControl.chipOn": "روشن",
+  "studio.accessControl.chipPartial": "{{n}} از {{m}}",
   "studio.accessControl.chipPaused": "توقف موقت",
   "studio.accessControl.createIpPolicy": "افزودن خط‌مشی IP",
   "studio.accessControl.description": "با اعمال یک خط‌مشی IP، دسترسی به این برنامه را کنترل کنید.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
+  "studio.accessControl.downgradeTitle": "این برنامه دیگر محافظت نمی‌شود",
+  "studio.accessControl.emptyPoliciesTitle": "هنوز هیچ خط‌مشی IP در این فضای کاری وجود ندارد",
   "studio.accessControl.enableAccessControl": "فعال‌سازی کنترل دسترسی",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "کنترل دسترسی",
+  "studio.accessControl.excluded": "مستثنا",
+  "studio.accessControl.ipPolicy": "خط‌مشی IP",
+  "studio.accessControl.lockoutWarning": "نشانی IP شما ({{ip}}) در این خط‌مشی نیست. ممکن است دسترسی خود را از دست بدهید.",
+  "studio.accessControl.manageIpPolicies": "مدیریت خط‌مشی‌های IP",
+  "studio.accessControl.notEnabled": "فعال نشده",
+  "studio.accessControl.paywallDescription": "دسترسی به این برنامه را به نشانی‌های IP مورد اعتماد خود محدود کنید.",
+  "studio.accessControl.paywallTitle": "کنترل دسترسی",
   "studio.accessControl.policyChanged": "این خط‌مشی تغییر کرده است. پیش از ذخیره مجدد، هشدار را بررسی کنید.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
+  "studio.accessControl.policySummaryNone": "هیچ نشانی‌ای مجاز نیست",
+  "studio.accessControl.policySummaryOne": "{{address}} را مجاز می‌کند",
+  "studio.accessControl.policySummaryTwo": "{{first}} و {{second}} را مجاز می‌کند",
+  "studio.accessControl.previewAppName": "دستیار برنامه‌نویسی",
+  "studio.accessControl.previewCaption": "این برنامه فقط در شبکه سازمان شما در دسترس است.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "از هر {{count}} نقطه دسترسی فعال محافظت می‌شود.",
+  "studio.accessControl.protectingPartial": "از {{n}} نقطه از {{m}} نقطه دسترسی فعال محافظت می‌شود.",
+  "studio.accessControl.protectsCoverage": "از {{n}} نقطه از {{m}} نقطه دسترسی محافظت می‌کند",
+  "studio.accessControl.readyToResume": "آماده ازسرگیری",
+  "studio.accessControl.restrictByIp": "محدود کردن بر اساس نشانی IP",
+  "studio.accessControl.restrictedTo": "محدود به {{name}}",
+  "studio.accessControl.saveAnyway": "در هر صورت ذخیره شود",
+  "studio.accessControl.saveWithoutOwnIp": "بدون نشانی IP خودتان ذخیره شود؟",
+  "studio.accessControl.selectAccessPoint": "لطفاً دست‌کم یک نقطه دسترسی انتخاب کنید.",
+  "studio.accessControl.selectPolicy": "یک خط‌مشی IP انتخاب کنید",
   "studio.accessControl.selectPolicyRequired": "لطفاً یک خط‌مشی IP انتخاب کنید.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "تنظیم نشده",
+  "studio.accessControl.tooltipOn": "همه نقاط دسترسی",
+  "studio.accessControl.tooltipPartial": "{{n}} نقطه از {{total}} نقطه دسترسی",
+  "studio.accessControl.tooltipPaused": "متوقف شده — {{name}} پیکربندی شده اما اعمال نمی‌شود",
+  "studio.accessControl.tooltipPro": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
+  "studio.accessControl.turnOffConfirm": "خاموش کردن",
+  "studio.accessControl.turnOffDescription": "دسترسی به {{points}} از هر نشانی IP ممکن خواهد شد.",
+  "studio.accessControl.turnOffTitle": "کنترل دسترسی خاموش شود؟",
+  "studio.accessControl.turnOn": "فعال‌سازی کنترل دسترسی",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
   "studio.accessPoint.embedIntoSite": "جاسازی در سایت",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index a2e38ebfa79c83..ffe93cf1d2b825 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} adresses",
+  "studio.accessControl.applyTo": "Appliquer à",
+  "studio.accessControl.applyToHelp": "Choisissez les points d’accès protégés par cette politique.",
+  "studio.accessControl.applyToHelpSelected": "Choisissez les points d’accès protégés par cette politique.",
+  "studio.accessControl.chipOff": "Désactivé",
+  "studio.accessControl.chipOn": "Activé",
+  "studio.accessControl.chipPartial": "{{n}} sur {{m}}",
   "studio.accessControl.chipPaused": "En pause",
   "studio.accessControl.createIpPolicy": "Ajouter une politique IP",
   "studio.accessControl.description": "Contrôlez l’accès à cette application en appliquant une politique IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
+  "studio.accessControl.downgradeTitle": "Cette application n’est plus protégée",
+  "studio.accessControl.emptyPoliciesTitle": "Cet espace de travail ne contient pas encore de politiques IP",
   "studio.accessControl.enableAccessControl": "Activer le contrôle d’accès",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Contrôle d’accès",
+  "studio.accessControl.excluded": "Exclu",
+  "studio.accessControl.ipPolicy": "Politique IP",
+  "studio.accessControl.lockoutWarning": "Votre IP ({{ip}}) n’est pas incluse dans cette politique. Vous risquez de perdre l’accès.",
+  "studio.accessControl.manageIpPolicies": "Gérer les politiques IP",
+  "studio.accessControl.notEnabled": "Non activé",
+  "studio.accessControl.paywallDescription": "Limitez l’accès à cette application aux adresses IP de confiance.",
+  "studio.accessControl.paywallTitle": "Contrôle d’accès",
   "studio.accessControl.policyChanged": "Cette politique a changé. Vérifiez l’avertissement avant d’enregistrer à nouveau.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Autorise {{listed}} et {{count}} autres adresses",
+  "studio.accessControl.policySummaryNone": "N’autorise aucune adresse",
+  "studio.accessControl.policySummaryOne": "Autorise {{address}}",
+  "studio.accessControl.policySummaryTwo": "Autorise {{first}} et {{second}}",
+  "studio.accessControl.previewAppName": "Assistant de code",
+  "studio.accessControl.previewCaption": "Cette application est uniquement accessible sur le réseau de votre organisation.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Les {{count}} points d’accès en service sont protégés.",
+  "studio.accessControl.protectingPartial": "{{n}} points d’accès en service sur {{m}} sont protégés.",
+  "studio.accessControl.protectsCoverage": "Protège {{n}} points d’accès sur {{m}}",
+  "studio.accessControl.readyToResume": "Prêt à reprendre",
+  "studio.accessControl.restrictByIp": "Restreindre par adresse IP",
+  "studio.accessControl.restrictedTo": "Limité à {{name}}",
+  "studio.accessControl.saveAnyway": "Enregistrer quand même",
+  "studio.accessControl.saveWithoutOwnIp": "Enregistrer sans inclure votre propre IP ?",
+  "studio.accessControl.selectAccessPoint": "Veuillez choisir au moins un point d’accès.",
+  "studio.accessControl.selectPolicy": "Sélectionnez une politique IP",
   "studio.accessControl.selectPolicyRequired": "Veuillez sélectionner une politique IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Non configuré",
+  "studio.accessControl.tooltipOn": "Tous les points d’accès",
+  "studio.accessControl.tooltipPartial": "{{n}} points d’accès sur {{total}}",
+  "studio.accessControl.tooltipPaused": "En pause — {{name}} est configurée mais n’est pas appliquée",
+  "studio.accessControl.tooltipPro": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
+  "studio.accessControl.turnOffConfirm": "Désactiver",
+  "studio.accessControl.turnOffDescription": "{{points}} seront accessibles depuis n’importe quelle IP.",
+  "studio.accessControl.turnOffTitle": "Désactiver le contrôle d’accès ?",
+  "studio.accessControl.turnOn": "Activer le contrôle d’accès",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
   "studio.accessPoint.embedIntoSite": "Intégrer au site",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index 7833bfa0fa8ca9..e405683f761c74 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} पते",
+  "studio.accessControl.applyTo": "इन पर लागू करें",
+  "studio.accessControl.applyToHelp": "चुनें कि यह नीति किन पहुँच बिंदुओं की सुरक्षा करेगी।",
+  "studio.accessControl.applyToHelpSelected": "चुनें कि यह नीति किन पहुँच बिंदुओं की सुरक्षा करेगी।",
+  "studio.accessControl.chipOff": "बंद",
+  "studio.accessControl.chipOn": "चालू",
+  "studio.accessControl.chipPartial": "{{m}} में से {{n}}",
   "studio.accessControl.chipPaused": "रुका हुआ",
   "studio.accessControl.createIpPolicy": "IP नीति जोड़ें",
   "studio.accessControl.description": "IP नीति लागू करके इस ऐप तक पहुँच नियंत्रित करें।",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
+  "studio.accessControl.downgradeTitle": "यह ऐप अब सुरक्षित नहीं है",
+  "studio.accessControl.emptyPoliciesTitle": "इस कार्यक्षेत्र में अभी कोई IP नीति नहीं है",
   "studio.accessControl.enableAccessControl": "पहुँच नियंत्रण सक्षम करें",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "पहुँच नियंत्रण",
+  "studio.accessControl.excluded": "बाहर रखा गया",
+  "studio.accessControl.ipPolicy": "IP नीति",
+  "studio.accessControl.lockoutWarning": "आपका IP ({{ip}}) इस नीति में शामिल नहीं है। आप पहुँच खो सकते हैं।",
+  "studio.accessControl.manageIpPolicies": "IP नीतियाँ प्रबंधित करें",
+  "studio.accessControl.notEnabled": "सक्षम नहीं है",
+  "studio.accessControl.paywallDescription": "इस ऐप की पहुँच को केवल भरोसेमंद IP पतों तक सीमित करें।",
+  "studio.accessControl.paywallTitle": "पहुँच नियंत्रण",
   "studio.accessControl.policyChanged": "यह नीति बदल गई है। दोबारा सहेजने से पहले चेतावनी की समीक्षा करें।",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "{{listed}} और {{count}} अन्य पतों को अनुमति देता है",
+  "studio.accessControl.policySummaryNone": "किसी भी पते को अनुमति नहीं देता",
+  "studio.accessControl.policySummaryOne": "{{address}} को अनुमति देता है",
+  "studio.accessControl.policySummaryTwo": "{{first}} और {{second}} को अनुमति देता है",
+  "studio.accessControl.previewAppName": "कोड सहायक",
+  "studio.accessControl.previewCaption": "यह ऐप केवल आपके संगठन के नेटवर्क पर उपलब्ध है।",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "सेवा में मौजूद सभी {{count}} पहुँच बिंदुओं की सुरक्षा की जा रही है।",
+  "studio.accessControl.protectingPartial": "सेवा में मौजूद {{m}} पहुँच बिंदुओं में से {{n}} की सुरक्षा की जा रही है।",
+  "studio.accessControl.protectsCoverage": "{{m}} पहुँच बिंदुओं में से {{n}} की सुरक्षा करता है",
+  "studio.accessControl.readyToResume": "फिर से शुरू करने के लिए तैयार",
+  "studio.accessControl.restrictByIp": "IP पते के आधार पर सीमित करें",
+  "studio.accessControl.restrictedTo": "{{name}} तक सीमित",
+  "studio.accessControl.saveAnyway": "फिर भी सहेजें",
+  "studio.accessControl.saveWithoutOwnIp": "अपने IP को शामिल किए बिना सहेजें?",
+  "studio.accessControl.selectAccessPoint": "कृपया कम से कम एक पहुँच बिंदु चुनें।",
+  "studio.accessControl.selectPolicy": "एक IP नीति चुनें",
   "studio.accessControl.selectPolicyRequired": "कृपया एक IP नीति चुनें।",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "सेट अप नहीं किया गया",
+  "studio.accessControl.tooltipOn": "सभी पहुँच बिंदु",
+  "studio.accessControl.tooltipPartial": "{{total}} पहुँच बिंदुओं में से {{n}}",
+  "studio.accessControl.tooltipPaused": "रुका हुआ — {{name}} कॉन्फ़िगर की गई है, लेकिन लागू नहीं है",
+  "studio.accessControl.tooltipPro": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
+  "studio.accessControl.turnOffConfirm": "बंद करें",
+  "studio.accessControl.turnOffDescription": "{{points}} तक किसी भी IP से पहुँचा जा सकेगा।",
+  "studio.accessControl.turnOffTitle": "पहुँच नियंत्रण बंद करें?",
+  "studio.accessControl.turnOn": "पहुँच नियंत्रण सक्षम करें",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
   "studio.accessPoint.embedIntoSite": "साइट में एम्बेड करें",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index db29a8af22e3f2..2aff58242b18a2 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} alamat",
+  "studio.accessControl.applyTo": "Terapkan ke",
+  "studio.accessControl.applyToHelp": "Pilih titik akses yang dilindungi kebijakan ini.",
+  "studio.accessControl.applyToHelpSelected": "Pilih titik akses yang dilindungi kebijakan ini.",
+  "studio.accessControl.chipOff": "Nonaktif",
+  "studio.accessControl.chipOn": "Aktif",
+  "studio.accessControl.chipPartial": "{{n}} dari {{m}}",
   "studio.accessControl.chipPaused": "Dijeda",
   "studio.accessControl.createIpPolicy": "Tambah kebijakan IP",
   "studio.accessControl.description": "Kontrol akses ke aplikasi ini dengan menerapkan kebijakan IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Kontrol akses tersedia pada paket Professional dan Team.",
+  "studio.accessControl.downgradeTitle": "Aplikasi ini tidak lagi dilindungi",
+  "studio.accessControl.emptyPoliciesTitle": "Belum ada kebijakan IP di ruang kerja ini",
   "studio.accessControl.enableAccessControl": "Aktifkan kontrol akses",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Kontrol akses",
+  "studio.accessControl.excluded": "Dikecualikan",
+  "studio.accessControl.ipPolicy": "Kebijakan IP",
+  "studio.accessControl.lockoutWarning": "IP Anda ({{ip}}) tidak tercakup dalam kebijakan ini. Anda mungkin kehilangan akses.",
+  "studio.accessControl.manageIpPolicies": "Kelola kebijakan IP",
+  "studio.accessControl.notEnabled": "Belum diaktifkan",
+  "studio.accessControl.paywallDescription": "Batasi akses ke aplikasi ini hanya untuk alamat IP yang Anda percayai.",
+  "studio.accessControl.paywallTitle": "Kontrol akses",
   "studio.accessControl.policyChanged": "Kebijakan ini telah berubah. Tinjau peringatan sebelum menyimpan lagi.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
+  "studio.accessControl.policySummaryNone": "Tidak mengizinkan alamat apa pun",
+  "studio.accessControl.policySummaryOne": "Mengizinkan {{address}}",
+  "studio.accessControl.policySummaryTwo": "Mengizinkan {{first}} dan {{second}}",
+  "studio.accessControl.previewAppName": "Asisten kode",
+  "studio.accessControl.previewCaption": "Aplikasi ini hanya tersedia di jaringan organisasi Anda.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Melindungi semua {{count}} titik akses yang beroperasi.",
+  "studio.accessControl.protectingPartial": "Melindungi {{n}} dari {{m}} titik akses yang beroperasi.",
+  "studio.accessControl.protectsCoverage": "Melindungi {{n}} dari {{m}} titik akses",
+  "studio.accessControl.readyToResume": "Siap dilanjutkan",
+  "studio.accessControl.restrictByIp": "Batasi berdasarkan alamat IP",
+  "studio.accessControl.restrictedTo": "Dibatasi sesuai {{name}}",
+  "studio.accessControl.saveAnyway": "Tetap simpan",
+  "studio.accessControl.saveWithoutOwnIp": "Simpan tanpa menyertakan IP Anda sendiri?",
+  "studio.accessControl.selectAccessPoint": "Pilih setidaknya satu titik akses.",
+  "studio.accessControl.selectPolicy": "Pilih kebijakan IP",
   "studio.accessControl.selectPolicyRequired": "Pilih kebijakan IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Belum dikonfigurasi",
+  "studio.accessControl.tooltipOn": "Semua titik akses",
+  "studio.accessControl.tooltipPartial": "{{n}} dari {{total}} titik akses",
+  "studio.accessControl.tooltipPaused": "Dijeda — {{name}} sudah dikonfigurasi tetapi tidak diterapkan",
+  "studio.accessControl.tooltipPro": "Kontrol akses tersedia pada paket Professional dan Team.",
+  "studio.accessControl.turnOffConfirm": "Nonaktifkan",
+  "studio.accessControl.turnOffDescription": "{{points}} akan dapat diakses dari IP mana pun.",
+  "studio.accessControl.turnOffTitle": "Nonaktifkan kontrol akses?",
+  "studio.accessControl.turnOn": "Aktifkan kontrol akses",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
   "studio.accessPoint.embedIntoSite": "Sematkan ke situs",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index a98b615c7230b0..fd21d3afdfd36c 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} indirizzi",
+  "studio.accessControl.applyTo": "Applica a",
+  "studio.accessControl.applyToHelp": "Scegli quali punti di accesso protegge questa policy.",
+  "studio.accessControl.applyToHelpSelected": "Scegli quali punti di accesso protegge questa policy.",
+  "studio.accessControl.chipOff": "Disattivato",
+  "studio.accessControl.chipOn": "Attivato",
+  "studio.accessControl.chipPartial": "{{n}} di {{m}}",
   "studio.accessControl.chipPaused": "In pausa",
   "studio.accessControl.createIpPolicy": "Aggiungi policy IP",
   "studio.accessControl.description": "Controlla l’accesso a questa app applicando una policy IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
+  "studio.accessControl.downgradeTitle": "Questa app non è più protetta",
+  "studio.accessControl.emptyPoliciesTitle": "Non ci sono ancora policy IP in questo spazio di lavoro",
   "studio.accessControl.enableAccessControl": "Abilita il controllo degli accessi",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Controllo degli accessi",
+  "studio.accessControl.excluded": "Escluso",
+  "studio.accessControl.ipPolicy": "Policy IP",
+  "studio.accessControl.lockoutWarning": "Il tuo IP ({{ip}}) non è incluso in questa policy. Potresti perdere l’accesso.",
+  "studio.accessControl.manageIpPolicies": "Gestisci le policy IP",
+  "studio.accessControl.notEnabled": "Non abilitato",
+  "studio.accessControl.paywallDescription": "Limita l’accesso a questa app agli indirizzi IP di cui ti fidi.",
+  "studio.accessControl.paywallTitle": "Controllo degli accessi",
   "studio.accessControl.policyChanged": "Questa policy è cambiata. Controlla l’avviso prima di salvare di nuovo.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Consente {{listed}} e altri {{count}} indirizzi",
+  "studio.accessControl.policySummaryNone": "Non consente alcun indirizzo",
+  "studio.accessControl.policySummaryOne": "Consente {{address}}",
+  "studio.accessControl.policySummaryTwo": "Consente {{first}} e {{second}}",
+  "studio.accessControl.previewAppName": "Assistente di codice",
+  "studio.accessControl.previewCaption": "Questa app è disponibile solo sulla rete della tua organizzazione.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Tutti i {{count}} punti di accesso in servizio sono protetti.",
+  "studio.accessControl.protectingPartial": "{{n}} di {{m}} punti di accesso in servizio sono protetti.",
+  "studio.accessControl.protectsCoverage": "Protegge {{n}} di {{m}} punti di accesso",
+  "studio.accessControl.readyToResume": "Pronto per riprendere",
+  "studio.accessControl.restrictByIp": "Limita per indirizzo IP",
+  "studio.accessControl.restrictedTo": "Limitato a {{name}}",
+  "studio.accessControl.saveAnyway": "Salva comunque",
+  "studio.accessControl.saveWithoutOwnIp": "Salvare senza includere il tuo IP?",
+  "studio.accessControl.selectAccessPoint": "Scegli almeno un punto di accesso.",
+  "studio.accessControl.selectPolicy": "Seleziona una policy IP",
   "studio.accessControl.selectPolicyRequired": "Seleziona una policy IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Non configurato",
+  "studio.accessControl.tooltipOn": "Tutti i punti di accesso",
+  "studio.accessControl.tooltipPartial": "{{n}} di {{total}} punti di accesso",
+  "studio.accessControl.tooltipPaused": "In pausa — {{name}} è configurata ma non viene applicata",
+  "studio.accessControl.tooltipPro": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
+  "studio.accessControl.turnOffConfirm": "Disattiva",
+  "studio.accessControl.turnOffDescription": "{{points}} saranno accessibili da qualsiasi IP.",
+  "studio.accessControl.turnOffTitle": "Disattivare il controllo degli accessi?",
+  "studio.accessControl.turnOn": "Abilita il controllo degli accessi",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
   "studio.accessPoint.embedIntoSite": "Incorpora nel sito",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 204d52b61c9ab5..5c733df560b605 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -38,12 +38,12 @@
   "studio.accessControl.applyToHelp": "このポリシーで保護するアクセスポイントを選択します。",
   "studio.accessControl.applyToHelpSelected": "このポリシーで保護するアクセスポイントを選択します。",
   "studio.accessControl.chipOff": "オフ",
-  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipOn": "オン",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "一時停止",
   "studio.accessControl.createIpPolicy": "IP ポリシーを追加",
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
-  "studio.accessControl.downgradeDescription": "アクセス制御には Pro プランが必要です。",
+  "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.enableAccessControl": "アクセス制御を有効にする",
@@ -78,7 +78,7 @@
   "studio.accessControl.tooltipOn": "すべてのアクセスポイント",
   "studio.accessControl.tooltipPartial": "アクセスポイント {{total}} 個中 {{n}} 個",
   "studio.accessControl.tooltipPaused": "一時停止 — {{name}} は設定済みですが適用されていません",
-  "studio.accessControl.tooltipPro": "アクセス制御には Pro プランが必要です",
+  "studio.accessControl.tooltipPro": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.turnOffConfirm": "オフにする",
   "studio.accessControl.turnOffDescription": "{{points}} は任意の IP から到達できるようになります。",
   "studio.accessControl.turnOffTitle": "アクセス制御をオフにしますか？",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 79968e45b3b51e..9f5ff02ca5afa7 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "주소 {{count}}개",
+  "studio.accessControl.applyTo": "적용 대상",
+  "studio.accessControl.applyToHelp": "이 정책으로 보호할 접근 지점을 선택하세요.",
+  "studio.accessControl.applyToHelpSelected": "이 정책으로 보호할 접근 지점을 선택하세요.",
+  "studio.accessControl.chipOff": "꺼짐",
+  "studio.accessControl.chipOn": "켜짐",
+  "studio.accessControl.chipPartial": "{{m}}개 중 {{n}}개",
   "studio.accessControl.chipPaused": "일시 중지",
   "studio.accessControl.createIpPolicy": "IP 정책 추가",
   "studio.accessControl.description": "IP 정책을 적용하여 이 앱에 대한 접근을 제어합니다.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
+  "studio.accessControl.downgradeTitle": "이 앱은 더 이상 보호되지 않습니다",
+  "studio.accessControl.emptyPoliciesTitle": "이 작업 공간에는 아직 IP 정책이 없습니다",
   "studio.accessControl.enableAccessControl": "접근 제어 활성화",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "접근 제어",
+  "studio.accessControl.excluded": "제외됨",
+  "studio.accessControl.ipPolicy": "IP 정책",
+  "studio.accessControl.lockoutWarning": "현재 IP({{ip}})가 이 정책에 포함되어 있지 않습니다. 접근 권한을 잃을 수 있습니다.",
+  "studio.accessControl.manageIpPolicies": "IP 정책 관리",
+  "studio.accessControl.notEnabled": "활성화되지 않음",
+  "studio.accessControl.paywallDescription": "신뢰하는 IP 주소에서만 이 앱에 접근할 수 있도록 제한합니다.",
+  "studio.accessControl.paywallTitle": "접근 제어",
   "studio.accessControl.policyChanged": "이 정책이 변경되었습니다. 다시 저장하기 전에 경고를 확인하세요.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "{{listed}} 및 {{count}}개의 추가 주소 허용",
+  "studio.accessControl.policySummaryNone": "허용된 주소 없음",
+  "studio.accessControl.policySummaryOne": "{{address}} 허용",
+  "studio.accessControl.policySummaryTwo": "{{first}} 및 {{second}} 허용",
+  "studio.accessControl.previewAppName": "코드 도우미",
+  "studio.accessControl.previewCaption": "이 앱은 조직의 네트워크에서만 사용할 수 있습니다.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "서비스 중인 접근 지점 {{count}}개를 모두 보호하고 있습니다.",
+  "studio.accessControl.protectingPartial": "서비스 중인 접근 지점 {{m}}개 중 {{n}}개를 보호하고 있습니다.",
+  "studio.accessControl.protectsCoverage": "접근 지점 {{m}}개 중 {{n}}개 보호",
+  "studio.accessControl.readyToResume": "재개 준비 완료",
+  "studio.accessControl.restrictByIp": "IP 주소로 제한",
+  "studio.accessControl.restrictedTo": "{{name}} 정책으로 제한됨",
+  "studio.accessControl.saveAnyway": "그래도 저장",
+  "studio.accessControl.saveWithoutOwnIp": "현재 IP를 포함하지 않고 저장할까요?",
+  "studio.accessControl.selectAccessPoint": "접근 지점을 하나 이상 선택하세요.",
+  "studio.accessControl.selectPolicy": "IP 정책 선택",
   "studio.accessControl.selectPolicyRequired": "IP 정책을 선택하세요.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "설정되지 않음",
+  "studio.accessControl.tooltipOn": "모든 접근 지점",
+  "studio.accessControl.tooltipPartial": "접근 지점 {{total}}개 중 {{n}}개",
+  "studio.accessControl.tooltipPaused": "일시 중지됨 — {{name}} 정책이 설정되었지만 적용되지 않고 있습니다",
+  "studio.accessControl.tooltipPro": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
+  "studio.accessControl.turnOffConfirm": "끄기",
+  "studio.accessControl.turnOffDescription": "모든 IP에서 {{points}}에 접근할 수 있게 됩니다.",
+  "studio.accessControl.turnOffTitle": "접근 제어를 끌까요?",
+  "studio.accessControl.turnOn": "접근 제어 활성화",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
   "studio.accessPoint.embedIntoSite": "사이트에 임베드",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index dd58e30dca05c7..b4564ffb6dcfb2 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ຍັງບໍ່ໄດ້ຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "ກຳລັງຖອນການຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ບໍ່ຮູ້ຈັກ",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} ທີ່ຢູ່",
+  "studio.accessControl.applyTo": "ນຳໃຊ້ກັບ",
+  "studio.accessControl.applyToHelp": "ເລືອກຈຸດເຂົ້າເຖິງທີ່ນະໂຍບາຍນີ້ຈະປົກປ້ອງ.",
+  "studio.accessControl.applyToHelpSelected": "ເລືອກຈຸດເຂົ້າເຖິງທີ່ນະໂຍບາຍນີ້ຈະປົກປ້ອງ.",
+  "studio.accessControl.chipOff": "ປິດ",
+  "studio.accessControl.chipOn": "ເປີດ",
+  "studio.accessControl.chipPartial": "{{n}} ຈາກ {{m}}",
   "studio.accessControl.chipPaused": "ຢຸດຊົ່ວຄາວ",
   "studio.accessControl.createIpPolicy": "ເພີ່ມນະໂຍບາຍ IP",
   "studio.accessControl.description": "ຄວບຄຸມການເຂົ້າເຖິງແອັບນີ້ໂດຍນຳໃຊ້ນະໂຍບາຍ IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
+  "studio.accessControl.downgradeTitle": "ແອັບນີ້ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ",
+  "studio.accessControl.emptyPoliciesTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP ໃນພື້ນທີ່ເຮັດວຽກນີ້",
   "studio.accessControl.enableAccessControl": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "ການຄວບຄຸມການເຂົ້າເຖິງ",
+  "studio.accessControl.excluded": "ບໍ່ລວມ",
+  "studio.accessControl.ipPolicy": "ນະໂຍບາຍ IP",
+  "studio.accessControl.lockoutWarning": "IP ຂອງທ່ານ ({{ip}}) ບໍ່ຢູ່ໃນນະໂຍບາຍນີ້. ທ່ານອາດສູນເສຍສິດເຂົ້າເຖິງ.",
+  "studio.accessControl.manageIpPolicies": "ຈັດການນະໂຍບາຍ IP",
+  "studio.accessControl.notEnabled": "ຍັງບໍ່ໄດ້ເປີດໃຊ້",
+  "studio.accessControl.paywallDescription": "ຈຳກັດການເຂົ້າເຖິງແອັບນີ້ໃຫ້ສະເພາະທີ່ຢູ່ IP ທີ່ທ່ານເຊື່ອຖື.",
+  "studio.accessControl.paywallTitle": "ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.policyChanged": "ນະໂຍບາຍນີ້ໄດ້ປ່ຽນແປງແລ້ວ. ກວດເບິ່ງຄຳເຕືອນກ່ອນບັນທຶກອີກຄັ້ງ.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
+  "studio.accessControl.policySummaryNone": "ບໍ່ອະນຸຍາດທີ່ຢູ່ໃດເລີຍ",
+  "studio.accessControl.policySummaryOne": "ອະນຸຍາດ {{address}}",
+  "studio.accessControl.policySummaryTwo": "ອະນຸຍາດ {{first}} ແລະ {{second}}",
+  "studio.accessControl.previewAppName": "ຜູ້ຊ່ວຍຂຽນໂຄດ",
+  "studio.accessControl.previewCaption": "ແອັບນີ້ໃຊ້ໄດ້ສະເພາະໃນເຄືອຂ່າຍຂອງອົງກອນທ່ານ.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "ກຳລັງປົກປ້ອງຈຸດເຂົ້າເຖິງທີ່ໃຫ້ບໍລິການທັງໝົດ {{count}} ຈຸດ.",
+  "studio.accessControl.protectingPartial": "ກຳລັງປົກປ້ອງຈຸດເຂົ້າເຖິງທີ່ໃຫ້ບໍລິການ {{n}} ຈາກ {{m}} ຈຸດ.",
+  "studio.accessControl.protectsCoverage": "ປົກປ້ອງຈຸດເຂົ້າເຖິງ {{n}} ຈາກ {{m}} ຈຸດ",
+  "studio.accessControl.readyToResume": "ພ້ອມດຳເນີນການຕໍ່",
+  "studio.accessControl.restrictByIp": "ຈຳກັດຕາມທີ່ຢູ່ IP",
+  "studio.accessControl.restrictedTo": "ຈຳກັດຕາມ {{name}}",
+  "studio.accessControl.saveAnyway": "ບັນທຶກຕໍ່ໄປ",
+  "studio.accessControl.saveWithoutOwnIp": "ບັນທຶກໂດຍບໍ່ລວມ IP ຂອງທ່ານບໍ?",
+  "studio.accessControl.selectAccessPoint": "ກະລຸນາເລືອກຈຸດເຂົ້າເຖິງຢ່າງໜ້ອຍໜຶ່ງຈຸດ.",
+  "studio.accessControl.selectPolicy": "ເລືອກນະໂຍບາຍ IP",
   "studio.accessControl.selectPolicyRequired": "ກະລຸນາເລືອກນະໂຍບາຍ IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "ຍັງບໍ່ໄດ້ຕັ້ງຄ່າ",
+  "studio.accessControl.tooltipOn": "ຈຸດເຂົ້າເຖິງທັງໝົດ",
+  "studio.accessControl.tooltipPartial": "ຈຸດເຂົ້າເຖິງ {{n}} ຈາກ {{total}} ຈຸດ",
+  "studio.accessControl.tooltipPaused": "ຢຸດຊົ່ວຄາວ — {{name}} ຖືກຕັ້ງຄ່າແລ້ວ ແຕ່ຍັງບໍ່ໄດ້ນຳໃຊ້",
+  "studio.accessControl.tooltipPro": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
+  "studio.accessControl.turnOffConfirm": "ປິດ",
+  "studio.accessControl.turnOffDescription": "ຈະສາມາດເຂົ້າເຖິງ {{points}} ໄດ້ຈາກທຸກ IP.",
+  "studio.accessControl.turnOffTitle": "ປິດການຄວບຄຸມການເຂົ້າເຖິງບໍ?",
+  "studio.accessControl.turnOn": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
   "studio.accessPoint.embedIntoSite": "ຝັງໄວ້ໃນເວັບໄຊ",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 0e077f2d85ae25..7244e39fb34f44 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} adressen",
+  "studio.accessControl.applyTo": "Toepassen op",
+  "studio.accessControl.applyToHelp": "Kies welke toegangspunten door dit beleid worden beschermd.",
+  "studio.accessControl.applyToHelpSelected": "Kies welke toegangspunten door dit beleid worden beschermd.",
+  "studio.accessControl.chipOff": "Uit",
+  "studio.accessControl.chipOn": "Aan",
+  "studio.accessControl.chipPartial": "{{n}} van {{m}}",
   "studio.accessControl.chipPaused": "Gepauzeerd",
   "studio.accessControl.createIpPolicy": "IP-beleid toevoegen",
   "studio.accessControl.description": "Beheer de toegang tot deze app door een IP-beleid toe te passen.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
+  "studio.accessControl.downgradeTitle": "Deze app is niet meer beschermd",
+  "studio.accessControl.emptyPoliciesTitle": "Deze werkruimte heeft nog geen IP-beleid",
   "studio.accessControl.enableAccessControl": "Toegangsbeheer inschakelen",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Toegangsbeheer",
+  "studio.accessControl.excluded": "Uitgesloten",
+  "studio.accessControl.ipPolicy": "IP-beleid",
+  "studio.accessControl.lockoutWarning": "Je IP-adres ({{ip}}) staat niet in dit beleid. Je kunt de toegang verliezen.",
+  "studio.accessControl.manageIpPolicies": "IP-beleid beheren",
+  "studio.accessControl.notEnabled": "Niet ingeschakeld",
+  "studio.accessControl.paywallDescription": "Beperk de toegang tot deze app tot IP-adressen die je vertrouwt.",
+  "studio.accessControl.paywallTitle": "Toegangsbeheer",
   "studio.accessControl.policyChanged": "Dit beleid is gewijzigd. Bekijk de waarschuwing voordat je opnieuw opslaat.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Staat {{listed}} en {{count}} andere adressen toe",
+  "studio.accessControl.policySummaryNone": "Staat geen adressen toe",
+  "studio.accessControl.policySummaryOne": "Staat {{address}} toe",
+  "studio.accessControl.policySummaryTwo": "Staat {{first}} en {{second}} toe",
+  "studio.accessControl.previewAppName": "Code-assistent",
+  "studio.accessControl.previewCaption": "Deze app is alleen beschikbaar op het netwerk van je organisatie.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Alle {{count}} actieve toegangspunten worden beschermd.",
+  "studio.accessControl.protectingPartial": "{{n}} van de {{m}} actieve toegangspunten worden beschermd.",
+  "studio.accessControl.protectsCoverage": "Beschermt {{n}} van de {{m}} toegangspunten",
+  "studio.accessControl.readyToResume": "Klaar om te hervatten",
+  "studio.accessControl.restrictByIp": "Beperken op IP-adres",
+  "studio.accessControl.restrictedTo": "Beperkt tot {{name}}",
+  "studio.accessControl.saveAnyway": "Toch opslaan",
+  "studio.accessControl.saveWithoutOwnIp": "Opslaan zonder je eigen IP-adres?",
+  "studio.accessControl.selectAccessPoint": "Kies ten minste één toegangspunt.",
+  "studio.accessControl.selectPolicy": "Selecteer een IP-beleid",
   "studio.accessControl.selectPolicyRequired": "Selecteer een IP-beleid.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Niet ingesteld",
+  "studio.accessControl.tooltipOn": "Alle toegangspunten",
+  "studio.accessControl.tooltipPartial": "{{n}} van de {{total}} toegangspunten",
+  "studio.accessControl.tooltipPaused": "Gepauzeerd — {{name}} is ingesteld maar wordt niet toegepast",
+  "studio.accessControl.tooltipPro": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
+  "studio.accessControl.turnOffConfirm": "Uitschakelen",
+  "studio.accessControl.turnOffDescription": "{{points}} worden bereikbaar vanaf elk IP-adres.",
+  "studio.accessControl.turnOffTitle": "Toegangsbeheer uitschakelen?",
+  "studio.accessControl.turnOn": "Toegangsbeheer inschakelen",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
   "studio.accessPoint.embedIntoSite": "In site insluiten",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 907351fc7ca27a..84c73f9b26ee27 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "Liczba adresów: {{count}}",
+  "studio.accessControl.applyTo": "Zastosuj do",
+  "studio.accessControl.applyToHelp": "Wybierz punkty dostępu chronione przez tę politykę.",
+  "studio.accessControl.applyToHelpSelected": "Wybierz punkty dostępu chronione przez tę politykę.",
+  "studio.accessControl.chipOff": "Wyłączone",
+  "studio.accessControl.chipOn": "Włączone",
+  "studio.accessControl.chipPartial": "{{n}} z {{m}}",
   "studio.accessControl.chipPaused": "Wstrzymane",
   "studio.accessControl.createIpPolicy": "Dodaj politykę IP",
   "studio.accessControl.description": "Kontroluj dostęp do tej aplikacji, stosując politykę IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Kontrola dostępu jest dostępna w planach Professional i Team.",
+  "studio.accessControl.downgradeTitle": "Ta aplikacja nie jest już chroniona",
+  "studio.accessControl.emptyPoliciesTitle": "W tym obszarze roboczym nie ma jeszcze polityk IP",
   "studio.accessControl.enableAccessControl": "Włącz kontrolę dostępu",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Kontrola dostępu",
+  "studio.accessControl.excluded": "Wykluczony",
+  "studio.accessControl.ipPolicy": "Polityka IP",
+  "studio.accessControl.lockoutWarning": "Twój adres IP ({{ip}}) nie jest uwzględniony w tej polityce. Możesz utracić dostęp.",
+  "studio.accessControl.manageIpPolicies": "Zarządzaj politykami IP",
+  "studio.accessControl.notEnabled": "Niewłączone",
+  "studio.accessControl.paywallDescription": "Ogranicz dostęp do tej aplikacji do zaufanych adresów IP.",
+  "studio.accessControl.paywallTitle": "Kontrola dostępu",
   "studio.accessControl.policyChanged": "Ta polityka uległa zmianie. Sprawdź ostrzeżenie przed ponownym zapisaniem.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryNone": "Nie zezwala na żadne adresy",
+  "studio.accessControl.policySummaryOne": "Zezwala na {{address}}",
+  "studio.accessControl.policySummaryTwo": "Zezwala na {{first}} i {{second}}",
+  "studio.accessControl.previewAppName": "Asystent programowania",
+  "studio.accessControl.previewCaption": "Ta aplikacja jest dostępna tylko w sieci Twojej organizacji.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Chronione są wszystkie aktywne punkty dostępu: {{count}}.",
+  "studio.accessControl.protectingPartial": "Chronione punkty dostępu w użyciu: {{n}} z {{m}}.",
+  "studio.accessControl.protectsCoverage": "Chronione punkty dostępu: {{n}} z {{m}}",
+  "studio.accessControl.readyToResume": "Gotowe do wznowienia",
+  "studio.accessControl.restrictByIp": "Ogranicz według adresu IP",
+  "studio.accessControl.restrictedTo": "Ograniczone do {{name}}",
+  "studio.accessControl.saveAnyway": "Zapisz mimo to",
+  "studio.accessControl.saveWithoutOwnIp": "Zapisać bez uwzględnienia własnego adresu IP?",
+  "studio.accessControl.selectAccessPoint": "Wybierz co najmniej jeden punkt dostępu.",
+  "studio.accessControl.selectPolicy": "Wybierz politykę IP",
   "studio.accessControl.selectPolicyRequired": "Wybierz politykę IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Nieskonfigurowane",
+  "studio.accessControl.tooltipOn": "Wszystkie punkty dostępu",
+  "studio.accessControl.tooltipPartial": "Punkty dostępu: {{n}} z {{total}}",
+  "studio.accessControl.tooltipPaused": "Wstrzymane — polityka {{name}} jest skonfigurowana, ale nie jest stosowana",
+  "studio.accessControl.tooltipPro": "Kontrola dostępu jest dostępna w planach Professional i Team.",
+  "studio.accessControl.turnOffConfirm": "Wyłącz",
+  "studio.accessControl.turnOffDescription": "Punkty dostępu {{points}} będą dostępne z dowolnego adresu IP.",
+  "studio.accessControl.turnOffTitle": "Wyłączyć kontrolę dostępu?",
+  "studio.accessControl.turnOn": "Włącz kontrolę dostępu",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
   "studio.accessPoint.embedIntoSite": "Osadź w witrynie",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 96a67a2115a5b5..72e15f3e65e35a 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} endereços",
+  "studio.accessControl.applyTo": "Aplicar a",
+  "studio.accessControl.applyToHelp": "Escolha quais pontos de acesso esta política protege.",
+  "studio.accessControl.applyToHelpSelected": "Escolha quais pontos de acesso esta política protege.",
+  "studio.accessControl.chipOff": "Desativado",
+  "studio.accessControl.chipOn": "Ativado",
+  "studio.accessControl.chipPartial": "{{n}} de {{m}}",
   "studio.accessControl.chipPaused": "Pausado",
   "studio.accessControl.createIpPolicy": "Adicionar política de IP",
   "studio.accessControl.description": "Controle o acesso a este aplicativo aplicando uma política de IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "O controle de acesso está disponível nos planos Professional e Team.",
+  "studio.accessControl.downgradeTitle": "Este aplicativo não está mais protegido",
+  "studio.accessControl.emptyPoliciesTitle": "Ainda não há políticas de IP neste espaço de trabalho",
   "studio.accessControl.enableAccessControl": "Ativar controle de acesso",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Controle de acesso",
+  "studio.accessControl.excluded": "Excluído",
+  "studio.accessControl.ipPolicy": "Política de IP",
+  "studio.accessControl.lockoutWarning": "Seu IP ({{ip}}) não está incluído nesta política. Você pode perder o acesso.",
+  "studio.accessControl.manageIpPolicies": "Gerenciar políticas de IP",
+  "studio.accessControl.notEnabled": "Não habilitado",
+  "studio.accessControl.paywallDescription": "Restrinja o acesso a este aplicativo a endereços IP confiáveis.",
+  "studio.accessControl.paywallTitle": "Controle de acesso",
   "studio.accessControl.policyChanged": "Esta política mudou. Revise o aviso antes de salvar novamente.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Permite {{listed}} e mais {{count}} endereços",
+  "studio.accessControl.policySummaryNone": "Não permite nenhum endereço",
+  "studio.accessControl.policySummaryOne": "Permite {{address}}",
+  "studio.accessControl.policySummaryTwo": "Permite {{first}} e {{second}}",
+  "studio.accessControl.previewAppName": "Assistente de código",
+  "studio.accessControl.previewCaption": "Este aplicativo está disponível apenas na rede da sua organização.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Protegendo todos os {{count}} pontos de acesso em serviço.",
+  "studio.accessControl.protectingPartial": "Protegendo {{n}} de {{m}} pontos de acesso em serviço.",
+  "studio.accessControl.protectsCoverage": "Protege {{n}} de {{m}} pontos de acesso",
+  "studio.accessControl.readyToResume": "Pronto para retomar",
+  "studio.accessControl.restrictByIp": "Restringir por endereço IP",
+  "studio.accessControl.restrictedTo": "Restrito a {{name}}",
+  "studio.accessControl.saveAnyway": "Salvar mesmo assim",
+  "studio.accessControl.saveWithoutOwnIp": "Salvar sem incluir seu próprio IP?",
+  "studio.accessControl.selectAccessPoint": "Escolha pelo menos um ponto de acesso.",
+  "studio.accessControl.selectPolicy": "Selecione uma política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecione uma política de IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Não configurado",
+  "studio.accessControl.tooltipOn": "Todos os pontos de acesso",
+  "studio.accessControl.tooltipPartial": "{{n}} de {{total}} pontos de acesso",
+  "studio.accessControl.tooltipPaused": "Pausado — {{name}} está configurada, mas não está sendo aplicada",
+  "studio.accessControl.tooltipPro": "O controle de acesso está disponível nos planos Professional e Team.",
+  "studio.accessControl.turnOffConfirm": "Desativar",
+  "studio.accessControl.turnOffDescription": "{{points}} poderão ser acessados de qualquer IP.",
+  "studio.accessControl.turnOffTitle": "Desativar o controle de acesso?",
+  "studio.accessControl.turnOn": "Ativar controle de acesso",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
   "studio.accessPoint.embedIntoSite": "Incorporar ao site",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 82764b20886eff..a7a706ae397f91 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} adrese",
+  "studio.accessControl.applyTo": "Se aplică la",
+  "studio.accessControl.applyToHelp": "Alegeți punctele de acces protejate de această politică.",
+  "studio.accessControl.applyToHelpSelected": "Alegeți punctele de acces protejate de această politică.",
+  "studio.accessControl.chipOff": "Dezactivat",
+  "studio.accessControl.chipOn": "Activat",
+  "studio.accessControl.chipPartial": "{{n}} din {{m}}",
   "studio.accessControl.chipPaused": "Pauză",
   "studio.accessControl.createIpPolicy": "Adăugați o politică IP",
   "studio.accessControl.description": "Controlați accesul la această aplicație aplicând o politică IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Controlul accesului este disponibil în planurile Professional și Team.",
+  "studio.accessControl.downgradeTitle": "Această aplicație nu mai este protejată",
+  "studio.accessControl.emptyPoliciesTitle": "Nu există încă politici IP în acest spațiu de lucru",
   "studio.accessControl.enableAccessControl": "Activați controlul accesului",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Controlul accesului",
+  "studio.accessControl.excluded": "Exclus",
+  "studio.accessControl.ipPolicy": "Politică IP",
+  "studio.accessControl.lockoutWarning": "Adresa dvs. IP ({{ip}}) nu este inclusă în această politică. Puteți pierde accesul.",
+  "studio.accessControl.manageIpPolicies": "Gestionați politicile IP",
+  "studio.accessControl.notEnabled": "Neactivat",
+  "studio.accessControl.paywallDescription": "Limitați accesul la această aplicație la adresele IP de încredere.",
+  "studio.accessControl.paywallTitle": "Controlul accesului",
   "studio.accessControl.policyChanged": "Această politică s-a modificat. Verificați avertismentul înainte de a salva din nou.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Permite {{listed}} și încă {{count}} adrese",
+  "studio.accessControl.policySummaryNone": "Nu permite nicio adresă",
+  "studio.accessControl.policySummaryOne": "Permite {{address}}",
+  "studio.accessControl.policySummaryTwo": "Permite {{first}} și {{second}}",
+  "studio.accessControl.previewAppName": "Asistent de programare",
+  "studio.accessControl.previewCaption": "Această aplicație este disponibilă doar în rețeaua organizației dvs.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Sunt protejate toate cele {{count}} puncte de acces în serviciu.",
+  "studio.accessControl.protectingPartial": "Sunt protejate {{n}} din {{m}} puncte de acces în serviciu.",
+  "studio.accessControl.protectsCoverage": "Protejează {{n}} din {{m}} puncte de acces",
+  "studio.accessControl.readyToResume": "Gata de reluare",
+  "studio.accessControl.restrictByIp": "Restricționați după adresa IP",
+  "studio.accessControl.restrictedTo": "Restricționat la {{name}}",
+  "studio.accessControl.saveAnyway": "Salvați oricum",
+  "studio.accessControl.saveWithoutOwnIp": "Salvați fără propria adresă IP?",
+  "studio.accessControl.selectAccessPoint": "Alegeți cel puțin un punct de acces.",
+  "studio.accessControl.selectPolicy": "Selectați o politică IP",
   "studio.accessControl.selectPolicyRequired": "Selectați o politică IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Neconfigurat",
+  "studio.accessControl.tooltipOn": "Toate punctele de acces",
+  "studio.accessControl.tooltipPartial": "{{n}} din {{total}} puncte de acces",
+  "studio.accessControl.tooltipPaused": "În pauză — {{name}} este configurată, dar nu este aplicată",
+  "studio.accessControl.tooltipPro": "Controlul accesului este disponibil în planurile Professional și Team.",
+  "studio.accessControl.turnOffConfirm": "Dezactivați",
+  "studio.accessControl.turnOffDescription": "{{points}} vor fi accesibile de la orice adresă IP.",
+  "studio.accessControl.turnOffTitle": "Dezactivați controlul accesului?",
+  "studio.accessControl.turnOn": "Activați controlul accesului",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
   "studio.accessPoint.embedIntoSite": "Încorporează în site",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index f66734dbacb3b4..8c19551ca0e848 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "Количество адресов: {{count}}",
+  "studio.accessControl.applyTo": "Применить к",
+  "studio.accessControl.applyToHelp": "Выберите точки доступа, которые защищает эта политика.",
+  "studio.accessControl.applyToHelpSelected": "Выберите точки доступа, которые защищает эта политика.",
+  "studio.accessControl.chipOff": "Выкл.",
+  "studio.accessControl.chipOn": "Вкл.",
+  "studio.accessControl.chipPartial": "{{n}} из {{m}}",
   "studio.accessControl.chipPaused": "Пауза",
   "studio.accessControl.createIpPolicy": "Добавить IP-политику",
   "studio.accessControl.description": "Управляйте доступом к этому приложению с помощью IP-политики.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Управление доступом доступно в тарифах Professional и Team.",
+  "studio.accessControl.downgradeTitle": "Это приложение больше не защищено",
+  "studio.accessControl.emptyPoliciesTitle": "В этом рабочем пространстве пока нет IP-политик",
   "studio.accessControl.enableAccessControl": "Включить контроль доступа",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Контроль доступа",
+  "studio.accessControl.excluded": "Исключено",
+  "studio.accessControl.ipPolicy": "IP-политика",
+  "studio.accessControl.lockoutWarning": "Ваш IP-адрес ({{ip}}) не включён в эту политику. Вы можете потерять доступ.",
+  "studio.accessControl.manageIpPolicies": "Управление IP-политиками",
+  "studio.accessControl.notEnabled": "Не включено",
+  "studio.accessControl.paywallDescription": "Разрешите доступ к этому приложению только с доверенных IP-адресов.",
+  "studio.accessControl.paywallTitle": "Контроль доступа",
   "studio.accessControl.policyChanged": "Эта политика изменилась. Прочитайте предупреждение перед повторным сохранением.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryNone": "Нет разрешённых адресов",
+  "studio.accessControl.policySummaryOne": "Разрешён {{address}}",
+  "studio.accessControl.policySummaryTwo": "Разрешены {{first}} и {{second}}",
+  "studio.accessControl.previewAppName": "Помощник программиста",
+  "studio.accessControl.previewCaption": "Это приложение доступно только в сети вашей организации.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Защищены все действующие точки доступа: {{count}}.",
+  "studio.accessControl.protectingPartial": "Защищено действующих точек доступа: {{n}} из {{m}}.",
+  "studio.accessControl.protectsCoverage": "Защищено точек доступа: {{n}} из {{m}}",
+  "studio.accessControl.readyToResume": "Готово к возобновлению",
+  "studio.accessControl.restrictByIp": "Ограничить по IP-адресу",
+  "studio.accessControl.restrictedTo": "Ограничено политикой {{name}}",
+  "studio.accessControl.saveAnyway": "Всё равно сохранить",
+  "studio.accessControl.saveWithoutOwnIp": "Сохранить без вашего IP-адреса?",
+  "studio.accessControl.selectAccessPoint": "Выберите хотя бы одну точку доступа.",
+  "studio.accessControl.selectPolicy": "Выберите IP-политику",
   "studio.accessControl.selectPolicyRequired": "Выберите IP-политику.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Не настроено",
+  "studio.accessControl.tooltipOn": "Все точки доступа",
+  "studio.accessControl.tooltipPartial": "Точки доступа: {{n}} из {{total}}",
+  "studio.accessControl.tooltipPaused": "Приостановлено — политика {{name}} настроена, но не применяется",
+  "studio.accessControl.tooltipPro": "Управление доступом доступно в тарифах Professional и Team.",
+  "studio.accessControl.turnOffConfirm": "Выключить",
+  "studio.accessControl.turnOffDescription": "Точки доступа {{points}} станут доступны с любого IP-адреса.",
+  "studio.accessControl.turnOffTitle": "Выключить контроль доступа?",
+  "studio.accessControl.turnOn": "Включить контроль доступа",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
   "studio.accessPoint.embedIntoSite": "Встроить на сайт",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 51cc550884f30b..8a4fe7d54b32b5 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "Število naslovov: {{count}}",
+  "studio.accessControl.applyTo": "Uporabi za",
+  "studio.accessControl.applyToHelp": "Izberite dostopne točke, ki jih varuje ta pravilnik.",
+  "studio.accessControl.applyToHelpSelected": "Izberite dostopne točke, ki jih varuje ta pravilnik.",
+  "studio.accessControl.chipOff": "Izklopljeno",
+  "studio.accessControl.chipOn": "Vklopljeno",
+  "studio.accessControl.chipPartial": "{{n}} od {{m}}",
   "studio.accessControl.chipPaused": "Začasno ustavljeno",
   "studio.accessControl.createIpPolicy": "Dodaj pravilnik IP",
   "studio.accessControl.description": "Nadzirajte dostop do te aplikacije z uporabo pravilnika IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Nadzor dostopa je na voljo v paketih Professional in Team.",
+  "studio.accessControl.downgradeTitle": "Ta aplikacija ni več zaščitena",
+  "studio.accessControl.emptyPoliciesTitle": "V tem delovnem prostoru še ni pravilnikov IP",
   "studio.accessControl.enableAccessControl": "Omogoči nadzor dostopa",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Nadzor dostopa",
+  "studio.accessControl.excluded": "Izključeno",
+  "studio.accessControl.ipPolicy": "Pravilnik IP",
+  "studio.accessControl.lockoutWarning": "Vaš naslov IP ({{ip}}) ni vključen v ta pravilnik. Lahko izgubite dostop.",
+  "studio.accessControl.manageIpPolicies": "Upravljaj pravilnike IP",
+  "studio.accessControl.notEnabled": "Ni omogočeno",
+  "studio.accessControl.paywallDescription": "Omejite dostop do te aplikacije na naslove IP, ki jim zaupate.",
+  "studio.accessControl.paywallTitle": "Nadzor dostopa",
   "studio.accessControl.policyChanged": "Ta pravilnik se je spremenil. Pred ponovnim shranjevanjem preglejte opozorilo.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryNone": "Ne dovoljuje nobenega naslova",
+  "studio.accessControl.policySummaryOne": "Dovoljuje {{address}}",
+  "studio.accessControl.policySummaryTwo": "Dovoljuje {{first}} in {{second}}",
+  "studio.accessControl.previewAppName": "Pomočnik za programiranje",
+  "studio.accessControl.previewCaption": "Ta aplikacija je na voljo samo v omrežju vaše organizacije.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Zaščitene so vse aktivne dostopne točke: {{count}}.",
+  "studio.accessControl.protectingPartial": "Zaščitene aktivne dostopne točke: {{n}} od {{m}}.",
+  "studio.accessControl.protectsCoverage": "Zaščitene dostopne točke: {{n}} od {{m}}",
+  "studio.accessControl.readyToResume": "Pripravljeno za nadaljevanje",
+  "studio.accessControl.restrictByIp": "Omeji glede na naslov IP",
+  "studio.accessControl.restrictedTo": "Omejeno na {{name}}",
+  "studio.accessControl.saveAnyway": "Vseeno shrani",
+  "studio.accessControl.saveWithoutOwnIp": "Želite shraniti brez svojega naslova IP?",
+  "studio.accessControl.selectAccessPoint": "Izberite vsaj eno dostopno točko.",
+  "studio.accessControl.selectPolicy": "Izberite pravilnik IP",
   "studio.accessControl.selectPolicyRequired": "Izberite pravilnik IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Ni nastavljeno",
+  "studio.accessControl.tooltipOn": "Vse dostopne točke",
+  "studio.accessControl.tooltipPartial": "Dostopne točke: {{n}} od {{total}}",
+  "studio.accessControl.tooltipPaused": "Začasno ustavljeno — {{name}} je nastavljen, vendar se ne uveljavlja",
+  "studio.accessControl.tooltipPro": "Nadzor dostopa je na voljo v paketih Professional in Team.",
+  "studio.accessControl.turnOffConfirm": "Izklopi",
+  "studio.accessControl.turnOffDescription": "{{points}} bodo dosegljive s katerega koli naslova IP.",
+  "studio.accessControl.turnOffTitle": "Želite izklopiti nadzor dostopa?",
+  "studio.accessControl.turnOn": "Omogoči nadzor dostopa",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
   "studio.accessPoint.embedIntoSite": "Vdelaj v spletno mesto",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 3128544e4ef187..69cc10e60a39a6 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} ที่อยู่",
+  "studio.accessControl.applyTo": "ใช้กับ",
+  "studio.accessControl.applyToHelp": "เลือกจุดเข้าใช้งานที่นโยบายนี้จะปกป้อง",
+  "studio.accessControl.applyToHelpSelected": "เลือกจุดเข้าใช้งานที่นโยบายนี้จะปกป้อง",
+  "studio.accessControl.chipOff": "ปิด",
+  "studio.accessControl.chipOn": "เปิด",
+  "studio.accessControl.chipPartial": "{{n}} จาก {{m}}",
   "studio.accessControl.chipPaused": "หยุดชั่วคราว",
   "studio.accessControl.createIpPolicy": "เพิ่มนโยบาย IP",
   "studio.accessControl.description": "ควบคุมการเข้าถึงแอปนี้โดยใช้นโยบาย IP",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
+  "studio.accessControl.downgradeTitle": "แอปนี้ไม่ได้รับการปกป้องอีกต่อไป",
+  "studio.accessControl.emptyPoliciesTitle": "ยังไม่มีนโยบาย IP ในพื้นที่ทำงานนี้",
   "studio.accessControl.enableAccessControl": "เปิดใช้งานการควบคุมการเข้าถึง",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "การควบคุมการเข้าถึง",
+  "studio.accessControl.excluded": "ไม่รวม",
+  "studio.accessControl.ipPolicy": "นโยบาย IP",
+  "studio.accessControl.lockoutWarning": "IP ของคุณ ({{ip}}) ไม่ได้อยู่ในนโยบายนี้ คุณอาจสูญเสียสิทธิ์การเข้าถึง",
+  "studio.accessControl.manageIpPolicies": "จัดการนโยบาย IP",
+  "studio.accessControl.notEnabled": "ยังไม่เปิดใช้งาน",
+  "studio.accessControl.paywallDescription": "จำกัดการเข้าถึงแอปนี้เฉพาะที่อยู่ IP ที่คุณเชื่อถือ",
+  "studio.accessControl.paywallTitle": "การควบคุมการเข้าถึง",
   "studio.accessControl.policyChanged": "นโยบายนี้มีการเปลี่ยนแปลง โปรดตรวจสอบคำเตือนก่อนบันทึกอีกครั้ง",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
+  "studio.accessControl.policySummaryNone": "ไม่อนุญาตที่อยู่ใดเลย",
+  "studio.accessControl.policySummaryOne": "อนุญาต {{address}}",
+  "studio.accessControl.policySummaryTwo": "อนุญาต {{first}} และ {{second}}",
+  "studio.accessControl.previewAppName": "ผู้ช่วยเขียนโค้ด",
+  "studio.accessControl.previewCaption": "แอปนี้ใช้งานได้เฉพาะบนเครือข่ายขององค์กรของคุณเท่านั้น",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "กำลังปกป้องจุดเข้าใช้งานที่ให้บริการทั้งหมด {{count}} จุด",
+  "studio.accessControl.protectingPartial": "กำลังปกป้องจุดเข้าใช้งานที่ให้บริการ {{n}} จาก {{m}} จุด",
+  "studio.accessControl.protectsCoverage": "ปกป้องจุดเข้าใช้งาน {{n}} จาก {{m}} จุด",
+  "studio.accessControl.readyToResume": "พร้อมกลับมาทำงานต่อ",
+  "studio.accessControl.restrictByIp": "จำกัดตามที่อยู่ IP",
+  "studio.accessControl.restrictedTo": "จำกัดตาม {{name}}",
+  "studio.accessControl.saveAnyway": "บันทึกต่อไป",
+  "studio.accessControl.saveWithoutOwnIp": "บันทึกโดยไม่รวม IP ของคุณเองหรือไม่?",
+  "studio.accessControl.selectAccessPoint": "โปรดเลือกจุดเข้าใช้งานอย่างน้อยหนึ่งจุด",
+  "studio.accessControl.selectPolicy": "เลือกนโยบาย IP",
   "studio.accessControl.selectPolicyRequired": "โปรดเลือกนโยบาย IP",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "ยังไม่ได้ตั้งค่า",
+  "studio.accessControl.tooltipOn": "จุดเข้าใช้งานทั้งหมด",
+  "studio.accessControl.tooltipPartial": "จุดเข้าใช้งาน {{n}} จาก {{total}} จุด",
+  "studio.accessControl.tooltipPaused": "หยุดชั่วคราว — ตั้งค่า {{name}} แล้ว แต่ยังไม่ได้บังคับใช้",
+  "studio.accessControl.tooltipPro": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
+  "studio.accessControl.turnOffConfirm": "ปิด",
+  "studio.accessControl.turnOffDescription": "จะสามารถเข้าถึง {{points}} ได้จากทุก IP",
+  "studio.accessControl.turnOffTitle": "ปิดการควบคุมการเข้าถึงหรือไม่?",
+  "studio.accessControl.turnOn": "เปิดใช้งานการควบคุมการเข้าถึง",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
   "studio.accessPoint.embedIntoSite": "ฝังในเว็บไซต์",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 82abf6476683da..a604d35a1bc20d 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} adres",
+  "studio.accessControl.applyTo": "Uygulanacak noktalar",
+  "studio.accessControl.applyToHelp": "Bu politikanın koruyacağı erişim noktalarını seçin.",
+  "studio.accessControl.applyToHelpSelected": "Bu politikanın koruyacağı erişim noktalarını seçin.",
+  "studio.accessControl.chipOff": "Kapalı",
+  "studio.accessControl.chipOn": "Açık",
+  "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "Duraklatıldı",
   "studio.accessControl.createIpPolicy": "IP politikası ekle",
   "studio.accessControl.description": "Bir IP politikası uygulayarak bu uygulamaya erişimi denetleyin.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
+  "studio.accessControl.downgradeTitle": "Bu uygulama artık korunmuyor",
+  "studio.accessControl.emptyPoliciesTitle": "Bu çalışma alanında henüz IP politikası yok",
   "studio.accessControl.enableAccessControl": "Erişim denetimini etkinleştir",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Erişim kontrolü",
+  "studio.accessControl.excluded": "Kapsam dışında",
+  "studio.accessControl.ipPolicy": "IP politikası",
+  "studio.accessControl.lockoutWarning": "IP adresiniz ({{ip}}) bu politikada yer almıyor. Erişiminizi kaybedebilirsiniz.",
+  "studio.accessControl.manageIpPolicies": "IP politikalarını yönet",
+  "studio.accessControl.notEnabled": "Etkin değil",
+  "studio.accessControl.paywallDescription": "Bu uygulamaya erişimi güvendiğiniz IP adresleriyle sınırlayın.",
+  "studio.accessControl.paywallTitle": "Erişim kontrolü",
   "studio.accessControl.policyChanged": "Bu politika değişti. Yeniden kaydetmeden önce uyarıyı inceleyin.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "{{listed}} ve {{count}} adrese daha izin verir",
+  "studio.accessControl.policySummaryNone": "Hiçbir adrese izin vermez",
+  "studio.accessControl.policySummaryOne": "{{address}} adresine izin verir",
+  "studio.accessControl.policySummaryTwo": "{{first}} ve {{second}} adreslerine izin verir",
+  "studio.accessControl.previewAppName": "Kod asistanı",
+  "studio.accessControl.previewCaption": "Bu uygulamaya yalnızca kuruluşunuzun ağından erişilebilir.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Hizmetteki {{count}} erişim noktasının tamamı korunuyor.",
+  "studio.accessControl.protectingPartial": "Hizmetteki {{m}} erişim noktasından {{n}} tanesi korunuyor.",
+  "studio.accessControl.protectsCoverage": "{{m}} erişim noktasından {{n}} tanesini korur",
+  "studio.accessControl.readyToResume": "Devam etmeye hazır",
+  "studio.accessControl.restrictByIp": "IP adresine göre kısıtla",
+  "studio.accessControl.restrictedTo": "{{name}} ile kısıtlı",
+  "studio.accessControl.saveAnyway": "Yine de kaydet",
+  "studio.accessControl.saveWithoutOwnIp": "Kendi IP adresiniz olmadan kaydedilsin mi?",
+  "studio.accessControl.selectAccessPoint": "Lütfen en az bir erişim noktası seçin.",
+  "studio.accessControl.selectPolicy": "Bir IP politikası seçin",
   "studio.accessControl.selectPolicyRequired": "Lütfen bir IP politikası seçin.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Yapılandırılmadı",
+  "studio.accessControl.tooltipOn": "Tüm erişim noktaları",
+  "studio.accessControl.tooltipPartial": "{{total}} erişim noktasından {{n}} tanesi",
+  "studio.accessControl.tooltipPaused": "Duraklatıldı — {{name}} yapılandırıldı ancak uygulanmıyor",
+  "studio.accessControl.tooltipPro": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
+  "studio.accessControl.turnOffConfirm": "Kapat",
+  "studio.accessControl.turnOffDescription": "{{points}} herhangi bir IP adresinden erişilebilir olacak.",
+  "studio.accessControl.turnOffTitle": "Erişim kontrolü kapatılsın mı?",
+  "studio.accessControl.turnOn": "Erişim denetimini etkinleştir",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
   "studio.accessPoint.embedIntoSite": "Siteye göm",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index d93289d59ee316..93a63bde58e754 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "Кількість адрес: {{count}}",
+  "studio.accessControl.applyTo": "Застосувати до",
+  "studio.accessControl.applyToHelp": "Виберіть точки доступу, які захищає ця політика.",
+  "studio.accessControl.applyToHelpSelected": "Виберіть точки доступу, які захищає ця політика.",
+  "studio.accessControl.chipOff": "Вимк.",
+  "studio.accessControl.chipOn": "Увімк.",
+  "studio.accessControl.chipPartial": "{{n}} із {{m}}",
   "studio.accessControl.chipPaused": "Призупинено",
   "studio.accessControl.createIpPolicy": "Додати IP-політику",
   "studio.accessControl.description": "Керуйте доступом до цього застосунку за допомогою IP-політики.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Керування доступом доступне в планах Professional і Team.",
+  "studio.accessControl.downgradeTitle": "Цей застосунок більше не захищено",
+  "studio.accessControl.emptyPoliciesTitle": "У цьому робочому просторі ще немає IP-політик",
   "studio.accessControl.enableAccessControl": "Увімкнути контроль доступу",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Контроль доступу",
+  "studio.accessControl.excluded": "Виключено",
+  "studio.accessControl.ipPolicy": "IP-політика",
+  "studio.accessControl.lockoutWarning": "Вашу IP-адресу ({{ip}}) не включено до цієї політики. Ви можете втратити доступ.",
+  "studio.accessControl.manageIpPolicies": "Керувати IP-політиками",
+  "studio.accessControl.notEnabled": "Не ввімкнено",
+  "studio.accessControl.paywallDescription": "Дозвольте доступ до цього застосунку лише з довірених IP-адрес.",
+  "studio.accessControl.paywallTitle": "Контроль доступу",
   "studio.accessControl.policyChanged": "Цю політику змінено. Перегляньте попередження перед повторним збереженням.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryNone": "Немає дозволених адрес",
+  "studio.accessControl.policySummaryOne": "Дозволено {{address}}",
+  "studio.accessControl.policySummaryTwo": "Дозволено {{first}} і {{second}}",
+  "studio.accessControl.previewAppName": "Помічник програміста",
+  "studio.accessControl.previewCaption": "Цей застосунок доступний лише в мережі вашої організації.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Захищено всі діючі точки доступу: {{count}}.",
+  "studio.accessControl.protectingPartial": "Захищено діючих точок доступу: {{n}} із {{m}}.",
+  "studio.accessControl.protectsCoverage": "Захищено точок доступу: {{n}} із {{m}}",
+  "studio.accessControl.readyToResume": "Готово до відновлення",
+  "studio.accessControl.restrictByIp": "Обмежити за IP-адресою",
+  "studio.accessControl.restrictedTo": "Обмежено політикою {{name}}",
+  "studio.accessControl.saveAnyway": "Усе одно зберегти",
+  "studio.accessControl.saveWithoutOwnIp": "Зберегти без вашої IP-адреси?",
+  "studio.accessControl.selectAccessPoint": "Виберіть принаймні одну точку доступу.",
+  "studio.accessControl.selectPolicy": "Виберіть IP-політику",
   "studio.accessControl.selectPolicyRequired": "Виберіть IP-політику.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Не налаштовано",
+  "studio.accessControl.tooltipOn": "Усі точки доступу",
+  "studio.accessControl.tooltipPartial": "Точки доступу: {{n}} із {{total}}",
+  "studio.accessControl.tooltipPaused": "Призупинено — політику {{name}} налаштовано, але вона не застосовується",
+  "studio.accessControl.tooltipPro": "Керування доступом доступне в планах Professional і Team.",
+  "studio.accessControl.turnOffConfirm": "Вимкнути",
+  "studio.accessControl.turnOffDescription": "Точки доступу {{points}} стануть доступними з будь-якої IP-адреси.",
+  "studio.accessControl.turnOffTitle": "Вимкнути контроль доступу?",
+  "studio.accessControl.turnOn": "Увімкнути контроль доступу",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
   "studio.accessPoint.embedIntoSite": "Вбудувати на сайт",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 60d701afe4d07f..4abb5f83b91e62 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -33,56 +33,56 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
-  "studio.accessControl.addressCount": "{{count}} addresses",
-  "studio.accessControl.applyTo": "Apply to",
-  "studio.accessControl.applyToHelp": "Choose which access points to protect.",
-  "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
-  "studio.accessControl.chipPartial": "{{n}} of {{m}}",
+  "studio.accessControl.addressCount": "{{count}} địa chỉ",
+  "studio.accessControl.applyTo": "Áp dụng cho",
+  "studio.accessControl.applyToHelp": "Chọn các điểm truy cập được chính sách này bảo vệ.",
+  "studio.accessControl.applyToHelpSelected": "Chọn các điểm truy cập được chính sách này bảo vệ.",
+  "studio.accessControl.chipOff": "Tắt",
+  "studio.accessControl.chipOn": "Bật",
+  "studio.accessControl.chipPartial": "{{n}} trên {{m}}",
   "studio.accessControl.chipPaused": "Tạm dừng",
   "studio.accessControl.createIpPolicy": "Thêm chính sách IP",
   "studio.accessControl.description": "Kiểm soát quyền truy cập ứng dụng này bằng cách áp dụng chính sách IP.",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
-  "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
+  "studio.accessControl.downgradeDescription": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
+  "studio.accessControl.downgradeTitle": "Ứng dụng này không còn được bảo vệ",
+  "studio.accessControl.emptyPoliciesTitle": "Chưa có chính sách IP nào trong không gian làm việc này",
   "studio.accessControl.enableAccessControl": "Bật kiểm soát truy cập",
-  "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
-  "studio.accessControl.ipPolicy": "IP Policy",
-  "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
-  "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.entryLabel": "Kiểm soát truy cập",
+  "studio.accessControl.excluded": "Đã loại trừ",
+  "studio.accessControl.ipPolicy": "Chính sách IP",
+  "studio.accessControl.lockoutWarning": "IP của bạn ({{ip}}) không nằm trong chính sách này. Bạn có thể mất quyền truy cập.",
+  "studio.accessControl.manageIpPolicies": "Quản lý chính sách IP",
+  "studio.accessControl.notEnabled": "Chưa bật",
+  "studio.accessControl.paywallDescription": "Chỉ cho phép truy cập ứng dụng này từ các địa chỉ IP mà bạn tin cậy.",
+  "studio.accessControl.paywallTitle": "Kiểm soát truy cập",
   "studio.accessControl.policyChanged": "Chính sách này đã thay đổi. Hãy xem lại cảnh báo trước khi lưu lại.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
-  "studio.accessControl.policySummaryNone": "Allows no addresses",
-  "studio.accessControl.policySummaryOne": "Allows {{address}}",
-  "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
-  "studio.accessControl.previewAppName": "Code Companion",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.policySummaryMany": "Cho phép {{listed}} và {{count}} địa chỉ khác",
+  "studio.accessControl.policySummaryNone": "Không cho phép địa chỉ nào",
+  "studio.accessControl.policySummaryOne": "Cho phép {{address}}",
+  "studio.accessControl.policySummaryTwo": "Cho phép {{first}} và {{second}}",
+  "studio.accessControl.previewAppName": "Trợ lý lập trình",
+  "studio.accessControl.previewCaption": "Ứng dụng này chỉ khả dụng trong mạng của tổ chức bạn.",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "Protecting all {{count}} access points in service.",
-  "studio.accessControl.protectingPartial": "Protecting {{n}} of {{m}} access points in service.",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
-  "studio.accessControl.restrictByIp": "Restrict by IP address",
-  "studio.accessControl.restrictedTo": "Restricted to {{name}}",
-  "studio.accessControl.saveAnyway": "Save anyway",
-  "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Select at least one access point to protect.",
-  "studio.accessControl.selectPolicy": "Select a policy",
+  "studio.accessControl.protectingAll": "Đang bảo vệ tất cả {{count}} điểm truy cập đang hoạt động.",
+  "studio.accessControl.protectingPartial": "Đang bảo vệ {{n}} trên {{m}} điểm truy cập đang hoạt động.",
+  "studio.accessControl.protectsCoverage": "Bảo vệ {{n}} trên {{m}} điểm truy cập",
+  "studio.accessControl.readyToResume": "Sẵn sàng tiếp tục",
+  "studio.accessControl.restrictByIp": "Giới hạn theo địa chỉ IP",
+  "studio.accessControl.restrictedTo": "Giới hạn theo {{name}}",
+  "studio.accessControl.saveAnyway": "Vẫn lưu",
+  "studio.accessControl.saveWithoutOwnIp": "Lưu mà không có IP của chính bạn?",
+  "studio.accessControl.selectAccessPoint": "Vui lòng chọn ít nhất một điểm truy cập.",
+  "studio.accessControl.selectPolicy": "Chọn chính sách IP",
   "studio.accessControl.selectPolicyRequired": "Vui lòng chọn chính sách IP.",
-  "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "all access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.tooltipPro": "Access control requires the Pro plan",
-  "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.tooltipOff": "Chưa thiết lập",
+  "studio.accessControl.tooltipOn": "Tất cả điểm truy cập",
+  "studio.accessControl.tooltipPartial": "{{n}} trên {{total}} điểm truy cập",
+  "studio.accessControl.tooltipPaused": "Đã tạm dừng — {{name}} đã được cấu hình nhưng chưa được áp dụng",
+  "studio.accessControl.tooltipPro": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
+  "studio.accessControl.turnOffConfirm": "Tắt",
+  "studio.accessControl.turnOffDescription": "Có thể truy cập {{points}} từ bất kỳ IP nào.",
+  "studio.accessControl.turnOffTitle": "Tắt kiểm soát truy cập?",
+  "studio.accessControl.turnOn": "Bật kiểm soát truy cập",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
   "studio.accessPoint.embedIntoSite": "Nhúng vào trang web",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index a634fcef24fd98..6f9e341b2e3256 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -38,12 +38,12 @@
   "studio.accessControl.applyToHelp": "选择此策略保护的访问入口。",
   "studio.accessControl.applyToHelpSelected": "选择此策略保护的访问入口。",
   "studio.accessControl.chipOff": "关闭",
-  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipOn": "开启",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "暂停",
   "studio.accessControl.createIpPolicy": "添加 IP 策略",
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
-  "studio.accessControl.downgradeDescription": "访问控制需要 Pro 套餐。",
+  "studio.accessControl.downgradeDescription": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.enableAccessControl": "启用访问控制",
@@ -78,7 +78,7 @@
   "studio.accessControl.tooltipOn": "全部访问入口",
   "studio.accessControl.tooltipPartial": "{{total}} 个访问入口中的 {{n}} 个",
   "studio.accessControl.tooltipPaused": "已暂停 — {{name}} 已配置但未生效",
-  "studio.accessControl.tooltipPro": "访问控制需要 Pro 套餐",
+  "studio.accessControl.tooltipPro": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.turnOffConfirm": "关闭",
   "studio.accessControl.turnOffDescription": "{{points}} 将可被任意 IP 访问。",
   "studio.accessControl.turnOffTitle": "关闭访问控制？",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 588469f6476df0..da5dfb36139117 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -37,36 +37,36 @@
   "studio.accessControl.applyTo": "套用至",
   "studio.accessControl.applyToHelp": "選擇要保護的存取點。",
   "studio.accessControl.applyToHelpSelected": "選擇此策略要保護的存取點。",
-  "studio.accessControl.chipOff": "Off",
-  "studio.accessControl.chipOn": "ON",
+  "studio.accessControl.chipOff": "關閉",
+  "studio.accessControl.chipOn": "開啟",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "暫停",
   "studio.accessControl.createIpPolicy": "新增 IP 原則",
   "studio.accessControl.description": "透過套用 IP 原則來控制對此應用程式的存取。",
-  "studio.accessControl.downgradeDescription": "Access control needs the Pro plan.",
-  "studio.accessControl.downgradeTitle": "This app is no longer protected",
+  "studio.accessControl.downgradeDescription": "存取控制功能適用於 Professional 和 Team 方案。",
+  "studio.accessControl.downgradeTitle": "此應用程式已不再受保護",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
   "studio.accessControl.enableAccessControl": "啟用存取控制",
-  "studio.accessControl.entryLabel": "Access Control",
+  "studio.accessControl.entryLabel": "存取控制",
   "studio.accessControl.excluded": "未涵蓋",
   "studio.accessControl.ipPolicy": "IP 策略",
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能會失去存取權限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
   "studio.accessControl.notEnabled": "未啟用",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.paywallDescription": "僅允許您信任的 IP 位址存取此應用程式。",
+  "studio.accessControl.paywallTitle": "存取控制",
   "studio.accessControl.policyChanged": "此原則已變更，請確認風險提示後再次儲存。",
   "studio.accessControl.policySummaryMany": "允許 {{listed}} 以及另外 {{count}} 個地址",
   "studio.accessControl.policySummaryNone": "未允許任何地址",
   "studio.accessControl.policySummaryOne": "允許 {{address}}",
   "studio.accessControl.policySummaryTwo": "允許 {{first}} 和 {{second}}",
   "studio.accessControl.previewAppName": "程式助手",
-  "studio.accessControl.previewCaption": "This app is only available on your organization's network.",
+  "studio.accessControl.previewCaption": "此應用程式僅可在您組織的網路中使用。",
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "正在保護全部 {{count}} 個服務中的存取點。",
   "studio.accessControl.protectingPartial": "正在保護 {{n}} / {{m}} 個服務中的存取點。",
-  "studio.accessControl.protectsCoverage": "Protects {{n}} of {{m}} access points",
-  "studio.accessControl.readyToResume": "Ready to resume",
+  "studio.accessControl.protectsCoverage": "保護 {{m}} 個存取點中的 {{n}} 個",
+  "studio.accessControl.readyToResume": "可隨時恢復",
   "studio.accessControl.restrictByIp": "依 IP 位址限制",
   "studio.accessControl.restrictedTo": "已限制為 {{name}}",
   "studio.accessControl.saveAnyway": "仍要儲存",
@@ -78,11 +78,11 @@
   "studio.accessControl.tooltipOn": "涵蓋全部存取點",
   "studio.accessControl.tooltipPartial": "{{n}} / {{total}} 個存取點",
   "studio.accessControl.tooltipPaused": "已暫停 — {{name}} 已設定但未生效",
-  "studio.accessControl.tooltipPro": "存取控制需要 Pro 方案",
+  "studio.accessControl.tooltipPro": "存取控制功能適用於 Professional 和 Team 方案。",
   "studio.accessControl.turnOffConfirm": "關閉",
   "studio.accessControl.turnOffDescription": "{{points}} 將可被任意 IP 存取。",
   "studio.accessControl.turnOffTitle": "關閉存取控制？",
-  "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.turnOn": "啟用存取控制",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",
   "studio.accessPoint.embedIntoSite": "嵌入網站",

From 0a4f5d065cf8c46abc8244cf6f43562a9f83ae08 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 22 Sep 2026 11:55:24 +0800
Subject: [PATCH 062/108] fix: clarify access control toggles and protection
 tooltips

---
 .../access-control/__tests__/index.spec.tsx   | 118 +++++++++++++++---
 .../app/access-point/access-control/index.tsx |  19 ++-
 .../access-control/status-panel.tsx           |  16 +--
 .../access/__tests__/page.spec.tsx            |   2 +-
 web/i18n/ar-TN/deployments.json               |   8 +-
 web/i18n/de-DE/deployments.json               |   8 +-
 web/i18n/en-US/deployments.json               |   8 +-
 web/i18n/es-ES/deployments.json               |   8 +-
 web/i18n/fa-IR/deployments.json               |   8 +-
 web/i18n/fr-FR/deployments.json               |   8 +-
 web/i18n/hi-IN/deployments.json               |   8 +-
 web/i18n/id-ID/deployments.json               |   8 +-
 web/i18n/it-IT/deployments.json               |   8 +-
 web/i18n/ja-JP/deployments.json               |   8 +-
 web/i18n/ko-KR/deployments.json               |   8 +-
 web/i18n/lo-LA/deployments.json               |   8 +-
 web/i18n/nl-NL/deployments.json               |   8 +-
 web/i18n/pl-PL/deployments.json               |   8 +-
 web/i18n/pt-BR/deployments.json               |   8 +-
 web/i18n/ro-RO/deployments.json               |   8 +-
 web/i18n/ru-RU/deployments.json               |   8 +-
 web/i18n/sl-SI/deployments.json               |   8 +-
 web/i18n/th-TH/deployments.json               |   8 +-
 web/i18n/tr-TR/deployments.json               |   8 +-
 web/i18n/uk-UA/deployments.json               |   8 +-
 web/i18n/vi-VN/deployments.json               |   8 +-
 web/i18n/zh-Hans/deployments.json             |   8 +-
 web/i18n/zh-Hant/deployments.json             |   8 +-
 28 files changed, 209 insertions(+), 138 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index a10a53fd677796..51feb7cd59983e 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -189,6 +189,11 @@ describe('AccessControlEntry', () => {
       })
 
       expect(within(getChip()).getByText('PRO')).toBeInTheDocument()
+      await user.hover(getChip())
+      expect(
+        await screen.findByText('No longer protected — available on Professional and Team plans'),
+      ).toBeInTheDocument()
+      await user.unhover(getChip())
       await user.click(getChip())
       expect(screen.getByText('This app is no longer protected')).toBeInTheDocument()
       expect(
@@ -200,7 +205,7 @@ describe('AccessControlEntry', () => {
       expect(screen.queryByText('Restricted to Internal Network')).not.toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
       expect(
-        screen.queryByRole('switch', { name: 'Enable access control' }),
+        screen.queryByRole('switch', { name: 'Restrict by IP address' }),
       ).not.toBeInTheDocument()
 
       await user.click(screen.getByRole('button', { name: 'Turn on Access Control' }))
@@ -208,15 +213,43 @@ describe('AccessControlEntry', () => {
     },
   )
 
-  it('renders a single chip with a non-interactive PRO badge for Cloud sandbox', () => {
+  it('shows the plan requirement for an unconfigured Cloud sandbox app', async () => {
+    const user = userEvent.setup()
     renderEntry({ plan: 'sandbox' })
 
     const chip = getChip()
     expect(chip).toBeInTheDocument()
     expect(within(chip).getByText('PRO')).toBeInTheDocument()
     expect(within(chip).queryByRole('button')).not.toBeInTheDocument()
+    await user.hover(chip)
+    expect(
+      await screen.findByText('Access control is available on Professional and Team plans.'),
+    ).toBeInTheDocument()
+    expect(screen.queryByText(/No longer protected/)).not.toBeInTheDocument()
   })
 
+  it.each([
+    { accessPoints: ['webapp', 'service_api', 'mcp'], protectedCount: 3 },
+    { accessPoints: ['webapp', 'service_api', 'mcp', 'trigger'], protectedCount: 4 },
+  ] as const)(
+    'shows $protectedCount of 4 protected access points on hover',
+    async ({ accessPoints, protectedCount }) => {
+      const user = userEvent.setup()
+      renderEntry({
+        plan: 'professional',
+        groups: [createNetworkAccessGroupFixture()],
+        binding: createBinding({ access_points: [...accessPoints] }),
+        availableAccessPoints: ['webapp', 'service_api', 'mcp', 'trigger'],
+      })
+
+      await user.hover(getChip())
+      expect(
+        await screen.findByText(`${protectedCount} of 4 access points are protected`),
+      ).toBeInTheDocument()
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    },
+  )
+
   it.each(['professional', 'team'] as const)(
     'renders the unpaid-config Off chip on Cloud %s',
     (plan) => {
@@ -428,7 +461,7 @@ describe('AccessControlEntry', () => {
     expect(within(getChip()).getByText('ON')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
   })
 
   it('discards an unsaved first-time draft on Cancel', async () => {
@@ -851,10 +884,13 @@ describe('supported access points and binding permission', () => {
     try {
       renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()], binding })
       await user.click(getChip())
-      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
-      expect(screen.getByRole('alertdialog')).toHaveTextContent(
-        'Web App, MCP Server will be reachable from any IP.',
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+      expect(
+        screen.getByRole('alertdialog', { name: 'Turn off IP access control?' }),
+      ).toHaveAccessibleDescription(
+        'All access points will be reachable from any IP address. Your configuration will be kept.',
       )
+      expect(payloads).toHaveLength(0)
       await user.click(screen.getByRole('button', { name: 'Turn off' }))
       await waitFor(() =>
         expect(payloads).toEqual([
@@ -869,14 +905,14 @@ describe('supported access points and binding permission', () => {
       await waitFor(() =>
         expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
       )
-      expect(screen.getByRole('switch', { name: 'Enable access control' })).not.toBeChecked()
+      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
       expect(
         screen.getByText('Paused — Internal Network is configured but not enforcing'),
       ).toBeInTheDocument()
       expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
       expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
-      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
       await waitFor(() => expect(payloads).toHaveLength(2))
       expect(payloads[1]).toEqual({
         enabled: true,
@@ -885,6 +921,8 @@ describe('supported access points and binding permission', () => {
         expected_version: 3,
       })
       await waitFor(() => expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument())
+      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+      expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
       await waitFor(() =>
         expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
       )
@@ -905,7 +943,7 @@ describe('supported access points and binding permission', () => {
       })
       await user.click(getChip())
       expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
-      expect(screen.getByRole('switch', { name: 'Enable access control' })).toHaveAttribute(
+      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
         'aria-disabled',
         'true',
       )
@@ -915,7 +953,7 @@ describe('supported access points and binding permission', () => {
       expect(
         screen.queryByRole('button', { name: 'Turn on Access Control' }),
       ).not.toBeInTheDocument()
-      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
       expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
       expect(fetchSpy).not.toHaveBeenCalled()
     } finally {
@@ -949,7 +987,7 @@ describe('supported access points and binding permission', () => {
     expect(screen.getByText('Protecting all 3 access points in service.')).toBeInTheDocument()
     expect(screen.queryByText('Office')).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Enable access control' })).toHaveAttribute(
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toHaveAttribute(
       'aria-disabled',
       'true',
     )
@@ -976,7 +1014,7 @@ describe('supported access points and binding permission', () => {
       binding: createBinding(),
     })
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
     expect(screen.getByRole('alertdialog')).toBeInTheDocument()
 
     rendered.rerender(
@@ -984,7 +1022,7 @@ describe('supported access points and binding permission', () => {
     )
     await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
     await user.click(getChip())
-    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
 
     rendered.rerender(
@@ -992,7 +1030,7 @@ describe('supported access points and binding permission', () => {
     )
     await user.click(getChip())
     expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
-    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
   })
 
@@ -1151,6 +1189,48 @@ const openSelectedConfig = async (user: ReturnType<typeof userEvent.setup>) => {
 const lockoutWarning = "Your IP (203.0.113.42) isn't in this policy. You may lose access."
 
 describe('trusted IP checks before saving', () => {
+  it('applies policy and scope edits to a live app only after Save', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer(createBinding())
+    server.groups.push(createNetworkAccessGroupFixture({ id: 'group-2', name: 'Office' }))
+    server.check.allowed = true
+    renderEntry({
+      plan: 'professional',
+      groups: server.groups,
+      binding: server.binding,
+      isPublished: true,
+    })
+
+    await user.click(getChip())
+    await user.click(screen.getByRole('button', { name: 'Edit' }))
+    expect(screen.queryByRole('switch', { name: 'Restrict by IP address' })).not.toBeInTheDocument()
+    await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+    await user.click(screen.getByRole('option', { name: /Office/ }))
+    await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+
+    expect(server.writes).toHaveLength(0)
+    expect(server.binding).toMatchObject({
+      enabled: true,
+      group_id: 'group-1',
+      access_points: ['webapp', 'service_api', 'mcp'],
+    })
+    expect(within(getChip()).getByText('ON')).toBeInTheDocument()
+
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(server.writes).toEqual([
+        {
+          enabled: true,
+          group_id: 'group-2',
+          access_points: ['webapp', 'service_api'],
+          expected_version: 2,
+        },
+      ]),
+    )
+    expect(await screen.findByText('Restricted to Office')).toBeInTheDocument()
+  })
+
   it.each([true, false])(
     'enables a paused policy after saving edits with a fresh IP check (allowed: %s)',
     async (allowed) => {
@@ -1188,7 +1268,7 @@ describe('trusted IP checks before saving', () => {
         ]),
       )
       expect(server.checks).toBeGreaterThan(checksBeforeSave)
-      expect(await screen.findByRole('switch', { name: 'Enable access control' })).toBeChecked()
+      expect(await screen.findByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
       expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument()
     },
   )
@@ -1292,11 +1372,11 @@ describe('immediate pause and resume', () => {
     const server = setupBindingServer(createBinding())
     renderEntry({ plan: 'professional', groups: server.groups, binding: server.binding })
     await user.click(getChip())
-    await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+    await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
     await user.click(
       within(screen.getByRole('alertdialog')).getByRole('button', { name: 'Cancel' }),
     )
-    expect(screen.getByRole('switch', { name: 'Enable access control' })).toBeChecked()
+    expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
     expect(server.writes).toHaveLength(0)
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
   })
@@ -1313,9 +1393,9 @@ describe('immediate pause and resume', () => {
         })
       renderEntry({ plan: 'professional', groups: server.groups, binding: server.binding })
       await user.click(getChip())
-      await user.click(screen.getByRole('switch', { name: 'Enable access control' }))
+      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
       await user.click(screen.getByRole('button', { name: 'Turn off' }))
-      const toggle = screen.getByRole('switch', { name: 'Enable access control' })
+      const toggle = screen.getByRole('switch', { name: 'Restrict by IP address' })
       await waitFor(() => expect(toggle).toHaveAttribute('aria-disabled', 'true'))
       await user.click(toggle)
       expect(server.writes).toEqual([
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index a4ab86dff4b37a..ceaebcce30a4f7 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -180,25 +180,22 @@ function AccessControlSession({
   const showDowngrade = Boolean(assignment) && !entitled
   const showStatus = Boolean(assignment) && entitled && (!canMutate || view === 'status')
 
-  const tooltip =
-    chip.kind === 'pro'
+  const tooltip = showDowngrade
+    ? t(($) => $['studio.accessControl.tooltipDowngraded'], { ns: 'deployments' })
+    : chip.kind === 'pro'
       ? t(($) => $['studio.accessControl.tooltipPro'], { ns: 'deployments' })
       : chip.kind === 'paused'
         ? t(($) => $['studio.accessControl.tooltipPaused'], {
             ns: 'deployments',
             name: chip.policyName ?? '',
           })
-        : chip.kind === 'on'
-          ? t(($) => $['studio.accessControl.tooltipOn'], {
+        : chip.kind === 'on' || chip.kind === 'partial'
+          ? t(($) => $['studio.accessControl.tooltipProtected'], {
               ns: 'deployments',
+              n: chip.coveredCount,
+              total: chip.inServiceCount,
             })
-          : chip.kind === 'partial'
-            ? t(($) => $['studio.accessControl.tooltipPartial'], {
-                ns: 'deployments',
-                n: chip.coveredCount,
-                total: chip.inServiceCount,
-              })
-            : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
+          : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
   const handleTurnOn = () => {
     void setPricing('open')
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index f9323bac1c6e9d..f53b6fab4530d3 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -14,6 +14,7 @@ import {
 } from '@langgenius/dify-ui/alert-dialog'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
+import { Field, FieldLabel } from '@langgenius/dify-ui/field'
 import { PopoverTitle } from '@langgenius/dify-ui/popover'
 import { Switch } from '@langgenius/dify-ui/switch'
 import { useState } from 'react'
@@ -62,9 +63,6 @@ export function AccessControlStatusPanel({
     mcp: t(($) => $['mcp.server.title'], { ns: 'tools' }),
     trigger: t(($) => $['settings.trigger'], { ns: 'common' }),
   }
-  const exposedNames = availableAccessPoints
-    .filter((scope) => draft.scopes[scope])
-    .map((scope) => labels[scope])
   const policyName = selectedPolicy?.name
 
   return (
@@ -86,11 +84,11 @@ export function AccessControlStatusPanel({
       </div>
 
       <div className="flex flex-col gap-5 overflow-hidden px-4 pt-2 pb-4">
-        <div className="flex items-center justify-between gap-2">
+        <Field className="flex items-center justify-between gap-2">
           <div className="flex min-w-0 flex-col gap-0.5">
-            <p className="system-md-medium text-text-primary">
+            <FieldLabel className="system-md-medium text-text-primary">
               {t(($) => $['studio.accessControl.restrictByIp'], { ns: 'deployments' })}
-            </p>
+            </FieldLabel>
             <p className="system-xs-regular text-text-tertiary">
               {!enabled
                 ? t(($) => $['studio.accessControl.tooltipPaused'], {
@@ -112,9 +110,6 @@ export function AccessControlStatusPanel({
           <Switch
             checked={enabled}
             disabled={updating || readOnly}
-            aria-label={t(($) => $['studio.accessControl.enableAccessControl'], {
-              ns: 'deployments',
-            })}
             onCheckedChange={(next) => {
               if (readOnly || updating) return
               if (next) {
@@ -124,7 +119,7 @@ export function AccessControlStatusPanel({
               setConfirmPause(true)
             }}
           />
-        </div>
+        </Field>
 
         {selectedPolicy && summary && (
           <div className="flex flex-col gap-0.5">
@@ -213,7 +208,6 @@ export function AccessControlStatusPanel({
             <AlertDialogDescription className="system-sm-regular text-text-secondary">
               {t(($) => $['studio.accessControl.turnOffDescription'], {
                 ns: 'deployments',
-                points: exposedNames.join(', '),
               })}
             </AlertDialogDescription>
           </div>
diff --git a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
index 16a81aac19916a..f1433fb88bd898 100644
--- a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
+++ b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
@@ -160,7 +160,7 @@ describe('Agent IP access configuration', () => {
     expect(screen.getByText('Protecting all 2 access points.')).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Edit' })).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
-    const toggle = screen.getByRole('switch', { name: 'Enable access control' })
+    const toggle = screen.getByRole('switch', { name: 'Restrict by IP address' })
     expect(toggle).toHaveAttribute('aria-disabled', 'true')
     await user.click(toggle)
     expect(toggle).toBeChecked()
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index decc92154e3cbc..706969c670c638 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "يرجى اختيار نقطة وصول واحدة على الأقل.",
   "studio.accessControl.selectPolicy": "اختر سياسة IP",
   "studio.accessControl.selectPolicyRequired": "يرجى اختيار سياسة IP.",
+  "studio.accessControl.tooltipDowngraded": "لم يعد محميًا — متاح في خطتي Professional وTeam",
   "studio.accessControl.tooltipOff": "لم يتم الإعداد",
-  "studio.accessControl.tooltipOn": "جميع نقاط الوصول",
-  "studio.accessControl.tooltipPartial": "{{n}} من أصل {{total}} من نقاط الوصول",
   "studio.accessControl.tooltipPaused": "متوقف مؤقتًا — تم إعداد {{name}} ولكنها غير مطبّقة",
   "studio.accessControl.tooltipPro": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
+  "studio.accessControl.tooltipProtected": "{{n}} من أصل {{total}} من نقاط الوصول محمية",
   "studio.accessControl.turnOffConfirm": "إيقاف",
-  "studio.accessControl.turnOffDescription": "ستصبح {{points}} متاحة من أي عنوان IP.",
-  "studio.accessControl.turnOffTitle": "هل تريد إيقاف التحكّم في الوصول؟",
+  "studio.accessControl.turnOffDescription": "ستصبح جميع نقاط الوصول متاحة من أي عنوان IP. سيتم الاحتفاظ بإعداداتك.",
+  "studio.accessControl.turnOffTitle": "هل تريد إيقاف التحكّم في الوصول حسب عنوان IP؟",
   "studio.accessControl.turnOn": "تفعيل التحكم في الوصول",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index 07a6a9e76edbe7..aaf17570c9f08b 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Bitte wählen Sie mindestens einen Zugangspunkt aus.",
   "studio.accessControl.selectPolicy": "IP-Richtlinie auswählen",
   "studio.accessControl.selectPolicyRequired": "Bitte wählen Sie eine IP-Richtlinie aus.",
+  "studio.accessControl.tooltipDowngraded": "Nicht mehr geschützt — verfügbar in den Tarifen Professional und Team",
   "studio.accessControl.tooltipOff": "Nicht eingerichtet",
-  "studio.accessControl.tooltipOn": "Alle Zugangspunkte",
-  "studio.accessControl.tooltipPartial": "{{n}} von {{total}} Zugangspunkten",
   "studio.accessControl.tooltipPaused": "Pausiert — {{name}} ist konfiguriert, wird aber nicht angewendet",
   "studio.accessControl.tooltipPro": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
+  "studio.accessControl.tooltipProtected": "{{n}} von {{total}} Zugriffspunkten sind geschützt",
   "studio.accessControl.turnOffConfirm": "Deaktivieren",
-  "studio.accessControl.turnOffDescription": "{{points}} sind dann von jeder IP-Adresse aus erreichbar.",
-  "studio.accessControl.turnOffTitle": "Zugriffskontrolle deaktivieren?",
+  "studio.accessControl.turnOffDescription": "Alle Zugriffspunkte sind dann von jeder IP-Adresse aus erreichbar. Deine Konfiguration bleibt erhalten.",
+  "studio.accessControl.turnOffTitle": "IP-Zugriffskontrolle deaktivieren?",
   "studio.accessControl.turnOn": "Zugriffskontrolle aktivieren",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index 1cc8ae53218bb1..ab725a52bb758b 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Please choose at least one access point.",
   "studio.accessControl.selectPolicy": "Select an IP policy",
   "studio.accessControl.selectPolicyRequired": "Please select an IP policy.",
+  "studio.accessControl.tooltipDowngraded": "No longer protected — available on Professional and Team plans",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipOn": "All access points",
-  "studio.accessControl.tooltipPartial": "{{n}} of {{total}} access points",
   "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.tooltipPro": "Access control is available on Professional and Team plans.",
+  "studio.accessControl.tooltipProtected": "{{n}} of {{total}} access points are protected",
   "studio.accessControl.turnOffConfirm": "Turn off",
-  "studio.accessControl.turnOffDescription": "{{points}} will be reachable from any IP.",
-  "studio.accessControl.turnOffTitle": "Turn off access control?",
+  "studio.accessControl.turnOffDescription": "All access points will be reachable from any IP address. Your configuration will be kept.",
+  "studio.accessControl.turnOffTitle": "Turn off IP access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
   "studio.accessPoint.apiDescription": "Integrate the app into your services over HTTP",
   "studio.accessPoint.description": "All the ways this app can be reached. Access points match the running version only.",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 28a6120fba7f8a..0691d0c7773bc3 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Elige al menos un punto de acceso.",
   "studio.accessControl.selectPolicy": "Selecciona una política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecciona una política de IP.",
+  "studio.accessControl.tooltipDowngraded": "Ya no está protegida — disponible en los planes Professional y Team",
   "studio.accessControl.tooltipOff": "Sin configurar",
-  "studio.accessControl.tooltipOn": "Todos los puntos de acceso",
-  "studio.accessControl.tooltipPartial": "{{n}} de {{total}} puntos de acceso",
   "studio.accessControl.tooltipPaused": "En pausa — {{name}} está configurada, pero no se aplica",
   "studio.accessControl.tooltipPro": "El control de acceso está disponible en los planes Professional y Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} de {{total}} puntos de acceso están protegidos",
   "studio.accessControl.turnOffConfirm": "Desactivar",
-  "studio.accessControl.turnOffDescription": "Se podrá acceder a {{points}} desde cualquier IP.",
-  "studio.accessControl.turnOffTitle": "¿Desactivar el control de acceso?",
+  "studio.accessControl.turnOffDescription": "Se podrá acceder a todos los puntos de acceso desde cualquier dirección IP. Se conservará tu configuración.",
+  "studio.accessControl.turnOffTitle": "¿Desactivar el control de acceso por IP?",
   "studio.accessControl.turnOn": "Activar el control de acceso",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index b8cf35bb5e4ae8..adec49844a3f6e 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "لطفاً دست‌کم یک نقطه دسترسی انتخاب کنید.",
   "studio.accessControl.selectPolicy": "یک خط‌مشی IP انتخاب کنید",
   "studio.accessControl.selectPolicyRequired": "لطفاً یک خط‌مشی IP انتخاب کنید.",
+  "studio.accessControl.tooltipDowngraded": "دیگر محافظت نمی‌شود — در طرح‌های Professional و Team در دسترس است",
   "studio.accessControl.tooltipOff": "تنظیم نشده",
-  "studio.accessControl.tooltipOn": "همه نقاط دسترسی",
-  "studio.accessControl.tooltipPartial": "{{n}} نقطه از {{total}} نقطه دسترسی",
   "studio.accessControl.tooltipPaused": "متوقف شده — {{name}} پیکربندی شده اما اعمال نمی‌شود",
   "studio.accessControl.tooltipPro": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
+  "studio.accessControl.tooltipProtected": "{{n}} نقطه از {{total}} نقطهٔ دسترسی محافظت می‌شوند",
   "studio.accessControl.turnOffConfirm": "خاموش کردن",
-  "studio.accessControl.turnOffDescription": "دسترسی به {{points}} از هر نشانی IP ممکن خواهد شد.",
-  "studio.accessControl.turnOffTitle": "کنترل دسترسی خاموش شود؟",
+  "studio.accessControl.turnOffDescription": "همهٔ نقاط دسترسی از هر نشانی IP قابل دسترسی خواهند بود. پیکربندی شما حفظ خواهد شد.",
+  "studio.accessControl.turnOffTitle": "کنترل دسترسی بر اساس IP غیرفعال شود؟",
   "studio.accessControl.turnOn": "فعال‌سازی کنترل دسترسی",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index ffe93cf1d2b825..85d1bafd62152e 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Veuillez choisir au moins un point d’accès.",
   "studio.accessControl.selectPolicy": "Sélectionnez une politique IP",
   "studio.accessControl.selectPolicyRequired": "Veuillez sélectionner une politique IP.",
+  "studio.accessControl.tooltipDowngraded": "N’est plus protégée — disponible avec les forfaits Professional et Team",
   "studio.accessControl.tooltipOff": "Non configuré",
-  "studio.accessControl.tooltipOn": "Tous les points d’accès",
-  "studio.accessControl.tooltipPartial": "{{n}} points d’accès sur {{total}}",
   "studio.accessControl.tooltipPaused": "En pause — {{name}} est configurée mais n’est pas appliquée",
   "studio.accessControl.tooltipPro": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} points d’accès sur {{total}} sont protégés",
   "studio.accessControl.turnOffConfirm": "Désactiver",
-  "studio.accessControl.turnOffDescription": "{{points}} seront accessibles depuis n’importe quelle IP.",
-  "studio.accessControl.turnOffTitle": "Désactiver le contrôle d’accès ?",
+  "studio.accessControl.turnOffDescription": "Tous les points d’accès seront accessibles depuis n’importe quelle adresse IP. Votre configuration sera conservée.",
+  "studio.accessControl.turnOffTitle": "Désactiver le contrôle d’accès par IP ?",
   "studio.accessControl.turnOn": "Activer le contrôle d’accès",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index e405683f761c74..d1180dd7e9984b 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "कृपया कम से कम एक पहुँच बिंदु चुनें।",
   "studio.accessControl.selectPolicy": "एक IP नीति चुनें",
   "studio.accessControl.selectPolicyRequired": "कृपया एक IP नीति चुनें।",
+  "studio.accessControl.tooltipDowngraded": "अब सुरक्षित नहीं है — Professional और Team प्लान में उपलब्ध",
   "studio.accessControl.tooltipOff": "सेट अप नहीं किया गया",
-  "studio.accessControl.tooltipOn": "सभी पहुँच बिंदु",
-  "studio.accessControl.tooltipPartial": "{{total}} पहुँच बिंदुओं में से {{n}}",
   "studio.accessControl.tooltipPaused": "रुका हुआ — {{name}} कॉन्फ़िगर की गई है, लेकिन लागू नहीं है",
   "studio.accessControl.tooltipPro": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
+  "studio.accessControl.tooltipProtected": "{{total}} में से {{n}} एक्सेस पॉइंट सुरक्षित हैं",
   "studio.accessControl.turnOffConfirm": "बंद करें",
-  "studio.accessControl.turnOffDescription": "{{points}} तक किसी भी IP से पहुँचा जा सकेगा।",
-  "studio.accessControl.turnOffTitle": "पहुँच नियंत्रण बंद करें?",
+  "studio.accessControl.turnOffDescription": "सभी एक्सेस पॉइंट किसी भी IP पते से सुलभ हो जाएँगे। आपका कॉन्फ़िगरेशन सुरक्षित रखा जाएगा।",
+  "studio.accessControl.turnOffTitle": "IP एक्सेस कंट्रोल बंद करें?",
   "studio.accessControl.turnOn": "पहुँच नियंत्रण सक्षम करें",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index 2aff58242b18a2..d942caea1cf1b3 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Pilih setidaknya satu titik akses.",
   "studio.accessControl.selectPolicy": "Pilih kebijakan IP",
   "studio.accessControl.selectPolicyRequired": "Pilih kebijakan IP.",
+  "studio.accessControl.tooltipDowngraded": "Tidak lagi dilindungi — tersedia pada paket Professional dan Team",
   "studio.accessControl.tooltipOff": "Belum dikonfigurasi",
-  "studio.accessControl.tooltipOn": "Semua titik akses",
-  "studio.accessControl.tooltipPartial": "{{n}} dari {{total}} titik akses",
   "studio.accessControl.tooltipPaused": "Dijeda — {{name}} sudah dikonfigurasi tetapi tidak diterapkan",
   "studio.accessControl.tooltipPro": "Kontrol akses tersedia pada paket Professional dan Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} dari {{total}} titik akses dilindungi",
   "studio.accessControl.turnOffConfirm": "Nonaktifkan",
-  "studio.accessControl.turnOffDescription": "{{points}} akan dapat diakses dari IP mana pun.",
-  "studio.accessControl.turnOffTitle": "Nonaktifkan kontrol akses?",
+  "studio.accessControl.turnOffDescription": "Semua titik akses akan dapat diakses dari alamat IP mana pun. Konfigurasi Anda akan tetap disimpan.",
+  "studio.accessControl.turnOffTitle": "Nonaktifkan kontrol akses IP?",
   "studio.accessControl.turnOn": "Aktifkan kontrol akses",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index fd21d3afdfd36c..4da413d57cca28 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Scegli almeno un punto di accesso.",
   "studio.accessControl.selectPolicy": "Seleziona una policy IP",
   "studio.accessControl.selectPolicyRequired": "Seleziona una policy IP.",
+  "studio.accessControl.tooltipDowngraded": "Non più protetta — disponibile nei piani Professional e Team",
   "studio.accessControl.tooltipOff": "Non configurato",
-  "studio.accessControl.tooltipOn": "Tutti i punti di accesso",
-  "studio.accessControl.tooltipPartial": "{{n}} di {{total}} punti di accesso",
   "studio.accessControl.tooltipPaused": "In pausa — {{name}} è configurata ma non viene applicata",
   "studio.accessControl.tooltipPro": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} punti di accesso su {{total}} sono protetti",
   "studio.accessControl.turnOffConfirm": "Disattiva",
-  "studio.accessControl.turnOffDescription": "{{points}} saranno accessibili da qualsiasi IP.",
-  "studio.accessControl.turnOffTitle": "Disattivare il controllo degli accessi?",
+  "studio.accessControl.turnOffDescription": "Tutti i punti di accesso saranno raggiungibili da qualsiasi indirizzo IP. La configurazione verrà mantenuta.",
+  "studio.accessControl.turnOffTitle": "Disattivare il controllo degli accessi IP?",
   "studio.accessControl.turnOn": "Abilita il controllo degli accessi",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 5c733df560b605..4deccfc0a97542 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "少なくとも 1 つのアクセスポイントを選択してください。",
   "studio.accessControl.selectPolicy": "IP ポリシーを選択",
   "studio.accessControl.selectPolicyRequired": "IP ポリシーを選択してください。",
+  "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます",
   "studio.accessControl.tooltipOff": "未設定",
-  "studio.accessControl.tooltipOn": "すべてのアクセスポイント",
-  "studio.accessControl.tooltipPartial": "アクセスポイント {{total}} 個中 {{n}} 個",
   "studio.accessControl.tooltipPaused": "一時停止 — {{name}} は設定済みですが適用されていません",
   "studio.accessControl.tooltipPro": "アクセス制御は Professional および Team プランで利用できます。",
+  "studio.accessControl.tooltipProtected": "{{total}} 個のアクセスポイントのうち {{n}} 個が保護されています",
   "studio.accessControl.turnOffConfirm": "オフにする",
-  "studio.accessControl.turnOffDescription": "{{points}} は任意の IP から到達できるようになります。",
-  "studio.accessControl.turnOffTitle": "アクセス制御をオフにしますか？",
+  "studio.accessControl.turnOffDescription": "すべてのアクセスポイントが任意の IP アドレスからアクセス可能になります。設定は保持されます。",
+  "studio.accessControl.turnOffTitle": "IP アクセス制御をオフにしますか？",
   "studio.accessControl.turnOn": "アクセス制御をオンにする",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 9f5ff02ca5afa7..868830e7ffc6b8 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "접근 지점을 하나 이상 선택하세요.",
   "studio.accessControl.selectPolicy": "IP 정책 선택",
   "studio.accessControl.selectPolicyRequired": "IP 정책을 선택하세요.",
+  "studio.accessControl.tooltipDowngraded": "더 이상 보호되지 않음 — Professional 및 Team 요금제에서 사용 가능",
   "studio.accessControl.tooltipOff": "설정되지 않음",
-  "studio.accessControl.tooltipOn": "모든 접근 지점",
-  "studio.accessControl.tooltipPartial": "접근 지점 {{total}}개 중 {{n}}개",
   "studio.accessControl.tooltipPaused": "일시 중지됨 — {{name}} 정책이 설정되었지만 적용되지 않고 있습니다",
   "studio.accessControl.tooltipPro": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
+  "studio.accessControl.tooltipProtected": "접근 지점 {{total}}개 중 {{n}}개가 보호되고 있습니다",
   "studio.accessControl.turnOffConfirm": "끄기",
-  "studio.accessControl.turnOffDescription": "모든 IP에서 {{points}}에 접근할 수 있게 됩니다.",
-  "studio.accessControl.turnOffTitle": "접근 제어를 끌까요?",
+  "studio.accessControl.turnOffDescription": "모든 IP 주소에서 모든 접근 지점에 접근할 수 있게 됩니다. 설정은 유지됩니다.",
+  "studio.accessControl.turnOffTitle": "IP 접근 제어를 끄시겠습니까?",
   "studio.accessControl.turnOn": "접근 제어 활성화",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index b4564ffb6dcfb2..d68f1dcb7acdb2 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "ກະລຸນາເລືອກຈຸດເຂົ້າເຖິງຢ່າງໜ້ອຍໜຶ່ງຈຸດ.",
   "studio.accessControl.selectPolicy": "ເລືອກນະໂຍບາຍ IP",
   "studio.accessControl.selectPolicyRequired": "ກະລຸນາເລືອກນະໂຍບາຍ IP.",
+  "studio.accessControl.tooltipDowngraded": "ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ — ມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team",
   "studio.accessControl.tooltipOff": "ຍັງບໍ່ໄດ້ຕັ້ງຄ່າ",
-  "studio.accessControl.tooltipOn": "ຈຸດເຂົ້າເຖິງທັງໝົດ",
-  "studio.accessControl.tooltipPartial": "ຈຸດເຂົ້າເຖິງ {{n}} ຈາກ {{total}} ຈຸດ",
   "studio.accessControl.tooltipPaused": "ຢຸດຊົ່ວຄາວ — {{name}} ຖືກຕັ້ງຄ່າແລ້ວ ແຕ່ຍັງບໍ່ໄດ້ນຳໃຊ້",
   "studio.accessControl.tooltipPro": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} ຈາກ {{total}} ຈຸດເຂົ້າເຖິງໄດ້ຮັບການປົກປ້ອງ",
   "studio.accessControl.turnOffConfirm": "ປິດ",
-  "studio.accessControl.turnOffDescription": "ຈະສາມາດເຂົ້າເຖິງ {{points}} ໄດ້ຈາກທຸກ IP.",
-  "studio.accessControl.turnOffTitle": "ປິດການຄວບຄຸມການເຂົ້າເຖິງບໍ?",
+  "studio.accessControl.turnOffDescription": "ຈຸດເຂົ້າເຖິງທັງໝົດຈະສາມາດເຂົ້າເຖິງໄດ້ຈາກທຸກທີ່ຢູ່ IP. ການຕັ້ງຄ່າຂອງທ່ານຈະຖືກເກັບໄວ້.",
+  "studio.accessControl.turnOffTitle": "ປິດການຄວບຄຸມການເຂົ້າເຖິງຕາມ IP ບໍ?",
   "studio.accessControl.turnOn": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index 7244e39fb34f44..f64ff8cb9ca76d 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Kies ten minste één toegangspunt.",
   "studio.accessControl.selectPolicy": "Selecteer een IP-beleid",
   "studio.accessControl.selectPolicyRequired": "Selecteer een IP-beleid.",
+  "studio.accessControl.tooltipDowngraded": "Niet langer beschermd — beschikbaar in de Professional- en Team-abonnementen",
   "studio.accessControl.tooltipOff": "Niet ingesteld",
-  "studio.accessControl.tooltipOn": "Alle toegangspunten",
-  "studio.accessControl.tooltipPartial": "{{n}} van de {{total}} toegangspunten",
   "studio.accessControl.tooltipPaused": "Gepauzeerd — {{name}} is ingesteld maar wordt niet toegepast",
   "studio.accessControl.tooltipPro": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
+  "studio.accessControl.tooltipProtected": "{{n}} van de {{total}} toegangspunten zijn beschermd",
   "studio.accessControl.turnOffConfirm": "Uitschakelen",
-  "studio.accessControl.turnOffDescription": "{{points}} worden bereikbaar vanaf elk IP-adres.",
-  "studio.accessControl.turnOffTitle": "Toegangsbeheer uitschakelen?",
+  "studio.accessControl.turnOffDescription": "Alle toegangspunten worden bereikbaar vanaf elk IP-adres. Je configuratie blijft bewaard.",
+  "studio.accessControl.turnOffTitle": "IP-toegangsbeheer uitschakelen?",
   "studio.accessControl.turnOn": "Toegangsbeheer inschakelen",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 84c73f9b26ee27..053cabef4c6110 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Wybierz co najmniej jeden punkt dostępu.",
   "studio.accessControl.selectPolicy": "Wybierz politykę IP",
   "studio.accessControl.selectPolicyRequired": "Wybierz politykę IP.",
+  "studio.accessControl.tooltipDowngraded": "Aplikacja nie jest już chroniona — funkcja dostępna w planach Professional i Team",
   "studio.accessControl.tooltipOff": "Nieskonfigurowane",
-  "studio.accessControl.tooltipOn": "Wszystkie punkty dostępu",
-  "studio.accessControl.tooltipPartial": "Punkty dostępu: {{n}} z {{total}}",
   "studio.accessControl.tooltipPaused": "Wstrzymane — polityka {{name}} jest skonfigurowana, ale nie jest stosowana",
   "studio.accessControl.tooltipPro": "Kontrola dostępu jest dostępna w planach Professional i Team.",
+  "studio.accessControl.tooltipProtected": "Liczba chronionych punktów dostępu: {{n}} z {{total}}",
   "studio.accessControl.turnOffConfirm": "Wyłącz",
-  "studio.accessControl.turnOffDescription": "Punkty dostępu {{points}} będą dostępne z dowolnego adresu IP.",
-  "studio.accessControl.turnOffTitle": "Wyłączyć kontrolę dostępu?",
+  "studio.accessControl.turnOffDescription": "Wszystkie punkty dostępu będą dostępne z dowolnego adresu IP. Twoja konfiguracja zostanie zachowana.",
+  "studio.accessControl.turnOffTitle": "Wyłączyć kontrolę dostępu według adresu IP?",
   "studio.accessControl.turnOn": "Włącz kontrolę dostępu",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index 72e15f3e65e35a..ea5007f6c20a41 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Escolha pelo menos um ponto de acesso.",
   "studio.accessControl.selectPolicy": "Selecione uma política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecione uma política de IP.",
+  "studio.accessControl.tooltipDowngraded": "Não está mais protegido — disponível nos planos Professional e Team",
   "studio.accessControl.tooltipOff": "Não configurado",
-  "studio.accessControl.tooltipOn": "Todos os pontos de acesso",
-  "studio.accessControl.tooltipPartial": "{{n}} de {{total}} pontos de acesso",
   "studio.accessControl.tooltipPaused": "Pausado — {{name}} está configurada, mas não está sendo aplicada",
   "studio.accessControl.tooltipPro": "O controle de acesso está disponível nos planos Professional e Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} de {{total}} pontos de acesso estão protegidos",
   "studio.accessControl.turnOffConfirm": "Desativar",
-  "studio.accessControl.turnOffDescription": "{{points}} poderão ser acessados de qualquer IP.",
-  "studio.accessControl.turnOffTitle": "Desativar o controle de acesso?",
+  "studio.accessControl.turnOffDescription": "Todos os pontos de acesso poderão ser acessados de qualquer endereço IP. Sua configuração será mantida.",
+  "studio.accessControl.turnOffTitle": "Desativar o controle de acesso por IP?",
   "studio.accessControl.turnOn": "Ativar controle de acesso",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index a7a706ae397f91..0514dc6a093524 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Alegeți cel puțin un punct de acces.",
   "studio.accessControl.selectPolicy": "Selectați o politică IP",
   "studio.accessControl.selectPolicyRequired": "Selectați o politică IP.",
+  "studio.accessControl.tooltipDowngraded": "Nu mai este protejată — disponibil în planurile Professional și Team",
   "studio.accessControl.tooltipOff": "Neconfigurat",
-  "studio.accessControl.tooltipOn": "Toate punctele de acces",
-  "studio.accessControl.tooltipPartial": "{{n}} din {{total}} puncte de acces",
   "studio.accessControl.tooltipPaused": "În pauză — {{name}} este configurată, dar nu este aplicată",
   "studio.accessControl.tooltipPro": "Controlul accesului este disponibil în planurile Professional și Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} din {{total}} puncte de acces sunt protejate",
   "studio.accessControl.turnOffConfirm": "Dezactivați",
-  "studio.accessControl.turnOffDescription": "{{points}} vor fi accesibile de la orice adresă IP.",
-  "studio.accessControl.turnOffTitle": "Dezactivați controlul accesului?",
+  "studio.accessControl.turnOffDescription": "Toate punctele de acces vor fi accesibile de la orice adresă IP. Configurația va fi păstrată.",
+  "studio.accessControl.turnOffTitle": "Dezactivați controlul accesului pe baza adresei IP?",
   "studio.accessControl.turnOn": "Activați controlul accesului",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index 8c19551ca0e848..691a54a8212ecb 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Выберите хотя бы одну точку доступа.",
   "studio.accessControl.selectPolicy": "Выберите IP-политику",
   "studio.accessControl.selectPolicyRequired": "Выберите IP-политику.",
+  "studio.accessControl.tooltipDowngraded": "Больше не защищено — доступно на тарифах Professional и Team",
   "studio.accessControl.tooltipOff": "Не настроено",
-  "studio.accessControl.tooltipOn": "Все точки доступа",
-  "studio.accessControl.tooltipPartial": "Точки доступа: {{n}} из {{total}}",
   "studio.accessControl.tooltipPaused": "Приостановлено — политика {{name}} настроена, но не применяется",
   "studio.accessControl.tooltipPro": "Управление доступом доступно в тарифах Professional и Team.",
+  "studio.accessControl.tooltipProtected": "Защищено точек доступа: {{n}} из {{total}}",
   "studio.accessControl.turnOffConfirm": "Выключить",
-  "studio.accessControl.turnOffDescription": "Точки доступа {{points}} станут доступны с любого IP-адреса.",
-  "studio.accessControl.turnOffTitle": "Выключить контроль доступа?",
+  "studio.accessControl.turnOffDescription": "Все точки доступа станут доступны с любого IP-адреса. Ваша конфигурация будет сохранена.",
+  "studio.accessControl.turnOffTitle": "Отключить контроль доступа по IP?",
   "studio.accessControl.turnOn": "Включить контроль доступа",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 8a4fe7d54b32b5..060e18a7cbed55 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Izberite vsaj eno dostopno točko.",
   "studio.accessControl.selectPolicy": "Izberite pravilnik IP",
   "studio.accessControl.selectPolicyRequired": "Izberite pravilnik IP.",
+  "studio.accessControl.tooltipDowngraded": "Ni več zaščitena — na voljo v paketih Professional in Team",
   "studio.accessControl.tooltipOff": "Ni nastavljeno",
-  "studio.accessControl.tooltipOn": "Vse dostopne točke",
-  "studio.accessControl.tooltipPartial": "Dostopne točke: {{n}} od {{total}}",
   "studio.accessControl.tooltipPaused": "Začasno ustavljeno — {{name}} je nastavljen, vendar se ne uveljavlja",
   "studio.accessControl.tooltipPro": "Nadzor dostopa je na voljo v paketih Professional in Team.",
+  "studio.accessControl.tooltipProtected": "Zaščitene dostopne točke: {{n}} od {{total}}",
   "studio.accessControl.turnOffConfirm": "Izklopi",
-  "studio.accessControl.turnOffDescription": "{{points}} bodo dosegljive s katerega koli naslova IP.",
-  "studio.accessControl.turnOffTitle": "Želite izklopiti nadzor dostopa?",
+  "studio.accessControl.turnOffDescription": "Vse dostopne točke bodo dosegljive s katerega koli naslova IP. Vaša konfiguracija bo ohranjena.",
+  "studio.accessControl.turnOffTitle": "Izklopim nadzor dostopa po naslovu IP?",
   "studio.accessControl.turnOn": "Omogoči nadzor dostopa",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 69cc10e60a39a6..325fbd0e953c26 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "โปรดเลือกจุดเข้าใช้งานอย่างน้อยหนึ่งจุด",
   "studio.accessControl.selectPolicy": "เลือกนโยบาย IP",
   "studio.accessControl.selectPolicyRequired": "โปรดเลือกนโยบาย IP",
+  "studio.accessControl.tooltipDowngraded": "ไม่ได้รับการป้องกันอีกต่อไป — ใช้งานได้ในแพ็กเกจ Professional และ Team",
   "studio.accessControl.tooltipOff": "ยังไม่ได้ตั้งค่า",
-  "studio.accessControl.tooltipOn": "จุดเข้าใช้งานทั้งหมด",
-  "studio.accessControl.tooltipPartial": "จุดเข้าใช้งาน {{n}} จาก {{total}} จุด",
   "studio.accessControl.tooltipPaused": "หยุดชั่วคราว — ตั้งค่า {{name}} แล้ว แต่ยังไม่ได้บังคับใช้",
   "studio.accessControl.tooltipPro": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
+  "studio.accessControl.tooltipProtected": "จุดเข้าถึง {{n}} จาก {{total}} จุดได้รับการป้องกัน",
   "studio.accessControl.turnOffConfirm": "ปิด",
-  "studio.accessControl.turnOffDescription": "จะสามารถเข้าถึง {{points}} ได้จากทุก IP",
-  "studio.accessControl.turnOffTitle": "ปิดการควบคุมการเข้าถึงหรือไม่?",
+  "studio.accessControl.turnOffDescription": "จุดเข้าถึงทั้งหมดจะสามารถเข้าถึงได้จากทุกที่อยู่ IP โดยจะเก็บการตั้งค่าของคุณไว้",
+  "studio.accessControl.turnOffTitle": "ปิดการควบคุมการเข้าถึงตาม IP หรือไม่?",
   "studio.accessControl.turnOn": "เปิดใช้งานการควบคุมการเข้าถึง",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index a604d35a1bc20d..977b2d9e35c380 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Lütfen en az bir erişim noktası seçin.",
   "studio.accessControl.selectPolicy": "Bir IP politikası seçin",
   "studio.accessControl.selectPolicyRequired": "Lütfen bir IP politikası seçin.",
+  "studio.accessControl.tooltipDowngraded": "Artık korunmuyor — Professional ve Team planlarında kullanılabilir",
   "studio.accessControl.tooltipOff": "Yapılandırılmadı",
-  "studio.accessControl.tooltipOn": "Tüm erişim noktaları",
-  "studio.accessControl.tooltipPartial": "{{total}} erişim noktasından {{n}} tanesi",
   "studio.accessControl.tooltipPaused": "Duraklatıldı — {{name}} yapılandırıldı ancak uygulanmıyor",
   "studio.accessControl.tooltipPro": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
+  "studio.accessControl.tooltipProtected": "{{total}} erişim noktasından {{n}} tanesi korunuyor",
   "studio.accessControl.turnOffConfirm": "Kapat",
-  "studio.accessControl.turnOffDescription": "{{points}} herhangi bir IP adresinden erişilebilir olacak.",
-  "studio.accessControl.turnOffTitle": "Erişim kontrolü kapatılsın mı?",
+  "studio.accessControl.turnOffDescription": "Tüm erişim noktaları herhangi bir IP adresinden erişilebilir olacak. Yapılandırmanız korunacak.",
+  "studio.accessControl.turnOffTitle": "IP erişim denetimi kapatılsın mı?",
   "studio.accessControl.turnOn": "Erişim denetimini etkinleştir",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 93a63bde58e754..18063fcfa26cb6 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Виберіть принаймні одну точку доступу.",
   "studio.accessControl.selectPolicy": "Виберіть IP-політику",
   "studio.accessControl.selectPolicyRequired": "Виберіть IP-політику.",
+  "studio.accessControl.tooltipDowngraded": "Більше не захищено — доступно в тарифах Professional і Team",
   "studio.accessControl.tooltipOff": "Не налаштовано",
-  "studio.accessControl.tooltipOn": "Усі точки доступу",
-  "studio.accessControl.tooltipPartial": "Точки доступу: {{n}} із {{total}}",
   "studio.accessControl.tooltipPaused": "Призупинено — політику {{name}} налаштовано, але вона не застосовується",
   "studio.accessControl.tooltipPro": "Керування доступом доступне в планах Professional і Team.",
+  "studio.accessControl.tooltipProtected": "Захищено точок доступу: {{n}} із {{total}}",
   "studio.accessControl.turnOffConfirm": "Вимкнути",
-  "studio.accessControl.turnOffDescription": "Точки доступу {{points}} стануть доступними з будь-якої IP-адреси.",
-  "studio.accessControl.turnOffTitle": "Вимкнути контроль доступу?",
+  "studio.accessControl.turnOffDescription": "Усі точки доступу стануть доступними з будь-якої IP-адреси. Вашу конфігурацію буде збережено.",
+  "studio.accessControl.turnOffTitle": "Вимкнути контроль доступу за IP?",
   "studio.accessControl.turnOn": "Увімкнути контроль доступу",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 4abb5f83b91e62..5a3a4e2fb390c2 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "Vui lòng chọn ít nhất một điểm truy cập.",
   "studio.accessControl.selectPolicy": "Chọn chính sách IP",
   "studio.accessControl.selectPolicyRequired": "Vui lòng chọn chính sách IP.",
+  "studio.accessControl.tooltipDowngraded": "Không còn được bảo vệ — có trong các gói Professional và Team",
   "studio.accessControl.tooltipOff": "Chưa thiết lập",
-  "studio.accessControl.tooltipOn": "Tất cả điểm truy cập",
-  "studio.accessControl.tooltipPartial": "{{n}} trên {{total}} điểm truy cập",
   "studio.accessControl.tooltipPaused": "Đã tạm dừng — {{name}} đã được cấu hình nhưng chưa được áp dụng",
   "studio.accessControl.tooltipPro": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
+  "studio.accessControl.tooltipProtected": "{{n}} trong số {{total}} điểm truy cập được bảo vệ",
   "studio.accessControl.turnOffConfirm": "Tắt",
-  "studio.accessControl.turnOffDescription": "Có thể truy cập {{points}} từ bất kỳ IP nào.",
-  "studio.accessControl.turnOffTitle": "Tắt kiểm soát truy cập?",
+  "studio.accessControl.turnOffDescription": "Tất cả điểm truy cập sẽ có thể được truy cập từ bất kỳ địa chỉ IP nào. Cấu hình của bạn sẽ được giữ lại.",
+  "studio.accessControl.turnOffTitle": "Tắt kiểm soát truy cập theo IP?",
   "studio.accessControl.turnOn": "Bật kiểm soát truy cập",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index 6f9e341b2e3256..c344236f4a3453 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "请至少选择一个访问入口。",
   "studio.accessControl.selectPolicy": "选择 IP 策略",
   "studio.accessControl.selectPolicyRequired": "请选择一条 IP 策略。",
+  "studio.accessControl.tooltipDowngraded": "已不再受保护，适用于 Professional 和 Team 套餐",
   "studio.accessControl.tooltipOff": "尚未配置",
-  "studio.accessControl.tooltipOn": "全部访问入口",
-  "studio.accessControl.tooltipPartial": "{{total}} 个访问入口中的 {{n}} 个",
   "studio.accessControl.tooltipPaused": "已暂停 — {{name}} 已配置但未生效",
   "studio.accessControl.tooltipPro": "访问控制功能适用于 Professional 和 Team 套餐。",
+  "studio.accessControl.tooltipProtected": "{{total}} 个访问入口中有 {{n}} 个受到保护",
   "studio.accessControl.turnOffConfirm": "关闭",
-  "studio.accessControl.turnOffDescription": "{{points}} 将可被任意 IP 访问。",
-  "studio.accessControl.turnOffTitle": "关闭访问控制？",
+  "studio.accessControl.turnOffDescription": "所有访问入口都将可从任意 IP 地址访问。你的配置将被保留。",
+  "studio.accessControl.turnOffTitle": "关闭 IP 访问控制？",
   "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
   "studio.accessPoint.description": "此应用的所有访问方式。访问入口仅对应当前运行版本。",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index da5dfb36139117..712ee2c96efaae 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -74,14 +74,14 @@
   "studio.accessControl.selectAccessPoint": "請至少選擇一個要保護的存取點。",
   "studio.accessControl.selectPolicy": "選擇策略",
   "studio.accessControl.selectPolicyRequired": "請選擇一項 IP 原則。",
+  "studio.accessControl.tooltipDowngraded": "已不再受保護，適用於 Professional 和 Team 方案",
   "studio.accessControl.tooltipOff": "尚未設定",
-  "studio.accessControl.tooltipOn": "涵蓋全部存取點",
-  "studio.accessControl.tooltipPartial": "{{n}} / {{total}} 個存取點",
   "studio.accessControl.tooltipPaused": "已暫停 — {{name}} 已設定但未生效",
   "studio.accessControl.tooltipPro": "存取控制功能適用於 Professional 和 Team 方案。",
+  "studio.accessControl.tooltipProtected": "{{total}} 個存取點中有 {{n}} 個受到保護",
   "studio.accessControl.turnOffConfirm": "關閉",
-  "studio.accessControl.turnOffDescription": "{{points}} 將可被任意 IP 存取。",
-  "studio.accessControl.turnOffTitle": "關閉存取控制？",
+  "studio.accessControl.turnOffDescription": "所有存取點都將可從任何 IP 位址存取。您的設定將會保留。",
+  "studio.accessControl.turnOffTitle": "關閉 IP 存取控制？",
   "studio.accessControl.turnOn": "啟用存取控制",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",

From 604d785fed607349034260717bd1b0756a683768 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 22 Sep 2026 13:46:04 +0800
Subject: [PATCH 063/108] fix: align access control editor permissions with PRD

---
 .../test_network_access_group_service.py      |  37 ++--
 .../__tests__/config-panel.spec.tsx           |  21 +-
 .../access-control/__tests__/index.spec.tsx   | 180 ++++++++++--------
 .../access-control/policy-field.tsx           |  14 +-
 web/i18n/ar-TN/deployments.json               |   2 +
 web/i18n/de-DE/deployments.json               |   2 +
 web/i18n/en-US/deployments.json               |   2 +
 web/i18n/es-ES/deployments.json               |   2 +
 web/i18n/fa-IR/deployments.json               |   2 +
 web/i18n/fr-FR/deployments.json               |   2 +
 web/i18n/hi-IN/deployments.json               |   2 +
 web/i18n/id-ID/deployments.json               |   2 +
 web/i18n/it-IT/deployments.json               |   2 +
 web/i18n/ja-JP/deployments.json               |   2 +
 web/i18n/ko-KR/deployments.json               |   2 +
 web/i18n/lo-LA/deployments.json               |   2 +
 web/i18n/nl-NL/deployments.json               |   2 +
 web/i18n/pl-PL/deployments.json               |   2 +
 web/i18n/pt-BR/deployments.json               |   2 +
 web/i18n/ro-RO/deployments.json               |   2 +
 web/i18n/ru-RU/deployments.json               |   2 +
 web/i18n/sl-SI/deployments.json               |   2 +
 web/i18n/th-TH/deployments.json               |   2 +
 web/i18n/tr-TR/deployments.json               |   2 +
 web/i18n/uk-UA/deployments.json               |   2 +
 web/i18n/vi-VN/deployments.json               |   2 +
 web/i18n/zh-Hans/deployments.json             |   2 +
 web/i18n/zh-Hant/deployments.json             |   2 +
 28 files changed, 200 insertions(+), 100 deletions(-)

diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 25fd8060b49198..63a280780ec686 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -84,12 +84,21 @@ def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "
     )
 
 
-@pytest.mark.parametrize("role", ["normal", None])
-def test_reads_reject_non_privileged_persisted_roles_before_control_plane(role: str | None) -> None:
+@pytest.mark.parametrize("role", ["normal", "dataset_operator", None])
+@pytest.mark.parametrize(
+    "read",
+    [
+        pytest.param(lambda service: service.list_groups(_context()), id="list"),
+        pytest.param(lambda service: service.get_group(_context(), group_id=GROUP_ID), id="detail"),
+    ],
+)
+def test_reads_reject_non_privileged_persisted_roles_before_control_plane(
+    role: str | None, read: Callable[[NetworkAccessGroupService], object]
+) -> None:
     harness = _harness(role=role)
 
     with pytest.raises(NetworkAccessGroupAccessDeniedError):
-        harness.service.list_groups(_context())
+        read(harness.service)
 
     harness.memberships.get_role_for_account.assert_called_once_with(
         workspace_id=WORKSPACE_ID,
@@ -145,7 +154,7 @@ def test_reads_reject_non_privileged_persisted_roles_before_control_plane(role:
         ),
     ],
 )
-@pytest.mark.parametrize("role", ["normal", None])
+@pytest.mark.parametrize("role", ["normal", "dataset_operator", None])
 def test_mutations_reject_non_privileged_persisted_roles_before_control_plane(
     role: str | None,
     mutation: Mutation,
@@ -217,8 +226,9 @@ def test_policy_mutations_reject_editor_before_control_plane(mutation: Mutation)
     assert harness.control_plane.method_calls == []
 
 
-def test_app_binding_get_and_put_allow_editor() -> None:
-    harness = _harness(role="editor")
+@pytest.mark.parametrize("role", ["owner", "admin", "editor"])
+def test_app_binding_get_and_put_allow_privileged_roles(role: str) -> None:
+    harness = _harness(role=role)
     harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
     harness.control_plane.update_app_binding.return_value = {
         "effective_enabled": True,
@@ -259,8 +269,9 @@ def test_app_binding_get_and_put_allow_editor() -> None:
         ),
     ],
 )
-def test_app_binding_rejects_normal_role_before_app_lookup(operation: Mutation) -> None:
-    harness = _harness(role="normal")
+@pytest.mark.parametrize("role", ["normal", "dataset_operator", None])
+def test_app_binding_rejects_disallowed_roles_before_app_lookup(operation: Mutation, role: str | None) -> None:
+    harness = _harness(role=role)
 
     with pytest.raises(NetworkAccessGroupAccessDeniedError):
         operation(harness.service, _context())
@@ -283,8 +294,9 @@ def test_mutation_does_not_repeat_http_paid_plan_admission() -> None:
     harness.entitlement.is_paid_plan.assert_not_called()
 
 
-def test_public_use_cases_forward_workspace_actor_and_request_parameters() -> None:
-    harness = _harness()
+@pytest.mark.parametrize("role", ["owner", "admin"])
+def test_public_use_cases_forward_workspace_actor_and_request_parameters(role: str) -> None:
+    harness = _harness(role=role)
     harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
     harness.control_plane.create_group.return_value = {"group": {"id": GROUP_ID}}
     harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
@@ -706,8 +718,9 @@ def test_current_ip_read_rejects_disallowed_persisted_roles_before_reading_ip(ro
     harness.entitlement.is_paid_plan.assert_not_called()
 
 
-def test_current_ip_check_rejects_role_before_policy_or_ip_lookup() -> None:
-    harness = _harness(role="normal")
+@pytest.mark.parametrize("role", ["normal", "dataset_operator", None])
+def test_current_ip_check_rejects_role_before_policy_or_ip_lookup(role: str | None) -> None:
+    harness = _harness(role=role)
     supplier = MagicMock(return_value="203.0.113.7")
 
     with pytest.raises(NetworkAccessGroupAccessDeniedError):
diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index 5fb83a2faa16b9..79959d7e286e48 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -152,16 +152,31 @@ describe('AccessControlConfigPanel', () => {
     },
   )
 
-  it.each([{ canManagePolicies: false }, { readOnly: true }])(
+  it.each([
+    { canManagePolicies: false, manageLabel: 'View IP policies' },
+    { readOnly: true, manageLabel: 'Manage IP policies' },
+  ])(
     'keeps policy creation unavailable without edit permission: %j',
-    (permissions) => {
+    ({ manageLabel, ...permissions }) => {
       render(<PanelHarness {...permissions} />)
 
       expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
-      expect(screen.getByRole('button', { name: 'Manage IP policies' })).toBeEnabled()
+      expect(screen.getByRole('button', { name: manageLabel })).toBeEnabled()
     },
   )
 
+  it('lets editors open the read-only policy list with a View IP policies tooltip', async () => {
+    const user = userEvent.setup()
+    const onManagePolicies = vi.fn()
+    render(<PanelHarness canManagePolicies={false} onManagePolicies={onManagePolicies} />)
+
+    const viewPolicies = screen.getByRole('button', { name: 'View IP policies' })
+    await user.hover(viewPolicies)
+    expect(await screen.findByText('View IP policies')).toBeInTheDocument()
+    await user.click(viewPolicies)
+    expect(onManagePolicies).toHaveBeenCalledOnce()
+  })
+
   it('requires access points when editing a paused policy', () => {
     render(
       <PanelHarness
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 51feb7cd59983e..b339323631875a 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -807,14 +807,22 @@ describe('supported access points and binding permission', () => {
     },
   )
 
-  it('lets editors select and save an existing policy without allowing policy creation', async () => {
+  it('asks editors to contact an owner or admin when no policies exist', async () => {
     const user = userEvent.setup()
-    const { unmount } = renderEntry({ plan: 'professional', role: 'editor' })
+    renderEntry({ plan: 'professional', role: 'editor' })
     await user.click(getChip())
+
+    expect(screen.getByText('Ask a workspace owner or admin to create one.')).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Manage IP policies' }))
-    expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
-    unmount()
+    expect(
+      screen.queryByRole('button', { name: /(?:Manage|View) IP policies/ }),
+    ).not.toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
+  })
+
+  it('lets editors select and save an existing policy without allowing policy creation', async () => {
+    const user = userEvent.setup()
     const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(
       async (input, init) =>
         metadataResponse(new Request(input, init)) ??
@@ -831,6 +839,10 @@ describe('supported access points and binding permission', () => {
         groups: [createNetworkAccessGroupFixture()],
       })
       await user.click(getChip())
+      expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
+      await user.click(screen.getByRole('button', { name: 'View IP policies' }))
+      expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
+      await user.click(getChip())
       await user.click(screen.getByRole('option', { name: /Internal Network/ }))
       await user.click(screen.getByRole('button', { name: 'Save' }))
       await waitFor(() =>
@@ -847,89 +859,97 @@ describe('supported access points and binding permission', () => {
     }
   })
 
-  it('preserves selected scopes and versions when pausing and resuming a binding', async () => {
-    const user = userEvent.setup()
-    const availableAccessPoints = ['webapp', 'service_api', 'mcp'] as const
-    let binding = createBinding({ access_points: ['webapp', 'mcp'] })
-    const payloads: unknown[] = []
-    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
-      const request = new Request(input, init)
-      const metadata = metadataResponse(request)
-      if (metadata) return metadata
-      if (request.url.endsWith('/workspaces/current/network-access-groups'))
+  it.each(['owner', 'admin', 'editor'] as const)(
+    'lets %s pause and resume while preserving scopes and versions',
+    async (role) => {
+      const user = userEvent.setup()
+      const availableAccessPoints = ['webapp', 'service_api', 'mcp'] as const
+      let binding = createBinding({ access_points: ['webapp', 'mcp'] })
+      const payloads: unknown[] = []
+      const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async (input, init) => {
+        const request = new Request(input, init)
+        const metadata = metadataResponse(request)
+        if (metadata) return metadata
+        if (request.url.endsWith('/workspaces/current/network-access-groups'))
+          return Response.json({
+            tenant_id: 'workspace-1',
+            entitled: true,
+            groups: [createNetworkAccessGroupFixture()],
+          })
+        if (request.method === 'PUT') {
+          const payload = await request.json()
+          payloads.push(payload)
+          binding = createBinding({ ...payload, version: binding.version + 1 })
+          return Response.json({
+            binding,
+            available_access_points: availableAccessPoints,
+            effective_enabled: binding.enabled,
+          })
+        }
         return Response.json({
           tenant_id: 'workspace-1',
+          app_id: 'app-1',
           entitled: true,
-          groups: [createNetworkAccessGroupFixture()],
-        })
-      if (request.method === 'PUT') {
-        const payload = await request.json()
-        payloads.push(payload)
-        binding = createBinding({ ...payload, version: binding.version + 1 })
-        return Response.json({
           binding,
           available_access_points: availableAccessPoints,
           effective_enabled: binding.enabled,
         })
-      }
-      return Response.json({
-        tenant_id: 'workspace-1',
-        app_id: 'app-1',
-        entitled: true,
-        binding,
-        available_access_points: availableAccessPoints,
-        effective_enabled: binding.enabled,
-      })
-    })
-    try {
-      renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()], binding })
-      await user.click(getChip())
-      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
-      expect(
-        screen.getByRole('alertdialog', { name: 'Turn off IP access control?' }),
-      ).toHaveAccessibleDescription(
-        'All access points will be reachable from any IP address. Your configuration will be kept.',
-      )
-      expect(payloads).toHaveLength(0)
-      await user.click(screen.getByRole('button', { name: 'Turn off' }))
-      await waitFor(() =>
-        expect(payloads).toEqual([
-          {
-            enabled: false,
-            group_id: 'group-1',
-            access_points: ['webapp', 'mcp'],
-            expected_version: 2,
-          },
-        ]),
-      )
-      await waitFor(() =>
-        expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
-      )
-      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
-      expect(
-        screen.getByText('Paused — Internal Network is configured but not enforcing'),
-      ).toBeInTheDocument()
-      expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
-      expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
-      expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
-      await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
-      await waitFor(() => expect(payloads).toHaveLength(2))
-      expect(payloads[1]).toEqual({
-        enabled: true,
-        group_id: 'group-1',
-        access_points: ['webapp', 'mcp'],
-        expected_version: 3,
       })
-      await waitFor(() => expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument())
-      expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
-      expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
-      await waitFor(() =>
-        expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
-      )
-    } finally {
-      fetchSpy.mockRestore()
-    }
-  })
+      try {
+        renderEntry({
+          plan: 'professional',
+          role,
+          groups: [createNetworkAccessGroupFixture()],
+          binding,
+        })
+        await user.click(getChip())
+        await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+        expect(
+          screen.getByRole('alertdialog', { name: 'Turn off IP access control?' }),
+        ).toHaveAccessibleDescription(
+          'All access points will be reachable from any IP address. Your configuration will be kept.',
+        )
+        expect(payloads).toHaveLength(0)
+        await user.click(screen.getByRole('button', { name: 'Turn off' }))
+        await waitFor(() =>
+          expect(payloads).toEqual([
+            {
+              enabled: false,
+              group_id: 'group-1',
+              access_points: ['webapp', 'mcp'],
+              expected_version: 2,
+            },
+          ]),
+        )
+        await waitFor(() =>
+          expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+        )
+        expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
+        expect(
+          screen.getByText('Paused — Internal Network is configured but not enforcing'),
+        ).toBeInTheDocument()
+        expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
+        expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
+        expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
+        await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
+        await waitFor(() => expect(payloads).toHaveLength(2))
+        expect(payloads[1]).toEqual({
+          enabled: true,
+          group_id: 'group-1',
+          access_points: ['webapp', 'mcp'],
+          expected_version: 3,
+        })
+        await waitFor(() => expect(within(getChip()).getByText('2 of 3')).toBeInTheDocument())
+        expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
+        expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
+        await waitFor(() =>
+          expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+        )
+      } finally {
+        fetchSpy.mockRestore()
+      }
+    },
+  )
 
   it('shows a paid read-only binding without a downgrade or editing controls', async () => {
     const user = userEvent.setup()
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 2162d14e05dfb1..c1d889fb15bc90 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -56,7 +56,9 @@ export function AccessControlPolicyField({
   const selectLabel = t(($) => $['studio.accessControl.ipPolicy'], { ns: 'deployments' })
   const placeholder = t(($) => $['studio.accessControl.selectPolicy'], { ns: 'deployments' })
   const canCreatePolicy = canManagePolicies && !readOnly
-  const manageLabel = t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })
+  const manageLabel = canManagePolicies
+    ? t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })
+    : t(($) => $['studio.accessControl.viewIpPolicies'], { ns: 'deployments' })
   const manageButton = (
     <Tooltip>
       <TooltipTrigger
@@ -74,17 +76,19 @@ export function AccessControlPolicyField({
     return (
       <div className="flex w-full flex-col items-center gap-3 overflow-hidden rounded-lg border border-dashed border-divider-regular px-4 py-5">
         <p className="w-full text-center system-sm-medium text-text-secondary">
-          {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
+          {canManagePolicies
+            ? t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })
+            : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
         </p>
         {canCreatePolicy ? (
           <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
             {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
           </Button>
-        ) : (
+        ) : canManagePolicies ? (
           <Button type="button" variant="secondary" onClick={onManagePolicies}>
-            {t(($) => $['studio.accessControl.manageIpPolicies'], { ns: 'deployments' })}
+            {manageLabel}
           </Button>
-        )}
+        ) : null}
       </div>
     )
   }
diff --git a/web/i18n/ar-TN/deployments.json b/web/i18n/ar-TN/deployments.json
index 706969c670c638..68fdb2b9d16072 100644
--- a/web/i18n/ar-TN/deployments.json
+++ b/web/i18n/ar-TN/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "تحكّم في الوصول إلى هذا التطبيق بتطبيق سياسة IP.",
   "studio.accessControl.downgradeDescription": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
   "studio.accessControl.downgradeTitle": "لم يعد هذا التطبيق محميًا",
+  "studio.accessControl.emptyPoliciesReadOnly": "اطلب من مالك مساحة العمل أو أحد المسؤولين إنشاء سياسة IP.",
   "studio.accessControl.emptyPoliciesTitle": "لا توجد سياسات IP في مساحة العمل هذه بعد",
   "studio.accessControl.enableAccessControl": "تفعيل التحكم في الوصول",
   "studio.accessControl.entryLabel": "التحكّم في الوصول",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "ستصبح جميع نقاط الوصول متاحة من أي عنوان IP. سيتم الاحتفاظ بإعداداتك.",
   "studio.accessControl.turnOffTitle": "هل تريد إيقاف التحكّم في الوصول حسب عنوان IP؟",
   "studio.accessControl.turnOn": "تفعيل التحكم في الوصول",
+  "studio.accessControl.viewIpPolicies": "عرض سياسات IP",
   "studio.accessPoint.apiDescription": "استدعِ التطبيق من خدماتك عبر HTTP",
   "studio.accessPoint.description": "جميع طرق الوصول إلى هذا التطبيق في البيئة المدمجة وكل بيئة منشورة.",
   "studio.accessPoint.embedIntoSite": "تضمين في الموقع",
diff --git a/web/i18n/de-DE/deployments.json b/web/i18n/de-DE/deployments.json
index aaf17570c9f08b..b1608af5236ccf 100644
--- a/web/i18n/de-DE/deployments.json
+++ b/web/i18n/de-DE/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Steuern Sie den Zugriff auf diese App durch Anwenden einer IP-Richtlinie.",
   "studio.accessControl.downgradeDescription": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
   "studio.accessControl.downgradeTitle": "Diese App ist nicht mehr geschützt",
+  "studio.accessControl.emptyPoliciesReadOnly": "Bitte einen Workspace-Inhaber oder Administrator, eine IP-Richtlinie zu erstellen.",
   "studio.accessControl.emptyPoliciesTitle": "In diesem Arbeitsbereich gibt es noch keine IP-Richtlinien",
   "studio.accessControl.enableAccessControl": "Zugriffskontrolle aktivieren",
   "studio.accessControl.entryLabel": "Zugriffskontrolle",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Alle Zugriffspunkte sind dann von jeder IP-Adresse aus erreichbar. Deine Konfiguration bleibt erhalten.",
   "studio.accessControl.turnOffTitle": "IP-Zugriffskontrolle deaktivieren?",
   "studio.accessControl.turnOn": "Zugriffskontrolle aktivieren",
+  "studio.accessControl.viewIpPolicies": "IP-Richtlinien anzeigen",
   "studio.accessPoint.apiDescription": "Rufen Sie die App über HTTP aus Ihren Diensten auf",
   "studio.accessPoint.description": "Alle Möglichkeiten, diese App in der integrierten Umgebung und jeder bereitgestellten Umgebung zu erreichen.",
   "studio.accessPoint.embedIntoSite": "In Website einbetten",
diff --git a/web/i18n/en-US/deployments.json b/web/i18n/en-US/deployments.json
index ab725a52bb758b..57d53361fb9e81 100644
--- a/web/i18n/en-US/deployments.json
+++ b/web/i18n/en-US/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Control access to this app by applying an IP policy.",
   "studio.accessControl.downgradeDescription": "Access control is available on Professional and Team plans.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
+  "studio.accessControl.emptyPoliciesReadOnly": "Ask a workspace owner or admin to create one.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
   "studio.accessControl.enableAccessControl": "Enable access control",
   "studio.accessControl.entryLabel": "Access Control",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "All access points will be reachable from any IP address. Your configuration will be kept.",
   "studio.accessControl.turnOffTitle": "Turn off IP access control?",
   "studio.accessControl.turnOn": "Turn on Access Control",
+  "studio.accessControl.viewIpPolicies": "View IP policies",
   "studio.accessPoint.apiDescription": "Integrate the app into your services over HTTP",
   "studio.accessPoint.description": "All the ways this app can be reached. Access points match the running version only.",
   "studio.accessPoint.embedIntoSite": "Embed Into Site",
diff --git a/web/i18n/es-ES/deployments.json b/web/i18n/es-ES/deployments.json
index 0691d0c7773bc3..f31338a5009171 100644
--- a/web/i18n/es-ES/deployments.json
+++ b/web/i18n/es-ES/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Controla el acceso a esta aplicación aplicando una política de IP.",
   "studio.accessControl.downgradeDescription": "El control de acceso está disponible en los planes Professional y Team.",
   "studio.accessControl.downgradeTitle": "Esta aplicación ya no está protegida",
+  "studio.accessControl.emptyPoliciesReadOnly": "Pide al propietario o a un administrador del espacio de trabajo que cree una política de IP.",
   "studio.accessControl.emptyPoliciesTitle": "Aún no hay políticas de IP en este espacio de trabajo",
   "studio.accessControl.enableAccessControl": "Activar el control de acceso",
   "studio.accessControl.entryLabel": "Control de acceso",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Se podrá acceder a todos los puntos de acceso desde cualquier dirección IP. Se conservará tu configuración.",
   "studio.accessControl.turnOffTitle": "¿Desactivar el control de acceso por IP?",
   "studio.accessControl.turnOn": "Activar el control de acceso",
+  "studio.accessControl.viewIpPolicies": "Ver políticas de IP",
   "studio.accessPoint.apiDescription": "Llama a la aplicación desde tus servicios a través de HTTP",
   "studio.accessPoint.description": "Todas las formas de acceder a esta aplicación en el entorno integrado y en cada entorno desplegado.",
   "studio.accessPoint.embedIntoSite": "Insertar en el sitio",
diff --git a/web/i18n/fa-IR/deployments.json b/web/i18n/fa-IR/deployments.json
index adec49844a3f6e..c53f0ee5782fdb 100644
--- a/web/i18n/fa-IR/deployments.json
+++ b/web/i18n/fa-IR/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "با اعمال یک خط‌مشی IP، دسترسی به این برنامه را کنترل کنید.",
   "studio.accessControl.downgradeDescription": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
   "studio.accessControl.downgradeTitle": "این برنامه دیگر محافظت نمی‌شود",
+  "studio.accessControl.emptyPoliciesReadOnly": "از مالک یا مدیر فضای کاری بخواهید یک سیاست IP ایجاد کند.",
   "studio.accessControl.emptyPoliciesTitle": "هنوز هیچ خط‌مشی IP در این فضای کاری وجود ندارد",
   "studio.accessControl.enableAccessControl": "فعال‌سازی کنترل دسترسی",
   "studio.accessControl.entryLabel": "کنترل دسترسی",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "همهٔ نقاط دسترسی از هر نشانی IP قابل دسترسی خواهند بود. پیکربندی شما حفظ خواهد شد.",
   "studio.accessControl.turnOffTitle": "کنترل دسترسی بر اساس IP غیرفعال شود؟",
   "studio.accessControl.turnOn": "فعال‌سازی کنترل دسترسی",
+  "studio.accessControl.viewIpPolicies": "مشاهده سیاست‌های IP",
   "studio.accessPoint.apiDescription": "برنامه را از سرویس‌های خود از طریق HTTP فراخوانی کنید",
   "studio.accessPoint.description": "همه روش‌های دسترسی به این برنامه در محیط داخلی و هر محیط استقرار‌یافته.",
   "studio.accessPoint.embedIntoSite": "جاسازی در سایت",
diff --git a/web/i18n/fr-FR/deployments.json b/web/i18n/fr-FR/deployments.json
index 85d1bafd62152e..1c2806ba0a1546 100644
--- a/web/i18n/fr-FR/deployments.json
+++ b/web/i18n/fr-FR/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Contrôlez l’accès à cette application en appliquant une politique IP.",
   "studio.accessControl.downgradeDescription": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
   "studio.accessControl.downgradeTitle": "Cette application n’est plus protégée",
+  "studio.accessControl.emptyPoliciesReadOnly": "Demandez au propriétaire ou à un administrateur de l’espace de travail de créer une politique IP.",
   "studio.accessControl.emptyPoliciesTitle": "Cet espace de travail ne contient pas encore de politiques IP",
   "studio.accessControl.enableAccessControl": "Activer le contrôle d’accès",
   "studio.accessControl.entryLabel": "Contrôle d’accès",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Tous les points d’accès seront accessibles depuis n’importe quelle adresse IP. Votre configuration sera conservée.",
   "studio.accessControl.turnOffTitle": "Désactiver le contrôle d’accès par IP ?",
   "studio.accessControl.turnOn": "Activer le contrôle d’accès",
+  "studio.accessControl.viewIpPolicies": "Afficher les politiques IP",
   "studio.accessPoint.apiDescription": "Appelez l’application depuis vos services via HTTP",
   "studio.accessPoint.description": "Toutes les façons d’accéder à cette application dans l’environnement intégré et dans chaque environnement déployé.",
   "studio.accessPoint.embedIntoSite": "Intégrer au site",
diff --git a/web/i18n/hi-IN/deployments.json b/web/i18n/hi-IN/deployments.json
index d1180dd7e9984b..6d48b4a5f35c9e 100644
--- a/web/i18n/hi-IN/deployments.json
+++ b/web/i18n/hi-IN/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "IP नीति लागू करके इस ऐप तक पहुँच नियंत्रित करें।",
   "studio.accessControl.downgradeDescription": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
   "studio.accessControl.downgradeTitle": "यह ऐप अब सुरक्षित नहीं है",
+  "studio.accessControl.emptyPoliciesReadOnly": "वर्कस्पेस के मालिक या एडमिन से IP नीति बनाने के लिए कहें।",
   "studio.accessControl.emptyPoliciesTitle": "इस कार्यक्षेत्र में अभी कोई IP नीति नहीं है",
   "studio.accessControl.enableAccessControl": "पहुँच नियंत्रण सक्षम करें",
   "studio.accessControl.entryLabel": "पहुँच नियंत्रण",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "सभी एक्सेस पॉइंट किसी भी IP पते से सुलभ हो जाएँगे। आपका कॉन्फ़िगरेशन सुरक्षित रखा जाएगा।",
   "studio.accessControl.turnOffTitle": "IP एक्सेस कंट्रोल बंद करें?",
   "studio.accessControl.turnOn": "पहुँच नियंत्रण सक्षम करें",
+  "studio.accessControl.viewIpPolicies": "IP नीतियाँ देखें",
   "studio.accessPoint.apiDescription": "HTTP के ज़रिए अपनी सेवाओं से ऐप को कॉल करें",
   "studio.accessPoint.description": "बिल्ट-इन और हर डिप्लॉय किए गए एनवायरनमेंट में इस ऐप तक पहुँचने के सभी तरीके।",
   "studio.accessPoint.embedIntoSite": "साइट में एम्बेड करें",
diff --git a/web/i18n/id-ID/deployments.json b/web/i18n/id-ID/deployments.json
index d942caea1cf1b3..2404412ac4d8bc 100644
--- a/web/i18n/id-ID/deployments.json
+++ b/web/i18n/id-ID/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Kontrol akses ke aplikasi ini dengan menerapkan kebijakan IP.",
   "studio.accessControl.downgradeDescription": "Kontrol akses tersedia pada paket Professional dan Team.",
   "studio.accessControl.downgradeTitle": "Aplikasi ini tidak lagi dilindungi",
+  "studio.accessControl.emptyPoliciesReadOnly": "Minta pemilik atau admin ruang kerja untuk membuat kebijakan IP.",
   "studio.accessControl.emptyPoliciesTitle": "Belum ada kebijakan IP di ruang kerja ini",
   "studio.accessControl.enableAccessControl": "Aktifkan kontrol akses",
   "studio.accessControl.entryLabel": "Kontrol akses",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Semua titik akses akan dapat diakses dari alamat IP mana pun. Konfigurasi Anda akan tetap disimpan.",
   "studio.accessControl.turnOffTitle": "Nonaktifkan kontrol akses IP?",
   "studio.accessControl.turnOn": "Aktifkan kontrol akses",
+  "studio.accessControl.viewIpPolicies": "Lihat kebijakan IP",
   "studio.accessPoint.apiDescription": "Panggil aplikasi dari layanan Anda melalui HTTP",
   "studio.accessPoint.description": "Semua cara aplikasi ini dapat diakses di lingkungan Bawaan dan setiap lingkungan yang di-deploy.",
   "studio.accessPoint.embedIntoSite": "Sematkan ke situs",
diff --git a/web/i18n/it-IT/deployments.json b/web/i18n/it-IT/deployments.json
index 4da413d57cca28..2098e578c07e5e 100644
--- a/web/i18n/it-IT/deployments.json
+++ b/web/i18n/it-IT/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Controlla l’accesso a questa app applicando una policy IP.",
   "studio.accessControl.downgradeDescription": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
   "studio.accessControl.downgradeTitle": "Questa app non è più protetta",
+  "studio.accessControl.emptyPoliciesReadOnly": "Chiedi al proprietario o a un amministratore dell’area di lavoro di creare una policy IP.",
   "studio.accessControl.emptyPoliciesTitle": "Non ci sono ancora policy IP in questo spazio di lavoro",
   "studio.accessControl.enableAccessControl": "Abilita il controllo degli accessi",
   "studio.accessControl.entryLabel": "Controllo degli accessi",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Tutti i punti di accesso saranno raggiungibili da qualsiasi indirizzo IP. La configurazione verrà mantenuta.",
   "studio.accessControl.turnOffTitle": "Disattivare il controllo degli accessi IP?",
   "studio.accessControl.turnOn": "Abilita il controllo degli accessi",
+  "studio.accessControl.viewIpPolicies": "Visualizza le policy IP",
   "studio.accessPoint.apiDescription": "Chiama l’app dai tuoi servizi tramite HTTP",
   "studio.accessPoint.description": "Tutti i modi per raggiungere questa app nell’ambiente integrato e in ogni ambiente distribuito.",
   "studio.accessPoint.embedIntoSite": "Incorpora nel sito",
diff --git a/web/i18n/ja-JP/deployments.json b/web/i18n/ja-JP/deployments.json
index 4deccfc0a97542..d05f98874c34a7 100644
--- a/web/i18n/ja-JP/deployments.json
+++ b/web/i18n/ja-JP/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
   "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
+  "studio.accessControl.emptyPoliciesReadOnly": "ワークスペースのオーナーまたは管理者に作成を依頼してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.enableAccessControl": "アクセス制御を有効にする",
   "studio.accessControl.entryLabel": "アクセス制御",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "すべてのアクセスポイントが任意の IP アドレスからアクセス可能になります。設定は保持されます。",
   "studio.accessControl.turnOffTitle": "IP アクセス制御をオフにしますか？",
   "studio.accessControl.turnOn": "アクセス制御をオンにする",
+  "studio.accessControl.viewIpPolicies": "IP ポリシーを表示",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
   "studio.accessPoint.embedIntoSite": "サイトに埋め込む",
diff --git a/web/i18n/ko-KR/deployments.json b/web/i18n/ko-KR/deployments.json
index 868830e7ffc6b8..0af5809112c6c1 100644
--- a/web/i18n/ko-KR/deployments.json
+++ b/web/i18n/ko-KR/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "IP 정책을 적용하여 이 앱에 대한 접근을 제어합니다.",
   "studio.accessControl.downgradeDescription": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
   "studio.accessControl.downgradeTitle": "이 앱은 더 이상 보호되지 않습니다",
+  "studio.accessControl.emptyPoliciesReadOnly": "워크스페이스 소유자 또는 관리자에게 IP 정책 생성을 요청하세요.",
   "studio.accessControl.emptyPoliciesTitle": "이 작업 공간에는 아직 IP 정책이 없습니다",
   "studio.accessControl.enableAccessControl": "접근 제어 활성화",
   "studio.accessControl.entryLabel": "접근 제어",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "모든 IP 주소에서 모든 접근 지점에 접근할 수 있게 됩니다. 설정은 유지됩니다.",
   "studio.accessControl.turnOffTitle": "IP 접근 제어를 끄시겠습니까?",
   "studio.accessControl.turnOn": "접근 제어 활성화",
+  "studio.accessControl.viewIpPolicies": "IP 정책 보기",
   "studio.accessPoint.apiDescription": "서비스에서 HTTP로 앱 호출",
   "studio.accessPoint.description": "기본 제공 환경과 모든 배포 환경에서 이 앱에 접근하는 모든 방법입니다.",
   "studio.accessPoint.embedIntoSite": "사이트에 임베드",
diff --git a/web/i18n/lo-LA/deployments.json b/web/i18n/lo-LA/deployments.json
index d68f1dcb7acdb2..29174c9abc2bc6 100644
--- a/web/i18n/lo-LA/deployments.json
+++ b/web/i18n/lo-LA/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "ຄວບຄຸມການເຂົ້າເຖິງແອັບນີ້ໂດຍນຳໃຊ້ນະໂຍບາຍ IP.",
   "studio.accessControl.downgradeDescription": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
   "studio.accessControl.downgradeTitle": "ແອັບນີ້ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ",
+  "studio.accessControl.emptyPoliciesReadOnly": "ຂໍໃຫ້ເຈົ້າຂອງ ຫຼື ຜູ້ດູແລພື້ນທີ່ເຮັດວຽກສ້າງນະໂຍບາຍ IP.",
   "studio.accessControl.emptyPoliciesTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP ໃນພື້ນທີ່ເຮັດວຽກນີ້",
   "studio.accessControl.enableAccessControl": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.entryLabel": "ການຄວບຄຸມການເຂົ້າເຖິງ",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "ຈຸດເຂົ້າເຖິງທັງໝົດຈະສາມາດເຂົ້າເຖິງໄດ້ຈາກທຸກທີ່ຢູ່ IP. ການຕັ້ງຄ່າຂອງທ່ານຈະຖືກເກັບໄວ້.",
   "studio.accessControl.turnOffTitle": "ປິດການຄວບຄຸມການເຂົ້າເຖິງຕາມ IP ບໍ?",
   "studio.accessControl.turnOn": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
+  "studio.accessControl.viewIpPolicies": "ເບິ່ງນະໂຍບາຍ IP",
   "studio.accessPoint.apiDescription": "ເອີ້ນໃຊ້ແອັບຈາກບໍລິການຂອງທ່ານຜ່ານ HTTP",
   "studio.accessPoint.description": "ທຸກວິທີທີ່ສາມາດເຂົ້າເຖິງແອັບນີ້ໄດ້ໃນສະພາບແວດລ້ອມ Built-in ແລະທຸກສະພາບແວດລ້ອມທີ່ deploy ແລ້ວ.",
   "studio.accessPoint.embedIntoSite": "ຝັງໄວ້ໃນເວັບໄຊ",
diff --git a/web/i18n/nl-NL/deployments.json b/web/i18n/nl-NL/deployments.json
index f64ff8cb9ca76d..3659927fda394b 100644
--- a/web/i18n/nl-NL/deployments.json
+++ b/web/i18n/nl-NL/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Beheer de toegang tot deze app door een IP-beleid toe te passen.",
   "studio.accessControl.downgradeDescription": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
   "studio.accessControl.downgradeTitle": "Deze app is niet meer beschermd",
+  "studio.accessControl.emptyPoliciesReadOnly": "Vraag een eigenaar of beheerder van de werkruimte om een IP-beleid aan te maken.",
   "studio.accessControl.emptyPoliciesTitle": "Deze werkruimte heeft nog geen IP-beleid",
   "studio.accessControl.enableAccessControl": "Toegangsbeheer inschakelen",
   "studio.accessControl.entryLabel": "Toegangsbeheer",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Alle toegangspunten worden bereikbaar vanaf elk IP-adres. Je configuratie blijft bewaard.",
   "studio.accessControl.turnOffTitle": "IP-toegangsbeheer uitschakelen?",
   "studio.accessControl.turnOn": "Toegangsbeheer inschakelen",
+  "studio.accessControl.viewIpPolicies": "IP-beleid bekijken",
   "studio.accessPoint.apiDescription": "Roep de app via HTTP aan vanuit je services",
   "studio.accessPoint.description": "Alle manieren waarop deze app bereikbaar is in de ingebouwde omgeving en elke geïmplementeerde omgeving.",
   "studio.accessPoint.embedIntoSite": "In site insluiten",
diff --git a/web/i18n/pl-PL/deployments.json b/web/i18n/pl-PL/deployments.json
index 053cabef4c6110..e9b8a6a64b39aa 100644
--- a/web/i18n/pl-PL/deployments.json
+++ b/web/i18n/pl-PL/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Kontroluj dostęp do tej aplikacji, stosując politykę IP.",
   "studio.accessControl.downgradeDescription": "Kontrola dostępu jest dostępna w planach Professional i Team.",
   "studio.accessControl.downgradeTitle": "Ta aplikacja nie jest już chroniona",
+  "studio.accessControl.emptyPoliciesReadOnly": "Poproś właściciela lub administratora obszaru roboczego o utworzenie zasad IP.",
   "studio.accessControl.emptyPoliciesTitle": "W tym obszarze roboczym nie ma jeszcze polityk IP",
   "studio.accessControl.enableAccessControl": "Włącz kontrolę dostępu",
   "studio.accessControl.entryLabel": "Kontrola dostępu",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Wszystkie punkty dostępu będą dostępne z dowolnego adresu IP. Twoja konfiguracja zostanie zachowana.",
   "studio.accessControl.turnOffTitle": "Wyłączyć kontrolę dostępu według adresu IP?",
   "studio.accessControl.turnOn": "Włącz kontrolę dostępu",
+  "studio.accessControl.viewIpPolicies": "Wyświetl zasady IP",
   "studio.accessPoint.apiDescription": "Wywołuj aplikację z usług przez HTTP",
   "studio.accessPoint.description": "Wszystkie sposoby dostępu do tej aplikacji w środowisku wbudowanym i każdym wdrożonym środowisku.",
   "studio.accessPoint.embedIntoSite": "Osadź w witrynie",
diff --git a/web/i18n/pt-BR/deployments.json b/web/i18n/pt-BR/deployments.json
index ea5007f6c20a41..39ed35fe0196e0 100644
--- a/web/i18n/pt-BR/deployments.json
+++ b/web/i18n/pt-BR/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Controle o acesso a este aplicativo aplicando uma política de IP.",
   "studio.accessControl.downgradeDescription": "O controle de acesso está disponível nos planos Professional e Team.",
   "studio.accessControl.downgradeTitle": "Este aplicativo não está mais protegido",
+  "studio.accessControl.emptyPoliciesReadOnly": "Peça ao proprietário ou a um administrador do espaço de trabalho para criar uma política de IP.",
   "studio.accessControl.emptyPoliciesTitle": "Ainda não há políticas de IP neste espaço de trabalho",
   "studio.accessControl.enableAccessControl": "Ativar controle de acesso",
   "studio.accessControl.entryLabel": "Controle de acesso",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Todos os pontos de acesso poderão ser acessados de qualquer endereço IP. Sua configuração será mantida.",
   "studio.accessControl.turnOffTitle": "Desativar o controle de acesso por IP?",
   "studio.accessControl.turnOn": "Ativar controle de acesso",
+  "studio.accessControl.viewIpPolicies": "Ver políticas de IP",
   "studio.accessPoint.apiDescription": "Chame o aplicativo a partir dos seus serviços via HTTP",
   "studio.accessPoint.description": "Todas as formas de acessar este aplicativo no ambiente integrado e em cada ambiente implantado.",
   "studio.accessPoint.embedIntoSite": "Incorporar ao site",
diff --git a/web/i18n/ro-RO/deployments.json b/web/i18n/ro-RO/deployments.json
index 0514dc6a093524..d1827cfdd122cb 100644
--- a/web/i18n/ro-RO/deployments.json
+++ b/web/i18n/ro-RO/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Controlați accesul la această aplicație aplicând o politică IP.",
   "studio.accessControl.downgradeDescription": "Controlul accesului este disponibil în planurile Professional și Team.",
   "studio.accessControl.downgradeTitle": "Această aplicație nu mai este protejată",
+  "studio.accessControl.emptyPoliciesReadOnly": "Cere proprietarului sau unui administrator al spațiului de lucru să creeze o politică IP.",
   "studio.accessControl.emptyPoliciesTitle": "Nu există încă politici IP în acest spațiu de lucru",
   "studio.accessControl.enableAccessControl": "Activați controlul accesului",
   "studio.accessControl.entryLabel": "Controlul accesului",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Toate punctele de acces vor fi accesibile de la orice adresă IP. Configurația va fi păstrată.",
   "studio.accessControl.turnOffTitle": "Dezactivați controlul accesului pe baza adresei IP?",
   "studio.accessControl.turnOn": "Activați controlul accesului",
+  "studio.accessControl.viewIpPolicies": "Vezi politicile IP",
   "studio.accessPoint.apiDescription": "Apelează aplicația din serviciile tale prin HTTP",
   "studio.accessPoint.description": "Toate modalitățile prin care această aplicație poate fi accesată în mediul integrat și în fiecare mediu implementat.",
   "studio.accessPoint.embedIntoSite": "Încorporează în site",
diff --git a/web/i18n/ru-RU/deployments.json b/web/i18n/ru-RU/deployments.json
index 691a54a8212ecb..cf84d55d4ea2b6 100644
--- a/web/i18n/ru-RU/deployments.json
+++ b/web/i18n/ru-RU/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Управляйте доступом к этому приложению с помощью IP-политики.",
   "studio.accessControl.downgradeDescription": "Управление доступом доступно в тарифах Professional и Team.",
   "studio.accessControl.downgradeTitle": "Это приложение больше не защищено",
+  "studio.accessControl.emptyPoliciesReadOnly": "Попросите владельца или администратора рабочего пространства создать политику IP.",
   "studio.accessControl.emptyPoliciesTitle": "В этом рабочем пространстве пока нет IP-политик",
   "studio.accessControl.enableAccessControl": "Включить контроль доступа",
   "studio.accessControl.entryLabel": "Контроль доступа",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Все точки доступа станут доступны с любого IP-адреса. Ваша конфигурация будет сохранена.",
   "studio.accessControl.turnOffTitle": "Отключить контроль доступа по IP?",
   "studio.accessControl.turnOn": "Включить контроль доступа",
+  "studio.accessControl.viewIpPolicies": "Просмотреть политики IP",
   "studio.accessPoint.apiDescription": "Вызывайте приложение из своих сервисов по HTTP",
   "studio.accessPoint.description": "Все способы доступа к приложению во встроенной среде и каждой развернутой среде.",
   "studio.accessPoint.embedIntoSite": "Встроить на сайт",
diff --git a/web/i18n/sl-SI/deployments.json b/web/i18n/sl-SI/deployments.json
index 060e18a7cbed55..6c24ce54585925 100644
--- a/web/i18n/sl-SI/deployments.json
+++ b/web/i18n/sl-SI/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Nadzirajte dostop do te aplikacije z uporabo pravilnika IP.",
   "studio.accessControl.downgradeDescription": "Nadzor dostopa je na voljo v paketih Professional in Team.",
   "studio.accessControl.downgradeTitle": "Ta aplikacija ni več zaščitena",
+  "studio.accessControl.emptyPoliciesReadOnly": "Prosite lastnika ali skrbnika delovnega prostora, naj ustvari pravilnik IP.",
   "studio.accessControl.emptyPoliciesTitle": "V tem delovnem prostoru še ni pravilnikov IP",
   "studio.accessControl.enableAccessControl": "Omogoči nadzor dostopa",
   "studio.accessControl.entryLabel": "Nadzor dostopa",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Vse dostopne točke bodo dosegljive s katerega koli naslova IP. Vaša konfiguracija bo ohranjena.",
   "studio.accessControl.turnOffTitle": "Izklopim nadzor dostopa po naslovu IP?",
   "studio.accessControl.turnOn": "Omogoči nadzor dostopa",
+  "studio.accessControl.viewIpPolicies": "Ogled pravilnikov IP",
   "studio.accessPoint.apiDescription": "Pokličite aplikacijo iz svojih storitev prek HTTP",
   "studio.accessPoint.description": "Vsi načini dostopa do te aplikacije v vgrajenem in vsakem uvedenem okolju.",
   "studio.accessPoint.embedIntoSite": "Vdelaj v spletno mesto",
diff --git a/web/i18n/th-TH/deployments.json b/web/i18n/th-TH/deployments.json
index 325fbd0e953c26..2a4f4ec33474f0 100644
--- a/web/i18n/th-TH/deployments.json
+++ b/web/i18n/th-TH/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "ควบคุมการเข้าถึงแอปนี้โดยใช้นโยบาย IP",
   "studio.accessControl.downgradeDescription": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
   "studio.accessControl.downgradeTitle": "แอปนี้ไม่ได้รับการปกป้องอีกต่อไป",
+  "studio.accessControl.emptyPoliciesReadOnly": "ขอให้เจ้าของหรือผู้ดูแลระบบของเวิร์กสเปซสร้างนโยบาย IP",
   "studio.accessControl.emptyPoliciesTitle": "ยังไม่มีนโยบาย IP ในพื้นที่ทำงานนี้",
   "studio.accessControl.enableAccessControl": "เปิดใช้งานการควบคุมการเข้าถึง",
   "studio.accessControl.entryLabel": "การควบคุมการเข้าถึง",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "จุดเข้าถึงทั้งหมดจะสามารถเข้าถึงได้จากทุกที่อยู่ IP โดยจะเก็บการตั้งค่าของคุณไว้",
   "studio.accessControl.turnOffTitle": "ปิดการควบคุมการเข้าถึงตาม IP หรือไม่?",
   "studio.accessControl.turnOn": "เปิดใช้งานการควบคุมการเข้าถึง",
+  "studio.accessControl.viewIpPolicies": "ดูนโยบาย IP",
   "studio.accessPoint.apiDescription": "เรียกใช้แอปจากบริการของคุณผ่าน HTTP",
   "studio.accessPoint.description": "ทุกช่องทางที่เข้าถึงแอปนี้ได้ในสภาพแวดล้อม Built-in และทุกสภาพแวดล้อมที่ปรับใช้",
   "studio.accessPoint.embedIntoSite": "ฝังในเว็บไซต์",
diff --git a/web/i18n/tr-TR/deployments.json b/web/i18n/tr-TR/deployments.json
index 977b2d9e35c380..822bde16a3d2c9 100644
--- a/web/i18n/tr-TR/deployments.json
+++ b/web/i18n/tr-TR/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Bir IP politikası uygulayarak bu uygulamaya erişimi denetleyin.",
   "studio.accessControl.downgradeDescription": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
   "studio.accessControl.downgradeTitle": "Bu uygulama artık korunmuyor",
+  "studio.accessControl.emptyPoliciesReadOnly": "Çalışma alanı sahibinden veya yöneticisinden bir IP politikası oluşturmasını isteyin.",
   "studio.accessControl.emptyPoliciesTitle": "Bu çalışma alanında henüz IP politikası yok",
   "studio.accessControl.enableAccessControl": "Erişim denetimini etkinleştir",
   "studio.accessControl.entryLabel": "Erişim kontrolü",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Tüm erişim noktaları herhangi bir IP adresinden erişilebilir olacak. Yapılandırmanız korunacak.",
   "studio.accessControl.turnOffTitle": "IP erişim denetimi kapatılsın mı?",
   "studio.accessControl.turnOn": "Erişim denetimini etkinleştir",
+  "studio.accessControl.viewIpPolicies": "IP politikalarını görüntüle",
   "studio.accessPoint.apiDescription": "Uygulamayı hizmetlerinizden HTTP üzerinden çağırın",
   "studio.accessPoint.description": "Bu uygulamaya Yerleşik ortamda ve dağıtılan her ortamda erişmenin tüm yolları.",
   "studio.accessPoint.embedIntoSite": "Siteye göm",
diff --git a/web/i18n/uk-UA/deployments.json b/web/i18n/uk-UA/deployments.json
index 18063fcfa26cb6..92a5ad5d7edede 100644
--- a/web/i18n/uk-UA/deployments.json
+++ b/web/i18n/uk-UA/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Керуйте доступом до цього застосунку за допомогою IP-політики.",
   "studio.accessControl.downgradeDescription": "Керування доступом доступне в планах Professional і Team.",
   "studio.accessControl.downgradeTitle": "Цей застосунок більше не захищено",
+  "studio.accessControl.emptyPoliciesReadOnly": "Попросіть власника або адміністратора робочого простору створити політику IP.",
   "studio.accessControl.emptyPoliciesTitle": "У цьому робочому просторі ще немає IP-політик",
   "studio.accessControl.enableAccessControl": "Увімкнути контроль доступу",
   "studio.accessControl.entryLabel": "Контроль доступу",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Усі точки доступу стануть доступними з будь-якої IP-адреси. Вашу конфігурацію буде збережено.",
   "studio.accessControl.turnOffTitle": "Вимкнути контроль доступу за IP?",
   "studio.accessControl.turnOn": "Увімкнути контроль доступу",
+  "studio.accessControl.viewIpPolicies": "Переглянути політики IP",
   "studio.accessPoint.apiDescription": "Викликайте застосунок зі своїх сервісів через HTTP",
   "studio.accessPoint.description": "Усі способи доступу до застосунку у вбудованому та кожному розгорнутому середовищі.",
   "studio.accessPoint.embedIntoSite": "Вбудувати на сайт",
diff --git a/web/i18n/vi-VN/deployments.json b/web/i18n/vi-VN/deployments.json
index 5a3a4e2fb390c2..410abb841f471f 100644
--- a/web/i18n/vi-VN/deployments.json
+++ b/web/i18n/vi-VN/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "Kiểm soát quyền truy cập ứng dụng này bằng cách áp dụng chính sách IP.",
   "studio.accessControl.downgradeDescription": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
   "studio.accessControl.downgradeTitle": "Ứng dụng này không còn được bảo vệ",
+  "studio.accessControl.emptyPoliciesReadOnly": "Hãy yêu cầu chủ sở hữu hoặc quản trị viên không gian làm việc tạo chính sách IP.",
   "studio.accessControl.emptyPoliciesTitle": "Chưa có chính sách IP nào trong không gian làm việc này",
   "studio.accessControl.enableAccessControl": "Bật kiểm soát truy cập",
   "studio.accessControl.entryLabel": "Kiểm soát truy cập",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "Tất cả điểm truy cập sẽ có thể được truy cập từ bất kỳ địa chỉ IP nào. Cấu hình của bạn sẽ được giữ lại.",
   "studio.accessControl.turnOffTitle": "Tắt kiểm soát truy cập theo IP?",
   "studio.accessControl.turnOn": "Bật kiểm soát truy cập",
+  "studio.accessControl.viewIpPolicies": "Xem chính sách IP",
   "studio.accessPoint.apiDescription": "Gọi ứng dụng từ các dịch vụ của bạn qua HTTP",
   "studio.accessPoint.description": "Mọi cách có thể truy cập ứng dụng này trong môi trường tích hợp sẵn và mọi môi trường đã triển khai.",
   "studio.accessPoint.embedIntoSite": "Nhúng vào trang web",
diff --git a/web/i18n/zh-Hans/deployments.json b/web/i18n/zh-Hans/deployments.json
index c344236f4a3453..53c710e5b5af9e 100644
--- a/web/i18n/zh-Hans/deployments.json
+++ b/web/i18n/zh-Hans/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
   "studio.accessControl.downgradeDescription": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
+  "studio.accessControl.emptyPoliciesReadOnly": "请联系工作空间所有者或管理员创建 IP 策略。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.enableAccessControl": "启用访问控制",
   "studio.accessControl.entryLabel": "访问控制",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "所有访问入口都将可从任意 IP 地址访问。你的配置将被保留。",
   "studio.accessControl.turnOffTitle": "关闭 IP 访问控制？",
   "studio.accessControl.turnOn": "开启访问控制",
+  "studio.accessControl.viewIpPolicies": "查看 IP 策略",
   "studio.accessPoint.apiDescription": "通过 HTTP 将应用集成到你的服务中",
   "studio.accessPoint.description": "此应用的所有访问方式。访问入口仅对应当前运行版本。",
   "studio.accessPoint.embedIntoSite": "嵌入网站",
diff --git a/web/i18n/zh-Hant/deployments.json b/web/i18n/zh-Hant/deployments.json
index 712ee2c96efaae..33b02d1a1178eb 100644
--- a/web/i18n/zh-Hant/deployments.json
+++ b/web/i18n/zh-Hant/deployments.json
@@ -45,6 +45,7 @@
   "studio.accessControl.description": "透過套用 IP 原則來控制對此應用程式的存取。",
   "studio.accessControl.downgradeDescription": "存取控制功能適用於 Professional 和 Team 方案。",
   "studio.accessControl.downgradeTitle": "此應用程式已不再受保護",
+  "studio.accessControl.emptyPoliciesReadOnly": "請聯絡工作空間擁有者或管理員建立 IP 原則。",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
   "studio.accessControl.enableAccessControl": "啟用存取控制",
   "studio.accessControl.entryLabel": "存取控制",
@@ -83,6 +84,7 @@
   "studio.accessControl.turnOffDescription": "所有存取點都將可從任何 IP 位址存取。您的設定將會保留。",
   "studio.accessControl.turnOffTitle": "關閉 IP 存取控制？",
   "studio.accessControl.turnOn": "啟用存取控制",
+  "studio.accessControl.viewIpPolicies": "檢視 IP 原則",
   "studio.accessPoint.apiDescription": "透過 HTTP 從你的服務呼叫應用程式",
   "studio.accessPoint.description": "應用程式在內建環境和每個已部署環境中的所有存取方式。",
   "studio.accessPoint.embedIntoSite": "嵌入網站",

From 388e663a303177f0090f60186c665c2f32b58618 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Tue, 22 Sep 2026 16:50:07 +0800
Subject: [PATCH 064/108] fix(api): require published apps before public web
 admission

---
 api/controllers/web/wraps.py                  |  20 +-
 api/core/app/public_runtime.py                |  66 +++++
 api/repositories/web_passport_repository.py   |   2 +
 .../webapp_access_query_repository.py         |   3 +
 api/services/webapp_access_query_service.py   |   2 +-
 .../controllers/web/test_wraps.py             |   9 +-
 .../web/test_public_app_admission.py          | 271 ++++++++++++++++++
 .../unit_tests/controllers/web/test_wraps.py  |  16 +-
 .../test_public_app_availability.py           | 202 +++++++++++++
 .../test_web_passport_repository.py           |  37 ++-
 .../test_webapp_access_query_repository.py    |  17 +-
 11 files changed, 635 insertions(+), 10 deletions(-)
 create mode 100644 api/core/app/public_runtime.py
 create mode 100644 api/tests/unit_tests/controllers/web/test_public_app_admission.py
 create mode 100644 api/tests/unit_tests/repositories/test_public_app_availability.py

diff --git a/api/controllers/web/wraps.py b/api/controllers/web/wraps.py
index 9af99821d4a814..397fa0469ddbe6 100644
--- a/api/controllers/web/wraps.py
+++ b/api/controllers/web/wraps.py
@@ -10,11 +10,13 @@
 
 from constants import HEADER_NAME_APP_CODE
 from controllers.web.error import WebAppAuthAccessDeniedError, WebAppAuthRequiredError, WebAppNotFoundError
+from core.app.public_runtime import published_app_filter
 from core.db.session_factory import session_factory
 from core.logging.context import set_identity_context
 from extensions.ext_database import db
 from libs.passport import PassportService
 from libs.token import extract_webapp_passport
+from models.enums import AppStatus
 from models.model import App, EndUser, Site
 from services.app_service import AppService
 from services.enterprise.enterprise_service import EnterpriseService, WebAppAccessMode, WebAppSettings
@@ -56,16 +58,28 @@ def decode_jwt_token(app_code: str | None = None, user_id: str | None = None) ->
         app_code = decoded.get("app_code")
         app_id = decoded.get("app_id")
         with session_factory.create_session() as session:
-            app_model = session.scalar(select(App).where(App.id == app_id))
-            site = session.scalar(select(Site).where(Site.code == app_code))
+            # A previously issued passport cannot expose an App after its
+            # published artifact disappears. Console/Debug never use this gate.
+            app_model = session.scalar(
+                select(App).where(App.id == app_id, App.status == AppStatus.NORMAL, published_app_filter())
+            )
             if not app_model:
                 raise WebAppNotFoundError()
+            site = session.scalar(
+                select(Site).where(Site.code == app_code, Site.app_id == app_model.id, Site.status == AppStatus.NORMAL)
+            )
             if not app_code or not site:
                 raise WebAppNotFoundError()
             if app_model.enable_site is False:
                 raise WebAppNotFoundError()
             end_user_id = decoded.get("end_user_id")
-            end_user = session.scalar(select(EndUser).where(EndUser.id == end_user_id))
+            end_user = session.scalar(
+                select(EndUser).where(
+                    EndUser.id == end_user_id,
+                    EndUser.app_id == app_model.id,
+                    EndUser.tenant_id == app_model.tenant_id,
+                )
+            )
             if not end_user:
                 raise NotFound()
 
diff --git a/api/core/app/public_runtime.py b/api/core/app/public_runtime.py
new file mode 100644
index 00000000000000..5f1d16cba9a25b
--- /dev/null
+++ b/api/core/app/public_runtime.py
@@ -0,0 +1,66 @@
+"""Publication admission shared by public Web App identity and passport reads.
+
+This is not a Console/Debug visibility rule. Published pointers keep serving
+while a newer draft is edited; an Agent's dirty-draft flag is not a publication
+gate. Every referenced artifact must still belong to this App and workspace.
+"""
+
+from sqlalchemy import and_, or_, select
+from sqlalchemy.sql.elements import ColumnElement
+
+from core.agent.publish_visibility import workflow_callable_active_snapshot_filter
+from models.agent import APP_BACKED_AGENT_SOURCES, Agent, AgentConfigSnapshot, AgentScope, AgentStatus
+from models.model import App, AppMode, AppModelConfig
+from models.workflow import Workflow
+
+
+def published_app_filter() -> ColumnElement[bool]:
+    """Match Apps with a live published artifact, without loading private content.
+
+    Callers additionally own App/Site lifecycle and authentication checks. The
+    predicate performs only reads and can be reused inside passport issuance's
+    bounded transaction before creating or reusing an EndUser.
+    """
+    published_workflow = (
+        select(Workflow.id)
+        .where(
+            Workflow.id == App.workflow_id,
+            Workflow.app_id == App.id,
+            Workflow.tenant_id == App.tenant_id,
+            Workflow.version != "draft",
+        )
+        .correlate(App)
+        .exists()
+    )
+    published_model_config = (
+        select(AppModelConfig.id)
+        .where(AppModelConfig.id == App.app_model_config_id, AppModelConfig.app_id == App.id)
+        .correlate(App)
+        .exists()
+    )
+    published_agent = (
+        select(Agent.id)
+        .join(
+            AgentConfigSnapshot,
+            and_(
+                AgentConfigSnapshot.id == Agent.active_config_snapshot_id,
+                AgentConfigSnapshot.agent_id == Agent.id,
+                AgentConfigSnapshot.tenant_id == Agent.tenant_id,
+            ),
+        )
+        .where(
+            Agent.app_id == App.id,
+            Agent.tenant_id == App.tenant_id,
+            Agent.scope == AgentScope.ROSTER,
+            Agent.source.in_(APP_BACKED_AGENT_SOURCES),
+            Agent.status == AgentStatus.ACTIVE,
+            workflow_callable_active_snapshot_filter(),
+        )
+        .correlate(App)
+        .exists()
+    )
+    return or_(
+        and_(App.mode.in_((AppMode.WORKFLOW, AppMode.ADVANCED_CHAT)), published_workflow),
+        and_(App.mode.in_((AppMode.CHAT, AppMode.COMPLETION, AppMode.AGENT_CHAT)), published_model_config),
+        and_(App.mode == AppMode.AGENT, published_agent),
+    )
diff --git a/api/repositories/web_passport_repository.py b/api/repositories/web_passport_repository.py
index f312c92d007374..f26cb039a699fd 100644
--- a/api/repositories/web_passport_repository.py
+++ b/api/repositories/web_passport_repository.py
@@ -5,6 +5,7 @@
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session, sessionmaker
 
+from core.app.public_runtime import published_app_filter
 from models.enums import AppStatus, EndUserType
 from models.model import App, EndUser, Site
 from services.entities.passport_entities import EndUserRecord, WebAppRecord, WebPassportEndUserResolution
@@ -88,6 +89,7 @@ def _active_web_app_stmt(app_code: str):
                 Site.status == AppStatus.NORMAL,
                 App.status == AppStatus.NORMAL,
                 App.enable_site.is_(True),
+                published_app_filter(),
             )
         )
 
diff --git a/api/repositories/webapp_access_query_repository.py b/api/repositories/webapp_access_query_repository.py
index 37347b398a444d..ba78abff287036 100644
--- a/api/repositories/webapp_access_query_repository.py
+++ b/api/repositories/webapp_access_query_repository.py
@@ -7,6 +7,7 @@
 from sqlalchemy.exc import DBAPIError, TimeoutError
 from sqlalchemy.orm import Session, sessionmaker
 
+from core.app.public_runtime import published_app_filter
 from models.enums import AppStatus
 from models.model import App, Site
 from services.webapp_access_query_service import WebAppAccessQuery, WebAppAccessUnavailableError
@@ -28,6 +29,7 @@ def find_app_id_by_code(self, app_code: str) -> str | None:
                         Site.status == AppStatus.NORMAL,
                         App.status == AppStatus.NORMAL,
                         App.enable_site.is_(True),
+                        published_app_filter(),
                     )
                     .limit(1)
                 )
@@ -52,6 +54,7 @@ def is_app_available(self, app_id: str) -> bool:
                             Site.status == AppStatus.NORMAL,
                             App.status == AppStatus.NORMAL,
                             App.enable_site.is_(True),
+                            published_app_filter(),
                         )
                         .limit(1)
                     )
diff --git a/api/services/webapp_access_query_service.py b/api/services/webapp_access_query_service.py
index 8291bcd7fb5fdf..b5c9ecf755c4db 100644
--- a/api/services/webapp_access_query_service.py
+++ b/api/services/webapp_access_query_service.py
@@ -41,7 +41,7 @@ def __init__(
         self._is_user_allowed_for_app = is_user_allowed_for_app
 
     def resolve_app_id(self, *, app_id: str | None = None, app_code: str | None = None) -> str:
-        """Resolve a live public App identity without loading authentication settings."""
+        """Resolve a published public App identity without tokens or user writes."""
         if app_code:
             app_id = self._access.find_app_id_by_code(app_code)
             if app_id is None:
diff --git a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
index c0cdf0e1b5e31c..38bb46a302c6e0 100644
--- a/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
+++ b/api/tests/test_containers_integration_tests/controllers/web/test_wraps.py
@@ -221,7 +221,7 @@ def app(self, flask_app_with_containers: Flask):
         return flask_app_with_containers
 
     def _create_app_site_enduser(self, db_session: Session, *, enable_site: bool = True):
-        from models.model import App, AppMode, CustomizeTokenStrategy, EndUser, Site
+        from models.model import App, AppMode, AppModelConfig, CustomizeTokenStrategy, EndUser, Site
 
         tenant_id = str(uuid4())
         app_model = App(
@@ -235,6 +235,13 @@ def _create_app_site_enduser(self, db_session: Session, *, enable_site: bool = T
         db_session.commit()
         db_session.expire_all()
 
+        # The happy-path fixture represents a published public App.
+        config = AppModelConfig(app_id=app_model.id)
+        db_session.add(config)
+        db_session.flush()
+        app_model.app_model_config_id = config.id
+        db_session.commit()
+
         site = Site(
             app_id=app_model.id,
             title="test-site",
diff --git a/api/tests/unit_tests/controllers/web/test_public_app_admission.py b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
new file mode 100644
index 00000000000000..81ff4a5846460b
--- /dev/null
+++ b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
@@ -0,0 +1,271 @@
+"""Public bootstrap admission with real SQL repositories and the canonical hook."""
+
+from datetime import UTC, datetime
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+from uuid import uuid4
+
+import pytest
+from flask import Flask
+from sqlalchemy import func, select
+from sqlalchemy.exc import OperationalError
+from sqlalchemy.orm import Session, sessionmaker
+
+from configs import dify_config
+from controllers.web import app as app_controller
+from controllers.web import bp, login, passport, site, wraps
+from enums import DeploymentEdition, WebAppAccessMode
+from models.account import Tenant
+from models.enums import EndUserType
+from models.model import App, AppMode, CustomizeTokenStrategy, EndUser, Message, Site
+from models.workflow import Workflow, WorkflowRun, WorkflowType
+from repositories.app_definition_query_repository import AppDefinitionQueryRepository
+from repositories.web_passport_repository import WebPassportRepository
+from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
+from services.app_definition_query_service import AppDefinitionQueryService
+from services.entities.feature_entities import FeatureModel
+from services.web_app_runtime_query_service import WebAppRuntimeQueryService
+from services.web_passport_service import WebPassportService
+from services.webapp_access_query_service import WebAppAccessQueryService
+
+
+def _harness(
+    session: Session,
+    factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    published: bool,
+    missing: bool = False,
+) -> SimpleNamespace:
+    app = App(
+        id=str(uuid4()),
+        tenant_id=str(uuid4()),
+        mode=AppMode.ADVANCED_CHAT,
+        name="Must not leak",
+        enable_site=True,
+        enable_api=True,
+    )
+    old_user = EndUser(
+        id=str(uuid4()),
+        tenant_id=app.tenant_id,
+        app_id=app.id,
+        session_id="old",
+        is_anonymous=True,
+        type=EndUserType.BROWSER,
+    )
+    if not missing:
+        tenant = Tenant(name="Private workspace")
+        tenant.id = app.tenant_id
+        session.add(tenant)
+        workflow = Workflow(
+            id=str(uuid4()),
+            tenant_id=app.tenant_id,
+            app_id=app.id,
+            type=WorkflowType.CHAT,
+            version="published" if published else "draft",
+            graph='{"nodes":[]}',
+            features="{}",
+            created_by=str(uuid4()),
+            environment_variables=[],
+            conversation_variables=[],
+            rag_pipeline_variables=[],
+        )
+        if published:
+            app.workflow_id = workflow.id
+        session.add_all(
+            [
+                app,
+                old_user,
+                workflow,
+                Site(
+                    app_id=app.id,
+                    code="fixture-code",
+                    title="Must not leak",
+                    default_language="en-US",
+                    customize_token_strategy=CustomizeTokenStrategy.UUID,
+                ),
+            ]
+        )
+        session.commit()
+
+    access_repo = WebAppAccessQueryRepository(session_factory=factory)
+    passport_repo = WebPassportRepository(session_factory=factory, generate_session_id=lambda: "new-session")
+    auth, tokens, mode_lookup = MagicMock(), MagicMock(), MagicMock(return_value=WebAppAccessMode.PUBLIC)
+    auth.is_webapp_auth_enabled.return_value = False
+    tokens.issue.return_value = "new-passport"
+    tokens.verify.return_value = {"app_id": app.id, "app_code": "fixture-code", "end_user_id": old_user.id}
+    definitions = AppDefinitionQueryRepository(session_factory=factory)
+    services = SimpleNamespace(
+        webapp_access=WebAppAccessQueryService(
+            access=access_repo,
+            webapp_auth_enabled=False,
+            access_mode_for_app=mode_lookup,
+            is_user_allowed_for_app=MagicMock(),
+        ),
+        web_passport=WebPassportService(
+            passports=passport_repo,
+            auth=auth,
+            tokens=tokens,
+            now=lambda: datetime.now(UTC),
+            access_token_expire_minutes=60,
+        ),
+        app_definitions=MagicMock(wraps=AppDefinitionQueryService(definitions=definitions, builtin_icon_url_prefix="")),
+        web_app_runtime=MagicMock(
+            wraps=WebAppRuntimeQueryService(
+                runtime=definitions,
+                file_service=MagicMock(),
+                workspace_features=lambda _: FeatureModel(),
+                files_url="https://files.example",
+                deployment_edition=DeploymentEdition.CLOUD,
+            )
+        ),
+    )
+    for module in (app_controller, login, passport, site):
+        monkeypatch.setattr(module, "application_services", lambda: services)
+    monkeypatch.setattr(wraps, "PassportService", lambda: tokens)
+    monkeypatch.setattr(wraps, "extract_webapp_passport", lambda *_: "old-passport")
+    monkeypatch.setattr(wraps.SystemFeatureService, "is_webapp_auth_enabled", lambda: False)
+    monkeypatch.setattr(dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
+    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    flask = Flask(__name__)
+    flask.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
+    flask.register_blueprint(bp)
+    return SimpleNamespace(
+        app=app,
+        old_user=old_user,
+        client=flask.test_client(),
+        services=services,
+        tokens=tokens,
+        auth=auth,
+        mode_lookup=mode_lookup,
+        access_repo=access_repo,
+        passport_repo=passport_repo,
+    )
+
+
+ROUTES = (
+    "/webapp/access-mode?appCode=fixture-code",
+    "/login/status?app_code=fixture-code",
+    "/passport?user_id=new-session",
+    "/site",
+    "/meta",
+    "/parameters",
+)
+
+
+@pytest.mark.parametrize("route", ROUTES)
+@pytest.mark.parametrize("missing", [False, True], ids=["unpublished", "missing"])
+def test_all_bootstrap_routes_share_404_before_user_or_metadata_side_effects(
+    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    route: str,
+    missing: bool,
+) -> None:
+    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=False, missing=missing)
+    response = h.client.get(
+        "/api" + route,
+        headers={"X-App-Code": "fixture-code"},
+        environ_overrides={"REMOTE_ADDR": "172.18.0.2", "HTTP_X_FORWARDED_FOR": "203.0.113.42"},
+    )
+    assert response.status_code == 404
+    assert (
+        response.data == b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
+    )
+    assert response.headers["Content-Type"] == "application/json"
+    assert response.headers["Cache-Control"] == "no-store"
+    assert h.services.app_definitions.method_calls == []
+    assert h.services.web_app_runtime.method_calls == []
+    assert h.auth.method_calls == []
+    h.mode_lookup.assert_not_called()
+    h.tokens.issue.assert_not_called()
+    assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == (0 if missing else 1)
+    assert sqlite_session.scalar(select(func.count()).select_from(WorkflowRun)) == 0
+    assert sqlite_session.scalar(select(func.count()).select_from(Message)) == 0
+
+
+@pytest.mark.parametrize("route", ROUTES)
+def test_published_bootstrap_remains_successful_with_normal_passport_behavior(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+) -> None:
+    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    response = h.client.get("/api" + route, headers={"X-App-Code": "fixture-code"})
+    assert response.status_code == 200
+    if route.startswith("/passport"):
+        assert response.get_json() == {"access_token": "new-passport"}
+        h.tokens.issue.assert_called_once()
+        assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == 2
+    else:
+        h.tokens.issue.assert_not_called()
+        assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == 1
+        if route.startswith("/webapp"):
+            assert response.get_json() == {"accessMode": "public"}
+        elif route.startswith("/login"):
+            assert response.get_json() == {"logged_in": True, "app_logged_in": True}
+        elif route == "/site":
+            assert response.get_json()["site"]["title"] == "Must not leak"
+        elif route == "/meta":
+            assert response.get_json() == {"tool_icons": {}}
+        else:
+            assert "user_input_form" in response.get_json()
+
+
+@pytest.mark.parametrize("route", ["/site", "/meta", "/parameters"])
+def test_old_passport_cannot_read_metadata_after_published_version_is_removed(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+) -> None:
+    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    assert h.access_repo.is_app_available(h.app.id)
+    h.app.workflow_id = None
+    sqlite_session.commit()
+    response = h.client.get(
+        "/api" + route, headers={"X-App-Code": "fixture-code"}, environ_overrides={"REMOTE_ADDR": "203.0.113.42"}
+    )
+    assert response.status_code == 404
+    assert response.get_json()["code"] == "app_not_found"
+    assert response.get_json()["client_ip"] == "203.0.113.42"
+    assert h.services.app_definitions.method_calls == []
+    assert h.services.web_app_runtime.method_calls == []
+
+
+@pytest.mark.parametrize("changed_owner", ["site-app", "end-user-app", "end-user-tenant"])
+def test_old_passport_cannot_cross_persisted_app_or_tenant_owner_chain(
+    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    changed_owner: str,
+) -> None:
+    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    if changed_owner == "site-app":
+        persisted_site = sqlite_session.scalar(select(Site).where(Site.app_id == h.app.id))
+        assert persisted_site is not None
+        persisted_site.app_id = str(uuid4())
+    elif changed_owner == "end-user-app":
+        h.old_user.app_id = str(uuid4())
+    else:
+        h.old_user.tenant_id = str(uuid4())
+    sqlite_session.commit()
+    response = h.client.get("/api/site", headers={"X-App-Code": "fixture-code"})
+    assert response.status_code == 404
+    assert response.get_json()["code"] == "app_not_found"
+    assert h.services.web_app_runtime.method_calls == []
+
+
+@pytest.mark.parametrize("route", ROUTES)
+def test_real_database_failure_is_not_reclassified_as_unpublished(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+) -> None:
+    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=False)
+    failing_session = MagicMock()
+    failure = OperationalError("select", {}, RuntimeError("database unavailable"))
+    failing_session.__enter__.return_value.scalar.side_effect = failure
+    failing_session.__enter__.return_value.execute.side_effect = failure
+    failing_factory = MagicMock(return_value=failing_session)
+    h.access_repo._session_factory = failing_factory
+    h.passport_repo._session_factory = failing_factory
+    monkeypatch.setattr(wraps.session_factory, "create_session", failing_factory)
+    response = h.client.get("/api" + route, headers={"X-App-Code": "fixture-code"})
+    assert response.status_code == (503 if route.startswith(("/webapp", "/login")) else 500)
+    assert response.get_json()["code"] != "app_not_found"
+    assert "client_ip" not in response.get_json()
+    h.tokens.issue.assert_not_called()
diff --git a/api/tests/unit_tests/controllers/web/test_wraps.py b/api/tests/unit_tests/controllers/web/test_wraps.py
index bc7999263fad3a..efc57db265236c 100644
--- a/api/tests/unit_tests/controllers/web/test_wraps.py
+++ b/api/tests/unit_tests/controllers/web/test_wraps.py
@@ -9,6 +9,7 @@
 
 from core.logging.context import clear_request_context, get_identity_context
 from models import App, EndUser
+from models.model import AppModelConfig
 
 
 @pytest.fixture(autouse=True)
@@ -68,6 +69,11 @@ def test_decode_jwt_token_uses_shared_session_factory(sqlite_session: Session) -
         enable_api=True,
     )
     sqlite_session.add(app_model)
+    sqlite_session.flush()
+    config = AppModelConfig(app_id=app_model.id)
+    config.id = str(uuid4())
+    app_model.app_model_config_id = config.id
+    sqlite_session.add(config)
     sqlite_session.commit()
 
     site = Site(
@@ -108,7 +114,7 @@ def test_decode_jwt_token_uses_shared_session_factory(sqlite_session: Session) -
     assert result_end_user.id == end_user.id
 
 
-@pytest.mark.parametrize("missing", ["app", "site", "code", "disabled", "end_user", "resource"])
+@pytest.mark.parametrize("missing", ["app", "site", "code", "disabled", "unpublished", "end_user", "resource"])
 def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
     sqlite_session: Session, monkeypatch: pytest.MonkeyPatch, missing: str
 ) -> None:
@@ -120,6 +126,7 @@ def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
     from models.model import AppMode, CustomizeTokenStrategy, Site
 
     app_id, tenant_id, end_user_id = str(uuid4()), str(uuid4()), str(uuid4())
+    config_id = str(uuid4())
     if missing != "app":
         sqlite_session.add(
             App(
@@ -129,8 +136,13 @@ def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
                 mode=AppMode.CHAT,
                 enable_site=missing != "disabled",
                 enable_api=True,
+                app_model_config_id=config_id if missing != "unpublished" else None,
             )
         )
+        if missing != "unpublished":
+            config = AppModelConfig(app_id=app_id)
+            config.id = config_id
+            sqlite_session.add(config)
     if missing != "site":
         sqlite_session.add(
             Site(
@@ -185,7 +197,7 @@ def post(self, _app: App, _end_user: EndUser) -> Never:
         )
 
     assert response.status_code == 404
-    if missing in {"app", "site", "code", "disabled"}:
+    if missing in {"app", "site", "code", "disabled", "unpublished"}:
         assert (
             response.data
             == b'{"client_ip":"203.0.113.42","code":"app_not_found","message":"App not found.","status":404}'
diff --git a/api/tests/unit_tests/repositories/test_public_app_availability.py b/api/tests/unit_tests/repositories/test_public_app_availability.py
new file mode 100644
index 00000000000000..5c654da4d262c5
--- /dev/null
+++ b/api/tests/unit_tests/repositories/test_public_app_availability.py
@@ -0,0 +1,202 @@
+"""Exercise the shared public publication gate using real persisted owner chains."""
+
+from uuid import uuid4
+
+import pytest
+from sqlalchemy import select
+from sqlalchemy.orm import Session, sessionmaker
+
+from core.app.public_runtime import published_app_filter
+from models.agent import (
+    Agent,
+    AgentConfigRevision,
+    AgentConfigRevisionOperation,
+    AgentConfigSnapshot,
+    AgentScope,
+    AgentSource,
+    AgentStatus,
+)
+from models.model import App, AppMode, AppModelConfig, CustomizeTokenStrategy, Site
+from models.workflow import Workflow, WorkflowType
+from repositories.web_passport_repository import WebPassportRepository
+from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
+
+
+def _app(session: Session, mode: AppMode) -> App:
+    app = App(
+        id=str(uuid4()), tenant_id=str(uuid4()), name="Private fixture", mode=mode, enable_site=True, enable_api=True
+    )
+    session.add_all(
+        [
+            app,
+            Site(
+                app_id=app.id,
+                code="public-code",
+                title="private",
+                default_language="en-US",
+                customize_token_strategy=CustomizeTokenStrategy.UUID,
+            ),
+        ]
+    )
+    session.flush()
+    return app
+
+
+def _workflow(session: Session, app: App, *, version: str = "published") -> Workflow:
+    workflow = Workflow(
+        id=str(uuid4()),
+        tenant_id=app.tenant_id,
+        app_id=app.id,
+        type=WorkflowType.WORKFLOW if app.mode == AppMode.WORKFLOW else WorkflowType.CHAT,
+        version=version,
+        graph='{"nodes":[]}',
+        features="{}",
+        created_by=str(uuid4()),
+        environment_variables=[],
+        conversation_variables=[],
+        rag_pipeline_variables=[],
+    )
+    session.add(workflow)
+    return workflow
+
+
+def _agent(session: Session, app: App, *, published: bool) -> tuple[Agent, AgentConfigSnapshot]:
+    agent = Agent(
+        id=str(uuid4()),
+        tenant_id=app.tenant_id,
+        app_id=app.id,
+        name="Private Agent",
+        scope=AgentScope.ROSTER,
+        source=AgentSource.AGENT_APP,
+        active_config_is_published=published,
+    )
+    snapshot = AgentConfigSnapshot(
+        id=str(uuid4()),
+        tenant_id=app.tenant_id,
+        agent_id=agent.id,
+        version=1,
+        home_snapshot_id=str(uuid4()),
+        config_snapshot={},
+    )
+    agent.active_config_snapshot_id = snapshot.id
+    session.add_all([agent, snapshot])
+    if published:
+        session.add(
+            AgentConfigRevision(
+                tenant_id=app.tenant_id,
+                agent_id=agent.id,
+                current_snapshot_id=snapshot.id,
+                revision=1,
+                operation=AgentConfigRevisionOperation.PUBLISH_DRAFT,
+            )
+        )
+    return agent, snapshot
+
+
+def _assert_readers(factory: sessionmaker[Session], app: App, expected: bool) -> None:
+    access = WebAppAccessQueryRepository(session_factory=factory)
+    assert access.find_app_id_by_code("public-code") == (app.id if expected else None)
+    assert access.is_app_available(app.id) is expected
+    passports = WebPassportRepository(session_factory=factory, generate_session_id=lambda: "never-created")
+    record = passports.get_active_web_app("public-code")
+    assert (record is not None) is expected
+
+
+@pytest.mark.parametrize(
+    "mode",
+    [AppMode.WORKFLOW, AppMode.ADVANCED_CHAT, AppMode.CHAT, AppMode.COMPLETION, AppMode.AGENT_CHAT, AppMode.AGENT],
+)
+@pytest.mark.parametrize("published", [False, True])
+def test_all_public_app_modes_require_their_published_artifact(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], mode: AppMode, published: bool
+) -> None:
+    app = _app(sqlite_session, mode)
+    if mode == AppMode.AGENT:
+        _agent(sqlite_session, app, published=published)
+    elif mode in (AppMode.WORKFLOW, AppMode.ADVANCED_CHAT):
+        draft = _workflow(sqlite_session, app, version="draft")
+        if published:
+            app.workflow_id = _workflow(sqlite_session, app).id
+        assert draft.id != app.workflow_id
+    elif published:
+        config = AppModelConfig(app_id=app.id)
+        config.id = str(uuid4())
+        app.app_model_config_id = config.id
+        sqlite_session.add(config)
+    sqlite_session.commit()
+    _assert_readers(sqlite_session_factory, app, published)
+
+
+@pytest.mark.parametrize("invalid", ["draft-pointer", "missing", "other-app", "other-tenant"])
+@pytest.mark.parametrize("mode", [AppMode.WORKFLOW, AppMode.ADVANCED_CHAT])
+def test_workflow_pointer_must_resolve_to_this_apps_published_workflow(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], mode: AppMode, invalid: str
+) -> None:
+    app = _app(sqlite_session, mode)
+    workflow = _workflow(sqlite_session, app, version="draft" if invalid == "draft-pointer" else "published")
+    app.workflow_id = str(uuid4()) if invalid == "missing" else workflow.id
+    if invalid == "other-app":
+        workflow.app_id = str(uuid4())
+    if invalid == "other-tenant":
+        workflow.tenant_id = str(uuid4())
+    sqlite_session.commit()
+    _assert_readers(sqlite_session_factory, app, False)
+
+
+@pytest.mark.parametrize("invalid", ["missing", "other-app"])
+def test_model_config_pointer_must_resolve_to_this_app(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], invalid: str
+) -> None:
+    app = _app(sqlite_session, AppMode.CHAT)
+    config = AppModelConfig(app_id=app.id if invalid == "missing" else str(uuid4()))
+    config.id = str(uuid4())
+    app.app_model_config_id = str(uuid4()) if invalid == "missing" else config.id
+    sqlite_session.add(config)
+    sqlite_session.commit()
+    _assert_readers(sqlite_session_factory, app, False)
+
+
+@pytest.mark.parametrize(
+    "state",
+    [
+        "dirty-draft",
+        "seeded",
+        "snapshot-missing",
+        "snapshot-other-agent",
+        "snapshot-other-tenant",
+        "agent-other-tenant",
+        "archived",
+        "workflow-only",
+    ],
+)
+def test_agent_publication_uses_owned_visible_snapshot_not_dirty_draft_flag(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], state: str
+) -> None:
+    app = _app(sqlite_session, AppMode.AGENT)
+    agent, snapshot = _agent(sqlite_session, app, published=state != "seeded")
+    # A seeded snapshot is not public even when an inconsistent dirty flag says otherwise.
+    agent.active_config_is_published = state == "seeded"
+    if state == "snapshot-missing":
+        agent.active_config_snapshot_id = str(uuid4())
+    elif state == "snapshot-other-agent":
+        snapshot.agent_id = str(uuid4())
+    elif state == "snapshot-other-tenant":
+        snapshot.tenant_id = str(uuid4())
+    elif state == "agent-other-tenant":
+        agent.tenant_id = str(uuid4())
+    elif state == "archived":
+        agent.status = AgentStatus.ARCHIVED
+    elif state == "workflow-only":
+        agent.scope = AgentScope.WORKFLOW_ONLY
+        agent.backing_app_id = app.id
+    sqlite_session.commit()
+    _assert_readers(sqlite_session_factory, app, state == "dirty-draft")
+
+
+def test_public_predicate_does_not_change_management_visibility(sqlite_session: Session) -> None:
+    app = _app(sqlite_session, AppMode.ADVANCED_CHAT)
+    draft = _workflow(sqlite_session, app, version="draft")
+    sqlite_session.commit()
+    assert sqlite_session.scalar(select(App.id).where(App.id == app.id, published_app_filter())) is None
+    assert sqlite_session.get(App, app.id) is app
+    assert sqlite_session.get(Workflow, draft.id) is draft
diff --git a/api/tests/unit_tests/repositories/test_web_passport_repository.py b/api/tests/unit_tests/repositories/test_web_passport_repository.py
index 6c5a66d5528acc..4fcc787e0f29b7 100644
--- a/api/tests/unit_tests/repositories/test_web_passport_repository.py
+++ b/api/tests/unit_tests/repositories/test_web_passport_repository.py
@@ -2,11 +2,12 @@
 from unittest.mock import MagicMock
 from uuid import NAMESPACE_URL, uuid5
 
+import pytest
 from sqlalchemy import select
 from sqlalchemy.orm import Session, sessionmaker
 
 from models.enums import CustomizeTokenStrategy, EndUserType
-from models.model import App, AppMode, EndUser, IconType, Site
+from models.model import App, AppMode, AppModelConfig, EndUser, IconType, Site
 from repositories.web_passport_repository import WebPassportRepository
 
 
@@ -20,6 +21,7 @@ def _persist_webapp(
     app_code: str = "code",
     identity: str | None = None,
     enable_site: bool = True,
+    published: bool = True,
 ) -> tuple[App, Site]:
     identity = identity or app_code
     app = App(
@@ -42,6 +44,11 @@ def _persist_webapp(
         code=app_code,
     )
     session.add_all([app, site])
+    if published:
+        config = AppModelConfig(app_id=app.id)
+        config.id = _stable_uuid(f"config:{identity}")
+        app.app_model_config_id = config.id
+        session.add(config)
     session.commit()
     return app, site
 
@@ -85,6 +92,34 @@ def test_get_active_web_app_rejects_disabled_app(
     assert repository.get_active_web_app("code") is None
 
 
+def test_unpublished_app_does_not_resolve_for_passport(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session]
+) -> None:
+    _persist_webapp(sqlite_session, published=False)
+    assert _repository(sqlite_session_factory).get_active_web_app("code") is None
+
+
+@pytest.mark.parametrize("authenticated", [False, True])
+def test_publication_is_rechecked_before_end_user_write(
+    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], authenticated: bool
+) -> None:
+    app, _ = _persist_webapp(sqlite_session)
+    repository = _repository(sqlite_session_factory)
+    record = repository.get_active_web_app("code")
+    assert record is not None
+    app.app_model_config_id = None
+    sqlite_session.commit()
+
+    if authenticated:
+        resolution = repository.resolve_authenticated_end_user(record, session_id="not-created", end_user_id=None)
+    else:
+        resolution = repository.resolve_standard_end_user(record, "not-created")
+
+    assert resolution.app_active is False
+    assert resolution.end_user is None
+    assert sqlite_session.scalar(select(EndUser).where(EndUser.app_id == app.id)) is None
+
+
 def test_get_active_web_app_accepts_duplicate_site_codes(
     sqlite_session: Session,
     sqlite_session_factory: sessionmaker[Session],
diff --git a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
index 7111f99058097f..bca4e114b61752 100644
--- a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
+++ b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
@@ -5,7 +5,7 @@
 from sqlalchemy.orm import Session, sessionmaker
 
 from models.enums import AppStatus, CustomizeTokenStrategy
-from models.model import App, Site
+from models.model import App, AppModelConfig, Site
 from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
 from services.webapp_access_query_service import WebAppAccessUnavailableError
 
@@ -14,7 +14,20 @@
 
 def test_find_app_id_by_code_returns_matching_site_app(sqlite_session_factory: sessionmaker[Session]) -> None:
     with sqlite_session_factory.begin() as session:
-        session.add(App(id=_APP_ID, tenant_id=_APP_ID, name="Test App", mode="chat", enable_site=True, enable_api=True))
+        config = AppModelConfig(app_id=_APP_ID)
+        config.id = "22222222-2222-2222-2222-222222222222"
+        session.add(config)
+        session.add(
+            App(
+                id=_APP_ID,
+                tenant_id=_APP_ID,
+                name="Test App",
+                mode="chat",
+                enable_site=True,
+                enable_api=True,
+                app_model_config_id=config.id,
+            )
+        )
         session.add(
             Site(
                 app_id=_APP_ID,

From aaf3076be5fcb92a63b43543ca43cfe73cc03187 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Tue, 22 Sep 2026 16:52:07 +0800
Subject: [PATCH 065/108] fix(web): return opaque document 404 before rendering
 public apps

---
 docker/envs/core-services/web.env.example     |   8 +
 web/.env.example                              |   6 +
 web/__tests__/proxy-frame-options.spec.ts     |  42 ++--
 web/app/layout.tsx                            |  34 ++-
 web/app/webapp-unavailable/page.tsx           |  65 +++++
 web/docs/webapp-document-gate-validation.md   |  49 ++++
 web/docs/webapp-document-gate.md              |  18 ++
 web/env.ts                                    |   4 +
 .../__tests__/document-response.spec.ts       | 226 ++++++++++++++++++
 .../app-access-error/__tests__/page.spec.tsx  |  19 ++
 .../app-access-error/document-response.ts     | 138 +++++++++++
 web/features/app-access-error/page.tsx        |   9 +-
 web/proxy.ts                                  |  27 ++-
 13 files changed, 606 insertions(+), 39 deletions(-)
 create mode 100644 web/app/webapp-unavailable/page.tsx
 create mode 100644 web/docs/webapp-document-gate-validation.md
 create mode 100644 web/docs/webapp-document-gate.md
 create mode 100644 web/features/app-access-error/__tests__/document-response.spec.ts
 create mode 100644 web/features/app-access-error/document-response.ts

diff --git a/docker/envs/core-services/web.env.example b/docker/envs/core-services/web.env.example
index 342e7f08e7f795..898c0526e4d281 100644
--- a/docker/envs/core-services/web.env.example
+++ b/docker/envs/core-services/web.env.example
@@ -4,6 +4,14 @@
 
 CONSOLE_API_URL=
 APP_API_URL=
+# Optional Cloud WebApp document admission. Enable only after the edge proxy
+# overwrites both X-Dify-Webapp-Client-Ip and X-Dify-Webapp-Proxy-Secret, Web is
+# private to that proxy, and the target Gateway enforces /api using trusted IPs.
+# Use the complete internal Gateway endpoint, never a direct Core API URL.
+# Example: http://gateway-public:8080/api/webapp/access-mode
+WEBAPP_ACCESS_PREFLIGHT_URL=
+# Provision outside Git; must match the edge-injected secret. Never NEXT_PUBLIC.
+WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET=
 SENTRY_DSN=
 NEXT_PUBLIC_SOCKET_URL=ws://localhost
 EXPERIMENTAL_ENABLE_VINEXT=false
diff --git a/web/.env.example b/web/.env.example
index d2fff4dfae4cf0..fd7e51897b7123 100644
--- a/web/.env.example
+++ b/web/.env.example
@@ -128,3 +128,9 @@ NEXT_PUBLIC_WEB_PREFIX=
 
 # number of concurrency
 NEXT_PUBLIC_BATCH_CONCURRENCY=5
+
+# Optional pre-render WebApp availability/IP gate. Use the INTERNAL Gateway,
+# never a direct Core API URL. See docs/webapp-document-gate.md before enabling.
+# WEBAPP_ACCESS_PREFLIGHT_URL=http://gateway-public:8080/api/webapp/access-mode
+# Shared only with an ingress that overwrites both attestation headers.
+WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET=
diff --git a/web/__tests__/proxy-frame-options.spec.ts b/web/__tests__/proxy-frame-options.spec.ts
index 315898f77dad21..7821793f506595 100644
--- a/web/__tests__/proxy-frame-options.spec.ts
+++ b/web/__tests__/proxy-frame-options.spec.ts
@@ -50,9 +50,9 @@ describe('proxy frame options', () => {
     expect(canEmbedPath('/apps')).toBe(false)
   })
 
-  it('should enforce frame ancestors on protected document routes', () => {
+  it('should enforce frame ancestors on protected document routes', async () => {
     vi.stubEnv('NODE_ENV', 'production')
-    const response = proxy(createRequest('https://cloud.dify.ai/device'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/device'))
     const contentSecurityPolicy = response.headers.get('content-security-policy')
 
     expect(response.headers.get('x-frame-options')).toBe('DENY')
@@ -60,9 +60,9 @@ describe('proxy frame options', () => {
     expect(contentSecurityPolicy).toContain("frame-ancestors 'none'")
   })
 
-  it('should keep published app routes embeddable', () => {
+  it('should keep published app routes embeddable', async () => {
     vi.stubEnv('NODE_ENV', 'production')
-    const response = proxy(createRequest('https://udify.app/chat/test-token'))
+    const response = await proxy(createRequest('https://udify.app/chat/test-token'))
     const contentSecurityPolicy = response.headers.get('content-security-policy')
 
     expect(response.headers.get('x-frame-options')).toBeNull()
@@ -70,27 +70,27 @@ describe('proxy frame options', () => {
     expect(contentSecurityPolicy).not.toContain('frame-ancestors')
   })
 
-  it('should allow Cloudflare Turnstile resources when its site key is configured', () => {
+  it('should allow Cloudflare Turnstile resources when its site key is configured', async () => {
     vi.stubEnv('NODE_ENV', 'production')
     mockEnv.NEXT_PUBLIC_TURNSTILE_SITE_KEY = 'site-key-for-tests'
 
-    const response = proxy(createRequest('https://cloud.dify.ai/signin'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/signin'))
 
     expect(response.headers.get('content-security-policy')).toContain(
       'https://challenges.cloudflare.com',
     )
   })
 
-  it('should protect device routes when global embedding is enabled', () => {
+  it('should protect device routes when global embedding is enabled', async () => {
     mockEnv.NEXT_PUBLIC_ALLOW_EMBED = true
-    const response = proxy(createRequest('https://cloud.dify.ai/device/code'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/device/code'))
 
     expect(response.headers.get('x-frame-options')).toBe('DENY')
     expect(response.headers.get('content-security-policy')).toContain("frame-ancestors 'none'")
   })
 
-  it('should deny framing for the Marketplace OAuth authorize route', () => {
-    const response = proxy(
+  it('should deny framing for the Marketplace OAuth authorize route', async () => {
+    const response = await proxy(
       createRequest('https://cloud.dify.ai/account/oauth/authorize?client_id=marketplace-client'),
     )
 
@@ -98,21 +98,21 @@ describe('proxy frame options', () => {
     expect(response.headers.get('content-security-policy')).toContain("frame-ancestors 'none'")
   })
 
-  it('should allow framing Marketplace pages when a Marketplace origin is configured', () => {
+  it('should allow framing Marketplace pages when a Marketplace origin is configured', async () => {
     vi.stubEnv('NODE_ENV', 'production')
     mockEnv.NEXT_PUBLIC_MARKETPLACE_URL_PREFIX = 'https://marketplace.dify.ai'
 
-    const response = proxy(createRequest('https://cloud.dify.ai/marketplace'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/marketplace'))
 
     expect(response.headers.get('content-security-policy') ?? '').toMatch(
       /frame-src[^;]*https:\/\/marketplace\.dify\.ai/,
     )
   })
 
-  it('should not add a Marketplace frame origin when the prefix is unset', () => {
+  it('should not add a Marketplace frame origin when the prefix is unset', async () => {
     vi.stubEnv('NODE_ENV', 'production')
 
-    const response = proxy(createRequest('https://cloud.dify.ai/marketplace'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/marketplace'))
     const contentSecurityPolicy = response.headers.get('content-security-policy') ?? ''
 
     expect(contentSecurityPolicy).toContain('frame-src')
@@ -121,9 +121,9 @@ describe('proxy frame options', () => {
 })
 
 describe('proxy CookieYes consent logging', () => {
-  it('should allow CookieYes logging requests only through connect-src', () => {
+  it('should allow CookieYes logging requests only through connect-src', async () => {
     vi.stubEnv('NODE_ENV', 'production')
-    const response = proxy(createRequest('https://cloud.dify.ai/signin'))
+    const response = await proxy(createRequest('https://cloud.dify.ai/signin'))
     const contentSecurityPolicy = response.headers.get('content-security-policy')!
     const directives = Object.fromEntries(
       contentSecurityPolicy
@@ -140,8 +140,8 @@ describe('proxy CookieYes consent logging', () => {
 })
 
 describe('proxy education entry normalization', () => {
-  it('redirects the legacy education action without leaking it into the canonical URL', () => {
-    const response = proxy(
+  it('redirects the legacy education action without leaking it into the canonical URL', async () => {
+    const response = await proxy(
       createRequest('https://cloud.dify.ai/?action=getEducationVerify&utm_source=education-site'),
     )
 
@@ -151,9 +151,9 @@ describe('proxy education entry normalization', () => {
     )
   })
 
-  it('does not redirect unrelated actions or paths', () => {
-    const unrelatedAction = proxy(createRequest('https://cloud.dify.ai/?action=showSettings'))
-    const unrelatedPath = proxy(
+  it('does not redirect unrelated actions or paths', async () => {
+    const unrelatedAction = await proxy(createRequest('https://cloud.dify.ai/?action=showSettings'))
+    const unrelatedPath = await proxy(
       createRequest('https://cloud.dify.ai/apps?action=getEducationVerify'),
     )
 
diff --git a/web/app/layout.tsx b/web/app/layout.tsx
index 7b3899446bd94f..f40c2ac0a0d336 100644
--- a/web/app/layout.tsx
+++ b/web/app/layout.tsx
@@ -4,11 +4,14 @@ import { ToastHost } from '@langgenius/dify-ui/toast'
 import { TooltipProvider } from '@langgenius/dify-ui/tooltip'
 import { HydrationBoundary } from '@tanstack/react-query'
 import { Provider as JotaiProvider } from 'jotai/react'
+import Negotiator from 'negotiator'
 import { ThemeProvider } from 'next-themes'
 import { NuqsAdapter } from 'nuqs/adapters/next/app'
 import { IS_PROD } from '@/config'
 import { getDatasetMap } from '@/env'
 import AppAccessBoundary from '@/features/app-access-error/boundary'
+import { APP_UNAVAILABLE_PATH } from '@/features/app-access-error/document-response'
+import { getBrowserLocale } from '@/features/app-access-error/locale'
 import { SystemFeaturesBootstrapBoundary } from '@/features/system-features/bootstrap-boundary'
 import {
   dehydrateSystemFeatures,
@@ -35,6 +38,8 @@ export const viewport: Viewport = {
 }
 
 export async function generateMetadata(): Promise<Metadata> {
+  if ((await headers()).get('x-dify-pathname') === APP_UNAVAILABLE_PATH)
+    return { icons: { icon: `${basePath}/favicon.ico` } }
   const systemFeatures = await getOptionalSystemFeatures()
   const branding = systemFeatures?.branding
   const applicationTitle = getApplicationTitle(branding)
@@ -53,12 +58,7 @@ export async function generateMetadata(): Promise<Metadata> {
 
 export default async function RootLayout({ children }: { children: React.ReactNode }) {
   const datasetMap = getDatasetMap()
-  const [locale, requestHeaders] = await Promise.all([
-    getLocaleOnServer(),
-    headers(),
-    getOptionalSystemFeatures(),
-  ])
-  const dehydratedState = dehydrateSystemFeatures()
+  const requestHeaders = await headers()
   const nonce = IS_PROD ? (requestHeaders.get('x-nonce') ?? undefined) : undefined
   const themeProviderProps: Omit<ThemeProviderProps, 'children'> = {
     attribute: 'data-theme',
@@ -68,6 +68,28 @@ export default async function RootLayout({ children }: { children: React.ReactNo
   }
   if (nonce !== undefined) themeProviderProps.nonce = nonce
 
+  // Proxy always overwrites this header. The terminal error document must not
+  // depend on console bootstrap APIs or render application-specific providers.
+  if (requestHeaders.get('x-dify-pathname') === APP_UNAVAILABLE_PATH) {
+    const documentLocale = getBrowserLocale(
+      new Negotiator({
+        headers: { 'accept-language': requestHeaders.get('accept-language') ?? '' },
+      }).languages(),
+    )
+    return (
+      <html lang={documentLocale} className="h-full" suppressHydrationWarning>
+        <body className="h-full bg-background-body" {...datasetMap}>
+          <ThemeProvider {...themeProviderProps}>
+            <NuqsAdapter>{children}</NuqsAdapter>
+          </ThemeProvider>
+        </body>
+      </html>
+    )
+  }
+
+  const [locale] = await Promise.all([getLocaleOnServer(), getOptionalSystemFeatures()])
+  const dehydratedState = dehydrateSystemFeatures()
+
   return (
     <html lang={locale ?? 'en'} className="h-full" suppressHydrationWarning>
       <head>
diff --git a/web/app/webapp-unavailable/page.tsx b/web/app/webapp-unavailable/page.tsx
new file mode 100644
index 00000000000000..11a44be49253fd
--- /dev/null
+++ b/web/app/webapp-unavailable/page.tsx
@@ -0,0 +1,65 @@
+import type { Metadata } from '@/next'
+import { createInstance } from 'i18next'
+import Negotiator from 'negotiator'
+import { APP_UNAVAILABLE_IP_HEADER } from '@/features/app-access-error/document-response'
+import { getBrowserLocale } from '@/features/app-access-error/locale'
+import AppNotAccessible from '@/features/app-access-error/page'
+import { loadI18nResource } from '@/i18n-config/load-resource'
+import { headers } from '@/next/headers'
+
+export const dynamic = 'force-dynamic'
+
+async function documentLocale() {
+  const requestHeaders = await headers()
+  return getBrowserLocale(
+    new Negotiator({
+      headers: { 'accept-language': requestHeaders.get('accept-language') ?? '' },
+    }).languages(),
+  )
+}
+
+export async function generateMetadata(): Promise<Metadata> {
+  const locale = await documentLocale()
+  const resource = await loadI18nResource(locale, 'share')
+  const i18n = createInstance()
+  await i18n.init({
+    lng: locale,
+    fallbackLng: false,
+    keySeparator: false,
+    resources: { [locale]: { share: resource.default } },
+  })
+  return {
+    title: {
+      absolute: i18n.getFixedT(locale, 'share')(($) => $['appNotAccessible.documentTitle']),
+    },
+    robots: { index: false },
+  }
+}
+
+export default async function UnavailableWebAppDocument() {
+  const locale = await documentLocale()
+  const [requestHeaders, share, common, login, fallbackShare, fallbackCommon, fallbackLogin] =
+    await Promise.all([
+      headers(),
+      loadI18nResource(locale, 'share'),
+      loadI18nResource(locale, 'common'),
+      loadI18nResource(locale, 'login'),
+      loadI18nResource('en-US', 'share'),
+      loadI18nResource('en-US', 'common'),
+      loadI18nResource('en-US', 'login'),
+    ])
+  return (
+    <AppNotAccessible
+      clientIp={requestHeaders.get(APP_UNAVAILABLE_IP_HEADER) ?? undefined}
+      initialLocale={locale}
+      initialResources={{
+        'en-US': {
+          share: fallbackShare.default,
+          common: fallbackCommon.default,
+          login: fallbackLogin.default,
+        },
+        [locale]: { share: share.default, common: common.default, login: login.default },
+      }}
+    />
+  )
+}
diff --git a/web/docs/webapp-document-gate-validation.md b/web/docs/webapp-document-gate-validation.md
new file mode 100644
index 00000000000000..6b549a4dc9d358
--- /dev/null
+++ b/web/docs/webapp-document-gate-validation.md
@@ -0,0 +1,49 @@
+# WebApp document gate: local validation, 2026-09-22
+
+Scope: local worktree only. No real Dify API, Gateway, tenant, application, or remote environment was contacted. The upstream was a synthetic HTTP server bound to loopback. Its successful response was the existing `{"accessMode":"public"}` contract; denial/missing used the canonical `404 app_not_found` body. All configured console/public API URLs also pointed to loopback. No real credential was used.
+
+## Final checks
+
+- Five focused Vitest suites: **108 tests passed**. Command from `web/`: `../node_modules/.bin/vp test run --project unit features/app-access-error/__tests__ __tests__/proxy-frame-options.spec.ts`.
+- `vp check` on all nine changed TypeScript/TSX files: **zero warnings, lint errors, and type errors**.
+- JSX accessibility check on root layout, unavailable document route, and existing generic error component: passed.
+- Documentation ESLint and `git diff --check`: passed.
+- The coordinating agent owns the repository-wide `vp run -w check`; its result is not claimed here.
+
+## Actual optimized Next.js runtime
+
+Next.js **16.3.4**, with the real Dify root layout and error-page component, not a mocked `NextResponse` or replacement page. Built the final code using:
+
+```sh
+./node_modules/.bin/next build --debug-build-paths 'app/webapp-unavailable/page.tsx,app/(shareLayout)/chat/[token]/page.tsx'
+```
+
+The selective optimized production build passed. It builds the changed document route, root layout, Proxy, and an unchanged allowed Chat route; it is not a claim that every application route received a full production build. The final run used `node .next/standalone/web/server.js`, a local synthetic ingress proof, an internal loopback upstream, and `NEXT_PUBLIC_BASE_PATH=/gate-test`.
+
+All nine HTTP cases below passed with redirects disabled. Header and HTML assertions were made on real responses. The document assertions checked actual `<h1>` and `<code>` markup, not text appearing inside serialized translation resources.
+
+| Case                                                    | Actual result                                                                                                                                                                        |
+| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Missing App, Host `saas.dify.dev`                       | 404, `text/html; charset=utf-8`, `Cache-Control: no-store`, no Location; generic heading and trusted test IP rendered in `<code>`                                                    |
+| Denied App, Host `saas-app.dify.dev`, iframe request    | Same 404/headers and generic content; no X-Frame-Options preventing embedding                                                                                                        |
+| RSC navigation with valid `_rsc` transport value        | 404, `text/x-component`, no-store, no Location; generic error component payload                                                                                                      |
+| Upstream dependency failure                             | 503, no-store, no rewrite/redirect to App-not-found                                                                                                                                  |
+| Missing ingress proof                                   | 503, no-store; no application rendering                                                                                                                                              |
+| Direct internal error route with forged query/header IP | 404, no-store; generic heading, neither fabricated nor unrelated trusted test IP rendered                                                                                            |
+| Allowed Chat                                            | Original route continues, 200; no error-route rewrite. Console bootstrap was deliberately unavailable in the local upstream, so this does not claim a successful real Chat execution |
+| Japanese browser language                               | 404, no-store; `<html lang="ja-JP">`, actual Japanese heading and trusted IP in `<code>`                                                                                             |
+| HEAD                                                    | 404, no-store, HTML content type, empty body                                                                                                                                         |
+
+The final HTML/body never contained the local ingress proof. Missing and denied **rendered `<main>` sections were byte-equal** for the same IP and language. The complete raw HTML is not claimed byte-equal: the existing sign-in return URL and Next routing serialization reflect the caller's own different requested URL. No App identity metadata or denial reason is fetched/rendered by the error route.
+
+## Regressions caught while validating
+
+1. A layout-only streamed `notFound()` was avoided. Proxy establishes status before rendering.
+2. The existing global system-features bootstrap could hide the generic error behind a loading/error screen. The trusted terminal error layout now avoids that Console dependency and generates neutral metadata.
+3. Removing Next's `_rsc` value made Next issue its cache-validation redirect. Only this framework-owned query field is preserved in the internal rewrite; arbitrary application query/IP fields are discarded.
+4. NextURL normalizes loopback IP hostnames to `localhost`. Binding the local test server to `127.0.0.1` made that normalized rewrite appear external; final runtime checks used a same-origin `localhost` bind and independently tested both deployed Host values. Production deployment still needs its own edge/Gateway trust regression.
+5. Development Next overrides document cache headers to `no-cache, must-revalidate`; the optimized standalone runtime confirmed the required exact `no-store` error header.
+
+## Deployment boundary
+
+This validates the Web adapter and real Next response behavior. It does not validate the actual Nginx overwrite rules, real Gateway source-IP interpretation, real backend publication queries, or public CDN behavior. The coordinating agent must verify those after deployment before claiming the full SaaS-dev regression complete.
diff --git a/web/docs/webapp-document-gate.md b/web/docs/webapp-document-gate.md
new file mode 100644
index 00000000000000..5f4cd1e8daba60
--- /dev/null
+++ b/web/docs/webapp-document-gate.md
@@ -0,0 +1,18 @@
+# WebApp document availability gate
+
+The optional Proxy gate checks default `/chat/:code`, `/chatbot/:code`, `/workflow/:code`, `/completion/:code`, and `/agent/:code` addresses before Next starts rendering. It does not replace Gateway checks on subsequent API requests. Environment/Enterprise address routing is unchanged.
+
+Configure both server-only variables:
+
+- `WEBAPP_ACCESS_PREFLIGHT_URL`: the fixed internal Gateway `/api/webapp/access-mode` endpoint. Do not point it at Core or a public redirecting origin.
+- `WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET`: a random shared ingress secret. Do not use a `NEXT_PUBLIC_` variable, commit its value, include it in logs, or expose it in a response.
+
+Every ingress location that forwards documents to Web must **overwrite**, not append or preserve, `X-Dify-Webapp-Client-Ip` with its validated visitor address and `X-Dify-Webapp-Proxy-Secret` with this secret. The ingress must itself have an explicit trusted-proxy policy; an arbitrary inbound XFF/CF header is not evidence of visitor identity. Web should not have an unprotected public port.
+
+Web verifies the proof with a constant-time comparison and validates a single IP, then creates a fresh Gateway request with only `Accept` and a one-address `X-Forwarded-For`. Gateway must trust the Web peer's network and resolve the forwarded address using its existing trusted-hop policy. Original XFF, Forwarded, CF headers, Authorization, Cookie, and ingress proof are not forwarded. The URL is configuration-owned; request queries cannot select another upstream or supply an IP.
+
+An unset URL leaves self-hosted routing unchanged. Once configured, missing/invalid attestation, timeout, redirects, invalid payloads, and dependency failures produce a non-cacheable 503. They are not application-not-found responses. Only the canonical Gateway/Core `404 app_not_found` produces the existing generic unavailable page, with a 404 status fixed before rendering and `Cache-Control: no-store`. The allow path retains existing rendering and authentication behavior.
+
+The internal `/webapp-unavailable` destination has no application lookup, uses no caller-supplied query state, and is always a 404. Proxy clears its internal IP header on every request, including direct visits. Only a verified denial can populate that header. Locale resources are provided for server rendering; the existing error-page UI remains the owner of language selection, appearance, and navigation.
+
+Validation must include real Next HTTP requests, not only an assertion on `NextResponse.status`: verify document status, absence of redirect, non-cacheability, matching missing/denied body, and unchanged allowed rendering. API availability and the edge trust configuration must be deployed before enabling these variables. Do not enable them globally in an environment whose Gateway does not route `/api`.
diff --git a/web/env.ts b/web/env.ts
index 6d755eb70ae05e..f8d0256f2b0c42 100644
--- a/web/env.ts
+++ b/web/env.ts
@@ -194,6 +194,10 @@ export const env = createEnv({
      * The timeout for the text generation in millisecond
      */
     TEXT_GENERATION_TIMEOUT_MS: coercedNumber.default(60000),
+    /** Ingress proof for the optional pre-render WebApp gate; never expose to the browser. */
+    WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET: z.string().optional(),
+    /** Fixed internal Gateway access-mode URL. Unset preserves self-hosted routing. */
+    WEBAPP_ACCESS_PREFLIGHT_URL: z.url().optional(),
     /**
      * The timeout for the cmd+k workflow generation in millisecond
      */
diff --git a/web/features/app-access-error/__tests__/document-response.spec.ts b/web/features/app-access-error/__tests__/document-response.spec.ts
new file mode 100644
index 00000000000000..4a6e7a93443254
--- /dev/null
+++ b/web/features/app-access-error/__tests__/document-response.spec.ts
@@ -0,0 +1,226 @@
+// oxlint-disable-next-line no-restricted-imports -- Exercise the real HTTP request/response boundary used by Proxy, not a mocked status wrapper.
+import { NextRequest } from 'next/server'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
+import { proxy } from '@/proxy'
+import { APP_UNAVAILABLE_IP_HEADER, getWebAppDocumentResponse } from '../document-response'
+
+const configuration = vi.hoisted(() => ({
+  WEBAPP_ACCESS_PREFLIGHT_URL: 'http://gateway.internal:8080/api/webapp/access-mode' as
+    | string
+    | undefined,
+  WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET: 'unit-test-ingress-proof' as string | undefined,
+}))
+vi.mock('@/env', () => ({ env: configuration }))
+
+const fetchMock = vi.fn<typeof fetch>()
+function request(path = '/chat/code', headers: Record<string, string> = {}) {
+  return new NextRequest(`https://apps.example${path}`, {
+    headers: {
+      'X-Dify-Webapp-Client-Ip': '203.0.113.42',
+      'X-Dify-Webapp-Proxy-Secret': 'unit-test-ingress-proof',
+      ...headers,
+    },
+  })
+}
+const gate = (incoming: NextRequest) =>
+  getWebAppDocumentResponse(incoming, new Headers(incoming.headers))
+
+beforeEach(() => {
+  configuration.WEBAPP_ACCESS_PREFLIGHT_URL = 'http://gateway.internal:8080/api/webapp/access-mode'
+  configuration.WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET = 'unit-test-ingress-proof'
+  fetchMock.mockReset()
+  fetchMock.mockResolvedValue(Response.json({ accessMode: 'public' }))
+  vi.stubGlobal('fetch', fetchMock)
+})
+afterEach(() => vi.unstubAllGlobals())
+
+describe('WebApp document admission', () => {
+  it.each(['chat', 'chatbot', 'workflow', 'completion', 'agent'])(
+    'checks %s before rendering with a fresh trusted-hop request',
+    async (kind) => {
+      expect(
+        await gate(
+          request(`/${kind}/co%64e?client_ip=198.51.100.1&appCode=other`, {
+            'X-Forwarded-For': '198.51.100.1',
+            'X-Real-IP': '198.51.100.2',
+            Forwarded: 'for=198.51.100.3',
+            'CF-Connecting-IP': '198.51.100.4',
+            Authorization: 'Bearer untrusted',
+            Cookie: 'session=not-forwarded',
+          }),
+        ),
+      ).toBeUndefined()
+      expect(fetchMock).toHaveBeenCalledExactlyOnceWith(
+        new URL('http://gateway.internal:8080/api/webapp/access-mode?appCode=code'),
+        {
+          method: 'GET',
+          cache: 'no-store',
+          redirect: 'error',
+          headers: { Accept: 'application/json', 'X-Forwarded-For': '203.0.113.42' },
+          signal: expect.any(AbortSignal),
+        },
+      )
+    },
+  )
+
+  it.each([
+    '/apps',
+    '/chatty/code',
+    '/chat/code/extra',
+    '/environment/chat/code',
+    '/environment/workflow/code',
+    '/webapp-signin',
+    '/form/code',
+  ])('does not expand the gate to %s', async (path) => {
+    expect(await gate(request(path))).toBeUndefined()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('leaves the optional gate disabled when its URL is unset', async () => {
+    configuration.WEBAPP_ACCESS_PREFLIGHT_URL = undefined
+    expect(await gate(request())).toBeUndefined()
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it.each<Record<string, string>>([
+    { 'X-Dify-Webapp-Proxy-Secret': '' },
+    { 'X-Dify-Webapp-Proxy-Secret': 'wrong' },
+    { 'X-Dify-Webapp-Client-Ip': '' },
+    { 'X-Dify-Webapp-Client-Ip': '203.0.113.42, 198.51.100.1' },
+    { 'X-Dify-Webapp-Client-Ip': 'unknown' },
+  ])('fails closed without trusted ingress proof %j', async (headers) => {
+    const result = await gate(request('/chat/code', headers))
+    expect(result?.status).toBe(503)
+    expect(result?.headers.get('cache-control')).toBe('no-store')
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects configured preflight without the matching server secret', async () => {
+    configuration.WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET = undefined
+    expect((await gate(request()))?.status).toBe(503)
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it.each(['public', 'private', 'private_all', 'sso_verified'])(
+    'retains normal rendering/authentication for access mode %s',
+    async (accessMode) => {
+      fetchMock.mockResolvedValue(Response.json({ accessMode }))
+      expect(await gate(request())).toBeUndefined()
+    },
+  )
+
+  it('rewrites canonical missing/denied responses to one 404 without exposing application data', async () => {
+    fetchMock.mockResolvedValue(
+      Response.json(
+        { code: 'app_not_found', status: 404, message: 'App not found.' },
+        { status: 404 },
+      ),
+    )
+    const incoming = request('/workflow/code?client_ip=198.51.100.1', {
+      [APP_UNAVAILABLE_IP_HEADER]: '198.51.100.2',
+    })
+    const forwarded = new Headers(incoming.headers)
+    const result = await getWebAppDocumentResponse(incoming, forwarded)
+    expect(result?.status).toBe(404)
+    expect(result?.headers.get('x-middleware-rewrite')).toBe(
+      'https://apps.example/webapp-unavailable',
+    )
+    expect(result?.headers.get('location')).toBeNull()
+    expect(result?.headers.get('cache-control')).toBe('no-store')
+    expect(forwarded.get(APP_UNAVAILABLE_IP_HEADER)).toBe('203.0.113.42')
+    expect(forwarded.has('x-dify-webapp-proxy-secret')).toBe(false)
+    expect(forwarded.has('x-dify-webapp-client-ip')).toBe(false)
+  })
+
+  it('clears fabricated internal IP data on a direct error-page visit', async () => {
+    const incoming = request('/webapp-unavailable?client_ip=198.51.100.1', {
+      [APP_UNAVAILABLE_IP_HEADER]: '198.51.100.2',
+    })
+    const forwarded = new Headers(incoming.headers)
+    const result = await getWebAppDocumentResponse(incoming, forwarded)
+    expect(result?.status).toBe(404)
+    expect(forwarded.has(APP_UNAVAILABLE_IP_HEADER)).toBe(false)
+    expect(fetchMock).not.toHaveBeenCalled()
+  })
+
+  it('keeps the RSC cache-busting value while removing application query state', async () => {
+    fetchMock.mockResolvedValue(
+      Response.json(
+        { code: 'app_not_found', status: 404, message: 'App not found.' },
+        { status: 404 },
+      ),
+    )
+    const result = await gate(request('/chat/code?_rsc=transport-value&client_ip=198.51.100.1'))
+    expect(result?.status).toBe(404)
+    expect(result?.headers.get('x-middleware-rewrite')).toBe(
+      'https://apps.example/webapp-unavailable?_rsc=transport-value',
+    )
+  })
+
+  it('keeps the configured Next basePath on the internal destination', async () => {
+    fetchMock.mockResolvedValue(
+      Response.json(
+        { code: 'app_not_found', status: 404, message: 'App not found.' },
+        { status: 404 },
+      ),
+    )
+    const incoming = new NextRequest('https://apps.example/dify/chat/code', {
+      nextConfig: { basePath: '/dify' },
+      headers: request().headers,
+    })
+    const result = await gate(incoming)
+    expect(result?.status).toBe(404)
+    expect(result?.headers.get('x-middleware-rewrite')).toBe(
+      'https://apps.example/dify/webapp-unavailable',
+    )
+  })
+
+  it('does not let a browser choose the root error-layout branch for an allowed app', async () => {
+    const result = await proxy(
+      request('/chat/code', {
+        'x-dify-pathname': '/webapp-unavailable',
+        [APP_UNAVAILABLE_IP_HEADER]: '198.51.100.1',
+      }),
+    )
+    expect(result.status).toBe(200)
+    expect(result.headers.get('x-middleware-rewrite')).toBeNull()
+    expect(result.headers.get('x-middleware-request-x-dify-pathname')).toBe('/chat/code')
+    expect(result.headers.has(`x-middleware-request-${APP_UNAVAILABLE_IP_HEADER}`)).toBe(false)
+  })
+
+  it.each([401, 403, 429, 500, 502, 503])(
+    'does not disguise upstream %s as not-found',
+    async (status) => {
+      fetchMock.mockResolvedValue(Response.json({ code: 'upstream_error' }, { status }))
+      expect((await gate(request()))?.status).toBe(503)
+    },
+  )
+
+  it.each([
+    () => new Response('<h1>404</h1>', { status: 404 }),
+    () => Response.json({ code: 'other_resource_not_found' }, { status: 404 }),
+    () =>
+      Response.json(
+        { code: 'app_not_found', status: 500, message: 'App not found.' },
+        { status: 404 },
+      ),
+    () =>
+      Response.json(
+        { code: 'app_not_found', status: 404, message: 'An upstream error' },
+        { status: 404 },
+      ),
+    () => Response.json({ code: 'app_not_found' }, { status: 404 }),
+    () => Response.json({ unexpected: true }),
+    () => Response.json({ code: 'app_not_found', padding: 'x'.repeat(8192) }, { status: 404 }),
+    () => new Response('{', { headers: { 'content-type': 'application/json' }, status: 404 }),
+  ])('treats invalid upstream payloads as unavailable, not app-not-found', async (response) => {
+    fetchMock.mockResolvedValue(response())
+    expect((await gate(request()))?.status).toBe(503)
+  })
+
+  it('does not use an allow fallback after a network/timeout failure', async () => {
+    fetchMock.mockRejectedValue(new DOMException('Timed out', 'TimeoutError'))
+    expect((await gate(request()))?.status).toBe(503)
+    expect(fetchMock).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/web/features/app-access-error/__tests__/page.spec.tsx b/web/features/app-access-error/__tests__/page.spec.tsx
index d301b5aee4c7b6..79388fd43e5535 100644
--- a/web/features/app-access-error/__tests__/page.spec.tsx
+++ b/web/features/app-access-error/__tests__/page.spec.tsx
@@ -1,9 +1,12 @@
 import { render, screen, waitFor } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
 import { createInstance } from 'i18next'
+import { renderToString } from 'react-dom/server'
 import { I18nextProvider } from 'react-i18next'
+import enCommon from '@/i18n/en-US/common.json'
 import enLogin from '@/i18n/en-US/login.json'
 import enShare from '@/i18n/en-US/share.json'
+import jaCommon from '@/i18n/ja-JP/common.json'
 import jaLogin from '@/i18n/ja-JP/login.json'
 import jaShare from '@/i18n/ja-JP/share.json'
 import zhLogin from '@/i18n/zh-Hans/login.json'
@@ -25,6 +28,22 @@ beforeEach(() => {
 })
 afterEach(() => vi.restoreAllMocks())
 
+it('server-renders the document title text and IP from preloaded browser-language resources', () => {
+  const html = renderToString(
+    <AppNotAccessible
+      clientIp="192.0.2.81"
+      initialLocale="ja-JP"
+      initialResources={{
+        'en-US': { share: enShare, common: enCommon, login: enLogin },
+        'ja-JP': { share: jaShare, common: jaCommon, login: jaLogin },
+      }}
+    />,
+  )
+  expect(html).toMatch(new RegExp(`<h1[^>]*>${jaShare['appNotAccessible.title']}</h1>`))
+  expect(html).toMatch(/<code[^>]*>192\.0\.2\.81<\/code>/)
+  expect(html).not.toContain(enShare['appNotAccessible.title'])
+})
+
 it.each([
   ['en-GB', enShare, enLogin],
   ['zh-CN', zhShare, zhLogin],
diff --git a/web/features/app-access-error/document-response.ts b/web/features/app-access-error/document-response.ts
new file mode 100644
index 00000000000000..c7c77e9fbe5d7d
--- /dev/null
+++ b/web/features/app-access-error/document-response.ts
@@ -0,0 +1,138 @@
+// oxlint-disable-next-line no-restricted-imports -- Proxy is the pre-render HTTP boundary, which requires Next's response implementation.
+import type { NextRequest } from 'next/server'
+import { Buffer } from 'node:buffer'
+import { timingSafeEqual } from 'node:crypto'
+import { isIP } from 'node:net'
+// oxlint-disable-next-line no-restricted-imports -- A rewrite with an explicit status must run before Next starts streaming the document.
+import { NextResponse } from 'next/server'
+import { env } from '@/env'
+import { isAccessMode } from '@/models/access-control'
+import { parseWebAppAddress } from '@/service/webapp-address'
+
+export const APP_UNAVAILABLE_PATH = '/webapp-unavailable'
+export const APP_UNAVAILABLE_IP_HEADER = 'x-dify-app-unavailable-ip'
+const PROXY_SECRET_HEADER = 'x-dify-webapp-proxy-secret'
+const VERIFIED_IP_HEADER = 'x-dify-webapp-client-ip'
+const MAX_PREFLIGHT_BYTES = 8192
+
+function authenticatedProxyIp(request: NextRequest) {
+  const expected = env.WEBAPP_ACCESS_PREFLIGHT_PROXY_SECRET
+  const supplied = request.headers.get(PROXY_SECRET_HEADER)
+  const ip = request.headers.get(VERIFIED_IP_HEADER)
+  if (!expected || !supplied || !ip || !isIP(ip)) return undefined
+  const expectedBytes = Buffer.from(expected)
+  const suppliedBytes = Buffer.from(supplied)
+  return expectedBytes.length === suppliedBytes.length &&
+    timingSafeEqual(expectedBytes, suppliedBytes)
+    ? ip
+    : undefined
+}
+
+async function readPreflightPayload(response: Response): Promise<unknown> {
+  if (!response.headers.get('content-type')?.toLowerCase().startsWith('application/json'))
+    throw new Error('Unexpected preflight content type')
+  const reader = response.body?.getReader()
+  if (!reader) throw new Error('Empty preflight response')
+  const chunks: Uint8Array[] = []
+  let length = 0
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) break
+      length += value.byteLength
+      if (length > MAX_PREFLIGHT_BYTES) throw new Error('Preflight response too large')
+      chunks.push(value)
+    }
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } finally {
+    await reader.cancel()
+  }
+}
+
+/** A protocol failure is not evidence that an application does not exist. */
+function unavailable() {
+  return new NextResponse(null, { status: 503, headers: { 'Cache-Control': 'no-store' } })
+}
+
+function notFoundDocument(request: NextRequest, requestHeaders: Headers, ip?: string) {
+  const destination = request.nextUrl.clone()
+  destination.pathname = APP_UNAVAILABLE_PATH
+  destination.search = ''
+  // Keep only Next's transport-owned cache-busting value for RSC navigation.
+  // Removing it causes Next's RSC validation to redirect before rendering.
+  const rsc = request.nextUrl.searchParams.get('_rsc')
+  if (rsc !== null) destination.searchParams.set('_rsc', rsc)
+  requestHeaders.set('x-dify-pathname', APP_UNAVAILABLE_PATH)
+  requestHeaders.set('x-dify-search', '')
+  if (ip) requestHeaders.set(APP_UNAVAILABLE_IP_HEADER, ip)
+  return NextResponse.rewrite(destination, {
+    status: 404,
+    headers: { 'Cache-Control': 'no-store' },
+    request: { headers: requestHeaders },
+  })
+}
+
+/**
+ * Only the configured ingress can attest the visitor IP. The Gateway remains
+ * the authorization owner; neither browser forwarding headers nor a direct
+ * Core request can substitute for its decision.
+ */
+export async function getWebAppDocumentResponse(request: NextRequest, requestHeaders: Headers) {
+  // These values must never survive from a browser request or reach page props.
+  requestHeaders.delete(APP_UNAVAILABLE_IP_HEADER)
+  requestHeaders.delete(PROXY_SECRET_HEADER)
+  requestHeaders.delete(VERIFIED_IP_HEADER)
+
+  const { pathname } = request.nextUrl
+  if (pathname === APP_UNAVAILABLE_PATH) return notFoundDocument(request, requestHeaders)
+
+  const address = parseWebAppAddress(pathname)
+  if (!address || address.kind !== 'default' || !env.WEBAPP_ACCESS_PREFLIGHT_URL) return undefined
+
+  const clientIp = authenticatedProxyIp(request)
+  if (!clientIp) return unavailable()
+
+  try {
+    const url = new URL(env.WEBAPP_ACCESS_PREFLIGHT_URL)
+    if (
+      !['http:', 'https:'].includes(url.protocol) ||
+      url.username ||
+      url.password ||
+      url.hash ||
+      url.search
+    )
+      return unavailable()
+    url.searchParams.set('appCode', decodeURIComponent(address.code))
+    const response = await fetch(url, {
+      method: 'GET',
+      headers: { Accept: 'application/json', 'X-Forwarded-For': clientIp },
+      cache: 'no-store',
+      redirect: 'error',
+      signal: AbortSignal.timeout(5000),
+    })
+    if (response.status !== 200 && response.status !== 404) return unavailable()
+    const payload = await readPreflightPayload(response)
+    if (typeof payload !== 'object' || payload === null) return unavailable()
+    if (
+      response.status === 200 &&
+      'accessMode' in payload &&
+      typeof payload.accessMode === 'string' &&
+      isAccessMode(payload.accessMode)
+    )
+      return undefined
+    if (
+      response.status === 404 &&
+      'code' in payload &&
+      payload.code === 'app_not_found' &&
+      'status' in payload &&
+      payload.status === 404 &&
+      'message' in payload &&
+      payload.message === 'App not found.'
+    )
+      return notFoundDocument(request, requestHeaders, clientIp)
+    return unavailable()
+  } catch {
+    // Do not log the URL, ingress proof, visitor IP, or upstream error body.
+    return unavailable()
+  }
+}
diff --git a/web/features/app-access-error/page.tsx b/web/features/app-access-error/page.tsx
index 74961f4143379e..f03022767d88e6 100644
--- a/web/features/app-access-error/page.tsx
+++ b/web/features/app-access-error/page.tsx
@@ -1,5 +1,6 @@
 'use client'
 
+import type { Resource } from 'i18next'
 import type { Locale } from '@/i18n-config'
 import { cn } from '@langgenius/dify-ui/cn'
 import { createInstance } from 'i18next'
@@ -22,6 +23,9 @@ type AppNotAccessibleProps = {
   clientIp?: string
   /** A dialog supplies its own landmarks and close control. */
   embedded?: boolean
+  /** The document gate supplies browser-language resources before streaming. */
+  initialLocale?: Locale
+  initialResources?: Resource
 }
 
 function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
@@ -135,7 +139,10 @@ export default function AppNotAccessible(props: AppNotAccessibleProps) {
     const instance = createInstance()
     void instance.use(resourcesToBackend(loadI18nResource)).init({
       ...getInitOptions(),
-      lng: getBrowserLocale(typeof navigator === 'undefined' ? [] : navigator.languages),
+      lng:
+        props.initialLocale ??
+        getBrowserLocale(typeof navigator === 'undefined' ? [] : navigator.languages),
+      resources: props.initialResources,
       ns: ['share', 'common', 'login'],
       defaultNS: 'share',
     })
diff --git a/web/proxy.ts b/web/proxy.ts
index ee4d4399c697f8..7313684b23a48f 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -4,6 +4,7 @@ import { Buffer } from 'node:buffer'
 // oxlint-disable-next-line no-restricted-imports
 import { NextResponse } from 'next/server'
 import { env } from '@/env'
+import { getWebAppDocumentResponse } from '@/features/app-access-error/document-response'
 
 const NECESSARY_DOMAIN =
   '*.sentry.io http://localhost:* http://127.0.0.1:* https://analytics.google.com googletagmanager.com *.googletagmanager.com https://www.google-analytics.com https://cdn-cookieyes.com https://ungh.cc https://api2.amplitude.com *.amplitude.com'
@@ -61,7 +62,7 @@ const wrapResponseWithFrameProtection = (response: NextResponse, pathname: strin
 
   return response
 }
-export function proxy(request: NextRequest) {
+export async function proxy(request: NextRequest) {
   const { pathname, search } = request.nextUrl
 
   // TODO(2026-11-11): Remove after external education CTAs and active campaign links use the canonical route.
@@ -83,11 +84,13 @@ export function proxy(request: NextRequest) {
   const isWhiteListEnabled =
     !!env.NEXT_PUBLIC_CSP_WHITELIST && process.env.NODE_ENV === 'production'
   if (!isWhiteListEnabled) {
-    const response = NextResponse.next({
-      request: {
-        headers: requestHeaders,
-      },
-    })
+    const response =
+      (await getWebAppDocumentResponse(request, requestHeaders)) ??
+      NextResponse.next({
+        request: {
+          headers: requestHeaders,
+        },
+      })
     return wrapResponseWithFrameProtection(response, pathname)
   }
 
@@ -124,11 +127,13 @@ export function proxy(request: NextRequest) {
 
   requestHeaders.set('Content-Security-Policy', contentSecurityPolicyHeaderValue)
 
-  const response = NextResponse.next({
-    request: {
-      headers: requestHeaders,
-    },
-  })
+  const response =
+    (await getWebAppDocumentResponse(request, requestHeaders)) ??
+    NextResponse.next({
+      request: {
+        headers: requestHeaders,
+      },
+    })
 
   response.headers.set('Content-Security-Policy', contentSecurityPolicyHeaderValue)
 

From 343fc364820ea4d8ea16597db4ae68aefa083c4f Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Tue, 22 Sep 2026 19:37:58 +0800
Subject: [PATCH 066/108] test(api): move SaaS dev queue repair tests into API
 suite

---
 .github/scripts/saas-dev/README.md            |   2 +-
 .../commands}/test_fix_workflow_queues.py     | 258 +++++++++---------
 2 files changed, 137 insertions(+), 123 deletions(-)
 rename {.github/scripts/saas-dev => api/tests/unit_tests/commands}/test_fix_workflow_queues.py (61%)

diff --git a/.github/scripts/saas-dev/README.md b/.github/scripts/saas-dev/README.md
index 109dcad91670ec..fdc096eadea4a9 100644
--- a/.github/scripts/saas-dev/README.md
+++ b/.github/scripts/saas-dev/README.md
@@ -121,7 +121,7 @@ script deliberately provides no automatic destructive rollback or queue purge.
 ## Local tests
 
 ```sh
-python3 -m unittest discover -s .github/scripts/saas-dev -p 'test_*.py' -v
+uv run --project api pytest api/tests/unit_tests/commands/test_fix_workflow_queues.py
 ```
 
 Tests use temporary synthetic Compose files and mocked broker responses. They
diff --git a/.github/scripts/saas-dev/test_fix_workflow_queues.py b/api/tests/unit_tests/commands/test_fix_workflow_queues.py
similarity index 61%
rename from .github/scripts/saas-dev/test_fix_workflow_queues.py
rename to api/tests/unit_tests/commands/test_fix_workflow_queues.py
index ec3fec85f77435..26c12c154260f4 100644
--- a/.github/scripts/saas-dev/test_fix_workflow_queues.py
+++ b/api/tests/unit_tests/commands/test_fix_workflow_queues.py
@@ -1,14 +1,22 @@
+"""Unit tests for the opt-in SaaS-dev workflow queue repair script."""
+
 import copy
 import importlib.util
-from pathlib import Path
 import stat
 import tempfile
 import unittest
+from collections.abc import Callable
+from pathlib import Path
+from typing import NotRequired, TypedDict, override
 from unittest.mock import patch
 
-SPEC = importlib.util.spec_from_file_location(
-    "fix_workflow_queues", Path(__file__).with_name("fix_workflow_queues.py")
-)
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parents[4]
+SCRIPT_PATH = REPO_ROOT / ".github" / "scripts" / "saas-dev" / "fix_workflow_queues.py"
+SPEC = importlib.util.spec_from_file_location("fix_workflow_queues", SCRIPT_PATH)
+assert SPEC is not None
+assert SPEC.loader is not None
 repair = importlib.util.module_from_spec(SPEC)
 SPEC.loader.exec_module(repair)
 
@@ -16,14 +24,12 @@
 FULL = ",".join(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
 
 
-def compose(value=BASE, before_worker="", after_worker="", newline="\n"):
+def compose(value: str = BASE, before_worker: str = "", after_worker: str = "", newline: str = "\n") -> bytes:
     return (
         (
             "# Keep this comment and unrelated settings\n"
             "x-common: &common\n  LOG_LEVEL: INFO\n"
-            "services:\n"
-            + before_worker
-            + "  worker:\n    image: langgenius/dify-api:deploy-saas\n"
+            "services:\n" + before_worker + "  worker:\n    image: langgenius/dify-api:deploy-saas\n"
             "    environment:\n      <<: *common\n      DEPLOYMENT_EDITION: CLOUD\n"
             f"      CELERY_QUEUES: {value}  # deliberately explicit\n"
             "      OTHER_CONFIG: unchanged\n" + after_worker + "volumes:\n  storage:\n"
@@ -40,39 +46,56 @@ def compose(value=BASE, before_worker="", after_worker="", newline="\n"):
 )
 
 
+class ApplyOverrides(TypedDict, total=False):
+    validate: Callable[[Path], object]
+    preflight: Callable[[], object]
+
+
+class ServiceConfig(TypedDict):
+    environment: dict[str, str]
+    deploy: NotRequired[dict[str, int]]
+
+
+class ComposeConfig(TypedDict):
+    services: dict[str, ServiceConfig]
+
+
+class ContainerConfig(TypedDict):
+    Env: list[str]
+    Labels: dict[str, str]
+
+
+class Container(TypedDict):
+    Id: str
+    State: dict[str, bool]
+    Config: ContainerConfig
+
+
 class PatchPlanTests(unittest.TestCase):
-    def test_preserves_every_other_byte_for_worker_at_different_positions(self):
+    def test_preserves_every_other_byte_for_worker_at_different_positions(self) -> None:
         for before_worker, after_worker in ((OTHER_WORKERS, ""), ("", OTHER_WORKERS)):
             for quote in ("", "'", '"'):
                 for newline in ("\n", "\r\n"):
-                    with self.subTest(
-                        before=bool(before_worker), quote=quote, newline=newline
-                    ):
-                        before = compose(
-                            quote + BASE + quote, before_worker, after_worker, newline
-                        )
+                    with self.subTest(before=bool(before_worker), quote=quote, newline=newline):
+                        before = compose(quote + BASE + quote, before_worker, after_worker, newline)
                         after, old, new = repair.plan_patch(before)
-                        self.assertEqual(
-                            after, before.replace(BASE.encode(), FULL.encode(), 1)
-                        )
-                        self.assertEqual(old, list(repair.BASE_QUEUES))
-                        self.assertEqual(
-                            new, list(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
-                        )
-
-    def test_only_appends_missing_names_and_keeps_existing_order(self):
+                        assert after == before.replace(BASE.encode(), FULL.encode(), 1)
+                        assert old == list(repair.BASE_QUEUES)
+                        assert new == list(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
+
+    def test_only_appends_missing_names_and_keeps_existing_order(self) -> None:
         current = ",".join(reversed(repair.BASE_QUEUES)) + ",workflow_team"
         after, old, new = repair.plan_patch(compose(current))
-        self.assertEqual(new, old + ["workflow_professional", "workflow_sandbox"])
-        self.assertIn(",".join(new).encode(), after)
+        assert new == old + ["workflow_professional", "workflow_sandbox"]
+        assert ",".join(new).encode() in after
 
-    def test_idempotent_when_all_queues_already_exist(self):
+    def test_idempotent_when_all_queues_already_exist(self) -> None:
         before = compose(FULL)
         after, old, new = repair.plan_patch(before)
-        self.assertEqual(after, before)
-        self.assertEqual(old, new)
+        assert after == before
+        assert old == new
 
-    def test_rejects_duplicate_unknown_missing_or_interpolated_queues(self):
+    def test_rejects_duplicate_unknown_missing_or_interpolated_queues(self) -> None:
         for value in (
             BASE + ",dataset",
             BASE + ",schedule_poller",
@@ -83,18 +106,16 @@ def test_rejects_duplicate_unknown_missing_or_interpolated_queues(self):
         ):
             with (
                 self.subTest(value=value),
-                self.assertRaises(repair.UnsafeConfiguration),
+                pytest.raises(repair.UnsafeConfiguration),
             ):
                 repair.plan_patch(compose(value))
 
-    def test_missing_and_ambiguous_target_fields_fail_closed(self):
+    def test_missing_and_ambiguous_target_fields_fail_closed(self) -> None:
         original = compose()
         for content in (
             original.replace(b"  worker:", b"  another_worker:"),
             original.replace(b"CELERY_QUEUES:", b"OTHER_QUEUES:"),
-            original.replace(
-                b"    environment:", b"    environment: {}\n    environment:"
-            ),
+            original.replace(b"    environment:", b"    environment: {}\n    environment:"),
             original.replace(b"  worker:", b"  worker: {}\n  worker:"),
             original.replace(b"services:", b"services: {}\nservices:"),
             original.replace(
@@ -104,34 +125,33 @@ def test_missing_and_ambiguous_target_fields_fail_closed(self):
         ):
             with (
                 self.subTest(content=content),
-                self.assertRaises(repair.UnsafeConfiguration),
+                pytest.raises(repair.UnsafeConfiguration),
             ):
                 repair.plan_patch(content)
 
-    def test_rejects_non_scalar_list_block_and_alias_values(self):
+    def test_rejects_non_scalar_list_block_and_alias_values(self) -> None:
         values = ("[dataset,mail]", "true", "|\n        " + BASE, ">\n        " + BASE)
         for value in values:
             with (
                 self.subTest(value=value),
-                self.assertRaises(repair.UnsafeConfiguration),
+                pytest.raises(repair.UnsafeConfiguration),
             ):
                 repair.plan_patch(compose(value))
-        outside_alias = (
-            b"x-queues: &queues " + BASE.encode() + b"\n" + compose("*queues")
-        )
-        with self.assertRaises(repair.UnsafeConfiguration):
+        outside_alias = b"x-queues: &queues " + BASE.encode() + b"\n" + compose("*queues")
+        with pytest.raises(repair.UnsafeConfiguration):
             repair.plan_patch(outside_alias)
         worker_alias = (
             b"x-worker: &worker\n  environment:\n    CELERY_QUEUES: "
             + BASE.encode()
             + b"\nservices:\n  worker: *worker\n"
         )
-        with self.assertRaises(repair.UnsafeConfiguration):
+        with pytest.raises(repair.UnsafeConfiguration):
             repair.plan_patch(worker_alias)
 
 
 class ResolvedValidationTests(unittest.TestCase):
-    def setUp(self):
+    @override
+    def setUp(self) -> None:
         self.before = {
             "services": {
                 "worker": {
@@ -140,17 +160,13 @@ def setUp(self):
                         "CELERY_QUEUES": BASE,
                     }
                 },
-                "priority_worker": {
-                    "environment": {
-                        "CELERY_QUEUES": "priority_dataset,priority_pipeline"
-                    }
-                },
+                "priority_worker": {"environment": {"CELERY_QUEUES": "priority_dataset,priority_pipeline"}},
             }
         }
         self.after = copy.deepcopy(self.before)
         self.after["services"]["worker"]["environment"]["CELERY_QUEUES"] = FULL
 
-    def test_accepts_exact_single_field_change(self):
+    def test_accepts_exact_single_field_change(self) -> None:
         repair.validate_resolved(
             self.before,
             self.after,
@@ -158,7 +174,7 @@ def test_accepts_exact_single_field_change(self):
             repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
         )
 
-    def test_rejects_overrides_non_cloud_or_unrelated_changes(self):
+    def test_rejects_overrides_non_cloud_or_unrelated_changes(self) -> None:
         for field, value in (
             ("CELERY_WORKER_QUEUES", "override"),
             ("DEPLOYMENT_EDITION", "COMMUNITY"),
@@ -168,7 +184,7 @@ def test_rejects_overrides_non_cloud_or_unrelated_changes(self):
             before["services"]["worker"]["environment"][field] = value
             with (
                 self.subTest(field=field),
-                self.assertRaises(repair.UnsafeConfiguration),
+                pytest.raises(repair.UnsafeConfiguration),
             ):
                 repair.validate_resolved(
                     before,
@@ -176,10 +192,8 @@ def test_rejects_overrides_non_cloud_or_unrelated_changes(self):
                     repair.BASE_QUEUES,
                     repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
                 )
-        self.after["services"]["priority_worker"]["environment"]["CELERY_QUEUES"] += (
-            ",workflow_professional"
-        )
-        with self.assertRaises(repair.UnsafeConfiguration):
+        self.after["services"]["priority_worker"]["environment"]["CELERY_QUEUES"] += ",workflow_professional"
+        with pytest.raises(repair.UnsafeConfiguration):
             repair.validate_resolved(
                 self.before,
                 self.after,
@@ -189,7 +203,8 @@ def test_rejects_overrides_non_cloud_or_unrelated_changes(self):
 
 
 class ApplyTests(unittest.TestCase):
-    def setUp(self):
+    @override
+    def setUp(self) -> None:
         self.temp = tempfile.TemporaryDirectory()
         self.addCleanup(self.temp.cleanup)
         self.path = Path(self.temp.name) / "docker-compose.yaml"
@@ -199,8 +214,11 @@ def setUp(self):
         self.path.chmod(0o640)
 
     def apply(
-        self, validate=lambda candidate: None, preflight=lambda: None, expected=None
-    ):
+        self,
+        validate: Callable[[Path], object] = lambda _candidate: None,
+        preflight: Callable[[], object] = lambda: None,
+        expected: str | None = None,
+    ) -> Path | None:
         return repair.apply_patch(
             self.path,
             self.before,
@@ -210,79 +228,80 @@ def apply(
             preflight,
         )
 
-    def test_backup_content_permissions_and_exact_change(self):
+    def test_backup_content_permissions_and_exact_change(self) -> None:
         backup = self.apply()
-        self.assertEqual(backup.read_bytes(), self.before)
-        self.assertEqual(self.path.read_bytes(), self.after)
-        self.assertEqual(stat.S_IMODE(backup.stat().st_mode), 0o640)
-        self.assertEqual(stat.S_IMODE(self.path.stat().st_mode), 0o640)
-        self.assertEqual(list(self.path.parent.glob(".snp836-candidate-*")), [])
-
-    def test_noop_does_not_write_or_create_backup(self):
+        assert backup is not None
+        assert backup.read_bytes() == self.before
+        assert self.path.read_bytes() == self.after
+        assert stat.S_IMODE(backup.stat().st_mode) == 0o640
+        assert stat.S_IMODE(self.path.stat().st_mode) == 0o640
+        assert list(self.path.parent.glob(".snp836-candidate-*")) == []
+
+    def test_noop_does_not_write_or_create_backup(self) -> None:
         original_inode = self.path.stat().st_ino
         backup = repair.apply_patch(
             self.path,
             self.before,
             self.before,
             repair.sha256(self.before),
-            lambda candidate: None,
+            lambda _candidate: None,
             lambda: None,
         )
-        self.assertIsNone(backup)
-        self.assertEqual(self.path.stat().st_ino, original_inode)
-        self.assertEqual(list(self.path.parent.glob("*backup*")), [])
+        assert backup is None
+        assert self.path.stat().st_ino == original_inode
+        assert list(self.path.parent.glob("*backup*")) == []
 
-    def test_hash_and_before_content_guards(self):
-        with self.assertRaises(repair.UnsafeConfiguration):
+    def test_hash_and_before_content_guards(self) -> None:
+        with pytest.raises(repair.UnsafeConfiguration):
             self.apply(expected="0" * 64)
         self.path.write_bytes(self.before + b"# concurrent update\n")
-        with self.assertRaises(repair.UnsafeConfiguration):
+        with pytest.raises(repair.UnsafeConfiguration):
             self.apply()
-        self.assertEqual(list(self.path.parent.glob("*backup*")), [])
+        assert list(self.path.parent.glob("*backup*")) == []
 
-    def test_validation_or_backlog_failure_does_not_write(self):
-        def refuse(*args):
+    def test_validation_or_backlog_failure_does_not_write(self) -> None:
+        def refuse(*_args: object) -> None:
             raise repair.UnsafeConfiguration("unsafe")
 
-        for arguments in ({"validate": refuse}, {"preflight": refuse}):
+        overrides: tuple[ApplyOverrides, ...] = ({"validate": refuse}, {"preflight": refuse})
+        for arguments in overrides:
             with (
                 self.subTest(arguments=arguments),
-                self.assertRaises(repair.UnsafeConfiguration),
+                pytest.raises(repair.UnsafeConfiguration),
             ):
                 self.apply(**arguments)
-            self.assertEqual(self.path.read_bytes(), self.before)
-            self.assertEqual(list(self.path.parent.glob("*backup*")), [])
-            self.assertEqual(list(self.path.parent.glob(".snp836-candidate-*")), [])
+            assert self.path.read_bytes() == self.before
+            assert list(self.path.parent.glob("*backup*")) == []
+            assert list(self.path.parent.glob(".snp836-candidate-*")) == []
 
-    def test_concurrent_edit_after_validation_is_not_overwritten(self):
+    def test_concurrent_edit_after_validation_is_not_overwritten(self) -> None:
         concurrent = self.before + b"# operator edit\n"
-        with self.assertRaises(repair.UnsafeConfiguration):
-            self.apply(validate=lambda candidate: self.path.write_bytes(concurrent))
-        self.assertEqual(self.path.read_bytes(), concurrent)
+        with pytest.raises(repair.UnsafeConfiguration):
+            self.apply(validate=lambda _candidate: self.path.write_bytes(concurrent))
+        assert self.path.read_bytes() == concurrent
 
-    def test_symlink_is_rejected(self):
+    def test_symlink_is_rejected(self) -> None:
         alias = self.path.parent / "alias"
         alias.symlink_to(self.path)
-        with self.assertRaises(repair.UnsafeConfiguration):
+        with pytest.raises(repair.UnsafeConfiguration):
             repair.regular_file(alias)
 
 
 class BrokerPreflightTests(unittest.TestCase):
-    def setUp(self):
+    @override
+    def setUp(self) -> None:
         self.env = {"CELERY_BROKER_URL": "redis://fake-fixture:6379/1"}
-        self.config = {
+        self.config: ComposeConfig = {
             "services": {
                 "api": {"environment": self.env.copy()},
                 "worker": {"environment": self.env.copy()},
             }
         }
 
-    def test_matching_plain_broker_is_accepted(self):
-        repair.validate_broker_environments(
-            self.config, [self.env.copy(), self.env.copy(), self.env.copy()]
-        )
+    def test_matching_plain_broker_is_accepted(self) -> None:
+        repair.validate_broker_environments(self.config, [self.env.copy(), self.env.copy(), self.env.copy()])
 
-    def test_namespace_or_broker_mismatch_fails_at_every_layer(self):
+    def test_namespace_or_broker_mismatch_fails_at_every_layer(self) -> None:
         for layer in ("api", "worker", "runtime"):
             for setting, value in (
                 ("REDIS_KEY_PREFIX", "isolated"),
@@ -290,44 +309,43 @@ def test_namespace_or_broker_mismatch_fails_at_every_layer(self):
                 ("CELERY_USE_SENTINEL", "true"),
                 ("BROKER_USE_SSL", "true"),
             ):
-                with (
-                    self.subTest(layer=layer, setting=setting),
-                    self.assertRaises(repair.UnsafeConfiguration),
-                ):
+                with self.subTest(layer=layer, setting=setting):
                     config = copy.deepcopy(self.config)
                     runtime = [self.env.copy()]
-                    target = (
-                        runtime[0]
-                        if layer == "runtime"
-                        else config["services"][layer]["environment"]
-                    )
+                    target = runtime[0] if layer == "runtime" else config["services"][layer]["environment"]
                     target[setting] = value
-                    repair.validate_broker_environments(config, runtime)
+                    with pytest.raises(repair.UnsafeConfiguration):
+                        repair.validate_broker_environments(config, runtime)
 
-    def test_any_workflow_backlog_unacked_or_invalid_reply_blocks_apply(self):
-        empty = {queue: 0 for queue in repair.WORKFLOW_QUEUES}
+    def test_any_workflow_backlog_unacked_or_invalid_reply_blocks_apply(self) -> None:
+        empty = dict.fromkeys(repair.WORKFLOW_QUEUES, 0)
         empty.update(unacked=0, unacked_index=0)
         with (
             patch.object(repair, "check_runtime_broker"),
             patch.object(repair, "safe_command") as command,
         ):
             command.return_value = repair.json.dumps(empty)
-            self.assertEqual(repair.broker_check(self.config), empty)
+            assert repair.broker_check(self.config) == empty
             for key in empty:
                 command.return_value = repair.json.dumps({**empty, key: 1})
                 with (
                     self.subTest(key=key),
-                    self.assertRaises(repair.UnsafeConfiguration),
+                    pytest.raises(repair.UnsafeConfiguration),
                 ):
                     repair.broker_check(self.config)
-            for invalid in ({}, {**empty, "unknown": 0}, {**empty, "unacked": False}):
+            invalid_replies: tuple[dict[str, int | bool], ...] = (
+                {},
+                {**empty, "unknown": 0},
+                {**empty, "unacked": False},
+            )
+            for invalid in invalid_replies:
                 command.return_value = repair.json.dumps(invalid)
-                with self.assertRaises(repair.UnsafeConfiguration):
+                with pytest.raises(repair.UnsafeConfiguration):
                     repair.broker_check(self.config)
 
-    def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self):
+    def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self) -> None:
         self.config["services"]["worker"]["deploy"] = {"replicas": 2}
-        containers = []
+        containers: list[Container] = []
         for index, service in enumerate(("api", "worker", "worker")):
             containers.append(
                 {
@@ -341,9 +359,7 @@ def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self):
                         "Labels": {
                             "com.docker.compose.service": service,
                             "com.docker.compose.project": "langgenius",
-                            "com.docker.compose.project.config_files": str(
-                                repair.TARGET
-                            ),
+                            "com.docker.compose.project.config_files": str(repair.TARGET),
                         },
                     },
                 }
@@ -357,24 +373,22 @@ def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self):
         with patch.object(repair, "safe_command", side_effect=responses):
             repair.check_runtime_broker(self.config)
         with patch.object(repair, "safe_command", return_value="one-worker-only\n"):
-            with self.assertRaises(repair.UnsafeConfiguration):
+            with pytest.raises(repair.UnsafeConfiguration):
                 repair.check_runtime_broker(self.config)
         with patch.object(
             repair,
             "safe_command",
             side_effect=responses[:2] + ["celery\0-Q\0wrong_queue\0"],
         ):
-            with self.assertRaises(repair.UnsafeConfiguration):
+            with pytest.raises(repair.UnsafeConfiguration):
                 repair.check_runtime_broker(self.config)
-        containers[0]["Config"]["Labels"]["com.docker.compose.project.config_files"] = (
-            "/different/compose.yaml"
-        )
+        containers[0]["Config"]["Labels"]["com.docker.compose.project.config_files"] = "/different/compose.yaml"
         with patch.object(
             repair,
             "safe_command",
             side_effect=[responses[0], repair.json.dumps(containers)],
         ):
-            with self.assertRaises(repair.UnsafeConfiguration):
+            with pytest.raises(repair.UnsafeConfiguration):
                 repair.check_runtime_broker(self.config)
 
 

From e4a2c433ea5530d2f8d5f6ce3777840e9a22cc27 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Tue, 22 Sep 2026 19:59:21 +0800
Subject: [PATCH 067/108] chore: remove SaaS dev queue repair tooling from
 feature PR

---
 .github/scripts/saas-dev/README.md            | 128 -----
 .../scripts/saas-dev/fix_workflow_queues.py   | 445 ------------------
 .../commands/test_fix_workflow_queues.py      | 396 ----------------
 3 files changed, 969 deletions(-)
 delete mode 100644 .github/scripts/saas-dev/README.md
 delete mode 100644 .github/scripts/saas-dev/fix_workflow_queues.py
 delete mode 100644 api/tests/unit_tests/commands/test_fix_workflow_queues.py

diff --git a/.github/scripts/saas-dev/README.md b/.github/scripts/saas-dev/README.md
deleted file mode 100644
index fdc096eadea4a9..00000000000000
--- a/.github/scripts/saas-dev/README.md
+++ /dev/null
@@ -1,128 +0,0 @@
-# SaaS dev workflow consumers (SNP-836)
-
-This is an **opt-in repair for the existing SaaS dev host**, not a general Cloud
-worker configuration or a Staging/Production deployment change. It never starts,
-stops, scales, or restarts containers and never enqueues, deletes, or consumes jobs.
-
-## Why
-
-The host's `/home/ubuntu/langgenius/docker-compose.yaml` explicitly sets the main
-worker's `CELERY_QUEUES`. This overrides the image defaults and omits
-`workflow_professional`, `workflow_team`, and `workflow_sandbox`. An allowed
-Webhook can therefore return HTTP 200 while its workflow remains queued.
-
-The repair appends only these three queues to the existing main worker setting.
-It preserves the existing ten queues, their order, comments, quoting, all other
-file bytes, file owner/group/mode, the two worker replicas, and every other
-service. It intentionally rejects a different or ambiguous baseline for review.
-
-Do **not** remove `CELERY_QUEUES`, enable all default queues, or change the shared
-image entrypoint. Dedicated Cloud workers elsewhere must not start competing for
-other queues. In the 2026-09-20 dev audit, `schedule_poller`, `schedule_executor`,
-and `trigger_refresh_publisher` each already contained more than 51,000 messages.
-Those queues and their data are outside this repair's scope.
-
-## Prerequisites and dry-run
-
-Requirements: Python 3.10+, PyYAML, Docker Compose v2, and access to the existing
-`langgenius-api-1` and two main worker containers. PyYAML was already installed on
-the audited host; no new package or credential is required. The existing API
-image supplies its Redis client. Resolved Compose configuration and broker
-credentials are processed only in memory, never printed or saved by the repair.
-
-From the repository root, run the script over SSH. Omitting `--apply` is a
-dry-run: the target and services are unchanged. A temporary validation candidate
-in the same directory is removed after validation.
-
-```sh
-ssh -T -i /Users/yansongzhang/.ssh/id_rsa -o IdentitiesOnly=yes \
-  ubuntu@ec2-100-30-236-187.compute-1.amazonaws.com \
-  'python3 - --target saas-dev' \
-  < .github/scripts/saas-dev/fix_workflow_queues.py
-```
-
-Every dry-run and apply performs these fail-closed preflight checks:
-
-- The target is precisely `/home/ubuntu/langgenius/docker-compose.yaml`, a regular
-  file, not a symlink or hardlink. `services.worker.environment.CELERY_QUEUES`
-  occurs exactly once and is an explicit, single-line string.
-- The resolved candidate differs only in that one environment value. The worker
-  is Cloud, and `CELERY_WORKER_QUEUES` does not override the intended setting.
-- Exactly two running main worker containers match the existing Compose project
-  and file. Their real PID 1 `-Q` arguments match their environment and contain
-  only the reviewed original queues and the three approved workflow queues.
-- Compose API/worker and running API/worker broker URLs match exactly in memory.
-  Redis prefixes, Sentinel, custom TLS, or a different topology fail closed;
-  review these explicitly instead of checking the wrong broker/namespace.
-- All three workflow queues, including Redis priority suffix keys, have **zero**
-  messages. Both broker `unacked` and `unacked_index` must also be **zero**.
-
-If any guard fails, stop and inspect the cause. Do not purge queues, remove
-messages, restart consumers, or weaken the guard to make the repair pass. A
-nonzero `unacked` count may be legitimate in-flight work; wait for it to finish
-and rerun the read-only check. The check is a snapshot, not a lock on producers;
-recheck immediately before the planned worker deployment.
-
-## Apply and deploy
-
-Review the dry-run's old/new queue lists and `before_sha256`. Apply requires that
-exact SHA256 plus the explicit target and apply flag:
-
-```sh
-ssh -T -i /Users/yansongzhang/.ssh/id_rsa -o IdentitiesOnly=yes \
-  ubuntu@ec2-100-30-236-187.compute-1.amazonaws.com \
-  'python3 - --target saas-dev --apply --expected-sha256 REVIEWED_SHA256' \
-  < .github/scripts/saas-dev/fix_workflow_queues.py
-```
-
-The script validates first, verifies the original content again, writes an exact
-same-directory backup with the original owner/group/mode, then atomically
-replaces the target and verifies the resulting bytes. It prints the concrete
-backup path, hashes, queue names, and `services_restarted: false`. Treat the
-backup as sensitive: it contains the original Compose configuration and must not
-be committed or attached to an issue. Record only its path and hash in the
-deployment report. An already-patched file is a no-op without another backup.
-
-This repository's `deploy-saas.yml` executes the configured
-`SSH_SCRIPT_SAAS_DEV`; the audited script pulls and recreates the normal API,
-Web, main worker, priority worker, and plugin worker services from this existing
-host Compose file. It does not replace that file, so the queue change persists
-through subsequent `deploy/saas` deployments. Keep the repair and API changes on
-the original PR and synchronize to `deploy/saas` through the normal reviewed
-workflow. Do not change the deployment script variable, pipeline settings,
-Staging/Production manifests, or unrelated service configurations for this fix.
-
-## Regression checklist
-
-1. After the normal deployment, inspect the two main worker PID 1 queue arguments:
-   the original ten queues plus exactly the three workflow queues must be present;
-   replica count and other workers' queue arguments must be unchanged.
-2. Create a disposable, no-model Webhook → End workflow. Bind a denying IP policy:
-   a request must return 403 and produce no workflow run or trigger log.
-3. Permit only the test source IP and send **one** Webhook request. HTTP 200 alone
-   is insufficient: verify the trigger log and workflow run reach `succeeded`,
-   with zero model tokens and no residual workflow queue message.
-4. Restore a denying policy, verify 403 and unchanged run count; confirm the
-   existing Web/API/MCP access-control regressions remain correct.
-5. Clean up only the disposable test resources through their normal lifecycle.
-   Do not clear shared queues, historical messages, or unrelated user data.
-6. Confirm none of the excluded schedule/refresh queues gained a consumer. Their
-   lengths can grow naturally while the beat process continues producing tasks;
-   growth is not a reason to consume or purge them during this fix.
-
-If rolling back, first check for running/pending workflow work and obtain approval
-for any service operation. Inspect the exact backup path printed by the apply;
-verify that the live file still has the recorded `after_sha256` before restoring
-it, so another person's intervening edits are not overwritten. Restore the
-backup with owner/group/mode preserved, validate Compose without printing its
-secret-bearing output, and use the normal worker deployment procedure. This
-script deliberately provides no automatic destructive rollback or queue purge.
-
-## Local tests
-
-```sh
-uv run --project api pytest api/tests/unit_tests/commands/test_fix_workflow_queues.py
-```
-
-Tests use temporary synthetic Compose files and mocked broker responses. They
-do not contact dev, invoke Docker, or use real credentials.
diff --git a/.github/scripts/saas-dev/fix_workflow_queues.py b/.github/scripts/saas-dev/fix_workflow_queues.py
deleted file mode 100644
index 6f1fb76374918b..00000000000000
--- a/.github/scripts/saas-dev/fix_workflow_queues.py
+++ /dev/null
@@ -1,445 +0,0 @@
-#!/usr/bin/env python3
-"""Opt-in, SaaS-dev-only repair for SNP-836; never starts a consumer.
-
-Requires Python 3.10+, PyYAML, Docker Compose v2, and the existing API container.
-The host's PyYAML is used only to locate YAML scalar spans; the file is not dumped
-or reformatted, and neither resolved configuration nor credentials are printed.
-"""
-
-import argparse
-import copy
-import hashlib
-import json
-import os
-from pathlib import Path
-import re
-import stat
-import subprocess
-import tempfile
-
-import yaml
-from yaml.nodes import MappingNode, ScalarNode
-
-TARGET = Path("/home/ubuntu/langgenius/docker-compose.yaml")
-BASE_QUEUES = (
-    "dataset",
-    "mail",
-    "ops_trace",
-    "app_deletion",
-    "pipeline",
-    "workflow_storage",
-    "conversation",
-    "workflow_based_app_execution",
-    "evaluation",
-    "new_agent_beta",
-)
-WORKFLOW_QUEUES = ("workflow_professional", "workflow_team", "workflow_sandbox")
-
-
-class UnsafeConfiguration(ValueError):
-    pass
-
-
-def field(node, name):
-    if not isinstance(node, MappingNode):
-        raise UnsafeConfiguration("Expected an explicit YAML mapping")
-    matches = [
-        (key, value)
-        for key, value in node.value
-        if isinstance(key, ScalarNode) and key.value == name
-    ]
-    if len(matches) != 1:
-        raise UnsafeConfiguration(f"Expected exactly one explicit {name} field")
-    key, value = matches[0]
-    if value.start_mark.index < key.end_mark.index:
-        raise UnsafeConfiguration(f"Aliased {name} field requires manual review")
-    return value
-
-
-def plan_patch(before):
-    """Change only the unique, direct worker queue scalar; return UTF-8 bytes."""
-    text = before.decode("utf-8")
-    try:
-        root = yaml.compose(text, Loader=yaml.SafeLoader)
-    except yaml.YAMLError:
-        raise UnsafeConfiguration(
-            "Invalid YAML; details suppressed to protect credentials"
-        ) from None
-    worker = field(field(root, "services"), "worker")
-    environment = field(worker, "environment")
-    queue = field(environment, "CELERY_QUEUES")
-    if not isinstance(queue, ScalarNode) or queue.tag != "tag:yaml.org,2002:str":
-        raise UnsafeConfiguration("CELERY_QUEUES must be an explicit string")
-    if (
-        queue.style not in (None, "'", '"')
-        or queue.start_mark.line != queue.end_mark.line
-    ):
-        raise UnsafeConfiguration(
-            "Multiline or non-scalar queue syntax requires manual review"
-        )
-    # Aliases can refer to a scalar outside this service. Never mutate its source.
-    if not (
-        worker.start_mark.index
-        < queue.start_mark.index
-        < queue.end_mark.index
-        <= worker.end_mark.index
-    ):
-        raise UnsafeConfiguration("Queue aliases outside worker require manual review")
-    current = queue.value.split(",")
-    if any(not re.fullmatch(r"[a-z_]+", item) for item in current):
-        raise UnsafeConfiguration(
-            "Queue interpolation, whitespace, or unsupported syntax requires review"
-        )
-    if len(current) != len(set(current)):
-        raise UnsafeConfiguration("Duplicate queue names require manual review")
-    if not set(BASE_QUEUES).issubset(current) or set(current) - set(
-        BASE_QUEUES + WORKFLOW_QUEUES
-    ):
-        raise UnsafeConfiguration(
-            "Worker queues differ from the reviewed SaaS dev baseline"
-        )
-    missing = [item for item in WORKFLOW_QUEUES if item not in current]
-    if not missing:
-        return before, current, current
-    updated = current + missing
-    raw = text[queue.start_mark.index : queue.end_mark.index]
-    quoted = queue.style or ""
-    # Refuse anchors, tags, escapes and aliases instead of rewriting them.
-    if raw != quoted + queue.value + quoted:
-        raise UnsafeConfiguration("Decorated queue scalar requires manual review")
-    replacement = quoted + ",".join(updated) + quoted
-    after = (
-        text[: queue.start_mark.index] + replacement + text[queue.end_mark.index :]
-    ).encode("utf-8")
-    if plan_patch(after)[0] != after:
-        raise UnsafeConfiguration("Candidate queue patch is not idempotent")
-    return after, current, updated
-
-
-def sha256(content):
-    return hashlib.sha256(content).hexdigest()
-
-
-def safe_command(command, *, input_text=None):
-    result = subprocess.run(
-        command, input=input_text, text=True, capture_output=True, timeout=45
-    )
-    if result.returncode:
-        raise UnsafeConfiguration(
-            "Read-only Docker validation failed; output suppressed to protect credentials"
-        )
-    return result.stdout
-
-
-def resolved_config(path):
-    return json.loads(
-        safe_command(
-            [
-                "docker",
-                "compose",
-                "--project-directory",
-                str(TARGET.parent),
-                "-f",
-                str(path),
-                "config",
-                "--format",
-                "json",
-            ]
-        )
-    )
-
-
-def validate_resolved(before, after, old_queues, new_queues):
-    """Catch inherited overrides, YAML ambiguity, and accidental unrelated edits."""
-    environment = before["services"]["worker"]["environment"]
-    if environment.get("DEPLOYMENT_EDITION") != "CLOUD":
-        raise UnsafeConfiguration("Expected CLOUD SaaS dev worker")
-    if environment.get("CELERY_WORKER_QUEUES"):
-        raise UnsafeConfiguration("CELERY_WORKER_QUEUES overrides CELERY_QUEUES")
-    if environment.get("CELERY_QUEUES") != ",".join(old_queues):
-        raise UnsafeConfiguration(
-            "Resolved queues differ from the explicit queue scalar"
-        )
-    expected = copy.deepcopy(before)
-    expected["services"]["worker"]["environment"]["CELERY_QUEUES"] = ",".join(
-        new_queues
-    )
-    if after != expected:
-        raise UnsafeConfiguration(
-            "Resolved candidate changes more than worker CELERY_QUEUES"
-        )
-
-
-BROKER_CHECK = r"""
-import json, os
-from redis import Redis
-try:
-    if os.environ.get("REDIS_KEY_PREFIX"):
-        raise ValueError("Unsupported broker namespace")
-    client = Redis.from_url(os.environ["CELERY_BROKER_URL"], socket_timeout=10)
-    counts = {}
-    for queue in ("workflow_professional", "workflow_team", "workflow_sandbox"):
-        name = queue.encode()
-        keys = {name, *client.scan_iter(match=name + b"\x06\x16*")}
-        counts[queue] = sum(client.llen(key) for key in keys)
-    counts["unacked"] = client.hlen("unacked")
-    counts["unacked_index"] = client.zcard("unacked_index")
-    print(json.dumps(counts))
-except Exception:
-    print("Broker check failed; details suppressed", file=__import__("sys").stderr)
-    raise SystemExit(1)
-"""
-
-
-def validate_broker_environments(config, runtime_environments):
-    """Compare credentials only in memory; unsupported broker layouts fail shut."""
-    expected = config["services"]["worker"]["environment"].get("CELERY_BROKER_URL")
-    if not isinstance(expected, str) or not expected.startswith("redis://"):
-        raise UnsafeConfiguration("Only the reviewed direct Redis broker is supported")
-    environments = [
-        config["services"][service]["environment"] for service in ("api", "worker")
-    ]
-    for environment in environments + list(runtime_environments):
-        if environment.get("CELERY_BROKER_URL") != expected:
-            raise UnsafeConfiguration(
-                "API/worker broker mismatch; refusing an unreliable backlog check"
-            )
-        if environment.get("REDIS_KEY_PREFIX"):
-            raise UnsafeConfiguration(
-                "Redis key prefixes require a separate namespace-aware review"
-            )
-        for setting in ("CELERY_USE_SENTINEL", "BROKER_USE_SSL"):
-            if str(environment.get(setting, "false")).lower() not in (
-                "",
-                "false",
-                "none",
-                "0",
-            ):
-                raise UnsafeConfiguration(
-                    "Redis Sentinel or custom TLS requires separate review"
-                )
-
-
-def check_runtime_broker(config):
-    workers = safe_command(
-        [
-            "docker",
-            "ps",
-            "-q",
-            "--filter",
-            "label=com.docker.compose.project=langgenius",
-            "--filter",
-            "label=com.docker.compose.service=worker",
-        ]
-    ).split()
-    if (
-        len(workers) != 2
-        or config["services"]["worker"].get("deploy", {}).get("replicas") != 2
-    ):
-        raise UnsafeConfiguration("Expected the reviewed two-worker SaaS dev topology")
-    containers = json.loads(
-        safe_command(["docker", "inspect", "langgenius-api-1", *workers])
-    )
-    environments = []
-    for container in containers:
-        labels = container["Config"].get("Labels", {})
-        service = labels.get("com.docker.compose.service")
-        if (
-            not container["State"]["Running"]
-            or service not in ("api", "worker")
-            or labels.get("com.docker.compose.project") != "langgenius"
-            or labels.get("com.docker.compose.project.config_files") != str(TARGET)
-        ):
-            raise UnsafeConfiguration(
-                "Running containers do not match the reviewed Compose deployment"
-            )
-        environment = dict(item.split("=", 1) for item in container["Config"]["Env"])
-        environments.append(environment)
-        if service == "worker":
-            if environment.get("CELERY_WORKER_QUEUES"):
-                raise UnsafeConfiguration(
-                    "Runtime CELERY_WORKER_QUEUES overrides the reviewed queue setting"
-                )
-            argv = safe_command(
-                ["docker", "exec", container["Id"], "cat", "/proc/1/cmdline"]
-            ).split("\0")
-            if (
-                argv.count("-Q") != 1
-                or argv.index("-Q") + 1 >= len(argv)
-                or argv[argv.index("-Q") + 1] != environment.get("CELERY_QUEUES")
-            ):
-                raise UnsafeConfiguration(
-                    "Runtime worker argv and queue environment differ"
-                )
-            queues = environment["CELERY_QUEUES"].split(",")
-            if set(queues) - set(BASE_QUEUES + WORKFLOW_QUEUES) or not set(
-                BASE_QUEUES
-            ).issubset(queues):
-                raise UnsafeConfiguration(
-                    "Runtime queues differ from the reviewed baseline"
-                )
-    validate_broker_environments(config, environments)
-
-
-def broker_check(config):
-    check_runtime_broker(config)
-    counts = json.loads(
-        safe_command(
-            [
-                "docker",
-                "exec",
-                "-i",
-                "langgenius-api-1",
-                "/app/api/.venv/bin/python",
-                "-",
-            ],
-            input_text=BROKER_CHECK,
-        )
-    )
-    expected = set(WORKFLOW_QUEUES) | {"unacked", "unacked_index"}
-    if set(counts) != expected or any(
-        type(value) is not int or value != 0 for value in counts.values()
-    ):
-        raise UnsafeConfiguration(
-            "Workflow backlog or unacked tasks exist; do not start new consumers"
-        )
-    return counts
-
-
-def regular_file(path):
-    metadata = path.lstat()
-    if not stat.S_ISREG(metadata.st_mode) or metadata.st_nlink != 1:
-        raise UnsafeConfiguration(
-            "Target must be a regular non-symlink, non-hardlinked file"
-        )
-    return metadata
-
-
-def private_copy(path, content, metadata, prefix):
-    fd, name = tempfile.mkstemp(prefix=prefix, dir=path.parent)
-    copy_path = Path(name)
-    try:
-        with os.fdopen(fd, "wb") as handle:
-            os.fchown(handle.fileno(), metadata.st_uid, metadata.st_gid)
-            os.fchmod(handle.fileno(), stat.S_IMODE(metadata.st_mode))
-            handle.write(content)
-            handle.flush()
-            os.fsync(handle.fileno())
-        return copy_path
-    except BaseException:
-        copy_path.unlink(missing_ok=True)
-        raise
-
-
-def apply_patch(path, before, after, expected_sha256, validate, preflight):
-    """No service operations. Keep an exact backup and fail closed on drift."""
-    import fcntl
-
-    if sha256(before) != expected_sha256:
-        raise UnsafeConfiguration("Expected SHA256 does not match the reviewed dry-run")
-    metadata = regular_file(path)
-    with path.open("rb") as original:
-        fcntl.flock(original.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-        if path.read_bytes() != before:
-            raise UnsafeConfiguration("Compose changed since the dry-run")
-        candidate = private_copy(path, after, metadata, ".snp836-candidate-")
-        try:
-            validate(candidate)
-            preflight()
-            if before == after:
-                return None
-            backup = private_copy(
-                path, before, metadata, "docker-compose.yaml.snp836-backup-"
-            )
-            if backup.read_bytes() != before:
-                raise UnsafeConfiguration("Backup verification failed")
-            if path.read_bytes() != before or path.stat().st_ino != metadata.st_ino:
-                raise UnsafeConfiguration(
-                    "Compose changed before replacement; backup retained"
-                )
-            os.replace(candidate, path)
-            if path.read_bytes() != after:
-                raise UnsafeConfiguration(
-                    f"Post-write verification failed; restore backup {backup}"
-                )
-            return backup
-        finally:
-            candidate.unlink(missing_ok=True)
-
-
-def main(argv=None):
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--target", required=True, choices=["saas-dev"])
-    parser.add_argument(
-        "--apply",
-        action="store_true",
-        help="Write only the reviewed queue change; never restart",
-    )
-    parser.add_argument(
-        "--expected-sha256", help="Required with --apply; copy from a fresh dry-run"
-    )
-    args = parser.parse_args(argv)
-    if args.apply and not args.expected_sha256:
-        parser.error("--apply requires --expected-sha256")
-    try:
-        metadata = regular_file(TARGET)
-        before = TARGET.read_bytes()
-        after, old_queues, new_queues = plan_patch(before)
-        resolved_before = resolved_config(TARGET)
-
-        def validate(candidate):
-            validate_resolved(
-                resolved_before, resolved_config(candidate), old_queues, new_queues
-            )
-
-        if args.apply:
-            backup = apply_patch(
-                TARGET,
-                before,
-                after,
-                args.expected_sha256,
-                validate,
-                lambda: broker_check(resolved_before),
-            )
-        else:
-            # Compose reads secrets, so keep even a temporary candidate private.
-            candidate = private_copy(TARGET, after, metadata, ".snp836-candidate-")
-            try:
-                validate(candidate)
-                broker_check(resolved_before)
-            finally:
-                candidate.unlink(missing_ok=True)
-            backup = None
-        print(
-            json.dumps(
-                {
-                    "target": "saas-dev",
-                    "path": str(TARGET),
-                    "mode": "apply" if args.apply else "dry-run",
-                    "changed": before != after,
-                    "before_sha256": sha256(before),
-                    "after_sha256": sha256(after),
-                    "queues_before": old_queues,
-                    "queues_after": new_queues,
-                    "backup": str(backup) if backup else None,
-                    "services_restarted": False,
-                },
-                indent=2,
-            )
-        )
-    except (
-        UnsafeConfiguration,
-        OSError,
-        KeyError,
-        ValueError,
-        subprocess.SubprocessError,
-    ) as exc:
-        # Do not leak subprocess output, YAML snippets, broker URLs, or environment.
-        message = (
-            str(exc) if isinstance(exc, UnsafeConfiguration) else type(exc).__name__
-        )
-        parser.exit(1, f"Refused: {message}\n")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/api/tests/unit_tests/commands/test_fix_workflow_queues.py b/api/tests/unit_tests/commands/test_fix_workflow_queues.py
deleted file mode 100644
index 26c12c154260f4..00000000000000
--- a/api/tests/unit_tests/commands/test_fix_workflow_queues.py
+++ /dev/null
@@ -1,396 +0,0 @@
-"""Unit tests for the opt-in SaaS-dev workflow queue repair script."""
-
-import copy
-import importlib.util
-import stat
-import tempfile
-import unittest
-from collections.abc import Callable
-from pathlib import Path
-from typing import NotRequired, TypedDict, override
-from unittest.mock import patch
-
-import pytest
-
-REPO_ROOT = Path(__file__).resolve().parents[4]
-SCRIPT_PATH = REPO_ROOT / ".github" / "scripts" / "saas-dev" / "fix_workflow_queues.py"
-SPEC = importlib.util.spec_from_file_location("fix_workflow_queues", SCRIPT_PATH)
-assert SPEC is not None
-assert SPEC.loader is not None
-repair = importlib.util.module_from_spec(SPEC)
-SPEC.loader.exec_module(repair)
-
-BASE = ",".join(repair.BASE_QUEUES)
-FULL = ",".join(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
-
-
-def compose(value: str = BASE, before_worker: str = "", after_worker: str = "", newline: str = "\n") -> bytes:
-    return (
-        (
-            "# Keep this comment and unrelated settings\n"
-            "x-common: &common\n  LOG_LEVEL: INFO\n"
-            "services:\n" + before_worker + "  worker:\n    image: langgenius/dify-api:deploy-saas\n"
-            "    environment:\n      <<: *common\n      DEPLOYMENT_EDITION: CLOUD\n"
-            f"      CELERY_QUEUES: {value}  # deliberately explicit\n"
-            "      OTHER_CONFIG: unchanged\n" + after_worker + "volumes:\n  storage:\n"
-        )
-        .replace("\n", newline)
-        .encode()
-    )
-
-
-OTHER_WORKERS = (
-    "  priority_worker:\n    environment:\n      CELERY_QUEUES: priority_dataset,priority_pipeline\n"
-    "  worker-plugin_autoupgrade:\n    environment:\n      CELERY_QUEUES: plugin\n"
-    "  worker_beat:\n    environment:\n      MODE: beat\n"
-)
-
-
-class ApplyOverrides(TypedDict, total=False):
-    validate: Callable[[Path], object]
-    preflight: Callable[[], object]
-
-
-class ServiceConfig(TypedDict):
-    environment: dict[str, str]
-    deploy: NotRequired[dict[str, int]]
-
-
-class ComposeConfig(TypedDict):
-    services: dict[str, ServiceConfig]
-
-
-class ContainerConfig(TypedDict):
-    Env: list[str]
-    Labels: dict[str, str]
-
-
-class Container(TypedDict):
-    Id: str
-    State: dict[str, bool]
-    Config: ContainerConfig
-
-
-class PatchPlanTests(unittest.TestCase):
-    def test_preserves_every_other_byte_for_worker_at_different_positions(self) -> None:
-        for before_worker, after_worker in ((OTHER_WORKERS, ""), ("", OTHER_WORKERS)):
-            for quote in ("", "'", '"'):
-                for newline in ("\n", "\r\n"):
-                    with self.subTest(before=bool(before_worker), quote=quote, newline=newline):
-                        before = compose(quote + BASE + quote, before_worker, after_worker, newline)
-                        after, old, new = repair.plan_patch(before)
-                        assert after == before.replace(BASE.encode(), FULL.encode(), 1)
-                        assert old == list(repair.BASE_QUEUES)
-                        assert new == list(repair.BASE_QUEUES + repair.WORKFLOW_QUEUES)
-
-    def test_only_appends_missing_names_and_keeps_existing_order(self) -> None:
-        current = ",".join(reversed(repair.BASE_QUEUES)) + ",workflow_team"
-        after, old, new = repair.plan_patch(compose(current))
-        assert new == old + ["workflow_professional", "workflow_sandbox"]
-        assert ",".join(new).encode() in after
-
-    def test_idempotent_when_all_queues_already_exist(self) -> None:
-        before = compose(FULL)
-        after, old, new = repair.plan_patch(before)
-        assert after == before
-        assert old == new
-
-    def test_rejects_duplicate_unknown_missing_or_interpolated_queues(self) -> None:
-        for value in (
-            BASE + ",dataset",
-            BASE + ",schedule_poller",
-            BASE.replace("dataset,", ""),
-            "${CELERY_QUEUES}",
-            BASE + ", workflow_team",
-            '"' + BASE + '\\n"',
-        ):
-            with (
-                self.subTest(value=value),
-                pytest.raises(repair.UnsafeConfiguration),
-            ):
-                repair.plan_patch(compose(value))
-
-    def test_missing_and_ambiguous_target_fields_fail_closed(self) -> None:
-        original = compose()
-        for content in (
-            original.replace(b"  worker:", b"  another_worker:"),
-            original.replace(b"CELERY_QUEUES:", b"OTHER_QUEUES:"),
-            original.replace(b"    environment:", b"    environment: {}\n    environment:"),
-            original.replace(b"  worker:", b"  worker: {}\n  worker:"),
-            original.replace(b"services:", b"services: {}\nservices:"),
-            original.replace(
-                b"      CELERY_QUEUES:",
-                b"      CELERY_QUEUES: other\n      CELERY_QUEUES:",
-            ),
-        ):
-            with (
-                self.subTest(content=content),
-                pytest.raises(repair.UnsafeConfiguration),
-            ):
-                repair.plan_patch(content)
-
-    def test_rejects_non_scalar_list_block_and_alias_values(self) -> None:
-        values = ("[dataset,mail]", "true", "|\n        " + BASE, ">\n        " + BASE)
-        for value in values:
-            with (
-                self.subTest(value=value),
-                pytest.raises(repair.UnsafeConfiguration),
-            ):
-                repair.plan_patch(compose(value))
-        outside_alias = b"x-queues: &queues " + BASE.encode() + b"\n" + compose("*queues")
-        with pytest.raises(repair.UnsafeConfiguration):
-            repair.plan_patch(outside_alias)
-        worker_alias = (
-            b"x-worker: &worker\n  environment:\n    CELERY_QUEUES: "
-            + BASE.encode()
-            + b"\nservices:\n  worker: *worker\n"
-        )
-        with pytest.raises(repair.UnsafeConfiguration):
-            repair.plan_patch(worker_alias)
-
-
-class ResolvedValidationTests(unittest.TestCase):
-    @override
-    def setUp(self) -> None:
-        self.before = {
-            "services": {
-                "worker": {
-                    "environment": {
-                        "DEPLOYMENT_EDITION": "CLOUD",
-                        "CELERY_QUEUES": BASE,
-                    }
-                },
-                "priority_worker": {"environment": {"CELERY_QUEUES": "priority_dataset,priority_pipeline"}},
-            }
-        }
-        self.after = copy.deepcopy(self.before)
-        self.after["services"]["worker"]["environment"]["CELERY_QUEUES"] = FULL
-
-    def test_accepts_exact_single_field_change(self) -> None:
-        repair.validate_resolved(
-            self.before,
-            self.after,
-            repair.BASE_QUEUES,
-            repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
-        )
-
-    def test_rejects_overrides_non_cloud_or_unrelated_changes(self) -> None:
-        for field, value in (
-            ("CELERY_WORKER_QUEUES", "override"),
-            ("DEPLOYMENT_EDITION", "COMMUNITY"),
-            ("CELERY_QUEUES", "other"),
-        ):
-            before = copy.deepcopy(self.before)
-            before["services"]["worker"]["environment"][field] = value
-            with (
-                self.subTest(field=field),
-                pytest.raises(repair.UnsafeConfiguration),
-            ):
-                repair.validate_resolved(
-                    before,
-                    self.after,
-                    repair.BASE_QUEUES,
-                    repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
-                )
-        self.after["services"]["priority_worker"]["environment"]["CELERY_QUEUES"] += ",workflow_professional"
-        with pytest.raises(repair.UnsafeConfiguration):
-            repair.validate_resolved(
-                self.before,
-                self.after,
-                repair.BASE_QUEUES,
-                repair.BASE_QUEUES + repair.WORKFLOW_QUEUES,
-            )
-
-
-class ApplyTests(unittest.TestCase):
-    @override
-    def setUp(self) -> None:
-        self.temp = tempfile.TemporaryDirectory()
-        self.addCleanup(self.temp.cleanup)
-        self.path = Path(self.temp.name) / "docker-compose.yaml"
-        self.before = compose()
-        self.after = repair.plan_patch(self.before)[0]
-        self.path.write_bytes(self.before)
-        self.path.chmod(0o640)
-
-    def apply(
-        self,
-        validate: Callable[[Path], object] = lambda _candidate: None,
-        preflight: Callable[[], object] = lambda: None,
-        expected: str | None = None,
-    ) -> Path | None:
-        return repair.apply_patch(
-            self.path,
-            self.before,
-            self.after,
-            expected or repair.sha256(self.before),
-            validate,
-            preflight,
-        )
-
-    def test_backup_content_permissions_and_exact_change(self) -> None:
-        backup = self.apply()
-        assert backup is not None
-        assert backup.read_bytes() == self.before
-        assert self.path.read_bytes() == self.after
-        assert stat.S_IMODE(backup.stat().st_mode) == 0o640
-        assert stat.S_IMODE(self.path.stat().st_mode) == 0o640
-        assert list(self.path.parent.glob(".snp836-candidate-*")) == []
-
-    def test_noop_does_not_write_or_create_backup(self) -> None:
-        original_inode = self.path.stat().st_ino
-        backup = repair.apply_patch(
-            self.path,
-            self.before,
-            self.before,
-            repair.sha256(self.before),
-            lambda _candidate: None,
-            lambda: None,
-        )
-        assert backup is None
-        assert self.path.stat().st_ino == original_inode
-        assert list(self.path.parent.glob("*backup*")) == []
-
-    def test_hash_and_before_content_guards(self) -> None:
-        with pytest.raises(repair.UnsafeConfiguration):
-            self.apply(expected="0" * 64)
-        self.path.write_bytes(self.before + b"# concurrent update\n")
-        with pytest.raises(repair.UnsafeConfiguration):
-            self.apply()
-        assert list(self.path.parent.glob("*backup*")) == []
-
-    def test_validation_or_backlog_failure_does_not_write(self) -> None:
-        def refuse(*_args: object) -> None:
-            raise repair.UnsafeConfiguration("unsafe")
-
-        overrides: tuple[ApplyOverrides, ...] = ({"validate": refuse}, {"preflight": refuse})
-        for arguments in overrides:
-            with (
-                self.subTest(arguments=arguments),
-                pytest.raises(repair.UnsafeConfiguration),
-            ):
-                self.apply(**arguments)
-            assert self.path.read_bytes() == self.before
-            assert list(self.path.parent.glob("*backup*")) == []
-            assert list(self.path.parent.glob(".snp836-candidate-*")) == []
-
-    def test_concurrent_edit_after_validation_is_not_overwritten(self) -> None:
-        concurrent = self.before + b"# operator edit\n"
-        with pytest.raises(repair.UnsafeConfiguration):
-            self.apply(validate=lambda _candidate: self.path.write_bytes(concurrent))
-        assert self.path.read_bytes() == concurrent
-
-    def test_symlink_is_rejected(self) -> None:
-        alias = self.path.parent / "alias"
-        alias.symlink_to(self.path)
-        with pytest.raises(repair.UnsafeConfiguration):
-            repair.regular_file(alias)
-
-
-class BrokerPreflightTests(unittest.TestCase):
-    @override
-    def setUp(self) -> None:
-        self.env = {"CELERY_BROKER_URL": "redis://fake-fixture:6379/1"}
-        self.config: ComposeConfig = {
-            "services": {
-                "api": {"environment": self.env.copy()},
-                "worker": {"environment": self.env.copy()},
-            }
-        }
-
-    def test_matching_plain_broker_is_accepted(self) -> None:
-        repair.validate_broker_environments(self.config, [self.env.copy(), self.env.copy(), self.env.copy()])
-
-    def test_namespace_or_broker_mismatch_fails_at_every_layer(self) -> None:
-        for layer in ("api", "worker", "runtime"):
-            for setting, value in (
-                ("REDIS_KEY_PREFIX", "isolated"),
-                ("CELERY_BROKER_URL", "redis://different-fixture:6379/2"),
-                ("CELERY_USE_SENTINEL", "true"),
-                ("BROKER_USE_SSL", "true"),
-            ):
-                with self.subTest(layer=layer, setting=setting):
-                    config = copy.deepcopy(self.config)
-                    runtime = [self.env.copy()]
-                    target = runtime[0] if layer == "runtime" else config["services"][layer]["environment"]
-                    target[setting] = value
-                    with pytest.raises(repair.UnsafeConfiguration):
-                        repair.validate_broker_environments(config, runtime)
-
-    def test_any_workflow_backlog_unacked_or_invalid_reply_blocks_apply(self) -> None:
-        empty = dict.fromkeys(repair.WORKFLOW_QUEUES, 0)
-        empty.update(unacked=0, unacked_index=0)
-        with (
-            patch.object(repair, "check_runtime_broker"),
-            patch.object(repair, "safe_command") as command,
-        ):
-            command.return_value = repair.json.dumps(empty)
-            assert repair.broker_check(self.config) == empty
-            for key in empty:
-                command.return_value = repair.json.dumps({**empty, key: 1})
-                with (
-                    self.subTest(key=key),
-                    pytest.raises(repair.UnsafeConfiguration),
-                ):
-                    repair.broker_check(self.config)
-            invalid_replies: tuple[dict[str, int | bool], ...] = (
-                {},
-                {**empty, "unknown": 0},
-                {**empty, "unacked": False},
-            )
-            for invalid in invalid_replies:
-                command.return_value = repair.json.dumps(invalid)
-                with pytest.raises(repair.UnsafeConfiguration):
-                    repair.broker_check(self.config)
-
-    def test_runtime_requires_exact_topology_labels_and_real_worker_queues(self) -> None:
-        self.config["services"]["worker"]["deploy"] = {"replicas": 2}
-        containers: list[Container] = []
-        for index, service in enumerate(("api", "worker", "worker")):
-            containers.append(
-                {
-                    "Id": f"fixture-{index}",
-                    "State": {"Running": True},
-                    "Config": {
-                        "Env": [
-                            "CELERY_BROKER_URL=" + self.env["CELERY_BROKER_URL"],
-                            "CELERY_QUEUES=" + BASE,
-                        ],
-                        "Labels": {
-                            "com.docker.compose.service": service,
-                            "com.docker.compose.project": "langgenius",
-                            "com.docker.compose.project.config_files": str(repair.TARGET),
-                        },
-                    },
-                }
-            )
-        responses = [
-            "fixture-1\nfixture-2\n",
-            repair.json.dumps(containers),
-            "celery\0worker\0-Q\0" + BASE + "\0",
-            "celery\0worker\0-Q\0" + BASE + "\0",
-        ]
-        with patch.object(repair, "safe_command", side_effect=responses):
-            repair.check_runtime_broker(self.config)
-        with patch.object(repair, "safe_command", return_value="one-worker-only\n"):
-            with pytest.raises(repair.UnsafeConfiguration):
-                repair.check_runtime_broker(self.config)
-        with patch.object(
-            repair,
-            "safe_command",
-            side_effect=responses[:2] + ["celery\0-Q\0wrong_queue\0"],
-        ):
-            with pytest.raises(repair.UnsafeConfiguration):
-                repair.check_runtime_broker(self.config)
-        containers[0]["Config"]["Labels"]["com.docker.compose.project.config_files"] = "/different/compose.yaml"
-        with patch.object(
-            repair,
-            "safe_command",
-            side_effect=[responses[0], repair.json.dumps(containers)],
-        ):
-            with pytest.raises(repair.UnsafeConfiguration):
-                repair.check_runtime_broker(self.config)
-
-
-if __name__ == "__main__":
-    unittest.main()

From 4e1b63cda1ac3a52e55fec22c2fa32468c641aae Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 23 Sep 2026 10:42:33 +0800
Subject: [PATCH 068/108] fix(api): skip unrelated bodies in app access error
 hook

---
 api/controllers/common/app_access_error.py    | 23 +++++-
 .../common/test_app_access_error.py           | 80 +++++++++++++++++++
 2 files changed, 100 insertions(+), 3 deletions(-)

diff --git a/api/controllers/common/app_access_error.py b/api/controllers/common/app_access_error.py
index 1c2b1b736288c1..b3be8919e0c86c 100644
--- a/api/controllers/common/app_access_error.py
+++ b/api/controllers/common/app_access_error.py
@@ -53,16 +53,34 @@ def register_app_access_error_metadata(blueprint: Blueprint, *, surface: Literal
 
     @blueprint.after_request
     def add_app_access_error_metadata(response: Response) -> Response:
+        # Most responses cannot be changed by this hook. Avoid decoding successful
+        # payloads (including large application data) or unrelated error bodies.
+        status = response.status_code
+        if status != 404 and (surface != "web" or status not in (400, 403)):
+            return response
         if response.is_streamed or response.direct_passthrough or not response.is_json or request.url_rule is None:
             return response
 
+        rule = request.url_rule.rule
+        is_app_identity = request.method == "GET" and rule in identity_rules
+        is_hitl = rule.startswith((prefix + "/form/human_input/", prefix + "/human-input-forms/"))
+        if is_hitl:
+            if surface != "web" or not (
+                (status == 404 and rule.startswith(prefix + "/form/human_input/"))
+                or (status == 403 and rule == prefix + "/human-input-forms/files")
+            ):
+                return response
+        elif status != 404 and not (surface == "web" and status == 400 and is_app_identity):
+            return response
+
+        # Non-HITL 404s still need inspection outside the identity allowlist:
+        # typed app_not_found errors can originate from invocation/resource routes.
         payload = response.get_json(silent=True)
         if not isinstance(payload, dict):
             return response
-        rule = request.url_rule.rule
         # Preserve HITL's dedicated expiry/token UI and do not expose an App IP
         # or policy-specific marker through these capability endpoints.
-        if rule.startswith((prefix + "/form/human_input/", prefix + "/human-input-forms/")):
+        if is_hitl:
             if (
                 surface == "web"
                 and rule.startswith(prefix + "/form/human_input/")
@@ -81,7 +99,6 @@ def add_app_access_error_metadata(response: Response) -> Response:
                     {"code": "invalid_upload_token", "message": "Upload token is invalid or expired.", "status": 403},
                 )
             return response
-        is_app_identity = request.method == "GET" and request.url_rule.rule in identity_rules
         if (
             surface == "web"
             and is_app_identity
diff --git a/api/tests/unit_tests/controllers/common/test_app_access_error.py b/api/tests/unit_tests/controllers/common/test_app_access_error.py
index 4d6c145b5efeab..f661eb0a00e96a 100644
--- a/api/tests/unit_tests/controllers/common/test_app_access_error.py
+++ b/api/tests/unit_tests/controllers/common/test_app_access_error.py
@@ -1,6 +1,7 @@
 import json
 from collections.abc import Callable, Iterator
 from typing import Literal
+from unittest.mock import MagicMock
 from uuid import UUID
 
 import pytest
@@ -325,6 +326,85 @@ def test_success_and_non_404_errors_are_unchanged(prefix: str, status: int) -> N
     assert "Cache-Control" not in response.headers
 
 
+@pytest.mark.parametrize("path", ["/api/site", f"/console/api/apps/{APP_ID}"])
+@pytest.mark.parametrize("status", [200, 201, 204, 301, 302, 303, 304, 307, 308, 401, 500, 503])
+def test_non_candidate_statuses_do_not_parse_json(monkeypatch: pytest.MonkeyPatch, path: str, status: int) -> None:
+    body = b'{"code":"app_not_found","message":"unchanged","data":[1,2,3]}'
+    original = Response(body, status=status, mimetype="application/json")
+    parse = MagicMock(side_effect=AssertionError("Non-candidate response must not be parsed"))
+    monkeypatch.setattr(original, "get_json", parse)
+    app = _create_app(lambda: original)
+
+    with app.test_request_context(path):
+        response = app.full_dispatch_request()
+
+    assert response is original
+    assert response.status_code == status
+    assert response.data == body
+    assert "Cache-Control" not in response.headers
+    parse.assert_not_called()
+
+
+@pytest.mark.parametrize(
+    ("path", "method", "status"),
+    [
+        (f"/console/api/apps/{APP_ID}", "GET", 400),
+        (f"/console/api/apps/{APP_ID}", "GET", 403),
+        ("/console/api/human-input-forms/files", "POST", 403),
+        ("/console/api/form/human_input/token", "GET", 404),
+        ("/api/chat-messages", "GET", 400),
+        ("/api/site", "POST", 400),
+        ("/api/form/human_input/token", "GET", 400),
+        ("/api/site", "GET", 403),
+        ("/api/chat-messages", "POST", 403),
+        ("/api/form/human_input/token", "GET", 403),
+        ("/api/human-input-forms/files", "POST", 404),
+    ],
+)
+def test_route_and_surface_ineligible_errors_do_not_parse_json(
+    monkeypatch: pytest.MonkeyPatch, path: str, method: str, status: int
+) -> None:
+    body = b'{"code":"app_not_found","message":"unchanged"}'
+    original = Response(body, status=status, mimetype="application/json")
+    parse = MagicMock(side_effect=AssertionError("Ineligible error must not be parsed"))
+    monkeypatch.setattr(original, "get_json", parse)
+    app = _create_app(lambda: original)
+
+    with app.test_request_context(path, method=method):
+        response = app.full_dispatch_request()
+
+    assert response is original
+    assert response.status_code == status
+    assert response.data == body
+    assert "Cache-Control" not in response.headers
+    parse.assert_not_called()
+
+
+@pytest.mark.parametrize("status", [200, 400, 403, 404])
+@pytest.mark.parametrize("direct_passthrough", [False, True])
+def test_candidate_and_success_streams_never_parse_or_consume_response(
+    monkeypatch: pytest.MonkeyPatch, status: int, direct_passthrough: bool
+) -> None:
+    consumed: list[bool] = []
+
+    def stream() -> Iterator[str]:
+        consumed.append(True)
+        yield '{"code":"app_not_found"}'
+
+    original = Response(stream(), status, mimetype="application/json", direct_passthrough=direct_passthrough)
+    parse = MagicMock(side_effect=AssertionError("Stream must not be parsed"))
+    monkeypatch.setattr(original, "get_json", parse)
+    app = _create_app(lambda: original)
+    with app.test_request_context("/api/site"):
+        response = app.full_dispatch_request()
+
+    assert response is original
+    assert response.status_code == status
+    assert "Cache-Control" not in response.headers
+    assert not consumed
+    parse.assert_not_called()
+
+
 def test_trial_forbidden_is_not_reclassified_as_missing_app() -> None:
     payload = {"code": "forbidden", "message": "App unavailable", "status": 403}
     response = _create_app(lambda: (payload, 403)).test_client().get(f"/console/api/trial-apps/{APP_ID}")

From af693a72225f20a0af20920f373aabbc8b854351 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 23 Sep 2026 10:49:19 +0800
Subject: [PATCH 069/108] fix(api): isolate MCP body parsing from database
 sessions

---
 api/controllers/API_SCHEMA_GUIDE.md           |   9 +
 api/controllers/common/access_response.py     |  29 +++-
 api/controllers/mcp/mcp.py                    |  84 ++++++----
 .../common/test_access_response.py            | 155 ++++++++++++++++--
 .../unit_tests/controllers/mcp/test_mcp.py    |  46 ++++++
 5 files changed, 273 insertions(+), 50 deletions(-)

diff --git a/api/controllers/API_SCHEMA_GUIDE.md b/api/controllers/API_SCHEMA_GUIDE.md
index f0c6eea6050b8b..f55e6b12d9c36a 100644
--- a/api/controllers/API_SCHEMA_GUIDE.md
+++ b/api/controllers/API_SCHEMA_GUIDE.md
@@ -255,6 +255,15 @@ invalid or oversized IDs become null. Numeric lexemes retain precision. Allowed
 requests retain their existing body and protocol-validation path. Do not create
 EndUsers or execute tools just to construct a not-found response.
 
+MCP identity preflight uses a short read session that ends before body reads or
+parsing. Normal execution rechecks the same server/App/tenant identity in its
+own transaction and uses fresh ORM objects; deletion, disabling or rebinding
+during parsing must not execute against the stale identity. Construct opaque
+404 responses outside both sessions. The error ID reader reuses existing raw
+Werkzeug body-cache bytes without changing that cache, and otherwise reads at
+most the limit plus one sentinel byte; it must not use unbounded `get_data()`
+for unknown-length bodies. This error-only limit does not cap valid MCP bodies.
+
 Real dependency failures stay fail-closed errors, not a missing-policy allow.
 The Gateway can present an unresolved canonical WebApp reference as opaque404
 while still terminating the request; it must never forward it because the
diff --git a/api/controllers/common/access_response.py b/api/controllers/common/access_response.py
index 844de7a2e4549a..c87b72e1c7d123 100644
--- a/api/controllers/common/access_response.py
+++ b/api/controllers/common/access_response.py
@@ -84,12 +84,9 @@ def _invalid_constant(_value: str) -> None:
     raise ValueError("Non-JSON numeric constant")
 
 
-def _mcp_request_id() -> str:
-    """Read at most the bounded denied request, returning serialized ID or null."""
+def _parse_mcp_error_request_id(body: bytes) -> str:
+    """Parse only an error response's ID, retaining its original numeric lexeme."""
     try:
-        if request.content_length is not None and request.content_length > MCP_ERROR_BODY_LIMIT:
-            return "null"
-        body = request.stream.read(MCP_ERROR_BODY_LIMIT + 1)
         if len(body) > MCP_ERROR_BODY_LIMIT or not _within_json_depth(body):
             return "null"
         payload = json.loads(
@@ -107,11 +104,31 @@ def _mcp_request_id() -> str:
             # Reject unpaired surrogates instead of creating invalid UTF-8.
             request_id.encode("utf-8")
             return _json(request_id)
-    except (HTTPException, ValueError, UnicodeError, RecursionError):
+    except (ValueError, UnicodeError, RecursionError):
         pass
     return "null"
 
 
+def _mcp_request_id() -> str:
+    """Read bounded raw bytes, including bodies already cached by request logging.
+
+    Werkzeug's public get_data() reuses _cached_data but otherwise reads the
+    entire stream. Its stream property does not replay that cache. Keep this
+    read-only private-attribute compatibility here: it avoids unbounded reads
+    for unknown Content-Length and never installs a partial request cache.
+    """
+    try:
+        if request.content_length is not None and request.content_length > MCP_ERROR_BODY_LIMIT:
+            return "null"
+        cached = getattr(request, "_cached_data", None)
+        if cached is not None:
+            return _parse_mcp_error_request_id(cached) if isinstance(cached, bytes) else "null"
+        body = request.stream.read(MCP_ERROR_BODY_LIMIT + 1)
+    except HTTPException:
+        return "null"
+    return _parse_mcp_error_request_id(body)
+
+
 def mcp_server_not_found_response() -> Response:
     """Opaque MCP lookup failure; no app/server identity or policy is disclosed."""
     body = '{"error":{"code":-32600,"message":"Server Not Found"},"id":' + _mcp_request_id() + ',"jsonrpc":"2.0"}'
diff --git a/api/controllers/mcp/mcp.py b/api/controllers/mcp/mcp.py
index b17db3682ac00c..d74b2b3cb1d525 100644
--- a/api/controllers/mcp/mcp.py
+++ b/api/controllers/mcp/mcp.py
@@ -75,36 +75,50 @@ def post(self, server_code: str):
             ValidationError: Invalid request format or parameters
         """
         # response-contract:ignore MCP route returns Flask Response from JSON-RPC handler
-        with sessionmaker(db.engine, expire_on_commit=False).begin() as session:
+        sessions = sessionmaker(db.engine, expire_on_commit=False)
+        try:
             # Resolve identity before parsing the body: missing identities have
-            # one bounded response even for malformed or oversized JSON.
-            try:
+            # one bounded response even for malformed or oversized JSON. Only
+            # scalar IDs cross this short read session, never its ORM objects.
+            with sessions.begin() as session:
                 mcp_server, app = self._get_mcp_server_and_app(server_code, session)
                 self._validate_server_status(mcp_server)
-            except MCPServerNotFoundError:
-                return mcp_server_not_found_response()
-
-            args = MCPRequestPayload.model_validate(mcp_ns.payload or {})
-            request_id: Union[int, str] | None = args.id
-            mcp_request = self._parse_mcp_request(args.model_dump(exclude_none=True))
-
-            # Allowed identities retain the existing protocol validation path.
-            is_initialize = isinstance(mcp_request.root, mcp_types.InitializeRequest)
-            header_value = request.headers.get("MCP-Protocol-Version")
-            protocol_version = negotiate_protocol_version(header_value, is_initialize)
-            if protocol_version is None:
-                if isinstance(mcp_request, mcp_types.ClientNotification):
-                    protocol_version = mcp_types.DEFAULT_NEGOTIATED_VERSION
-                else:
-                    return self._protocol_version_error_response(request_id, header_value)
-
-            # Get user input form
-            user_input_form = self._get_user_input_form(app)
-
-            # Handle notification vs request differently
-            return self._process_mcp_message(
-                mcp_request, request_id, app, mcp_server, user_input_form, session, protocol_version
-            )
+                identity = (mcp_server.id, app.id, app.tenant_id)
+        except MCPServerNotFoundError:
+            # Error formatting may read the request body; release DB resources first.
+            return mcp_server_not_found_response()
+
+        # Allowed requests retain the existing full body/protocol parser. The
+        # 64 KiB cap belongs only to opaque errors, not normal MCP invocations.
+        args = MCPRequestPayload.model_validate(mcp_ns.payload or {})
+        request_id: Union[int, str] | None = args.id
+        mcp_request = self._parse_mcp_request(args.model_dump(exclude_none=True))
+
+        is_initialize = isinstance(mcp_request.root, mcp_types.InitializeRequest)
+        header_value = request.headers.get("MCP-Protocol-Version")
+        protocol_version = negotiate_protocol_version(header_value, is_initialize)
+        if protocol_version is None:
+            if isinstance(mcp_request, mcp_types.ClientNotification):
+                protocol_version = mcp_types.DEFAULT_NEGOTIATED_VERSION
+            else:
+                return self._protocol_version_error_response(request_id, header_value)
+
+        try:
+            # Reading/parsing may have taken time. Revalidate in the original
+            # execution transaction and use fresh, attached ORM records. A code
+            # reassigned to a different server/App/tenant is not this request's identity.
+            with sessions.begin() as session:
+                mcp_server, app = self._get_mcp_server_and_app(server_code, session)
+                self._validate_server_status(mcp_server)
+                if (mcp_server.id, app.id, app.tenant_id) != identity:
+                    raise MCPServerNotFoundError()
+                user_input_form = self._get_user_input_form(app, session=session)
+
+                return self._process_mcp_message(
+                    mcp_request, request_id, app, mcp_server, user_input_form, session, protocol_version
+                )
+        except MCPServerNotFoundError:
+            return mcp_server_not_found_response()
 
     def _protocol_version_error_response(
         self, request_id: Union[int, str] | None, header_value: str | None
@@ -131,7 +145,9 @@ def _get_mcp_server_and_app(self, server_code: str, session: Session) -> tuple[A
         if not mcp_server:
             raise MCPServerNotFoundError()
 
-        app = session.scalar(select(App).where(App.id == mcp_server.app_id).limit(1))
+        app = session.scalar(
+            select(App).where(App.id == mcp_server.app_id, App.tenant_id == mcp_server.tenant_id).limit(1)
+        )
         if not app:
             raise MCPServerNotFoundError()
 
@@ -191,17 +207,19 @@ def _handle_request(
 
         return helper.compact_generate_response(result.model_dump(by_alias=True, mode="json", exclude_none=True))
 
-    def _get_user_input_form(self, app: App) -> list[VariableEntity]:
+    def _get_user_input_form(self, app: App, *, session: Session) -> list[VariableEntity]:
         """Get and convert user input form"""
         # Get raw user input form based on app mode
         if app.mode in {AppMode.ADVANCED_CHAT, AppMode.WORKFLOW}:
-            if not app.workflow:
+            workflow = app.workflow_with_session(session=session)
+            if workflow is None:
                 raise MCPRequestError(mcp_types.INVALID_REQUEST, "App is unavailable")
-            raw_user_input_form = app.workflow.user_input_form(to_old_structure=True)
+            raw_user_input_form = workflow.user_input_form(to_old_structure=True)
         else:
-            if not app.app_model_config:
+            app_model_config = app.app_model_config_with_session(session=session)
+            if app_model_config is None:
                 raise MCPRequestError(mcp_types.INVALID_REQUEST, "App is unavailable")
-            features_dict = app.app_model_config.to_dict()
+            features_dict = app_model_config.to_dict()
             raw_user_input_form = features_dict.get("user_input_form", [])
 
         # Convert to VariableEntity objects
diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
index 0df7bf8f7ce2ca..646d8ebbc58e08 100644
--- a/api/tests/unit_tests/controllers/common/test_access_response.py
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -2,6 +2,9 @@
 
 import io
 import json
+import logging
+from collections.abc import Iterator
+from contextlib import contextmanager
 from types import SimpleNamespace
 from typing import Literal, Never, override
 from unittest.mock import MagicMock
@@ -23,6 +26,7 @@
 )
 from controllers.mcp import mcp
 from controllers.trigger import webhook
+from extensions import ext_request_logging
 from libs.external_api import ExternalApi
 from models.engine import db
 from models.enums import AppMCPServerStatus
@@ -164,6 +168,7 @@ def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
     return http_app.test_client(), session, execute, end_user
 
 
+@pytest.mark.parametrize("cached", [False, True])
 @pytest.mark.parametrize("identity", ["missing-server", "missing-app", "inactive"])
 @pytest.mark.parametrize(
     ("body", "expected_id"),
@@ -195,17 +200,25 @@ def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
         (b'{"id":1,"params":' + b"[" * 63 + b"0" + b"]" * 63 + b"}", b"1"),
         (b'{"id":1,"params":' + b"[" * 64 + b"0" + b"]" * 64 + b"}", b"null"),
         (b'{"id":1,"params":"' + b"[" * 100 + b'\\"}"}', b"1"),
+        (b'{"id":1}' + b" " * (MCP_ERROR_BODY_LIMIT - len(b'{"id":1}')), b"1"),
         (b'{"id":1}' + b" " * MCP_ERROR_BODY_LIMIT, b"null"),
     ],
 )
 def test_mcp_missing_identity_final_response_is_bounded_and_opaque(
     mcp_client: MCPClient,
     identity: Literal["missing-server", "missing-app", "inactive"],
+    cached: bool,
     body: bytes,
     expected_id: bytes,
 ) -> None:
     client, session, execute, end_user = mcp_client
-    server = SimpleNamespace(app_id="private-app", status=AppMCPServerStatus.ACTIVE)
+    server = SimpleNamespace(app_id="private-app", tenant_id="tenant", status=AppMCPServerStatus.ACTIVE)
+    if cached:
+
+        @client.application.before_request
+        def cache_body() -> None:
+            request.get_data()
+
     if identity == "missing-server":
         session.scalar.side_effect = [None]
     elif identity == "missing-app":
@@ -227,7 +240,9 @@ def test_mcp_missing_identity_final_response_is_bounded_and_opaque(
     session.execute.assert_not_called()
 
 
-def test_mcp_unknown_length_stream_read_is_capped(http_app: Flask) -> None:
+@pytest.mark.parametrize("cached", [False, True])
+@pytest.mark.parametrize("oversized", [False, True])
+def test_mcp_unknown_length_stream_read_is_capped(http_app: Flask, cached: bool, oversized: bool) -> None:
     class RecordingStream(io.BytesIO):
         requested: list[int | None] = []
 
@@ -236,23 +251,42 @@ def read(self, size: int | None = -1) -> bytes:
             self.requested.append(size)
             return super().read(size)
 
-    stream = RecordingStream(b'{"id":1}' + b" " * MCP_ERROR_BODY_LIMIT)
+    stream = RecordingStream(b'{"id":1}' + (b" " * MCP_ERROR_BODY_LIMIT if oversized else b""))
     with http_app.test_request_context(
         "/", method="POST", environ_overrides={"wsgi.input": stream, "wsgi.input_terminated": True}
     ):
+        if cached:
+            request.get_data()
+            stream.requested.clear()
         response = mcp_server_not_found_response()
-    assert stream.requested == [MCP_ERROR_BODY_LIMIT + 1]
-    assert response.get_json()["id"] is None
+    assert stream.requested == ([] if cached else [MCP_ERROR_BODY_LIMIT + 1])
+    assert response.get_json()["id"] == (None if oversized else 1)
+
+
+def test_mcp_debug_request_logging_preserves_raw_error_id(
+    mcp_client: MCPClient, caplog: pytest.LogCaptureFixture, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    client, session, execute, end_user = mcp_client
+    session.scalar.return_value = None
+    caplog.set_level(logging.DEBUG, logger=ext_request_logging.__name__)
+    # Exercise the real existing request-started logger, including request.data caching.
+    monkeypatch.setattr(ext_request_logging.dify_config, "ENABLE_REQUEST_LOGGING", True)
+    ext_request_logging.init_app(client.application)
+    response = client.post("/mcp/server/missing-fixture/mcp", data=b'{"id":1.2500}', content_type="application/json")
+    assert response.status_code == 404
+    assert b'"id":1.2500,' in response.data
+    assert "Received Request" in caplog.text
+    execute.assert_not_called()
+    end_user.assert_not_called()
 
 
 def test_existing_mcp_keeps_normal_large_payload_and_response(
     mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch
 ) -> None:
     client, session, _execute, _end_user = mcp_client
-    session.scalar.side_effect = [
-        SimpleNamespace(app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
-        SimpleNamespace(id="existing-app"),
-    ]
+    server = SimpleNamespace(id="server", tenant_id="tenant", app_id="existing-app", status=AppMCPServerStatus.ACTIVE)
+    app = SimpleNamespace(id="existing-app", tenant_id="tenant")
+    session.scalar.side_effect = [server, app, server, app]
     monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", MagicMock(return_value=[]))
     expected_body = b'{"id":2,"jsonrpc":"2.0","result":{}}'
     process = MagicMock(return_value=Response(expected_body, status=200, content_type="application/json"))
@@ -277,8 +311,8 @@ def test_existing_mcp_keeps_normal_large_payload_and_response(
 def test_existing_mcp_still_validates_malformed_payload(mcp_client: MCPClient) -> None:
     client, session, execute, end_user = mcp_client
     session.scalar.side_effect = [
-        SimpleNamespace(app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
-        SimpleNamespace(id="existing-app"),
+        SimpleNamespace(id="server", tenant_id="tenant", app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
+        SimpleNamespace(id="existing-app", tenant_id="tenant"),
     ]
     response = client.post("/mcp/server/existing-fixture/mcp", data=b"{", content_type="application/json")
     assert response.status_code == 400
@@ -286,6 +320,105 @@ def test_existing_mcp_still_validates_malformed_payload(mcp_client: MCPClient) -
     end_user.assert_not_called()
 
 
+@pytest.mark.parametrize(
+    "change",
+    [
+        "initial-missing",
+        "missing-server",
+        "missing-app",
+        "inactive",
+        "server-replaced",
+        "app-rebound",
+        "tenant-changed",
+        "unchanged",
+    ],
+)
+def test_mcp_reads_body_outside_sessions_and_rechecks_identity_before_execution(
+    mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch, change: str
+) -> None:
+    client, _session, execute, end_user = mcp_client
+    active_sessions: list[MagicMock] = []
+    opened: list[MagicMock] = []
+    read_sessions: list[bool] = []
+    initial_server = SimpleNamespace(id="server", tenant_id="tenant", app_id="app", status=AppMCPServerStatus.ACTIVE)
+    initial_app = SimpleNamespace(id="app", tenant_id="tenant")
+    fresh_server = SimpleNamespace(**vars(initial_server))
+    fresh_app = SimpleNamespace(**vars(initial_app))
+    if change == "inactive":
+        fresh_server.status = "inactive"
+    elif change == "server-replaced":
+        fresh_server.id = "other-server"
+    elif change == "app-rebound":
+        fresh_server.app_id = fresh_app.id = "other-app"
+    elif change == "tenant-changed":
+        fresh_server.tenant_id = fresh_app.tenant_id = "other-tenant"
+    initial = MagicMock()
+    initial.scalar.side_effect = [None] if change == "initial-missing" else [initial_server, initial_app]
+    execution = MagicMock()
+    execution.scalar.side_effect = (
+        [None] if change == "missing-server" else [fresh_server, None if change == "missing-app" else fresh_app]
+    )
+    remaining = iter((initial, execution))
+
+    @contextmanager
+    def begin() -> Iterator[MagicMock]:
+        session = next(remaining)
+        opened.append(session)
+        active_sessions.append(session)
+        try:
+            yield session
+        finally:
+            active_sessions.pop()
+
+    monkeypatch.setattr(mcp, "sessionmaker", lambda *_args, **_kwargs: SimpleNamespace(begin=begin))
+    form = MagicMock(return_value=[])
+    process = MagicMock(return_value=Response("ok", status=200))
+    monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", form)
+    monkeypatch.setattr(mcp.MCPAppApi, "_process_mcp_message", process)
+    original_error = mcp.mcp_server_not_found_response
+
+    def error_response() -> Response:
+        assert not active_sessions, "404 response must be constructed after releasing sessions"
+        return original_error()
+
+    monkeypatch.setattr(mcp, "mcp_server_not_found_response", error_response)
+
+    class RecordingStream(io.BytesIO):
+        @override
+        def read(self, size: int | None = -1) -> bytes:
+            read_sessions.append(bool(active_sessions))
+            return super().read(size)
+
+        @override
+        def readinto(self, buffer) -> int:
+            data = self.read(len(buffer))
+            buffer[: len(data)] = data
+            return len(data)
+
+    payload = b'{"jsonrpc":"2.0","method":"ping","id":900719925474099312345678901234567890}'
+    response = client.post(
+        "/mcp/server/fixture/mcp", input_stream=RecordingStream(payload), content_type="application/json"
+    )
+    assert read_sessions
+    assert not any(read_sessions)
+    assert opened == ([initial] if change == "initial-missing" else [initial, execution])
+    if change == "unchanged":
+        assert response.status_code == 200
+        form.assert_called_once_with(fresh_app, session=execution)
+        assert process.call_args.args[2] is fresh_app
+        assert process.call_args.args[3] is fresh_server
+        assert process.call_args.args[5] is execution
+    else:
+        assert response.status_code == 404
+        assert b'"id":900719925474099312345678901234567890,' in response.data
+        form.assert_not_called()
+        process.assert_not_called()
+    execute.assert_not_called()
+    end_user.assert_not_called()
+    initial.add.assert_not_called()
+    execution.add.assert_not_called()
+
+
 @pytest.mark.parametrize("route", ["webhook", "webhook-debug"])
 def test_webhook_missing_identity_uses_native_html_without_disclosing_id(
     http_app: Flask, monkeypatch: pytest.MonkeyPatch, route: Literal["webhook", "webhook-debug"]
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp.py b/api/tests/unit_tests/controllers/mcp/test_mcp.py
index 6485f36f7f1b06..f79568f0a97af9 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp.py
@@ -12,6 +12,7 @@
 import pytest
 from flask import Flask, Response
 from pydantic import ValidationError
+from sqlalchemy import inspect
 
 import controllers.mcp.mcp as module
 from models.engine import db
@@ -550,6 +551,51 @@ def _tools_call_payload() -> dict[str, object]:
     }
 
 
+def test_execution_reloads_attached_orm_objects_after_identity_preflight(app: Flask, monkeypatch: pytest.MonkeyPatch):
+    app_model = _app(module.AppMode.CHAT, with_model_config=True)
+    server = _server(module.AppMCPServerStatus.ACTIVE)
+    db.session.add_all([app_model, server])
+    db.session.commit()
+    api = module.MCPAppApi()
+    lookup = api._get_mcp_server_and_app
+    snapshots = []
+
+    def observe_lookup(code, session):
+        pair = lookup(code, session)
+        snapshots.append(pair)
+        return pair
+
+    def process(_mcp_request, _request_id, fresh_app, fresh_server, _form, session, _protocol):
+        old_server, old_app = snapshots[0]
+        assert inspect(old_server).detached
+        assert inspect(old_app).detached
+        assert fresh_server is not old_server
+        assert fresh_app is not old_app
+        assert inspect(fresh_server).session is session
+        assert inspect(fresh_app).session is session
+        return Response("ok")
+
+    monkeypatch.setattr(api, "_get_mcp_server_and_app", observe_lookup)
+    monkeypatch.setattr(api, "_process_mcp_message", process)
+    fake_payload({"jsonrpc": "2.0", "method": "ping", "id": 1})
+    with app.test_request_context("/"):
+        response = api.post("server-1")
+    assert response.status_code == 200
+    assert len(snapshots) == 2
+
+
+@pytest.mark.usefixtures("app")
+def test_identity_query_does_not_accept_a_server_bound_to_another_tenants_app():
+    app_model = _app(module.AppMode.CHAT)
+    server = _server(module.AppMCPServerStatus.ACTIVE)
+    server.tenant_id = str(uuid4())
+    db.session.add_all([app_model, server])
+    db.session.commit()
+    with module.sessionmaker(db.engine).begin() as session:
+        with pytest.raises(module.MCPServerNotFoundError):
+            module.MCPAppApi()._get_mcp_server_and_app("server-1", session)
+
+
 class TestMCPProtocolVersionNegotiationApi:
     """MCP protocol version negotiation exercised through the HTTP controller layer.
 

From d07e2d23b5989c54fdb22a4f0e22b9b69f9c3e72 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 23 Sep 2026 10:58:03 +0800
Subject: [PATCH 070/108] refactor(api): type network access control plane
 boundaries

---
 .../console/workspace/network_access_group.py |  68 ++--
 .../entities/network_access_group_entities.py |  80 +++++
 api/services/network_access_group_gateway.py  | 339 ++++++++++++++----
 api/services/network_access_group_service.py  | 295 ++++++---------
 .../workspace/test_network_access_group.py    | 206 +++++++----
 .../test_ext_application_services.py          |  55 ++-
 .../test_network_access_group_gateway.py      | 225 ++++++++++--
 .../test_network_access_group_service.py      | 245 ++++++-------
 .../test_remove_app_and_related_data_task.py  |   2 +-
 9 files changed, 998 insertions(+), 517 deletions(-)
 create mode 100644 api/services/entities/network_access_group_entities.py

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 1d8626904b19ab..4b13240f576ba1 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -25,6 +25,7 @@
     NetworkAccessGroupEntitlementUnavailableError,
     NetworkAccessGroupError,
     NetworkAccessGroupInvalidPolicyError,
+    NetworkAccessGroupInvalidResponseError,
     NetworkAccessGroupUnsupportedAccessPointsError,
     NetworkAccessGroupUnsupportedAppModeError,
     NetworkAccessGroupUpstreamError,
@@ -80,27 +81,21 @@ class NetworkAccessGroupAppResponse(ResponseModel):
 
 class NetworkAccessGroupResponse(ResponseModel):
     id: str
-    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    tenant_id: str
     name: str
     description: str = ""
     allowed_cidrs: list[str] = Field(
         min_length=1,
         max_length=100,
-        validation_alias=AliasChoices("allowed_cidrs", "allowedCidrs"),
     )
     version: int = Field(ge=1)
-    used_by_count: int = Field(ge=0, validation_alias=AliasChoices("used_by_count", "usedByCount"))
-    enforcing_count: int = Field(ge=0, validation_alias=AliasChoices("enforcing_count", "enforcingCount"))
-    app_ids: list[str] = Field(
-        validation_alias=AliasChoices("app_ids", "appIds", "used_by_app_ids", "usedByAppIds"),
-    )
+    used_by_count: int = Field(ge=0)
+    enforcing_count: int = Field(ge=0)
+    app_ids: list[str]
     apps: list[NetworkAccessGroupAppResponse]
-    updated_by_account_id: str | None = Field(
-        default=None,
-        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
-    )
-    created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
-    updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
+    updated_by_account_id: str | None = None
+    created_at: datetime
+    updated_at: datetime
 
     @model_validator(mode="after")
     def validate_enforcing_count(self) -> Self:
@@ -110,7 +105,7 @@ def validate_enforcing_count(self) -> Self:
 
 
 class NetworkAccessGroupListResponse(ResponseModel):
-    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
+    tenant_id: str
     entitled: bool
     groups: list[NetworkAccessGroupResponse]
 
@@ -135,24 +130,17 @@ class NetworkAccessGroupCurrentIPCheckResponse(ResponseModel):
 
 class AppNetworkAccessGroupBindingResponse(ResponseModel):
     id: str
-    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
-    app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
+    tenant_id: str
+    app_id: str
     enabled: bool
-    group_id: str | None = Field(
-        default=None,
-        validation_alias=AliasChoices("group_id", "groupId", "policy_id", "policyId"),
-    )
+    group_id: str | None = None
     access_points: list[NetworkAccessPoint] = Field(
         max_length=4,
-        validation_alias=AliasChoices("access_points", "accessPoints"),
     )
     version: int = Field(ge=1)
-    updated_by_account_id: str | None = Field(
-        default=None,
-        validation_alias=AliasChoices("updated_by_account_id", "updatedByAccountId"),
-    )
-    created_at: datetime = Field(validation_alias=AliasChoices("created_at", "createdAt"))
-    updated_at: datetime = Field(validation_alias=AliasChoices("updated_at", "updatedAt"))
+    updated_by_account_id: str | None = None
+    created_at: datetime
+    updated_at: datetime
 
     @model_validator(mode="after")
     def validate_enabled_configuration(self) -> Self:
@@ -160,23 +148,23 @@ def validate_enabled_configuration(self) -> Self:
             raise ValueError("access_points must not contain duplicates")
         if self.enabled and self.group_id is None:
             raise ValueError("group_id is required when network access control is enabled")
-        if self.enabled and not self.access_points:
-            raise ValueError("access_points must not be empty when network access control is enabled")
+        # A saved enabled binding can have no scopes supported by the App's
+        # current mode. Preserve its switch/reference; effective_enabled is false.
         return self
 
 
 class AppNetworkAccessGroupResponse(ResponseModel):
-    tenant_id: str = Field(validation_alias=AliasChoices("tenant_id", "tenantId"))
-    app_id: str = Field(validation_alias=AliasChoices("app_id", "appId"))
+    tenant_id: str
+    app_id: str
     entitled: bool
-    effective_enabled: bool = Field(validation_alias=AliasChoices("effective_enabled", "effectiveEnabled"))
+    effective_enabled: bool
     available_access_points: list[NetworkAccessPoint]
     binding: AppNetworkAccessGroupBindingResponse | None
 
 
 class AppNetworkAccessGroupMutationResponse(ResponseModel):
     binding: AppNetworkAccessGroupBindingResponse
-    effective_enabled: bool = Field(validation_alias=AliasChoices("effective_enabled", "effectiveEnabled"))
+    effective_enabled: bool
     available_access_points: list[NetworkAccessPoint]
 
 
@@ -225,6 +213,8 @@ def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception
 
 
 def _translate_service_error(exc: NetworkAccessGroupError) -> Exception:
+    if isinstance(exc, NetworkAccessGroupInvalidResponseError):
+        return BadGateway("Invalid response from the network access group service.")
     if isinstance(exc, NetworkAccessGroupUpstreamError):
         return _translate_upstream_error(exc)
     if isinstance(exc, NetworkAccessGroupAccessDeniedError):
@@ -242,7 +232,7 @@ def _translate_service_error(exc: NetworkAccessGroupError) -> Exception:
     raise TypeError(f"Unsupported network access group error: {type(exc).__name__}")
 
 
-def _serialize_response(response_model: type[ResponseModel], payload: dict[str, Any]) -> dict[str, Any]:
+def _serialize_response(response_model: type[ResponseModel], payload: object) -> dict[str, Any]:
     try:
         return dump_response(response_model, payload)
     except ValidationError as exc:
@@ -296,7 +286,7 @@ def post(
             )
         except NetworkAccessGroupError as exc:
             raise _translate_service_error(exc) from exc
-        return _serialize_response(NetworkAccessGroupMutationResponse, payload), 201
+        return _serialize_response(NetworkAccessGroupMutationResponse, {"group": payload}), 201
 
 
 @console_ns.route("/workspaces/current/network-access-groups/<uuid:group_id>")
@@ -315,7 +305,7 @@ def get(self, request_context: RequestContext, group_id: UUID) -> dict[str, Any]
             )
         except NetworkAccessGroupError as exc:
             raise _translate_service_error(exc) from exc
-        return _serialize_response(NetworkAccessGroupMutationResponse, payload)
+        return _serialize_response(NetworkAccessGroupMutationResponse, {"group": payload})
 
     @console_ns.expect(console_ns.models[NetworkAccessGroupUpdatePayload.__name__])
     @console_ns.response(
@@ -343,7 +333,7 @@ def put(
             )
         except NetworkAccessGroupError as exc:
             raise _translate_service_error(exc) from exc
-        return _serialize_response(NetworkAccessGroupMutationResponse, payload)
+        return _serialize_response(NetworkAccessGroupMutationResponse, {"group": payload})
 
     @console_ns.doc(params=query_params_from_model(NetworkAccessGroupDeleteQuery))
     @console_ns.response(
@@ -368,7 +358,7 @@ def delete(
             )
         except NetworkAccessGroupError as exc:
             raise _translate_service_error(exc) from exc
-        return _serialize_response(NetworkAccessGroupDeleteResponse, payload)
+        return _serialize_response(NetworkAccessGroupDeleteResponse, {"deleted": payload})
 
 
 @console_ns.route("/workspaces/current/network-access-groups/current-ip")
@@ -396,7 +386,7 @@ def disable_client_ip_response_cache(response: Response) -> Response:
             raise ServiceUnavailable("Current client IP is unavailable.") from exc
         except NetworkAccessGroupError as exc:
             raise _translate_service_error(exc) from exc
-        return _serialize_response(NetworkAccessGroupCurrentIPResponse, payload)
+        return _serialize_response(NetworkAccessGroupCurrentIPResponse, {"client_ip": payload})
 
 
 @console_ns.route("/workspaces/current/network-access-groups/<uuid:group_id>/check-current-ip")
diff --git a/api/services/entities/network_access_group_entities.py b/api/services/entities/network_access_group_entities.py
new file mode 100644
index 00000000000000..fe7814f3843524
--- /dev/null
+++ b/api/services/entities/network_access_group_entities.py
@@ -0,0 +1,80 @@
+"""Immutable application values, independent of SaaS wire names and HTTP DTOs."""
+
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Literal, NamedTuple
+
+NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
+
+
+class NetworkAccessGroupAppRecord(NamedTuple):
+    id: str
+    mode: str
+    name: str
+    icon: str | None
+    icon_type: str | None
+    icon_background: str | None
+    bound_agent_id: str | None = None
+
+
+@dataclass(frozen=True)
+class NetworkAccessGroup:
+    id: str
+    tenant_id: str
+    name: str
+    description: str
+    allowed_cidrs: tuple[str, ...]
+    version: int
+    used_by_count: int
+    enforcing_count: int
+    app_ids: tuple[str, ...]
+    updated_by_account_id: str | None
+    created_at: datetime
+    updated_at: datetime
+    apps: tuple[NetworkAccessGroupAppRecord, ...] = ()
+
+
+@dataclass(frozen=True)
+class NetworkAccessBinding:
+    id: str
+    tenant_id: str
+    app_id: str
+    enabled: bool
+    group_id: str | None
+    # Preserve legacy/future scope names at the port; the service owns capabilities.
+    access_points: tuple[str, ...]
+    version: int
+    updated_by_account_id: str | None
+    created_at: datetime
+    updated_at: datetime
+
+
+@dataclass(frozen=True)
+class NetworkAccessGroupList:
+    tenant_id: str
+    entitled: bool
+    groups: tuple[NetworkAccessGroup, ...]
+
+
+@dataclass(frozen=True)
+class NetworkAccessAppConfig:
+    tenant_id: str
+    app_id: str
+    entitled: bool
+    effective_enabled: bool
+    binding: NetworkAccessBinding | None
+    available_access_points: tuple[NetworkAccessPoint, ...] = ()
+
+
+@dataclass(frozen=True)
+class NetworkAccessBindingUpdate:
+    binding: NetworkAccessBinding
+    effective_enabled: bool
+    available_access_points: tuple[NetworkAccessPoint, ...] = ()
+
+
+@dataclass(frozen=True)
+class NetworkAccessCurrentIPCheck:
+    client_ip: str
+    allowed: bool
+    policy_version: int
diff --git a/api/services/network_access_group_gateway.py b/api/services/network_access_group_gateway.py
index af45b25e3fbb36..3d634012fabb74 100644
--- a/api/services/network_access_group_gateway.py
+++ b/api/services/network_access_group_gateway.py
@@ -1,22 +1,192 @@
 """HTTP and Billing adapters used by the network access group service."""
 
 import json
-from typing import Any, Literal, override
+import re
+from collections.abc import Mapping
+from datetime import datetime
+from typing import Annotated, Any, ClassVar, Literal, override
 
 import httpx
-from pydantic import ValidationError
+from pydantic import (
+    BaseModel,
+    BeforeValidator,
+    ConfigDict,
+    Field,
+    StrictBool,
+    StrictStr,
+    ValidationError,
+    model_validator,
+)
 from tenacity import retry, retry_if_exception_type, stop_before_delay, wait_fixed
 
 from core.helper.http_client_pooling import get_pooled_http_client
 from enums import CloudPlan
 from services.billing_service import BillingService, _BillingHTTPStatusError
+from services.entities.network_access_group_entities import (
+    NetworkAccessAppConfig,
+    NetworkAccessBinding,
+    NetworkAccessBindingUpdate,
+    NetworkAccessGroup,
+    NetworkAccessGroupList,
+)
 from services.network_access_group_service import (
     NetworkAccessGroupControlPlane,
     NetworkAccessGroupEntitlement,
     NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupInvalidResponseError,
     NetworkAccessGroupUpstreamError,
 )
 
+
+def _int64(value: object) -> int:
+    if type(value) is int:
+        return value
+    if isinstance(value, str) and re.fullmatch(r"[+-]?[0-9]+", value):
+        return int(value)
+    raise ValueError("Expected a ProtoJSON integer or decimal string")
+
+
+_Count = Annotated[int, BeforeValidator(_int64), Field(ge=0, le=2**63 - 1)]
+_Version = Annotated[int, BeforeValidator(_int64), Field(ge=1, le=2**63 - 1)]
+_Identifier = Annotated[StrictStr, Field(min_length=1)]
+
+
+class _WireModel(BaseModel):
+    model_config = ConfigDict(frozen=True, extra="ignore")
+    aliases: ClassVar[Mapping[str, tuple[str, ...]]] = {}
+
+    @model_validator(mode="before")
+    @classmethod
+    def canonical_names(cls, value: object) -> object:
+        if not isinstance(value, dict):
+            return value
+        data = dict(value)
+        for name, aliases in cls.aliases.items():
+            supplied = [data[key] for key in (name, *aliases) if key in data]
+            if not supplied:
+                continue
+            if any(type(item) is not type(supplied[0]) or item != supplied[0] for item in supplied[1:]):
+                raise ValueError(f"Conflicting aliases for {name}")
+            data[name] = supplied[0]
+            for alias in aliases:
+                data.pop(alias, None)
+        return data
+
+
+class _GroupWire(_WireModel):
+    aliases = {
+        "tenant_id": ("tenantId",),
+        "allowed_cidrs": ("allowedCidrs",),
+        "used_by_count": ("usedByCount",),
+        "enforcing_count": ("enforcingCount",),
+        "app_ids": ("appIds", "used_by_app_ids", "usedByAppIds"),
+        "updated_by_account_id": ("updatedByAccountId",),
+        "created_at": ("createdAt",),
+        "updated_at": ("updatedAt",),
+    }
+    id: _Identifier
+    tenant_id: _Identifier
+    name: StrictStr
+    description: StrictStr = ""
+    allowed_cidrs: Annotated[tuple[StrictStr, ...], Field(min_length=1, max_length=100)]
+    version: _Version
+    used_by_count: _Count | None = None
+    enforcing_count: _Count = 0
+    app_ids: tuple[_Identifier, ...] = ()
+    updated_by_account_id: StrictStr | None = None
+    created_at: datetime
+    updated_at: datetime
+
+    def record(self) -> NetworkAccessGroup:
+        return NetworkAccessGroup(
+            id=self.id,
+            tenant_id=self.tenant_id,
+            name=self.name,
+            description=self.description,
+            allowed_cidrs=self.allowed_cidrs,
+            version=self.version,
+            used_by_count=len(self.app_ids) if self.used_by_count is None else self.used_by_count,
+            enforcing_count=self.enforcing_count,
+            app_ids=self.app_ids,
+            updated_by_account_id=self.updated_by_account_id,
+            created_at=self.created_at,
+            updated_at=self.updated_at,
+        )
+
+
+class _BindingWire(_WireModel):
+    aliases = {
+        "tenant_id": ("tenantId",),
+        "app_id": ("appId",),
+        "group_id": ("groupId", "policy_id", "policyId"),
+        "access_points": ("accessPoints",),
+        "updated_by_account_id": ("updatedByAccountId",),
+        "created_at": ("createdAt",),
+        "updated_at": ("updatedAt",),
+    }
+    id: _Identifier
+    tenant_id: _Identifier
+    app_id: _Identifier
+    enabled: StrictBool = False
+    group_id: StrictStr | None = None
+    access_points: tuple[StrictStr, ...] = ()
+    version: _Version
+    updated_by_account_id: StrictStr | None = None
+    created_at: datetime
+    updated_at: datetime
+
+    def record(self) -> NetworkAccessBinding:
+        return NetworkAccessBinding(
+            id=self.id,
+            tenant_id=self.tenant_id,
+            app_id=self.app_id,
+            enabled=self.enabled,
+            group_id=self.group_id or None,
+            access_points=self.access_points,
+            version=self.version,
+            updated_by_account_id=self.updated_by_account_id,
+            created_at=self.created_at,
+            updated_at=self.updated_at,
+        )
+
+
+class _GroupResultWire(_WireModel):
+    group: _GroupWire
+
+
+class _ListWire(_WireModel):
+    aliases = {"tenant_id": ("tenantId",)}
+    tenant_id: _Identifier
+    entitled: StrictBool = False
+    groups: tuple[_GroupWire, ...] = ()
+
+
+class _AppConfigWire(_WireModel):
+    aliases = {"tenant_id": ("tenantId",), "app_id": ("appId",), "effective_enabled": ("effectiveEnabled",)}
+    tenant_id: _Identifier
+    app_id: _Identifier
+    entitled: StrictBool = False
+    effective_enabled: StrictBool = False
+    binding: _BindingWire | None = None
+
+
+class _BindingUpdateWire(_WireModel):
+    aliases = {"effective_enabled": ("effectiveEnabled",)}
+    binding: _BindingWire
+    effective_enabled: StrictBool = False
+
+
+class _DeletedWire(_WireModel):
+    deleted: StrictBool = False
+
+
+def _decode[T: _WireModel](model: type[T], value: dict[str, Any]) -> T:
+    try:
+        return model.model_validate(value)
+    except ValidationError as exc:
+        raise NetworkAccessGroupInvalidResponseError from exc
+
+
 _http_client: httpx.Client = get_pooled_http_client(
     "network-access-group:default",
     lambda: httpx.Client(
@@ -40,12 +210,16 @@ def __init__(
         self._http_client = http_client
 
     @override
-    def list_groups(self, workspace_id: str, actor_account_id: str) -> dict[str, Any]:
-        return self._send_request(
-            "GET",
-            f"/tenants/{workspace_id}/network-access-groups",
-            params={"actor_account_id": actor_account_id},
+    def list_groups(self, workspace_id: str, actor_account_id: str) -> NetworkAccessGroupList:
+        wire = _decode(
+            _ListWire,
+            self._send_request(
+                "GET",
+                f"/tenants/{workspace_id}/network-access-groups",
+                params={"actor_account_id": actor_account_id},
+            ),
         )
+        return NetworkAccessGroupList(wire.tenant_id, wire.entitled, tuple(group.record() for group in wire.groups))
 
     @override
     def create_group(
@@ -56,25 +230,31 @@ def create_group(
         description: str,
         allowed_cidrs: list[str],
         actor_account_id: str,
-    ) -> dict[str, Any]:
-        return self._send_request(
-            "POST",
-            f"/tenants/{workspace_id}/network-access-groups",
-            payload_json={
-                "name": name,
-                "description": description,
-                "allowed_cidrs": allowed_cidrs,
-                "actor_account_id": actor_account_id,
-            },
-        )
+    ) -> NetworkAccessGroup:
+        return _decode(
+            _GroupResultWire,
+            self._send_request(
+                "POST",
+                f"/tenants/{workspace_id}/network-access-groups",
+                payload_json={
+                    "name": name,
+                    "description": description,
+                    "allowed_cidrs": allowed_cidrs,
+                    "actor_account_id": actor_account_id,
+                },
+            ),
+        ).group.record()
 
     @override
-    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> dict[str, Any]:
-        return self._send_request(
-            "GET",
-            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
-            params={"actor_account_id": actor_account_id},
-        )
+    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> NetworkAccessGroup:
+        return _decode(
+            _GroupResultWire,
+            self._send_request(
+                "GET",
+                f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+                params={"actor_account_id": actor_account_id},
+            ),
+        ).group.record()
 
     @override
     def update_group(
@@ -87,18 +267,21 @@ def update_group(
         allowed_cidrs: list[str],
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]:
-        return self._send_request(
-            "PUT",
-            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
-            payload_json={
-                "name": name,
-                "description": description,
-                "allowed_cidrs": allowed_cidrs,
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
-        )
+    ) -> NetworkAccessGroup:
+        return _decode(
+            _GroupResultWire,
+            self._send_request(
+                "PUT",
+                f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+                payload_json={
+                    "name": name,
+                    "description": description,
+                    "allowed_cidrs": allowed_cidrs,
+                    "expected_version": expected_version,
+                    "actor_account_id": actor_account_id,
+                },
+            ),
+        ).group.record()
 
     @override
     def delete_group(
@@ -108,22 +291,35 @@ def delete_group(
         *,
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]:
-        return self._send_request(
-            "DELETE",
-            f"/tenants/{workspace_id}/network-access-groups/{group_id}",
-            params={
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
-        )
+    ) -> bool:
+        return _decode(
+            _DeletedWire,
+            self._send_request(
+                "DELETE",
+                f"/tenants/{workspace_id}/network-access-groups/{group_id}",
+                params={
+                    "expected_version": expected_version,
+                    "actor_account_id": actor_account_id,
+                },
+            ),
+        ).deleted
 
     @override
-    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> dict[str, Any]:
-        return self._send_request(
-            "GET",
-            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
-            params={"actor_account_id": actor_account_id},
+    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppConfig:
+        wire = _decode(
+            _AppConfigWire,
+            self._send_request(
+                "GET",
+                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
+                params={"actor_account_id": actor_account_id},
+            ),
+        )
+        return NetworkAccessAppConfig(
+            wire.tenant_id,
+            wire.app_id,
+            wire.entitled,
+            wire.effective_enabled,
+            wire.binding.record() if wire.binding is not None else None,
         )
 
     @override
@@ -137,25 +333,32 @@ def update_app_binding(
         access_points: list[str],
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]:
-        return self._send_request(
-            "PUT",
-            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
-            payload_json={
-                "enabled": enabled,
-                "group_id": group_id,
-                "access_points": access_points,
-                "expected_version": expected_version,
-                "actor_account_id": actor_account_id,
-            },
+    ) -> NetworkAccessBindingUpdate:
+        wire = _decode(
+            _BindingUpdateWire,
+            self._send_request(
+                "PUT",
+                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group",
+                payload_json={
+                    "enabled": enabled,
+                    "group_id": group_id,
+                    "access_points": access_points,
+                    "expected_version": expected_version,
+                    "actor_account_id": actor_account_id,
+                },
+            ),
         )
+        return NetworkAccessBindingUpdate(wire.binding.record(), wire.effective_enabled)
 
     @override
-    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> dict[str, Any]:
-        return self._send_request(
-            "DELETE",
-            f"/tenants/{workspace_id}/apps/{app_id}/network-access-group-binding",
-        )
+    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> bool:
+        return _decode(
+            _DeletedWire,
+            self._send_request(
+                "DELETE",
+                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group-binding",
+            ),
+        ).deleted
 
     def _send_request(
         self,
@@ -188,10 +391,10 @@ def _send_request(
         try:
             payload = response.json()
         except (json.JSONDecodeError, TypeError, ValueError) as exc:
-            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY) from exc
+            raise NetworkAccessGroupInvalidResponseError from exc
 
         if not isinstance(payload, dict):
-            raise NetworkAccessGroupUpstreamError(httpx.codes.BAD_GATEWAY)
+            raise NetworkAccessGroupInvalidResponseError
         return payload
 
     @retry(
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 9005604fb68348..9d6847120d9c8c 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -3,14 +3,23 @@
 import ipaddress
 import logging
 from collections.abc import Callable, Sequence
-from typing import Any, Literal, NamedTuple, Protocol
+from dataclasses import replace
+from typing import Protocol
 
 from machinery.context import RequestContext
+from services.entities.network_access_group_entities import (
+    NetworkAccessAppConfig,
+    NetworkAccessBinding,
+    NetworkAccessBindingUpdate,
+    NetworkAccessCurrentIPCheck,
+    NetworkAccessGroup,
+    NetworkAccessGroupAppRecord,
+    NetworkAccessGroupList,
+    NetworkAccessPoint,
+)
 
 logger = logging.getLogger(__name__)
 
-NetworkAccessPoint = Literal["webapp", "service_api", "mcp", "trigger"]
-
 _POLICY_READ_ROLES = frozenset({"owner", "admin", "editor"})
 _POLICY_WRITE_ROLES = frozenset({"owner", "admin"})
 _APP_BINDING_ROLES = _POLICY_READ_ROLES
@@ -66,18 +75,12 @@ class NetworkAccessGroupInvalidPolicyError(NetworkAccessGroupError):
     """The control plane returned a policy that cannot be evaluated safely."""
 
 
-class NetworkAccessGroupAppQueryError(Exception):
-    """The local App read model could not be queried."""
+class NetworkAccessGroupInvalidResponseError(NetworkAccessGroupError):
+    """The control plane returned a malformed wire response, not an unavailable service."""
 
 
-class NetworkAccessGroupAppRecord(NamedTuple):
-    id: str
-    mode: str
-    name: str
-    icon: str | None
-    icon_type: str | None
-    icon_background: str | None
-    bound_agent_id: str | None = None
+class NetworkAccessGroupAppQueryError(Exception):
+    """The local App read model could not be queried."""
 
 
 class NetworkAccessGroupAppQuery(Protocol):
@@ -100,7 +103,7 @@ def is_paid_plan(self, workspace_id: str) -> bool: ...
 
 
 class NetworkAccessGroupControlPlane(Protocol):
-    def list_groups(self, workspace_id: str, actor_account_id: str) -> dict[str, Any]: ...
+    def list_groups(self, workspace_id: str, actor_account_id: str) -> NetworkAccessGroupList: ...
 
     def create_group(
         self,
@@ -110,9 +113,9 @@ def create_group(
         description: str,
         allowed_cidrs: list[str],
         actor_account_id: str,
-    ) -> dict[str, Any]: ...
+    ) -> NetworkAccessGroup: ...
 
-    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> dict[str, Any]: ...
+    def get_group(self, workspace_id: str, group_id: str, actor_account_id: str) -> NetworkAccessGroup: ...
 
     def update_group(
         self,
@@ -124,7 +127,7 @@ def update_group(
         allowed_cidrs: list[str],
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]: ...
+    ) -> NetworkAccessGroup: ...
 
     def delete_group(
         self,
@@ -133,9 +136,9 @@ def delete_group(
         *,
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]: ...
+    ) -> bool: ...
 
-    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> dict[str, Any]: ...
+    def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppConfig: ...
 
     def update_app_binding(
         self,
@@ -147,9 +150,9 @@ def update_app_binding(
         access_points: list[str],
         expected_version: int,
         actor_account_id: str,
-    ) -> dict[str, Any]: ...
+    ) -> NetworkAccessBindingUpdate: ...
 
-    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> dict[str, Any]: ...
+    def cleanup_app_binding(self, workspace_id: str, app_id: str) -> bool: ...
 
 
 class NetworkAccessGroupService:
@@ -166,14 +169,12 @@ def __init__(
         self._memberships = memberships
         self._entitlement = entitlement
 
-    def list_groups(self, context: RequestContext) -> dict[str, Any]:
+    def list_groups(self, context: RequestContext) -> NetworkAccessGroupList:
         self._ensure_workspace_role(context, _POLICY_READ_ROLES)
-        payload = self._control_plane.list_groups(context.active_workspace_id, context.account_id)
-        payload["entitled"] = self._effective_entitlement(
-            context.active_workspace_id,
-            payload.get("entitled"),
-        )
-        return self._enrich_app_references(payload, context.active_workspace_id)
+        result = self._control_plane.list_groups(context.active_workspace_id, context.account_id)
+        entitled = self._effective_entitlement(context.active_workspace_id, result.entitled)
+        groups = result.groups if entitled else tuple(replace(group, enforcing_count=0) for group in result.groups)
+        return replace(result, entitled=entitled, groups=self._enrich_groups(groups, context.active_workspace_id))
 
     def create_group(
         self,
@@ -182,25 +183,25 @@ def create_group(
         name: str,
         description: str,
         allowed_cidrs: list[str],
-    ) -> dict[str, Any]:
+    ) -> NetworkAccessGroup:
         self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
-        payload = self._control_plane.create_group(
+        group = self._control_plane.create_group(
             context.active_workspace_id,
             name=name,
             description=description,
             allowed_cidrs=allowed_cidrs,
             actor_account_id=context.account_id,
         )
-        return self._enrich_app_references(payload, context.active_workspace_id)
+        return self._enrich_groups((group,), context.active_workspace_id)[0]
 
-    def get_group(self, context: RequestContext, *, group_id: str) -> dict[str, Any]:
+    def get_group(self, context: RequestContext, *, group_id: str) -> NetworkAccessGroup:
         self._ensure_workspace_role(context, _POLICY_READ_ROLES)
-        payload = self._control_plane.get_group(
+        group = self._control_plane.get_group(
             context.active_workspace_id,
             group_id,
             context.account_id,
         )
-        return self._enrich_app_references(payload, context.active_workspace_id)
+        return self._enrich_groups((group,), context.active_workspace_id)[0]
 
     def update_group(
         self,
@@ -211,9 +212,9 @@ def update_group(
         description: str,
         allowed_cidrs: list[str],
         expected_version: int,
-    ) -> dict[str, Any]:
+    ) -> NetworkAccessGroup:
         self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
-        payload = self._control_plane.update_group(
+        group = self._control_plane.update_group(
             context.active_workspace_id,
             group_id,
             name=name,
@@ -222,7 +223,7 @@ def update_group(
             expected_version=expected_version,
             actor_account_id=context.account_id,
         )
-        return self._enrich_app_references(payload, context.active_workspace_id)
+        return self._enrich_groups((group,), context.active_workspace_id)[0]
 
     def delete_group(
         self,
@@ -230,7 +231,7 @@ def delete_group(
         *,
         group_id: str,
         expected_version: int,
-    ) -> dict[str, Any]:
+    ) -> bool:
         self._ensure_workspace_role(context, _POLICY_WRITE_ROLES)
         return self._control_plane.delete_group(
             context.active_workspace_id,
@@ -239,24 +240,24 @@ def delete_group(
             actor_account_id=context.account_id,
         )
 
-    def get_app_binding(self, context: RequestContext, *, app_id: str) -> dict[str, Any]:
+    def get_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppConfig:
         self._ensure_workspace_role(context, _APP_BINDING_ROLES)
         app = self._get_manageable_app(context.active_workspace_id, app_id)
         available_access_points = self._available_access_points(app.mode)
-        payload = self._control_plane.get_app_binding(
+        result = self._control_plane.get_app_binding(
             context.active_workspace_id,
             app.id,
             context.account_id,
         )
-        self._normalize_app_binding_defaults(payload)
-        self._limit_binding_access_points(payload, available_access_points)
-        payload["entitled"] = self._effective_entitlement(
-            context.active_workspace_id,
-            payload.get("entitled"),
+        binding = self._filter_binding(result.binding, available_access_points)
+        entitled = self._effective_entitlement(context.active_workspace_id, result.entitled)
+        return replace(
+            result,
+            binding=binding,
+            entitled=entitled,
+            available_access_points=available_access_points,
+            effective_enabled=self._effective_enabled(result.effective_enabled, binding, entitled),
         )
-        payload["available_access_points"] = available_access_points
-        self._finalize_effective_enabled(payload, entitled=payload["entitled"])
-        return payload
 
     def update_app_binding(
         self,
@@ -267,12 +268,12 @@ def update_app_binding(
         group_id: str | None,
         access_points: list[NetworkAccessPoint],
         expected_version: int,
-    ) -> dict[str, Any]:
+    ) -> NetworkAccessBindingUpdate:
         self._ensure_workspace_role(context, _APP_BINDING_ROLES)
         app = self._get_manageable_app(context.active_workspace_id, app_id)
         available_access_points = self._available_access_points(app.mode)
         self._validate_app_access_points(access_points, available_access_points)
-        payload = self._control_plane.update_app_binding(
+        result = self._control_plane.update_app_binding(
             context.active_workspace_id,
             app.id,
             enabled=enabled,
@@ -281,18 +282,23 @@ def update_app_binding(
             expected_version=expected_version,
             actor_account_id=context.account_id,
         )
-        self._normalize_app_binding_defaults(payload)
-        self._limit_binding_access_points(payload, available_access_points)
-        payload["available_access_points"] = available_access_points
-        self._finalize_effective_enabled(payload)
-        return payload
+        binding = replace(
+            result.binding,
+            access_points=tuple(point for point in result.binding.access_points if point in available_access_points),
+        )
+        return replace(
+            result,
+            binding=binding,
+            available_access_points=available_access_points,
+            effective_enabled=self._effective_enabled(result.effective_enabled, binding),
+        )
 
     def get_current_ip(
         self,
         context: RequestContext,
         *,
         client_ip_supplier: Callable[[], str],
-    ) -> dict[str, str]:
+    ) -> str:
         """Return trusted request metadata without requiring a saved policy.
 
         Like policy reads and the existing IP preflight, this read-only helper
@@ -302,7 +308,7 @@ def get_current_ip(
         """
 
         self._ensure_workspace_role(context, _POLICY_READ_ROLES)
-        return {"client_ip": client_ip_supplier()}
+        return client_ip_supplier()
 
     def check_current_ip(
         self,
@@ -310,7 +316,7 @@ def check_current_ip(
         *,
         group_id: str,
         client_ip_supplier: Callable[[], str],
-    ) -> dict[str, Any]:
+    ) -> NetworkAccessCurrentIPCheck:
         """Evaluate the request's trusted client IP against one tenant policy.
 
         The supplier is deliberately lazy: persisted workspace authorization and
@@ -319,37 +325,16 @@ def check_current_ip(
         """
 
         self._ensure_workspace_role(context, _POLICY_READ_ROLES)
-        payload = self._control_plane.get_group(
+        group = self._control_plane.get_group(
             context.active_workspace_id,
             group_id,
             context.account_id,
         )
-        group = payload.get("group")
-        if not isinstance(group, dict):
-            raise NetworkAccessGroupInvalidPolicyError
-
-        raw_cidrs = group.get("allowed_cidrs", group.get("allowedCidrs"))
-        raw_version = group.get("version")
-        if not isinstance(raw_cidrs, list):
-            raise NetworkAccessGroupInvalidPolicyError
-        if isinstance(raw_version, bool) or not isinstance(raw_version, (int, str)):
-            raise NetworkAccessGroupInvalidPolicyError
-        try:
-            policy_version = int(raw_version)
-        except (TypeError, ValueError) as exc:
-            raise NetworkAccessGroupInvalidPolicyError from exc
-        if policy_version < 1:
-            raise NetworkAccessGroupInvalidPolicyError
-
         client_ip = client_ip_supplier()
-        allowed = self._policy_allows_client_ip(raw_cidrs, client_ip)
-        return {
-            "client_ip": client_ip,
-            "allowed": allowed,
-            "policy_version": policy_version,
-        }
-
-    def cleanup_app_binding(self, *, workspace_id: str, app_id: str) -> dict[str, Any]:
+        allowed = self._policy_allows_client_ip(group.allowed_cidrs, client_ip)
+        return NetworkAccessCurrentIPCheck(client_ip, allowed, group.version)
+
+    def cleanup_app_binding(self, *, workspace_id: str, app_id: str) -> bool:
         return self._control_plane.cleanup_app_binding(workspace_id, app_id)
 
     def _ensure_workspace_role(self, context: RequestContext, allowed_roles: frozenset[str]) -> None:
@@ -360,8 +345,8 @@ def _ensure_workspace_role(self, context: RequestContext, allowed_roles: frozens
         if role not in allowed_roles:
             raise NetworkAccessGroupAccessDeniedError
 
-    def _effective_entitlement(self, workspace_id: str, upstream_entitled: object) -> bool:
-        return bool(upstream_entitled) and self._entitlement.is_paid_plan(workspace_id)
+    def _effective_entitlement(self, workspace_id: str, upstream_entitled: bool) -> bool:
+        return upstream_entitled and self._entitlement.is_paid_plan(workspace_id)
 
     def _get_manageable_app(self, workspace_id: str, app_id: str) -> NetworkAccessGroupAppRecord:
         app = self._apps.get_manageable_app(workspace_id=workspace_id, app_id=app_id)
@@ -370,11 +355,11 @@ def _get_manageable_app(self, workspace_id: str, app_id: str) -> NetworkAccessGr
         return app
 
     @staticmethod
-    def _available_access_points(app_mode: str) -> list[NetworkAccessPoint]:
+    def _available_access_points(app_mode: str) -> tuple[NetworkAccessPoint, ...]:
         available = _ACCESS_POINTS_BY_APP_MODE.get(app_mode)
         if available is None:
             raise NetworkAccessGroupUnsupportedAppModeError(app_mode)
-        return list(available)
+        return available
 
     @staticmethod
     def _validate_app_access_points(
@@ -386,52 +371,24 @@ def _validate_app_access_points(
             raise NetworkAccessGroupUnsupportedAccessPointsError(unsupported)
 
     @staticmethod
-    def _normalize_app_binding_defaults(payload: dict[str, Any]) -> None:
-        """Materialize ProtoJSON defaults so the Console response stays stable."""
-
-        if "effective_enabled" not in payload:
-            payload["effective_enabled"] = payload.pop("effectiveEnabled", False)
-        else:
-            payload.pop("effectiveEnabled", None)
-        payload.setdefault("binding", None)
-        binding = payload.get("binding")
-        if not isinstance(binding, dict):
-            return
-        binding.setdefault("enabled", False)
-        if "access_points" not in binding and "accessPoints" not in binding:
-            binding["access_points"] = []
-
-    @staticmethod
-    def _limit_binding_access_points(
-        payload: dict[str, Any],
+    def _filter_binding(
+        binding: NetworkAccessBinding | None,
         available: Sequence[NetworkAccessPoint],
-    ) -> None:
-        """Hide stale scopes which are not real access points for the current App mode."""
-
-        binding = payload.get("binding")
-        if not isinstance(binding, dict):
-            return
-        raw_access_points = binding.get("access_points", binding.get("accessPoints", []))
-        if not isinstance(raw_access_points, list):
-            return
-        binding["access_points"] = [access_point for access_point in raw_access_points if access_point in available]
-        binding.pop("accessPoints", None)
+    ) -> NetworkAccessBinding | None:
+        """Project current capabilities without mutating the saved binding snapshot."""
+        if binding is None:
+            return None
+        return replace(binding, access_points=tuple(point for point in binding.access_points if point in available))
 
     @staticmethod
-    def _finalize_effective_enabled(payload: dict[str, Any], *, entitled: object = True) -> None:
-        binding = payload.get("binding")
-        if not isinstance(binding, dict):
-            payload["effective_enabled"] = False
-            return
-        group_id = binding.get("group_id", binding.get("groupId"))
-        access_points = binding.get("access_points", binding.get("accessPoints", []))
-        payload["effective_enabled"] = bool(
-            payload.get("effective_enabled")
+    def _effective_enabled(upstream: bool, binding: NetworkAccessBinding | None, entitled: bool = True) -> bool:
+        return bool(
+            upstream
             and entitled
-            and binding.get("enabled")
-            and group_id
-            and isinstance(access_points, list)
-            and access_points
+            and binding is not None
+            and binding.enabled
+            and binding.group_id
+            and binding.access_points
         )
 
     @staticmethod
@@ -469,50 +426,15 @@ def _normalize_ip_network(raw_cidr: object) -> ipaddress.IPv4Network | ipaddress
             raise ValueError("IPv4-mapped IPv6 policy prefixes must be at least /96")
         return ipaddress.IPv4Network((original_address.ipv4_mapped, prefix_length - 96), strict=False)
 
-    def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) -> dict[str, Any]:
-        """Attach tenant-scoped App display metadata to one or more group payloads."""
-
-        raw_groups: list[object] = []
-        if isinstance(payload.get("group"), dict):
-            raw_groups.append(payload["group"])
-        if isinstance(payload.get("groups"), list):
-            raw_groups.extend(payload["groups"])
-
-        groups = [group for group in raw_groups if isinstance(group, dict)]
-        for group in groups:
-            raw_app_ids = (
-                group.get("used_by_app_ids")
-                or group.get("usedByAppIds")
-                or group.get("app_ids")
-                or group.get("appIds")
-                or []
-            )
-            group["app_ids"] = list(raw_app_ids) if isinstance(raw_app_ids, list) else raw_app_ids
-            raw_count = group.get("used_by_count")
-            if raw_count is None:
-                raw_count = group.get("usedByCount")
-            if raw_count is None:
-                raw_count = len(raw_app_ids) if isinstance(raw_app_ids, list) else 0
-            group["used_by_count"] = raw_count
-            raw_enforcing_count = group.get("enforcing_count")
-            if raw_enforcing_count is None:
-                raw_enforcing_count = group.get("enforcingCount")
-            group["enforcing_count"] = (
-                0 if payload.get("entitled") is False or raw_enforcing_count is None else raw_enforcing_count
-            )
-            group.pop("enforcingCount", None)
-
-        app_ids = {
-            str(app_id)
-            for group in groups
-            if isinstance(group["app_ids"], list)
-            for app_id in group["app_ids"]
-            if app_id
-        }
+    def _enrich_groups(
+        self,
+        groups: Sequence[NetworkAccessGroup],
+        workspace_id: str,
+    ) -> tuple[NetworkAccessGroup, ...]:
+        """Attach tenant-scoped App display metadata to immutable policies."""
+        app_ids = {app_id for group in groups for app_id in group.app_ids}
         if not app_ids:
-            for group in groups:
-                group["apps"] = []
-            return payload
+            return tuple(replace(group, apps=()) for group in groups)
 
         try:
             app_records = self._apps.list_apps(workspace_id=workspace_id, app_ids=tuple(app_ids))
@@ -521,23 +443,10 @@ def _enrich_app_references(self, payload: dict[str, Any], workspace_id: str) ->
                 "Failed to enrich network access group App references",
                 extra={"workspace_id": workspace_id},
             )
-            for group in groups:
-                group["apps"] = []
-            return payload
-
-        apps_by_id = {
-            app.id: {
-                "id": app.id,
-                "name": app.name,
-                "icon": app.icon,
-                "icon_type": app.icon_type,
-                "icon_background": app.icon_background,
-                "mode": app.mode,
-                "bound_agent_id": app.bound_agent_id,
-            }
-            for app in app_records
-        }
-        for group in groups:
-            group_app_ids = group["app_ids"] if isinstance(group["app_ids"], list) else []
-            group["apps"] = [apps_by_id[str(app_id)] for app_id in group_app_ids if str(app_id) in apps_by_id]
-        return payload
+            return tuple(replace(group, apps=()) for group in groups)
+
+        apps_by_id = {app.id: app for app in app_records}
+        return tuple(
+            replace(group, apps=tuple(apps_by_id[app_id] for app_id in group.app_ids if app_id in apps_by_id))
+            for group in groups
+        )
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index dae277dcdb193e..b9f97b2287c29f 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -1,15 +1,18 @@
-from collections.abc import Callable, Generator
+from collections.abc import Callable, Generator, Mapping
 from contextlib import contextmanager
+from dataclasses import replace
 from datetime import UTC, datetime
 from inspect import unwrap
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 from uuid import UUID
 
+import httpx
 import pytest
 from flask import Flask, Response
 from pydantic import ValidationError
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
+from werkzeug.test import TestResponse
 
 from controllers.console.app.error import AppNotFoundError
 from controllers.console.workspace.network_access_group import (
@@ -29,12 +32,24 @@
 from core.network_access.client_ip import NetworkAccessClientIPUnavailableError
 from enums import DeploymentEdition
 from machinery.context import RequestContext
+from services.entities.network_access_group_entities import (
+    NetworkAccessAppConfig,
+    NetworkAccessBinding,
+    NetworkAccessBindingUpdate,
+    NetworkAccessCurrentIPCheck,
+    NetworkAccessGroup,
+    NetworkAccessGroupList,
+)
+from services.network_access_group_gateway import NetworkAccessGroupGateway
 from services.network_access_group_service import (
     NetworkAccessGroupAccessDeniedError,
     NetworkAccessGroupAppNotFoundError,
+    NetworkAccessGroupAppRecord,
     NetworkAccessGroupEntitlementUnavailableError,
     NetworkAccessGroupError,
     NetworkAccessGroupInvalidPolicyError,
+    NetworkAccessGroupInvalidResponseError,
+    NetworkAccessGroupService,
     NetworkAccessGroupUnsupportedAccessPointsError,
     NetworkAccessGroupUnsupportedAppModeError,
     NetworkAccessGroupUpstreamError,
@@ -57,7 +72,7 @@ def _request_context() -> RequestContext:
 
 
 @contextmanager
-def _application_services(service: MagicMock) -> Generator[None]:
+def _application_services(service: MagicMock | NetworkAccessGroupService) -> Generator[None]:
     with patch(
         "controllers.console.workspace.network_access_group.application_services",
         return_value=SimpleNamespace(network_access_groups=service),
@@ -65,23 +80,22 @@ def _application_services(service: MagicMock) -> Generator[None]:
         yield
 
 
-def _group_payload(*, app_ids: list[str] | None = None) -> dict[str, object]:
+def _group_payload(*, app_ids: list[str] | None = None) -> NetworkAccessGroup:
     app_ids = app_ids or []
-    return {
-        "id": GROUP_ID,
-        "tenantId": TENANT_ID,
-        "name": "Office network",
-        "description": "Reusable office egress addresses",
-        "allowedCidrs": ["203.0.113.7/32"],
-        "usedByCount": len(app_ids),
-        "enforcingCount": 0,
-        "usedByAppIds": app_ids,
-        "apps": [],
-        "version": "2",
-        "updatedByAccountId": ACCOUNT_ID,
-        "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
-        "updatedAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
-    }
+    return NetworkAccessGroup(
+        id=GROUP_ID,
+        tenant_id=TENANT_ID,
+        name="Office network",
+        description="Reusable office egress addresses",
+        allowed_cidrs=("203.0.113.7/32",),
+        used_by_count=len(app_ids),
+        enforcing_count=0,
+        app_ids=tuple(app_ids),
+        version=2,
+        updated_by_account_id=ACCOUNT_ID,
+        created_at=datetime(2026, 8, 21, tzinfo=UTC),
+        updated_at=datetime(2026, 8, 21, tzinfo=UTC),
+    )
 
 
 def _binding_payload(
@@ -89,28 +103,24 @@ def _binding_payload(
     enabled: bool = True,
     group_id: str | None = GROUP_ID,
     access_points: list[str] | None = None,
-) -> dict[str, object]:
-    return {
-        "id": BINDING_ID,
-        "tenantId": TENANT_ID,
-        "appId": APP_ID,
-        "enabled": enabled,
-        "groupId": group_id,
-        "accessPoints": ["webapp", "service_api"] if access_points is None else access_points,
-        "version": "3",
-        "updatedByAccountId": ACCOUNT_ID,
-        "createdAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
-        "updatedAt": datetime(2026, 8, 21, tzinfo=UTC).isoformat(),
-    }
+) -> NetworkAccessBinding:
+    return NetworkAccessBinding(
+        id=BINDING_ID,
+        tenant_id=TENANT_ID,
+        app_id=APP_ID,
+        enabled=enabled,
+        group_id=group_id,
+        access_points=("webapp", "service_api") if access_points is None else tuple(access_points),
+        version=3,
+        updated_by_account_id=ACCOUNT_ID,
+        created_at=datetime(2026, 8, 21, tzinfo=UTC),
+        updated_at=datetime(2026, 8, 21, tzinfo=UTC),
+    )
 
 
 def test_list_forwards_request_context_and_serializes_response() -> None:
     service = MagicMock()
-    service.list_groups.return_value = {
-        "tenantId": TENANT_ID,
-        "entitled": True,
-        "groups": [_group_payload()],
-    }
+    service.list_groups.return_value = NetworkAccessGroupList(TENANT_ID, True, (_group_payload(),))
     api = CurrentWorkspaceNetworkAccessGroupsApi()
 
     with _application_services(service):
@@ -124,7 +134,7 @@ def test_list_forwards_request_context_and_serializes_response() -> None:
 
 def test_create_forwards_payload_and_returns_201() -> None:
     service = MagicMock()
-    service.create_group.return_value = {"group": _group_payload()}
+    service.create_group.return_value = _group_payload()
     request_payload = NetworkAccessGroupCreatePayload(
         name="Office network",
         description="Reusable office egress addresses",
@@ -151,9 +161,9 @@ def test_create_forwards_payload_and_returns_201() -> None:
 
 def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
     service = MagicMock()
-    service.get_group.return_value = {"group": _group_payload()}
-    service.update_group.return_value = {"group": _group_payload()}
-    service.delete_group.return_value = {"deleted": True}
+    service.get_group.return_value = _group_payload()
+    service.update_group.return_value = _group_payload()
+    service.delete_group.return_value = True
     update_payload = NetworkAccessGroupUpdatePayload(
         name="Office network",
         description="Updated",
@@ -194,19 +204,19 @@ def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
 
 def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
     service = MagicMock()
-    service.get_app_binding.return_value = {
-        "tenantId": TENANT_ID,
-        "appId": APP_ID,
-        "entitled": True,
-        "effectiveEnabled": False,
-        "available_access_points": ["webapp", "service_api", "mcp"],
-        "binding": None,
-    }
-    service.update_app_binding.return_value = {
-        "binding": _binding_payload(),
-        "effectiveEnabled": True,
-        "available_access_points": ["webapp", "service_api", "mcp"],
-    }
+    service.get_app_binding.return_value = NetworkAccessAppConfig(
+        TENANT_ID,
+        APP_ID,
+        True,
+        False,
+        None,
+        ("webapp", "service_api", "mcp"),
+    )
+    service.update_app_binding.return_value = NetworkAccessBindingUpdate(
+        _binding_payload(),
+        True,
+        ("webapp", "service_api", "mcp"),
+    )
     request_payload = AppNetworkAccessGroupUpdatePayload(
         enabled=True,
         group_id=GROUP_ID,
@@ -286,6 +296,7 @@ def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None
         (NetworkAccessGroupUnsupportedAppModeError("channel"), BadRequest, "channel"),
         (NetworkAccessGroupUnsupportedAccessPointsError(["trigger"]), BadRequest, "trigger"),
         (NetworkAccessGroupInvalidPolicyError(), ServiceUnavailable, "cannot be evaluated"),
+        (NetworkAccessGroupInvalidResponseError(), BadGateway, "invalid response"),
     ],
 )
 def test_application_error_mapping(
@@ -414,9 +425,9 @@ def check_current_ip(
         *,
         group_id: str,
         client_ip_supplier: Callable[[], str],
-    ) -> dict[str, object]:
+    ) -> NetworkAccessCurrentIPCheck:
         assert group_id == GROUP_ID
-        return {"client_ip": client_ip_supplier(), "allowed": True, "policy_version": 4}
+        return NetworkAccessCurrentIPCheck(client_ip_supplier(), True, 4)
 
     service.check_current_ip.side_effect = check_current_ip
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
@@ -487,13 +498,8 @@ def test_current_ip_check_fails_closed_when_trusted_proxy_config_is_empty(
 
 def test_group_response_rejects_enforcing_count_greater_than_used_by_count() -> None:
     service = MagicMock()
-    group = _group_payload(app_ids=[APP_ID])
-    group["enforcingCount"] = 2
-    service.list_groups.return_value = {
-        "tenantId": TENANT_ID,
-        "entitled": True,
-        "groups": [group],
-    }
+    group = replace(_group_payload(app_ids=[APP_ID]), enforcing_count=2)
+    service.list_groups.return_value = NetworkAccessGroupList(TENANT_ID, True, (group,))
 
     with _application_services(service), pytest.raises(BadGateway, match="Invalid response"):
         unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
@@ -522,7 +528,7 @@ def test_current_ip_read_uses_trusted_resolver_and_ignores_client_supplied_ip(
     app = Flask(__name__)
     service = MagicMock()
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
-    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: {"client_ip": client_ip_supplier()}
+    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: client_ip_supplier()
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
 
     with (
@@ -566,7 +572,7 @@ def test_current_ip_read_fails_closed_with_no_store_on_503(
     app = Flask(__name__)
     service = MagicMock()
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=trusted_proxies)
-    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: {"client_ip": client_ip_supplier()}
+    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: client_ip_supplier()
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
 
     with (
@@ -644,3 +650,75 @@ def test_current_ip_read_response_schema_exposes_only_client_ip() -> None:
     assert schema["required"] == ["client_ip"]
     assert set(schema["properties"]) == {"client_ip"}
     assert schema["properties"]["client_ip"]["type"] == "string"
+
+
+@pytest.mark.parametrize("group_field", ["group_id", "groupId", "policy_id", "policyId"])
+@pytest.mark.parametrize("stale_only", [False, True])
+def test_typed_gateway_service_controller_pipeline_preserves_binding_configuration(
+    group_field: str, stale_only: bool
+) -> None:
+    wire = {
+        "tenantId": TENANT_ID,
+        "appId": APP_ID,
+        "entitled": True,
+        "effectiveEnabled": True,
+        "binding": {
+            "id": BINDING_ID,
+            "tenantId": TENANT_ID,
+            "appId": APP_ID,
+            "enabled": True,
+            group_field: GROUP_ID,
+            "accessPoints": ["future_scope"] if stale_only else ["webapp"],
+            "version": "3",
+            "createdAt": "2026-08-21T00:00:00Z",
+            "updatedAt": "2026-08-21T00:00:00Z",
+        },
+    }
+    response = _typed_binding_http_response(wire)
+    assert response.status_code == 200
+    body = response.get_json()
+    assert body["binding"]["enabled"] is True
+    assert body["binding"]["group_id"] == GROUP_ID
+    assert body["binding"]["version"] == 3
+    assert body["binding"]["access_points"] == ([] if stale_only else ["webapp"])
+    assert body["effective_enabled"] is not stale_only
+    assert wire["binding"]["accessPoints"] == (["future_scope"] if stale_only else ["webapp"])
+
+
+def test_malformed_upstream_response_maps_to_http_502_before_business_truthiness() -> None:
+    response = _typed_binding_http_response(
+        {
+            "tenantId": TENANT_ID,
+            "appId": APP_ID,
+            "entitled": "false",
+            "effectiveEnabled": False,
+        }
+    )
+    assert response.status_code == 502
+
+
+def _typed_binding_http_response(wire: Mapping[str, object]) -> TestResponse:
+    app = Flask(__name__)
+    app.testing = True
+    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
+    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, "workflow", "Test", None, None, None)
+    memberships.get_role_for_account.return_value = "owner"
+    entitlement.is_paid_plan.return_value = True
+    with httpx.Client(transport=httpx.MockTransport(lambda _request: httpx.Response(200, json=wire))) as client:
+        gateway = NetworkAccessGroupGateway(
+            base_url="https://test.invalid",
+            fallback_base_url="",
+            secret_key="synthetic",
+            http_client=client,
+        )
+        service = NetworkAccessGroupService(
+            control_plane=gateway, apps=apps, memberships=memberships, entitlement=entitlement
+        )
+        api = AppNetworkAccessGroupApi()
+
+        @app.get("/binding")
+        def binding() -> dict[str, object]:
+            return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
+
+        with _application_services(service):
+            return app.test_client().get("/binding")
diff --git a/api/tests/unit_tests/extensions/test_ext_application_services.py b/api/tests/unit_tests/extensions/test_ext_application_services.py
index 11ce08b16344c3..606b0f6c5771e2 100644
--- a/api/tests/unit_tests/extensions/test_ext_application_services.py
+++ b/api/tests/unit_tests/extensions/test_ext_application_services.py
@@ -19,7 +19,8 @@
 from extensions.ext_redis import RedisClientWrapper
 from machinery.context import RequestContext
 from models.account import Account
-from models.model import AccountTrialAppRecord, DifySetup
+from models.enums import AppStatus
+from models.model import AccountTrialAppRecord, App, AppMode, AppModelConfig, CustomizeTokenStrategy, DifySetup, Site
 from repositories.account_activation_repository import SQLAlchemyAccountActivationRepository
 from repositories.account_integration_repository import SQLAlchemyAccountIntegrationRepository
 from repositories.account_oauth_repository import (
@@ -724,8 +725,38 @@ def test_build_application_services_wires_trial_app_usage(
     assert record.count == 1
 
 
+@pytest.fixture
+def published_webapp_id(sqlite_session: Session) -> str:
+    """Keep public admission real so wiring tests reach the Enterprise adapter."""
+    app_id = str(uuid4())
+    config = AppModelConfig(app_id=app_id)
+    config.id = str(uuid4())
+    app = App(
+        id=app_id,
+        tenant_id=str(uuid4()),
+        name="Published adapter fixture",
+        mode=AppMode.CHAT,
+        status=AppStatus.NORMAL,
+        enable_site=True,
+        enable_api=True,
+        app_model_config_id=config.id,
+    )
+    site = Site(
+        app_id=app_id,
+        code="published-adapter-fixture",
+        title="Published adapter fixture",
+        default_language="en-US",
+        customize_token_strategy=CustomizeTokenStrategy.UUID,
+        status=AppStatus.NORMAL,
+    )
+    sqlite_session.add_all([app, config, site])
+    sqlite_session.commit()
+    return app_id
+
+
 def test_build_application_services_adapts_enterprise_webapp_access_mode(
     sqlite_session_factory: sessionmaker[Session],
+    published_webapp_id: str,
 ) -> None:
     with (
         patch("extensions.ext_application_services.SystemFeatureService.is_webapp_auth_enabled", return_value=True),
@@ -740,10 +771,10 @@ def test_build_application_services_adapts_enterprise_webapp_access_mode(
             initialization_password="",
             redis=MagicMock(spec=RedisClientWrapper),
         )
-        result = services.webapp_access.get_access_mode(app_id="app-1", app_code=None)
+        result = services.webapp_access.get_access_mode(app_id=published_webapp_id, app_code=None)
 
     assert result is WebAppAccessMode.PRIVATE_ALL
-    get_access_mode.assert_called_once_with("app-1")
+    get_access_mode.assert_called_once_with(published_webapp_id)
 
 
 @pytest.mark.parametrize(
@@ -762,6 +793,7 @@ def test_build_application_services_adapts_enterprise_webapp_access_mode(
 )
 def test_build_application_services_maps_known_enterprise_errors(
     sqlite_session_factory: sessionmaker[Session],
+    published_webapp_id: str,
     enterprise_error: Exception,
 ) -> None:
     with (
@@ -769,7 +801,7 @@ def test_build_application_services_maps_known_enterprise_errors(
         patch(
             "extensions.ext_application_services.EnterpriseService.WebAppAuth.get_app_access_mode_by_id",
             side_effect=enterprise_error,
-        ),
+        ) as get_access_mode,
     ):
         services = ext_application_services.build_application_services(
             database_client=sqlite_session_factory,
@@ -779,20 +811,22 @@ def test_build_application_services_maps_known_enterprise_errors(
         )
 
         with pytest.raises(WebAppAccessUnavailableError) as raised:
-            services.webapp_access.get_access_mode(app_id="app-1", app_code=None)
+            services.webapp_access.get_access_mode(app_id=published_webapp_id, app_code=None)
 
     assert raised.value.__cause__ is enterprise_error
+    get_access_mode.assert_called_once_with(published_webapp_id)
 
 
 def test_build_application_services_maps_invalid_access_mode_to_unavailable(
     sqlite_session_factory: sessionmaker[Session],
+    published_webapp_id: str,
 ) -> None:
     with (
         patch("extensions.ext_application_services.SystemFeatureService.is_webapp_auth_enabled", return_value=True),
         patch(
             "extensions.ext_application_services.EnterpriseService.WebAppAuth.get_app_access_mode_by_id",
             return_value=SimpleNamespace(access_mode="invalid"),
-        ),
+        ) as get_access_mode,
     ):
         services = ext_application_services.build_application_services(
             database_client=sqlite_session_factory,
@@ -802,13 +836,15 @@ def test_build_application_services_maps_invalid_access_mode_to_unavailable(
         )
 
         with pytest.raises(WebAppAccessUnavailableError) as raised:
-            services.webapp_access.get_access_mode(app_id="app-1", app_code=None)
+            services.webapp_access.get_access_mode(app_id=published_webapp_id, app_code=None)
 
     assert isinstance(raised.value.__cause__, ValueError)
+    get_access_mode.assert_called_once_with(published_webapp_id)
 
 
 def test_build_application_services_does_not_hide_unknown_enterprise_errors(
     sqlite_session_factory: sessionmaker[Session],
+    published_webapp_id: str,
 ) -> None:
     failure = TypeError("adapter bug")
     with (
@@ -816,7 +852,7 @@ def test_build_application_services_does_not_hide_unknown_enterprise_errors(
         patch(
             "extensions.ext_application_services.EnterpriseService.WebAppAuth.get_app_access_mode_by_id",
             side_effect=failure,
-        ),
+        ) as get_access_mode,
     ):
         services = ext_application_services.build_application_services(
             database_client=sqlite_session_factory,
@@ -826,9 +862,10 @@ def test_build_application_services_does_not_hide_unknown_enterprise_errors(
         )
 
         with pytest.raises(TypeError) as raised:
-            services.webapp_access.get_access_mode(app_id="app-1", app_code=None)
+            services.webapp_access.get_access_mode(app_id=published_webapp_id, app_code=None)
 
     assert raised.value is failure
+    get_access_mode.assert_called_once_with(published_webapp_id)
 
 
 def test_build_application_services_wires_webapp_permission(
diff --git a/api/tests/unit_tests/services/test_network_access_group_gateway.py b/api/tests/unit_tests/services/test_network_access_group_gateway.py
index 9036672893812c..9dcbd56eeedd69 100644
--- a/api/tests/unit_tests/services/test_network_access_group_gateway.py
+++ b/api/tests/unit_tests/services/test_network_access_group_gateway.py
@@ -11,6 +11,7 @@
 )
 from services.network_access_group_service import (
     NetworkAccessGroupEntitlementUnavailableError,
+    NetworkAccessGroupInvalidResponseError,
     NetworkAccessGroupUpstreamError,
 )
 
@@ -21,6 +22,31 @@
 HEADERS = {"Content-Type": "application/json", "Billing-Api-Secret-Key": "test-secret"}
 
 
+def _group_wire(**overrides: object) -> dict[str, object]:
+    return {
+        "id": GROUP_ID,
+        "tenant_id": TENANT_ID,
+        "name": "Office",
+        "allowed_cidrs": ["203.0.113.7/32"],
+        "version": "1",
+        "created_at": "2026-09-01T00:00:00Z",
+        "updated_at": "2026-09-01T00:00:00Z",
+        **overrides,
+    }
+
+
+def _binding_wire(**overrides: object) -> dict[str, object]:
+    return {
+        "id": GROUP_ID,
+        "tenant_id": TENANT_ID,
+        "app_id": APP_ID,
+        "version": "1",
+        "created_at": "2026-09-01T00:00:00Z",
+        "updated_at": "2026-09-01T00:00:00Z",
+        **overrides,
+    }
+
+
 def _gateway(*, base_url: str = "https://network-access.internal/v1/") -> tuple[NetworkAccessGroupGateway, MagicMock]:
     http_client = MagicMock(spec=httpx.Client)
     return (
@@ -75,15 +101,15 @@ def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()},
-        {"group": {"id": GROUP_ID}},
+        {"group": _group_wire()},
     ]
     http_client.request.return_value = response
 
     list_result = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
     item_result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
-    assert list_result["groups"] == []
-    assert item_result["group"]["id"] == GROUP_ID
+    assert list_result.groups == ()
+    assert item_result.id == GROUP_ID
     assert http_client.request.call_args_list == [
         call(
             "GET",
@@ -108,8 +134,8 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
     gateway, http_client = _gateway(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
-        {"group": {"id": GROUP_ID, "version": "1"}},
-        {"group": {"id": GROUP_ID, "version": "2"}},
+        {"group": _group_wire(version="1")},
+        {"group": _group_wire(version="2")},
         {"deleted": True},
     ]
     http_client.request.return_value = response
@@ -182,22 +208,14 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
         {
-            "binding": {
-                "app_id": APP_ID,
-                "enabled": True,
-                "group_id": GROUP_ID,
-                "access_points": ["webapp", "service_api"],
-                "version": "1",
-            }
+            "binding": _binding_wire(
+                enabled=True, group_id=GROUP_ID, access_points=["webapp", "service_api"], version="1"
+            )
         },
         {
-            "binding": {
-                "app_id": APP_ID,
-                "enabled": False,
-                "group_id": GROUP_ID,
-                "access_points": ["webapp", "service_api"],
-                "version": "2",
-            }
+            "binding": _binding_wire(
+                enabled=False, group_id=GROUP_ID, access_points=["webapp", "service_api"], version="2"
+            )
         },
     ]
     http_client.request.return_value = response
@@ -271,7 +289,7 @@ def test_app_lifecycle_cleanup_uses_internal_secret_endpoint() -> None:
 
     result = gateway.cleanup_app_binding(TENANT_ID, APP_ID)
 
-    assert result == {"deleted": True}
+    assert result is True
     http_client.request.assert_called_once_with(
         "DELETE",
         f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group-binding",
@@ -331,12 +349,10 @@ def test_network_access_group_request_rejects_non_object_response() -> None:
     response.json.return_value = list[object]()
     with (
         patch.object(gateway, "_send_http_request", return_value=response),
-        pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
+        pytest.raises(NetworkAccessGroupInvalidResponseError),
     ):
         gateway._send_request("GET", "/groups")
 
-    assert exc_info.value.status_code == httpx.codes.BAD_GATEWAY
-
 
 @pytest.mark.parametrize("plan", [CloudPlan.PROFESSIONAL, CloudPlan.TEAM])
 def test_billing_entitlement_gateway_accepts_paid_plans(plan: CloudPlan) -> None:
@@ -393,3 +409,166 @@ def test_billing_entitlement_gateway_does_not_mask_unexpected_value_error() -> N
         pytest.raises(ValueError, match="programming error"),
     ):
         gateway.is_paid_plan(TENANT_ID)
+
+
+def test_protojson_defaults_are_materialized_before_service_boundary() -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    client.request.return_value = response
+    response.json.return_value = {"tenantId": TENANT_ID}
+    groups = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
+    assert groups.entitled is False
+    assert groups.groups == ()
+
+    for binding in (None, _binding_wire()):
+        response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID, "binding": binding}
+        result = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+        assert result.entitled is False
+        assert result.effective_enabled is False
+        if binding is None:
+            assert result.binding is None
+        else:
+            assert result.binding is not None
+            assert result.binding.enabled is False
+            assert result.binding.access_points == ()
+            assert result.binding.group_id is None
+
+    response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID}
+    assert gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding is None
+    response.json.return_value = dict[str, object]()
+    assert gateway.cleanup_app_binding(TENANT_ID, APP_ID) is False
+
+
+def test_policy_protojson_aliases_and_count_defaults_are_decoded_once() -> None:
+    gateway, client = _gateway()
+    wire = {
+        "id": GROUP_ID,
+        "tenantId": TENANT_ID,
+        "name": "Office",
+        "allowedCidrs": ["203.0.113.7/32"],
+        "version": "9007199254740993",
+        "usedByAppIds": [APP_ID],
+        "createdAt": "2026-09-01T00:00:00Z",
+        "updatedAt": "2026-09-01T00:00:00Z",
+    }
+    response = MagicMock(status_code=200)
+    response.json.return_value = {"group": wire}
+    client.request.return_value = response
+    result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
+    assert result.version == 9007199254740993
+    assert result.used_by_count == 1  # Legacy replies without a count retain the reference fallback.
+    assert result.enforcing_count == 0
+    assert result.allowed_cidrs == ("203.0.113.7/32",)
+    assert result.app_ids == (APP_ID,)
+    assert result.description == ""
+    assert result.updated_by_account_id is None
+    assert "enforcing_count" not in wire
+
+
+@pytest.mark.parametrize("alias", ["group_id", "groupId", "policy_id", "policyId"])
+@pytest.mark.parametrize("group_id", [GROUP_ID, None, ""])
+def test_binding_policy_aliases_and_nullable_references(alias: str, group_id: str | None) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID, "binding": _binding_wire(**{alias: group_id})}
+    client.request.return_value = response
+    binding = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding
+    assert binding is not None
+    assert binding.group_id == (group_id or None)
+
+
+def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload() -> None:
+    gateway, client = _gateway()
+    scopes = ["webapp", "future_scope", "trigger"]
+    response = MagicMock(status_code=200)
+    response.json.return_value = {
+        "effectiveEnabled": True,
+        "binding": _binding_wire(enabled=True, policyId=GROUP_ID, accessPoints=scopes),
+    }
+    client.request.return_value = response
+    result = gateway.update_app_binding(
+        TENANT_ID,
+        APP_ID,
+        enabled=True,
+        group_id=GROUP_ID,
+        access_points=["webapp"],
+        expected_version=1,
+        actor_account_id=ACCOUNT_ID,
+    )
+    assert result.binding.access_points == ("webapp", "future_scope", "trigger")
+    assert result.binding.group_id == GROUP_ID
+    assert result.effective_enabled is True
+    scopes.clear()
+    assert result.binding.access_points == ("webapp", "future_scope", "trigger")
+
+
+@pytest.mark.parametrize("value", [True, False, 1.0, "1.5", "invalid", 0, -1, 2**63, str(2**63)])
+def test_invalid_versions_are_rejected_at_gateway(value: object) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = {"group": _group_wire(version=value)}
+    client.request.return_value = response
+    with pytest.raises(NetworkAccessGroupInvalidResponseError):
+        gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
+
+
+@pytest.mark.parametrize("version", [1, "1", 2**63 - 1, str(2**63 - 1)])
+def test_int64_versions_do_not_lose_precision(version: int | str) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = {"group": _group_wire(version=version)}
+    client.request.return_value = response
+    assert gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID).version == int(version)
+
+
+@pytest.mark.parametrize("field", ["entitled", "effective_enabled", "enabled"])
+@pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
+def test_wire_flags_are_strict_booleans(field: str, value: object) -> None:
+    gateway, client = _gateway()
+    binding = _binding_wire()
+    payload: dict[str, object] = {"tenant_id": TENANT_ID, "app_id": APP_ID, "binding": binding}
+    (binding if field == "enabled" else payload)[field] = value
+    response = MagicMock(status_code=200)
+    response.json.return_value = payload
+    client.request.return_value = response
+    with pytest.raises(NetworkAccessGroupInvalidResponseError):
+        gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+
+
+@pytest.mark.parametrize("alias", ["groupId", "policy_id", "policyId"])
+def test_conflicting_policy_aliases_fail_instead_of_selecting_one(alias: str) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = {
+        "tenant_id": TENANT_ID,
+        "app_id": APP_ID,
+        "binding": _binding_wire(group_id=GROUP_ID, **{alias: APP_ID}),
+    }
+    client.request.return_value = response
+    with pytest.raises(NetworkAccessGroupInvalidResponseError):
+        gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+    response.json.return_value["binding"][alias] = GROUP_ID
+    binding = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding
+    assert binding is not None
+    assert binding.group_id == GROUP_ID
+
+
+@pytest.mark.parametrize("payload", [{}, {"group": None}, {"group": {"version": "1"}}])
+def test_existing_policy_identity_fields_are_never_fabricated(payload: dict[str, object]) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = payload
+    client.request.return_value = response
+    with pytest.raises(NetworkAccessGroupInvalidResponseError):
+        gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
+
+
+@pytest.mark.parametrize("field", ["used_by_count", "enforcing_count"])
+@pytest.mark.parametrize("value", [True, 0.0, "0.5", -1])
+def test_invalid_policy_counts_are_rejected(field: str, value: object) -> None:
+    gateway, client = _gateway()
+    response = MagicMock(status_code=200)
+    response.json.return_value = {"group": _group_wire(**{field: value})}
+    client.request.return_value = response
+    with pytest.raises(NetworkAccessGroupInvalidResponseError):
+        gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 63a280780ec686..4e057794c64592 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -1,10 +1,19 @@
 from collections.abc import Callable
+from datetime import UTC, datetime
 from typing import NamedTuple
 from unittest.mock import MagicMock, create_autospec
 
 import pytest
 
 from machinery.context import RequestContext
+from services.entities.network_access_group_entities import (
+    NetworkAccessAppConfig,
+    NetworkAccessBinding,
+    NetworkAccessBindingUpdate,
+    NetworkAccessCurrentIPCheck,
+    NetworkAccessGroup,
+    NetworkAccessGroupList,
+)
 from services.network_access_group_service import (
     NetworkAccessGroupAccessDeniedError,
     NetworkAccessGroupAppNotFoundError,
@@ -25,6 +34,50 @@
 ACCOUNT_ID = "account-1"
 APP_ID = "app-1"
 GROUP_ID = "group-1"
+NOW = datetime(2026, 9, 1, tzinfo=UTC)
+
+
+def _group(
+    *,
+    group_id: str = GROUP_ID,
+    app_ids: tuple[str, ...] = (),
+    version: int = 1,
+    allowed_cidrs: tuple[str, ...] = ("203.0.113.0/24",),
+    used_by_count: int | None = None,
+    enforcing_count: int = 0,
+) -> NetworkAccessGroup:
+    return NetworkAccessGroup(
+        group_id,
+        WORKSPACE_ID,
+        "Office",
+        "",
+        allowed_cidrs,
+        version,
+        len(app_ids) if used_by_count is None else used_by_count,
+        enforcing_count,
+        app_ids,
+        ACCOUNT_ID,
+        NOW,
+        NOW,
+    )
+
+
+def _binding(
+    *, enabled: bool = False, group_id: str | None = None, access_points: tuple[str, ...] = ()
+) -> NetworkAccessBinding:
+    return NetworkAccessBinding(
+        "binding", WORKSPACE_ID, APP_ID, enabled, group_id, access_points, 1, ACCOUNT_ID, NOW, NOW
+    )
+
+
+def _config(
+    binding: NetworkAccessBinding | None = None, *, effective_enabled: bool = False, entitled: bool = True
+) -> NetworkAccessAppConfig:
+    return NetworkAccessAppConfig(WORKSPACE_ID, APP_ID, entitled, effective_enabled, binding)
+
+
+def _groups(groups: tuple[NetworkAccessGroup, ...] = (), *, entitled: bool = True) -> NetworkAccessGroupList:
+    return NetworkAccessGroupList(WORKSPACE_ID, entitled, groups)
 
 
 class _Harness(NamedTuple):
@@ -70,6 +123,14 @@ def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "
     memberships.get_role_for_account.return_value = role
     entitlement.is_paid_plan.return_value = paid
     apps.get_manageable_app.return_value = _app(mode=app_mode)
+    apps.list_apps.return_value = list[NetworkAccessGroupAppRecord]()
+    control_plane.list_groups.return_value = _groups()
+    for method in (control_plane.get_group, control_plane.create_group, control_plane.update_group):
+        method.return_value = _group()
+    control_plane.get_app_binding.return_value = _config()
+    control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(_binding(), False)
+    control_plane.delete_group.return_value = True
+    control_plane.cleanup_app_binding.return_value = True
     return _Harness(
         service=NetworkAccessGroupService(
             control_plane=control_plane,
@@ -174,8 +235,8 @@ def test_mutations_reject_non_privileged_persisted_roles_before_control_plane(
 @pytest.mark.parametrize("role", ["owner", "admin", "editor"])
 def test_policy_reads_allow_persisted_owner_admin_and_editor(role: str) -> None:
     harness = _harness(role=role)
-    harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
-    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.list_groups.return_value = _groups()
+    harness.control_plane.get_group.return_value = _group()
 
     harness.service.list_groups(_context())
     harness.service.get_group(_context(), group_id=GROUP_ID)
@@ -229,11 +290,10 @@ def test_policy_mutations_reject_editor_before_control_plane(mutation: Mutation)
 @pytest.mark.parametrize("role", ["owner", "admin", "editor"])
 def test_app_binding_get_and_put_allow_privileged_roles(role: str) -> None:
     harness = _harness(role=role)
-    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
-    harness.control_plane.update_app_binding.return_value = {
-        "effective_enabled": True,
-        "binding": {"enabled": True, "group_id": GROUP_ID, "access_points": ["webapp"]},
-    }
+    harness.control_plane.get_app_binding.return_value = _config()
+    harness.control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(
+        _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp",)), True
+    )
 
     harness.service.get_app_binding(_context(), app_id=APP_ID)
     harness.service.update_app_binding(
@@ -282,7 +342,7 @@ def test_app_binding_rejects_disallowed_roles_before_app_lookup(operation: Mutat
 
 def test_mutation_does_not_repeat_http_paid_plan_admission() -> None:
     harness = _harness()
-    harness.control_plane.create_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.create_group.return_value = _group()
 
     harness.service.create_group(
         _context(),
@@ -297,13 +357,6 @@ def test_mutation_does_not_repeat_http_paid_plan_admission() -> None:
 @pytest.mark.parametrize("role", ["owner", "admin"])
 def test_public_use_cases_forward_workspace_actor_and_request_parameters(role: str) -> None:
     harness = _harness(role=role)
-    harness.control_plane.list_groups.return_value = {"entitled": True, "groups": list[object]()}
-    harness.control_plane.create_group.return_value = {"group": {"id": GROUP_ID}}
-    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
-    harness.control_plane.update_group.return_value = {"group": {"id": GROUP_ID}}
-    harness.control_plane.delete_group.return_value = {"deleted": True}
-    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
-    harness.control_plane.update_app_binding.return_value = dict[str, object](binding=None)
     context = _context()
 
     harness.service.list_groups(context)
@@ -371,11 +424,11 @@ def test_public_use_cases_forward_workspace_actor_and_request_parameters(role: s
 
 def test_cleanup_app_binding_forwards_without_console_admission() -> None:
     harness = _harness()
-    harness.control_plane.cleanup_app_binding.return_value = {"deleted": True}
+    harness.control_plane.cleanup_app_binding.return_value = True
 
     result = harness.service.cleanup_app_binding(workspace_id=WORKSPACE_ID, app_id=APP_ID)
 
-    assert result == {"deleted": True}
+    assert result is True
     harness.control_plane.cleanup_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID)
     harness.memberships.get_role_for_account.assert_not_called()
     harness.entitlement.is_paid_plan.assert_not_called()
@@ -396,14 +449,11 @@ def test_list_effective_entitlement_requires_both_sources(
     expected: bool,
 ) -> None:
     harness = _harness(paid=paid)
-    harness.control_plane.list_groups.return_value = {
-        "entitled": upstream_entitled,
-        "groups": list[object](),
-    }
+    harness.control_plane.list_groups.return_value = _groups(entitled=upstream_entitled)
 
     result = harness.service.list_groups(_context())
 
-    assert result["entitled"] is expected
+    assert result.entitled is expected
 
 
 @pytest.mark.parametrize(
@@ -422,11 +472,11 @@ def test_app_binding_reports_access_points_for_each_supported_mode(
     available_access_points: list[str],
 ) -> None:
     harness = _harness(app_mode=mode)
-    harness.control_plane.get_app_binding.return_value = {"entitled": True, "binding": None}
+    harness.control_plane.get_app_binding.return_value = _config()
 
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
-    assert result["available_access_points"] == available_access_points
+    assert result.available_access_points == tuple(available_access_points)
 
 
 def test_app_binding_rejects_unsupported_app_mode_before_control_plane() -> None:
@@ -492,45 +542,36 @@ def test_update_app_binding_rejects_access_points_not_supported_by_mode() -> Non
     harness.control_plane.update_app_binding.assert_not_called()
 
 
-def test_app_binding_materializes_protojson_defaults() -> None:
+def test_disabled_binding_stays_disabled() -> None:
     harness = _harness(app_mode="chat")
-    harness.control_plane.get_app_binding.return_value = {
-        "entitled": True,
-        "binding": dict[str, object](),
-    }
+    harness.control_plane.get_app_binding.return_value = _config(_binding())
 
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
-    assert result["binding"] == {"enabled": False, "access_points": []}
-    assert result["effective_enabled"] is False
+    assert result.binding == _binding()
+    assert result.effective_enabled is False
 
 
-def test_app_binding_normalizes_camel_case_and_filters_stale_access_points() -> None:
+def test_app_binding_filters_stale_and_future_scopes_without_mutating_snapshot() -> None:
     harness = _harness(app_mode="chat")
-    harness.control_plane.get_app_binding.return_value = {
-        "entitled": True,
-        "binding": {"enabled": True, "accessPoints": ["webapp", "trigger", "mcp"]},
-    }
+    saved = _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "trigger", "mcp", "future"))
+    harness.control_plane.get_app_binding.return_value = _config(saved)
 
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
-    assert result["binding"] == {"enabled": True, "access_points": ["webapp", "mcp"]}
-    assert result["effective_enabled"] is False
+    assert result.binding == _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "mcp"))
+    assert result.effective_enabled is False
+    assert saved.access_points == ("webapp", "trigger", "mcp", "future")
 
 
 def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
     harness = _harness()
-    harness.control_plane.list_groups.return_value = {
-        "entitled": True,
-        "groups": [
-            {
-                "id": "group-1",
-                "usedByAppIds": ["app-2", "missing-app", "app-1"],
-                "usedByCount": "3",
-            },
-            {"id": "group-2", "app_ids": ["app-1"]},
-        ],
-    }
+    harness.control_plane.list_groups.return_value = _groups(
+        (
+            _group(app_ids=("app-2", "missing-app", "app-1")),
+            _group(group_id="group-2", app_ids=("app-1",)),
+        )
+    )
     harness.apps.list_apps.return_value = [
         _app(app_id="app-1", name="One"),
         _app(app_id="app-2", name="Two"),
@@ -538,22 +579,12 @@ def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
 
     result = harness.service.list_groups(_context())
 
-    groups = result["groups"]
-    assert groups[0]["app_ids"] == ["app-2", "missing-app", "app-1"]
-    assert groups[0]["used_by_count"] == "3"
-    assert [app["id"] for app in groups[0]["apps"]] == ["app-2", "app-1"]
-    assert groups[1]["used_by_count"] == 1
-    assert groups[1]["apps"] == [
-        {
-            "id": "app-1",
-            "name": "One",
-            "icon": "app-1.png",
-            "icon_type": "image",
-            "icon_background": "#FFFFFF",
-            "mode": "workflow",
-            "bound_agent_id": None,
-        }
-    ]
+    groups = result.groups
+    assert groups[0].app_ids == ("app-2", "missing-app", "app-1")
+    assert groups[0].used_by_count == 3
+    assert [app.id for app in groups[0].apps] == ["app-2", "app-1"]
+    assert groups[1].used_by_count == 1
+    assert groups[1].apps == (_app(app_id="app-1", name="One"),)
     call_kwargs = harness.apps.list_apps.call_args.kwargs
     assert call_kwargs["workspace_id"] == WORKSPACE_ID
     assert set(call_kwargs["app_ids"]) == {"app-1", "app-2", "missing-app"}
@@ -561,46 +592,34 @@ def test_group_payloads_are_enriched_with_tenant_scoped_app_metadata() -> None:
 
 def test_app_query_failure_degrades_group_enrichment_to_empty_apps() -> None:
     harness = _harness()
-    harness.control_plane.get_group.return_value = {
-        "group": {"id": GROUP_ID, "used_by_app_ids": [APP_ID], "used_by_count": 1}
-    }
+    harness.control_plane.get_group.return_value = _group(app_ids=(APP_ID,))
     harness.apps.list_apps.side_effect = NetworkAccessGroupAppQueryError
 
     result = harness.service.get_group(_context(), group_id=GROUP_ID)
 
-    assert result["group"]["app_ids"] == [APP_ID]
-    assert result["group"]["apps"] == []
+    assert result.app_ids == (APP_ID,)
+    assert result.apps == ()
 
 
 @pytest.mark.parametrize(("paid", "expected"), [(True, True), (False, False)])
 def test_app_effective_enabled_is_bounded_by_final_entitlement(paid: bool, expected: bool) -> None:
     harness = _harness(paid=paid, app_mode="chat")
-    harness.control_plane.get_app_binding.return_value = {
-        "entitled": True,
-        "effectiveEnabled": True,
-        "binding": {
-            "enabled": True,
-            "groupId": GROUP_ID,
-            "accessPoints": ["webapp", "service_api"],
-        },
-    }
+    saved = _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "service_api"))
+    harness.control_plane.get_app_binding.return_value = _config(saved, effective_enabled=True)
 
     result = harness.service.get_app_binding(_context(), app_id=APP_ID)
 
-    assert result["effective_enabled"] is expected
-    assert result["binding"]["enabled"] is True
+    assert result.effective_enabled is expected
+    assert result.binding is not None
+    assert result.binding.enabled is True
+    assert harness.control_plane.get_app_binding.return_value.entitled is True
 
 
 def test_app_effective_enabled_does_not_reenable_an_incomplete_filtered_binding() -> None:
     harness = _harness(app_mode="agent")
-    harness.control_plane.update_app_binding.return_value = {
-        "effectiveEnabled": True,
-        "binding": {
-            "enabled": True,
-            "groupId": GROUP_ID,
-            "accessPoints": ["mcp"],
-        },
-    }
+    harness.control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(
+        _binding(enabled=True, group_id=GROUP_ID, access_points=("mcp",)), True
+    )
 
     result = harness.service.update_app_binding(
         _context(),
@@ -611,9 +630,10 @@ def test_app_effective_enabled_does_not_reenable_an_incomplete_filtered_binding(
         expected_version=1,
     )
 
-    assert result["binding"]["enabled"] is True
-    assert result["binding"]["access_points"] == []
-    assert result["effective_enabled"] is False
+    assert result.binding.enabled is True
+    assert result.binding.group_id == GROUP_ID
+    assert result.binding.access_points == ()
+    assert result.effective_enabled is False
 
 
 @pytest.mark.parametrize(("paid", "expected"), [(True, 2), (False, 0)])
@@ -622,45 +642,30 @@ def test_group_enforcing_count_is_normalized_and_bounded_by_final_entitlement(
     expected: int,
 ) -> None:
     harness = _harness(paid=paid)
-    harness.control_plane.list_groups.return_value = {
-        "entitled": True,
-        "groups": [{"id": GROUP_ID, "enforcingCount": 2, "usedByCount": 3}],
-    }
+    harness.control_plane.list_groups.return_value = _groups((_group(enforcing_count=2, used_by_count=3),))
 
     result = harness.service.list_groups(_context())
 
-    assert result["groups"][0]["enforcing_count"] == expected
+    assert result.groups[0].enforcing_count == expected
 
 
-def test_group_enforcing_count_materializes_omitted_protojson_zero() -> None:
+def test_group_with_zero_enforcement_retains_zero() -> None:
     harness = _harness()
-    harness.control_plane.get_group.return_value = {"group": {"id": GROUP_ID}}
+    harness.control_plane.get_group.return_value = _group()
 
     result = harness.service.get_group(_context(), group_id=GROUP_ID)
 
-    assert result["group"]["enforcing_count"] == 0
+    assert result.enforcing_count == 0
 
 
 def test_group_enrichment_includes_agent_routing_metadata() -> None:
     harness = _harness()
-    harness.control_plane.get_group.return_value = {
-        "group": {"id": GROUP_ID, "used_by_app_ids": [APP_ID], "used_by_count": 1}
-    }
+    harness.control_plane.get_group.return_value = _group(app_ids=(APP_ID,))
     harness.apps.list_apps.return_value = [_app(app_id=APP_ID, mode="agent", name="Agent", bound_agent_id="agent-1")]
 
     result = harness.service.get_group(_context(), group_id=GROUP_ID)
 
-    assert result["group"]["apps"] == [
-        {
-            "id": APP_ID,
-            "name": "Agent",
-            "icon": f"{APP_ID}.png",
-            "icon_type": "image",
-            "icon_background": "#FFFFFF",
-            "mode": "agent",
-            "bound_agent_id": "agent-1",
-        }
-    ]
+    assert result.apps == (_app(app_id=APP_ID, mode="agent", name="Agent", bound_agent_id="agent-1"),)
 
 
 def test_current_ip_check_authorizes_and_loads_tenant_policy_before_reading_ip() -> None:
@@ -668,7 +673,7 @@ def test_current_ip_check_authorizes_and_loads_tenant_policy_before_reading_ip()
     order: list[str] = []
     harness.memberships.get_role_for_account.side_effect = lambda **_kwargs: order.append("role") or "editor"
     harness.control_plane.get_group.side_effect = lambda *_args: (
-        order.append("policy") or {"group": {"version": "7", "allowedCidrs": ["2001:db8::/32"]}}
+        order.append("policy") or _group(version=7, allowed_cidrs=("2001:db8::/32",))
     )
 
     result = harness.service.check_current_ip(
@@ -678,7 +683,7 @@ def test_current_ip_check_authorizes_and_loads_tenant_policy_before_reading_ip()
     )
 
     assert order == ["role", "policy", "ip"]
-    assert result == {"client_ip": "2001:db8::42", "allowed": True, "policy_version": 7}
+    assert result == NetworkAccessCurrentIPCheck("2001:db8::42", True, 7)
 
 
 @pytest.mark.parametrize("role", ["owner", "admin", "editor"])
@@ -693,7 +698,7 @@ def test_current_ip_read_needs_no_policy_and_preserves_read_admission(role: str,
         client_ip_supplier=lambda: order.append("ip") or "2001:db8::42",
     )
 
-    assert result == {"client_ip": "2001:db8::42"}
+    assert result == "2001:db8::42"
     assert order == ["role", "ip"]
     harness.memberships.get_role_for_account.assert_called_once_with(
         workspace_id=WORKSPACE_ID,
@@ -756,7 +761,7 @@ def test_current_ip_check_matches_ipv4_ipv6_and_mapped_addresses_consistently(
     expected: bool,
 ) -> None:
     harness = _harness()
-    harness.control_plane.get_group.return_value = {"group": {"version": 1, "allowed_cidrs": allowed_cidrs}}
+    harness.control_plane.get_group.return_value = _group(allowed_cidrs=tuple(allowed_cidrs))
 
     result = harness.service.check_current_ip(
         _context(),
@@ -764,7 +769,7 @@ def test_current_ip_check_matches_ipv4_ipv6_and_mapped_addresses_consistently(
         client_ip_supplier=lambda: client_ip,
     )
 
-    assert result["allowed"] is expected
+    assert result.allowed is expected
 
 
 @pytest.mark.parametrize(
@@ -780,7 +785,7 @@ def test_current_ip_check_rejects_malformed_policy_without_short_circuiting(
     allowed_cidrs: list[str],
 ) -> None:
     harness = _harness()
-    harness.control_plane.get_group.return_value = {"group": {"version": 1, "allowed_cidrs": allowed_cidrs}}
+    harness.control_plane.get_group.return_value = _group(allowed_cidrs=tuple(allowed_cidrs))
 
     with pytest.raises(NetworkAccessGroupInvalidPolicyError):
         harness.service.check_current_ip(
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index 30e6568407ee9b..75f0e2f012ee90 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -154,7 +154,7 @@ def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: py
 
 def test_independent_binding_cleanup_task_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
     service = MagicMock()
-    service.cleanup_app_binding.return_value = {"deleted": True}
+    service.cleanup_app_binding.return_value = True
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
 
     with patch(

From a22026a2c1fb7816d2ac5ebddb2472c66c1bdbe4 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Wed, 23 Sep 2026 11:02:10 +0800
Subject: [PATCH 071/108] test(api): annotate MCP request lifecycle regression
 helpers

---
 .../common/test_access_response.py            | 11 +++++-----
 .../unit_tests/controllers/mcp/test_mcp.py    | 21 ++++++++++++++-----
 2 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
index 646d8ebbc58e08..92fb574ae555a6 100644
--- a/api/tests/unit_tests/controllers/common/test_access_response.py
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -3,7 +3,7 @@
 import io
 import json
 import logging
-from collections.abc import Iterator
+from collections.abc import Buffer, Generator
 from contextlib import contextmanager
 from types import SimpleNamespace
 from typing import Literal, Never, override
@@ -361,7 +361,7 @@ def test_mcp_reads_body_outside_sessions_and_rechecks_identity_before_execution(
     remaining = iter((initial, execution))
 
     @contextmanager
-    def begin() -> Iterator[MagicMock]:
+    def begin() -> Generator[MagicMock]:
         session = next(remaining)
         opened.append(session)
         active_sessions.append(session)
@@ -390,10 +390,9 @@ def read(self, size: int | None = -1) -> bytes:
             return super().read(size)
 
         @override
-        def readinto(self, buffer) -> int:
-            data = self.read(len(buffer))
-            buffer[: len(data)] = data
-            return len(data)
+        def readinto(self, buffer: Buffer) -> int:
+            read_sessions.append(bool(active_sessions))
+            return super().readinto(buffer)
 
     payload = b'{"jsonrpc":"2.0","method":"ping","id":900719925474099312345678901234567890}'
     response = client.post(
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp.py b/api/tests/unit_tests/controllers/mcp/test_mcp.py
index f79568f0a97af9..2a473177a9aab0 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp.py
@@ -13,6 +13,7 @@
 from flask import Flask, Response
 from pydantic import ValidationError
 from sqlalchemy import inspect
+from sqlalchemy.orm import Session
 
 import controllers.mcp.mcp as module
 from models.engine import db
@@ -551,21 +552,31 @@ def _tools_call_payload() -> dict[str, object]:
     }
 
 
-def test_execution_reloads_attached_orm_objects_after_identity_preflight(app: Flask, monkeypatch: pytest.MonkeyPatch):
+def test_execution_reloads_attached_orm_objects_after_identity_preflight(
+    app: Flask, monkeypatch: pytest.MonkeyPatch
+) -> None:
     app_model = _app(module.AppMode.CHAT, with_model_config=True)
     server = _server(module.AppMCPServerStatus.ACTIVE)
     db.session.add_all([app_model, server])
     db.session.commit()
     api = module.MCPAppApi()
     lookup = api._get_mcp_server_and_app
-    snapshots = []
+    snapshots: list[tuple[module.AppMCPServer, module.App]] = []
 
-    def observe_lookup(code, session):
+    def observe_lookup(code: str, session: Session) -> tuple[module.AppMCPServer, module.App]:
         pair = lookup(code, session)
         snapshots.append(pair)
         return pair
 
-    def process(_mcp_request, _request_id, fresh_app, fresh_server, _form, session, _protocol):
+    def process(
+        _mcp_request: module.mcp_types.ClientRequest | module.mcp_types.ClientNotification,
+        _request_id: int | str | None,
+        fresh_app: module.App,
+        fresh_server: module.AppMCPServer,
+        _form: list[module.VariableEntity],
+        session: Session,
+        _protocol: str,
+    ) -> Response:
         old_server, old_app = snapshots[0]
         assert inspect(old_server).detached
         assert inspect(old_app).detached
@@ -585,7 +596,7 @@ def process(_mcp_request, _request_id, fresh_app, fresh_server, _form, session,
 
 
 @pytest.mark.usefixtures("app")
-def test_identity_query_does_not_accept_a_server_bound_to_another_tenants_app():
+def test_identity_query_does_not_accept_a_server_bound_to_another_tenants_app() -> None:
     app_model = _app(module.AppMode.CHAT)
     server = _server(module.AppMCPServerStatus.ACTIVE)
     server.tenant_id = str(uuid4())

From 1378a72c8cd6ffa55760abd54d8dae25f0650479 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Wed, 23 Sep 2026 15:07:45 +0800
Subject: [PATCH 072/108] fix(web): restore sign-in from unavailable app page
 (SNP-852)

---
 web/features/app-access-error/page.tsx | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/web/features/app-access-error/page.tsx b/web/features/app-access-error/page.tsx
index f03022767d88e6..806f1b8b11c262 100644
--- a/web/features/app-access-error/page.tsx
+++ b/web/features/app-access-error/page.tsx
@@ -12,7 +12,6 @@ import { DifyLogo } from '@/app/components/base/logo/dify-logo'
 import ThemeSelector from '@/app/components/base/theme-selector'
 import { loadI18nResource } from '@/i18n-config/load-resource'
 import { getInitOptions } from '@/i18n-config/settings'
-import Link from '@/next/link'
 import { usePathname, useSearchParams } from '@/next/navigation'
 import { basePath } from '@/utils/var'
 import { getBrowserLocale } from './locale'
@@ -34,6 +33,7 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
   const searchParams = useSearchParams()
   const query = searchParams.toString()
   const returnTo = `${pathname}${query ? `?${query}` : ''}`
+  const signInHref = `${basePath}/signin?${new URLSearchParams({ redirect_url: returnTo })}`
   const [copyrightYear] = useState(() => new Date().getFullYear())
   const title = t(($) => $['appNotAccessible.documentTitle'])
   const ip = getClientIp({ client_ip: clientIp })
@@ -68,9 +68,8 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
             />
             <ThemeSelector />
             <span aria-hidden className="h-3.5 w-px shrink-0 bg-divider-regular" />
-            <Link
-              href={{ pathname: '/signin', query: { redirect_url: returnTo } }}
-              prefetch={false}
+            <a
+              href={signInHref}
               className="inline-flex shrink-0 items-center rounded-full p-0.5 text-components-button-secondary-text hover:bg-state-base-hover focus-visible:ring-2 focus-visible:ring-state-accent-solid focus-visible:outline-hidden"
             >
               <span
@@ -88,7 +87,7 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
               <span className="px-2 system-sm-medium whitespace-nowrap">
                 {t(($) => $.signBtn, { ns: 'login' })}
               </span>
-            </Link>
+            </a>
           </div>
         </header>
         <Content className="flex flex-1 items-center justify-center px-6 pt-12 pb-12 md:pb-30">

From 3eb6fe394830c3a1da03c05c9f240950e4412e56 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Wed, 23 Sep 2026 15:13:32 +0800
Subject: [PATCH 073/108] fix(web): refresh IP policy after version conflict
 (SNP-853)

---
 .../ip-policies-page/__tests__/index.spec.tsx | 131 ++++++++++++++++++
 .../ip-policies-page/index.tsx                |  73 ++++++++--
 .../ip-policies-page/policy-dialog.tsx        |  19 ++-
 3 files changed, 206 insertions(+), 17 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 824c6ace354746..b9d0e81dc7942d 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -162,6 +162,137 @@ describe('IpPoliciesPage', () => {
     },
   )
 
+  it('reloads a conflicting policy from the server before another save', async () => {
+    const user = userEvent.setup()
+    const original = createNetworkAccessGroupFixture({ version: 1 })
+    const remote = createNetworkAccessGroupFixture({ name: 'Allow-Remote', version: 2 })
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { groups: [original] })
+    const requests: Request[] = []
+    const putBodies: unknown[] = []
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      requests.push(request)
+      if (request.url.endsWith('/current-ip')) return Response.json({ client_ip: '203.0.113.42' })
+      if (request.method === 'GET')
+        return Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [remote] })
+      putBodies.push(JSON.parse(await request.clone().text()))
+      if (requests.filter((item) => item.method === 'PUT').length === 1)
+        return Response.json({ code: 'network_access_conflict' }, { status: 409 })
+      return Response.json({ group: remote, entitled: true })
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+    await user.clear(screen.getByRole('textbox', { name: 'Name' }))
+    await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Allow-Local')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Allow-Remote'),
+    )
+    expect(
+      requests.filter(
+        (request) => request.method === 'GET' && !request.url.endsWith('/current-ip'),
+      ),
+    ).toHaveLength(1)
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await user.click(screen.getByRole('button', { name: 'Allow-Remote' }))
+    expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Allow-Remote')
+    await user.clear(screen.getByRole('textbox', { name: 'Name' }))
+    await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Confirmed')
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(requests.filter((request) => request.method === 'PUT')).toHaveLength(2),
+    )
+    expect(putBodies[1]).toMatchObject({
+      name: 'Confirmed',
+      expected_version: 2,
+    })
+  })
+
+  it('offers a retry when conflict recovery cannot reload the policy', async () => {
+    const user = userEvent.setup()
+    const original = createNetworkAccessGroupFixture({ version: 1 })
+    const remote = createNetworkAccessGroupFixture({ name: 'Allow-Remote', version: 2 })
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { groups: [original] })
+    let getCount = 0
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      if (request.url.endsWith('/current-ip')) return Response.json({ client_ip: '203.0.113.42' })
+      if (request.method === 'GET') {
+        getCount += 1
+        return getCount === 1
+          ? Response.json({ message: 'Unavailable' }, { status: 500 })
+          : Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [remote] })
+      }
+      return Response.json({ code: 'network_access_conflict' }, { status: 409 })
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    expect(await screen.findByRole('alert')).toHaveTextContent('Failed to load')
+    expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    await user.click(screen.getByRole('button', { name: 'Try Again' }))
+    await waitFor(() =>
+      expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Allow-Remote'),
+    )
+    expect(getCount).toBe(2)
+  })
+
+  it('does not replace another edit session with a late conflict response', async () => {
+    const user = userEvent.setup()
+    const original = createNetworkAccessGroupFixture({ version: 1 })
+    const other = createNetworkAccessGroupFixture({ id: 'group-2', name: 'Other Policy' })
+    const remote = createNetworkAccessGroupFixture({ name: 'Allow-Remote', version: 2 })
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { groups: [original, other] })
+    let resolveReload!: (response: Response) => void
+    const reload = new Promise<Response>((resolve) => {
+      resolveReload = resolve
+    })
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      if (request.url.endsWith('/current-ip')) return Response.json({ client_ip: '203.0.113.42' })
+      return request.method === 'GET'
+        ? reload
+        : Response.json({ code: 'network_access_conflict' }, { status: 409 })
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+    )
+
+    await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(screen.getByRole('button', { name: 'Save' })).toHaveAttribute('aria-disabled', 'true'),
+    )
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await user.click(screen.getByRole('button', { name: 'Other Policy' }))
+    await act(async () => {
+      resolveReload(
+        Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [remote, other] }),
+      )
+    })
+    expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Other Policy')
+  })
+
   it.each(['create', 'edit', 'delete'] as const)(
     'stops %s when manager permission is revoked',
     async (action) => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index f6735586f8eace..323b3dc6153af1 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -5,7 +5,7 @@ import { Button } from '@langgenius/dify-ui/button'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
-import { useState } from 'react'
+import { useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { getNetworkAccessErrorStatus } from '@/app/components/app/access-point/access-control/network-access'
 import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
@@ -74,17 +74,42 @@ export default function IpPoliciesPage() {
     consoleQuery.workspaces.current.networkAccessGroups.byGroupId.put.mutationOptions(),
   )
   const [dialogState, setDialogState] = useState<DialogState>(null)
+  const dialogSessionRef = useRef(0)
+  const [isRecovering, setIsRecovering] = useState(false)
+  const [recoveryError, setRecoveryError] = useState(false)
   const groups = data?.groups ?? []
   const entitled = data?.entitled === true
   const canMutate = canManagePolicies && entitled
   const selectedGroup = dialogState && dialogState.mode !== 'create' ? dialogState.group : null
   const isSaving = createGroup.isPending || updateGroup.isPending
 
-  const refreshGroupsAfterConflict = async (groupId?: string) => {
-    const refreshed = await queryClient.fetchQuery(groupsQuery)
-    if (!groupId) return
-    const nextGroup = refreshed.groups.find((group) => group.id === groupId)
-    setDialogState(nextGroup ? { mode: 'edit', group: nextGroup } : null)
+  const openDialog = (next: DialogState) => {
+    dialogSessionRef.current += 1
+    setIsRecovering(false)
+    setRecoveryError(false)
+    setDialogState(next)
+  }
+
+  const refreshGroupsAfterConflict = async (groupId: string, session: number) => {
+    if (dialogSessionRef.current !== session) return
+    setIsRecovering(true)
+    setRecoveryError(false)
+    try {
+      const refreshed = await queryClient.query({ ...groupsQuery, staleTime: 0 })
+      if (dialogSessionRef.current !== session) return
+      const nextGroup = refreshed.groups.find((group) => group.id === groupId)
+      setDialogState((current) =>
+        current?.mode === 'edit' && current.group.id === groupId
+          ? nextGroup
+            ? { mode: 'edit', group: nextGroup }
+            : null
+          : current,
+      )
+    } catch {
+      if (dialogSessionRef.current === session) setRecoveryError(true)
+    } finally {
+      if (dialogSessionRef.current === session) setIsRecovering(false)
+    }
   }
 
   const handleOpenCreate = () => {
@@ -93,7 +118,7 @@ export default function IpPoliciesPage() {
       void setPricing('open')
       return
     }
-    setDialogState({ mode: 'create' })
+    openDialog({ mode: 'create' })
   }
 
   if (!canReadPolicies) return null
@@ -156,10 +181,10 @@ export default function IpPoliciesPage() {
               key={group.id}
               group={group}
               canMutate={canMutate}
-              onView={(group) => setDialogState({ mode: canMutate ? 'edit' : 'view', group })}
+              onView={(group) => openDialog({ mode: canMutate ? 'edit' : 'view', group })}
               onEdit={(group) => {
                 if (!canMutate) return
-                setDialogState({ mode: 'edit', group })
+                openDialog({ mode: 'edit', group })
               }}
             />
           ))}
@@ -168,18 +193,32 @@ export default function IpPoliciesPage() {
 
       {dialogState && (dialogState.mode !== 'create' || canMutate) && (
         <IpPolicyDialog
+          key={selectedGroup ? `${selectedGroup.id}:${selectedGroup.version}` : 'create'}
           mode={canMutate ? dialogState.mode : 'view'}
           open
           initialName={selectedGroup?.name}
           initialEntries={selectedGroup?.allowed_cidrs}
           usedByCount={selectedGroup?.used_by_count}
           referencedApps={selectedGroup?.apps}
-          isPending={isSaving}
+          isPending={isSaving || isRecovering}
+          recoveryError={recoveryError}
+          onRetryRecovery={() => {
+            if (selectedGroup)
+              void refreshGroupsAfterConflict(selectedGroup.id, dialogSessionRef.current)
+          }}
           onOpenChange={(open) => {
-            if (!open) setDialogState(null)
+            if (!open) openDialog(null)
           }}
           onSubmit={(payload) => {
-            if (!canMutate || isSaving || dialogState.mode === 'view') return
+            if (
+              !canMutate ||
+              isSaving ||
+              isRecovering ||
+              recoveryError ||
+              dialogState.mode === 'view'
+            )
+              return
+            const session = dialogSessionRef.current
             if (selectedGroup) {
               updateGroup.mutate(
                 {
@@ -192,10 +231,12 @@ export default function IpPoliciesPage() {
                   },
                 },
                 {
-                  onSuccess: () => setDialogState(null),
+                  onSuccess: () => {
+                    if (dialogSessionRef.current === session) openDialog(null)
+                  },
                   onError: (error) => {
                     if (getNetworkAccessErrorStatus(error) !== 409) return
-                    void refreshGroupsAfterConflict(selectedGroup.id)
+                    void refreshGroupsAfterConflict(selectedGroup.id, session)
                   },
                 },
               )
@@ -211,7 +252,9 @@ export default function IpPoliciesPage() {
                 },
               },
               {
-                onSuccess: () => setDialogState(null),
+                onSuccess: () => {
+                  if (dialogSessionRef.current === session) openDialog(null)
+                },
               },
             )
           }}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 09c2996a9b512b..05ee98c1d61d78 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -39,6 +39,8 @@ type IpPolicyDialogProps = {
   usedByCount?: number
   referencedApps?: NetworkAccessGroupResponse['apps']
   isPending?: boolean
+  recoveryError?: boolean
+  onRetryRecovery?: () => void
   onOpenChange: (open: boolean) => void
   onSubmit?: (payload: IpPolicyDialogSubmit) => void
 }
@@ -52,6 +54,8 @@ export function IpPolicyDialog({
   usedByCount = 0,
   referencedApps = [],
   isPending = false,
+  recoveryError = false,
+  onRetryRecovery,
   onOpenChange,
   onSubmit,
 }: IpPolicyDialogProps) {
@@ -167,7 +171,7 @@ export function IpPolicyDialog({
             className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto"
             onSubmit={(event) => {
               event.preventDefault()
-              if (!canSubmit || isPending) return
+              if (!canSubmit || isPending || recoveryError) return
               onSubmit?.({
                 name: name.trim(),
                 allowed_cidrs: collectAllowedCidrs(entryValues),
@@ -206,6 +210,17 @@ export function IpPolicyDialog({
               </Field>
             )}
 
+            {recoveryError && (
+              <div role="alert" className="flex shrink-0 items-center justify-between gap-3">
+                <p className="system-sm-regular text-text-destructive">
+                  {t(($) => $['common.loadFailed'], { ns: 'deployments' })}
+                </p>
+                <Button type="button" variant="secondary" onClick={onRetryRecovery}>
+                  {t(($) => $['errorBoundary.tryAgain'], { ns: 'common' })}
+                </Button>
+              </div>
+            )}
+
             <div className="flex shrink-0 items-center justify-end gap-2 pt-2">
               <Button type="button" variant="secondary" onClick={() => onOpenChange(false)}>
                 {t(($) => $['operation.cancel'], { ns: 'common' })}
@@ -213,7 +228,7 @@ export function IpPolicyDialog({
               <Button
                 type="submit"
                 variant="primary"
-                disabled={!canSubmit || isPending}
+                disabled={!canSubmit || isPending || recoveryError}
                 loading={isPending}
               >
                 {mode === 'edit'

From bec385be7d13031346dc1ed0f17ad362fb114ea4 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Wed, 23 Sep 2026 15:16:48 +0800
Subject: [PATCH 074/108] fix(web): gate Chatflow access points on publication
 (SNP-854)

---
 .../__tests__/built-in-access-points.spec.tsx | 60 +++++++++++++++++++
 .../built-in-access-points/index.tsx          |  5 +-
 .../app/access-point/shared/utils.ts          |  6 +-
 3 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
index c4ba3dd2d24669..e2f2408ed99baf 100644
--- a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
@@ -169,6 +169,66 @@ describe('BuiltInAccessPoints', () => {
     )
   })
 
+  it('keeps an unpublished Chatflow unavailable without showing a Trigger card', () => {
+    mocks.appInfo = {
+      ...mocks.appInfo,
+      mode: 'advanced-chat',
+      enable_site: true,
+      enable_api: true,
+    }
+    render(
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+    )
+
+    expect(screen.getByText('deployments.studio.accessPoint.noPublishedTitle')).toBeInTheDocument()
+    expect(mocks.webCard).toHaveBeenCalledWith(
+      expect.objectContaining({ availability: 'unavailable' }),
+    )
+    expect(mocks.apiCard).toHaveBeenCalledWith(
+      expect.objectContaining({ availability: 'unavailable' }),
+    )
+    expect(mocks.mcpCard).toHaveBeenCalledWith(
+      expect.objectContaining({ triggerModeDisabled: false }),
+    )
+    expect(mocks.triggerCard).not.toHaveBeenCalled()
+    expect(mocks.useAppWorkflow).toHaveBeenCalledWith('app-1', expect.any(Object))
+  })
+
+  it.each([
+    ['loading', { data: null, isError: false, isPending: true }, 'loading'],
+    ['failed', { data: null, isError: true, isPending: false }, 'unavailable'],
+    [
+      'published',
+      {
+        data: { graph: { nodes: [{ data: { type: 'start' } }] } },
+        isError: false,
+        isPending: false,
+      },
+      'available',
+    ],
+  ] as const)(
+    'shows Chatflow access points as %s while published workflow is %s',
+    (_state, workflow, availability) => {
+      mocks.appInfo = {
+        ...mocks.appInfo,
+        mode: 'advanced-chat',
+        enable_site: true,
+        enable_api: true,
+      }
+      mocks.workflow = workflow
+      render(
+        <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      )
+
+      expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability }))
+      expect(mocks.apiCard).toHaveBeenCalledWith(expect.objectContaining({ availability }))
+      expect(mocks.triggerCard).not.toHaveBeenCalled()
+      expect(
+        screen.queryByText('deployments.studio.accessPoint.noPublishedTitle'),
+      ).not.toBeInTheDocument()
+    },
+  )
+
   it('uses Access Point management for every requested built-in operation', () => {
     render(
       <BuiltInAccessPoints
diff --git a/web/app/components/app/access-point/built-in-access-points/index.tsx b/web/app/components/app/access-point/built-in-access-points/index.tsx
index 1713f41cdbd414..6aa93375fb9278 100644
--- a/web/app/components/app/access-point/built-in-access-points/index.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/index.tsx
@@ -54,9 +54,10 @@ export function BuiltInAccessPoints({
   if (!appInfo) return <Loading />
 
   const workflowState = getPublishedWorkflowState(appInfo, workflow)
-  const builtInLoading = workflowState.isWorkflowApp && workflowLoading
+  const builtInLoading = workflowState.requiresPublishedWorkflow && workflowLoading
   const appCardsUnavailable =
-    workflowState.isWorkflowApp && (workflowState.isUnpublished || workflowState.hasTriggerNode)
+    workflowState.requiresPublishedWorkflow &&
+    (workflowError || workflowState.isUnpublished || workflowState.hasTriggerNode)
   const appCardAvailability = builtInLoading
     ? 'loading'
     : appCardsUnavailable
diff --git a/web/app/components/app/access-point/shared/utils.ts b/web/app/components/app/access-point/shared/utils.ts
index ad06c1b8786354..b0833cfa61181d 100644
--- a/web/app/components/app/access-point/shared/utils.ts
+++ b/web/app/components/app/access-point/shared/utils.ts
@@ -33,15 +33,17 @@ export function getPublishedWorkflowState(
   workflow: PublishedWorkflow,
 ) {
   const isWorkflowApp = appInfo.mode === AppModeEnum.WORKFLOW
+  const requiresPublishedWorkflow = isAdvancedApp(appInfo)
   const nodes = getPublishedWorkflowNodes(workflow)
   const hasStartNode = nodes.some((node) => node.data.type === BlockEnum.Start)
-  const hasTriggerNode = nodes.some((node) => isTriggerNode(node.data.type))
+  const hasTriggerNode = isWorkflowApp && nodes.some((node) => isTriggerNode(node.data.type))
 
   return {
     hasStartNode,
     hasTriggerNode,
-    isUnpublished: isWorkflowApp && !workflow?.graph,
+    isUnpublished: requiresPublishedWorkflow && !workflow?.graph,
     isWorkflowApp,
+    requiresPublishedWorkflow,
   }
 }
 

From 4e9644183d14541694d0f63022c43c06861728f8 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Tue, 29 Sep 2026 09:00:17 +0000
Subject: [PATCH 075/108] [autofix.ci] apply automated fixes

---
 api/controllers/web/login.py                       | 1 -
 api/tests/unit_tests/controllers/web/test_wraps.py | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/api/controllers/web/login.py b/api/controllers/web/login.py
index a0f5c2d9276262..ee912a9e2165c8 100644
--- a/api/controllers/web/login.py
+++ b/api/controllers/web/login.py
@@ -45,7 +45,6 @@
 from services.account_service import AccountService
 from services.entities.auth_audit_entities import LoginFailureReason
 from services.entities.auth_entities import LoginPayloadBase
-from services.webapp_access_query_service import WebAppAccessAppNotFoundError, WebAppAccessUnavailableError
 from services.webapp_auth_service import WebAppAuthService
 
 logger = logging.getLogger(__name__)
diff --git a/api/tests/unit_tests/controllers/web/test_wraps.py b/api/tests/unit_tests/controllers/web/test_wraps.py
index 0dec3788aafe76..ca6284231ce569 100644
--- a/api/tests/unit_tests/controllers/web/test_wraps.py
+++ b/api/tests/unit_tests/controllers/web/test_wraps.py
@@ -211,6 +211,8 @@ def post(self, _app: App, _end_user: EndUser) -> Never:
         if missing == "resource":
             assert response.get_json()["message"] == "Conversation not found."
     assert calls == (["view"] if missing == "resource" else [])
+
+
 @pytest.mark.usefixtures("app_query_services")
 @pytest.mark.parametrize("token", [None, "expired-token"])
 def test_web_auth_rejects_unknown_app_code_with_http_not_found(app, monkeypatch, token):

From 20a8125b8da18a27db7d9a70da2c66adb9315dfb Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 29 Sep 2026 18:24:57 +0800
Subject: [PATCH 076/108] fix(web): align add IP policy dropdown action with
 design

---
 .../access-control/__tests__/config-panel.spec.tsx   |  6 +++---
 .../access-control/__tests__/index.spec.tsx          | 12 ++++++------
 .../app/access-point/access-control/policy-field.tsx |  8 ++++----
 web/i18n/locales/en-US/deployments.json              |  2 +-
 4 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index 8c309bfcedcf80..a11e8a457e6fcf 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -142,9 +142,9 @@ describe('AccessControlConfigPanel', () => {
 
       if (selectedPolicyId) {
         await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-        await user.click(await screen.findByRole('option', { name: 'Add IP Policy' }))
+        await user.click(await screen.findByRole('option', { name: 'Add an IP policy' }))
       } else {
-        await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
+        await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
       }
 
       expect(onCreatePolicy).toHaveBeenCalledOnce()
@@ -160,7 +160,7 @@ describe('AccessControlConfigPanel', () => {
     ({ manageLabel, ...permissions }) => {
       render(<PanelHarness {...permissions} />)
 
-      expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
       expect(screen.getByRole('button', { name: manageLabel })).toBeEnabled()
     },
   )
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index e2373aa677f21f..18c59b4c42e805 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -340,7 +340,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
 
     expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
     expect(mockSetSettingsDestination).not.toHaveBeenCalled()
@@ -351,7 +351,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
     await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Cancel' }))
 
     await waitFor(() => {
@@ -397,7 +397,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add IP Policy' }))
+    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
     await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
     await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
     await user.click(screen.getByRole('button', { name: 'Create' }))
@@ -823,7 +823,7 @@ describe('supported access points and binding permission', () => {
     await user.click(getChip())
 
     expect(screen.getByText('Ask a workspace owner or admin to create one.')).toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
     expect(
       screen.queryByRole('button', { name: /(?:Manage|View) IP policies/ }),
     ).not.toBeInTheDocument()
@@ -849,7 +849,7 @@ describe('supported access points and binding permission', () => {
         groups: [createNetworkAccessGroupFixture()],
       })
       await user.click(getChip())
-      expect(screen.queryByRole('button', { name: 'Add IP Policy' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
       await user.click(screen.getByRole('button', { name: 'View IP policies' }))
       expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
       await user.click(getChip())
@@ -1476,7 +1476,7 @@ describe('returning from policy creation', () => {
       await screen.findByText(lockoutWarning)
       await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
       await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-      await user.click(screen.getByRole('option', { name: 'Add IP Policy' }))
+      await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
       const dialog = await screen.findByRole('dialog')
       if (action !== 'cancel') {
         await user.type(within(dialog).getByRole('textbox', { name: 'Name' }), 'New Office')
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 0820d8208a6243..8908eafe34c92f 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -110,8 +110,8 @@ export function AccessControlPolicyField({
       {canCreatePolicy && (
         <>
           <SelectSeparator />
-          <SelectItem value={CREATE_POLICY_VALUE}>
-            <SelectItemText>
+          <SelectItem value={CREATE_POLICY_VALUE} className="h-7.5 rounded-md text-text-accent">
+            <SelectItemText className="px-0">
               {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
             </SelectItemText>
           </SelectItem>
@@ -172,8 +172,8 @@ export function AccessControlPolicyField({
               <div className="my-1 h-px bg-divider-subtle" />
               <Button
                 type="button"
-                variant="ghost"
-                className="w-full justify-start"
+                variant="ghost-accent"
+                className="h-7.5 w-full justify-start rounded-md px-2 system-sm-medium text-text-accent"
                 onClick={onCreatePolicy}
               >
                 {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index d80afd38b6e12a..2b3bbc13033b74 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -40,7 +40,7 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.chipPaused": "Pause",
-  "studio.accessControl.createIpPolicy": "Add IP Policy",
+  "studio.accessControl.createIpPolicy": "Add an IP policy",
   "studio.accessControl.description": "Control access to this app by applying an IP policy.",
   "studio.accessControl.downgradeDescription": "Access control is available on Professional and Team plans.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",

From 2b4eee88d3c904d1612541fe8ab07e6060aa36e7 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 29 Sep 2026 18:40:17 +0800
Subject: [PATCH 077/108] fix(web): sync generated types for IP policy label

---
 web/i18n/resources.generated.d.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 54013f63553903..4ee3e21dc0d729 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -2995,7 +2995,7 @@ export default interface Resources {
     'studio.accessControl.chipOn': 'ON'
     'studio.accessControl.chipPartial': '{{n}} of {{m}}'
     'studio.accessControl.chipPaused': 'Pause'
-    'studio.accessControl.createIpPolicy': 'Add IP Policy'
+    'studio.accessControl.createIpPolicy': 'Add an IP policy'
     'studio.accessControl.description': 'Control access to this app by applying an IP policy.'
     'studio.accessControl.downgradeDescription': 'Access control is available on Professional and Team plans.'
     'studio.accessControl.downgradeTitle': 'This app is no longer protected'

From b47d5fbfb25c7394ec0f8d1f2dee429a0933da61 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 29 Sep 2026 19:14:29 +0800
Subject: [PATCH 078/108] fix(ci): align IP access control checks and tests

---
 api/controllers/common/access_response.py     |  2 +-
 .../controllers/web/test_site.py              | 10 ++---
 .../common/test_access_response.py            |  5 ++-
 .../common/test_app_access_error.py           |  8 ++--
 .../web/test_public_app_admission.py          | 13 ++++--
 .../unit_tests/controllers/web/test_site.py   |  4 +-
 .../controllers/web/test_web_login.py         | 44 ++++++++++++-------
 .../unit_tests/controllers/web/test_wraps.py  |  4 +-
 .../test_webapp_access_query_service.py       | 16 ++++++-
 .../apps/web-app-service.steps.ts             | 12 ++++-
 .../[appId]/__tests__/layout-main.spec.tsx    | 22 ++++++----
 .../access-control/chip-affix.tsx             |  2 +-
 .../access-control/config-panel.tsx           |  2 +-
 .../access-control/downgrade-panel.tsx        |  2 +-
 .../access-control/free-paywall.tsx           |  2 +-
 .../access-control/restricted-preview.tsx     |  2 +-
 .../base/chat/chat/__tests__/hooks.spec.tsx   |  2 +-
 web/app/components/base/chat/chat/hooks.ts    |  2 +-
 .../components/base/file-uploader/hooks.ts    |  2 +-
 .../components/base/image-uploader/hooks.ts   |  2 +-
 .../ip-policies-page/index.tsx                |  4 +-
 .../ip-policies-page/policy-dialog.tsx        |  2 +-
 .../ip-policies-page/policy-item.tsx          |  2 +-
 .../ip-policies-page/referenced-apps.tsx      |  2 +-
 web/features/app-access-error/page.tsx        |  1 +
 web/features/app-access-error/state.ts        |  5 +--
 web/i18n/locales/ar-TN/common.json            |  3 --
 web/i18n/locales/ar-TN/deployments.json       |  2 -
 web/i18n/locales/de-DE/common.json            |  3 --
 web/i18n/locales/de-DE/deployments.json       |  2 -
 web/i18n/locales/en-US/common.json            |  3 --
 web/i18n/locales/en-US/deployments.json       |  2 -
 web/i18n/locales/es-ES/common.json            |  3 --
 web/i18n/locales/es-ES/deployments.json       |  2 -
 web/i18n/locales/fa-IR/common.json            |  3 --
 web/i18n/locales/fa-IR/deployments.json       |  2 -
 web/i18n/locales/fr-FR/common.json            |  3 --
 web/i18n/locales/fr-FR/deployments.json       |  2 -
 web/i18n/locales/hi-IN/common.json            |  3 --
 web/i18n/locales/hi-IN/deployments.json       |  2 -
 web/i18n/locales/id-ID/common.json            |  3 --
 web/i18n/locales/id-ID/deployments.json       |  2 -
 web/i18n/locales/it-IT/common.json            |  3 --
 web/i18n/locales/it-IT/deployments.json       |  2 -
 web/i18n/locales/ja-JP/common.json            |  3 --
 web/i18n/locales/ja-JP/deployments.json       |  2 -
 web/i18n/locales/ko-KR/common.json            |  3 --
 web/i18n/locales/ko-KR/deployments.json       |  2 -
 web/i18n/locales/lo-LA/common.json            |  3 --
 web/i18n/locales/lo-LA/deployments.json       |  2 -
 web/i18n/locales/nl-NL/common.json            |  3 --
 web/i18n/locales/nl-NL/deployments.json       |  2 -
 web/i18n/locales/pl-PL/common.json            |  3 --
 web/i18n/locales/pl-PL/deployments.json       |  2 -
 web/i18n/locales/pt-BR/common.json            |  3 --
 web/i18n/locales/pt-BR/deployments.json       |  2 -
 web/i18n/locales/ro-RO/common.json            |  3 --
 web/i18n/locales/ro-RO/deployments.json       |  2 -
 web/i18n/locales/ru-RU/common.json            |  3 --
 web/i18n/locales/ru-RU/deployments.json       |  2 -
 web/i18n/locales/sl-SI/common.json            |  3 --
 web/i18n/locales/sl-SI/deployments.json       |  2 -
 web/i18n/locales/th-TH/common.json            |  3 --
 web/i18n/locales/th-TH/deployments.json       |  2 -
 web/i18n/locales/tr-TR/common.json            |  3 --
 web/i18n/locales/tr-TR/deployments.json       |  2 -
 web/i18n/locales/uk-UA/common.json            |  3 --
 web/i18n/locales/uk-UA/deployments.json       |  2 -
 web/i18n/locales/vi-VN/common.json            |  3 --
 web/i18n/locales/vi-VN/deployments.json       |  2 -
 web/i18n/locales/zh-Hans/common.json          |  3 --
 web/i18n/locales/zh-Hans/deployments.json     |  2 -
 web/i18n/locales/zh-Hant/common.json          |  3 --
 web/i18n/locales/zh-Hant/deployments.json     |  2 -
 web/i18n/resources.generated.d.ts             |  5 ---
 .../__tests__/ip-access-denied.spec.ts        |  2 +-
 web/service/share.ts                          |  2 +-
 77 files changed, 111 insertions(+), 192 deletions(-)

diff --git a/api/controllers/common/access_response.py b/api/controllers/common/access_response.py
index c87b72e1c7d123..1d7e7630926643 100644
--- a/api/controllers/common/access_response.py
+++ b/api/controllers/common/access_response.py
@@ -120,7 +120,7 @@ def _mcp_request_id() -> str:
     try:
         if request.content_length is not None and request.content_length > MCP_ERROR_BODY_LIMIT:
             return "null"
-        cached = getattr(request, "_cached_data", None)
+        cached = vars(request).get("_cached_data")
         if cached is not None:
             return _parse_mcp_error_request_id(cached) if isinstance(cached, bytes) else "null"
         body = request.stream.read(MCP_ERROR_BODY_LIMIT + 1)
diff --git a/api/tests/test_containers_integration_tests/controllers/web/test_site.py b/api/tests/test_containers_integration_tests/controllers/web/test_site.py
index e5f6f83d768a4b..89a1ec9aaefc52 100644
--- a/api/tests/test_containers_integration_tests/controllers/web/test_site.py
+++ b/api/tests/test_containers_integration_tests/controllers/web/test_site.py
@@ -7,8 +7,8 @@
 import pytest
 from flask import Flask
 from sqlalchemy.orm import Session
-from werkzeug.exceptions import Forbidden
 
+from controllers.web.error import WebAppNotFoundError
 from controllers.web.site import AppSiteApi, WebAppSiteResponse, WebModelConfigResponse
 from models import Tenant, TenantStatus
 from models.account import TenantCustomConfigDict
@@ -97,17 +97,17 @@ def test_happy_path(self, mock_features: MagicMock, app: Flask, db_session_with_
         assert result["enable_site"] is True
         assert result["mode"] == AppMode.CHAT
 
-    def test_missing_site_raises_forbidden(self, app: Flask, db_session_with_containers: Session) -> None:
+    def test_missing_site_raises_not_found(self, app: Flask, db_session_with_containers: Session) -> None:
         app.config["RESTX_MASK_HEADER"] = "X-Fields"
         tenant = _create_tenant(db_session_with_containers)
         app_model = _create_app(db_session_with_containers, tenant.id)
         end_user = _end_user(tenant.id, app_model.id)
 
         with app.test_request_context("/site"):
-            with pytest.raises(Forbidden):
+            with pytest.raises(WebAppNotFoundError):
                 AppSiteApi().get(app_model, end_user)
 
-    def test_archived_tenant_raises_forbidden(self, app: Flask, db_session_with_containers: Session) -> None:
+    def test_archived_tenant_raises_not_found(self, app: Flask, db_session_with_containers: Session) -> None:
         app.config["RESTX_MASK_HEADER"] = "X-Fields"
         tenant = _create_tenant(db_session_with_containers, status=TenantStatus.ARCHIVE)
         app_model = _create_app(db_session_with_containers, tenant.id)
@@ -115,7 +115,7 @@ def test_archived_tenant_raises_forbidden(self, app: Flask, db_session_with_cont
         end_user = _end_user(tenant.id, app_model.id)
 
         with app.test_request_context("/site"):
-            with pytest.raises(Forbidden):
+            with pytest.raises(WebAppNotFoundError):
                 AppSiteApi().get(app_model, end_user)
 
 
diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
index 92fb574ae555a6..7f527ebb8465a1 100644
--- a/api/tests/unit_tests/controllers/common/test_access_response.py
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -29,7 +29,8 @@
 from extensions import ext_request_logging
 from libs.external_api import ExternalApi
 from models.engine import db
-from models.enums import AppMCPServerStatus
+from services.app.mcp_server_service import AppMCPServerStatus
+from tests.unit_tests.config_override import apply_config_overrides
 
 type TokenClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
 type MCPClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
@@ -270,7 +271,7 @@ def test_mcp_debug_request_logging_preserves_raw_error_id(
     session.scalar.return_value = None
     caplog.set_level(logging.DEBUG, logger=ext_request_logging.__name__)
     # Exercise the real existing request-started logger, including request.data caching.
-    monkeypatch.setattr(ext_request_logging.dify_config, "ENABLE_REQUEST_LOGGING", True)
+    apply_config_overrides(monkeypatch, ENABLE_REQUEST_LOGGING=True)
     ext_request_logging.init_app(client.application)
     response = client.post("/mcp/server/missing-fixture/mcp", data=b'{"id":1.2500}', content_type="application/json")
     assert response.status_code == 404
diff --git a/api/tests/unit_tests/controllers/common/test_app_access_error.py b/api/tests/unit_tests/controllers/common/test_app_access_error.py
index f661eb0a00e96a..2f279428002310 100644
--- a/api/tests/unit_tests/controllers/common/test_app_access_error.py
+++ b/api/tests/unit_tests/controllers/common/test_app_access_error.py
@@ -11,10 +11,10 @@
 from werkzeug.exceptions import NotFound
 from werkzeug.middleware.proxy_fix import ProxyFix
 
-from configs import dify_config
 from controllers.common.app_access_error import register_app_access_error_metadata
 from libs.exception import BaseHTTPException
 from libs.external_api import ExternalApi
+from tests.unit_tests.config_override import apply_config_overrides
 
 APP_ID = "9d6e3fb3-94ce-48f9-a958-58ca80b1c02e"
 TRUSTED = "172.18.0.0/16,10.0.0.0/8,2400:cb00::/32"
@@ -90,7 +90,7 @@ def _path(rule: str) -> str:
 
 @pytest.fixture(autouse=True)
 def _trusted_proxies(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", TRUSTED)
+    apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=TRUSTED)
 
 
 @pytest.mark.parametrize("rule", WEB_IDENTITIES)
@@ -190,7 +190,7 @@ def test_trust_boundary_ignores_spoofed_arguments_and_headers(
 def test_missing_or_invalid_trust_configuration_preserves_original_404(
     monkeypatch: pytest.MonkeyPatch, config: str
 ) -> None:
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", config)
+    apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=config)
     response = (
         _create_app()
         .test_client()
@@ -216,7 +216,7 @@ def test_unavailable_client_ip_never_exposes_internal_peer_or_changes_status(for
 def test_unavailable_client_ip_removes_existing_unverified_metadata(
     monkeypatch: pytest.MonkeyPatch, config: str
 ) -> None:
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", config)
+    apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=config)
     payload = {
         "code": "app_not_found",
         "message": "missing",
diff --git a/api/tests/unit_tests/controllers/web/test_public_app_admission.py b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
index 81ff4a5846460b..16de6e60eace67 100644
--- a/api/tests/unit_tests/controllers/web/test_public_app_admission.py
+++ b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
@@ -11,7 +11,6 @@
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm import Session, sessionmaker
 
-from configs import dify_config
 from controllers.web import app as app_controller
 from controllers.web import bp, login, passport, site, wraps
 from enums import DeploymentEdition, WebAppAccessMode
@@ -27,6 +26,7 @@
 from services.web_app_runtime_query_service import WebAppRuntimeQueryService
 from services.web_passport_service import WebPassportService
 from services.webapp_access_query_service import WebAppAccessQueryService
+from tests.unit_tests.config_override import apply_config_overrides
 
 
 def _harness(
@@ -101,6 +101,8 @@ def _harness(
             webapp_auth_enabled=False,
             access_mode_for_app=mode_lookup,
             is_user_allowed_for_app=MagicMock(),
+            get_access_modes=MagicMock(),
+            get_user_permissions=MagicMock(),
         ),
         web_passport=WebPassportService(
             passports=passport_repo,
@@ -120,13 +122,16 @@ def _harness(
             )
         ),
     )
-    for module in (app_controller, login, passport, site):
+    for module in (app_controller, login, passport, site, wraps):
         monkeypatch.setattr(module, "application_services", lambda: services)
     monkeypatch.setattr(wraps, "PassportService", lambda: tokens)
     monkeypatch.setattr(wraps, "extract_webapp_passport", lambda *_: "old-passport")
     monkeypatch.setattr(wraps.SystemFeatureService, "is_webapp_auth_enabled", lambda: False)
-    monkeypatch.setattr(dify_config, "DEPLOYMENT_EDITION", DeploymentEdition.CLOUD)
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    apply_config_overrides(
+        monkeypatch,
+        DEPLOYMENT_EDITION=DeploymentEdition.CLOUD,
+        NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16",
+    )
     flask = Flask(__name__)
     flask.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
     flask.register_blueprint(bp)
diff --git a/api/tests/unit_tests/controllers/web/test_site.py b/api/tests/unit_tests/controllers/web/test_site.py
index 0ea59a277ca652..f55b4ff79d5bfa 100644
--- a/api/tests/unit_tests/controllers/web/test_site.py
+++ b/api/tests/unit_tests/controllers/web/test_site.py
@@ -14,6 +14,7 @@
     WebAppBootstrap,
     WebAppRuntimeUnavailableError,
 )
+from tests.unit_tests.config_override import apply_config_overrides
 
 
 def _bootstrap() -> WebAppBootstrap:
@@ -101,7 +102,6 @@ def test_app_site_api_maps_unavailable_runtime_to_app_not_found() -> None:
 def test_site_final_response_only_reclassifies_terminal_runtime_failure(
     failure: Exception, status: int, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    from configs import dify_config
     from controllers.web import wraps
 
     app = Flask(__name__)
@@ -122,7 +122,7 @@ def test_site_final_response_only_reclassifies_terminal_runtime_failure(
             SimpleNamespace(id="fixture-user", tenant_id="fixture-tenant", type="browser"),
         ),
     )
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
     response = app.test_client().get("/api/site", environ_overrides={"REMOTE_ADDR": "203.0.113.42"})
     assert response.status_code == status
     if status == 404:
diff --git a/api/tests/unit_tests/controllers/web/test_web_login.py b/api/tests/unit_tests/controllers/web/test_web_login.py
index 4679e818d2d2ec..91ccbc0f80f25c 100644
--- a/api/tests/unit_tests/controllers/web/test_web_login.py
+++ b/api/tests/unit_tests/controllers/web/test_web_login.py
@@ -25,6 +25,7 @@
     WebAppAccessQueryService,
     WebAppAccessUnavailableError,
 )
+from tests.unit_tests.config_override import apply_config_overrides
 
 pytestmark = [
     pytest.mark.parametrize("sqlite_session", [(DifySetup,)], indirect=True),
@@ -265,11 +266,13 @@ def test_missing_app_is_final_canonical_404_without_private_details(
         app: Flask,
         monkeypatch: pytest.MonkeyPatch,
     ) -> None:
-        from configs import dify_config
-        from controllers.web import bp
+        from controllers.web import bp, wraps
 
-        mock_app_id.return_value.webapp_access.resolve_app_id.side_effect = WebAppAccessAppNotFoundError("private code")
-        monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+        monkeypatch.setattr(wraps, "application_services", lambda: mock_app_id.return_value)
+        mock_app_id.return_value.webapp_access.get_app_id_by_code.side_effect = WebAppAccessAppNotFoundError(
+            "private code"
+        )
+        apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
         app.register_blueprint(bp)
         response = app.test_client().get(
             "/api/login/status?app_code=missing", environ_overrides={"REMOTE_ADDR": "203.0.113.42"}
@@ -292,19 +295,22 @@ def test_no_app_code_returns_logged_in_false(self, mock_extract: MagicMock, app:
 
     @patch("controllers.web.login.decode_jwt_token")
     @patch("controllers.web.login.PassportService")
-    @patch("controllers.web.login.WebAppAuthService.is_app_require_permission_check", return_value=False)
     @patch("controllers.web.login.application_services")
     @patch("controllers.web.login.extract_webapp_access_token", return_value="tok")
     def test_public_app_user_logged_in(
         self,
         mock_extract: MagicMock,
         mock_app_id: MagicMock,
-        mock_perm: MagicMock,
         mock_passport: MagicMock,
         mock_decode: MagicMock,
         app: Flask,
+        monkeypatch: pytest.MonkeyPatch,
     ) -> None:
-        mock_app_id.return_value.webapp_access.resolve_app_id.return_value = "app-1"
+        from controllers.web import wraps
+
+        monkeypatch.setattr(wraps, "application_services", lambda: mock_app_id.return_value)
+        mock_app_id.return_value.webapp_access.get_app_id_by_code.return_value = "app-1"
+        mock_app_id.return_value.webapp_access.requires_permission_check.return_value = False
         mock_decode.return_value = (MagicMock(), MagicMock())
 
         with app.test_request_context("/web/login/status?app_code=code1"):
@@ -315,19 +321,22 @@ def test_public_app_user_logged_in(
 
     @patch("controllers.web.login.decode_jwt_token", side_effect=Exception("bad"))
     @patch("controllers.web.login.PassportService")
-    @patch("controllers.web.login.WebAppAuthService.is_app_require_permission_check", return_value=True)
     @patch("controllers.web.login.application_services")
     @patch("controllers.web.login.extract_webapp_access_token", return_value="tok")
     def test_private_app_passport_fails(
         self,
         mock_extract: MagicMock,
         mock_app_id: MagicMock,
-        mock_perm: MagicMock,
         mock_passport_cls: MagicMock,
         mock_decode: MagicMock,
         app: Flask,
+        monkeypatch: pytest.MonkeyPatch,
     ) -> None:
-        mock_app_id.return_value.webapp_access.resolve_app_id.return_value = "app-1"
+        from controllers.web import wraps
+
+        monkeypatch.setattr(wraps, "application_services", lambda: mock_app_id.return_value)
+        mock_app_id.return_value.webapp_access.get_app_id_by_code.return_value = "app-1"
+        mock_app_id.return_value.webapp_access.requires_permission_check.return_value = True
         mock_passport_cls.return_value.verify.side_effect = Exception("bad")
 
         with app.test_request_context("/web/login/status?app_code=code1"):
@@ -342,8 +351,7 @@ def test_private_app_passport_fails(
     def test_unavailable_public_identity_is_final_404_before_authentication(
         self, condition: str, app: Flask, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        from configs import dify_config
-        from controllers.web import bp
+        from controllers.web import bp, wraps
         from controllers.web import login as login_module
 
         app_id = "11111111-1111-1111-1111-111111111111"
@@ -381,11 +389,14 @@ def test_unavailable_public_identity_is_final_404_before_authentication(
             webapp_auth_enabled=False,
             access_mode_for_app=modes,
             is_user_allowed_for_app=MagicMock(),
+            get_access_modes=MagicMock(),
+            get_user_permissions=MagicMock(),
         )
         monkeypatch.setattr(login_module, "application_services", lambda: SimpleNamespace(webapp_access=service))
+        monkeypatch.setattr(wraps, "application_services", lambda: SimpleNamespace(webapp_access=service))
         decode = MagicMock()
         monkeypatch.setattr(login_module, "decode_jwt_token", decode)
-        monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+        apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
         app.register_blueprint(bp)
         response = app.test_client().get(
             "/api/login/status?app_code=private-fixture", environ_overrides={"REMOTE_ADDR": "203.0.113.42"}
@@ -405,11 +416,12 @@ def test_unavailable_public_identity_is_final_404_before_authentication(
     )
     @patch("controllers.web.login.application_services")
     def test_identity_dependency_or_bug_is_not_hidden_as_app_404(
-        self, services: MagicMock, failure: Exception, status: int, app: Flask
+        self, services: MagicMock, failure: Exception, status: int, app: Flask, monkeypatch: pytest.MonkeyPatch
     ) -> None:
-        from controllers.web import bp
+        from controllers.web import bp, wraps
 
-        services.return_value.webapp_access.resolve_app_id.side_effect = failure
+        monkeypatch.setattr(wraps, "application_services", lambda: services.return_value)
+        services.return_value.webapp_access.get_app_id_by_code.side_effect = failure
         app.register_blueprint(bp)
         response = app.test_client().get("/api/login/status?app_code=fixture")
         assert response.status_code == status
diff --git a/api/tests/unit_tests/controllers/web/test_wraps.py b/api/tests/unit_tests/controllers/web/test_wraps.py
index ca6284231ce569..353b9514d42342 100644
--- a/api/tests/unit_tests/controllers/web/test_wraps.py
+++ b/api/tests/unit_tests/controllers/web/test_wraps.py
@@ -10,6 +10,7 @@
 from core.logging.context import clear_request_context, get_identity_context
 from models import App, EndUser
 from models.model import AppModelConfig
+from tests.unit_tests.config_override import apply_config_overrides
 
 
 @pytest.fixture(autouse=True)
@@ -118,7 +119,6 @@ def test_decode_jwt_token_uses_shared_session_factory(sqlite_session: Session) -
 def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
     sqlite_session: Session, monkeypatch: pytest.MonkeyPatch, missing: str
 ) -> None:
-    from configs import dify_config
     from controllers.common.app_access_error import register_app_access_error_metadata
     from controllers.web import wraps
     from libs.external_api import ExternalApi
@@ -164,7 +164,7 @@ def test_post_missing_app_is_canonical_but_other_not_found_keeps_its_owner(
             )
         )
     sqlite_session.commit()
-    monkeypatch.setattr(dify_config, "NETWORK_ACCESS_TRUSTED_PROXY_CIDRS", "172.18.0.0/16")
+    apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
     app = Flask(__name__)
     app.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
     bp = Blueprint("web_post_fixture", __name__, url_prefix="/api")
diff --git a/api/tests/unit_tests/services/test_webapp_access_query_service.py b/api/tests/unit_tests/services/test_webapp_access_query_service.py
index 7157ae7e9b7559..dc8c7d1740c4b4 100644
--- a/api/tests/unit_tests/services/test_webapp_access_query_service.py
+++ b/api/tests/unit_tests/services/test_webapp_access_query_service.py
@@ -8,7 +8,7 @@
 
 from enums import WebAppAccessMode
 from models.enums import CustomizeTokenStrategy
-from models.model import Site
+from models.model import App, AppModelConfig, Site
 from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
 from services.webapp_access_query_service import (
     WebAppAccessAppNotFoundError,
@@ -232,6 +232,20 @@ def test_app_code_lookup_releases_database_before_access_policy(sqlite_engine: E
     factory = sessionmaker(bind=sqlite_engine, expire_on_commit=False, close_resets_only=False)
     app_id = "11111111-1111-1111-1111-111111111111"
     with factory.begin() as session:
+        config = AppModelConfig(app_id=app_id)
+        config.id = "22222222-2222-2222-2222-222222222222"
+        session.add(config)
+        session.add(
+            App(
+                id=app_id,
+                tenant_id=app_id,
+                name="Test App",
+                mode="chat",
+                enable_site=True,
+                enable_api=True,
+                app_model_config_id=config.id,
+            )
+        )
         session.add(
             Site(
                 app_id=app_id,
diff --git a/e2e/features/step-definitions/apps/web-app-service.steps.ts b/e2e/features/step-definitions/apps/web-app-service.steps.ts
index d4532f3c9b9de3..7a7b8a100ff955 100644
--- a/e2e/features/step-definitions/apps/web-app-service.steps.ts
+++ b/e2e/features/step-definitions/apps/web-app-service.steps.ts
@@ -104,8 +104,16 @@ Then('the published workflow Web App should be accessible', async function (this
 
 Then('the published workflow Web App should be unavailable', async function (this: DifyWorld) {
   if (!this.sharedAppPage) throw new Error('The anonymous visitor has not opened the Web App.')
-  await expect(this.sharedAppPage.getByRole('heading', { name: '404' })).toBeVisible({
+  await expect(
+    this.sharedAppPage.getByRole('heading', {
+      name: 'This app doesn’t exist or isn’t accessible from your network.',
+    }),
+  ).toBeVisible({
     timeout: 15_000,
   })
-  await expect(this.sharedAppPage.getByText('App is unavailable', { exact: true })).toBeVisible()
+  await expect(
+    this.sharedAppPage.getByText('Contact the app administrator if you need help.', {
+      exact: true,
+    }),
+  ).toBeVisible()
 })
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
index 13641a5fe0d872..e526ccb9d94364 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
@@ -1,6 +1,7 @@
 import type { AppDetailWithSite } from '@dify/contracts/api/console/apps/types.gen'
 import { act, screen, waitFor } from '@testing-library/react'
 import { useStore } from '@/app/components/app/store'
+import { markAppDeletionFailed, markAppDeletionStarted } from '@/service/app-deletion'
 import { renderWithConsoleQuery } from '@/test/console/query-data'
 import { createAppDetailFixture } from '@/test/fixtures/app'
 import { AppModeEnum } from '@/types/app'
@@ -140,16 +141,21 @@ describe('AppDetailLayout', () => {
 
   it('redirects a deleted app after the generated transport returns not found', async () => {
     mockAppResponse.mockResolvedValue(Response.json({ message: 'App not found' }, { status: 404 }))
+    markAppDeletionStarted('app-1')
 
-    render(
-      <AppDetailLayout appId="app-1">
-        <div>App page content</div>
-      </AppDetailLayout>,
-    )
+    try {
+      render(
+        <AppDetailLayout appId="app-1">
+          <div>App page content</div>
+        </AppDetailLayout>,
+      )
 
-    await waitFor(() => expect(mockReplace).toHaveBeenCalledWith('/apps'))
-    expect(screen.queryByText('App page content')).not.toBeInTheDocument()
-    expect(useStore.getState().appDetail).toBeUndefined()
+      await waitFor(() => expect(mockReplace).toHaveBeenCalledWith('/apps'))
+      expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+      expect(useStore.getState().appDetail).toBeUndefined()
+    } finally {
+      markAppDeletionFailed('app-1')
+    }
   })
 
   it('should keep app detail data when navigating between pages in the same app', async () => {
diff --git a/web/app/components/app/access-point/access-control/chip-affix.tsx b/web/app/components/app/access-point/access-control/chip-affix.tsx
index 58b5daa25f851b..7185d891e04885 100644
--- a/web/app/components/app/access-point/access-control/chip-affix.tsx
+++ b/web/app/components/app/access-point/access-control/chip-affix.tsx
@@ -17,7 +17,7 @@ export function AccessControlChipAffix({
   coveredCount,
   inServiceCount,
 }: AccessControlChipAffixProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['deployments'])
 
   if (kind === 'pro') {
     return (
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 5a9b8bbfe7091b..3fd3dd3c5bb456 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -61,7 +61,7 @@ export function AccessControlConfigPanel({
   onDraftChange,
   onSave,
 }: AccessControlConfigPanelProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['deployments', 'common'])
   const policyErrorId = useId()
   const accessPointErrorId = useId()
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
diff --git a/web/app/components/app/access-point/access-control/downgrade-panel.tsx b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
index 8506f865491e1e..a73b9cbebb8ccd 100644
--- a/web/app/components/app/access-point/access-control/downgrade-panel.tsx
+++ b/web/app/components/app/access-point/access-control/downgrade-panel.tsx
@@ -29,7 +29,7 @@ export function AccessControlDowngradePanel({
   availableAccessPoints,
   onTurnOn,
 }: AccessControlDowngradePanelProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['deployments'])
   const coverage = getInServiceCoverage(assignment.scopes, availableAccessPoints)
   const protectedScopes = availableAccessPoints.filter((scope) => assignment.scopes[scope])
   const title = t(($) => $['studio.accessControl.entryLabel'], { ns: 'deployments' })
diff --git a/web/app/components/app/access-point/access-control/free-paywall.tsx b/web/app/components/app/access-point/access-control/free-paywall.tsx
index e60de9d6a6891f..5ca83715bacc44 100644
--- a/web/app/components/app/access-point/access-control/free-paywall.tsx
+++ b/web/app/components/app/access-point/access-control/free-paywall.tsx
@@ -10,7 +10,7 @@ type AccessControlFreePaywallProps = {
 }
 
 export function AccessControlFreePaywall({ onTurnOn }: AccessControlFreePaywallProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['deployments'])
   const title = t(($) => $['studio.accessControl.paywallTitle'], { ns: 'deployments' })
   const turnOn = t(($) => $['studio.accessControl.turnOn'], { ns: 'deployments' })
   const pro = t(($) => $['studio.accessControl.proBadge'], { ns: 'deployments' })
diff --git a/web/app/components/app/access-point/access-control/restricted-preview.tsx b/web/app/components/app/access-point/access-control/restricted-preview.tsx
index c830c1802ce008..5063bbaed0b90d 100644
--- a/web/app/components/app/access-point/access-control/restricted-preview.tsx
+++ b/web/app/components/app/access-point/access-control/restricted-preview.tsx
@@ -3,7 +3,7 @@
 import { useTranslation } from 'react-i18next'
 
 export function AccessControlRestrictedPreview() {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['deployments'])
 
   return (
     <div
diff --git a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
index 4b3bb319fa9aba..ffd9af0a1718ec 100644
--- a/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
+++ b/web/app/components/base/chat/chat/__tests__/hooks.spec.tsx
@@ -1,8 +1,8 @@
 import type { ChatConfig, ChatItemInTree } from '../../types'
 import type { FileEntity } from '@/app/components/base/file-uploader/types'
-import { toast } from '@/app/notifications'
 import { act, renderHook } from '@testing-library/react'
 import { InputVarType, WorkflowRunningStatus } from '@/app/components/workflow/types'
+import { toast } from '@/app/notifications'
 import { captureAppAccessScope, handleAppAccessError } from '@/features/app-access-error/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
diff --git a/web/app/components/base/chat/chat/hooks.ts b/web/app/components/base/chat/chat/hooks.ts
index ef65f5e016b7a2..583a0d7636d960 100644
--- a/web/app/components/base/chat/chat/hooks.ts
+++ b/web/app/components/base/chat/chat/hooks.ts
@@ -21,12 +21,12 @@ import {
 import { isInstalledAppPath } from '@/app/components/explore/installed-app/routes'
 import { addFileInfos, sortAgentSorts } from '@/app/components/tools/utils'
 import { NodeRunningStatus, WorkflowRunningStatus } from '@/app/components/workflow/types'
+import { toast } from '@/app/notifications'
 import {
   captureAppAccessScope,
   hasAppAccessError,
   isAppAccessScopeCurrent,
 } from '@/features/app-access-error/state'
-import { toast } from '@/app/notifications'
 import useTimestamp from '@/hooks/use-timestamp'
 import { useParams, usePathname } from '@/next/navigation'
 import { sseGet, ssePost } from '@/service/base'
diff --git a/web/app/components/base/file-uploader/hooks.ts b/web/app/components/base/file-uploader/hooks.ts
index e6f8bca6f74fab..89612c3b00b54b 100644
--- a/web/app/components/base/file-uploader/hooks.ts
+++ b/web/app/components/base/file-uploader/hooks.ts
@@ -16,8 +16,8 @@ import {
   VIDEO_SIZE_LIMIT,
 } from '@/app/components/base/file-uploader/constants'
 import { SupportUploadFileTypes } from '@/app/components/workflow/types'
-import { isAppAccessError } from '@/features/app-access-error/state'
 import { toast } from '@/app/notifications'
+import { isAppAccessError } from '@/features/app-access-error/state'
 import { useParams, usePathname } from '@/next/navigation'
 import { uploadRemoteFileInfo } from '@/service/common'
 import { uploadHumanInputFormLocalFile, uploadHumanInputFormRemoteFileInfo } from '@/service/share'
diff --git a/web/app/components/base/image-uploader/hooks.ts b/web/app/components/base/image-uploader/hooks.ts
index 2a21538a385868..c135104b826066 100644
--- a/web/app/components/base/image-uploader/hooks.ts
+++ b/web/app/components/base/image-uploader/hooks.ts
@@ -1,8 +1,8 @@
 import type { ImageFile } from '@/types/app'
 import { useCallback, useMemo, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
-import { isAppAccessError } from '@/features/app-access-error/state'
 import { toast } from '@/app/notifications'
+import { isAppAccessError } from '@/features/app-access-error/state'
 import { useParams } from '@/next/navigation'
 import { ALLOW_FILE_EXTENSIONS, TransferMethod } from '@/types/app'
 import { isAbortError } from '@/utils/is-abort-error'
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 323b3dc6153af1..d9e8fe8376cb88 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -35,7 +35,7 @@ type DialogState =
   | null
 
 function IpPoliciesListSkeleton() {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['common', 'deployments'])
 
   return (
     <div role="status" aria-label={t(($) => $.loading, { ns: 'common' })}>
@@ -57,7 +57,7 @@ function IpPoliciesListSkeleton() {
 }
 
 export default function IpPoliciesPage() {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['common', 'deployments'])
   const queryClient = useQueryClient()
   const canReadPolicies = useAtomValue(canReadNetworkAccessAtom)
   const canManagePolicies = useAtomValue(canManageNetworkAccessPoliciesAtom)
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index 05ee98c1d61d78..e1eb172fae943c 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -59,7 +59,7 @@ export function IpPolicyDialog({
   onOpenChange,
   onSubmit,
 }: IpPolicyDialogProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['common', 'deployments'])
   const currentIpQuery = useQuery(
     consoleQuery.workspaces.current.networkAccessGroups.currentIp.get.queryOptions({
       enabled: open && mode !== 'view' && currentIp === undefined,
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 512e5f4858f7ec..961bb1be5f37a9 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -42,7 +42,7 @@ type PolicyItemProps = {
 }
 
 export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['common'])
   const { formatTimeFromNow } = useFormatTimeFromNow()
   const [menuOpen, setMenuOpen] = useState(false)
   const [confirmDelete, setConfirmDelete] = useState(false)
diff --git a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
index bbfa533eb6a54d..d717596664f6a7 100644
--- a/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/referenced-apps.tsx
@@ -15,7 +15,7 @@ function toAppIconType(iconType: string | null | undefined): AppIconType | undef
 }
 
 export function PolicyReferencedApps({ apps, usedByCount }: PolicyReferencedAppsProps) {
-  const { t } = useTranslation()
+  const { t } = useTranslation(['common'])
 
   if (apps.length === 0) {
     if (usedByCount <= 0) return null
diff --git a/web/features/app-access-error/page.tsx b/web/features/app-access-error/page.tsx
index 3d1c9a97d453fe..f98d77521fc94f 100644
--- a/web/features/app-access-error/page.tsx
+++ b/web/features/app-access-error/page.tsx
@@ -109,6 +109,7 @@ function PageContent({ clientIp, embedded }: AppNotAccessibleProps) {
               <p className="mt-8 max-w-full system-sm-regular text-text-primary">
                 <Trans
                   t={t}
+                  ns="share"
                   i18nKey={($) => $['appNotAccessible.ipAddress']}
                   values={{ ip }}
                   components={{
diff --git a/web/features/app-access-error/state.ts b/web/features/app-access-error/state.ts
index 5a7380ce34c454..7ef9f5097ccfce 100644
--- a/web/features/app-access-error/state.ts
+++ b/web/features/app-access-error/state.ts
@@ -95,10 +95,7 @@ export function hasAppAccessError(scope: AppAccessScope | null) {
   return scope !== null && appAccessStore.get(errorAtomFor(scope))?.scope === scope
 }
 
-export function isIpAccessDeniedResponse(
-  status: number,
-  data: unknown,
-): data is IpAccessDeniedResponse {
+function isIpAccessDeniedResponse(status: number, data: unknown): data is IpAccessDeniedResponse {
   return (
     status === 403 &&
     typeof data === 'object' &&
diff --git a/web/i18n/locales/ar-TN/common.json b/web/i18n/locales/ar-TN/common.json
index 612c3419bc9f30..6e527d1bc39961 100644
--- a/web/i18n/locales/ar-TN/common.json
+++ b/web/i18n/locales/ar-TN/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "إدخالات IP",
   "settings.ipPolicyColumnName": "الاسم",
   "settings.ipPolicyColumnUpdatedAt": "آخر تحديث",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "تعذّر التحقق من عنوان IP الخاص بك. يرجى المحاولة مرة أخرى.",
   "settings.ipPolicyCurrentIpLoading": "جارٍ التحقق من عنوان IP الخاص بك…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ستسمح هذه التطبيقات بالوصول من أي عنوان IP. لا يمكن التراجع عن هذا الإجراء.",
   "settings.ipPolicyDeleteConfirm": "هل تريد حذف “{{name}}”؟",
   "settings.ipPolicyDeleteDescription": "لا يمكن التراجع عن هذا الإجراء.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "المزيد",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/ar-TN/deployments.json b/web/i18n/locales/ar-TN/deployments.json
index 7ccc8a679f58a6..07ec5f77112e74 100644
--- a/web/i18n/locales/ar-TN/deployments.json
+++ b/web/i18n/locales/ar-TN/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "لم يعد هذا التطبيق محميًا",
   "studio.accessControl.emptyPoliciesReadOnly": "اطلب من مالك مساحة العمل أو أحد المسؤولين إنشاء سياسة IP.",
   "studio.accessControl.emptyPoliciesTitle": "لا توجد سياسات IP في مساحة العمل هذه بعد",
-  "studio.accessControl.enableAccessControl": "تفعيل التحكم في الوصول",
   "studio.accessControl.entryLabel": "التحكّم في الوصول",
-  "studio.accessControl.excluded": "مستبعد",
   "studio.accessControl.ipPolicy": "سياسة IP",
   "studio.accessControl.lockoutWarning": "عنوان IP الخاص بك ({{ip}}) غير مشمول بهذه السياسة. قد تفقد إمكانية الوصول.",
   "studio.accessControl.manageIpPolicies": "إدارة سياسات IP",
diff --git a/web/i18n/locales/de-DE/common.json b/web/i18n/locales/de-DE/common.json
index 249b90b460947d..937bb39152fa64 100644
--- a/web/i18n/locales/de-DE/common.json
+++ b/web/i18n/locales/de-DE/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP-Einträge",
   "settings.ipPolicyColumnName": "Name",
   "settings.ipPolicyColumnUpdatedAt": "Aktualisiert",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Ihre IP-Adresse konnte nicht überprüft werden. Bitte versuchen Sie es erneut.",
   "settings.ipPolicyCurrentIpLoading": "Ihre IP-Adresse wird überprüft…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Diese Apps erlauben dann den Zugriff von jeder IP-Adresse. Dies kann nicht rückgängig gemacht werden.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” löschen?",
   "settings.ipPolicyDeleteDescription": "Dies kann nicht rückgängig gemacht werden.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Mehr",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/de-DE/deployments.json b/web/i18n/locales/de-DE/deployments.json
index c211d83f1d9d18..d9fea353bf37d2 100644
--- a/web/i18n/locales/de-DE/deployments.json
+++ b/web/i18n/locales/de-DE/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Diese App ist nicht mehr geschützt",
   "studio.accessControl.emptyPoliciesReadOnly": "Bitte einen Workspace-Inhaber oder Administrator, eine IP-Richtlinie zu erstellen.",
   "studio.accessControl.emptyPoliciesTitle": "In diesem Arbeitsbereich gibt es noch keine IP-Richtlinien",
-  "studio.accessControl.enableAccessControl": "Zugriffskontrolle aktivieren",
   "studio.accessControl.entryLabel": "Zugriffskontrolle",
-  "studio.accessControl.excluded": "Ausgeschlossen",
   "studio.accessControl.ipPolicy": "IP-Richtlinie",
   "studio.accessControl.lockoutWarning": "Ihre IP-Adresse ({{ip}}) ist nicht in dieser Richtlinie enthalten. Sie könnten den Zugriff verlieren.",
   "studio.accessControl.manageIpPolicies": "IP-Richtlinien verwalten",
diff --git a/web/i18n/locales/en-US/common.json b/web/i18n/locales/en-US/common.json
index c0c66f7ffaff66..d51fe3c6142419 100644
--- a/web/i18n/locales/en-US/common.json
+++ b/web/i18n/locales/en-US/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP Entries",
   "settings.ipPolicyColumnName": "Name",
   "settings.ipPolicyColumnUpdatedAt": "Updated at",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Unable to check your IP address. Please try again.",
   "settings.ipPolicyCurrentIpLoading": "Checking your IP address…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Apps using this policy will become accessible from any IP address. This can’t be undone.",
   "settings.ipPolicyDeleteConfirm": "Delete “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "This can’t be undone.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "More",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index 2b3bbc13033b74..e5b207fb05f256 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
   "studio.accessControl.emptyPoliciesReadOnly": "Ask a workspace owner or admin to create one.",
   "studio.accessControl.emptyPoliciesTitle": "No IP policies in this workspace yet",
-  "studio.accessControl.enableAccessControl": "Enable access control",
   "studio.accessControl.entryLabel": "Access Control",
-  "studio.accessControl.excluded": "Excluded",
   "studio.accessControl.ipPolicy": "IP Policy",
   "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
   "studio.accessControl.manageIpPolicies": "Manage IP policies",
diff --git a/web/i18n/locales/es-ES/common.json b/web/i18n/locales/es-ES/common.json
index 8972fcac323edf..1e4317efe77b93 100644
--- a/web/i18n/locales/es-ES/common.json
+++ b/web/i18n/locales/es-ES/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Entradas IP",
   "settings.ipPolicyColumnName": "Nombre",
   "settings.ipPolicyColumnUpdatedAt": "Actualizado",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "No se pudo comprobar tu dirección IP. Inténtalo de nuevo.",
   "settings.ipPolicyCurrentIpLoading": "Comprobando tu dirección IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Estas aplicaciones permitirán el acceso desde cualquier dirección IP. Esta acción no se puede deshacer.",
   "settings.ipPolicyDeleteConfirm": "¿Eliminar “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Esta acción no se puede deshacer.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Más",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/es-ES/deployments.json b/web/i18n/locales/es-ES/deployments.json
index 87ffe8da4e875a..9a9a756814e8ea 100644
--- a/web/i18n/locales/es-ES/deployments.json
+++ b/web/i18n/locales/es-ES/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Esta aplicación ya no está protegida",
   "studio.accessControl.emptyPoliciesReadOnly": "Pide al propietario o a un administrador del espacio de trabajo que cree una política de IP.",
   "studio.accessControl.emptyPoliciesTitle": "Aún no hay políticas de IP en este espacio de trabajo",
-  "studio.accessControl.enableAccessControl": "Activar el control de acceso",
   "studio.accessControl.entryLabel": "Control de acceso",
-  "studio.accessControl.excluded": "Excluido",
   "studio.accessControl.ipPolicy": "Política de IP",
   "studio.accessControl.lockoutWarning": "Tu IP ({{ip}}) no está incluida en esta política. Podrías perder el acceso.",
   "studio.accessControl.manageIpPolicies": "Gestionar políticas de IP",
diff --git a/web/i18n/locales/fa-IR/common.json b/web/i18n/locales/fa-IR/common.json
index a96bb4e1e3e91b..d16268b1e6f6bc 100644
--- a/web/i18n/locales/fa-IR/common.json
+++ b/web/i18n/locales/fa-IR/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "ورودی‌های IP",
   "settings.ipPolicyColumnName": "نام",
   "settings.ipPolicyColumnUpdatedAt": "به‌روزرسانی",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "بررسی نشانی IP شما ممکن نیست. لطفاً دوباره تلاش کنید.",
   "settings.ipPolicyCurrentIpLoading": "در حال بررسی نشانی IP شما…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "این برنامه‌ها دسترسی از هر نشانی IP را مجاز خواهند کرد. این اقدام قابل بازگشت نیست.",
   "settings.ipPolicyDeleteConfirm": "آیا “{{name}}” حذف شود؟",
   "settings.ipPolicyDeleteDescription": "این اقدام قابل بازگشت نیست.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "بیشتر",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/fa-IR/deployments.json b/web/i18n/locales/fa-IR/deployments.json
index 1637d9865ec439..32957611663859 100644
--- a/web/i18n/locales/fa-IR/deployments.json
+++ b/web/i18n/locales/fa-IR/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "این برنامه دیگر محافظت نمی‌شود",
   "studio.accessControl.emptyPoliciesReadOnly": "از مالک یا مدیر فضای کاری بخواهید یک سیاست IP ایجاد کند.",
   "studio.accessControl.emptyPoliciesTitle": "هنوز هیچ خط‌مشی IP در این فضای کاری وجود ندارد",
-  "studio.accessControl.enableAccessControl": "فعال‌سازی کنترل دسترسی",
   "studio.accessControl.entryLabel": "کنترل دسترسی",
-  "studio.accessControl.excluded": "مستثنا",
   "studio.accessControl.ipPolicy": "خط‌مشی IP",
   "studio.accessControl.lockoutWarning": "نشانی IP شما ({{ip}}) در این خط‌مشی نیست. ممکن است دسترسی خود را از دست بدهید.",
   "studio.accessControl.manageIpPolicies": "مدیریت خط‌مشی‌های IP",
diff --git a/web/i18n/locales/fr-FR/common.json b/web/i18n/locales/fr-FR/common.json
index 1f515cda7d398f..b3f4278d416492 100644
--- a/web/i18n/locales/fr-FR/common.json
+++ b/web/i18n/locales/fr-FR/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Entrées IP",
   "settings.ipPolicyColumnName": "Nom",
   "settings.ipPolicyColumnUpdatedAt": "Mis à jour",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Impossible de vérifier votre adresse IP. Veuillez réessayer.",
   "settings.ipPolicyCurrentIpLoading": "Vérification de votre adresse IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Ces applications autoriseront l’accès depuis n’importe quelle adresse IP. Cette action est irréversible.",
   "settings.ipPolicyDeleteConfirm": "Supprimer “{{name}}” ?",
   "settings.ipPolicyDeleteDescription": "Cette action est irréversible.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Plus",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/fr-FR/deployments.json b/web/i18n/locales/fr-FR/deployments.json
index f9d4940a4effca..d0312de0486c78 100644
--- a/web/i18n/locales/fr-FR/deployments.json
+++ b/web/i18n/locales/fr-FR/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Cette application n’est plus protégée",
   "studio.accessControl.emptyPoliciesReadOnly": "Demandez au propriétaire ou à un administrateur de l’espace de travail de créer une politique IP.",
   "studio.accessControl.emptyPoliciesTitle": "Cet espace de travail ne contient pas encore de politiques IP",
-  "studio.accessControl.enableAccessControl": "Activer le contrôle d’accès",
   "studio.accessControl.entryLabel": "Contrôle d’accès",
-  "studio.accessControl.excluded": "Exclu",
   "studio.accessControl.ipPolicy": "Politique IP",
   "studio.accessControl.lockoutWarning": "Votre IP ({{ip}}) n’est pas incluse dans cette politique. Vous risquez de perdre l’accès.",
   "studio.accessControl.manageIpPolicies": "Gérer les politiques IP",
diff --git a/web/i18n/locales/hi-IN/common.json b/web/i18n/locales/hi-IN/common.json
index e090929c318719..ad5c3b8f33981c 100644
--- a/web/i18n/locales/hi-IN/common.json
+++ b/web/i18n/locales/hi-IN/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP प्रविष्टियाँ",
   "settings.ipPolicyColumnName": "नाम",
   "settings.ipPolicyColumnUpdatedAt": "अपडेट किया गया",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "आपके IP पते की जाँच नहीं हो सकी। कृपया फिर से प्रयास करें।",
   "settings.ipPolicyCurrentIpLoading": "आपके IP पते की जाँच की जा रही है…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ये ऐप किसी भी IP पते से एक्सेस की अनुमति देंगे। इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” हटाएं?",
   "settings.ipPolicyDeleteDescription": "इस कार्रवाई को पूर्ववत नहीं किया जा सकता।",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "अधिक",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/hi-IN/deployments.json b/web/i18n/locales/hi-IN/deployments.json
index becb9141e04e65..44f65eb58ef905 100644
--- a/web/i18n/locales/hi-IN/deployments.json
+++ b/web/i18n/locales/hi-IN/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "यह ऐप अब सुरक्षित नहीं है",
   "studio.accessControl.emptyPoliciesReadOnly": "वर्कस्पेस के मालिक या एडमिन से IP नीति बनाने के लिए कहें।",
   "studio.accessControl.emptyPoliciesTitle": "इस कार्यक्षेत्र में अभी कोई IP नीति नहीं है",
-  "studio.accessControl.enableAccessControl": "पहुँच नियंत्रण सक्षम करें",
   "studio.accessControl.entryLabel": "पहुँच नियंत्रण",
-  "studio.accessControl.excluded": "बाहर रखा गया",
   "studio.accessControl.ipPolicy": "IP नीति",
   "studio.accessControl.lockoutWarning": "आपका IP ({{ip}}) इस नीति में शामिल नहीं है। आप पहुँच खो सकते हैं।",
   "studio.accessControl.manageIpPolicies": "IP नीतियाँ प्रबंधित करें",
diff --git a/web/i18n/locales/id-ID/common.json b/web/i18n/locales/id-ID/common.json
index 7b8cc6866b7376..9cd2503772055d 100644
--- a/web/i18n/locales/id-ID/common.json
+++ b/web/i18n/locales/id-ID/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Entri IP",
   "settings.ipPolicyColumnName": "Nama",
   "settings.ipPolicyColumnUpdatedAt": "Diperbarui",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Alamat IP Anda tidak dapat diperiksa. Coba lagi.",
   "settings.ipPolicyCurrentIpLoading": "Memeriksa alamat IP Anda…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Aplikasi ini akan mengizinkan akses dari alamat IP mana pun. Tindakan ini tidak dapat dibatalkan.",
   "settings.ipPolicyDeleteConfirm": "Hapus “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Tindakan ini tidak dapat dibatalkan.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Lebih",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/id-ID/deployments.json b/web/i18n/locales/id-ID/deployments.json
index 5ac9bd45e1fad5..d789125b0a84c0 100644
--- a/web/i18n/locales/id-ID/deployments.json
+++ b/web/i18n/locales/id-ID/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Aplikasi ini tidak lagi dilindungi",
   "studio.accessControl.emptyPoliciesReadOnly": "Minta pemilik atau admin ruang kerja untuk membuat kebijakan IP.",
   "studio.accessControl.emptyPoliciesTitle": "Belum ada kebijakan IP di ruang kerja ini",
-  "studio.accessControl.enableAccessControl": "Aktifkan kontrol akses",
   "studio.accessControl.entryLabel": "Kontrol akses",
-  "studio.accessControl.excluded": "Dikecualikan",
   "studio.accessControl.ipPolicy": "Kebijakan IP",
   "studio.accessControl.lockoutWarning": "IP Anda ({{ip}}) tidak tercakup dalam kebijakan ini. Anda mungkin kehilangan akses.",
   "studio.accessControl.manageIpPolicies": "Kelola kebijakan IP",
diff --git a/web/i18n/locales/it-IT/common.json b/web/i18n/locales/it-IT/common.json
index b1669f16cd6e1c..4bfa35511c7ff5 100644
--- a/web/i18n/locales/it-IT/common.json
+++ b/web/i18n/locales/it-IT/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Voci IP",
   "settings.ipPolicyColumnName": "Nome",
   "settings.ipPolicyColumnUpdatedAt": "Aggiornato",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Impossibile verificare il tuo indirizzo IP. Riprova.",
   "settings.ipPolicyCurrentIpLoading": "Verifica dell’indirizzo IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Queste app consentiranno l’accesso da qualsiasi indirizzo IP. Questa azione non può essere annullata.",
   "settings.ipPolicyDeleteConfirm": "Eliminare “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Questa azione non può essere annullata.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Di più",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/it-IT/deployments.json b/web/i18n/locales/it-IT/deployments.json
index 38f21fac269e8a..f1098c125c22f3 100644
--- a/web/i18n/locales/it-IT/deployments.json
+++ b/web/i18n/locales/it-IT/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Questa app non è più protetta",
   "studio.accessControl.emptyPoliciesReadOnly": "Chiedi al proprietario o a un amministratore dell’area di lavoro di creare una policy IP.",
   "studio.accessControl.emptyPoliciesTitle": "Non ci sono ancora policy IP in questo spazio di lavoro",
-  "studio.accessControl.enableAccessControl": "Abilita il controllo degli accessi",
   "studio.accessControl.entryLabel": "Controllo degli accessi",
-  "studio.accessControl.excluded": "Escluso",
   "studio.accessControl.ipPolicy": "Policy IP",
   "studio.accessControl.lockoutWarning": "Il tuo IP ({{ip}}) non è incluso in questa policy. Potresti perdere l’accesso.",
   "studio.accessControl.manageIpPolicies": "Gestisci le policy IP",
diff --git a/web/i18n/locales/ja-JP/common.json b/web/i18n/locales/ja-JP/common.json
index fea7391e96e1e8..e0a080b993b997 100644
--- a/web/i18n/locales/ja-JP/common.json
+++ b/web/i18n/locales/ja-JP/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "追加",
   "settings.ipPolicyAllowlist": "許可リスト",
   "settings.ipPolicyAllowlistHelp": "単一のアドレス（203.0.113.42）または CIDR 範囲（10.0.0.0/8）を入力できます。IPv4 と IPv6 の両方に対応しています。",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP エントリ",
   "settings.ipPolicyColumnName": "名前",
   "settings.ipPolicyColumnUpdatedAt": "更新日時",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "現在の IP は {{ip}} です",
   "settings.ipPolicyCurrentIpError": "IP アドレスを確認できません。もう一度お試しください。",
   "settings.ipPolicyCurrentIpLoading": "IP アドレスを確認しています…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "このポリシーを使用しているアプリには、すべての IP アドレスからアクセスできるようになります。この操作は元に戻せません。",
   "settings.ipPolicyDeleteConfirm": "「{{name}}」を削除しますか？",
   "settings.ipPolicyDeleteDescription": "この操作は元に戻せません。",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "IPv4 / IPv6 アドレスと CIDR 範囲のみサポートしています",
   "settings.ipPolicyMore": "その他",
   "settings.ipPolicyName": "名前",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "例：社内ネットワーク",
   "settings.ipPolicyNewTitle": "IP ポリシーを作成",
   "settings.ipPolicyRemoveEntry": "エントリを削除",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index a607db46152171..c4f48b2cfc8ea4 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
   "studio.accessControl.emptyPoliciesReadOnly": "ワークスペースのオーナーまたは管理者に作成を依頼してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
-  "studio.accessControl.enableAccessControl": "アクセス制御を有効にする",
   "studio.accessControl.entryLabel": "アクセス制御",
-  "studio.accessControl.excluded": "対象外",
   "studio.accessControl.ipPolicy": "IP ポリシー",
   "studio.accessControl.lockoutWarning": "あなたの IP（{{ip}}）はこのポリシーに含まれていません。アクセスできなくなる可能性があります。",
   "studio.accessControl.manageIpPolicies": "IP ポリシーを管理",
diff --git a/web/i18n/locales/ko-KR/common.json b/web/i18n/locales/ko-KR/common.json
index db60a839064403..79e788b8b9fd9e 100644
--- a/web/i18n/locales/ko-KR/common.json
+++ b/web/i18n/locales/ko-KR/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP 항목",
   "settings.ipPolicyColumnName": "이름",
   "settings.ipPolicyColumnUpdatedAt": "업데이트",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "IP 주소를 확인할 수 없습니다. 다시 시도하세요.",
   "settings.ipPolicyCurrentIpLoading": "IP 주소 확인 중…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "이 앱들은 모든 IP 주소에서 접근할 수 있게 됩니다. 이 작업은 되돌릴 수 없습니다.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}”을(를) 삭제하시겠습니까?",
   "settings.ipPolicyDeleteDescription": "이 작업은 되돌릴 수 없습니다.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "더 많은",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/ko-KR/deployments.json b/web/i18n/locales/ko-KR/deployments.json
index 980022f3a5f9c7..eea0e3a84e6352 100644
--- a/web/i18n/locales/ko-KR/deployments.json
+++ b/web/i18n/locales/ko-KR/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "이 앱은 더 이상 보호되지 않습니다",
   "studio.accessControl.emptyPoliciesReadOnly": "워크스페이스 소유자 또는 관리자에게 IP 정책 생성을 요청하세요.",
   "studio.accessControl.emptyPoliciesTitle": "이 작업 공간에는 아직 IP 정책이 없습니다",
-  "studio.accessControl.enableAccessControl": "접근 제어 활성화",
   "studio.accessControl.entryLabel": "접근 제어",
-  "studio.accessControl.excluded": "제외됨",
   "studio.accessControl.ipPolicy": "IP 정책",
   "studio.accessControl.lockoutWarning": "현재 IP({{ip}})가 이 정책에 포함되어 있지 않습니다. 접근 권한을 잃을 수 있습니다.",
   "studio.accessControl.manageIpPolicies": "IP 정책 관리",
diff --git a/web/i18n/locales/lo-LA/common.json b/web/i18n/locales/lo-LA/common.json
index c81b1bd01059bc..490db3e3737951 100644
--- a/web/i18n/locales/lo-LA/common.json
+++ b/web/i18n/locales/lo-LA/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "ລາຍການ IP",
   "settings.ipPolicyColumnName": "ຊື່",
   "settings.ipPolicyColumnUpdatedAt": "ອັບເດດ",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "ບໍ່ສາມາດກວດສອບທີ່ຢູ່ IP ຂອງທ່ານໄດ້. ກະລຸນາລອງໃໝ່.",
   "settings.ipPolicyCurrentIpLoading": "ກຳລັງກວດສອບທີ່ຢູ່ IP ຂອງທ່ານ…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "ແອັບເຫຼົ່ານີ້ຈະອະນຸຍາດໃຫ້ເຂົ້າເຖິງຈາກທີ່ຢູ່ IP ໃດກໍໄດ້. ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
   "settings.ipPolicyDeleteConfirm": "ລຶບ “{{name}}” ຫຼືບໍ່?",
   "settings.ipPolicyDeleteDescription": "ການດຳເນີນການນີ້ບໍ່ສາມາດຍົກເລີກໄດ້.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "ເພີ່ມເຕີມ",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/lo-LA/deployments.json b/web/i18n/locales/lo-LA/deployments.json
index ab3a8c98ebe43f..dbb230666bbe67 100644
--- a/web/i18n/locales/lo-LA/deployments.json
+++ b/web/i18n/locales/lo-LA/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "ແອັບນີ້ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ",
   "studio.accessControl.emptyPoliciesReadOnly": "ຂໍໃຫ້ເຈົ້າຂອງ ຫຼື ຜູ້ດູແລພື້ນທີ່ເຮັດວຽກສ້າງນະໂຍບາຍ IP.",
   "studio.accessControl.emptyPoliciesTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP ໃນພື້ນທີ່ເຮັດວຽກນີ້",
-  "studio.accessControl.enableAccessControl": "ເປີດໃຊ້ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.entryLabel": "ການຄວບຄຸມການເຂົ້າເຖິງ",
-  "studio.accessControl.excluded": "ບໍ່ລວມ",
   "studio.accessControl.ipPolicy": "ນະໂຍບາຍ IP",
   "studio.accessControl.lockoutWarning": "IP ຂອງທ່ານ ({{ip}}) ບໍ່ຢູ່ໃນນະໂຍບາຍນີ້. ທ່ານອາດສູນເສຍສິດເຂົ້າເຖິງ.",
   "studio.accessControl.manageIpPolicies": "ຈັດການນະໂຍບາຍ IP",
diff --git a/web/i18n/locales/nl-NL/common.json b/web/i18n/locales/nl-NL/common.json
index 2982e2cd179673..1223dd6e7fd45a 100644
--- a/web/i18n/locales/nl-NL/common.json
+++ b/web/i18n/locales/nl-NL/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP-vermeldingen",
   "settings.ipPolicyColumnName": "Naam",
   "settings.ipPolicyColumnUpdatedAt": "Bijgewerkt",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Je IP-adres kan niet worden gecontroleerd. Probeer het opnieuw.",
   "settings.ipPolicyCurrentIpLoading": "Je IP-adres wordt gecontroleerd…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Deze apps staan dan toegang vanaf elk IP-adres toe. Dit kan niet ongedaan worden gemaakt.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” verwijderen?",
   "settings.ipPolicyDeleteDescription": "Dit kan niet ongedaan worden gemaakt.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "More",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/nl-NL/deployments.json b/web/i18n/locales/nl-NL/deployments.json
index 0016fabcbbb037..d9c1a28d83ee9e 100644
--- a/web/i18n/locales/nl-NL/deployments.json
+++ b/web/i18n/locales/nl-NL/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Deze app is niet meer beschermd",
   "studio.accessControl.emptyPoliciesReadOnly": "Vraag een eigenaar of beheerder van de werkruimte om een IP-beleid aan te maken.",
   "studio.accessControl.emptyPoliciesTitle": "Deze werkruimte heeft nog geen IP-beleid",
-  "studio.accessControl.enableAccessControl": "Toegangsbeheer inschakelen",
   "studio.accessControl.entryLabel": "Toegangsbeheer",
-  "studio.accessControl.excluded": "Uitgesloten",
   "studio.accessControl.ipPolicy": "IP-beleid",
   "studio.accessControl.lockoutWarning": "Je IP-adres ({{ip}}) staat niet in dit beleid. Je kunt de toegang verliezen.",
   "studio.accessControl.manageIpPolicies": "IP-beleid beheren",
diff --git a/web/i18n/locales/pl-PL/common.json b/web/i18n/locales/pl-PL/common.json
index 6050f478a33605..514bfc3d1937b0 100644
--- a/web/i18n/locales/pl-PL/common.json
+++ b/web/i18n/locales/pl-PL/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Wpisy IP",
   "settings.ipPolicyColumnName": "Nazwa",
   "settings.ipPolicyColumnUpdatedAt": "Zaktualizowano",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Nie można sprawdzić Twojego adresu IP. Spróbuj ponownie.",
   "settings.ipPolicyCurrentIpLoading": "Sprawdzanie Twojego adresu IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Te aplikacje będą zezwalać na dostęp z dowolnego adresu IP. Tej operacji nie można cofnąć.",
   "settings.ipPolicyDeleteConfirm": "Usunąć “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Tej operacji nie można cofnąć.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Więcej",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/pl-PL/deployments.json b/web/i18n/locales/pl-PL/deployments.json
index 098146af5e9991..a2e8f8e4441332 100644
--- a/web/i18n/locales/pl-PL/deployments.json
+++ b/web/i18n/locales/pl-PL/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Ta aplikacja nie jest już chroniona",
   "studio.accessControl.emptyPoliciesReadOnly": "Poproś właściciela lub administratora obszaru roboczego o utworzenie zasad IP.",
   "studio.accessControl.emptyPoliciesTitle": "W tym obszarze roboczym nie ma jeszcze polityk IP",
-  "studio.accessControl.enableAccessControl": "Włącz kontrolę dostępu",
   "studio.accessControl.entryLabel": "Kontrola dostępu",
-  "studio.accessControl.excluded": "Wykluczony",
   "studio.accessControl.ipPolicy": "Polityka IP",
   "studio.accessControl.lockoutWarning": "Twój adres IP ({{ip}}) nie jest uwzględniony w tej polityce. Możesz utracić dostęp.",
   "studio.accessControl.manageIpPolicies": "Zarządzaj politykami IP",
diff --git a/web/i18n/locales/pt-BR/common.json b/web/i18n/locales/pt-BR/common.json
index b7929e912fef13..737a4d945cc5ac 100644
--- a/web/i18n/locales/pt-BR/common.json
+++ b/web/i18n/locales/pt-BR/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Entradas de IP",
   "settings.ipPolicyColumnName": "Nome",
   "settings.ipPolicyColumnUpdatedAt": "Atualizado em",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Não foi possível verificar seu endereço IP. Tente novamente.",
   "settings.ipPolicyCurrentIpLoading": "Verificando seu endereço IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Esses aplicativos permitirão o acesso de qualquer endereço IP. Esta ação não pode ser desfeita.",
   "settings.ipPolicyDeleteConfirm": "Excluir “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Esta ação não pode ser desfeita.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Mais",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/pt-BR/deployments.json b/web/i18n/locales/pt-BR/deployments.json
index 1d0d2ae23f172f..1ca6b258dccb15 100644
--- a/web/i18n/locales/pt-BR/deployments.json
+++ b/web/i18n/locales/pt-BR/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Este aplicativo não está mais protegido",
   "studio.accessControl.emptyPoliciesReadOnly": "Peça ao proprietário ou a um administrador do espaço de trabalho para criar uma política de IP.",
   "studio.accessControl.emptyPoliciesTitle": "Ainda não há políticas de IP neste espaço de trabalho",
-  "studio.accessControl.enableAccessControl": "Ativar controle de acesso",
   "studio.accessControl.entryLabel": "Controle de acesso",
-  "studio.accessControl.excluded": "Excluído",
   "studio.accessControl.ipPolicy": "Política de IP",
   "studio.accessControl.lockoutWarning": "Seu IP ({{ip}}) não está incluído nesta política. Você pode perder o acesso.",
   "studio.accessControl.manageIpPolicies": "Gerenciar políticas de IP",
diff --git a/web/i18n/locales/ro-RO/common.json b/web/i18n/locales/ro-RO/common.json
index 9031e60ab31dff..6b040fcf7cb264 100644
--- a/web/i18n/locales/ro-RO/common.json
+++ b/web/i18n/locales/ro-RO/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Intrări IP",
   "settings.ipPolicyColumnName": "Nume",
   "settings.ipPolicyColumnUpdatedAt": "Actualizat",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Adresa IP nu poate fi verificată. Încercați din nou.",
   "settings.ipPolicyCurrentIpLoading": "Se verifică adresa IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Aceste aplicații vor permite accesul de la orice adresă IP. Această acțiune nu poate fi anulată.",
   "settings.ipPolicyDeleteConfirm": "Ștergeți “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Această acțiune nu poate fi anulată.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Mai mult",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/ro-RO/deployments.json b/web/i18n/locales/ro-RO/deployments.json
index 1e1a24189ee0b1..548ff89517662c 100644
--- a/web/i18n/locales/ro-RO/deployments.json
+++ b/web/i18n/locales/ro-RO/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Această aplicație nu mai este protejată",
   "studio.accessControl.emptyPoliciesReadOnly": "Cere proprietarului sau unui administrator al spațiului de lucru să creeze o politică IP.",
   "studio.accessControl.emptyPoliciesTitle": "Nu există încă politici IP în acest spațiu de lucru",
-  "studio.accessControl.enableAccessControl": "Activați controlul accesului",
   "studio.accessControl.entryLabel": "Controlul accesului",
-  "studio.accessControl.excluded": "Exclus",
   "studio.accessControl.ipPolicy": "Politică IP",
   "studio.accessControl.lockoutWarning": "Adresa dvs. IP ({{ip}}) nu este inclusă în această politică. Puteți pierde accesul.",
   "studio.accessControl.manageIpPolicies": "Gestionați politicile IP",
diff --git a/web/i18n/locales/ru-RU/common.json b/web/i18n/locales/ru-RU/common.json
index 2afa8028f43dcd..dc03863408edf3 100644
--- a/web/i18n/locales/ru-RU/common.json
+++ b/web/i18n/locales/ru-RU/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP-записи",
   "settings.ipPolicyColumnName": "Название",
   "settings.ipPolicyColumnUpdatedAt": "Обновлено",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Не удалось проверить ваш IP-адрес. Повторите попытку.",
   "settings.ipPolicyCurrentIpLoading": "Проверка вашего IP-адреса…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Эти приложения станут доступны с любого IP-адреса. Это действие нельзя отменить.",
   "settings.ipPolicyDeleteConfirm": "Удалить “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Это действие нельзя отменить.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Больше",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/ru-RU/deployments.json b/web/i18n/locales/ru-RU/deployments.json
index 208f96da7ca23b..97255a79590706 100644
--- a/web/i18n/locales/ru-RU/deployments.json
+++ b/web/i18n/locales/ru-RU/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Это приложение больше не защищено",
   "studio.accessControl.emptyPoliciesReadOnly": "Попросите владельца или администратора рабочего пространства создать политику IP.",
   "studio.accessControl.emptyPoliciesTitle": "В этом рабочем пространстве пока нет IP-политик",
-  "studio.accessControl.enableAccessControl": "Включить контроль доступа",
   "studio.accessControl.entryLabel": "Контроль доступа",
-  "studio.accessControl.excluded": "Исключено",
   "studio.accessControl.ipPolicy": "IP-политика",
   "studio.accessControl.lockoutWarning": "Ваш IP-адрес ({{ip}}) не включён в эту политику. Вы можете потерять доступ.",
   "studio.accessControl.manageIpPolicies": "Управление IP-политиками",
diff --git a/web/i18n/locales/sl-SI/common.json b/web/i18n/locales/sl-SI/common.json
index e04b5daecb9af9..af8aea27de672f 100644
--- a/web/i18n/locales/sl-SI/common.json
+++ b/web/i18n/locales/sl-SI/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP vnosi",
   "settings.ipPolicyColumnName": "Ime",
   "settings.ipPolicyColumnUpdatedAt": "Posodobljeno",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Vašega naslova IP ni mogoče preveriti. Poskusite znova.",
   "settings.ipPolicyCurrentIpLoading": "Preverjanje vašega naslova IP…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Te aplikacije bodo dovolile dostop s katerega koli naslova IP. Tega dejanja ni mogoče razveljaviti.",
   "settings.ipPolicyDeleteConfirm": "Izbrišem “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Tega dejanja ni mogoče razveljaviti.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Več",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/sl-SI/deployments.json b/web/i18n/locales/sl-SI/deployments.json
index c6e015bf44f022..6a6875b29967f6 100644
--- a/web/i18n/locales/sl-SI/deployments.json
+++ b/web/i18n/locales/sl-SI/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Ta aplikacija ni več zaščitena",
   "studio.accessControl.emptyPoliciesReadOnly": "Prosite lastnika ali skrbnika delovnega prostora, naj ustvari pravilnik IP.",
   "studio.accessControl.emptyPoliciesTitle": "V tem delovnem prostoru še ni pravilnikov IP",
-  "studio.accessControl.enableAccessControl": "Omogoči nadzor dostopa",
   "studio.accessControl.entryLabel": "Nadzor dostopa",
-  "studio.accessControl.excluded": "Izključeno",
   "studio.accessControl.ipPolicy": "Pravilnik IP",
   "studio.accessControl.lockoutWarning": "Vaš naslov IP ({{ip}}) ni vključen v ta pravilnik. Lahko izgubite dostop.",
   "studio.accessControl.manageIpPolicies": "Upravljaj pravilnike IP",
diff --git a/web/i18n/locales/th-TH/common.json b/web/i18n/locales/th-TH/common.json
index 458d7780c11d12..96a35b4c6eeb6a 100644
--- a/web/i18n/locales/th-TH/common.json
+++ b/web/i18n/locales/th-TH/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "รายการ IP",
   "settings.ipPolicyColumnName": "ชื่อ",
   "settings.ipPolicyColumnUpdatedAt": "อัปเดตเมื่อ",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "ไม่สามารถตรวจสอบที่อยู่ IP ของคุณได้ โปรดลองอีกครั้ง",
   "settings.ipPolicyCurrentIpLoading": "กำลังตรวจสอบที่อยู่ IP ของคุณ…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "แอปเหล่านี้จะอนุญาตให้เข้าถึงจากที่อยู่ IP ใดก็ได้ การดำเนินการนี้ไม่สามารถยกเลิกได้",
   "settings.ipPolicyDeleteConfirm": "ลบ “{{name}}” หรือไม่?",
   "settings.ipPolicyDeleteDescription": "การดำเนินการนี้ไม่สามารถยกเลิกได้",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "มากขึ้น",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/th-TH/deployments.json b/web/i18n/locales/th-TH/deployments.json
index cf57481b244d32..70868ed9117715 100644
--- a/web/i18n/locales/th-TH/deployments.json
+++ b/web/i18n/locales/th-TH/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "แอปนี้ไม่ได้รับการปกป้องอีกต่อไป",
   "studio.accessControl.emptyPoliciesReadOnly": "ขอให้เจ้าของหรือผู้ดูแลระบบของเวิร์กสเปซสร้างนโยบาย IP",
   "studio.accessControl.emptyPoliciesTitle": "ยังไม่มีนโยบาย IP ในพื้นที่ทำงานนี้",
-  "studio.accessControl.enableAccessControl": "เปิดใช้งานการควบคุมการเข้าถึง",
   "studio.accessControl.entryLabel": "การควบคุมการเข้าถึง",
-  "studio.accessControl.excluded": "ไม่รวม",
   "studio.accessControl.ipPolicy": "นโยบาย IP",
   "studio.accessControl.lockoutWarning": "IP ของคุณ ({{ip}}) ไม่ได้อยู่ในนโยบายนี้ คุณอาจสูญเสียสิทธิ์การเข้าถึง",
   "studio.accessControl.manageIpPolicies": "จัดการนโยบาย IP",
diff --git a/web/i18n/locales/tr-TR/common.json b/web/i18n/locales/tr-TR/common.json
index c1ebb92b2aead8..8183814b4f7066 100644
--- a/web/i18n/locales/tr-TR/common.json
+++ b/web/i18n/locales/tr-TR/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP kayıtları",
   "settings.ipPolicyColumnName": "Ad",
   "settings.ipPolicyColumnUpdatedAt": "Güncellendi",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "IP adresiniz kontrol edilemiyor. Lütfen tekrar deneyin.",
   "settings.ipPolicyCurrentIpLoading": "IP adresiniz kontrol ediliyor…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Bu uygulamalar herhangi bir IP adresinden erişime izin verecek. Bu işlem geri alınamaz.",
   "settings.ipPolicyDeleteConfirm": "“{{name}}” silinsin mi?",
   "settings.ipPolicyDeleteDescription": "Bu işlem geri alınamaz.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Daha fazla",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/tr-TR/deployments.json b/web/i18n/locales/tr-TR/deployments.json
index 75fe2ea3906a9e..b5e4367dc99a41 100644
--- a/web/i18n/locales/tr-TR/deployments.json
+++ b/web/i18n/locales/tr-TR/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Bu uygulama artık korunmuyor",
   "studio.accessControl.emptyPoliciesReadOnly": "Çalışma alanı sahibinden veya yöneticisinden bir IP politikası oluşturmasını isteyin.",
   "studio.accessControl.emptyPoliciesTitle": "Bu çalışma alanında henüz IP politikası yok",
-  "studio.accessControl.enableAccessControl": "Erişim denetimini etkinleştir",
   "studio.accessControl.entryLabel": "Erişim kontrolü",
-  "studio.accessControl.excluded": "Kapsam dışında",
   "studio.accessControl.ipPolicy": "IP politikası",
   "studio.accessControl.lockoutWarning": "IP adresiniz ({{ip}}) bu politikada yer almıyor. Erişiminizi kaybedebilirsiniz.",
   "studio.accessControl.manageIpPolicies": "IP politikalarını yönet",
diff --git a/web/i18n/locales/uk-UA/common.json b/web/i18n/locales/uk-UA/common.json
index 524864df05af70..44652b99ff2611 100644
--- a/web/i18n/locales/uk-UA/common.json
+++ b/web/i18n/locales/uk-UA/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "IP-записи",
   "settings.ipPolicyColumnName": "Назва",
   "settings.ipPolicyColumnUpdatedAt": "Оновлено",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Не вдалося перевірити вашу IP-адресу. Спробуйте ще раз.",
   "settings.ipPolicyCurrentIpLoading": "Перевірка вашої IP-адреси…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Ці застосунки дозволятимуть доступ із будь-якої IP-адреси. Цю дію неможливо скасувати.",
   "settings.ipPolicyDeleteConfirm": "Видалити “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Цю дію неможливо скасувати.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Більше",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/uk-UA/deployments.json b/web/i18n/locales/uk-UA/deployments.json
index bed2f68c04cf65..81e779cb44aa8e 100644
--- a/web/i18n/locales/uk-UA/deployments.json
+++ b/web/i18n/locales/uk-UA/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Цей застосунок більше не захищено",
   "studio.accessControl.emptyPoliciesReadOnly": "Попросіть власника або адміністратора робочого простору створити політику IP.",
   "studio.accessControl.emptyPoliciesTitle": "У цьому робочому просторі ще немає IP-політик",
-  "studio.accessControl.enableAccessControl": "Увімкнути контроль доступу",
   "studio.accessControl.entryLabel": "Контроль доступу",
-  "studio.accessControl.excluded": "Виключено",
   "studio.accessControl.ipPolicy": "IP-політика",
   "studio.accessControl.lockoutWarning": "Вашу IP-адресу ({{ip}}) не включено до цієї політики. Ви можете втратити доступ.",
   "studio.accessControl.manageIpPolicies": "Керувати IP-політиками",
diff --git a/web/i18n/locales/vi-VN/common.json b/web/i18n/locales/vi-VN/common.json
index 708086c43e00c7..9f5abc3cdac060 100644
--- a/web/i18n/locales/vi-VN/common.json
+++ b/web/i18n/locales/vi-VN/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
   "settings.ipPolicyAllowlistHelp": "Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.",
-  "settings.ipPolicyCidrMax": "A policy can include up to {{max}} addresses",
   "settings.ipPolicyColumnIpEntries": "Mục IP",
   "settings.ipPolicyColumnName": "Tên",
   "settings.ipPolicyColumnUpdatedAt": "Cập nhật",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "Your current IP is {{ip}}",
   "settings.ipPolicyCurrentIpError": "Không thể kiểm tra địa chỉ IP của bạn. Vui lòng thử lại.",
   "settings.ipPolicyCurrentIpLoading": "Đang kiểm tra địa chỉ IP của bạn…",
-  "settings.ipPolicyDeleteBound": "This policy is in use",
   "settings.ipPolicyDeleteBoundDescription": "Các ứng dụng này sẽ cho phép truy cập từ mọi địa chỉ IP. Không thể hoàn tác thao tác này.",
   "settings.ipPolicyDeleteConfirm": "Xóa “{{name}}”?",
   "settings.ipPolicyDeleteDescription": "Không thể hoàn tác thao tác này.",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "Only IPv4 / IPv6 addresses and CIDR ranges are supported",
   "settings.ipPolicyMore": "Hơn",
   "settings.ipPolicyName": "Name",
-  "settings.ipPolicyNameMax": "Name must be {{max}} characters or fewer",
   "settings.ipPolicyNamePlaceholder": "e.g. Internal Network",
   "settings.ipPolicyNewTitle": "New IP Policy",
   "settings.ipPolicyRemoveEntry": "Remove entry",
diff --git a/web/i18n/locales/vi-VN/deployments.json b/web/i18n/locales/vi-VN/deployments.json
index 941d517305e9e6..e04d766fe37c90 100644
--- a/web/i18n/locales/vi-VN/deployments.json
+++ b/web/i18n/locales/vi-VN/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "Ứng dụng này không còn được bảo vệ",
   "studio.accessControl.emptyPoliciesReadOnly": "Hãy yêu cầu chủ sở hữu hoặc quản trị viên không gian làm việc tạo chính sách IP.",
   "studio.accessControl.emptyPoliciesTitle": "Chưa có chính sách IP nào trong không gian làm việc này",
-  "studio.accessControl.enableAccessControl": "Bật kiểm soát truy cập",
   "studio.accessControl.entryLabel": "Kiểm soát truy cập",
-  "studio.accessControl.excluded": "Đã loại trừ",
   "studio.accessControl.ipPolicy": "Chính sách IP",
   "studio.accessControl.lockoutWarning": "IP của bạn ({{ip}}) không nằm trong chính sách này. Bạn có thể mất quyền truy cập.",
   "studio.accessControl.manageIpPolicies": "Quản lý chính sách IP",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index cc29f522a4132b..34726ca4701ae9 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "添加",
   "settings.ipPolicyAllowlist": "允许列表",
   "settings.ipPolicyAllowlistHelp": "支持单个地址（203.0.113.42）或 CIDR 网段（10.0.0.0/8），IPv4 与 IPv6 均可。",
-  "settings.ipPolicyCidrMax": "一条策略最多包含 {{max}} 个地址",
   "settings.ipPolicyColumnIpEntries": "IP 条目",
   "settings.ipPolicyColumnName": "名称",
   "settings.ipPolicyColumnUpdatedAt": "更新时间",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyCurrentIpError": "无法检查您的 IP 地址，请重试。",
   "settings.ipPolicyCurrentIpLoading": "正在检查您的 IP 地址…",
-  "settings.ipPolicyDeleteBound": "该策略正在使用中",
   "settings.ipPolicyDeleteBoundDescription": "正在引用此策略的应用将完全开放访问。此操作无法撤销。",
   "settings.ipPolicyDeleteConfirm": "删除“{{name}}”？",
   "settings.ipPolicyDeleteDescription": "此操作无法撤销。",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "仅支持 IPv4 / IPv6 地址和 CIDR 网段",
   "settings.ipPolicyMore": "更多",
   "settings.ipPolicyName": "名称",
-  "settings.ipPolicyNameMax": "名称不能超过 {{max}} 个字符",
   "settings.ipPolicyNamePlaceholder": "例：内部网络",
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 698288fd4a6903..ca8517e597981d 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
   "studio.accessControl.emptyPoliciesReadOnly": "请联系工作空间所有者或管理员创建 IP 策略。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
-  "studio.accessControl.enableAccessControl": "启用访问控制",
   "studio.accessControl.entryLabel": "访问控制",
-  "studio.accessControl.excluded": "未覆盖",
   "studio.accessControl.ipPolicy": "IP 策略",
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能会失去访问权限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
diff --git a/web/i18n/locales/zh-Hant/common.json b/web/i18n/locales/zh-Hant/common.json
index 8d8d0180c31b48..c903076e1bd2d0 100644
--- a/web/i18n/locales/zh-Hant/common.json
+++ b/web/i18n/locales/zh-Hant/common.json
@@ -264,7 +264,6 @@
   "settings.ipPolicyAddEntry": "新增",
   "settings.ipPolicyAllowlist": "允許清單",
   "settings.ipPolicyAllowlistHelp": "支援單一地址（203.0.113.42）或 CIDR 網段（10.0.0.0/8），IPv4 與 IPv6 皆可。",
-  "settings.ipPolicyCidrMax": "一條策略最多包含 {{max}} 個地址",
   "settings.ipPolicyColumnIpEntries": "IP 項目",
   "settings.ipPolicyColumnName": "名稱",
   "settings.ipPolicyColumnUpdatedAt": "更新時間",
@@ -273,7 +272,6 @@
   "settings.ipPolicyCurrentIp": "你目前的 IP 是 {{ip}}",
   "settings.ipPolicyCurrentIpError": "無法檢查您的 IP 位址，請重試。",
   "settings.ipPolicyCurrentIpLoading": "正在檢查您的 IP 位址…",
-  "settings.ipPolicyDeleteBound": "該策略正在使用中",
   "settings.ipPolicyDeleteBoundDescription": "這些應用程式將允許從任何 IP 位址存取。此操作無法復原。",
   "settings.ipPolicyDeleteConfirm": "確定刪除 “{{name}}”？",
   "settings.ipPolicyDeleteDescription": "此操作無法復原。",
@@ -292,7 +290,6 @@
   "settings.ipPolicyEntryUnsupported": "僅支援 IPv4 / IPv6 位址和 CIDR 網段",
   "settings.ipPolicyMore": "更多",
   "settings.ipPolicyName": "名稱",
-  "settings.ipPolicyNameMax": "名稱不能超過 {{max}} 個字元",
   "settings.ipPolicyNamePlaceholder": "例：內部網路",
   "settings.ipPolicyNewTitle": "新增 IP 策略",
   "settings.ipPolicyRemoveEntry": "刪除條目",
diff --git a/web/i18n/locales/zh-Hant/deployments.json b/web/i18n/locales/zh-Hant/deployments.json
index f6c3fc1d69e9b2..5ca7a739554ec1 100644
--- a/web/i18n/locales/zh-Hant/deployments.json
+++ b/web/i18n/locales/zh-Hant/deployments.json
@@ -46,9 +46,7 @@
   "studio.accessControl.downgradeTitle": "此應用程式已不再受保護",
   "studio.accessControl.emptyPoliciesReadOnly": "請聯絡工作空間擁有者或管理員建立 IP 原則。",
   "studio.accessControl.emptyPoliciesTitle": "目前工作區還沒有 IP 策略",
-  "studio.accessControl.enableAccessControl": "啟用存取控制",
   "studio.accessControl.entryLabel": "存取控制",
-  "studio.accessControl.excluded": "未涵蓋",
   "studio.accessControl.ipPolicy": "IP 策略",
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能會失去存取權限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 4ee3e21dc0d729..220babf28d5f47 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -1808,7 +1808,6 @@ export default interface Resources {
     'settings.ipPolicyAddEntry': 'Add'
     'settings.ipPolicyAllowlist': 'Allowlist'
     'settings.ipPolicyAllowlistHelp': 'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.'
-    'settings.ipPolicyCidrMax': 'A policy can include up to {{max}} addresses'
     'settings.ipPolicyColumnIpEntries': 'IP Entries'
     'settings.ipPolicyColumnName': 'Name'
     'settings.ipPolicyColumnUpdatedAt': 'Updated at'
@@ -1817,7 +1816,6 @@ export default interface Resources {
     'settings.ipPolicyCurrentIp': 'Your current IP is {{ip}}'
     'settings.ipPolicyCurrentIpError': 'Unable to check your IP address. Please try again.'
     'settings.ipPolicyCurrentIpLoading': 'Checking your IP address…'
-    'settings.ipPolicyDeleteBound': 'This policy is in use'
     'settings.ipPolicyDeleteBoundDescription': 'Apps using this policy will become accessible from any IP address. This can’t be undone.'
     'settings.ipPolicyDeleteConfirm': 'Delete “{{name}}”?'
     'settings.ipPolicyDeleteDescription': 'This can’t be undone.'
@@ -1836,7 +1834,6 @@ export default interface Resources {
     'settings.ipPolicyEntryUnsupported': 'Only IPv4 / IPv6 addresses and CIDR ranges are supported'
     'settings.ipPolicyMore': 'More'
     'settings.ipPolicyName': 'Name'
-    'settings.ipPolicyNameMax': 'Name must be {{max}} characters or fewer'
     'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network'
     'settings.ipPolicyNewTitle': 'New IP Policy'
     'settings.ipPolicyRemoveEntry': 'Remove entry'
@@ -3001,9 +2998,7 @@ export default interface Resources {
     'studio.accessControl.downgradeTitle': 'This app is no longer protected'
     'studio.accessControl.emptyPoliciesReadOnly': 'Ask a workspace owner or admin to create one.'
     'studio.accessControl.emptyPoliciesTitle': 'No IP policies in this workspace yet'
-    'studio.accessControl.enableAccessControl': 'Enable access control'
     'studio.accessControl.entryLabel': 'Access Control'
-    'studio.accessControl.excluded': 'Excluded'
     'studio.accessControl.ipPolicy': 'IP Policy'
     'studio.accessControl.lockoutWarning': "Your IP ({{ip}}) isn't in this policy. You may lose access."
     'studio.accessControl.manageIpPolicies': 'Manage IP policies'
diff --git a/web/service/__tests__/ip-access-denied.spec.ts b/web/service/__tests__/ip-access-denied.spec.ts
index 091a843edce6fa..bccebf7622f3d3 100644
--- a/web/service/__tests__/ip-access-denied.spec.ts
+++ b/web/service/__tests__/ip-access-denied.spec.ts
@@ -1,6 +1,6 @@
-import { toast } from '@/app/notifications'
 import { waitFor } from '@testing-library/react'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vite-plus/test'
+import { toast } from '@/app/notifications'
 import {
   appAccessErrorAtom,
   appAccessStore,
diff --git a/web/service/share.ts b/web/service/share.ts
index 5c1f8edd6a3605..98f8e984452084 100644
--- a/web/service/share.ts
+++ b/web/service/share.ts
@@ -5,13 +5,13 @@ import type { ChatConfig } from '@/app/components/base/chat/types'
 import type { AccessMode } from '@/models/access-control'
 import type { AppConversationData, AppData, AppMeta, ConversationItem } from '@/models/share'
 import { WEB_APP_SHARE_CODE_HEADER_NAME } from '@/config'
-import { consoleClient } from '@/service/console'
 import {
   captureAppAccessScope,
   hasAppAccessError,
   isAppAccessError,
   isAppAccessScopeCurrent,
 } from '@/features/app-access-error/state'
+import { consoleClient } from '@/service/console'
 import {
   del as consoleDel,
   get as consoleGet,

From 8795a5e651ff84179bb2d0f5d789821ffbc42bb2 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 29 Sep 2026 19:24:47 +0800
Subject: [PATCH 079/108] fix(ci): satisfy Python boundary guards and MCP
 checks

---
 api/controllers/mcp/mcp.py                    |  9 ++--
 api/controllers/web/wraps.py                  | 47 +++++--------------
 api/repositories/web_passport_repository.py   | 26 ++++++++++
 .../common/test_access_response.py            | 24 +++++-----
 .../unit_tests/controllers/mcp/test_mcp.py    |  7 +--
 .../web/test_public_app_admission.py          |  4 +-
 .../test_webapp_access_query_repository.py    | 22 ++++++---
 .../test_webapp_access_query_service.py       |  3 ++
 8 files changed, 80 insertions(+), 62 deletions(-)

diff --git a/api/controllers/mcp/mcp.py b/api/controllers/mcp/mcp.py
index d7bf50fb798883..53907cf5dcd84e 100644
--- a/api/controllers/mcp/mcp.py
+++ b/api/controllers/mcp/mcp.py
@@ -4,14 +4,14 @@
 from flask_restx import Resource
 from pydantic import BaseModel, Field, RootModel, ValidationError
 from sqlalchemy import select
-from sqlalchemy.orm import Session, sessionmaker
+from sqlalchemy.orm import Session
 
 from controllers.common.access_response import mcp_server_not_found_response
 from controllers.common.schema import register_response_schema_models, register_schema_model
 from controllers.mcp import mcp_ns
+from core.db.session_factory import session_factory
 from core.mcp import types as mcp_types
 from core.mcp.server.streamable_http import handle_mcp_request, negotiate_protocol_version
-from extensions.ext_database import db
 from graphon.variables.input_entities import VariableEntity, VariableEntityType
 from libs import helper
 from models.enums import EndUserType
@@ -76,7 +76,7 @@ def post(self, server_code: str):
             ValidationError: Invalid request format or parameters
         """
         # response-contract:ignore MCP route returns Flask Response from JSON-RPC handler
-        sessions = sessionmaker(db.engine, expire_on_commit=False)
+        sessions = session_factory.get_session_maker()
         try:
             # Resolve identity before parsing the body: missing identities have
             # one bounded response even for malformed or oversized JSON. Only
@@ -220,8 +220,7 @@ def _get_user_input_form(self, app: App, *, session: Session) -> list[VariableEn
             app_model_config = app.app_model_config_with_session(session=session)
             if app_model_config is None:
                 raise MCPRequestError(mcp_types.INVALID_REQUEST, "App is unavailable")
-            features_dict = app_model_config.to_dict()
-            raw_user_input_form = features_dict.get("user_input_form", [])
+            raw_user_input_form = app_model_config.user_input_form_list
 
         # Convert to VariableEntity objects
         try:
diff --git a/api/controllers/web/wraps.py b/api/controllers/web/wraps.py
index b84e640cc8cf9c..e7ec334b831fc5 100644
--- a/api/controllers/web/wraps.py
+++ b/api/controllers/web/wraps.py
@@ -5,7 +5,6 @@
 
 from flask import request
 from flask_restx import Resource
-from sqlalchemy import select
 from werkzeug.exceptions import NotFound, Unauthorized
 
 from constants import HEADER_NAME_APP_CODE
@@ -15,14 +14,12 @@
     WebAppAuthRequiredError,
     WebAppNotFoundError,
 )
-from core.app.public_runtime import published_app_filter
-from core.db.session_factory import session_factory
 from core.logging.context import set_identity_context
 from extensions.ext_application_services import application_services
 from libs.passport import PassportService
 from libs.token import extract_webapp_passport
-from models.enums import AppStatus
-from models.model import App, EndUser, Site
+from models.model import App, EndUser
+from repositories.web_passport_repository import get_web_passport_identity
 from services.enterprise.enterprise_service import EnterpriseService, WebAppAccessMode, WebAppSettings
 from services.system_feature_service import SystemFeatureService
 from services.web_passport_gateways import resolve_web_app_auth_type
@@ -70,36 +67,18 @@ def decode_jwt_token(app_code: str | None = None, user_id: str | None = None) ->
             raise Unauthorized("App token is missing.")
         decoded = PassportService().verify(tk)
         app_code = decoded.get("app_code")
+        if not isinstance(app_code, str) or not app_code:
+            raise WebAppNotFoundError()
         app_id = decoded.get("app_id")
-        with session_factory.create_session() as session:
-            # A previously issued passport cannot expose an App after its
-            # published artifact disappears. Console/Debug never use this gate.
-            app_model = session.scalar(
-                select(App).where(App.id == app_id, App.status == AppStatus.NORMAL, published_app_filter())
-            )
-            if not app_model:
-                raise WebAppNotFoundError()
-            site = session.scalar(
-                select(Site).where(Site.code == app_code, Site.app_id == app_model.id, Site.status == AppStatus.NORMAL)
-            )
-            if not app_code or not site:
-                raise WebAppNotFoundError()
-            if app_model.enable_site is False:
-                raise WebAppNotFoundError()
-            end_user_id = decoded.get("end_user_id")
-            end_user = session.scalar(
-                select(EndUser).where(
-                    EndUser.id == end_user_id,
-                    EndUser.app_id == app_model.id,
-                    EndUser.tenant_id == app_model.tenant_id,
-                )
-            )
-            if not end_user:
-                raise NotFound()
-
-            # Validate user_id against end_user's session_id if provided
-            if user_id is not None and end_user.session_id != user_id:
-                raise Unauthorized("Authentication has expired.")
+        app_model, end_user = get_web_passport_identity(app_id, app_code, decoded.get("end_user_id"))
+        if app_model is None:
+            raise WebAppNotFoundError()
+        if end_user is None:
+            raise NotFound()
+
+        # Validate user_id against end_user's session_id if provided.
+        if user_id is not None and end_user.session_id != user_id:
+            raise Unauthorized("Authentication has expired.")
 
         # for enterprise webapp auth
         app_web_auth_enabled = False
diff --git a/api/repositories/web_passport_repository.py b/api/repositories/web_passport_repository.py
index f26cb039a699fd..47ef50fd001a7e 100644
--- a/api/repositories/web_passport_repository.py
+++ b/api/repositories/web_passport_repository.py
@@ -6,11 +6,37 @@
 from sqlalchemy.orm import Session, sessionmaker
 
 from core.app.public_runtime import published_app_filter
+from core.db.session_factory import session_factory as global_session_factory
 from models.enums import AppStatus, EndUserType
 from models.model import App, EndUser, Site
 from services.entities.passport_entities import EndUserRecord, WebAppRecord, WebPassportEndUserResolution
 
 
+def get_web_passport_identity(
+    app_id: str | None, app_code: str | None, end_user_id: str | None
+) -> tuple[App | None, EndUser | None]:
+    """Resolve a previously issued passport against the current published app and owner chain."""
+    with global_session_factory.create_session() as session:
+        app = session.scalar(
+            select(App).where(App.id == app_id, App.status == AppStatus.NORMAL, published_app_filter())
+        )
+        if app is None:
+            return None, None
+        site = session.scalar(
+            select(Site).where(Site.code == app_code, Site.app_id == app.id, Site.status == AppStatus.NORMAL)
+        )
+        if app_code is None or site is None or app.enable_site is False:
+            return None, None
+        end_user = session.scalar(
+            select(EndUser).where(
+                EndUser.id == end_user_id,
+                EndUser.app_id == app.id,
+                EndUser.tenant_id == app.tenant_id,
+            )
+        )
+        return app, end_user
+
+
 class WebPassportRepository:
     def __init__(
         self,
diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
index 7f527ebb8465a1..9a2f23be4f72e7 100644
--- a/api/tests/unit_tests/controllers/common/test_access_response.py
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -6,13 +6,14 @@
 from collections.abc import Buffer, Generator
 from contextlib import contextmanager
 from types import SimpleNamespace
-from typing import Literal, Never, override
+from typing import Literal, Never, cast, override
 from unittest.mock import MagicMock
 
 import pytest
 from flask import Blueprint, Flask, Response, jsonify, request
 from flask.testing import FlaskClient
 from flask_restx import Namespace, Resource
+from sqlalchemy import Table
 from werkzeug.exceptions import NotFound, Unauthorized
 
 import controllers.service_api.wraps as token_wraps
@@ -29,6 +30,7 @@
 from extensions import ext_request_logging
 from libs.external_api import ExternalApi
 from models.engine import db
+from models.model import ApiToken
 from services.app.mcp_server_service import AppMCPServerStatus
 from tests.unit_tests.config_override import apply_config_overrides
 
@@ -121,18 +123,14 @@ def test_invalid_token_final_response_and_no_usage(token_client: TokenClient) ->
 
 
 def test_invalid_token_database_path_does_not_record_usage(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
-    session = MagicMock()
-    session.scalar.return_value = None
-    maker = MagicMock()
-    maker.return_value.__enter__.return_value = session
     usage = MagicMock()
-    monkeypatch.setattr(token_service, "Session", maker)
     monkeypatch.setattr(token_service.ApiTokenCache, "set", MagicMock())
     monkeypatch.setattr(token_service, "record_token_usage", usage)
-    with http_app.app_context(), pytest.raises(Unauthorized, match="Access token is invalid"):
-        token_service.query_token_from_db("missing-token", "app")
+    with http_app.app_context():
+        cast(Table, ApiToken.__table__).create(db.engine)
+        with pytest.raises(Unauthorized, match="Access token is invalid"):
+            token_service.query_token_from_db("missing-token", "app")
     usage.assert_not_called()
-    session.add.assert_not_called()
 
 
 def test_success_token_and_other_surface_are_not_rewritten(token_client: TokenClient) -> None:
@@ -158,10 +156,10 @@ def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
     api.add_namespace(namespace)
     http_app.register_blueprint(bp)
     monkeypatch.setattr(mcp, "mcp_ns", namespace)
-    session = MagicMock()
+    session = MagicMock()  # guard-ignore: no-new-session-mock -- controls HTTP query results
     maker = MagicMock()
-    maker.return_value.begin.return_value.__enter__.return_value = session
-    monkeypatch.setattr(mcp, "sessionmaker", maker)
+    maker.begin.return_value.__enter__.return_value = session
+    monkeypatch.setattr(mcp.session_factory, "get_session_maker", lambda: maker)
     execute = MagicMock()
     end_user = MagicMock()
     monkeypatch.setattr(mcp, "handle_mcp_request", execute)
@@ -371,7 +369,7 @@ def begin() -> Generator[MagicMock]:
         finally:
             active_sessions.pop()
 
-    monkeypatch.setattr(mcp, "sessionmaker", lambda *_args, **_kwargs: SimpleNamespace(begin=begin))
+    monkeypatch.setattr(mcp.session_factory, "get_session_maker", lambda: SimpleNamespace(begin=begin))
     form = MagicMock(return_value=[])
     process = MagicMock(return_value=Response("ok", status=200))
     monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", form)
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp.py b/api/tests/unit_tests/controllers/mcp/test_mcp.py
index c7591c6a1e847c..0e49d01231f6f2 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp.py
@@ -13,7 +13,7 @@
 from flask import Flask, Response
 from pydantic import ValidationError
 from sqlalchemy import inspect
-from sqlalchemy.orm import Session
+from sqlalchemy.orm import Session, sessionmaker
 
 import controllers.mcp.mcp as module
 from models.engine import db
@@ -39,7 +39,8 @@ def app() -> Iterator[Flask]:
             Workflow.__table__,
         ):
             table.create(db.engine)
-        yield app
+        with patch.object(module.session_factory, "get_session_maker", return_value=sessionmaker(db.engine)):
+            yield app
 
 
 @pytest.fixture(autouse=True)
@@ -602,7 +603,7 @@ def test_identity_query_does_not_accept_a_server_bound_to_another_tenants_app()
     server.tenant_id = str(uuid4())
     db.session.add_all([app_model, server])
     db.session.commit()
-    with module.sessionmaker(db.engine).begin() as session:
+    with sessionmaker(db.engine).begin() as session:
         with pytest.raises(module.MCPServerNotFoundError):
             module.MCPAppApi()._get_mcp_server_and_app("server-1", session)
 
diff --git a/api/tests/unit_tests/controllers/web/test_public_app_admission.py b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
index 16de6e60eace67..2c263848e0a5b9 100644
--- a/api/tests/unit_tests/controllers/web/test_public_app_admission.py
+++ b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
@@ -268,7 +268,9 @@ def test_real_database_failure_is_not_reclassified_as_unpublished(
     failing_factory = MagicMock(return_value=failing_session)
     h.access_repo._session_factory = failing_factory
     h.passport_repo._session_factory = failing_factory
-    monkeypatch.setattr(wraps.session_factory, "create_session", failing_factory)
+    from repositories import web_passport_repository
+
+    monkeypatch.setattr(web_passport_repository.global_session_factory, "create_session", failing_factory)
     response = h.client.get("/api" + route, headers={"X-App-Code": "fixture-code"})
     assert response.status_code == (503 if route.startswith(("/webapp", "/login")) else 500)
     assert response.get_json()["code"] != "app_not_found"
diff --git a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
index bca4e114b61752..8365ecc949ad12 100644
--- a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
+++ b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
@@ -1,6 +1,7 @@
 from unittest.mock import MagicMock
 
 import pytest
+from sqlalchemy import Engine, event
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm import Session, sessionmaker
 
@@ -82,13 +83,22 @@ def test_malformed_app_id_is_not_a_database_error() -> None:
     factory.assert_not_called()
 
 
-def test_app_id_database_failure_remains_unavailable() -> None:
+def test_app_id_database_failure_remains_unavailable(
+    sqlite_session_factory: sessionmaker[Session], sqlite_engine: Engine
+) -> None:
     database_error = OperationalError("select", {}, RuntimeError("connection failed"))
-    session = MagicMock()
-    session.__enter__.return_value.scalar.side_effect = database_error
-    repository = WebAppAccessQueryRepository(session_factory=MagicMock(return_value=session))
-    with pytest.raises(WebAppAccessUnavailableError):
-        repository.is_app_available(_APP_ID)
+
+    def fail_query(*_args: object) -> None:
+        raise database_error
+
+    event.listen(sqlite_engine, "before_cursor_execute", fail_query)
+    try:
+        repository = WebAppAccessQueryRepository(session_factory=sqlite_session_factory)
+        with pytest.raises(WebAppAccessUnavailableError) as raised:
+            repository.is_app_available(_APP_ID)
+        assert raised.value.__cause__ is database_error
+    finally:
+        event.remove(sqlite_engine, "before_cursor_execute", fail_query)
 
 
 def test_find_app_id_by_code_returns_none_for_missing_code(
diff --git a/api/tests/unit_tests/services/test_webapp_access_query_service.py b/api/tests/unit_tests/services/test_webapp_access_query_service.py
index dc8c7d1740c4b4..98de3dbd3bf231 100644
--- a/api/tests/unit_tests/services/test_webapp_access_query_service.py
+++ b/api/tests/unit_tests/services/test_webapp_access_query_service.py
@@ -321,6 +321,9 @@ def get_user_permissions(self, *, user_id: str, app_ids: Sequence[str]) -> Mappi
     def find_app_id_by_code(self, app_code: str) -> str | None:
         raise AssertionError(f"Batch queries must not resolve app codes: {app_code}")
 
+    def is_app_available(self, app_id: str) -> bool:
+        raise AssertionError(f"Batch queries must not check app availability: {app_id}")
+
     def get_access_mode(self, app_id: str) -> WebAppAccessMode:
         raise AssertionError(f"Batch queries must not use single-app lookups: {app_id}")
 

From 3f478c83e81281f59247551b15f84e820b4d4c41 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Thu, 8 Oct 2026 11:25:01 +0800
Subject: [PATCH 080/108] test(api): use real clients for network access
 regression

---
 .../test_ext_application_services.py          |   2 +-
 .../test_network_access_group_gateway.py      | 298 ++++++++++++------
 2 files changed, 204 insertions(+), 96 deletions(-)

diff --git a/api/tests/unit_tests/extensions/test_ext_application_services.py b/api/tests/unit_tests/extensions/test_ext_application_services.py
index c63c06602e3df4..7fdda108dab392 100644
--- a/api/tests/unit_tests/extensions/test_ext_application_services.py
+++ b/api/tests/unit_tests/extensions/test_ext_application_services.py
@@ -679,7 +679,7 @@ def test_build_application_services_wires_network_access_group_boundary(
         database_client=sqlite_session_factory,
         deployment_edition=DeploymentEdition.CLOUD,
         initialization_password="",
-        redis=MagicMock(spec=RedisClientWrapper),
+        redis=_redis(),
     )
 
     network_access_groups = services.network_access_groups
diff --git a/api/tests/unit_tests/services/test_network_access_group_gateway.py b/api/tests/unit_tests/services/test_network_access_group_gateway.py
index 9dcbd56eeedd69..7d7a9f42b31d62 100644
--- a/api/tests/unit_tests/services/test_network_access_group_gateway.py
+++ b/api/tests/unit_tests/services/test_network_access_group_gateway.py
@@ -1,3 +1,5 @@
+from collections.abc import Callable, Generator
+from typing import Protocol, cast, override
 from unittest.mock import MagicMock, call, patch
 
 import httpx
@@ -47,70 +49,151 @@ def _binding_wire(**overrides: object) -> dict[str, object]:
     }
 
 
-def _gateway(*, base_url: str = "https://network-access.internal/v1/") -> tuple[NetworkAccessGroupGateway, MagicMock]:
-    http_client = MagicMock(spec=httpx.Client)
-    return (
-        NetworkAccessGroupGateway(
-            base_url=base_url,
-            fallback_base_url="https://billing.internal/v1",
-            secret_key="test-secret",
-            http_client=http_client,
-        ),
-        http_client,
-    )
-
-
-def test_network_access_requests_use_independent_api_url_when_configured() -> None:
-    gateway, http_client = _gateway()
+class RecordingHTTPClient(httpx.Client):
+    """Exercise httpx serialization while keeping all requests inside MockTransport."""
+
+    def __init__(self) -> None:
+        self.response: httpx.Response | MagicMock = httpx.Response(200, json={})
+        self.request_calls: list[object] = []
+        self.wire_requests: list[httpx.Request] = []
+        super().__init__(
+            transport=httpx.MockTransport(self._respond),
+            timeout=httpx.Timeout(30.0, connect=5.0),
+            trust_env=False,
+        )
+
+    @override
+    def request(self, *args: object, **kwargs: object) -> httpx.Response:
+        self.request_calls.append(call(*args, **kwargs))
+        return cast(Callable[..., httpx.Response], super().request)(*args, **kwargs)
+
+    def _respond(self, request: httpx.Request) -> httpx.Response:
+        self.wire_requests.append(request)
+        if isinstance(self.response, httpx.Response):
+            return httpx.Response(
+                self.response.status_code, content=self.response.content, headers=self.response.headers
+            )
+        return httpx.Response(self.response.status_code, json=self.response.json())
+
+
+class GatewayFactory(Protocol):
+    def __call__(
+        self, *, base_url: str = "https://network-access.internal/v1/"
+    ) -> tuple[NetworkAccessGroupGateway, RecordingHTTPClient]: ...
+
+
+@pytest.fixture
+def gateway_factory() -> Generator[GatewayFactory]:
+    clients: list[RecordingHTTPClient] = []
+
+    def create(
+        *, base_url: str = "https://network-access.internal/v1/"
+    ) -> tuple[NetworkAccessGroupGateway, RecordingHTTPClient]:
+        http_client = RecordingHTTPClient()
+        clients.append(http_client)
+        return (
+            NetworkAccessGroupGateway(
+                base_url=base_url,
+                fallback_base_url="https://billing.internal/v1",
+                secret_key="test-secret",
+                http_client=http_client,
+            ),
+            http_client,
+        )
+
+    try:
+        yield create
+    finally:
+        for client in clients:
+            client.close()
+            assert client.is_closed
+
+
+def test_network_access_requests_use_independent_api_url_when_configured(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory()
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
-    http_client.request.return_value = response
+    http_client.response = response
 
     gateway.list_groups(TENANT_ID, ACCOUNT_ID)
 
-    http_client.request.assert_called_once_with(
-        "GET",
-        f"https://network-access.internal/v1/tenants/{TENANT_ID}/network-access-groups",
-        json=None,
-        params={"actor_account_id": ACCOUNT_ID},
-        headers=HEADERS,
-        follow_redirects=True,
-    )
+    assert http_client.request_calls == [
+        call(
+            "GET",
+            f"https://network-access.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+            json=None,
+            params={"actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        )
+    ]
 
 
-def test_network_access_requests_fall_back_to_billing_api_url() -> None:
-    gateway, http_client = _gateway(base_url="")
+def test_network_access_requests_fall_back_to_billing_api_url(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
-    http_client.request.return_value = response
+    http_client.response = response
 
     gateway.list_groups(TENANT_ID, ACCOUNT_ID)
 
-    http_client.request.assert_called_once_with(
-        "GET",
-        f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
-        json=None,
-        params={"actor_account_id": ACCOUNT_ID},
-        headers=HEADERS,
-        follow_redirects=True,
+    assert http_client.request_calls == [
+        call(
+            "GET",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
+            json=None,
+            params={"actor_account_id": ACCOUNT_ID},
+            headers=HEADERS,
+            follow_redirects=True,
+        )
+    ]
+
+
+def test_injected_http_client_keeps_timeout_and_remains_reusable(gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
+    client.response = httpx.Response(200, json={"tenant_id": TENANT_ID, "entitled": True, "groups": []})
+
+    gateway.list_groups(TENANT_ID, ACCOUNT_ID)
+
+    first = client.wire_requests[0]
+    assert first.method == "GET"
+    assert str(first.url) == (
+        f"https://network-access.internal/v1/tenants/{TENANT_ID}/network-access-groups?actor_account_id={ACCOUNT_ID}"
     )
+    assert first.headers["Billing-Api-Secret-Key"] == "test-secret"
+    assert first.headers["Content-Type"] == "application/json"
+    assert first.content == b""
+    assert first.extensions["timeout"] == {"connect": 5.0, "read": 30.0, "write": 30.0, "pool": 30.0}
+    assert not client.is_closed
 
+    client.timeout = httpx.Timeout(8.0, connect=1.5)
+    gateway.list_groups(TENANT_ID, ACCOUNT_ID)
 
-def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
-    gateway, http_client = _gateway(base_url="")
+    assert len(client.wire_requests) == 2
+    assert client.wire_requests[1].extensions["timeout"] == {
+        "connect": 1.5,
+        "read": 8.0,
+        "write": 8.0,
+        "pool": 8.0,
+    }
+    assert not client.is_closed
+
+
+def test_group_list_and_item_reads_use_authenticated_saas_endpoints(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()},
         {"group": _group_wire()},
     ]
-    http_client.request.return_value = response
+    http_client.response = response
 
     list_result = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
     item_result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
     assert list_result.groups == ()
     assert item_result.id == GROUP_ID
-    assert http_client.request.call_args_list == [
+    assert http_client.request_calls == [
         call(
             "GET",
             f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
@@ -130,15 +213,15 @@ def test_group_list_and_item_reads_use_authenticated_saas_endpoints() -> None:
     ]
 
 
-def test_group_mutations_inject_actor_and_use_expected_version() -> None:
-    gateway, http_client = _gateway(base_url="")
+def test_group_mutations_inject_actor_and_use_expected_version(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"group": _group_wire(version="1")},
         {"group": _group_wire(version="2")},
         {"deleted": True},
     ]
-    http_client.request.return_value = response
+    http_client.response = response
 
     gateway.create_group(
         TENANT_ID,
@@ -163,7 +246,7 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
         actor_account_id=ACCOUNT_ID,
     )
 
-    assert http_client.request.call_args_list == [
+    assert http_client.request_calls == [
         call(
             "POST",
             f"https://billing.internal/v1/tenants/{TENANT_ID}/network-access-groups",
@@ -202,8 +285,8 @@ def test_group_mutations_inject_actor_and_use_expected_version() -> None:
     ]
 
 
-def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
-    gateway, http_client = _gateway(base_url="")
+def test_app_config_read_and_atomic_write_use_tenant_and_app_path(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.side_effect = [
         {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
@@ -218,7 +301,7 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
             )
         },
     ]
-    http_client.request.return_value = response
+    http_client.response = response
 
     gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
     gateway.update_app_binding(
@@ -241,7 +324,7 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
     )
 
     endpoint = f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group"
-    assert http_client.request.call_args_list == [
+    assert http_client.request_calls == [
         call(
             "GET",
             endpoint,
@@ -281,28 +364,32 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path() -> None:
     ]
 
 
-def test_app_lifecycle_cleanup_uses_internal_secret_endpoint() -> None:
-    gateway, http_client = _gateway(base_url="")
+def test_app_lifecycle_cleanup_uses_internal_secret_endpoint(gateway_factory: GatewayFactory) -> None:
+    gateway, http_client = gateway_factory(base_url="")
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = {"deleted": True}
-    http_client.request.return_value = response
+    http_client.response = response
 
     result = gateway.cleanup_app_binding(TENANT_ID, APP_ID)
 
     assert result is True
-    http_client.request.assert_called_once_with(
-        "DELETE",
-        f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group-binding",
-        json=None,
-        params=None,
-        headers=HEADERS,
-        follow_redirects=True,
-    )
+    assert http_client.request_calls == [
+        call(
+            "DELETE",
+            f"https://billing.internal/v1/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group-binding",
+            json=None,
+            params=None,
+            headers=HEADERS,
+            follow_redirects=True,
+        )
+    ]
 
 
 @pytest.mark.parametrize("status_code", [400, 403, 404, 409, 500, 503])
-def test_network_access_group_request_preserves_upstream_status(status_code: int) -> None:
-    gateway, _ = _gateway()
+def test_network_access_group_request_preserves_upstream_status(
+    status_code: int, gateway_factory: GatewayFactory
+) -> None:
+    gateway, _ = gateway_factory()
     response = MagicMock(status_code=status_code)
     with (
         patch.object(gateway, "_send_http_request", return_value=response),
@@ -313,8 +400,8 @@ def test_network_access_group_request_preserves_upstream_status(status_code: int
     assert exc_info.value.status_code == status_code
 
 
-def test_network_access_group_request_preserves_upstream_reason() -> None:
-    gateway, _ = _gateway()
+def test_network_access_group_request_preserves_upstream_reason(gateway_factory: GatewayFactory) -> None:
+    gateway, _ = gateway_factory()
     response = MagicMock(status_code=httpx.codes.CONFLICT)
     response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_VERSION_CONFLICT", "message": "internal"}
     with (
@@ -327,8 +414,10 @@ def test_network_access_group_request_preserves_upstream_reason() -> None:
     assert exc_info.value.reason == "NETWORK_ACCESS_VERSION_CONFLICT"
 
 
-def test_network_access_group_request_maps_transport_failure_to_service_unavailable() -> None:
-    gateway, _ = _gateway()
+def test_network_access_group_request_maps_transport_failure_to_service_unavailable(
+    gateway_factory: GatewayFactory,
+) -> None:
+    gateway, _ = gateway_factory()
     request = httpx.Request("GET", "https://network-access.internal/v1/groups")
     with (
         patch.object(
@@ -343,8 +432,8 @@ def test_network_access_group_request_maps_transport_failure_to_service_unavaila
     assert exc_info.value.status_code == httpx.codes.SERVICE_UNAVAILABLE
 
 
-def test_network_access_group_request_rejects_non_object_response() -> None:
-    gateway, _ = _gateway()
+def test_network_access_group_request_rejects_non_object_response(gateway_factory: GatewayFactory) -> None:
+    gateway, _ = gateway_factory()
     response = MagicMock(status_code=httpx.codes.OK)
     response.json.return_value = list[object]()
     with (
@@ -354,6 +443,21 @@ def test_network_access_group_request_rejects_non_object_response() -> None:
         gateway._send_request("GET", "/groups")
 
 
+@pytest.mark.parametrize("body", [b"{", b"\xff", b""])
+def test_invalid_json_is_rejected_after_transport_receives_raw_response(
+    gateway_factory: GatewayFactory, body: bytes
+) -> None:
+    gateway, client = gateway_factory()
+    client.response = httpx.Response(200, content=body, headers={"Content-Type": "application/json"})
+
+    with pytest.raises(NetworkAccessGroupInvalidResponseError) as raised:
+        gateway._send_request("GET", "/groups")
+
+    assert isinstance(raised.value.__cause__, ValueError)
+    assert len(client.wire_requests) == 1
+    assert not client.is_closed
+
+
 @pytest.mark.parametrize("plan", [CloudPlan.PROFESSIONAL, CloudPlan.TEAM])
 def test_billing_entitlement_gateway_accepts_paid_plans(plan: CloudPlan) -> None:
     gateway = BillingNetworkAccessGroupEntitlementGateway()
@@ -411,10 +515,10 @@ def test_billing_entitlement_gateway_does_not_mask_unexpected_value_error() -> N
         gateway.is_paid_plan(TENANT_ID)
 
 
-def test_protojson_defaults_are_materialized_before_service_boundary() -> None:
-    gateway, client = _gateway()
+def test_protojson_defaults_are_materialized_before_service_boundary(gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
-    client.request.return_value = response
+    client.response = response
     response.json.return_value = {"tenantId": TENANT_ID}
     groups = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
     assert groups.entitled is False
@@ -439,8 +543,8 @@ def test_protojson_defaults_are_materialized_before_service_boundary() -> None:
     assert gateway.cleanup_app_binding(TENANT_ID, APP_ID) is False
 
 
-def test_policy_protojson_aliases_and_count_defaults_are_decoded_once() -> None:
-    gateway, client = _gateway()
+def test_policy_protojson_aliases_and_count_defaults_are_decoded_once(gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     wire = {
         "id": GROUP_ID,
         "tenantId": TENANT_ID,
@@ -453,7 +557,7 @@ def test_policy_protojson_aliases_and_count_defaults_are_decoded_once() -> None:
     }
     response = MagicMock(status_code=200)
     response.json.return_value = {"group": wire}
-    client.request.return_value = response
+    client.response = response
     result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
     assert result.version == 9007199254740993
     assert result.used_by_count == 1  # Legacy replies without a count retain the reference fallback.
@@ -467,25 +571,27 @@ def test_policy_protojson_aliases_and_count_defaults_are_decoded_once() -> None:
 
 @pytest.mark.parametrize("alias", ["group_id", "groupId", "policy_id", "policyId"])
 @pytest.mark.parametrize("group_id", [GROUP_ID, None, ""])
-def test_binding_policy_aliases_and_nullable_references(alias: str, group_id: str | None) -> None:
-    gateway, client = _gateway()
+def test_binding_policy_aliases_and_nullable_references(
+    alias: str, group_id: str | None, gateway_factory: GatewayFactory
+) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID, "binding": _binding_wire(**{alias: group_id})}
-    client.request.return_value = response
+    client.response = response
     binding = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding
     assert binding is not None
     assert binding.group_id == (group_id or None)
 
 
-def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload() -> None:
-    gateway, client = _gateway()
+def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload(gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     scopes = ["webapp", "future_scope", "trigger"]
     response = MagicMock(status_code=200)
     response.json.return_value = {
         "effectiveEnabled": True,
         "binding": _binding_wire(enabled=True, policyId=GROUP_ID, accessPoints=scopes),
     }
-    client.request.return_value = response
+    client.response = response
     result = gateway.update_app_binding(
         TENANT_ID,
         APP_ID,
@@ -503,48 +609,48 @@ def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload() -> No
 
 
 @pytest.mark.parametrize("value", [True, False, 1.0, "1.5", "invalid", 0, -1, 2**63, str(2**63)])
-def test_invalid_versions_are_rejected_at_gateway(value: object) -> None:
-    gateway, client = _gateway()
+def test_invalid_versions_are_rejected_at_gateway(value: object, gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = {"group": _group_wire(version=value)}
-    client.request.return_value = response
+    client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
 
 @pytest.mark.parametrize("version", [1, "1", 2**63 - 1, str(2**63 - 1)])
-def test_int64_versions_do_not_lose_precision(version: int | str) -> None:
-    gateway, client = _gateway()
+def test_int64_versions_do_not_lose_precision(version: int | str, gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = {"group": _group_wire(version=version)}
-    client.request.return_value = response
+    client.response = response
     assert gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID).version == int(version)
 
 
 @pytest.mark.parametrize("field", ["entitled", "effective_enabled", "enabled"])
 @pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
-def test_wire_flags_are_strict_booleans(field: str, value: object) -> None:
-    gateway, client = _gateway()
+def test_wire_flags_are_strict_booleans(field: str, value: object, gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     binding = _binding_wire()
     payload: dict[str, object] = {"tenant_id": TENANT_ID, "app_id": APP_ID, "binding": binding}
     (binding if field == "enabled" else payload)[field] = value
     response = MagicMock(status_code=200)
     response.json.return_value = payload
-    client.request.return_value = response
+    client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
 
 
 @pytest.mark.parametrize("alias", ["groupId", "policy_id", "policyId"])
-def test_conflicting_policy_aliases_fail_instead_of_selecting_one(alias: str) -> None:
-    gateway, client = _gateway()
+def test_conflicting_policy_aliases_fail_instead_of_selecting_one(alias: str, gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = {
         "tenant_id": TENANT_ID,
         "app_id": APP_ID,
         "binding": _binding_wire(group_id=GROUP_ID, **{alias: APP_ID}),
     }
-    client.request.return_value = response
+    client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
     response.json.return_value["binding"][alias] = GROUP_ID
@@ -554,21 +660,23 @@ def test_conflicting_policy_aliases_fail_instead_of_selecting_one(alias: str) ->
 
 
 @pytest.mark.parametrize("payload", [{}, {"group": None}, {"group": {"version": "1"}}])
-def test_existing_policy_identity_fields_are_never_fabricated(payload: dict[str, object]) -> None:
-    gateway, client = _gateway()
+def test_existing_policy_identity_fields_are_never_fabricated(
+    payload: dict[str, object], gateway_factory: GatewayFactory
+) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = payload
-    client.request.return_value = response
+    client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
 
 @pytest.mark.parametrize("field", ["used_by_count", "enforcing_count"])
 @pytest.mark.parametrize("value", [True, 0.0, "0.5", -1])
-def test_invalid_policy_counts_are_rejected(field: str, value: object) -> None:
-    gateway, client = _gateway()
+def test_invalid_policy_counts_are_rejected(field: str, value: object, gateway_factory: GatewayFactory) -> None:
+    gateway, client = gateway_factory()
     response = MagicMock(status_code=200)
     response.json.return_value = {"group": _group_wire(**{field: value})}
-    client.request.return_value = response
+    client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)

From da21c3896678a5142adaa2baa27c3ba60e1d671c Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Thu, 8 Oct 2026 14:42:49 +0800
Subject: [PATCH 081/108] feat(web): track IP access control analytics

---
 .../access-control/__tests__/index.spec.tsx   | 326 +++++++++++++++++-
 .../access-control/config-panel.tsx           |  10 +
 .../app/access-point/access-control/index.tsx | 255 ++++++++++----
 .../access-control/status-panel.tsx           |  22 +-
 web/app/components/app/access-point/index.tsx |  36 +-
 .../__tests__/access-point-page-view.spec.ts  | 113 ++++++
 .../amplitude/access-point-page-properties.ts |  14 +
 web/app/components/base/amplitude/runtime.ts  |  23 +-
 .../ip-policies-page/__tests__/index.spec.tsx | 142 +++++++-
 .../ip-policies-page/index.tsx                | 122 +++++--
 .../ip-policies-page/policy-dialog.tsx        |  13 +-
 .../ip-policies-page/policy-form-analytics.ts |  34 ++
 .../ip-policies-page/policy-item.tsx          |  21 +-
 .../agent-v2/agent-detail/access/page.tsx     |   1 +
 .../__tests__/analytics.spec.ts               |  77 +++++
 web/features/network-access/analytics.ts      | 202 +++++++++++
 16 files changed, 1290 insertions(+), 121 deletions(-)
 create mode 100644 web/app/components/base/amplitude/__tests__/access-point-page-view.spec.ts
 create mode 100644 web/app/components/base/amplitude/access-point-page-properties.ts
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/policy-form-analytics.ts
 create mode 100644 web/features/network-access/__tests__/analytics.spec.ts
 create mode 100644 web/features/network-access/analytics.ts

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 18c59b4c42e805..b2e4d59bd5db0a 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -9,6 +9,7 @@ import type {
 } from '@dify/contracts/api/console/workspaces/types.gen'
 import { act, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { trackEvent } from '@/app/components/base/amplitude'
 import { consoleQuery } from '@/service/console'
 import {
   createNetworkAccessGroupFixture,
@@ -20,6 +21,7 @@ import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console
 import { AccessControlEntry } from '..'
 
 const mockSetPricing = vi.fn()
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
 const mockSetSettingsDestination = vi.fn()
 const accessControlTranslations = vi.hoisted(() => ({
   'operation.back': 'Back',
@@ -106,6 +108,7 @@ const renderEntry = ({
 
   return renderWithConsoleQuery(
     <AccessControlEntry
+      appMode="chat"
       appId="app-1"
       appIcon={{}}
       isPublished={isPublished}
@@ -162,10 +165,106 @@ describe('AccessControlEntry', () => {
     vi.clearAllMocks()
   })
 
+  it.each([
+    { entryStatus: 'off', plan: 'professional', binding: null },
+    { entryStatus: 'paused', plan: 'professional', binding: createBinding({ enabled: false }) },
+    { entryStatus: 'on', plan: 'professional', binding: createBinding() },
+    {
+      entryStatus: 'partial',
+      plan: 'professional',
+      binding: createBinding({ access_points: ['webapp'] }),
+    },
+    { entryStatus: 'sandbox', plan: 'sandbox', binding: null },
+    { entryStatus: 'lapsed', plan: 'sandbox', binding: createBinding() },
+  ] as const)(
+    'reports the $entryStatus status before opening the panel',
+    async ({ entryStatus, plan, binding }) => {
+      const user = userEvent.setup()
+      renderEntry({ plan, binding, groups: [createNetworkAccessGroupFixture()] })
+      await user.click(getChip())
+      expect(
+        vi
+          .mocked(trackEvent)
+          .mock.calls.filter(([event]) => event === 'access_control_entry_click'),
+      ).toEqual([
+        [
+          'access_control_entry_click',
+          {
+            app_id: 'app-1',
+            app_mode: 'chat',
+            access_point_total: 3,
+            entry_status: entryStatus,
+            has_draft: false,
+          },
+        ],
+      ])
+      if (entryStatus === 'lapsed') {
+        await user.click(screen.getByRole('button', { name: /Turn on/ }))
+        expect(trackEvent).toHaveBeenCalledWith('access_control_upgrade_click', {
+          app_id: 'app-1',
+          app_mode: 'chat',
+          access_point_total: 3,
+          plan_state: 'lapsed',
+        })
+      }
+    },
+  )
+
+  it('tracks first configuration, dismissal and draft restoration without duplicating entry clicks', async () => {
+    const user = userEvent.setup()
+    renderEntry({ plan: 'professional', groups: [createNetworkAccessGroupFixture()] })
+    await user.click(getChip())
+    expect(trackEvent).toHaveBeenCalledWith('access_control_entry_click', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      entry_status: 'off',
+      has_draft: false,
+    })
+    expect(trackEvent).toHaveBeenCalledWith('access_control_interaction', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      action: 'edit_started',
+      edit_entry: 'first_config',
+    })
+    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    expect(trackEvent).toHaveBeenCalledWith('access_control_interaction', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      action: 'policy_selected',
+      policy_id: 'group-1',
+    })
+    await user.keyboard('{Escape}')
+    await waitFor(() =>
+      expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
+    )
+    expect(trackEvent).toHaveBeenCalledWith('access_control_interaction', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      action: 'edit_abandoned',
+      abandon_method: 'dismiss',
+    })
+    await user.click(getChip())
+    expect(trackEvent).toHaveBeenLastCalledWith('access_control_interaction', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      action: 'edit_started',
+      edit_entry: 'draft_restored',
+    })
+    expect(
+      vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'access_control_entry_click'),
+    ).toHaveLength(2)
+  })
+
   it('does not render on community edition', () => {
     renderEntry({ deploymentEdition: 'COMMUNITY', plan: 'sandbox' })
 
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+    expect(trackEvent).not.toHaveBeenCalled()
   })
 
   it('does not render on enterprise edition', () => {
@@ -289,6 +388,12 @@ describe('AccessControlEntry', () => {
     await user.click(turnOn)
 
     expect(mockSetPricing).toHaveBeenCalledWith('open')
+    expect(trackEvent).toHaveBeenLastCalledWith('access_control_upgrade_click', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      plan_state: 'sandbox',
+    })
   })
 
   it('closes the paywall on Escape without side effects', async () => {
@@ -1009,7 +1114,13 @@ describe('supported access points and binding permission', () => {
     await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
 
     rendered.rerender(
-      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding={false} />,
+      <AccessControlEntry
+        appMode="chat"
+        appId="app-1"
+        appIcon={{}}
+        isPublished={false}
+        canEditBinding={false}
+      />,
     )
     await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
     await user.click(getChip())
@@ -1023,7 +1134,13 @@ describe('supported access points and binding permission', () => {
     )
 
     rendered.rerender(
-      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+      <AccessControlEntry
+        appMode="chat"
+        appId="app-1"
+        appIcon={{}}
+        isPublished={false}
+        canEditBinding
+      />,
     )
     await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
     await user.click(getChip())
@@ -1048,7 +1165,13 @@ describe('supported access points and binding permission', () => {
     expect(screen.getByRole('alertdialog')).toBeInTheDocument()
 
     rendered.rerender(
-      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding={false} />,
+      <AccessControlEntry
+        appMode="chat"
+        appId="app-1"
+        appIcon={{}}
+        isPublished={false}
+        canEditBinding={false}
+      />,
     )
     await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
     await user.click(getChip())
@@ -1056,7 +1179,13 @@ describe('supported access points and binding permission', () => {
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
 
     rendered.rerender(
-      <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+      <AccessControlEntry
+        appMode="chat"
+        appId="app-1"
+        appIcon={{}}
+        isPublished={false}
+        canEditBinding
+      />,
     )
     await user.click(getChip())
     expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument()
@@ -1111,7 +1240,13 @@ describe('supported access points and binding permission', () => {
     await user.click(screen.getByRole('switch', { name: 'Web App' }))
     await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     rendered.rerender(
-      <AccessControlEntry appId="app-2" appIcon={{}} isPublished={false} canEditBinding />,
+      <AccessControlEntry
+        appMode="chat"
+        appId="app-2"
+        appIcon={{}}
+        isPublished={false}
+        canEditBinding
+      />,
     )
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
     await user.click(getChip())
@@ -1144,7 +1279,13 @@ describe('supported access points and binding permission', () => {
     const fetchSpy = vi.spyOn(globalThis, 'fetch').mockImplementation(async () => response())
     try {
       renderWithConsoleQuery(
-        <AccessControlEntry appId="app-1" appIcon={{}} isPublished={false} canEditBinding />,
+        <AccessControlEntry
+          appMode="chat"
+          appId="app-1"
+          appIcon={{}}
+          isPublished={false}
+          canEditBinding
+        />,
         {
           queryClient,
           systemFeatures: { deployment_edition: 'CLOUD' },
@@ -1229,6 +1370,85 @@ const openSelectedConfig = async (user: ReturnType<typeof userEvent.setup>) => {
 const lockoutWarning = "Your IP (203.0.113.42) isn't in this policy. You may lose access."
 
 describe('trusted IP checks before saving', () => {
+  it.each([
+    [403, 'This feature requires a paid plan.', 'plan'],
+    [403, 'Forbidden', 'permission'],
+    [503, 'Unavailable', 'network'],
+    [409, 'The network access resource changed. Refresh it and try again.', 'other'],
+  ] as const)(
+    'reports one failed save for the submitted draft after HTTP %s',
+    async (status, message, failReason) => {
+      const user = userEvent.setup()
+      const server = setupBindingServer()
+      server.check.allowed = true
+      server.put = async () => Response.json({ message }, { status })
+      renderEntry({ plan: 'professional', groups: server.groups })
+      await openSelectedConfig(user)
+      await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      await waitFor(() =>
+        expect(
+          vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'access_control_save'),
+        ).toEqual([
+          [
+            'access_control_save',
+            {
+              app_id: 'app-1',
+              app_mode: 'chat',
+              access_point_total: 3,
+              result: 'failed',
+              fail_reason: failReason,
+              is_first_config: true,
+              policy_id: 'group-1',
+              protected_access_points: ['web_app', 'service_api', 'mcp_server'],
+              protected_count: 3,
+              is_current_ip_included: true,
+            },
+          ],
+        ]),
+      )
+    },
+  )
+
+  it('reports the original save once even when its component unmounts before the response', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    server.check.allowed = true
+    let resolveSave!: (response: Response) => void
+    server.put = () =>
+      new Promise<Response>((resolve) => {
+        resolveSave = resolve
+      })
+    const view = renderEntry({ plan: 'professional', groups: server.groups })
+    await openSelectedConfig(user)
+    await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() => expect(server.writes).toHaveLength(1))
+    view.unmount()
+    await act(async () =>
+      resolveSave(Response.json({ binding: createBinding(), effective_enabled: true })),
+    )
+    await waitFor(() =>
+      expect(
+        vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'access_control_save'),
+      ).toEqual([
+        [
+          'access_control_save',
+          {
+            app_id: 'app-1',
+            app_mode: 'chat',
+            access_point_total: 3,
+            result: 'success',
+            is_first_config: true,
+            policy_id: 'group-1',
+            protected_access_points: ['web_app', 'service_api', 'mcp_server'],
+            protected_count: 3,
+            is_current_ip_included: true,
+          },
+        ],
+      ]),
+    )
+  })
   it('applies policy and scope edits to a live app only after Save', async () => {
     const user = userEvent.setup()
     const server = setupBindingServer(createBinding())
@@ -1269,6 +1489,17 @@ describe('trusted IP checks before saving', () => {
       ]),
     )
     expect(await screen.findByText('Restricted to Office')).toBeInTheDocument()
+    expect(trackEvent).toHaveBeenCalledWith('access_control_save', {
+      app_id: 'app-1',
+      app_mode: 'chat',
+      access_point_total: 3,
+      result: 'success',
+      is_first_config: false,
+      policy_id: 'group-2',
+      protected_access_points: ['web_app', 'service_api'],
+      protected_count: 2,
+      is_current_ip_included: true,
+    })
   })
 
   it.each([true, false])(
@@ -1338,6 +1569,30 @@ describe('trusted IP checks before saving', () => {
         await user.click(await screen.findByRole('button', { name: 'Save anyway' }))
         await waitFor(() => expect(server.writes).toHaveLength(1))
       }
+      await waitFor(() =>
+        expect(trackEvent).toHaveBeenCalledWith('access_control_save', {
+          app_id: 'app-1',
+          app_mode: 'chat',
+          access_point_total: 3,
+          result: 'success',
+          is_first_config: true,
+          policy_id: 'group-1',
+          protected_access_points: ['web_app', 'service_api', 'mcp_server'],
+          protected_count: 3,
+          is_current_ip_included: allowed,
+        }),
+      )
+      expect(
+        vi
+          .mocked(trackEvent)
+          .mock.calls.filter(([event]) => event === 'access_control_entry_click'),
+      ).toHaveLength(1)
+      expect(
+        vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'access_control_save'),
+      ).toHaveLength(1)
+      expect(
+        vi.mocked(trackEvent).mock.calls.some(([, props]) => props?.action === 'edit_abandoned'),
+      ).toBe(false)
     },
   )
 
@@ -1446,6 +1701,15 @@ describe('immediate pause and resume', () => {
           expected_version: 2,
         },
       ])
+      expect(
+        vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'access_control_save'),
+      ).toHaveLength(0)
+      expect(
+        vi
+          .mocked(trackEvent)
+          .mock.calls.filter(([, props]) => String(props?.action).startsWith('turn_off_'))
+          .map(([, props]) => props?.action),
+      ).toEqual(['turn_off_attempted', 'turn_off_confirmed'])
       if (status === 409)
         server.binding = createBinding({ version: 3, access_points: ['webapp', 'mcp'] })
       await act(async () => finish(Response.json({ message: 'Unable to pause' }, { status })))
@@ -1466,6 +1730,56 @@ describe('immediate pause and resume', () => {
 })
 
 describe('returning from policy creation', () => {
+  it('keeps a reopened policy form when the previous creation finishes', async () => {
+    const user = userEvent.setup()
+    const server = setupBindingServer()
+    const fetchDefault = vi.mocked(globalThis.fetch).getMockImplementation()!
+    let finish!: (response: Response) => void
+    vi.mocked(globalThis.fetch).mockImplementation((input, init) =>
+      new Request(input, init).method === 'POST'
+        ? new Promise<Response>((resolve) => {
+            finish = resolve
+          })
+        : fetchDefault(input, init),
+    )
+    renderEntry({ plan: 'professional', groups: server.groups })
+    await openSelectedConfig(user)
+    await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+    await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
+    await user.type(screen.getByRole('textbox', { name: 'Name' }), 'First')
+    await user.click(screen.getByPlaceholderText('10.0.0.0/8'))
+    await user.paste('10.0.0.0/8')
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+    await waitFor(() => expect(finish).toBeDefined())
+    await user.click(screen.getByRole('button', { name: 'Cancel' }))
+    await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
+    await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
+    await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Second')
+    await act(async () =>
+      finish(
+        Response.json(
+          { group: createNetworkAccessGroupFixture({ id: 'new-policy', name: 'First' }) },
+          { status: 201 },
+        ),
+      ),
+    )
+    await waitFor(() =>
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+        app_id: 'app-1',
+        app_mode: 'chat',
+        mode: 'create',
+        source: 'access_control_dropdown',
+        result: 'success',
+        policy_id: 'new-policy',
+        entry_count: 1,
+        validation_error_types: [],
+      }),
+    )
+    expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Second')
+    expect(
+      vi.mocked(trackEvent).mock.calls.filter(([, props]) => props?.action === 'edit_abandoned'),
+    ).toHaveLength(0)
+  })
   it.each(['create', 'cancel', 'failure'] as const)(
     'preserves the selected policy and scope draft after %s',
     async (action) => {
diff --git a/web/app/components/app/access-point/access-control/config-panel.tsx b/web/app/components/app/access-point/access-control/config-panel.tsx
index 3fd3dd3c5bb456..3ca9d90c69e9d1 100644
--- a/web/app/components/app/access-point/access-control/config-panel.tsx
+++ b/web/app/components/app/access-point/access-control/config-panel.tsx
@@ -5,6 +5,7 @@ import type { FormEvent } from 'react'
 import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import type { AccessControlAppIcon } from './index'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import type { AccessControlAnalyticsContext } from '@/features/network-access/analytics'
 import { Button } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
 import { Fieldset, FieldsetLegend } from '@langgenius/dify-ui/fieldset'
@@ -12,11 +13,13 @@ import { IconButton } from '@langgenius/dify-ui/icon-button'
 import { PopoverClose, PopoverDescription, PopoverTitle } from '@langgenius/dify-ui/popover'
 import { useId } from 'react'
 import { useTranslation } from 'react-i18next'
+import { trackNetworkAccessEvent } from '@/features/network-access/analytics'
 import { canSaveAccessControl, hasSelectedAccessPoint } from './draft'
 import { AccessControlPolicyField } from './policy-field'
 import { AccessControlScopeList } from './scope-list'
 
 type AccessControlConfigPanelProps = {
+  analyticsContext?: AccessControlAnalyticsContext
   draft: AccessControlDraft
   policies: readonly AccessControlPolicy[]
   ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
@@ -40,6 +43,7 @@ type AccessControlConfigPanelProps = {
 }
 
 export function AccessControlConfigPanel({
+  analyticsContext,
   draft,
   policies,
   ipCheck,
@@ -142,6 +146,12 @@ export function AccessControlConfigPanel({
             onManagePolicies={onManagePolicies}
             onSelectPolicy={(policyId) => {
               if (readOnly) return
+              if (analyticsContext)
+                trackNetworkAccessEvent('access_control_interaction', {
+                  ...analyticsContext,
+                  action: 'policy_selected',
+                  policy_id: policyId,
+                })
               onDraftChange({ ...draft, selectedPolicyId: policyId })
             }}
           />
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index bd65a9ee6f25aa..f69af382d285df 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -1,9 +1,12 @@
 'use client'
 
+import type { AppMode } from '@dify/contracts/api/console/apps/types.gen'
 import type { ComponentProps } from 'react'
 import type { AccessControlAssignment } from './chip-status'
 import type { AccessControlDraft } from './draft'
 import type AppIcon from '@/app/components/base/app-icon'
+import type { IpPolicyFormSession } from '@/app/components/header/account-setting/ip-policies-page/policy-form-analytics'
+import type { AccessControlSaveProperties } from '@/features/network-access/analytics'
 import {
   AlertDialog,
   AlertDialogCancelButton,
@@ -25,10 +28,17 @@ import {
   pricingQueryParser,
 } from '@/app/components/billing/pricing/query-params'
 import { IpPolicyDialog } from '@/app/components/header/account-setting/ip-policies-page/policy-dialog'
+import { startIpPolicyForm } from '@/app/components/header/account-setting/ip-policies-page/policy-form-analytics'
 import {
   settingsQueryParamName,
   settingsQueryParser,
 } from '@/app/components/header/account-setting/query-params'
+import {
+  getAccessControlFailReason,
+  getIpPolicyFailReason,
+  getProtectedAccessPoints,
+  trackNetworkAccessEvent,
+} from '@/features/network-access/analytics'
 import {
   canManageNetworkAccessPoliciesAtom,
   canReadNetworkAccessAtom,
@@ -56,6 +66,7 @@ export type AccessControlAppIcon = Pick<
 
 type AccessControlEntryProps = {
   appId: string
+  appMode: AppMode
   appIcon: AccessControlAppIcon
   canEditBinding: boolean
   isPublished: boolean
@@ -102,6 +113,7 @@ function AccessControlStatusOnlyEntry({ appId }: { appId: string }) {
 
 function AccessControlSession({
   appId,
+  appMode,
   appIcon,
   canEditBinding,
   isPublished,
@@ -140,7 +152,7 @@ function AccessControlSession({
   const [view, setView] = useState<'config' | 'status'>('status')
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
-  const [createPolicyOpen, setCreatePolicyOpen] = useState(false)
+  const [policyFormSession, setPolicyFormSession] = useState<IpPolicyFormSession | null>(null)
   const [policySelectOpen, setPolicySelectOpen] = useState(false)
   const [confirmation, setConfirmation] = useState<{
     draft: AccessControlDraft
@@ -149,6 +161,8 @@ function AccessControlSession({
     changed: boolean
   } | null>(null)
   const saveAttemptRef = useRef(0)
+  const editingRef = useRef(false)
+  const policyDialogSessionRef = useRef(0)
   const selectedPolicyId = draft ? draft.selectedPolicyId : bindingQuery.data?.binding?.group_id
   const checkCurrentIp =
     consoleQuery.workspaces.current.networkAccessGroups.byGroupId.checkCurrentIp.get
@@ -213,6 +227,11 @@ function AccessControlSession({
   const showPaywall = chip.kind === 'pro' && !assignment
   const showDowngrade = Boolean(assignment) && !entitled
   const showStatus = Boolean(assignment) && entitled && (!canMutate || view === 'status')
+  const analyticsContext = {
+    app_id: appId,
+    app_mode: appMode,
+    access_point_total: availableAccessPoints.length,
+  }
 
   const tooltip = showDowngrade
     ? t(($) => $['studio.accessControl.tooltipDowngraded'], { ns: 'deployments' })
@@ -232,12 +251,17 @@ function AccessControlSession({
           : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
   const handleTurnOn = () => {
+    trackNetworkAccessEvent('access_control_upgrade_click', {
+      ...analyticsContext,
+      plan_state: showDowngrade ? 'lapsed' : 'sandbox',
+    })
     void setPricing('open')
     const gtag = (window as Window & { gtag?: GtagHandler }).gtag
     if (gtag) gtag('event', 'click_upgrade_btn', { loc: 'access-control-paywall' })
   }
 
   const discardDraft = () => {
+    editingRef.current = false
     saveAttemptRef.current += 1
     saveCheck.reset()
     setConfirmation(null)
@@ -246,7 +270,18 @@ function AccessControlSession({
     setShowBack(false)
   }
 
+  const abandonEditing = (method: 'cancel' | 'back' | 'dismiss') => {
+    if (editingRef.current && !updateBinding.isPending)
+      trackNetworkAccessEvent('access_control_interaction', {
+        ...analyticsContext,
+        action: 'edit_abandoned',
+        abandon_method: method,
+      })
+    editingRef.current = false
+  }
+
   const handleCancel = () => {
+    abandonEditing('cancel')
     discardDraft()
     if (assignment) {
       setView('status')
@@ -256,24 +291,39 @@ function AccessControlSession({
   }
 
   const handleBack = () => {
+    abandonEditing('back')
     discardDraft()
     setView('status')
   }
 
   const handleCreatePolicy = () => {
     if (!canMutate || !canManagePolicies) return
+    policyDialogSessionRef.current += 1
     setOpen(false)
-    setCreatePolicyOpen(true)
+    setPolicyFormSession(
+      startIpPolicyForm({
+        mode: 'create',
+        source: groups.length ? 'access_control_dropdown' : 'access_control_empty_state',
+        app_id: appId,
+        app_mode: appMode,
+      }),
+    )
   }
 
   const handleManagePolicies = () => {
+    trackNetworkAccessEvent('access_control_interaction', {
+      ...analyticsContext,
+      action: 'manage_policies_clicked',
+    })
+    editingRef.current = false
     setOpen(false)
     void setSettingsDestination('ip-policies')
   }
 
   const handlePolicyDialogOpenChange = (nextOpen: boolean) => {
     if (nextOpen) return
-    setCreatePolicyOpen(false)
+    policyDialogSessionRef.current += 1
+    setPolicyFormSession(null)
     setOpen(true)
   }
 
@@ -288,45 +338,65 @@ function AccessControlSession({
       accessPoints: ReturnType<typeof accessPointsFromScopes>
     },
     onSuccess?: () => void,
+    analytics?: AccessControlSaveProperties,
   ) => {
     if (!canMutate || updateBinding.isPending) return
 
-    updateBinding.mutate(
-      {
-        params: { app_id: appId },
-        body: {
-          enabled,
-          group_id: groupId,
-          access_points: accessPoints,
-          expected_version: binding?.version ?? 0,
+    void updateBinding
+      .mutateAsync(
+        {
+          params: { app_id: appId },
+          body: {
+            enabled,
+            group_id: groupId,
+            access_points: accessPoints,
+            expected_version: binding?.version ?? 0,
+          },
         },
-      },
-      {
-        onSuccess: (data) => {
-          queryClient.setQueryData(
-            consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
-              input: { params: { app_id: appId } },
-            }),
-            (current) => (current ? { ...current, ...data } : current),
-          )
-          onSuccess?.()
+        {
+          onSuccess: (data) => {
+            queryClient.setQueryData(
+              consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
+                input: { params: { app_id: appId } },
+              }),
+              (current) => (current ? { ...current, ...data } : current),
+            )
+            onSuccess?.()
+          },
+          onError: (error) => {
+            if (getNetworkAccessErrorStatus(error) !== 409) return
+            void queryClient.invalidateQueries({
+              queryKey: consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
+                input: { params: { app_id: appId } },
+              }),
+            })
+            void queryClient.invalidateQueries({
+              queryKey: consoleQuery.workspaces.current.networkAccessGroups.get.queryKey(),
+            })
+          },
         },
-        onError: (error) => {
-          if (getNetworkAccessErrorStatus(error) !== 409) return
-          void queryClient.invalidateQueries({
-            queryKey: consoleQuery.apps.byAppId.networkAccessGroup.get.queryKey({
-              input: { params: { app_id: appId } },
-            }),
-          })
-          void queryClient.invalidateQueries({
-            queryKey: consoleQuery.workspaces.current.networkAccessGroups.get.queryKey(),
-          })
+      )
+      .then(
+        () => {
+          if (analytics)
+            trackNetworkAccessEvent('access_control_save', { ...analytics, result: 'success' })
         },
-      },
-    )
+        async (error: unknown) => {
+          if (analytics)
+            trackNetworkAccessEvent('access_control_save', {
+              ...analytics,
+              result: 'failed',
+              fail_reason: await getAccessControlFailReason(error),
+            })
+        },
+      )
   }
 
-  const saveDraft = (nextDraft: AccessControlDraft) => {
+  const saveDraft = (nextDraft: AccessControlDraft, currentIpIncluded: boolean) => {
+    if (!nextDraft.selectedPolicyId) return
+    const protectedAccessPoints = getProtectedAccessPoints(
+      accessPointsFromScopes(nextDraft.scopes, availableAccessPoints),
+    )
     persistBinding(
       {
         enabled: true,
@@ -338,6 +408,14 @@ function AccessControlSession({
         setView('status')
         setOpen(true)
       },
+      {
+        ...analyticsContext,
+        is_first_config: binding === null,
+        policy_id: nextDraft.selectedPolicyId,
+        protected_access_points: protectedAccessPoints,
+        protected_count: protectedAccessPoints.length,
+        is_current_ip_included: currentIpIncluded,
+      },
     )
   }
 
@@ -373,7 +451,7 @@ function AccessControlSession({
             return
           }
           setConfirmation(null)
-          saveDraft(nextDraft)
+          saveDraft(nextDraft, check.allowed)
         },
       },
     )
@@ -390,6 +468,16 @@ function AccessControlSession({
     )
   }
 
+  const startEditing = (editEntry: 'first_config' | 'preview_edit' | 'draft_restored') => {
+    if (!canMutate) return
+    editingRef.current = true
+    trackNetworkAccessEvent('access_control_interaction', {
+      ...analyticsContext,
+      action: 'edit_started',
+      edit_entry: editEntry,
+    })
+  }
+
   return (
     <>
       <Tooltip>
@@ -398,16 +486,30 @@ function AccessControlSession({
           onOpenChange={(nextOpen) => {
             setOpen(nextOpen)
             if (!nextOpen) {
+              abandonEditing('dismiss')
               saveAttemptRef.current += 1
               saveCheck.reset()
               if (!dirty) discardDraft()
               return
             }
+            trackNetworkAccessEvent('access_control_entry_click', {
+              ...analyticsContext,
+              entry_status: showPaywall
+                ? 'sandbox'
+                : showDowngrade
+                  ? 'lapsed'
+                  : chip.kind === 'pro'
+                    ? 'sandbox'
+                    : chip.kind,
+              has_draft: dirty,
+            })
             if (dirty) {
+              startEditing('draft_restored')
               setView('config')
               setShowBack(Boolean(assignment) && canMutate)
               return
             }
+            if (!assignment) startEditing('first_config')
             setView(assignment || !canMutate ? 'status' : 'config')
             setShowBack(false)
           }}
@@ -440,6 +542,7 @@ function AccessControlSession({
               />
             ) : showStatus && assignment ? (
               <AccessControlStatusPanel
+                analyticsContext={analyticsContext}
                 draft={resolvedDraft}
                 appIcon={appIcon}
                 availableAccessPoints={availableAccessPoints}
@@ -450,6 +553,7 @@ function AccessControlSession({
                 onEnabledChange={handleEnabledChange}
                 onEdit={() => {
                   if (!canMutate) return
+                  startEditing('preview_edit')
                   setDraft(resolvedDraft)
                   setShowBack(true)
                   setView('config')
@@ -457,6 +561,7 @@ function AccessControlSession({
               />
             ) : (
               <AccessControlConfigPanel
+                analyticsContext={analyticsContext}
                 draft={resolvedDraft}
                 appIcon={appIcon}
                 availableAccessPoints={availableAccessPoints}
@@ -498,42 +603,68 @@ function AccessControlSession({
         </Popover>
         <TooltipContent>{tooltip}</TooltipContent>
       </Tooltip>
-      {createPolicyOpen && canMutate && canManagePolicies && (
+      {policyFormSession && canMutate && canManagePolicies && (
         <IpPolicyDialog
+          analyticsSession={policyFormSession}
           mode="create"
           open
           isPending={createGroup.isPending}
           onOpenChange={handlePolicyDialogOpenChange}
           onSubmit={(payload) => {
             if (!canMutate || !canManagePolicies) return
-            createGroup.mutate(
-              {
-                body: {
-                  name: payload.name,
-                  description: '',
-                  allowed_cidrs: payload.allowed_cidrs,
+            const session = policyDialogSessionRef.current
+            const analytics = {
+              ...policyFormSession.context,
+              mode: 'create' as const,
+              entry_count: payload.allowed_cidrs.length,
+              validation_error_types: [...policyFormSession.validationErrors],
+            }
+            void createGroup
+              .mutateAsync(
+                {
+                  body: {
+                    name: payload.name,
+                    description: '',
+                    allowed_cidrs: payload.allowed_cidrs,
+                  },
                 },
-              },
-              {
-                onSuccess: (data) => {
-                  queryClient.setQueryData(
-                    consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions().queryKey,
-                    (current) => {
-                      if (!current) return current
-                      if (current.groups.some((group) => group.id === data.group.id)) return current
-                      return {
-                        ...current,
-                        groups: [...current.groups, data.group],
-                      }
-                    },
-                  )
-                  setCreatePolicyOpen(false)
-                  setView('config')
-                  setPolicySelectOpen(true)
-                  setOpen(true)
+                {
+                  onSuccess: (data) => {
+                    queryClient.setQueryData(
+                      consoleQuery.workspaces.current.networkAccessGroups.get.queryOptions()
+                        .queryKey,
+                      (current) => {
+                        if (!current) return current
+                        if (current.groups.some((group) => group.id === data.group.id))
+                          return current
+                        return {
+                          ...current,
+                          groups: [...current.groups, data.group],
+                        }
+                      },
+                    )
+                    if (policyDialogSessionRef.current !== session) return
+                    setPolicyFormSession(null)
+                    setView('config')
+                    setPolicySelectOpen(true)
+                    setOpen(true)
+                  },
                 },
-              },
-            )
+              )
+              .then(
+                (data) =>
+                  trackNetworkAccessEvent('ip_policy_save', {
+                    ...analytics,
+                    result: 'success',
+                    policy_id: data.group.id,
+                  }),
+                async (error: unknown) =>
+                  trackNetworkAccessEvent('ip_policy_save', {
+                    ...analytics,
+                    result: 'failed',
+                    fail_reason: await getIpPolicyFailReason(error),
+                  }),
+              )
           }}
         />
       )}
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index bcdeb7b6dbdf86..1bcb3646bb0d1d 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -3,6 +3,7 @@
 import type { AccessControlDraft, AccessControlPolicy } from './draft'
 import type { AccessControlAppIcon } from './index'
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
+import type { AccessControlAnalyticsContext } from '@/features/network-access/analytics'
 import {
   AlertDialog,
   AlertDialogCancelButton,
@@ -21,6 +22,7 @@ import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import AppIcon from '@/app/components/base/app-icon'
 import { splitPolicySummary } from '@/app/components/header/account-setting/ip-policies-page/validate-ip-entry'
+import { trackNetworkAccessEvent } from '@/features/network-access/analytics'
 import { getInServiceCoverage } from './chip-status'
 
 const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
@@ -30,6 +32,7 @@ const SCOPE_ICONS: Record<Exclude<AccessPoint, 'webApp'>, string> = {
 }
 
 type AccessControlStatusPanelProps = {
+  analyticsContext: AccessControlAnalyticsContext
   draft: AccessControlDraft
   appIcon: AccessControlAppIcon
   availableAccessPoints: readonly AccessPoint[]
@@ -42,6 +45,7 @@ type AccessControlStatusPanelProps = {
 }
 
 export function AccessControlStatusPanel({
+  analyticsContext,
   draft,
   appIcon,
   availableAccessPoints,
@@ -64,6 +68,16 @@ export function AccessControlStatusPanel({
     trigger: t(($) => $['settings.trigger'], { ns: 'navigation' }),
   }
   const policyName = selectedPolicy?.name
+  const trackToggle = (
+    action: 'turned_on' | 'turn_off_attempted' | 'turn_off_confirmed' | 'turn_off_cancelled',
+  ) => {
+    if (draft.selectedPolicyId)
+      trackNetworkAccessEvent('access_control_interaction', {
+        ...analyticsContext,
+        action,
+        policy_id: draft.selectedPolicyId,
+      })
+  }
 
   return (
     <div className="flex w-100 flex-col">
@@ -113,9 +127,11 @@ export function AccessControlStatusPanel({
             onCheckedChange={(next) => {
               if (readOnly || updating) return
               if (next) {
+                trackToggle('turned_on')
                 onEnabledChange(true)
                 return
               }
+              trackToggle('turn_off_attempted')
               setConfirmPause(true)
             }}
           />
@@ -212,13 +228,17 @@ export function AccessControlStatusPanel({
             </AlertDialogDescription>
           </div>
           <AlertDialogFooter>
-            <AlertDialogCancelButton variant="secondary">
+            <AlertDialogCancelButton
+              variant="secondary"
+              onClick={() => trackToggle('turn_off_cancelled')}
+            >
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </AlertDialogCancelButton>
             <AlertDialogConfirmButton
               disabled={readOnly || updating}
               onClick={() => {
                 if (readOnly || updating) return
+                trackToggle('turn_off_confirmed')
                 onEnabledChange(false)
                 setConfirmPause(false)
               }}
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index 3df8eda2f868f6..0255ee9c946c46 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -76,22 +76,26 @@ function AccessPointContent({
             <h1 id="access-point-title" className="title-xl-semi-bold text-text-primary">
               {t(($) => $['appMenus.accessPoint'], { ns: 'common' })}
             </h1>
-            <AccessControlEntry
-              appId={appId}
-              isPublished={Boolean(
-                appInfo &&
-                (appInfo.mode === AppModeEnum.WORKFLOW || appInfo.mode === AppModeEnum.ADVANCED_CHAT
-                  ? appInfo.workflow?.id
-                  : appInfo.model_config),
-              )}
-              appIcon={{
-                iconType: appInfo?.icon_type,
-                icon: appInfo?.icon ?? undefined,
-                background: appInfo?.icon_background,
-                imageUrl: appInfo?.icon_url,
-              }}
-              canEditBinding={canManageAccessPoint}
-            />
+            {appInfo && (
+              <AccessControlEntry
+                appId={appId}
+                appMode={appInfo.mode}
+                isPublished={Boolean(
+                  appInfo &&
+                  (appInfo.mode === AppModeEnum.WORKFLOW ||
+                  appInfo.mode === AppModeEnum.ADVANCED_CHAT
+                    ? appInfo.workflow?.id
+                    : appInfo.model_config),
+                )}
+                appIcon={{
+                  iconType: appInfo?.icon_type,
+                  icon: appInfo?.icon ?? undefined,
+                  background: appInfo?.icon_background,
+                  imageUrl: appInfo?.icon_url,
+                }}
+                canEditBinding={canManageAccessPoint}
+              />
+            )}
           </div>
           <p className="system-xs-regular text-text-tertiary">
             {t(($) => $['studio.accessPoint.description'], { ns: 'deployments' })}
diff --git a/web/app/components/base/amplitude/__tests__/access-point-page-view.spec.ts b/web/app/components/base/amplitude/__tests__/access-point-page-view.spec.ts
new file mode 100644
index 00000000000000..c6fa3f3a2d0823
--- /dev/null
+++ b/web/app/components/base/amplitude/__tests__/access-point-page-view.spec.ts
@@ -0,0 +1,113 @@
+import type { Types } from '@amplitude/analytics-browser'
+import * as amplitude from '@amplitude/analytics-browser'
+import { getQueryClient } from '@/app/get-query-client'
+import { consoleQuery } from '@/service/console'
+import { createAgentFixture } from '@/test/fixtures/agent'
+import { initializeAmplitudeSDK } from '../runtime'
+
+vi.mock('@amplitude/analytics-browser', () => ({
+  init: vi.fn(),
+  add: vi.fn(),
+  setOptOut: vi.fn(),
+  track: vi.fn(),
+  flush: vi.fn(),
+  setUserId: vi.fn(),
+  Identify: vi.fn(),
+  identify: vi.fn(),
+  reset: vi.fn(),
+}))
+vi.mock('@amplitude/plugin-session-replay-browser', () => ({
+  sessionReplayPlugin: vi.fn(() => ({ name: 'replay' })),
+}))
+
+const pageView = (url: string): Types.Event => ({
+  event_type: '[Amplitude] Page Viewed',
+  event_properties: { '[Amplitude] Page URL': url },
+})
+const getPlugin = () => {
+  initializeAmplitudeSDK('test-key', 0)
+  return vi.mocked(amplitude.add).mock.calls[0]![0] as Types.EnrichmentPlugin
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  getQueryClient().clear()
+})
+
+it('registers enrichment before initialization can capture the first page view', () => {
+  getPlugin()
+  expect(vi.mocked(amplitude.add).mock.invocationCallOrder[0]).toBeLessThan(
+    vi.mocked(amplitude.init).mock.invocationCallOrder[0]!,
+  )
+})
+
+it.each([
+  ['https://cloud.dify.ai/app/app-a/access-point', 'app-a'],
+  ['https://cloud.dify.ai/console/app/app-b/access-point?settings=ip-policies', 'app-b'],
+])('enriches %s from the event URL even after navigation', async (url, appId) => {
+  const event = pageView(url)
+  const result = await getPlugin().execute!(event)
+  expect(result?.event_properties).toMatchObject({ app_id: appId })
+  expect(amplitude.track).not.toHaveBeenCalled()
+})
+
+it('uses the associated App ID from the cached Agent query', async () => {
+  const options = consoleQuery.agent.byAgentId.get.queryOptions({
+    input: { params: { agent_id: 'agent-a' } },
+  })
+  getQueryClient().setQueryData(
+    options.queryKey,
+    createAgentFixture({ id: 'agent-a', app_id: 'backing-app', hidden_app_backed: false }),
+  )
+  const result = await getPlugin().execute!(pageView('https://cloud.dify.ai/agents/agent-a/access'))
+  expect(result?.event_properties).toMatchObject({ app_id: 'backing-app' })
+  expect(globalThis.fetch).not.toHaveBeenCalled()
+})
+
+it('keeps a failed Agent lookup page view without inventing an App ID', async () => {
+  vi.mocked(globalThis.fetch).mockResolvedValue(
+    Response.json({ message: 'Unavailable' }, { status: 503 }),
+  )
+  const event = pageView('https://cloud.dify.ai/agents/agent-a/access')
+  expect(await getPlugin().execute!(event)).toBe(event)
+  expect(event.event_properties).not.toHaveProperty('app_id')
+})
+
+it('keeps a pending Agent lookup attached to its original page view during navigation', async () => {
+  let resolveAgent!: (response: Response) => void
+  vi.mocked(globalThis.fetch).mockImplementation(
+    () =>
+      new Promise<Response>((resolve) => {
+        resolveAgent = resolve
+      }),
+  )
+  const plugin = getPlugin()
+  const event = pageView('https://cloud.dify.ai/agents/agent-a/access')
+  const pending = plugin.execute!(event)
+  await vi.waitFor(() => expect(globalThis.fetch).toHaveBeenCalledOnce())
+  window.history.replaceState({}, '', '/app/app-b/access-point')
+  const next = await plugin.execute!(pageView(window.location.href))
+  resolveAgent(
+    Response.json(
+      createAgentFixture({ id: 'agent-a', app_id: 'backing-app-a', hidden_app_backed: false }),
+    ),
+  )
+  expect((await pending)?.event_properties).toMatchObject({ app_id: 'backing-app-a' })
+  expect(next?.event_properties).toMatchObject({ app_id: 'app-b' })
+  expect(amplitude.track).not.toHaveBeenCalled()
+  window.history.replaceState({}, '', '/')
+})
+
+it('leaves other pages and custom events without Access Point properties', async () => {
+  const plugin = getPlugin()
+  const event = pageView('https://cloud.dify.ai/apps')
+  await plugin.execute!(event)
+  expect(event.event_properties).not.toHaveProperty('app_id')
+  const custom = {
+    ...pageView('https://cloud.dify.ai/app/app-a/access-point'),
+    event_type: 'custom',
+  }
+  await plugin.execute!(custom)
+  expect(custom.event_properties).not.toHaveProperty('app_id')
+  expect(globalThis.fetch).not.toHaveBeenCalled()
+})
diff --git a/web/app/components/base/amplitude/access-point-page-properties.ts b/web/app/components/base/amplitude/access-point-page-properties.ts
new file mode 100644
index 00000000000000..fa8625d41a86ff
--- /dev/null
+++ b/web/app/components/base/amplitude/access-point-page-properties.ts
@@ -0,0 +1,14 @@
+import { getQueryClient } from '@/app/get-query-client'
+import { consoleQuery } from '@/service/console'
+
+export async function getAgentAccessAppId(agentId: string) {
+  const agent = await getQueryClient().query(
+    consoleQuery.agent.byAgentId.get.queryOptions({
+      input: { params: { agent_id: agentId } },
+      context: { silent: true },
+      staleTime: Infinity,
+      retry: false,
+    }),
+  )
+  return agent.hidden_app_backed ? undefined : agent.app_id
+}
diff --git a/web/app/components/base/amplitude/runtime.ts b/web/app/components/base/amplitude/runtime.ts
index f91131d44db7a1..395191a9191398 100644
--- a/web/app/components/base/amplitude/runtime.ts
+++ b/web/app/components/base/amplitude/runtime.ts
@@ -35,6 +35,27 @@ const createPageNameEnrichmentPlugin = (): Types.EnrichmentPlugin => {
         /* v8 ignore next @preserve */
         const pathname = typeof window !== 'undefined' ? window.location.pathname : ''
         event.event_properties['[Amplitude] Page Title'] = getEnglishPageName(pathname)
+        const pageUrl = event.event_properties['[Amplitude] Page URL']
+        if (typeof pageUrl === 'string') {
+          let eventPath: string
+          try {
+            eventPath = new URL(pageUrl).pathname
+          } catch {
+            return event
+          }
+          const appMatch = /\/app\/([^/]+)\/access-point\/?$/.exec(eventPath)
+          if (appMatch) event.event_properties.app_id = appMatch[1]
+          const agentMatch = /\/agents\/([^/]+)\/access\/?$/.exec(eventPath)
+          if (agentMatch?.[1]) {
+            try {
+              const { getAgentAccessAppId } = await import('./access-point-page-properties')
+              const appId = await getAgentAccessAppId(agentMatch[1])
+              if (appId) event.event_properties.app_id = appId
+            } catch {
+              // Preserve the page view when the app identity cannot be resolved.
+            }
+          }
+        }
       }
       return event
     },
@@ -42,6 +63,7 @@ const createPageNameEnrichmentPlugin = (): Types.EnrichmentPlugin => {
 }
 
 export function initializeAmplitudeSDK(apiKey: string, sessionReplaySampleRate: number) {
+  amplitude.add(createPageNameEnrichmentPlugin())
   amplitude.init(apiKey, {
     defaultTracking: {
       sessions: true,
@@ -51,7 +73,6 @@ export function initializeAmplitudeSDK(apiKey: string, sessionReplaySampleRate:
       attribution: true,
     },
   })
-  amplitude.add(createPageNameEnrichmentPlugin())
   amplitude.add(sessionReplayPlugin({ sampleRate: sessionReplaySampleRate }))
   amplitude.setOptOut(false)
   return {
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 6fbabf45d1ffc8..c5866ff5c0e4f4 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -3,6 +3,7 @@ import userEvent from '@testing-library/user-event'
 import { createInstance } from 'i18next'
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
 import { initReactI18next } from 'react-i18next'
+import { trackEvent } from '@/app/components/base/amplitude'
 import commonTranslations from '@/i18n/locales/en-US/common.json'
 import deploymentTranslations from '@/i18n/locales/en-US/deployments.json'
 import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
@@ -14,6 +15,7 @@ import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console
 import IpPoliciesPage from '..'
 
 vi.unmock('react-i18next')
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
 
 describe('IpPoliciesPage', () => {
   beforeEach(async () => {
@@ -78,6 +80,15 @@ describe('IpPoliciesPage', () => {
       await user.keyboard('{Enter}')
 
       const dialog = screen.getByRole('dialog', { name: 'Internal Network' })
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_interaction', {
+        action: 'settings_tab_viewed',
+      })
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_interaction', {
+        action: 'form_opened',
+        mode: 'view',
+        source: 'list_row',
+        policy_id: 'group-1',
+      })
       expect(within(dialog).getByText('203.0.113.42/32')).toBeInTheDocument()
       expect(within(dialog).getByText('198.51.100.0/24')).toBeInTheDocument()
       expect(within(dialog).getByText('2001:db8::/32')).toBeInTheDocument()
@@ -216,6 +227,113 @@ describe('IpPoliciesPage', () => {
     })
   })
 
+  it('accumulates all validation errors through a conflict retry and resets them on reopen', async () => {
+    const user = userEvent.setup()
+    const group = createNetworkAccessGroupFixture({ allowed_cidrs: ['10.0.0.0/8'] })
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { groups: [group] })
+    let saves = 0
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = new Request(input, init)
+      if (request.url.endsWith('/current-ip')) return Response.json({ client_ip: '203.0.113.42' })
+      if (request.method === 'PUT') {
+        saves += 1
+        return saves === 1
+          ? Response.json({ code: 'network_access_conflict' }, { status: 409 })
+          : Response.json({ group, entitled: true })
+      }
+      return Response.json({
+        tenant_id: 'workspace-1',
+        entitled: true,
+        groups: [{ ...group, version: 2 }],
+      })
+    })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      {
+        queryClient,
+        systemFeatures: { deployment_edition: 'CLOUD' },
+      },
+    )
+    await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+    const entry = screen.getByPlaceholderText('10.0.0.0/8')
+    for (const invalid of [
+      '256.1.1.1',
+      '01.1.1.1',
+      'gg::1',
+      '10.0.0.1/x',
+      '10.0.0.1/33',
+      '10.0.0.1/1/2',
+      'invalid',
+      '256.1.1.1',
+    ]) {
+      await user.clear(entry)
+      await user.paste(invalid)
+      expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
+    }
+    await user.clear(entry)
+    await user.paste('10.0.0.0/8')
+    const validationErrors = [
+      'octet_out_of_range',
+      'leading_zero',
+      'invalid_ipv6',
+      'prefix_not_number',
+      'prefix_out_of_range',
+      'multiple_slash',
+      'unsupported_format',
+    ]
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+        mode: 'edit',
+        source: 'list_row',
+        policy_id: 'group-1',
+        entry_count: 1,
+        validation_error_types: validationErrors,
+        result: 'failed',
+        fail_reason: 'other',
+      }),
+    )
+    await waitFor(() =>
+      expect(screen.getByRole('button', { name: 'Save' })).not.toHaveAttribute(
+        'aria-disabled',
+        'true',
+      ),
+    )
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+        mode: 'edit',
+        source: 'list_row',
+        policy_id: 'group-1',
+        entry_count: 1,
+        validation_error_types: validationErrors,
+        result: 'success',
+      }),
+    )
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+    await user.click(screen.getByRole('button', { name: 'Internal Network' }))
+    await user.click(screen.getByRole('button', { name: 'Save' }))
+    await waitFor(() =>
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+        mode: 'edit',
+        source: 'list_row',
+        policy_id: 'group-1',
+        entry_count: 1,
+        validation_error_types: [],
+        result: 'success',
+      }),
+    )
+    expect(
+      vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'ip_policy_save'),
+    ).toHaveLength(3)
+    expect(
+      vi.mocked(trackEvent).mock.calls.filter(([, props]) => props?.action === 'form_opened'),
+    ).toHaveLength(2)
+  })
+
   it('offers a retry when conflict recovery cannot reload the policy', async () => {
     const user = userEvent.setup()
     const original = createNetworkAccessGroupFixture({ version: 1 })
@@ -580,6 +698,17 @@ describe('IpPoliciesPage', () => {
       expect(within(dialog).queryByText(/Still used by/)).not.toBeInTheDocument()
       await user.click(within(dialog).getByRole('button', { name: button }))
 
+      expect(
+        vi
+          .mocked(trackEvent)
+          .mock.calls.filter(([, props]) => String(props?.action).startsWith('delete_')),
+      ).toEqual([
+        ['ip_policy_interaction', { action: 'delete_attempted', policy_id: 'group-1' }],
+        ...(button === 'Cancel'
+          ? [['ip_policy_interaction', { action: 'delete_cancelled', policy_id: 'group-1' }]]
+          : []),
+      ])
+
       await waitFor(() => expect(screen.queryByRole('alertdialog')).not.toBeInTheDocument())
       expect(screen.getByRole('button', { name: 'Internal Network' })).toBeInTheDocument()
       expect(globalThis.fetch).not.toHaveBeenCalled()
@@ -591,7 +720,7 @@ describe('IpPoliciesPage', () => {
     async (succeeds) => {
       const user = userEvent.setup()
       const queryClient = createConsoleQueryClient()
-      const group = createNetworkAccessGroupFixture({ version: 7 })
+      const group = createNetworkAccessGroupFixture({ version: 7, used_by_count: 2 })
       seedNetworkAccessGroups(queryClient, { groups: [group] })
       let resolveDeletion!: (response: Response) => void
       const deletion = new Promise<Response>((resolve) => {
@@ -629,6 +758,17 @@ describe('IpPoliciesPage', () => {
       expect(dialog).toBeInTheDocument()
       expect(deleteRequests).toHaveLength(1)
       expect(deleteRequests[0]?.url).toContain('group-1?expected_version=7')
+      expect(
+        vi
+          .mocked(trackEvent)
+          .mock.calls.filter(([, props]) => String(props?.action).startsWith('delete_')),
+      ).toEqual([
+        ['ip_policy_interaction', { action: 'delete_attempted', policy_id: 'group-1' }],
+        [
+          'ip_policy_interaction',
+          { action: 'delete_confirmed', policy_id: 'group-1', referenced_app_count: 2 },
+        ],
+      ])
 
       await act(async () => {
         resolveDeletion(
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index d9e8fe8376cb88..83f0e71a5d16ff 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -1,11 +1,12 @@
 'use client'
 
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
+import type { IpPolicyFormSession } from './policy-form-analytics'
 import { Button } from '@langgenius/dify-ui/button'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
 import { useQueryState } from 'nuqs'
-import { useRef, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
 import { getNetworkAccessErrorStatus } from '@/app/components/app/access-point/access-control/network-access'
 import { SkeletonContainer, SkeletonRectangle, SkeletonRow } from '@/app/components/base/skeleton'
@@ -13,12 +14,14 @@ import {
   pricingQueryParamName,
   pricingQueryParser,
 } from '@/app/components/billing/pricing/query-params'
+import { getIpPolicyFailReason, trackNetworkAccessEvent } from '@/features/network-access/analytics'
 import {
   canManageNetworkAccessPoliciesAtom,
   canReadNetworkAccessAtom,
 } from '@/features/network-access/permissions'
 import { consoleQuery } from '@/service/console'
 import { IpPolicyDialog } from './policy-dialog'
+import { startIpPolicyForm } from './policy-form-analytics'
 import {
   policyActionsColClassName,
   policyIpEntriesColClassName,
@@ -29,10 +32,11 @@ import {
   policyUsedByColClassName,
 } from './policy-item'
 
-type DialogState =
+type DialogRequest =
   | { mode: 'create' }
   | { mode: 'edit' | 'view'; group: NetworkAccessGroupResponse }
   | null
+type DialogState = (NonNullable<DialogRequest> & { analytics: IpPolicyFormSession }) | null
 
 function IpPoliciesListSkeleton() {
   const { t } = useTranslation(['common', 'deployments'])
@@ -82,12 +86,32 @@ export default function IpPoliciesPage() {
   const canMutate = canManagePolicies && entitled
   const selectedGroup = dialogState && dialogState.mode !== 'create' ? dialogState.group : null
   const isSaving = createGroup.isPending || updateGroup.isPending
+  const viewedRef = useRef(false)
+  useEffect(() => {
+    if (!canReadPolicies || viewedRef.current) return
+    viewedRef.current = true
+    trackNetworkAccessEvent('ip_policy_interaction', { action: 'settings_tab_viewed' })
+  }, [canReadPolicies])
 
-  const openDialog = (next: DialogState) => {
+  const openDialog = (
+    next: DialogRequest,
+    source: 'list_add_button' | 'list_row' | 'list_row_menu' = 'list_row',
+  ) => {
     dialogSessionRef.current += 1
     setIsRecovering(false)
     setRecoveryError(false)
-    setDialogState(next)
+    setDialogState(
+      next
+        ? {
+            ...next,
+            analytics: startIpPolicyForm({
+              mode: next.mode,
+              source,
+              ...(next.mode === 'create' ? {} : { policy_id: next.group.id }),
+            }),
+          }
+        : null,
+    )
   }
 
   const refreshGroupsAfterConflict = async (groupId: string, session: number) => {
@@ -101,7 +125,7 @@ export default function IpPoliciesPage() {
       setDialogState((current) =>
         current?.mode === 'edit' && current.group.id === groupId
           ? nextGroup
-            ? { mode: 'edit', group: nextGroup }
+            ? { ...current, group: nextGroup }
             : null
           : current,
       )
@@ -118,7 +142,7 @@ export default function IpPoliciesPage() {
       void setPricing('open')
       return
     }
-    openDialog({ mode: 'create' })
+    openDialog({ mode: 'create' }, 'list_add_button')
   }
 
   if (!canReadPolicies) return null
@@ -184,7 +208,7 @@ export default function IpPoliciesPage() {
               onView={(group) => openDialog({ mode: canMutate ? 'edit' : 'view', group })}
               onEdit={(group) => {
                 if (!canMutate) return
-                openDialog({ mode: 'edit', group })
+                openDialog({ mode: 'edit', group }, 'list_row_menu')
               }}
             />
           ))}
@@ -193,6 +217,7 @@ export default function IpPoliciesPage() {
 
       {dialogState && (dialogState.mode !== 'create' || canMutate) && (
         <IpPolicyDialog
+          analyticsSession={dialogState.analytics}
           key={selectedGroup ? `${selectedGroup.id}:${selectedGroup.version}` : 'create'}
           mode={canMutate ? dialogState.mode : 'view'}
           open
@@ -219,44 +244,77 @@ export default function IpPoliciesPage() {
             )
               return
             const session = dialogSessionRef.current
+            const analytics = {
+              ...dialogState.analytics.context,
+              mode: dialogState.mode,
+              entry_count: payload.allowed_cidrs.length,
+              validation_error_types: [...dialogState.analytics.validationErrors],
+            }
+            const trackFailure = async (error: unknown) => {
+              trackNetworkAccessEvent('ip_policy_save', {
+                ...analytics,
+                result: 'failed',
+                fail_reason: await getIpPolicyFailReason(error),
+              })
+            }
             if (selectedGroup) {
-              updateGroup.mutate(
+              void updateGroup
+                .mutateAsync(
+                  {
+                    params: { group_id: selectedGroup.id },
+                    body: {
+                      name: payload.name,
+                      description: selectedGroup.description ?? '',
+                      allowed_cidrs: payload.allowed_cidrs,
+                      expected_version: selectedGroup.version,
+                    },
+                  },
+                  {
+                    onSuccess: () => {
+                      if (dialogSessionRef.current === session) openDialog(null)
+                    },
+                    onError: (error) => {
+                      if (getNetworkAccessErrorStatus(error) !== 409) return
+                      void refreshGroupsAfterConflict(selectedGroup.id, session)
+                    },
+                  },
+                )
+                .then(
+                  (data) =>
+                    trackNetworkAccessEvent('ip_policy_save', {
+                      ...analytics,
+                      result: 'success',
+                      policy_id: data.group.id,
+                    }),
+                  trackFailure,
+                )
+              return
+            }
+
+            void createGroup
+              .mutateAsync(
                 {
-                  params: { group_id: selectedGroup.id },
                   body: {
                     name: payload.name,
-                    description: selectedGroup.description ?? '',
+                    description: '',
                     allowed_cidrs: payload.allowed_cidrs,
-                    expected_version: selectedGroup.version,
                   },
                 },
                 {
                   onSuccess: () => {
                     if (dialogSessionRef.current === session) openDialog(null)
                   },
-                  onError: (error) => {
-                    if (getNetworkAccessErrorStatus(error) !== 409) return
-                    void refreshGroupsAfterConflict(selectedGroup.id, session)
-                  },
                 },
               )
-              return
-            }
-
-            createGroup.mutate(
-              {
-                body: {
-                  name: payload.name,
-                  description: '',
-                  allowed_cidrs: payload.allowed_cidrs,
-                },
-              },
-              {
-                onSuccess: () => {
-                  if (dialogSessionRef.current === session) openDialog(null)
-                },
-              },
-            )
+              .then(
+                (data) =>
+                  trackNetworkAccessEvent('ip_policy_save', {
+                    ...analytics,
+                    result: 'success',
+                    policy_id: data.group.id,
+                  }),
+                trackFailure,
+              )
           }}
         />
       )}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index e1eb172fae943c..f6923947875303 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -1,6 +1,7 @@
 'use client'
 
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
+import type { IpPolicyFormSession } from './policy-form-analytics'
 import { Button } from '@langgenius/dify-ui/button'
 import {
   Dialog,
@@ -18,6 +19,7 @@ import { useTranslation } from 'react-i18next'
 import { consoleQuery } from '@/service/console'
 import { AllowlistField } from './allowlist-field'
 import { createAllowlistRow } from './allowlist-row'
+import { recordPolicyValidation } from './policy-form-analytics'
 import { PolicyReferencedApps } from './referenced-apps'
 import {
   canSubmitIpPolicy,
@@ -31,6 +33,7 @@ type IpPolicyDialogSubmit = {
 }
 
 type IpPolicyDialogProps = {
+  analyticsSession?: IpPolicyFormSession
   open: boolean
   mode: 'create' | 'edit' | 'view'
   currentIp?: string
@@ -46,6 +49,7 @@ type IpPolicyDialogProps = {
 }
 
 export function IpPolicyDialog({
+  analyticsSession,
   open,
   mode,
   currentIp,
@@ -195,7 +199,14 @@ export function IpPolicyDialog({
               onRetryCurrentIp={() => {
                 void currentIpQuery.refetch()
               }}
-              onEntriesChange={setEntries}
+              onEntriesChange={(nextEntries) => {
+                if (analyticsSession)
+                  recordPolicyValidation(
+                    analyticsSession,
+                    nextEntries.map((entry) => entry.value),
+                  )
+                setEntries(nextEntries)
+              }}
             />
 
             {mode === 'edit' && usedByCount > 0 && (
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-form-analytics.ts b/web/app/components/header/account-setting/ip-policies-page/policy-form-analytics.ts
new file mode 100644
index 00000000000000..5b610ecfcd0916
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-form-analytics.ts
@@ -0,0 +1,34 @@
+import type { IpEntryErrorCode } from './validate-ip-entry'
+import type {
+  IpPolicyFormContext,
+  IpPolicyValidationError,
+} from '@/features/network-access/analytics'
+import { trackNetworkAccessEvent } from '@/features/network-access/analytics'
+import { validateIpEntry } from './validate-ip-entry'
+
+const VALIDATION_ERRORS = {
+  octetRange: 'octet_out_of_range',
+  leadingZeros: 'leading_zero',
+  invalidIpv6: 'invalid_ipv6',
+  prefixNotNumber: 'prefix_not_number',
+  prefixRange: 'prefix_out_of_range',
+  multipleSlashes: 'multiple_slash',
+  unsupported: 'unsupported_format',
+} as const satisfies Record<IpEntryErrorCode, IpPolicyValidationError>
+
+export type IpPolicyFormSession = {
+  context: IpPolicyFormContext
+  validationErrors: Set<IpPolicyValidationError>
+}
+
+export function startIpPolicyForm(context: IpPolicyFormContext): IpPolicyFormSession {
+  trackNetworkAccessEvent('ip_policy_interaction', { action: 'form_opened', ...context })
+  return { context, validationErrors: new Set() }
+}
+
+export function recordPolicyValidation(session: IpPolicyFormSession, entries: readonly string[]) {
+  entries.forEach((entry) => {
+    const result = validateIpEntry(entry)
+    if (result.kind === 'invalid') session.validationErrors.add(VALIDATION_ERRORS[result.code])
+  })
+}
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index 3233d3e9986b51..eb81ab256eeab7 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -23,6 +23,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from '@langgenius/dify-ui/too
 import { useMutation } from '@tanstack/react-query'
 import { useState } from 'react'
 import { useTranslation } from 'react-i18next'
+import { trackNetworkAccessEvent } from '@/features/network-access/analytics'
 import { useFormatTimeFromNow } from '@/hooks/use-format-time-from-now'
 import { consoleQuery } from '@/service/console'
 import { PolicyReferencedApps } from './referenced-apps'
@@ -62,6 +63,11 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
 
   const handleDelete = () => {
     if (!canMutate || deleteGroup.isPending) return
+    trackNetworkAccessEvent('ip_policy_interaction', {
+      action: 'delete_confirmed',
+      policy_id: group.id,
+      referenced_app_count: group.used_by_count,
+    })
 
     deleteGroup.mutate(
       {
@@ -142,6 +148,10 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
                 onClick={() => {
                   if (!canMutate) return
                   setConfirmDelete(true)
+                  trackNetworkAccessEvent('ip_policy_interaction', {
+                    action: 'delete_attempted',
+                    policy_id: group.id,
+                  })
                   setMenuOpen(false)
                 }}
               >
@@ -195,7 +205,16 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
             )}
           </div>
           <AlertDialogFooter className="p-0 pt-2">
-            <AlertDialogCancelButton variant="secondary" disabled={deleteGroup.isPending}>
+            <AlertDialogCancelButton
+              variant="secondary"
+              disabled={deleteGroup.isPending}
+              onClick={() =>
+                trackNetworkAccessEvent('ip_policy_interaction', {
+                  action: 'delete_cancelled',
+                  policy_id: group.id,
+                })
+              }
+            >
               {t(($) => $['operation.cancel'], { ns: 'common' })}
             </AlertDialogCancelButton>
             <AlertDialogConfirmButton
diff --git a/web/features/agent-v2/agent-detail/access/page.tsx b/web/features/agent-v2/agent-detail/access/page.tsx
index 2ea3486992ac40..db01a379518892 100644
--- a/web/features/agent-v2/agent-detail/access/page.tsx
+++ b/web/features/agent-v2/agent-detail/access/page.tsx
@@ -60,6 +60,7 @@ export function AgentAccessPage({ agentId }: AgentAccessPageProps) {
         {agent?.app_id && !agent.hidden_app_backed && capabilities.canViewAccessPoint && (
           <AccessControlEntry
             appId={agent.app_id}
+            appMode="agent"
             isPublished={agent.access_ready === true}
             appIcon={{
               iconType:
diff --git a/web/features/network-access/__tests__/analytics.spec.ts b/web/features/network-access/__tests__/analytics.spec.ts
new file mode 100644
index 00000000000000..41f5e803310c90
--- /dev/null
+++ b/web/features/network-access/__tests__/analytics.spec.ts
@@ -0,0 +1,77 @@
+import { trackEvent } from '@/app/components/base/amplitude'
+import {
+  getAccessControlFailReason,
+  getIpPolicyFailReason,
+  getProtectedAccessPoints,
+  trackNetworkAccessEvent,
+} from '../analytics'
+
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
+
+it('maps API scopes to the analytics vocabulary', () => {
+  expect(getProtectedAccessPoints(['webapp', 'service_api', 'mcp', 'trigger'])).toEqual([
+    'web_app',
+    'service_api',
+    'mcp_server',
+    'trigger',
+  ])
+})
+
+it('only forwards allowlisted properties and excludes application context from Settings forms', () => {
+  const properties = {
+    action: 'form_opened' as const,
+    mode: 'edit' as const,
+    source: 'list_row' as const,
+    policy_id: 'policy-1',
+    name: 'Private',
+    allowed_cidrs: ['203.0.113.42/32'],
+    client_ip: '203.0.113.42',
+    app_id: 'unrelated-app',
+    app_mode: 'chat',
+    access_point_total: 3,
+  }
+  trackNetworkAccessEvent('ip_policy_interaction', properties)
+  expect(trackEvent).toHaveBeenLastCalledWith('ip_policy_interaction', {
+    action: 'form_opened',
+    mode: 'edit',
+    source: 'list_row',
+    policy_id: 'policy-1',
+  })
+})
+
+it.each([
+  [403, 'This feature requires a paid plan.', 'plan', 'permission'],
+  [403, 'Network access groups are not available for this workspace.', 'plan', 'permission'],
+  [
+    403,
+    'Your workspace role does not allow this network access operation.',
+    'permission',
+    'permission',
+  ],
+  [401, 'Unauthorized', 'permission', 'permission'],
+  [503, 'Unavailable', 'network', 'network'],
+  [409, 'This workspace has reached the network access group limit.', 'other', 'limit_exceeded'],
+  [409, 'The network access resource changed. Refresh it and try again.', 'other', 'other'],
+  [409, 'A network access group with this name already exists.', 'other', 'other'],
+  [400, 'Invalid request', 'other', 'other'],
+])(
+  'classifies HTTP %i failures without forwarding error text',
+  async (status, message, accessReason, policyReason) => {
+    const error = Response.json({ message }, { status })
+    expect(await getAccessControlFailReason(error)).toBe(accessReason)
+    expect(await getIpPolicyFailReason(error)).toBe(policyReason)
+    expect(error.bodyUsed).toBe(false)
+  },
+)
+
+it('recognizes fetch failures without labelling arbitrary exceptions as network errors', async () => {
+  expect(await getAccessControlFailReason(new TypeError('Failed to fetch'))).toBe('network')
+  expect(await getIpPolicyFailReason(new Error('Unexpected failure'))).toBe('other')
+})
+
+it('still classifies the status when an error response body has already been consumed', async () => {
+  const response = Response.json({ message: 'Unavailable' }, { status: 503 })
+  await response.json()
+  expect(await getAccessControlFailReason(response)).toBe('network')
+  expect(await getIpPolicyFailReason(response)).toBe('network')
+})
diff --git a/web/features/network-access/analytics.ts b/web/features/network-access/analytics.ts
new file mode 100644
index 00000000000000..5cd78a05c9c8f9
--- /dev/null
+++ b/web/features/network-access/analytics.ts
@@ -0,0 +1,202 @@
+import type { AppMode } from '@dify/contracts/api/console/apps/types.gen'
+import type { NetworkAccessPoint } from '@/app/components/app/access-point/access-control/network-access'
+import { trackEvent } from '@/app/components/base/amplitude'
+
+export type AccessControlAnalyticsContext = {
+  app_id: string
+  app_mode: AppMode
+  access_point_total: number
+}
+
+export type IpPolicySource =
+  | 'list_add_button'
+  | 'list_empty_state'
+  | 'list_row'
+  | 'list_row_menu'
+  | 'access_control_dropdown'
+  | 'access_control_empty_state'
+
+export type IpPolicyValidationError =
+  | 'octet_out_of_range'
+  | 'leading_zero'
+  | 'invalid_ipv6'
+  | 'prefix_not_number'
+  | 'prefix_out_of_range'
+  | 'multiple_slash'
+  | 'unsupported_format'
+
+export type IpPolicyFormContext = {
+  mode: 'create' | 'edit' | 'view'
+  policy_id?: string
+} & (
+  | { source: Extract<IpPolicySource, `list_${string}`> }
+  | ({ source: Extract<IpPolicySource, `access_control_${string}`> } & Pick<
+      AccessControlAnalyticsContext,
+      'app_id' | 'app_mode'
+    >)
+)
+
+type AccessControlInteraction =
+  | { action: 'edit_started'; edit_entry: 'first_config' | 'preview_edit' | 'draft_restored' }
+  | { action: 'edit_abandoned'; abandon_method: 'cancel' | 'back' | 'dismiss' }
+  | { action: 'manage_policies_clicked' }
+  | {
+      action:
+        | 'policy_selected'
+        | 'turned_on'
+        | 'turn_off_attempted'
+        | 'turn_off_confirmed'
+        | 'turn_off_cancelled'
+      policy_id: string
+    }
+
+export type AccessControlSaveProperties = AccessControlAnalyticsContext & {
+  is_first_config: boolean
+  policy_id: string
+  protected_access_points: Array<'web_app' | 'service_api' | 'mcp_server' | 'trigger'>
+  protected_count: number
+  is_current_ip_included: boolean
+}
+
+export type IpPolicySaveProperties = IpPolicyFormContext & {
+  mode: 'create' | 'edit'
+  entry_count: number
+  validation_error_types: IpPolicyValidationError[]
+}
+
+type AccessControlFailReason = 'network' | 'permission' | 'plan' | 'other'
+type IpPolicyFailReason = 'limit_exceeded' | 'network' | 'permission' | 'other'
+type SaveResult<Reason> = { result: 'success' } | { result: 'failed'; fail_reason: Reason }
+type NetworkAccessEvents = {
+  access_control_entry_click: AccessControlAnalyticsContext & {
+    entry_status: 'off' | 'paused' | 'on' | 'partial' | 'sandbox' | 'lapsed'
+    has_draft: boolean
+  }
+  access_control_upgrade_click: AccessControlAnalyticsContext & { plan_state: 'sandbox' | 'lapsed' }
+  access_control_interaction: AccessControlAnalyticsContext & AccessControlInteraction
+  access_control_save: AccessControlSaveProperties & SaveResult<AccessControlFailReason>
+  ip_policy_save: IpPolicySaveProperties & SaveResult<IpPolicyFailReason>
+  ip_policy_interaction:
+    | { action: 'settings_tab_viewed' }
+    | ({ action: 'form_opened' } & IpPolicyFormContext)
+    | { action: 'delete_attempted' | 'delete_cancelled'; policy_id: string }
+    | { action: 'delete_confirmed'; policy_id: string; referenced_app_count: number }
+}
+
+const APP_PROPERTIES = ['app_id', 'app_mode', 'access_point_total']
+const EVENT_PROPERTIES = {
+  access_control_entry_click: [...APP_PROPERTIES, 'entry_status', 'has_draft'],
+  access_control_upgrade_click: [...APP_PROPERTIES, 'plan_state'],
+  access_control_interaction: [
+    ...APP_PROPERTIES,
+    'action',
+    'edit_entry',
+    'abandon_method',
+    'policy_id',
+  ],
+  access_control_save: [
+    ...APP_PROPERTIES,
+    'result',
+    'is_first_config',
+    'policy_id',
+    'protected_access_points',
+    'protected_count',
+    'is_current_ip_included',
+    'fail_reason',
+  ],
+  ip_policy_save: [
+    'mode',
+    'source',
+    'result',
+    'policy_id',
+    'entry_count',
+    'validation_error_types',
+    'fail_reason',
+  ],
+  ip_policy_interaction: ['action', 'mode', 'source', 'policy_id', 'referenced_app_count'],
+} satisfies Record<keyof NetworkAccessEvents, string[]>
+
+export function trackNetworkAccessEvent<Event extends keyof NetworkAccessEvents>(
+  event: Event,
+  properties: NetworkAccessEvents[Event],
+) {
+  const allowed = EVENT_PROPERTIES[event]
+  const fromApp =
+    'source' in properties &&
+    (properties.source === 'access_control_dropdown' ||
+      properties.source === 'access_control_empty_state')
+  const keys = fromApp ? [...allowed, 'app_id', 'app_mode'] : allowed
+  const payload = Object.fromEntries(
+    Object.entries(properties).filter(([key, value]) => keys.includes(key) && value !== undefined),
+  )
+  trackEvent(event, payload)
+}
+
+const ACCESS_POINTS = {
+  webapp: 'web_app',
+  service_api: 'service_api',
+  mcp: 'mcp_server',
+  trigger: 'trigger',
+} as const
+
+export function getProtectedAccessPoints(points: readonly NetworkAccessPoint[]) {
+  return points.map((point) => ACCESS_POINTS[point])
+}
+
+async function readFailure(
+  error: unknown,
+): Promise<{ status?: number; message?: string; code?: string }> {
+  if (typeof error !== 'object' || error === null) return {}
+  const response =
+    error instanceof Response
+      ? error
+      : 'response' in error && error.response instanceof Response
+        ? error.response
+        : undefined
+  if (response) {
+    try {
+      const data: unknown = await response.clone().json()
+      return { ...(await readFailure(data)), status: response.status }
+    } catch {
+      return { status: response.status }
+    }
+  }
+  return {
+    status: 'status' in error && typeof error.status === 'number' ? error.status : undefined,
+    message: 'message' in error && typeof error.message === 'string' ? error.message : undefined,
+    code: 'code' in error && typeof error.code === 'string' ? error.code : undefined,
+  }
+}
+
+function isNetworkFailure(error: unknown, status?: number) {
+  return (
+    (status !== undefined && [408, 502, 503, 504].includes(status)) ||
+    (status === undefined &&
+      error instanceof Error &&
+      ['TypeError', 'TimeoutError', 'AbortError'].includes(error.name))
+  )
+}
+
+export async function getAccessControlFailReason(error: unknown): Promise<AccessControlFailReason> {
+  const { status, message } = await readFailure(error)
+  if (
+    status === 403 &&
+    (message === 'This feature requires a paid plan.' ||
+      message === 'Network access groups are not available for this workspace.')
+  )
+    return 'plan'
+  if (status === 401 || status === 403) return 'permission'
+  return isNetworkFailure(error, status) ? 'network' : 'other'
+}
+
+export async function getIpPolicyFailReason(error: unknown): Promise<IpPolicyFailReason> {
+  const { status, message, code } = await readFailure(error)
+  if (
+    status === 409 &&
+    (code === 'NETWORK_ACCESS_GROUP_LIMIT' ||
+      message === 'This workspace has reached the network access group limit.')
+  )
+    return 'limit_exceeded'
+  if (status === 401 || status === 403) return 'permission'
+  return isNetworkFailure(error, status) ? 'network' : 'other'
+}

From 9ea1b651af79df376cb01e6d6a47e7b717767739 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Fri, 9 Oct 2026 10:42:16 +0800
Subject: [PATCH 082/108] feat(web): add Settings IP policies empty state

---
 .../account-setting/__tests__/index.spec.tsx  |  15 +-
 .../header/account-setting/index.tsx          |  20 +-
 .../ip-policies-page/__tests__/index.spec.tsx | 295 +++++++++++++++---
 .../ip-policies-page/index.tsx                |  43 ++-
 web/i18n/locales/ar-TN/common.json            |   3 +
 web/i18n/locales/az-AZ/common.json            |   3 +
 web/i18n/locales/de-DE/common.json            |   3 +
 web/i18n/locales/en-US/common.json            |   3 +
 web/i18n/locales/es-ES/common.json            |   3 +
 web/i18n/locales/fa-IR/common.json            |   3 +
 web/i18n/locales/fr-FR/common.json            |   3 +
 web/i18n/locales/hi-IN/common.json            |   3 +
 web/i18n/locales/id-ID/common.json            |   3 +
 web/i18n/locales/it-IT/common.json            |   3 +
 web/i18n/locales/ja-JP/common.json            |   3 +
 web/i18n/locales/ko-KR/common.json            |   3 +
 web/i18n/locales/lo-LA/common.json            |   3 +
 web/i18n/locales/nl-NL/common.json            |   3 +
 web/i18n/locales/pl-PL/common.json            |   3 +
 web/i18n/locales/pt-BR/common.json            |   3 +
 web/i18n/locales/ro-RO/common.json            |   3 +
 web/i18n/locales/ru-RU/common.json            |   3 +
 web/i18n/locales/sl-SI/common.json            |   3 +
 web/i18n/locales/th-TH/common.json            |   3 +
 web/i18n/locales/tr-TR/common.json            |   3 +
 web/i18n/locales/uk-UA/common.json            |   3 +
 web/i18n/locales/vi-VN/common.json            |   3 +
 web/i18n/locales/zh-Hans/common.json          |   3 +
 web/i18n/locales/zh-Hant/common.json          |   3 +
 web/i18n/resources.generated.d.ts             |   3 +
 .../illustrations/ip-policies-empty.svg       |  35 +++
 31 files changed, 415 insertions(+), 71 deletions(-)
 create mode 100644 web/public/illustrations/ip-policies-empty.svg

diff --git a/web/app/components/header/account-setting/__tests__/index.spec.tsx b/web/app/components/header/account-setting/__tests__/index.spec.tsx
index 8a83c738eb8a9e..f077eefc1766a5 100644
--- a/web/app/components/header/account-setting/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/__tests__/index.spec.tsx
@@ -578,9 +578,12 @@ describe('AccountSetting', () => {
       renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
 
       expect(screen.getByRole('button', { name: 'common.settings.ipPolicies' })).toBeInTheDocument()
+      expect(screen.getByText('common.settings.ipPolicyEmptyTitle')).toBeInTheDocument()
+      expect(screen.getAllByText('common.settings.ipPolicies')).toHaveLength(2)
       expect(
-        screen.getByText('deployments.studio.accessControl.emptyPoliciesTitle'),
+        screen.getByRole('heading', { name: 'common.settings.ipPolicies' }),
       ).toBeInTheDocument()
+      expect(screen.getByText('common.settings.ipPoliciesDescription')).toBeInTheDocument()
     })
 
     it('opens IP Policies read-only for editors', () => {
@@ -594,11 +597,9 @@ describe('AccountSetting', () => {
       renderAccountSetting({ initialTab: ACCOUNT_SETTING_TAB.IP_POLICIES })
 
       expect(screen.getByRole('button', { name: 'common.settings.ipPolicies' })).toBeInTheDocument()
+      expect(screen.getByText('common.settings.ipPolicyEmptyTitle')).toBeInTheDocument()
       expect(
-        screen.getByText('deployments.studio.accessControl.emptyPoliciesTitle'),
-      ).toBeInTheDocument()
-      expect(
-        screen.queryByRole('button', { name: 'common.settings.ipPolicyAddEntry' }),
+        screen.queryByRole('button', { name: 'common.settings.ipPolicyEmptyCreate' }),
       ).not.toBeInTheDocument()
     })
 
@@ -617,9 +618,7 @@ describe('AccountSetting', () => {
         expect(
           screen.queryByRole('button', { name: 'common.settings.ipPolicies' }),
         ).not.toBeInTheDocument()
-        expect(
-          screen.queryByText('deployments.studio.accessControl.emptyPoliciesTitle'),
-        ).not.toBeInTheDocument()
+        expect(screen.queryByText('common.settings.ipPolicyEmptyTitle')).not.toBeInTheDocument()
       },
     )
 
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index a5104064d83848..d88302a3ad9f90 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -261,16 +261,18 @@ export default function AccountSetting({
                 style={{ minWidth: 0 }}
                 className="min-h-full w-full max-w-full pb-4"
               >
-                <div className="sticky top-0 z-20 mx-8 flex min-h-15 items-end bg-components-panel-bg pt-8 pb-2">
-                  <div className="min-w-0 flex-1 title-2xl-semi-bold text-text-primary">
-                    {activeItem?.title ?? activeItem?.name}
-                    {activeItem?.description && (
-                      <div className="mt-1 system-sm-regular wrap-break-word whitespace-normal text-text-tertiary">
-                        {activeItem?.description}
-                      </div>
-                    )}
+                {activeMenu !== ACCOUNT_SETTING_TAB.IP_POLICIES && (
+                  <div className="sticky top-0 z-20 mx-8 flex min-h-15 items-end bg-components-panel-bg pt-8 pb-2">
+                    <div className="min-w-0 flex-1 title-2xl-semi-bold text-text-primary">
+                      {activeItem?.title ?? activeItem?.name}
+                      {activeItem?.description && (
+                        <div className="mt-1 system-sm-regular wrap-break-word whitespace-normal text-text-tertiary">
+                          {activeItem?.description}
+                        </div>
+                      )}
+                    </div>
                   </div>
-                </div>
+                )}
                 <div className="max-w-full min-w-0 px-4 pt-6 sm:px-8">
                   {activeMenu === ACCOUNT_SETTING_TAB.MEMBERS && <MembersPage />}
                   {activeMenu === ACCOUNT_SETTING_TAB.IP_POLICIES && <IpPoliciesPage />}
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index c5866ff5c0e4f4..c72072eab5b3e2 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -411,12 +411,14 @@ describe('IpPoliciesPage', () => {
     expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Other Policy')
   })
 
-  it.each(['create', 'edit', 'delete'] as const)(
+  it.each(['create_empty', 'create', 'edit', 'delete'] as const)(
     'stops %s when manager permission is revoked',
     async (action) => {
       const user = userEvent.setup()
       const queryClient = createConsoleQueryClient()
-      seedNetworkAccessGroups(queryClient, { groups: [createNetworkAccessGroupFixture()] })
+      seedNetworkAccessGroups(queryClient, {
+        groups: action === 'create_empty' ? [] : [createNetworkAccessGroupFixture()],
+      })
       renderWithConsoleQuery(
         <NuqsTestingAdapter>
           <IpPoliciesPage />
@@ -428,8 +430,12 @@ describe('IpPoliciesPage', () => {
         },
       )
 
-      if (action === 'create') {
-        await user.click(screen.getByRole('button', { name: 'Add' }))
+      if (action === 'create' || action === 'create_empty') {
+        await user.click(
+          screen.getByRole('button', {
+            name: action === 'create_empty' ? 'Create IP Policy' : 'Add',
+          }),
+        )
         await user.type(screen.getByRole('textbox', { name: 'Name' }), 'New policy')
         await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
       } else {
@@ -447,6 +453,7 @@ describe('IpPoliciesPage', () => {
 
       await waitFor(() => {
         expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
+        expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
         expect(
           screen.queryByRole('button', { name: /^(Create|Save|Delete)$/ }),
         ).not.toBeInTheDocument()
@@ -487,10 +494,154 @@ describe('IpPoliciesPage', () => {
     },
   )
 
-  it('opens the new policy dialog from Add', async () => {
+  it.each(['owner', 'admin'] as const)(
+    'opens a fresh empty-state form for %s on each visit',
+    async (role) => {
+      const user = userEvent.setup()
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        {
+          queryClient,
+          currentWorkspace: { role },
+          systemFeatures: { deployment_edition: 'CLOUD' },
+        },
+      )
+
+      expect(screen.getByRole('heading', { name: 'No IP policies yet' })).toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
+      await user.tab()
+      expect(screen.getByRole('button', { name: 'Create IP Policy' })).toHaveFocus()
+      await user.keyboard('{Enter}')
+      expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+      expect(vi.mocked(trackEvent).mock.calls).toEqual([
+        ['ip_policy_interaction', { action: 'settings_tab_viewed' }],
+        [
+          'ip_policy_interaction',
+          { action: 'form_opened', mode: 'create', source: 'list_empty_state' },
+        ],
+      ])
+
+      await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Unsaved policy')
+      await user.click(screen.getByRole('button', { name: 'Cancel' }))
+      await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
+      await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+      expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('')
+      expect(vi.mocked(trackEvent).mock.calls).toEqual([
+        ['ip_policy_interaction', { action: 'settings_tab_viewed' }],
+        [
+          'ip_policy_interaction',
+          { action: 'form_opened', mode: 'create', source: 'list_empty_state' },
+        ],
+        [
+          'ip_policy_interaction',
+          { action: 'form_opened', mode: 'create', source: 'list_empty_state' },
+        ],
+      ])
+    },
+  )
+
+  it.each(['list_empty_state', 'list_add_button'] as const)(
+    'creates a policy from %s and refreshes the list',
+    async (source) => {
+      const user = userEvent.setup()
+      const initialGroups = source === 'list_add_button' ? [createNetworkAccessGroupFixture()] : []
+      const created = createNetworkAccessGroupFixture({ id: 'new-group', name: 'Office' })
+      const posted: Array<{ method: string; url: string; body: unknown }> = []
+      vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+        const request = input instanceof Request ? input : new Request(String(input), init)
+        const bodyText =
+          request.method === 'GET' || request.method === 'HEAD' ? '' : await request.text()
+        posted.push({
+          method: request.method,
+          url: request.url,
+          body: bodyText ? JSON.parse(bodyText) : null,
+        })
+        if (request.method === 'POST')
+          return Response.json({ group: created, entitled: true }, { status: 201 })
+        if (new URL(request.url).pathname.endsWith('/network-access-groups'))
+          return Response.json({
+            tenant_id: 'workspace-1',
+            entitled: true,
+            groups: [...initialGroups, created],
+          })
+        return Response.json({ client_ip: '203.0.113.42' })
+      })
+      const queryClient = createConsoleQueryClient()
+      seedNetworkAccessGroups(queryClient, { entitled: true, groups: initialGroups })
+      renderWithConsoleQuery(
+        <NuqsTestingAdapter>
+          <IpPoliciesPage />
+        </NuqsTestingAdapter>,
+        { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
+      )
+
+      await user.click(
+        screen.getByRole('button', {
+          name: source === 'list_empty_state' ? 'Create IP Policy' : 'Add',
+        }),
+      )
+      await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
+      await user.click(screen.getByPlaceholderText('10.0.0.0/8'))
+      await user.paste('10.0.0.0/8')
+      expect(screen.getByRole('button', { name: 'Create' })).toBeEnabled()
+      await user.click(screen.getByRole('button', { name: 'Create' }))
+
+      await waitFor(() => {
+        expect(posted).toContainEqual({
+          method: 'POST',
+          url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups',
+          body: {
+            name: 'Office',
+            description: '',
+            allowed_cidrs: ['10.0.0.0/8'],
+          },
+        })
+      })
+      expect(await screen.findByRole('button', { name: 'Office' })).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Add' })).toBeInTheDocument()
+      expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_interaction', {
+        action: 'form_opened',
+        mode: 'create',
+        source,
+      })
+      await waitFor(() =>
+        expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+          mode: 'create',
+          source,
+          result: 'success',
+          policy_id: created.id,
+          entry_count: 1,
+          validation_error_types: [],
+        }),
+      )
+    },
+  )
+
+  it('keeps the empty-state source and validation history through a failed creation and retry', async () => {
     const user = userEvent.setup()
+    const created = createNetworkAccessGroupFixture({ name: 'Office' })
+    let attempts = 0
+    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+      const request = input instanceof Request ? input : new Request(String(input), init)
+      if (request.method === 'POST') {
+        attempts += 1
+        return attempts === 1
+          ? Response.json({ message: 'Unavailable' }, { status: 503 })
+          : Response.json({ group: created, entitled: true }, { status: 201 })
+      }
+      if (new URL(request.url).pathname.endsWith('/network-access-groups'))
+        return Response.json({ tenant_id: 'workspace-1', entitled: true, groups: [created] })
+      return Response.json({ client_ip: '203.0.113.42' })
+    })
     const queryClient = createConsoleQueryClient()
-    seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+    seedNetworkAccessGroups(queryClient)
     renderWithConsoleQuery(
       <NuqsTestingAdapter>
         <IpPoliciesPage />
@@ -498,56 +649,114 @@ describe('IpPoliciesPage', () => {
       { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
-    expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
-    await user.click(screen.getByRole('button', { name: 'Add' }))
-    expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
+    await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+    await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Office')
+    const entry = screen.getByPlaceholderText('10.0.0.0/8')
+    await user.click(entry)
+    await user.paste('999.0.0.1')
     expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
+    await user.clear(entry)
+    await user.paste('10.0.0.0/8')
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+
+    const analytics = {
+      mode: 'create',
+      source: 'list_empty_state',
+      entry_count: 1,
+      validation_error_types: ['octet_out_of_range'],
+    }
+    await waitFor(() =>
+      expect(trackEvent).toHaveBeenCalledWith('ip_policy_save', {
+        ...analytics,
+        result: 'failed',
+        fail_reason: 'network',
+      }),
+    )
+    expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('Office')
+    expect(entry).toHaveValue('10.0.0.0/8')
+    await user.click(screen.getByRole('button', { name: 'Create' }))
+    await waitFor(() =>
+      expect(
+        vi.mocked(trackEvent).mock.calls.filter(([event]) => event === 'ip_policy_save'),
+      ).toEqual([
+        ['ip_policy_save', { ...analytics, result: 'failed', fail_reason: 'network' }],
+        ['ip_policy_save', { ...analytics, result: 'success', policy_id: created.id }],
+      ]),
+    )
+    expect(
+      vi
+        .mocked(trackEvent)
+        .mock.calls.filter(([, properties]) => properties?.action === 'form_opened'),
+    ).toHaveLength(1)
   })
 
-  it('posts a new policy when Create is clicked', async () => {
-    const user = userEvent.setup()
-    const created = createNetworkAccessGroupFixture({ name: 'Office' })
-    const posted: Array<{ method: string; url: string; body: unknown }> = []
-    vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
-      const request = input instanceof Request ? input : new Request(String(input), init)
-      const bodyText =
-        request.method === 'GET' || request.method === 'HEAD' ? '' : await request.text()
-      posted.push({
-        method: request.method,
-        url: request.url,
-        body: bodyText ? JSON.parse(bodyText) : null,
-      })
-      return new Response(JSON.stringify({ group: created, entitled: true }), {
-        status: 201,
-        headers: { 'content-type': 'application/json' },
-      })
-    })
+  it('keeps empty-state creation unavailable to editors', () => {
     const queryClient = createConsoleQueryClient()
-    seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+    seedNetworkAccessGroups(queryClient)
     renderWithConsoleQuery(
       <NuqsTestingAdapter>
         <IpPoliciesPage />
       </NuqsTestingAdapter>,
+      {
+        queryClient,
+        currentWorkspace: { role: 'editor' },
+        systemFeatures: { deployment_edition: 'CLOUD' },
+      },
+    )
+
+    expect(screen.getByRole('heading', { name: 'No IP policies yet' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
+    expect(trackEvent).toHaveBeenCalledExactlyOnceWith('ip_policy_interaction', {
+      action: 'settings_tab_viewed',
+    })
+  })
+
+  it('opens pricing without reporting a form when the empty workspace is not entitled', async () => {
+    const user = userEvent.setup()
+    const onUrlUpdate = vi.fn()
+    const queryClient = createConsoleQueryClient()
+    seedNetworkAccessGroups(queryClient, { entitled: false })
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter onUrlUpdate={onUrlUpdate}>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
       { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
-    await user.click(screen.getByRole('button', { name: 'Add' }))
-    await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
-    await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
-    expect(screen.getByRole('button', { name: 'Create' })).toBeEnabled()
-    await user.click(screen.getByRole('button', { name: 'Create' }))
+    await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+    await waitFor(() => expect(onUrlUpdate).toHaveBeenCalled())
+    expect(onUrlUpdate.mock.lastCall?.[0].searchParams.get('pricing')).toBe('open')
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    expect(trackEvent).toHaveBeenCalledExactlyOnceWith('ip_policy_interaction', {
+      action: 'settings_tab_viewed',
+    })
+  })
 
-    await waitFor(() => {
-      expect(posted).toContainEqual({
-        method: 'POST',
-        url: 'http://localhost:5001/console/api/workspaces/current/network-access-groups',
-        body: {
-          name: 'Office',
-          description: '',
-          allowed_cidrs: ['10.0.0.0/8'],
-        },
-      })
+  it('does not show the empty state while policies are loading or when the request fails', async () => {
+    let resolveGroups!: (response: Response) => void
+    vi.mocked(globalThis.fetch).mockReturnValue(
+      new Promise<Response>((resolve) => {
+        resolveGroups = resolve
+      }),
+    )
+    renderWithConsoleQuery(
+      <NuqsTestingAdapter>
+        <IpPoliciesPage />
+      </NuqsTestingAdapter>,
+      { systemFeatures: { deployment_edition: 'CLOUD' } },
+    )
+
+    expect(screen.getByRole('status')).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+    await waitFor(() => expect(globalThis.fetch).toHaveBeenCalled())
+    await act(async () => {
+      resolveGroups(Response.json({ message: 'Unavailable' }, { status: 503 }))
     })
+    expect(await screen.findByText(deploymentTranslations['common.loadFailed'])).toBeInTheDocument()
+    expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
   })
 
   it('lists existing policies and opens edit from the row', async () => {
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 83f0e71a5d16ff..7a5f27140a80e4 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -2,9 +2,11 @@
 
 import type { NetworkAccessGroupResponse } from '@dify/contracts/api/console/workspaces/types.gen'
 import type { IpPolicyFormSession } from './policy-form-analytics'
+import type { IpPolicySource } from '@/features/network-access/analytics'
 import { Button } from '@langgenius/dify-ui/button'
 import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
+import Image from 'next/image'
 import { useQueryState } from 'nuqs'
 import { useEffect, useRef, useState } from 'react'
 import { useTranslation } from 'react-i18next'
@@ -82,6 +84,7 @@ export default function IpPoliciesPage() {
   const [isRecovering, setIsRecovering] = useState(false)
   const [recoveryError, setRecoveryError] = useState(false)
   const groups = data?.groups ?? []
+  const isEmpty = !isPending && !isError && groups.length === 0
   const entitled = data?.entitled === true
   const canMutate = canManagePolicies && entitled
   const selectedGroup = dialogState && dialogState.mode !== 'create' ? dialogState.group : null
@@ -95,7 +98,7 @@ export default function IpPoliciesPage() {
 
   const openDialog = (
     next: DialogRequest,
-    source: 'list_add_button' | 'list_row' | 'list_row_menu' = 'list_row',
+    source: Extract<IpPolicySource, `list_${string}`> = 'list_row',
   ) => {
     dialogSessionRef.current += 1
     setIsRecovering(false)
@@ -136,20 +139,22 @@ export default function IpPoliciesPage() {
     }
   }
 
-  const handleOpenCreate = () => {
+  const handleOpenCreate = (
+    source: Extract<IpPolicySource, 'list_add_button' | 'list_empty_state'>,
+  ) => {
     if (!canManagePolicies || isPending || isError) return
     if (!entitled) {
       void setPricing('open')
       return
     }
-    openDialog({ mode: 'create' }, 'list_add_button')
+    openDialog({ mode: 'create' }, source)
   }
 
   if (!canReadPolicies) return null
 
   return (
     <div className="flex flex-col gap-4">
-      <div className="flex items-start justify-between gap-4">
+      <div className="flex min-h-15 items-start justify-between gap-4 py-2">
         <div className="flex min-w-0 flex-col gap-1">
           <h2 className="title-2xl-semi-bold text-text-primary">
             {t(($) => $['settings.ipPolicies'], { ns: 'common' })}
@@ -158,8 +163,12 @@ export default function IpPoliciesPage() {
             {t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })}
           </p>
         </div>
-        {canManagePolicies && (
-          <Button variant="primary" size="small" onClick={handleOpenCreate}>
+        {canManagePolicies && !isEmpty && (
+          <Button
+            variant="primary"
+            size="small"
+            onClick={() => handleOpenCreate('list_add_button')}
+          >
             <span aria-hidden className="i-ri-add-line size-4" />
             {t(($) => $['settings.ipPolicyAddEntry'], { ns: 'common' })}
           </Button>
@@ -173,11 +182,23 @@ export default function IpPoliciesPage() {
         </p>
       )}
 
-      {!isPending && !isError && groups.length === 0 && (
-        <div className="flex flex-col items-center py-10 text-center">
-          <p className="system-sm-medium text-text-secondary">
-            {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
-          </p>
+      {isEmpty && (
+        <div className="flex min-h-100 flex-col items-center justify-center gap-4 py-6 text-center">
+          <Image src="/illustrations/ip-policies-empty.svg" alt="" width={48} height={48} />
+          <div className="flex w-full max-w-105 flex-col gap-2">
+            <h3 className="title-xl-semi-bold leading-6 text-text-primary">
+              {t(($) => $['settings.ipPolicyEmptyTitle'], { ns: 'common' })}
+            </h3>
+            <p className="system-sm-regular leading-5 whitespace-pre-line text-text-tertiary">
+              {t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })}
+            </p>
+          </div>
+          {canManagePolicies && (
+            <Button variant="primary" onClick={() => handleOpenCreate('list_empty_state')}>
+              <span aria-hidden className="i-ri-add-line size-4" />
+              {t(($) => $['settings.ipPolicyEmptyCreate'], { ns: 'common' })}
+            </Button>
+          )}
         </div>
       )}
 
diff --git a/web/i18n/locales/ar-TN/common.json b/web/i18n/locales/ar-TN/common.json
index c0a11d8fc6eba3..1e6594f28d5a60 100644
--- a/web/i18n/locales/ar-TN/common.json
+++ b/web/i18n/locales/ar-TN/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "تسري التغييرات فورًا في كل مكان تُطبّق فيه هذه السياسة.",
+  "settings.ipPolicyEmptyCreate": "إنشاء سياسة IP",
+  "settings.ipPolicyEmptyDescription": "حدّد عناوين IP والنطاقات المسموح بها،\nثم طبّق السياسة على تطبيقاتك.",
+  "settings.ipPolicyEmptyTitle": "لا توجد سياسات IP بعد",
   "settings.ipPolicyEnforcingMany": "{{count}} تطبيقات",
   "settings.ipPolicyEnforcingNone": "0 تطبيقات",
   "settings.ipPolicyEnforcingOne": "تطبيق واحد",
diff --git a/web/i18n/locales/az-AZ/common.json b/web/i18n/locales/az-AZ/common.json
index c8347f63a8ed97..35acaa4580d90a 100644
--- a/web/i18n/locales/az-AZ/common.json
+++ b/web/i18n/locales/az-AZ/common.json
@@ -256,6 +256,9 @@
   "resize.nodeHelp": "Ölçünü dəyişmək üçün ox düymələrindən istifadə edin. Daha böyük addımlar üçün Shift düyməsini basılı saxlayın. Home və ya Enter düyməsi ölçünü məzmuna uyğun kiçildir.",
   "resize.size": "{{width}} piksel enində, {{height}} piksel hündürlüyündə",
   "resize.width": "En: {{width}} piksel",
+  "settings.ipPolicyEmptyCreate": "IP siyasəti yarat",
+  "settings.ipPolicyEmptyDescription": "İcazə verilən IP ünvanlarını və diapazonlarını müəyyən edin,\nsonra siyasəti tətbiqlərinizə tətbiq edin.",
+  "settings.ipPolicyEmptyTitle": "Hələ IP siyasəti yoxdur",
   "sort.cancelled": "{{item}} elementinin sıralanması ləğv edildi.",
   "sort.finished": "{{item}} elementi {{count}} mövqe arasında {{position}} nömrəli mövqeyə yerləşdirildi.",
   "sort.handle": "{{item}} elementinin sırasını dəyiş",
diff --git a/web/i18n/locales/de-DE/common.json b/web/i18n/locales/de-DE/common.json
index eda9935f265450..31a57258496136 100644
--- a/web/i18n/locales/de-DE/common.json
+++ b/web/i18n/locales/de-DE/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Änderungen werden überall dort sofort wirksam, wo diese Richtlinie angewendet wird.",
+  "settings.ipPolicyEmptyCreate": "IP-Richtlinie erstellen",
+  "settings.ipPolicyEmptyDescription": "Lege erlaubte IP-Adressen und IP-Bereiche fest\nund wende die Richtlinie auf deine Apps an.",
+  "settings.ipPolicyEmptyTitle": "Noch keine IP-Richtlinien",
   "settings.ipPolicyEnforcingMany": "{{count}} Apps",
   "settings.ipPolicyEnforcingNone": "0 Apps",
   "settings.ipPolicyEnforcingOne": "1 App",
diff --git a/web/i18n/locales/en-US/common.json b/web/i18n/locales/en-US/common.json
index 391a755f8816d2..5771ed6a2e2d4f 100644
--- a/web/i18n/locales/en-US/common.json
+++ b/web/i18n/locales/en-US/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Changes take effect immediately wherever this policy is applied.",
+  "settings.ipPolicyEmptyCreate": "Create IP Policy",
+  "settings.ipPolicyEmptyDescription": "Define allowed IP addresses and ranges,\nthen apply the policy to your apps.",
+  "settings.ipPolicyEmptyTitle": "No IP policies yet",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/es-ES/common.json b/web/i18n/locales/es-ES/common.json
index 72e713b5aa2f06..020470000e7a58 100644
--- a/web/i18n/locales/es-ES/common.json
+++ b/web/i18n/locales/es-ES/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Los cambios se aplican de inmediato donde se utilice esta política.",
+  "settings.ipPolicyEmptyCreate": "Crear política de IP",
+  "settings.ipPolicyEmptyDescription": "Define las direcciones y los rangos de IP permitidos\ny aplica la política a tus aplicaciones.",
+  "settings.ipPolicyEmptyTitle": "Aún no hay políticas de IP",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/fa-IR/common.json b/web/i18n/locales/fa-IR/common.json
index 5ca7cbaae0abe7..c2c60474a887c0 100644
--- a/web/i18n/locales/fa-IR/common.json
+++ b/web/i18n/locales/fa-IR/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "تغییرات بلافاصله در هر جایی که این خط‌مشی اعمال شده است، اجرا می‌شوند.",
+  "settings.ipPolicyEmptyCreate": "ایجاد سیاست IP",
+  "settings.ipPolicyEmptyDescription": "نشانی‌ها و محدوده‌های IP مجاز را مشخص کنید،\nسپس سیاست را روی برنامه‌های خود اعمال کنید.",
+  "settings.ipPolicyEmptyTitle": "هنوز سیاست IP ایجاد نشده است",
   "settings.ipPolicyEnforcingMany": "{{count}} برنامه",
   "settings.ipPolicyEnforcingNone": "۰ برنامه",
   "settings.ipPolicyEnforcingOne": "۱ برنامه",
diff --git a/web/i18n/locales/fr-FR/common.json b/web/i18n/locales/fr-FR/common.json
index 09f2b90ec9ef45..100eea43badf40 100644
--- a/web/i18n/locales/fr-FR/common.json
+++ b/web/i18n/locales/fr-FR/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Les modifications prennent effet immédiatement partout où cette politique est appliquée.",
+  "settings.ipPolicyEmptyCreate": "Créer une politique IP",
+  "settings.ipPolicyEmptyDescription": "Définissez les adresses et plages IP autorisées,\npuis appliquez la politique à vos applications.",
+  "settings.ipPolicyEmptyTitle": "Aucune politique IP pour le moment",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/hi-IN/common.json b/web/i18n/locales/hi-IN/common.json
index 25d230592977d6..93c3be19c5cd1a 100644
--- a/web/i18n/locales/hi-IN/common.json
+++ b/web/i18n/locales/hi-IN/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "यह नीति जहाँ भी लागू है, वहाँ बदलाव तुरंत प्रभावी होंगे।",
+  "settings.ipPolicyEmptyCreate": "IP नीति बनाएँ",
+  "settings.ipPolicyEmptyDescription": "अनुमत IP पते और रेंज तय करें,\nफिर नीति को अपने ऐप्स पर लागू करें।",
+  "settings.ipPolicyEmptyTitle": "अभी कोई IP नीति नहीं है",
   "settings.ipPolicyEnforcingMany": "{{count}} ऐप",
   "settings.ipPolicyEnforcingNone": "0 ऐप",
   "settings.ipPolicyEnforcingOne": "1 ऐप",
diff --git a/web/i18n/locales/id-ID/common.json b/web/i18n/locales/id-ID/common.json
index c635937ead9da1..635e9714ad41b0 100644
--- a/web/i18n/locales/id-ID/common.json
+++ b/web/i18n/locales/id-ID/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Perubahan langsung berlaku di mana pun kebijakan ini diterapkan.",
+  "settings.ipPolicyEmptyCreate": "Buat kebijakan IP",
+  "settings.ipPolicyEmptyDescription": "Tentukan alamat dan rentang IP yang diizinkan,\nlalu terapkan kebijakan ke aplikasi Anda.",
+  "settings.ipPolicyEmptyTitle": "Belum ada kebijakan IP",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikasi",
   "settings.ipPolicyEnforcingNone": "0 aplikasi",
   "settings.ipPolicyEnforcingOne": "1 aplikasi",
diff --git a/web/i18n/locales/it-IT/common.json b/web/i18n/locales/it-IT/common.json
index 3cc4bde1710b94..b06a7130d59345 100644
--- a/web/i18n/locales/it-IT/common.json
+++ b/web/i18n/locales/it-IT/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Le modifiche hanno effetto immediato ovunque sia applicata questa policy.",
+  "settings.ipPolicyEmptyCreate": "Crea policy IP",
+  "settings.ipPolicyEmptyDescription": "Definisci gli indirizzi e gli intervalli IP consentiti,\nquindi applica la policy alle tue app.",
+  "settings.ipPolicyEmptyTitle": "Nessuna policy IP presente",
   "settings.ipPolicyEnforcingMany": "{{count}} app",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/ja-JP/common.json b/web/i18n/locales/ja-JP/common.json
index 4552552ea9861d..e5aa7199f62306 100644
--- a/web/i18n/locales/ja-JP/common.json
+++ b/web/i18n/locales/ja-JP/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "アクセスを許可する IP アドレスまたは範囲を指定します。",
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
   "settings.ipPolicyEditUsedBy": "変更は、このポリシーが適用されているすべての箇所に即時反映されます。",
+  "settings.ipPolicyEmptyCreate": "IP ポリシーを作成",
+  "settings.ipPolicyEmptyDescription": "許可する IP アドレスと範囲を定義し、\nポリシーをアプリに適用します。",
+  "settings.ipPolicyEmptyTitle": "IP ポリシーはまだありません",
   "settings.ipPolicyEnforcingMany": "{{count}} 個のアプリ",
   "settings.ipPolicyEnforcingNone": "0 個のアプリ",
   "settings.ipPolicyEnforcingOne": "1 個のアプリ",
diff --git a/web/i18n/locales/ko-KR/common.json b/web/i18n/locales/ko-KR/common.json
index d4af35877b5e78..d7c09f9fb58d0b 100644
--- a/web/i18n/locales/ko-KR/common.json
+++ b/web/i18n/locales/ko-KR/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "이 정책이 적용된 모든 곳에 변경 사항이 즉시 반영됩니다.",
+  "settings.ipPolicyEmptyCreate": "IP 정책 만들기",
+  "settings.ipPolicyEmptyDescription": "허용할 IP 주소와 범위를 정의한 후\n앱에 정책을 적용하세요.",
+  "settings.ipPolicyEmptyTitle": "아직 IP 정책이 없습니다",
   "settings.ipPolicyEnforcingMany": "앱 {{count}}개",
   "settings.ipPolicyEnforcingNone": "앱 0개",
   "settings.ipPolicyEnforcingOne": "앱 1개",
diff --git a/web/i18n/locales/lo-LA/common.json b/web/i18n/locales/lo-LA/common.json
index 7533d4425f8d45..cf421b0d064f61 100644
--- a/web/i18n/locales/lo-LA/common.json
+++ b/web/i18n/locales/lo-LA/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "ການປ່ຽນແປງຈະມີຜົນທັນທີໃນທຸກບ່ອນທີ່ນຳໃຊ້ນະໂຍບາຍນີ້.",
+  "settings.ipPolicyEmptyCreate": "ສ້າງນະໂຍບາຍ IP",
+  "settings.ipPolicyEmptyDescription": "ກຳນົດທີ່ຢູ່ IP ແລະຊ່ວງ IP ທີ່ອະນຸຍາດ,\nແລ້ວນຳໃຊ້ນະໂຍບາຍກັບແອັບຂອງທ່ານ.",
+  "settings.ipPolicyEmptyTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP",
   "settings.ipPolicyEnforcingMany": "{{count}} ແອັບ",
   "settings.ipPolicyEnforcingNone": "0 ແອັບ",
   "settings.ipPolicyEnforcingOne": "1 ແອັບ",
diff --git a/web/i18n/locales/nl-NL/common.json b/web/i18n/locales/nl-NL/common.json
index 3660aa547e3f52..c58185d91d478d 100644
--- a/web/i18n/locales/nl-NL/common.json
+++ b/web/i18n/locales/nl-NL/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Wijzigingen worden onmiddellijk van kracht overal waar dit beleid wordt toegepast.",
+  "settings.ipPolicyEmptyCreate": "IP-beleid maken",
+  "settings.ipPolicyEmptyDescription": "Definieer toegestane IP-adressen en IP-bereiken\nen pas het beleid toe op je apps.",
+  "settings.ipPolicyEmptyTitle": "Nog geen IP-beleid",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/pl-PL/common.json b/web/i18n/locales/pl-PL/common.json
index fbfd366caa9119..732ef358825d3c 100644
--- a/web/i18n/locales/pl-PL/common.json
+++ b/web/i18n/locales/pl-PL/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Zmiany obowiązują natychmiast wszędzie tam, gdzie stosowana jest ta polityka.",
+  "settings.ipPolicyEmptyCreate": "Utwórz zasady IP",
+  "settings.ipPolicyEmptyDescription": "Określ dozwolone adresy i zakresy IP,\na następnie zastosuj zasady do swoich aplikacji.",
+  "settings.ipPolicyEmptyTitle": "Brak zasad IP",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacji",
   "settings.ipPolicyEnforcingNone": "0 aplikacji",
   "settings.ipPolicyEnforcingOne": "1 aplikacja",
diff --git a/web/i18n/locales/pt-BR/common.json b/web/i18n/locales/pt-BR/common.json
index 0191de7e35c011..3833d3591ef207 100644
--- a/web/i18n/locales/pt-BR/common.json
+++ b/web/i18n/locales/pt-BR/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "As alterações entram em vigor imediatamente onde esta política estiver aplicada.",
+  "settings.ipPolicyEmptyCreate": "Criar política de IP",
+  "settings.ipPolicyEmptyDescription": "Defina os endereços e intervalos de IP permitidos\ne aplique a política aos seus aplicativos.",
+  "settings.ipPolicyEmptyTitle": "Ainda não há políticas de IP",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/ro-RO/common.json b/web/i18n/locales/ro-RO/common.json
index f068aa5834d19b..64648e1f1976d5 100644
--- a/web/i18n/locales/ro-RO/common.json
+++ b/web/i18n/locales/ro-RO/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Modificările se aplică imediat oriunde este utilizată această politică.",
+  "settings.ipPolicyEmptyCreate": "Creează o politică IP",
+  "settings.ipPolicyEmptyDescription": "Definește adresele și intervalele IP permise,\napoi aplică politica aplicațiilor tale.",
+  "settings.ipPolicyEmptyTitle": "Nu există încă politici IP",
   "settings.ipPolicyEnforcingMany": "{{count}} aplicații",
   "settings.ipPolicyEnforcingNone": "0 aplicații",
   "settings.ipPolicyEnforcingOne": "1 aplicație",
diff --git a/web/i18n/locales/ru-RU/common.json b/web/i18n/locales/ru-RU/common.json
index fb1fd90fe15e48..2964702a76d12d 100644
--- a/web/i18n/locales/ru-RU/common.json
+++ b/web/i18n/locales/ru-RU/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Изменения вступают в силу немедленно везде, где применяется эта политика.",
+  "settings.ipPolicyEmptyCreate": "Создать политику IP",
+  "settings.ipPolicyEmptyDescription": "Укажите разрешённые IP-адреса и диапазоны,\nзатем примените политику к своим приложениям.",
+  "settings.ipPolicyEmptyTitle": "Политик IP пока нет",
   "settings.ipPolicyEnforcingMany": "{{count}} приложений",
   "settings.ipPolicyEnforcingNone": "0 приложений",
   "settings.ipPolicyEnforcingOne": "1 приложение",
diff --git a/web/i18n/locales/sl-SI/common.json b/web/i18n/locales/sl-SI/common.json
index 28449f134a6c9f..4e0c35a3480b57 100644
--- a/web/i18n/locales/sl-SI/common.json
+++ b/web/i18n/locales/sl-SI/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Spremembe začnejo veljati takoj povsod, kjer se uporablja ta pravilnik.",
+  "settings.ipPolicyEmptyCreate": "Ustvari pravilnik IP",
+  "settings.ipPolicyEmptyDescription": "Določite dovoljene naslove in obsege IP,\nnato pravilnik uporabite za svoje aplikacije.",
+  "settings.ipPolicyEmptyTitle": "Pravilnikov IP še ni",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacij",
   "settings.ipPolicyEnforcingNone": "0 aplikacij",
   "settings.ipPolicyEnforcingOne": "1 aplikacija",
diff --git a/web/i18n/locales/th-TH/common.json b/web/i18n/locales/th-TH/common.json
index 76b88f33a431fb..3f1bc18c18a6f8 100644
--- a/web/i18n/locales/th-TH/common.json
+++ b/web/i18n/locales/th-TH/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "การเปลี่ยนแปลงจะมีผลทันทีในทุกที่ที่ใช้นโยบายนี้",
+  "settings.ipPolicyEmptyCreate": "สร้างนโยบาย IP",
+  "settings.ipPolicyEmptyDescription": "กำหนดที่อยู่และช่วง IP ที่อนุญาต\nแล้วนำนโยบายไปใช้กับแอปของคุณ",
+  "settings.ipPolicyEmptyTitle": "ยังไม่มีนโยบาย IP",
   "settings.ipPolicyEnforcingMany": "{{count}} แอป",
   "settings.ipPolicyEnforcingNone": "0 แอป",
   "settings.ipPolicyEnforcingOne": "1 แอป",
diff --git a/web/i18n/locales/tr-TR/common.json b/web/i18n/locales/tr-TR/common.json
index cd74480bd4ebaa..7b5a5023e2f04c 100644
--- a/web/i18n/locales/tr-TR/common.json
+++ b/web/i18n/locales/tr-TR/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Değişiklikler bu politikanın uygulandığı her yerde hemen geçerli olur.",
+  "settings.ipPolicyEmptyCreate": "IP politikası oluştur",
+  "settings.ipPolicyEmptyDescription": "İzin verilen IP adreslerini ve aralıklarını tanımlayın,\nardından politikayı uygulamalarınıza uygulayın.",
+  "settings.ipPolicyEmptyTitle": "Henüz IP politikası yok",
   "settings.ipPolicyEnforcingMany": "{{count}} uygulama",
   "settings.ipPolicyEnforcingNone": "0 uygulama",
   "settings.ipPolicyEnforcingOne": "1 uygulama",
diff --git a/web/i18n/locales/uk-UA/common.json b/web/i18n/locales/uk-UA/common.json
index 9b11ca4ddb87eb..6f550f04b65d01 100644
--- a/web/i18n/locales/uk-UA/common.json
+++ b/web/i18n/locales/uk-UA/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Зміни набувають чинності негайно всюди, де застосовується ця політика.",
+  "settings.ipPolicyEmptyCreate": "Створити політику IP",
+  "settings.ipPolicyEmptyDescription": "Визначте дозволені IP-адреси та діапазони,\nа потім застосуйте політику до своїх застосунків.",
+  "settings.ipPolicyEmptyTitle": "Політик IP ще немає",
   "settings.ipPolicyEnforcingMany": "{{count}} застосунків",
   "settings.ipPolicyEnforcingNone": "0 застосунків",
   "settings.ipPolicyEnforcingOne": "1 застосунок",
diff --git a/web/i18n/locales/vi-VN/common.json b/web/i18n/locales/vi-VN/common.json
index efdb67d975cc9f..43954768e696b2 100644
--- a/web/i18n/locales/vi-VN/common.json
+++ b/web/i18n/locales/vi-VN/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Các thay đổi có hiệu lực ngay lập tức ở mọi nơi áp dụng chính sách này.",
+  "settings.ipPolicyEmptyCreate": "Tạo chính sách IP",
+  "settings.ipPolicyEmptyDescription": "Xác định địa chỉ và dải IP được phép,\nsau đó áp dụng chính sách cho ứng dụng của bạn.",
+  "settings.ipPolicyEmptyTitle": "Chưa có chính sách IP",
   "settings.ipPolicyEnforcingMany": "{{count}} ứng dụng",
   "settings.ipPolicyEnforcingNone": "0 ứng dụng",
   "settings.ipPolicyEnforcingOne": "1 ứng dụng",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index 2abf2567ee75da..021a80faea3f81 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "指定允许访问的 IP 地址或网段。",
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
   "settings.ipPolicyEditUsedBy": "修改将立即对所有引用此策略的应用生效。",
+  "settings.ipPolicyEmptyCreate": "创建 IP 策略",
+  "settings.ipPolicyEmptyDescription": "定义允许访问的 IP 地址和网段，\n然后将策略应用到你的应用。",
+  "settings.ipPolicyEmptyTitle": "暂无 IP 策略",
   "settings.ipPolicyEnforcingMany": "{{count}} 个",
   "settings.ipPolicyEnforcingNone": "0 个",
   "settings.ipPolicyEnforcingOne": "1 个",
diff --git a/web/i18n/locales/zh-Hant/common.json b/web/i18n/locales/zh-Hant/common.json
index 2f2707dc32dfcf..db506f29e39675 100644
--- a/web/i18n/locales/zh-Hant/common.json
+++ b/web/i18n/locales/zh-Hant/common.json
@@ -276,6 +276,9 @@
   "settings.ipPolicyDialogDescription": "指定允許存取的 IP 位址或網段。",
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
   "settings.ipPolicyEditUsedBy": "修改將立即對所有套用此原則的應用程式生效。",
+  "settings.ipPolicyEmptyCreate": "建立 IP 策略",
+  "settings.ipPolicyEmptyDescription": "定義允許存取的 IP 位址與網段，\n再將策略套用至你的應用程式。",
+  "settings.ipPolicyEmptyTitle": "尚無 IP 策略",
   "settings.ipPolicyEnforcingMany": "{{count}} 個應用",
   "settings.ipPolicyEnforcingNone": "0 個應用",
   "settings.ipPolicyEnforcingOne": "1 個應用",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 6958415a0c855c..f61541c9224b67 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -1827,6 +1827,9 @@ export default interface Resources {
     'settings.ipPolicyDialogDescription': 'Specify which IP addresses or ranges can access your apps.'
     'settings.ipPolicyEditTitle': 'Edit IP Policy'
     'settings.ipPolicyEditUsedBy': 'Changes take effect immediately wherever this policy is applied.'
+    'settings.ipPolicyEmptyCreate': 'Create IP Policy'
+    'settings.ipPolicyEmptyDescription': 'Define allowed IP addresses and ranges,\nthen apply the policy to your apps.'
+    'settings.ipPolicyEmptyTitle': 'No IP policies yet'
     'settings.ipPolicyEnforcingMany': '{{count}} apps'
     'settings.ipPolicyEnforcingNone': '0 apps'
     'settings.ipPolicyEnforcingOne': '1 app'
diff --git a/web/public/illustrations/ip-policies-empty.svg b/web/public/illustrations/ip-policies-empty.svg
new file mode 100644
index 00000000000000..16f38d8598cd1c
--- /dev/null
+++ b/web/public/illustrations/ip-policies-empty.svg
@@ -0,0 +1,35 @@
+<svg width="48" height="48" viewBox="0 0 48 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+<rect width="48" height="48" fill="#A8A8A8"/>
+<g id="setting">
+<path d="M-1170 -1789C-1170 -1790.1 -1169.1 -1791 -1168 -1791H13439C13440.1 -1791 13441 -1790.1 13441 -1789V1757C13441 1758.1 13440.1 1759 13439 1759H-1168C-1169.1 1759 -1170 1758.1 -1170 1757V-1789Z" fill="#616161"/>
+<path d="M-1168 -1791V-1790H13439V-1791V-1792H-1168V-1791ZM13441 -1789H13440V1757H13441H13442V-1789H13441ZM13439 1759V1758H-1168V1759V1760H13439V1759ZM-1170 1757H-1169V-1789H-1170H-1171V1757H-1170ZM-1168 1759V1758C-1168.55 1758 -1169 1757.55 -1169 1757H-1170H-1171C-1171 1758.66 -1169.66 1760 -1168 1760V1759ZM13441 1757H13440C13440 1757.55 13439.6 1758 13439 1758V1759V1760C13440.7 1760 13442 1758.66 13442 1757H13441ZM13439 -1791V-1790C13439.6 -1790 13440 -1789.55 13440 -1789H13441H13442C13442 -1790.66 13440.7 -1792 13439 -1792V-1791ZM-1168 -1791V-1792C-1169.66 -1792 -1171 -1790.66 -1171 -1789H-1170H-1169C-1169 -1789.55 -1168.55 -1790 -1168 -1790V-1791Z" fill="black" fill-opacity="0.1"/>
+<g id="setting_2" clip-path="url(#clip0_1_47)">
+<rect width="1512" height="982" transform="translate(-844 -208)" fill="#F2F4F7"/>
+<g id="IP Policies">
+<rect width="1512" height="982" transform="translate(-844 -208)" fill="white" fill-opacity="0.8"/>
+<g id="Right">
+<rect width="824" height="982" transform="translate(-388 -208)" fill="white"/>
+<g id="Container">
+<g id="Container_2">
+<g id="Empty State &#194;&#183; No IP Policies">
+<g id="IP Policy &#194;&#183; Shield" clip-path="url(#clip1_1_47)">
+<path id="Vector" d="M36 0H12C5.37258 0 0 5.37258 0 12V36C0 42.6274 5.37258 48 12 48H36C42.6274 48 48 42.6274 48 36V12C48 5.37258 42.6274 0 36 0Z" fill="#F2F4F7"/>
+<path id="Vector_2" d="M24 11L34 15V23C34 30 29 34 24 37C19 34 14 30 14 23V15L24 11Z" stroke="#667085" stroke-width="1.8" stroke-linejoin="round"/>
+<path id="Vector_3" d="M24 19V27M20 23H28" stroke="#667085" stroke-width="1.8" stroke-linecap="round"/>
+</g>
+</g>
+</g>
+</g>
+</g>
+</g>
+</g>
+</g>
+<defs>
+<clipPath id="clip0_1_47">
+<rect width="1512" height="982" fill="white" transform="translate(-844 -208)"/>
+</clipPath>
+<clipPath id="clip1_1_47">
+<rect width="48" height="48" fill="white"/>
+</clipPath>
+</defs>
+</svg>

From e79d9856563fe26020396279833ae81bc1a81d25 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 17:11:28 +0800
Subject: [PATCH 083/108] fix(web): stabilize IP policy current IP row height
 (SNP-945)

---
 .../account-setting/ip-policies-page/allowlist-field.tsx   | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
index fda984dafbf30b..8d7fe3847cb598 100644
--- a/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/allowlist-field.tsx
@@ -136,7 +136,10 @@ export function AllowlistField({
       </Button>
 
       {currentIpStatus && (
-        <p role="status" className="system-xs-regular text-text-tertiary">
+        <p
+          role="status"
+          className="flex min-h-6 shrink-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary"
+        >
           {currentIpStatus === 'loading'
             ? t(($) => $['settings.ipPolicyCurrentIpLoading'], { ns: 'common' })
             : t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
@@ -149,7 +152,7 @@ export function AllowlistField({
       )}
 
       {currentIp && (
-        <p className="flex shrink-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
+        <p className="flex min-h-6 shrink-0 flex-wrap items-center gap-1.5 system-xs-regular text-text-tertiary">
           <span>{t(($) => $['settings.ipPolicyCurrentIp'], { ns: 'common', ip: currentIp })}</span>
           <Button
             type="button"

From e1b130bcbaab1c1141d58ce8a81028669cd931d8 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 17:17:09 +0800
Subject: [PATCH 084/108] fix(web): restore IP lockout confirmation spacing
 (SNP-939)

---
 .../app/access-point/access-control/index.tsx | 40 ++++++++++---------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index f69af382d285df..cc022eb53e1fe1 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -679,25 +679,27 @@ function AccessControlSession({
         }}
       >
         <AlertDialogContent className="w-100">
-          <AlertDialogTitle>
-            {t(($) => $['studio.accessControl.saveWithoutOwnIp'], { ns: 'deployments' })}
-          </AlertDialogTitle>
-          <AlertDialogDescription>
-            {t(($) => $['studio.accessControl.lockoutWarning'], {
-              ns: 'deployments',
-              ip: confirmation?.clientIp ?? '',
-            })}
-          </AlertDialogDescription>
-          {confirmation?.changed && (
-            <p role="status" className="system-sm-regular text-text-warning">
-              {t(($) => $['studio.accessControl.policyChanged'], { ns: 'deployments' })}
-            </p>
-          )}
-          {saveCheck.isError && (
-            <p role="alert" className="system-sm-regular text-text-warning">
-              {t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
-            </p>
-          )}
+          <div className="flex flex-col gap-2 p-6 pb-4">
+            <AlertDialogTitle className="title-xl-semi-bold text-text-primary">
+              {t(($) => $['studio.accessControl.saveWithoutOwnIp'], { ns: 'deployments' })}
+            </AlertDialogTitle>
+            <AlertDialogDescription className="system-sm-regular text-text-secondary">
+              {t(($) => $['studio.accessControl.lockoutWarning'], {
+                ns: 'deployments',
+                ip: confirmation?.clientIp ?? '',
+              })}
+            </AlertDialogDescription>
+            {confirmation?.changed && (
+              <p role="status" className="system-sm-regular text-text-warning">
+                {t(($) => $['studio.accessControl.policyChanged'], { ns: 'deployments' })}
+              </p>
+            )}
+            {saveCheck.isError && (
+              <p role="alert" className="system-sm-regular text-text-warning">
+                {t(($) => $['settings.ipPolicyCurrentIpError'], { ns: 'common' })}
+              </p>
+            )}
+          </div>
           <AlertDialogFooter>
             <AlertDialogCancelButton>
               {t(($) => $['operation.cancel'], { ns: 'common' })}

From e859efaab43749cdac13408fa3dd81f2794da6f5 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 17:19:56 +0800
Subject: [PATCH 085/108] fix(web): pluralize IP policy address counts
 (SNP-938)

---
 web/i18n/locales/ar-TN/deployments.json   | 7 ++++++-
 web/i18n/locales/az-AZ/deployments.json   | 2 ++
 web/i18n/locales/de-DE/deployments.json   | 3 ++-
 web/i18n/locales/en-US/deployments.json   | 3 ++-
 web/i18n/locales/es-ES/deployments.json   | 4 +++-
 web/i18n/locales/fa-IR/deployments.json   | 3 ++-
 web/i18n/locales/fr-FR/deployments.json   | 4 +++-
 web/i18n/locales/hi-IN/deployments.json   | 3 ++-
 web/i18n/locales/id-ID/deployments.json   | 3 ++-
 web/i18n/locales/it-IT/deployments.json   | 4 +++-
 web/i18n/locales/ja-JP/deployments.json   | 3 ++-
 web/i18n/locales/ko-KR/deployments.json   | 3 ++-
 web/i18n/locales/lo-LA/deployments.json   | 3 ++-
 web/i18n/locales/nl-NL/deployments.json   | 3 ++-
 web/i18n/locales/pl-PL/deployments.json   | 5 ++++-
 web/i18n/locales/pt-BR/deployments.json   | 4 +++-
 web/i18n/locales/ro-RO/deployments.json   | 4 +++-
 web/i18n/locales/ru-RU/deployments.json   | 5 ++++-
 web/i18n/locales/sl-SI/deployments.json   | 5 ++++-
 web/i18n/locales/th-TH/deployments.json   | 3 ++-
 web/i18n/locales/tr-TR/deployments.json   | 3 ++-
 web/i18n/locales/uk-UA/deployments.json   | 5 ++++-
 web/i18n/locales/vi-VN/deployments.json   | 3 ++-
 web/i18n/locales/zh-Hans/deployments.json | 3 ++-
 web/i18n/locales/zh-Hant/deployments.json | 3 ++-
 web/i18n/resources.generated.d.ts         | 2 +-
 26 files changed, 68 insertions(+), 25 deletions(-)

diff --git a/web/i18n/locales/ar-TN/deployments.json b/web/i18n/locales/ar-TN/deployments.json
index 07ec5f77112e74..1d9a1ab2a72373 100644
--- a/web/i18n/locales/ar-TN/deployments.json
+++ b/web/i18n/locales/ar-TN/deployments.json
@@ -32,7 +32,12 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "غير منشور",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "جاري إلغاء النشر",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "غير معروف",
-  "studio.accessControl.addressCount": "{{count}} من العناوين",
+  "studio.accessControl.addressCount_few": "{{count}} عناوين",
+  "studio.accessControl.addressCount_many": "{{count}} عنوانًا",
+  "studio.accessControl.addressCount_one": "{{count}} عنوان",
+  "studio.accessControl.addressCount_other": "{{count}} عنوان",
+  "studio.accessControl.addressCount_two": "عنوانان ({{count}})",
+  "studio.accessControl.addressCount_zero": "{{count}} عناوين",
   "studio.accessControl.applyTo": "تطبيق على",
   "studio.accessControl.applyToHelp": "اختر نقاط الوصول التي تحميها هذه السياسة.",
   "studio.accessControl.applyToHelpSelected": "اختر نقاط الوصول التي تحميها هذه السياسة.",
diff --git a/web/i18n/locales/az-AZ/deployments.json b/web/i18n/locales/az-AZ/deployments.json
index 1f7e402c9bf711..0052ce265d4a4f 100644
--- a/web/i18n/locales/az-AZ/deployments.json
+++ b/web/i18n/locales/az-AZ/deployments.json
@@ -32,6 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Yerləşdirilməyib",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Yerləşdirmə ləğv edilir",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Naməlum",
+  "studio.accessControl.addressCount_one": "{{count}} ünvan",
+  "studio.accessControl.addressCount_other": "{{count}} ünvan",
   "studio.accessPoint.apiDescription": "Tətbiqi HTTP vasitəsilə xidmətlərinizə inteqrasiya edin",
   "studio.accessPoint.description": "Bu tətbiqə çıxışın bütün yolları. Giriş nöqtələri yalnız işləyən versiyaya uyğundur.",
   "studio.accessPoint.embedIntoSite": "Sayta yerləşdir",
diff --git a/web/i18n/locales/de-DE/deployments.json b/web/i18n/locales/de-DE/deployments.json
index d9fea353bf37d2..211fe6310b3857 100644
--- a/web/i18n/locales/de-DE/deployments.json
+++ b/web/i18n/locales/de-DE/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nicht bereitgestellt",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Bereitstellung wird aufgehoben",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unbekannt",
-  "studio.accessControl.addressCount": "{{count}} Adressen",
+  "studio.accessControl.addressCount_one": "{{count}} Adresse",
+  "studio.accessControl.addressCount_other": "{{count}} Adressen",
   "studio.accessControl.applyTo": "Anwenden auf",
   "studio.accessControl.applyToHelp": "Wählen Sie aus, welche Zugangspunkte diese Richtlinie schützt.",
   "studio.accessControl.applyToHelpSelected": "Wählen Sie aus, welche Zugangspunkte diese Richtlinie schützt.",
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index e5b207fb05f256..8cd8c0b12956f4 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Not deployed",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Undeploying",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Unknown",
-  "studio.accessControl.addressCount": "{{count}} addresses",
+  "studio.accessControl.addressCount_one": "{{count}} address",
+  "studio.accessControl.addressCount_other": "{{count}} addresses",
   "studio.accessControl.applyTo": "Apply to",
   "studio.accessControl.applyToHelp": "Choose which access points this policy protects.",
   "studio.accessControl.applyToHelpSelected": "Choose which access points this policy protects.",
diff --git a/web/i18n/locales/es-ES/deployments.json b/web/i18n/locales/es-ES/deployments.json
index 9a9a756814e8ea..aa2f8bef240e6d 100644
--- a/web/i18n/locales/es-ES/deployments.json
+++ b/web/i18n/locales/es-ES/deployments.json
@@ -32,7 +32,9 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "No desplegado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Retirando despliegue",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconocido",
-  "studio.accessControl.addressCount": "{{count}} direcciones",
+  "studio.accessControl.addressCount_many": "{{count}} direcciones",
+  "studio.accessControl.addressCount_one": "{{count}} dirección",
+  "studio.accessControl.addressCount_other": "{{count}} direcciones",
   "studio.accessControl.applyTo": "Aplicar a",
   "studio.accessControl.applyToHelp": "Elige qué puntos de acceso protege esta política.",
   "studio.accessControl.applyToHelpSelected": "Elige qué puntos de acceso protege esta política.",
diff --git a/web/i18n/locales/fa-IR/deployments.json b/web/i18n/locales/fa-IR/deployments.json
index 32957611663859..6687f1e8c855e7 100644
--- a/web/i18n/locales/fa-IR/deployments.json
+++ b/web/i18n/locales/fa-IR/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "مستقر نشده",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "در حال لغو استقرار",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ناشناخته",
-  "studio.accessControl.addressCount": "{{count}} نشانی",
+  "studio.accessControl.addressCount_one": "{{count}} نشانی",
+  "studio.accessControl.addressCount_other": "{{count}} نشانی",
   "studio.accessControl.applyTo": "اعمال روی",
   "studio.accessControl.applyToHelp": "انتخاب کنید این خط‌مشی از کدام نقاط دسترسی محافظت کند.",
   "studio.accessControl.applyToHelpSelected": "انتخاب کنید این خط‌مشی از کدام نقاط دسترسی محافظت کند.",
diff --git a/web/i18n/locales/fr-FR/deployments.json b/web/i18n/locales/fr-FR/deployments.json
index d0312de0486c78..5ffdb58bc61644 100644
--- a/web/i18n/locales/fr-FR/deployments.json
+++ b/web/i18n/locales/fr-FR/deployments.json
@@ -32,7 +32,9 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non déployé",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annulation du déploiement",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Inconnu",
-  "studio.accessControl.addressCount": "{{count}} adresses",
+  "studio.accessControl.addressCount_many": "{{count}} adresses",
+  "studio.accessControl.addressCount_one": "{{count}} adresse",
+  "studio.accessControl.addressCount_other": "{{count}} adresses",
   "studio.accessControl.applyTo": "Appliquer à",
   "studio.accessControl.applyToHelp": "Choisissez les points d’accès protégés par cette politique.",
   "studio.accessControl.applyToHelpSelected": "Choisissez les points d’accès protégés par cette politique.",
diff --git a/web/i18n/locales/hi-IN/deployments.json b/web/i18n/locales/hi-IN/deployments.json
index 44f65eb58ef905..6724cb8b2a3b2e 100644
--- a/web/i18n/locales/hi-IN/deployments.json
+++ b/web/i18n/locales/hi-IN/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "डिप्लॉय नहीं किया गया",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "अनडिप्लॉय हो रहा है",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "अज्ञात",
-  "studio.accessControl.addressCount": "{{count}} पते",
+  "studio.accessControl.addressCount_one": "{{count}} पता",
+  "studio.accessControl.addressCount_other": "{{count}} पते",
   "studio.accessControl.applyTo": "इन पर लागू करें",
   "studio.accessControl.applyToHelp": "चुनें कि यह नीति किन पहुँच बिंदुओं की सुरक्षा करेगी।",
   "studio.accessControl.applyToHelpSelected": "चुनें कि यह नीति किन पहुँच बिंदुओं की सुरक्षा करेगी।",
diff --git a/web/i18n/locales/id-ID/deployments.json b/web/i18n/locales/id-ID/deployments.json
index d789125b0a84c0..97f83ccc4e6324 100644
--- a/web/i18n/locales/id-ID/deployments.json
+++ b/web/i18n/locales/id-ID/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Belum diterapkan",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Membatalkan penerapan",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Tidak diketahui",
-  "studio.accessControl.addressCount": "{{count}} alamat",
+  "studio.accessControl.addressCount_one": "{{count}} alamat",
+  "studio.accessControl.addressCount_other": "{{count}} alamat",
   "studio.accessControl.applyTo": "Terapkan ke",
   "studio.accessControl.applyToHelp": "Pilih titik akses yang dilindungi kebijakan ini.",
   "studio.accessControl.applyToHelpSelected": "Pilih titik akses yang dilindungi kebijakan ini.",
diff --git a/web/i18n/locales/it-IT/deployments.json b/web/i18n/locales/it-IT/deployments.json
index f1098c125c22f3..aefb424781fed0 100644
--- a/web/i18n/locales/it-IT/deployments.json
+++ b/web/i18n/locales/it-IT/deployments.json
@@ -32,7 +32,9 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Non distribuito",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Annullamento distribuzione",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Sconosciuto",
-  "studio.accessControl.addressCount": "{{count}} indirizzi",
+  "studio.accessControl.addressCount_many": "{{count}} indirizzi",
+  "studio.accessControl.addressCount_one": "{{count}} indirizzo",
+  "studio.accessControl.addressCount_other": "{{count}} indirizzi",
   "studio.accessControl.applyTo": "Applica a",
   "studio.accessControl.applyToHelp": "Scegli quali punti di accesso protegge questa policy.",
   "studio.accessControl.applyToHelpSelected": "Scegli quali punti di accesso protegge questa policy.",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index c4f48b2cfc8ea4..71c5751d4e9623 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未デプロイ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "アンデプロイ中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "不明",
-  "studio.accessControl.addressCount": "{{count}} 件のアドレス",
+  "studio.accessControl.addressCount_one": "{{count}} 件のアドレス",
+  "studio.accessControl.addressCount_other": "{{count}} 件のアドレス",
   "studio.accessControl.applyTo": "適用先",
   "studio.accessControl.applyToHelp": "このポリシーで保護するアクセスポイントを選択します。",
   "studio.accessControl.applyToHelpSelected": "このポリシーで保護するアクセスポイントを選択します。",
diff --git a/web/i18n/locales/ko-KR/deployments.json b/web/i18n/locales/ko-KR/deployments.json
index eea0e3a84e6352..a13497d4724428 100644
--- a/web/i18n/locales/ko-KR/deployments.json
+++ b/web/i18n/locales/ko-KR/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "배포되지 않음",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "배포 취소 중",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "알 수 없음",
-  "studio.accessControl.addressCount": "주소 {{count}}개",
+  "studio.accessControl.addressCount_one": "주소 {{count}}개",
+  "studio.accessControl.addressCount_other": "주소 {{count}}개",
   "studio.accessControl.applyTo": "적용 대상",
   "studio.accessControl.applyToHelp": "이 정책으로 보호할 접근 지점을 선택하세요.",
   "studio.accessControl.applyToHelpSelected": "이 정책으로 보호할 접근 지점을 선택하세요.",
diff --git a/web/i18n/locales/lo-LA/deployments.json b/web/i18n/locales/lo-LA/deployments.json
index dbb230666bbe67..d4874f61f49821 100644
--- a/web/i18n/locales/lo-LA/deployments.json
+++ b/web/i18n/locales/lo-LA/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ຍັງບໍ່ໄດ້ຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "ກຳລັງຖອນການຕິດຕັ້ງ",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ບໍ່ຮູ້ຈັກ",
-  "studio.accessControl.addressCount": "{{count}} ທີ່ຢູ່",
+  "studio.accessControl.addressCount_one": "{{count}} ທີ່ຢູ່",
+  "studio.accessControl.addressCount_other": "{{count}} ທີ່ຢູ່",
   "studio.accessControl.applyTo": "ນຳໃຊ້ກັບ",
   "studio.accessControl.applyToHelp": "ເລືອກຈຸດເຂົ້າເຖິງທີ່ນະໂຍບາຍນີ້ຈະປົກປ້ອງ.",
   "studio.accessControl.applyToHelpSelected": "ເລືອກຈຸດເຂົ້າເຖິງທີ່ນະໂຍບາຍນີ້ຈະປົກປ້ອງ.",
diff --git a/web/i18n/locales/nl-NL/deployments.json b/web/i18n/locales/nl-NL/deployments.json
index d9c1a28d83ee9e..31d98fd5177951 100644
--- a/web/i18n/locales/nl-NL/deployments.json
+++ b/web/i18n/locales/nl-NL/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Niet geïmplementeerd",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Implementatie ongedaan maken",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Onbekend",
-  "studio.accessControl.addressCount": "{{count}} adressen",
+  "studio.accessControl.addressCount_one": "{{count}} adres",
+  "studio.accessControl.addressCount_other": "{{count}} adressen",
   "studio.accessControl.applyTo": "Toepassen op",
   "studio.accessControl.applyToHelp": "Kies welke toegangspunten door dit beleid worden beschermd.",
   "studio.accessControl.applyToHelpSelected": "Kies welke toegangspunten door dit beleid worden beschermd.",
diff --git a/web/i18n/locales/pl-PL/deployments.json b/web/i18n/locales/pl-PL/deployments.json
index a2e8f8e4441332..103c43158cc7e7 100644
--- a/web/i18n/locales/pl-PL/deployments.json
+++ b/web/i18n/locales/pl-PL/deployments.json
@@ -32,7 +32,10 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Nie wdrożone",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Wycofywanie wdrożenia",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Nieznane",
-  "studio.accessControl.addressCount": "Liczba adresów: {{count}}",
+  "studio.accessControl.addressCount_few": "Liczba adresów: {{count}}",
+  "studio.accessControl.addressCount_many": "Liczba adresów: {{count}}",
+  "studio.accessControl.addressCount_one": "Liczba adresów: {{count}}",
+  "studio.accessControl.addressCount_other": "Liczba adresów: {{count}}",
   "studio.accessControl.applyTo": "Zastosuj do",
   "studio.accessControl.applyToHelp": "Wybierz punkty dostępu chronione przez tę politykę.",
   "studio.accessControl.applyToHelpSelected": "Wybierz punkty dostępu chronione przez tę politykę.",
diff --git a/web/i18n/locales/pt-BR/deployments.json b/web/i18n/locales/pt-BR/deployments.json
index 1ca6b258dccb15..5b9d2e6312a941 100644
--- a/web/i18n/locales/pt-BR/deployments.json
+++ b/web/i18n/locales/pt-BR/deployments.json
@@ -32,7 +32,9 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Não implantado",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Desimplantando",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Desconhecido",
-  "studio.accessControl.addressCount": "{{count}} endereços",
+  "studio.accessControl.addressCount_many": "{{count}} endereços",
+  "studio.accessControl.addressCount_one": "{{count}} endereço",
+  "studio.accessControl.addressCount_other": "{{count}} endereços",
   "studio.accessControl.applyTo": "Aplicar a",
   "studio.accessControl.applyToHelp": "Escolha quais pontos de acesso esta política protege.",
   "studio.accessControl.applyToHelpSelected": "Escolha quais pontos de acesso esta política protege.",
diff --git a/web/i18n/locales/ro-RO/deployments.json b/web/i18n/locales/ro-RO/deployments.json
index 548ff89517662c..863cbac93522c4 100644
--- a/web/i18n/locales/ro-RO/deployments.json
+++ b/web/i18n/locales/ro-RO/deployments.json
@@ -32,7 +32,9 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Neimplementat",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Se anulează implementarea",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Necunoscut",
-  "studio.accessControl.addressCount": "{{count}} adrese",
+  "studio.accessControl.addressCount_few": "{{count}} adrese",
+  "studio.accessControl.addressCount_one": "{{count}} adresă",
+  "studio.accessControl.addressCount_other": "{{count}} de adrese",
   "studio.accessControl.applyTo": "Se aplică la",
   "studio.accessControl.applyToHelp": "Alegeți punctele de acces protejate de această politică.",
   "studio.accessControl.applyToHelpSelected": "Alegeți punctele de acces protejate de această politică.",
diff --git a/web/i18n/locales/ru-RU/deployments.json b/web/i18n/locales/ru-RU/deployments.json
index 97255a79590706..01088c67443fc0 100644
--- a/web/i18n/locales/ru-RU/deployments.json
+++ b/web/i18n/locales/ru-RU/deployments.json
@@ -32,7 +32,10 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не развернуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Свертывание развертывания",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Неизвестно",
-  "studio.accessControl.addressCount": "Количество адресов: {{count}}",
+  "studio.accessControl.addressCount_few": "Количество адресов: {{count}}",
+  "studio.accessControl.addressCount_many": "Количество адресов: {{count}}",
+  "studio.accessControl.addressCount_one": "Количество адресов: {{count}}",
+  "studio.accessControl.addressCount_other": "Количество адресов: {{count}}",
   "studio.accessControl.applyTo": "Применить к",
   "studio.accessControl.applyToHelp": "Выберите точки доступа, которые защищает эта политика.",
   "studio.accessControl.applyToHelpSelected": "Выберите точки доступа, которые защищает эта политика.",
diff --git a/web/i18n/locales/sl-SI/deployments.json b/web/i18n/locales/sl-SI/deployments.json
index 6a6875b29967f6..ae95404e8ff417 100644
--- a/web/i18n/locales/sl-SI/deployments.json
+++ b/web/i18n/locales/sl-SI/deployments.json
@@ -32,7 +32,10 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Ni uvedeno",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Razveljavljanje uvedbe",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Neznano",
-  "studio.accessControl.addressCount": "Število naslovov: {{count}}",
+  "studio.accessControl.addressCount_few": "Število naslovov: {{count}}",
+  "studio.accessControl.addressCount_one": "Število naslovov: {{count}}",
+  "studio.accessControl.addressCount_other": "Število naslovov: {{count}}",
+  "studio.accessControl.addressCount_two": "Število naslovov: {{count}}",
   "studio.accessControl.applyTo": "Uporabi za",
   "studio.accessControl.applyToHelp": "Izberite dostopne točke, ki jih varuje ta pravilnik.",
   "studio.accessControl.applyToHelpSelected": "Izberite dostopne točke, ki jih varuje ta pravilnik.",
diff --git a/web/i18n/locales/th-TH/deployments.json b/web/i18n/locales/th-TH/deployments.json
index 70868ed9117715..c4e6e064535e71 100644
--- a/web/i18n/locales/th-TH/deployments.json
+++ b/web/i18n/locales/th-TH/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "ยังไม่ได้ปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "กำลังยกเลิกการปรับใช้",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "ไม่ทราบ",
-  "studio.accessControl.addressCount": "{{count}} ที่อยู่",
+  "studio.accessControl.addressCount_one": "{{count}} ที่อยู่",
+  "studio.accessControl.addressCount_other": "{{count}} ที่อยู่",
   "studio.accessControl.applyTo": "ใช้กับ",
   "studio.accessControl.applyToHelp": "เลือกจุดเข้าใช้งานที่นโยบายนี้จะปกป้อง",
   "studio.accessControl.applyToHelpSelected": "เลือกจุดเข้าใช้งานที่นโยบายนี้จะปกป้อง",
diff --git a/web/i18n/locales/tr-TR/deployments.json b/web/i18n/locales/tr-TR/deployments.json
index b5e4367dc99a41..35fe32c5876eb8 100644
--- a/web/i18n/locales/tr-TR/deployments.json
+++ b/web/i18n/locales/tr-TR/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Dağıtılmadı",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Dağıtım geri alınıyor",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Bilinmiyor",
-  "studio.accessControl.addressCount": "{{count}} adres",
+  "studio.accessControl.addressCount_one": "{{count}} adres",
+  "studio.accessControl.addressCount_other": "{{count}} adres",
   "studio.accessControl.applyTo": "Uygulanacak noktalar",
   "studio.accessControl.applyToHelp": "Bu politikanın koruyacağı erişim noktalarını seçin.",
   "studio.accessControl.applyToHelpSelected": "Bu politikanın koruyacağı erişim noktalarını seçin.",
diff --git a/web/i18n/locales/uk-UA/deployments.json b/web/i18n/locales/uk-UA/deployments.json
index 81e779cb44aa8e..35c89bb5053407 100644
--- a/web/i18n/locales/uk-UA/deployments.json
+++ b/web/i18n/locales/uk-UA/deployments.json
@@ -32,7 +32,10 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Не розгорнуто",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Скасування розгортання",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Невідомо",
-  "studio.accessControl.addressCount": "Кількість адрес: {{count}}",
+  "studio.accessControl.addressCount_few": "Кількість адрес: {{count}}",
+  "studio.accessControl.addressCount_many": "Кількість адрес: {{count}}",
+  "studio.accessControl.addressCount_one": "Кількість адрес: {{count}}",
+  "studio.accessControl.addressCount_other": "Кількість адрес: {{count}}",
   "studio.accessControl.applyTo": "Застосувати до",
   "studio.accessControl.applyToHelp": "Виберіть точки доступу, які захищає ця політика.",
   "studio.accessControl.applyToHelpSelected": "Виберіть точки доступу, які захищає ця політика.",
diff --git a/web/i18n/locales/vi-VN/deployments.json b/web/i18n/locales/vi-VN/deployments.json
index e04d766fe37c90..e5be0c30c591f3 100644
--- a/web/i18n/locales/vi-VN/deployments.json
+++ b/web/i18n/locales/vi-VN/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "Chưa triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "Đang hủy triển khai",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Không xác định",
-  "studio.accessControl.addressCount": "{{count}} địa chỉ",
+  "studio.accessControl.addressCount_one": "{{count}} địa chỉ",
+  "studio.accessControl.addressCount_other": "{{count}} địa chỉ",
   "studio.accessControl.applyTo": "Áp dụng cho",
   "studio.accessControl.applyToHelp": "Chọn các điểm truy cập được chính sách này bảo vệ.",
   "studio.accessControl.applyToHelpSelected": "Chọn các điểm truy cập được chính sách này bảo vệ.",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index ca8517e597981d..6cbfb118168b92 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下线中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
-  "studio.accessControl.addressCount": "{{count}} 个地址",
+  "studio.accessControl.addressCount_one": "{{count}} 个地址",
+  "studio.accessControl.addressCount_other": "{{count}} 个地址",
   "studio.accessControl.applyTo": "应用于",
   "studio.accessControl.applyToHelp": "选择此策略保护的访问入口。",
   "studio.accessControl.applyToHelpSelected": "选择此策略保护的访问入口。",
diff --git a/web/i18n/locales/zh-Hant/deployments.json b/web/i18n/locales/zh-Hant/deployments.json
index 5ca7a739554ec1..804bae19b7e44a 100644
--- a/web/i18n/locales/zh-Hant/deployments.json
+++ b/web/i18n/locales/zh-Hant/deployments.json
@@ -32,7 +32,8 @@
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED": "未部署",
   "status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING": "下線中",
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "未知",
-  "studio.accessControl.addressCount": "{{count}} 個地址",
+  "studio.accessControl.addressCount_one": "{{count}} 個地址",
+  "studio.accessControl.addressCount_other": "{{count}} 個地址",
   "studio.accessControl.applyTo": "套用至",
   "studio.accessControl.applyToHelp": "選擇要保護的存取點。",
   "studio.accessControl.applyToHelpSelected": "選擇此策略要保護的存取點。",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index f61541c9224b67..54b8e6dee7ec7f 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -2992,7 +2992,7 @@ export default interface Resources {
     'status.RUNTIME_INSTANCE_STATUS_UNDEPLOYED': 'Not deployed'
     'status.RUNTIME_INSTANCE_STATUS_UNDEPLOYING': 'Undeploying'
     'status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED': 'Unknown'
-    'studio.accessControl.addressCount': '{{count}} addresses'
+    'studio.accessControl.addressCount': '{{count}} address' | '{{count}} addresses'
     'studio.accessControl.applyTo': 'Apply to'
     'studio.accessControl.applyToHelp': 'Choose which access points this policy protects.'
     'studio.accessControl.applyToHelpSelected': 'Choose which access points this policy protects.'

From 96f5fffccaf97ed73a964ba7c0a9678cfcb51b16 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 17:26:29 +0800
Subject: [PATCH 086/108] fix(web): align IP access control copy with spec
 (SNP-942)

---
 .../__tests__/config-panel.spec.tsx           | 14 ++--
 .../access-control/__tests__/index.spec.tsx   | 67 +++++++++----------
 .../app/access-point/access-control/index.tsx | 14 ++--
 .../access-control/policy-field.tsx           | 15 +++--
 .../access-control/status-panel.tsx           |  3 +-
 .../ip-policies-page/__tests__/index.spec.tsx | 44 +++++++-----
 web/i18n/locales/ar-TN/common.json            |  4 +-
 web/i18n/locales/ar-TN/deployments.json       |  7 +-
 web/i18n/locales/az-AZ/common.json            |  4 +-
 web/i18n/locales/az-AZ/deployments.json       |  5 ++
 web/i18n/locales/de-DE/common.json            |  4 +-
 web/i18n/locales/de-DE/deployments.json       |  7 +-
 web/i18n/locales/en-US/common.json            |  6 +-
 web/i18n/locales/en-US/deployments.json       |  9 +--
 web/i18n/locales/es-ES/common.json            |  4 +-
 web/i18n/locales/es-ES/deployments.json       |  7 +-
 web/i18n/locales/fa-IR/common.json            |  6 +-
 web/i18n/locales/fa-IR/deployments.json       |  7 +-
 web/i18n/locales/fr-FR/common.json            |  4 +-
 web/i18n/locales/fr-FR/deployments.json       |  7 +-
 web/i18n/locales/hi-IN/common.json            |  4 +-
 web/i18n/locales/hi-IN/deployments.json       |  7 +-
 web/i18n/locales/id-ID/common.json            |  4 +-
 web/i18n/locales/id-ID/deployments.json       |  7 +-
 web/i18n/locales/it-IT/common.json            |  4 +-
 web/i18n/locales/it-IT/deployments.json       |  7 +-
 web/i18n/locales/ja-JP/common.json            |  4 +-
 web/i18n/locales/ja-JP/deployments.json       |  7 +-
 web/i18n/locales/ko-KR/common.json            |  4 +-
 web/i18n/locales/ko-KR/deployments.json       |  7 +-
 web/i18n/locales/lo-LA/common.json            |  4 +-
 web/i18n/locales/lo-LA/deployments.json       |  7 +-
 web/i18n/locales/nl-NL/common.json            |  4 +-
 web/i18n/locales/nl-NL/deployments.json       |  7 +-
 web/i18n/locales/pl-PL/common.json            |  6 +-
 web/i18n/locales/pl-PL/deployments.json       |  7 +-
 web/i18n/locales/pt-BR/common.json            |  4 +-
 web/i18n/locales/pt-BR/deployments.json       |  7 +-
 web/i18n/locales/ro-RO/common.json            |  4 +-
 web/i18n/locales/ro-RO/deployments.json       |  7 +-
 web/i18n/locales/ru-RU/common.json            |  6 +-
 web/i18n/locales/ru-RU/deployments.json       |  7 +-
 web/i18n/locales/sl-SI/common.json            |  4 +-
 web/i18n/locales/sl-SI/deployments.json       |  7 +-
 web/i18n/locales/th-TH/common.json            |  4 +-
 web/i18n/locales/th-TH/deployments.json       |  7 +-
 web/i18n/locales/tr-TR/common.json            |  4 +-
 web/i18n/locales/tr-TR/deployments.json       |  7 +-
 web/i18n/locales/uk-UA/common.json            |  6 +-
 web/i18n/locales/uk-UA/deployments.json       |  7 +-
 web/i18n/locales/vi-VN/common.json            |  4 +-
 web/i18n/locales/vi-VN/deployments.json       |  7 +-
 web/i18n/locales/zh-Hans/common.json          |  4 +-
 web/i18n/locales/zh-Hans/deployments.json     |  7 +-
 web/i18n/locales/zh-Hant/common.json          |  4 +-
 web/i18n/locales/zh-Hant/deployments.json     |  7 +-
 web/i18n/resources.generated.d.ts             | 15 +++--
 57 files changed, 251 insertions(+), 206 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index a11e8a457e6fcf..aacf01e8234221 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -142,9 +142,9 @@ describe('AccessControlConfigPanel', () => {
 
       if (selectedPolicyId) {
         await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-        await user.click(await screen.findByRole('option', { name: 'Add an IP policy' }))
+        await user.click(await screen.findByRole('option', { name: 'Create an IP policy' }))
       } else {
-        await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
+        await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
       }
 
       expect(onCreatePolicy).toHaveBeenCalledOnce()
@@ -160,7 +160,7 @@ describe('AccessControlConfigPanel', () => {
     ({ manageLabel, ...permissions }) => {
       render(<PanelHarness {...permissions} />)
 
-      expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
       expect(screen.getByRole('button', { name: manageLabel })).toBeEnabled()
     },
   )
@@ -190,7 +190,7 @@ describe('AccessControlConfigPanel', () => {
 
     expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
     expect(screen.getByRole('group', { name: 'Apply to' })).toHaveAccessibleDescription(
-      'Please choose at least one access point.',
+      'Please select at least one access point.',
     )
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
@@ -205,7 +205,7 @@ describe('AccessControlConfigPanel', () => {
     await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
     await user.click(screen.getByRole('switch', { name: 'Trigger' }))
 
-    expect(screen.getByText('Please choose at least one access point.')).toBeInTheDocument()
+    expect(screen.getByText('Please select at least one access point.')).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
   })
 
@@ -223,7 +223,7 @@ describe('AccessControlConfigPanel', () => {
     expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
   })
 
-  it('lets the user turn any access point off without a Not enabled label', async () => {
+  it('lets the user turn any access point off without a Not protected label', async () => {
     const user = userEvent.setup()
     render(
       <PanelHarness
@@ -235,7 +235,7 @@ describe('AccessControlConfigPanel', () => {
       />,
     )
 
-    expect(screen.queryByText('Not enabled')).not.toBeInTheDocument()
+    expect(screen.queryByText('Not protected')).not.toBeInTheDocument()
     await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
     expect(screen.getByRole('switch', { name: 'MCP Server' })).not.toBeChecked()
     await user.click(screen.getByRole('switch', { name: 'Trigger' }))
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index b2e4d59bd5db0a..64f4122e946b6f 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -338,26 +338,27 @@ describe('AccessControlEntry', () => {
   })
 
   it.each([
-    { accessPoints: ['webapp', 'service_api', 'mcp'], protectedCount: 3 },
-    { accessPoints: ['webapp', 'service_api', 'mcp', 'trigger'], protectedCount: 4 },
-  ] as const)(
-    'shows $protectedCount of 4 protected access points on hover',
-    async ({ accessPoints, protectedCount }) => {
-      const user = userEvent.setup()
-      renderEntry({
-        plan: 'professional',
-        groups: [createNetworkAccessGroupFixture()],
-        binding: createBinding({ access_points: [...accessPoints] }),
-        availableAccessPoints: ['webapp', 'service_api', 'mcp', 'trigger'],
-      })
-
-      await user.hover(getChip())
-      expect(
-        await screen.findByText(`${protectedCount} of 4 access points are protected`),
-      ).toBeInTheDocument()
-      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+    {
+      accessPoints: ['webapp', 'service_api', 'mcp'],
+      tooltip: '3 of 4 access points are protected',
     },
-  )
+    {
+      accessPoints: ['webapp', 'service_api', 'mcp', 'trigger'],
+      tooltip: 'All 4 access points are protected',
+    },
+  ] as const)('shows "$tooltip" on hover', async ({ accessPoints, tooltip }) => {
+    const user = userEvent.setup()
+    renderEntry({
+      plan: 'professional',
+      groups: [createNetworkAccessGroupFixture()],
+      binding: createBinding({ access_points: [...accessPoints] }),
+      availableAccessPoints: ['webapp', 'service_api', 'mcp', 'trigger'],
+    })
+
+    await user.hover(getChip())
+    expect(await screen.findByText(tooltip)).toBeInTheDocument()
+    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+  })
 
   it.each(['professional', 'team'] as const)(
     'renders the unpaid-config Off chip on Cloud %s',
@@ -420,11 +421,7 @@ describe('AccessControlEntry', () => {
     await user.click(getChip())
 
     expect(screen.getByText('No IP policies in this workspace yet')).toBeInTheDocument()
-    expect(
-      screen.queryByText(
-        'A policy is the list of IP addresses allowed in. Create one, then come back to apply it here.',
-      ),
-    ).not.toBeInTheDocument()
+    expect(screen.getByText('A policy is the list of IP addresses allowed in.')).toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Back' })).not.toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Save' })).toBeDisabled()
     expect(screen.getByRole('switch', { name: 'Web App' })).toHaveAttribute('aria-disabled', 'true')
@@ -437,7 +434,7 @@ describe('AccessControlEntry', () => {
       'true',
     )
     expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
-    expect(screen.queryByText('Not enabled')).not.toBeInTheDocument()
+    expect(screen.queryByText('Not protected')).not.toBeInTheDocument()
   })
 
   it('opens the new policy dialog from the empty-state create action', async () => {
@@ -445,7 +442,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
 
     expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
     expect(mockSetSettingsDestination).not.toHaveBeenCalled()
@@ -456,7 +453,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
     await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Cancel' }))
 
     await waitFor(() => {
@@ -502,7 +499,7 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'professional' })
 
     await user.click(getChip())
-    await user.click(screen.getByRole('button', { name: 'Add an IP policy' }))
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
     await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
     await user.type(screen.getByPlaceholderText('10.0.0.0/8'), '10.0.0.0/8')
     await user.click(screen.getByRole('button', { name: 'Create' }))
@@ -928,7 +925,7 @@ describe('supported access points and binding permission', () => {
     await user.click(getChip())
 
     expect(screen.getByText('Ask a workspace owner or admin to create one.')).toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
     expect(
       screen.queryByRole('button', { name: /(?:Manage|View) IP policies/ }),
     ).not.toBeInTheDocument()
@@ -954,7 +951,7 @@ describe('supported access points and binding permission', () => {
         groups: [createNetworkAccessGroupFixture()],
       })
       await user.click(getChip())
-      expect(screen.queryByRole('button', { name: 'Add an IP policy' })).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
       await user.click(screen.getByRole('button', { name: 'View IP policies' }))
       expect(mockSetSettingsDestination).toHaveBeenCalledWith('ip-policies')
       await user.click(getChip())
@@ -1040,9 +1037,7 @@ describe('supported access points and binding permission', () => {
           expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
         )
         expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
-        expect(
-          screen.getByText('Paused — Internal Network is configured but not enforcing'),
-        ).toBeInTheDocument()
+        expect(screen.getByText('Configured but paused')).toBeInTheDocument()
         expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
         expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
         expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
@@ -1745,7 +1740,7 @@ describe('returning from policy creation', () => {
     renderEntry({ plan: 'professional', groups: server.groups })
     await openSelectedConfig(user)
     await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-    await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
+    await user.click(screen.getByRole('option', { name: 'Create an IP policy' }))
     await user.type(screen.getByRole('textbox', { name: 'Name' }), 'First')
     await user.click(screen.getByPlaceholderText('10.0.0.0/8'))
     await user.paste('10.0.0.0/8')
@@ -1753,7 +1748,7 @@ describe('returning from policy creation', () => {
     await waitFor(() => expect(finish).toBeDefined())
     await user.click(screen.getByRole('button', { name: 'Cancel' }))
     await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-    await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
+    await user.click(screen.getByRole('option', { name: 'Create an IP policy' }))
     await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Second')
     await act(async () =>
       finish(
@@ -1790,7 +1785,7 @@ describe('returning from policy creation', () => {
       await screen.findByText(lockoutWarning)
       await user.click(screen.getByRole('switch', { name: 'MCP Server' }))
       await user.click(screen.getByRole('combobox', { name: 'IP Policy' }))
-      await user.click(screen.getByRole('option', { name: 'Add an IP policy' }))
+      await user.click(screen.getByRole('option', { name: 'Create an IP policy' }))
       const dialog = await screen.findByRole('dialog')
       if (action !== 'cancel') {
         await user.type(within(dialog).getByRole('textbox', { name: 'Name' }), 'New Office')
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index cc022eb53e1fe1..c55fb6d59a589b 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -240,15 +240,19 @@ function AccessControlSession({
       : chip.kind === 'paused'
         ? t(($) => $['studio.accessControl.tooltipPaused'], {
             ns: 'deployments',
-            name: chip.policyName ?? '',
           })
-        : chip.kind === 'on' || chip.kind === 'partial'
-          ? t(($) => $['studio.accessControl.tooltipProtected'], {
+        : chip.kind === 'on'
+          ? t(($) => $['studio.accessControl.tooltipAllProtected'], {
               ns: 'deployments',
-              n: chip.coveredCount,
               total: chip.inServiceCount,
             })
-          : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
+          : chip.kind === 'partial'
+            ? t(($) => $['studio.accessControl.tooltipProtected'], {
+                ns: 'deployments',
+                n: chip.coveredCount,
+                total: chip.inServiceCount,
+              })
+            : t(($) => $['studio.accessControl.tooltipOff'], { ns: 'deployments' })
 
   const handleTurnOn = () => {
     trackNetworkAccessEvent('access_control_upgrade_click', {
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 8908eafe34c92f..7cc984aeec613e 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -75,11 +75,16 @@ export function AccessControlPolicyField({
   if (policies.length === 0) {
     return (
       <div className="flex w-full flex-col items-center gap-3 overflow-hidden rounded-lg border border-dashed border-divider-regular px-4 py-5">
-        <p className="w-full text-center system-sm-medium text-text-secondary">
-          {canManagePolicies
-            ? t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })
-            : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
-        </p>
+        <div className="flex w-full flex-col gap-1 text-center">
+          <p className="system-sm-medium text-text-secondary">
+            {canManagePolicies
+              ? t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })
+              : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
+          </p>
+          <p className="system-xs-regular text-text-tertiary">
+            {t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })}
+          </p>
+        </div>
         {canCreatePolicy ? (
           <Button type="button" variant="secondary-accent" onClick={onCreatePolicy}>
             {t(($) => $['studio.accessControl.createIpPolicy'], { ns: 'deployments' })}
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index 1bcb3646bb0d1d..180a5cf78da947 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -107,7 +107,6 @@ export function AccessControlStatusPanel({
               {!enabled
                 ? t(($) => $['studio.accessControl.tooltipPaused'], {
                     ns: 'deployments',
-                    name: policyName ?? '',
                   })
                 : coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
                   ? t(($) => $['studio.accessControl.protectingAll'], {
@@ -168,7 +167,7 @@ export function AccessControlStatusPanel({
 
         <div className="flex flex-col gap-0.5">
           <p className="system-sm-medium text-text-secondary">
-            {t(($) => $['studio.accessControl.applyTo'], { ns: 'deployments' })}
+            {t(($) => $['studio.accessPoints'], { ns: 'deployments' })}
           </p>
           {availableAccessPoints.map((scope) => {
             const excluded = !draft.scopes[scope]
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index c72072eab5b3e2..77fef851640e5c 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -433,7 +433,7 @@ describe('IpPoliciesPage', () => {
       if (action === 'create' || action === 'create_empty') {
         await user.click(
           screen.getByRole('button', {
-            name: action === 'create_empty' ? 'Create IP Policy' : 'Add',
+            name: action === 'create_empty' ? 'Create an IP policy' : 'Add',
           }),
         )
         await user.type(screen.getByRole('textbox', { name: 'Name' }), 'New policy')
@@ -453,7 +453,9 @@ describe('IpPoliciesPage', () => {
 
       await waitFor(() => {
         expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
-        expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+        expect(
+          screen.queryByRole('button', { name: 'Create an IP policy' }),
+        ).not.toBeInTheDocument()
         expect(
           screen.queryByRole('button', { name: /^(Create|Save|Delete)$/ }),
         ).not.toBeInTheDocument()
@@ -511,10 +513,12 @@ describe('IpPoliciesPage', () => {
         },
       )
 
-      expect(screen.getByRole('heading', { name: 'No IP policies yet' })).toBeInTheDocument()
+      expect(
+        screen.getByRole('heading', { name: 'No IP policies in this workspace yet' }),
+      ).toBeInTheDocument()
       expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
       await user.tab()
-      expect(screen.getByRole('button', { name: 'Create IP Policy' })).toHaveFocus()
+      expect(screen.getByRole('button', { name: 'Create an IP policy' })).toHaveFocus()
       await user.keyboard('{Enter}')
       expect(screen.getByRole('heading', { name: 'New IP Policy' })).toBeInTheDocument()
       expect(screen.getByRole('button', { name: 'Create' })).toBeDisabled()
@@ -529,7 +533,7 @@ describe('IpPoliciesPage', () => {
       await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Unsaved policy')
       await user.click(screen.getByRole('button', { name: 'Cancel' }))
       await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument())
-      await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+      await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
       expect(screen.getByRole('textbox', { name: 'Name' })).toHaveValue('')
       expect(vi.mocked(trackEvent).mock.calls).toEqual([
         ['ip_policy_interaction', { action: 'settings_tab_viewed' }],
@@ -582,7 +586,7 @@ describe('IpPoliciesPage', () => {
 
       await user.click(
         screen.getByRole('button', {
-          name: source === 'list_empty_state' ? 'Create IP Policy' : 'Add',
+          name: source === 'list_empty_state' ? 'Create an IP policy' : 'Add',
         }),
       )
       await user.type(screen.getByPlaceholderText('e.g. Internal Network'), 'Office')
@@ -604,8 +608,10 @@ describe('IpPoliciesPage', () => {
       })
       expect(await screen.findByRole('button', { name: 'Office' })).toBeInTheDocument()
       expect(screen.getByRole('button', { name: 'Add' })).toBeInTheDocument()
-      expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
-      expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+      expect(
+        screen.queryByRole('heading', { name: 'No IP policies in this workspace yet' }),
+      ).not.toBeInTheDocument()
+      expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
       expect(trackEvent).toHaveBeenCalledWith('ip_policy_interaction', {
         action: 'form_opened',
         mode: 'create',
@@ -649,7 +655,7 @@ describe('IpPoliciesPage', () => {
       { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
-    await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
     await user.type(screen.getByRole('textbox', { name: 'Name' }), 'Office')
     const entry = screen.getByPlaceholderText('10.0.0.0/8')
     await user.click(entry)
@@ -704,8 +710,10 @@ describe('IpPoliciesPage', () => {
       },
     )
 
-    expect(screen.getByRole('heading', { name: 'No IP policies yet' })).toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+    expect(
+      screen.getByRole('heading', { name: 'No IP policies in this workspace yet' }),
+    ).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
     expect(trackEvent).toHaveBeenCalledExactlyOnceWith('ip_policy_interaction', {
       action: 'settings_tab_viewed',
@@ -724,7 +732,7 @@ describe('IpPoliciesPage', () => {
       { queryClient, systemFeatures: { deployment_edition: 'CLOUD' } },
     )
 
-    await user.click(screen.getByRole('button', { name: 'Create IP Policy' }))
+    await user.click(screen.getByRole('button', { name: 'Create an IP policy' }))
     await waitFor(() => expect(onUrlUpdate).toHaveBeenCalled())
     expect(onUrlUpdate.mock.lastCall?.[0].searchParams.get('pricing')).toBe('open')
     expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
@@ -748,15 +756,19 @@ describe('IpPoliciesPage', () => {
     )
 
     expect(screen.getByRole('status')).toBeInTheDocument()
-    expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+    expect(
+      screen.queryByRole('heading', { name: 'No IP policies in this workspace yet' }),
+    ).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
     await waitFor(() => expect(globalThis.fetch).toHaveBeenCalled())
     await act(async () => {
       resolveGroups(Response.json({ message: 'Unavailable' }, { status: 503 }))
     })
     expect(await screen.findByText(deploymentTranslations['common.loadFailed'])).toBeInTheDocument()
-    expect(screen.queryByRole('heading', { name: 'No IP policies yet' })).not.toBeInTheDocument()
-    expect(screen.queryByRole('button', { name: 'Create IP Policy' })).not.toBeInTheDocument()
+    expect(
+      screen.queryByRole('heading', { name: 'No IP policies in this workspace yet' }),
+    ).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
   })
 
   it('lists existing policies and opens edit from the row', async () => {
diff --git a/web/i18n/locales/ar-TN/common.json b/web/i18n/locales/ar-TN/common.json
index 1e6594f28d5a60..0907cce2f48f11 100644
--- a/web/i18n/locales/ar-TN/common.json
+++ b/web/i18n/locales/ar-TN/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "تسري التغييرات فورًا في كل مكان تُطبّق فيه هذه السياسة.",
   "settings.ipPolicyEmptyCreate": "إنشاء سياسة IP",
-  "settings.ipPolicyEmptyDescription": "حدّد عناوين IP والنطاقات المسموح بها،\nثم طبّق السياسة على تطبيقاتك.",
-  "settings.ipPolicyEmptyTitle": "لا توجد سياسات IP بعد",
+  "settings.ipPolicyEmptyDescription": "السياسة هي قائمة عناوين IP المسموح لها بالوصول.",
+  "settings.ipPolicyEmptyTitle": "لا توجد سياسات IP في مساحة العمل هذه بعد",
   "settings.ipPolicyEnforcingMany": "{{count}} تطبيقات",
   "settings.ipPolicyEnforcingNone": "0 تطبيقات",
   "settings.ipPolicyEnforcingOne": "تطبيق واحد",
diff --git a/web/i18n/locales/ar-TN/deployments.json b/web/i18n/locales/ar-TN/deployments.json
index 1d9a1ab2a72373..e3363c1c3b3589 100644
--- a/web/i18n/locales/ar-TN/deployments.json
+++ b/web/i18n/locales/ar-TN/deployments.json
@@ -45,7 +45,7 @@
   "studio.accessControl.chipOn": "مفعّل",
   "studio.accessControl.chipPartial": "{{n}} من {{m}}",
   "studio.accessControl.chipPaused": "متوقف مؤقتًا",
-  "studio.accessControl.createIpPolicy": "إضافة سياسة IP",
+  "studio.accessControl.createIpPolicy": "إنشاء سياسة IP",
   "studio.accessControl.description": "تحكّم في الوصول إلى هذا التطبيق بتطبيق سياسة IP.",
   "studio.accessControl.downgradeDescription": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
   "studio.accessControl.downgradeTitle": "لم يعد هذا التطبيق محميًا",
@@ -55,7 +55,7 @@
   "studio.accessControl.ipPolicy": "سياسة IP",
   "studio.accessControl.lockoutWarning": "عنوان IP الخاص بك ({{ip}}) غير مشمول بهذه السياسة. قد تفقد إمكانية الوصول.",
   "studio.accessControl.manageIpPolicies": "إدارة سياسات IP",
-  "studio.accessControl.notEnabled": "غير مفعّل",
+  "studio.accessControl.notEnabled": "غير محمي",
   "studio.accessControl.paywallDescription": "اسمح بالوصول إلى هذا التطبيق من عناوين IP التي تثق بها فقط.",
   "studio.accessControl.paywallTitle": "التحكّم في الوصول",
   "studio.accessControl.policyChanged": "تغيّرت هذه السياسة. راجع التحذير قبل الحفظ مجددًا.",
@@ -77,9 +77,10 @@
   "studio.accessControl.selectAccessPoint": "يرجى اختيار نقطة وصول واحدة على الأقل.",
   "studio.accessControl.selectPolicy": "اختر سياسة IP",
   "studio.accessControl.selectPolicyRequired": "يرجى اختيار سياسة IP.",
+  "studio.accessControl.tooltipAllProtected": "جميع نقاط الوصول البالغ عددها {{total}} محمية",
   "studio.accessControl.tooltipDowngraded": "لم يعد محميًا — متاح في خطتي Professional وTeam",
   "studio.accessControl.tooltipOff": "لم يتم الإعداد",
-  "studio.accessControl.tooltipPaused": "متوقف مؤقتًا — تم إعداد {{name}} ولكنها غير مطبّقة",
+  "studio.accessControl.tooltipPaused": "مُهيّأ لكن متوقف مؤقتًا",
   "studio.accessControl.tooltipPro": "التحكّم في الوصول متاح ضمن خطتَي Professional وTeam.",
   "studio.accessControl.tooltipProtected": "{{n}} من أصل {{total}} من نقاط الوصول محمية",
   "studio.accessControl.turnOffConfirm": "إيقاف",
diff --git a/web/i18n/locales/az-AZ/common.json b/web/i18n/locales/az-AZ/common.json
index 35acaa4580d90a..f2c80849b801ae 100644
--- a/web/i18n/locales/az-AZ/common.json
+++ b/web/i18n/locales/az-AZ/common.json
@@ -257,8 +257,8 @@
   "resize.size": "{{width}} piksel enində, {{height}} piksel hündürlüyündə",
   "resize.width": "En: {{width}} piksel",
   "settings.ipPolicyEmptyCreate": "IP siyasəti yarat",
-  "settings.ipPolicyEmptyDescription": "İcazə verilən IP ünvanlarını və diapazonlarını müəyyən edin,\nsonra siyasəti tətbiqlərinizə tətbiq edin.",
-  "settings.ipPolicyEmptyTitle": "Hələ IP siyasəti yoxdur",
+  "settings.ipPolicyEmptyDescription": "Siyasət girişə icazə verilən IP ünvanlarının siyahısıdır.",
+  "settings.ipPolicyEmptyTitle": "Bu iş məkanında hələ IP siyasəti yoxdur",
   "sort.cancelled": "{{item}} elementinin sıralanması ləğv edildi.",
   "sort.finished": "{{item}} elementi {{count}} mövqe arasında {{position}} nömrəli mövqeyə yerləşdirildi.",
   "sort.handle": "{{item}} elementinin sırasını dəyiş",
diff --git a/web/i18n/locales/az-AZ/deployments.json b/web/i18n/locales/az-AZ/deployments.json
index 0052ce265d4a4f..ffbc1bf2c7e1ac 100644
--- a/web/i18n/locales/az-AZ/deployments.json
+++ b/web/i18n/locales/az-AZ/deployments.json
@@ -34,6 +34,11 @@
   "status.RUNTIME_INSTANCE_STATUS_UNSPECIFIED": "Naməlum",
   "studio.accessControl.addressCount_one": "{{count}} ünvan",
   "studio.accessControl.addressCount_other": "{{count}} ünvan",
+  "studio.accessControl.createIpPolicy": "IP siyasəti yarat",
+  "studio.accessControl.notEnabled": "Qorunmur",
+  "studio.accessControl.selectAccessPoint": "Ən azı bir giriş nöqtəsi seçin.",
+  "studio.accessControl.tooltipAllProtected": "Bütün {{total}} giriş nöqtəsi qorunur",
+  "studio.accessControl.tooltipPaused": "Konfiqurasiya edilib, lakin müvəqqəti dayandırılıb",
   "studio.accessPoint.apiDescription": "Tətbiqi HTTP vasitəsilə xidmətlərinizə inteqrasiya edin",
   "studio.accessPoint.description": "Bu tətbiqə çıxışın bütün yolları. Giriş nöqtələri yalnız işləyən versiyaya uyğundur.",
   "studio.accessPoint.embedIntoSite": "Sayta yerləşdir",
diff --git a/web/i18n/locales/de-DE/common.json b/web/i18n/locales/de-DE/common.json
index 31a57258496136..ba9bb72d4a8c55 100644
--- a/web/i18n/locales/de-DE/common.json
+++ b/web/i18n/locales/de-DE/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Änderungen werden überall dort sofort wirksam, wo diese Richtlinie angewendet wird.",
   "settings.ipPolicyEmptyCreate": "IP-Richtlinie erstellen",
-  "settings.ipPolicyEmptyDescription": "Lege erlaubte IP-Adressen und IP-Bereiche fest\nund wende die Richtlinie auf deine Apps an.",
-  "settings.ipPolicyEmptyTitle": "Noch keine IP-Richtlinien",
+  "settings.ipPolicyEmptyDescription": "Eine Richtlinie ist die Liste der IP-Adressen, denen der Zugriff erlaubt ist.",
+  "settings.ipPolicyEmptyTitle": "In diesem Arbeitsbereich gibt es noch keine IP-Richtlinien",
   "settings.ipPolicyEnforcingMany": "{{count}} Apps",
   "settings.ipPolicyEnforcingNone": "0 Apps",
   "settings.ipPolicyEnforcingOne": "1 App",
diff --git a/web/i18n/locales/de-DE/deployments.json b/web/i18n/locales/de-DE/deployments.json
index 211fe6310b3857..8c0f3e2cc20da2 100644
--- a/web/i18n/locales/de-DE/deployments.json
+++ b/web/i18n/locales/de-DE/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "Ein",
   "studio.accessControl.chipPartial": "{{n}} von {{m}}",
   "studio.accessControl.chipPaused": "Pausiert",
-  "studio.accessControl.createIpPolicy": "IP-Richtlinie hinzufügen",
+  "studio.accessControl.createIpPolicy": "IP-Richtlinie erstellen",
   "studio.accessControl.description": "Steuern Sie den Zugriff auf diese App durch Anwenden einer IP-Richtlinie.",
   "studio.accessControl.downgradeDescription": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
   "studio.accessControl.downgradeTitle": "Diese App ist nicht mehr geschützt",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP-Richtlinie",
   "studio.accessControl.lockoutWarning": "Ihre IP-Adresse ({{ip}}) ist nicht in dieser Richtlinie enthalten. Sie könnten den Zugriff verlieren.",
   "studio.accessControl.manageIpPolicies": "IP-Richtlinien verwalten",
-  "studio.accessControl.notEnabled": "Nicht aktiviert",
+  "studio.accessControl.notEnabled": "Nicht geschützt",
   "studio.accessControl.paywallDescription": "Beschränken Sie den Zugriff auf diese App auf vertrauenswürdige IP-Adressen.",
   "studio.accessControl.paywallTitle": "Zugriffskontrolle",
   "studio.accessControl.policyChanged": "Diese Richtlinie wurde geändert. Prüfen Sie die Warnung, bevor Sie erneut speichern.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "Bitte wählen Sie mindestens einen Zugangspunkt aus.",
   "studio.accessControl.selectPolicy": "IP-Richtlinie auswählen",
   "studio.accessControl.selectPolicyRequired": "Bitte wählen Sie eine IP-Richtlinie aus.",
+  "studio.accessControl.tooltipAllProtected": "Alle {{total}} Zugriffspunkte sind geschützt",
   "studio.accessControl.tooltipDowngraded": "Nicht mehr geschützt — verfügbar in den Tarifen Professional und Team",
   "studio.accessControl.tooltipOff": "Nicht eingerichtet",
-  "studio.accessControl.tooltipPaused": "Pausiert — {{name}} ist konfiguriert, wird aber nicht angewendet",
+  "studio.accessControl.tooltipPaused": "Konfiguriert, aber pausiert",
   "studio.accessControl.tooltipPro": "Die Zugriffskontrolle ist in den Tarifen Professional und Team verfügbar.",
   "studio.accessControl.tooltipProtected": "{{n}} von {{total}} Zugriffspunkten sind geschützt",
   "studio.accessControl.turnOffConfirm": "Deaktivieren",
diff --git a/web/i18n/locales/en-US/common.json b/web/i18n/locales/en-US/common.json
index 5771ed6a2e2d4f..281bec043f3348 100644
--- a/web/i18n/locales/en-US/common.json
+++ b/web/i18n/locales/en-US/common.json
@@ -276,9 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Changes take effect immediately wherever this policy is applied.",
-  "settings.ipPolicyEmptyCreate": "Create IP Policy",
-  "settings.ipPolicyEmptyDescription": "Define allowed IP addresses and ranges,\nthen apply the policy to your apps.",
-  "settings.ipPolicyEmptyTitle": "No IP policies yet",
+  "settings.ipPolicyEmptyCreate": "Create an IP policy",
+  "settings.ipPolicyEmptyDescription": "A policy is the list of IP addresses allowed in.",
+  "settings.ipPolicyEmptyTitle": "No IP policies in this workspace yet",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index 8cd8c0b12956f4..bc2dc39f427763 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "ON",
   "studio.accessControl.chipPartial": "{{n}} of {{m}}",
   "studio.accessControl.chipPaused": "Pause",
-  "studio.accessControl.createIpPolicy": "Add an IP policy",
+  "studio.accessControl.createIpPolicy": "Create an IP policy",
   "studio.accessControl.description": "Control access to this app by applying an IP policy.",
   "studio.accessControl.downgradeDescription": "Access control is available on Professional and Team plans.",
   "studio.accessControl.downgradeTitle": "This app is no longer protected",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP Policy",
   "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
   "studio.accessControl.manageIpPolicies": "Manage IP policies",
-  "studio.accessControl.notEnabled": "Not enabled",
+  "studio.accessControl.notEnabled": "Not protected",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
   "studio.accessControl.policyChanged": "This policy changed. Review the warning before saving again.",
@@ -70,12 +70,13 @@
   "studio.accessControl.restrictedTo": "Restricted to {{name}}",
   "studio.accessControl.saveAnyway": "Save anyway",
   "studio.accessControl.saveWithoutOwnIp": "Save without your own IP?",
-  "studio.accessControl.selectAccessPoint": "Please choose at least one access point.",
+  "studio.accessControl.selectAccessPoint": "Please select at least one access point.",
   "studio.accessControl.selectPolicy": "Select an IP policy",
   "studio.accessControl.selectPolicyRequired": "Please select an IP policy.",
+  "studio.accessControl.tooltipAllProtected": "All {{total}} access points are protected",
   "studio.accessControl.tooltipDowngraded": "No longer protected — available on Professional and Team plans",
   "studio.accessControl.tooltipOff": "Not set up",
-  "studio.accessControl.tooltipPaused": "Paused — {{name}} is configured but not enforcing",
+  "studio.accessControl.tooltipPaused": "Configured but paused",
   "studio.accessControl.tooltipPro": "Access control is available on Professional and Team plans.",
   "studio.accessControl.tooltipProtected": "{{n}} of {{total}} access points are protected",
   "studio.accessControl.turnOffConfirm": "Turn off",
diff --git a/web/i18n/locales/es-ES/common.json b/web/i18n/locales/es-ES/common.json
index 020470000e7a58..413efb12d15c10 100644
--- a/web/i18n/locales/es-ES/common.json
+++ b/web/i18n/locales/es-ES/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Los cambios se aplican de inmediato donde se utilice esta política.",
   "settings.ipPolicyEmptyCreate": "Crear política de IP",
-  "settings.ipPolicyEmptyDescription": "Define las direcciones y los rangos de IP permitidos\ny aplica la política a tus aplicaciones.",
-  "settings.ipPolicyEmptyTitle": "Aún no hay políticas de IP",
+  "settings.ipPolicyEmptyDescription": "Una política es la lista de direcciones IP que tienen permitido el acceso.",
+  "settings.ipPolicyEmptyTitle": "Aún no hay políticas de IP en este espacio de trabajo",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/es-ES/deployments.json b/web/i18n/locales/es-ES/deployments.json
index aa2f8bef240e6d..92640a80dc6a2e 100644
--- a/web/i18n/locales/es-ES/deployments.json
+++ b/web/i18n/locales/es-ES/deployments.json
@@ -42,7 +42,7 @@
   "studio.accessControl.chipOn": "Activado",
   "studio.accessControl.chipPartial": "{{n}} de {{m}}",
   "studio.accessControl.chipPaused": "En pausa",
-  "studio.accessControl.createIpPolicy": "Añadir política de IP",
+  "studio.accessControl.createIpPolicy": "Crear política de IP",
   "studio.accessControl.description": "Controla el acceso a esta aplicación aplicando una política de IP.",
   "studio.accessControl.downgradeDescription": "El control de acceso está disponible en los planes Professional y Team.",
   "studio.accessControl.downgradeTitle": "Esta aplicación ya no está protegida",
@@ -52,7 +52,7 @@
   "studio.accessControl.ipPolicy": "Política de IP",
   "studio.accessControl.lockoutWarning": "Tu IP ({{ip}}) no está incluida en esta política. Podrías perder el acceso.",
   "studio.accessControl.manageIpPolicies": "Gestionar políticas de IP",
-  "studio.accessControl.notEnabled": "No habilitado",
+  "studio.accessControl.notEnabled": "Sin protección",
   "studio.accessControl.paywallDescription": "Restringe el acceso a esta aplicación a direcciones IP de confianza.",
   "studio.accessControl.paywallTitle": "Control de acceso",
   "studio.accessControl.policyChanged": "Esta política ha cambiado. Revisa la advertencia antes de volver a guardar.",
@@ -74,9 +74,10 @@
   "studio.accessControl.selectAccessPoint": "Elige al menos un punto de acceso.",
   "studio.accessControl.selectPolicy": "Selecciona una política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecciona una política de IP.",
+  "studio.accessControl.tooltipAllProtected": "Los {{total}} puntos de acceso están protegidos",
   "studio.accessControl.tooltipDowngraded": "Ya no está protegida — disponible en los planes Professional y Team",
   "studio.accessControl.tooltipOff": "Sin configurar",
-  "studio.accessControl.tooltipPaused": "En pausa — {{name}} está configurada, pero no se aplica",
+  "studio.accessControl.tooltipPaused": "Configurado, pero en pausa",
   "studio.accessControl.tooltipPro": "El control de acceso está disponible en los planes Professional y Team.",
   "studio.accessControl.tooltipProtected": "{{n}} de {{total}} puntos de acceso están protegidos",
   "studio.accessControl.turnOffConfirm": "Desactivar",
diff --git a/web/i18n/locales/fa-IR/common.json b/web/i18n/locales/fa-IR/common.json
index c2c60474a887c0..fa1d31a52ad106 100644
--- a/web/i18n/locales/fa-IR/common.json
+++ b/web/i18n/locales/fa-IR/common.json
@@ -276,9 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "تغییرات بلافاصله در هر جایی که این خط‌مشی اعمال شده است، اجرا می‌شوند.",
-  "settings.ipPolicyEmptyCreate": "ایجاد سیاست IP",
-  "settings.ipPolicyEmptyDescription": "نشانی‌ها و محدوده‌های IP مجاز را مشخص کنید،\nسپس سیاست را روی برنامه‌های خود اعمال کنید.",
-  "settings.ipPolicyEmptyTitle": "هنوز سیاست IP ایجاد نشده است",
+  "settings.ipPolicyEmptyCreate": "ایجاد خط‌مشی IP",
+  "settings.ipPolicyEmptyDescription": "خط‌مشی، فهرست نشانی‌های IP مجاز برای دسترسی است.",
+  "settings.ipPolicyEmptyTitle": "هنوز هیچ خط‌مشی IP در این فضای کاری وجود ندارد",
   "settings.ipPolicyEnforcingMany": "{{count}} برنامه",
   "settings.ipPolicyEnforcingNone": "۰ برنامه",
   "settings.ipPolicyEnforcingOne": "۱ برنامه",
diff --git a/web/i18n/locales/fa-IR/deployments.json b/web/i18n/locales/fa-IR/deployments.json
index 6687f1e8c855e7..2b2f879c96d1c5 100644
--- a/web/i18n/locales/fa-IR/deployments.json
+++ b/web/i18n/locales/fa-IR/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "روشن",
   "studio.accessControl.chipPartial": "{{n}} از {{m}}",
   "studio.accessControl.chipPaused": "توقف موقت",
-  "studio.accessControl.createIpPolicy": "افزودن خط‌مشی IP",
+  "studio.accessControl.createIpPolicy": "ایجاد خط‌مشی IP",
   "studio.accessControl.description": "با اعمال یک خط‌مشی IP، دسترسی به این برنامه را کنترل کنید.",
   "studio.accessControl.downgradeDescription": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
   "studio.accessControl.downgradeTitle": "این برنامه دیگر محافظت نمی‌شود",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "خط‌مشی IP",
   "studio.accessControl.lockoutWarning": "نشانی IP شما ({{ip}}) در این خط‌مشی نیست. ممکن است دسترسی خود را از دست بدهید.",
   "studio.accessControl.manageIpPolicies": "مدیریت خط‌مشی‌های IP",
-  "studio.accessControl.notEnabled": "فعال نشده",
+  "studio.accessControl.notEnabled": "محافظت نمی‌شود",
   "studio.accessControl.paywallDescription": "دسترسی به این برنامه را به نشانی‌های IP مورد اعتماد خود محدود کنید.",
   "studio.accessControl.paywallTitle": "کنترل دسترسی",
   "studio.accessControl.policyChanged": "این خط‌مشی تغییر کرده است. پیش از ذخیره مجدد، هشدار را بررسی کنید.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "لطفاً دست‌کم یک نقطه دسترسی انتخاب کنید.",
   "studio.accessControl.selectPolicy": "یک خط‌مشی IP انتخاب کنید",
   "studio.accessControl.selectPolicyRequired": "لطفاً یک خط‌مشی IP انتخاب کنید.",
+  "studio.accessControl.tooltipAllProtected": "همهٔ {{total}} نقطهٔ دسترسی محافظت می‌شوند",
   "studio.accessControl.tooltipDowngraded": "دیگر محافظت نمی‌شود — در طرح‌های Professional و Team در دسترس است",
   "studio.accessControl.tooltipOff": "تنظیم نشده",
-  "studio.accessControl.tooltipPaused": "متوقف شده — {{name}} پیکربندی شده اما اعمال نمی‌شود",
+  "studio.accessControl.tooltipPaused": "پیکربندی شده، اما موقتاً متوقف است",
   "studio.accessControl.tooltipPro": "کنترل دسترسی در طرح‌های Professional و Team در دسترس است.",
   "studio.accessControl.tooltipProtected": "{{n}} نقطه از {{total}} نقطهٔ دسترسی محافظت می‌شوند",
   "studio.accessControl.turnOffConfirm": "خاموش کردن",
diff --git a/web/i18n/locales/fr-FR/common.json b/web/i18n/locales/fr-FR/common.json
index 100eea43badf40..1ee46f3ca9476d 100644
--- a/web/i18n/locales/fr-FR/common.json
+++ b/web/i18n/locales/fr-FR/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Les modifications prennent effet immédiatement partout où cette politique est appliquée.",
   "settings.ipPolicyEmptyCreate": "Créer une politique IP",
-  "settings.ipPolicyEmptyDescription": "Définissez les adresses et plages IP autorisées,\npuis appliquez la politique à vos applications.",
-  "settings.ipPolicyEmptyTitle": "Aucune politique IP pour le moment",
+  "settings.ipPolicyEmptyDescription": "Une politique définit la liste des adresses IP autorisées.",
+  "settings.ipPolicyEmptyTitle": "Cet espace de travail ne contient pas encore de politiques IP",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/fr-FR/deployments.json b/web/i18n/locales/fr-FR/deployments.json
index 5ffdb58bc61644..a2bb01cd99d214 100644
--- a/web/i18n/locales/fr-FR/deployments.json
+++ b/web/i18n/locales/fr-FR/deployments.json
@@ -42,7 +42,7 @@
   "studio.accessControl.chipOn": "Activé",
   "studio.accessControl.chipPartial": "{{n}} sur {{m}}",
   "studio.accessControl.chipPaused": "En pause",
-  "studio.accessControl.createIpPolicy": "Ajouter une politique IP",
+  "studio.accessControl.createIpPolicy": "Créer une politique IP",
   "studio.accessControl.description": "Contrôlez l’accès à cette application en appliquant une politique IP.",
   "studio.accessControl.downgradeDescription": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
   "studio.accessControl.downgradeTitle": "Cette application n’est plus protégée",
@@ -52,7 +52,7 @@
   "studio.accessControl.ipPolicy": "Politique IP",
   "studio.accessControl.lockoutWarning": "Votre IP ({{ip}}) n’est pas incluse dans cette politique. Vous risquez de perdre l’accès.",
   "studio.accessControl.manageIpPolicies": "Gérer les politiques IP",
-  "studio.accessControl.notEnabled": "Non activé",
+  "studio.accessControl.notEnabled": "Non protégé",
   "studio.accessControl.paywallDescription": "Limitez l’accès à cette application aux adresses IP de confiance.",
   "studio.accessControl.paywallTitle": "Contrôle d’accès",
   "studio.accessControl.policyChanged": "Cette politique a changé. Vérifiez l’avertissement avant d’enregistrer à nouveau.",
@@ -74,9 +74,10 @@
   "studio.accessControl.selectAccessPoint": "Veuillez choisir au moins un point d’accès.",
   "studio.accessControl.selectPolicy": "Sélectionnez une politique IP",
   "studio.accessControl.selectPolicyRequired": "Veuillez sélectionner une politique IP.",
+  "studio.accessControl.tooltipAllProtected": "Les {{total}} points d’accès sont tous protégés",
   "studio.accessControl.tooltipDowngraded": "N’est plus protégée — disponible avec les forfaits Professional et Team",
   "studio.accessControl.tooltipOff": "Non configuré",
-  "studio.accessControl.tooltipPaused": "En pause — {{name}} est configurée mais n’est pas appliquée",
+  "studio.accessControl.tooltipPaused": "Configuré, mais en pause",
   "studio.accessControl.tooltipPro": "Le contrôle d’accès est disponible avec les forfaits Professional et Team.",
   "studio.accessControl.tooltipProtected": "{{n}} points d’accès sur {{total}} sont protégés",
   "studio.accessControl.turnOffConfirm": "Désactiver",
diff --git a/web/i18n/locales/hi-IN/common.json b/web/i18n/locales/hi-IN/common.json
index 93c3be19c5cd1a..3abd3a4ee351ca 100644
--- a/web/i18n/locales/hi-IN/common.json
+++ b/web/i18n/locales/hi-IN/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "यह नीति जहाँ भी लागू है, वहाँ बदलाव तुरंत प्रभावी होंगे।",
   "settings.ipPolicyEmptyCreate": "IP नीति बनाएँ",
-  "settings.ipPolicyEmptyDescription": "अनुमत IP पते और रेंज तय करें,\nफिर नीति को अपने ऐप्स पर लागू करें।",
-  "settings.ipPolicyEmptyTitle": "अभी कोई IP नीति नहीं है",
+  "settings.ipPolicyEmptyDescription": "नीति उन IP पतों की सूची है जिन्हें पहुँच की अनुमति है।",
+  "settings.ipPolicyEmptyTitle": "इस कार्यक्षेत्र में अभी कोई IP नीति नहीं है",
   "settings.ipPolicyEnforcingMany": "{{count}} ऐप",
   "settings.ipPolicyEnforcingNone": "0 ऐप",
   "settings.ipPolicyEnforcingOne": "1 ऐप",
diff --git a/web/i18n/locales/hi-IN/deployments.json b/web/i18n/locales/hi-IN/deployments.json
index 6724cb8b2a3b2e..a1eed234868eed 100644
--- a/web/i18n/locales/hi-IN/deployments.json
+++ b/web/i18n/locales/hi-IN/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "चालू",
   "studio.accessControl.chipPartial": "{{m}} में से {{n}}",
   "studio.accessControl.chipPaused": "रुका हुआ",
-  "studio.accessControl.createIpPolicy": "IP नीति जोड़ें",
+  "studio.accessControl.createIpPolicy": "IP नीति बनाएँ",
   "studio.accessControl.description": "IP नीति लागू करके इस ऐप तक पहुँच नियंत्रित करें।",
   "studio.accessControl.downgradeDescription": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
   "studio.accessControl.downgradeTitle": "यह ऐप अब सुरक्षित नहीं है",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP नीति",
   "studio.accessControl.lockoutWarning": "आपका IP ({{ip}}) इस नीति में शामिल नहीं है। आप पहुँच खो सकते हैं।",
   "studio.accessControl.manageIpPolicies": "IP नीतियाँ प्रबंधित करें",
-  "studio.accessControl.notEnabled": "सक्षम नहीं है",
+  "studio.accessControl.notEnabled": "सुरक्षित नहीं है",
   "studio.accessControl.paywallDescription": "इस ऐप की पहुँच को केवल भरोसेमंद IP पतों तक सीमित करें।",
   "studio.accessControl.paywallTitle": "पहुँच नियंत्रण",
   "studio.accessControl.policyChanged": "यह नीति बदल गई है। दोबारा सहेजने से पहले चेतावनी की समीक्षा करें।",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "कृपया कम से कम एक पहुँच बिंदु चुनें।",
   "studio.accessControl.selectPolicy": "एक IP नीति चुनें",
   "studio.accessControl.selectPolicyRequired": "कृपया एक IP नीति चुनें।",
+  "studio.accessControl.tooltipAllProtected": "सभी {{total}} पहुँच बिंदु सुरक्षित हैं",
   "studio.accessControl.tooltipDowngraded": "अब सुरक्षित नहीं है — Professional और Team प्लान में उपलब्ध",
   "studio.accessControl.tooltipOff": "सेट अप नहीं किया गया",
-  "studio.accessControl.tooltipPaused": "रुका हुआ — {{name}} कॉन्फ़िगर की गई है, लेकिन लागू नहीं है",
+  "studio.accessControl.tooltipPaused": "कॉन्फ़िगर किया गया है, लेकिन रुका हुआ है",
   "studio.accessControl.tooltipPro": "ऐक्सेस कंट्रोल Professional और Team प्लान में उपलब्ध है।",
   "studio.accessControl.tooltipProtected": "{{total}} में से {{n}} एक्सेस पॉइंट सुरक्षित हैं",
   "studio.accessControl.turnOffConfirm": "बंद करें",
diff --git a/web/i18n/locales/id-ID/common.json b/web/i18n/locales/id-ID/common.json
index 635e9714ad41b0..d195325cbd4553 100644
--- a/web/i18n/locales/id-ID/common.json
+++ b/web/i18n/locales/id-ID/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Perubahan langsung berlaku di mana pun kebijakan ini diterapkan.",
   "settings.ipPolicyEmptyCreate": "Buat kebijakan IP",
-  "settings.ipPolicyEmptyDescription": "Tentukan alamat dan rentang IP yang diizinkan,\nlalu terapkan kebijakan ke aplikasi Anda.",
-  "settings.ipPolicyEmptyTitle": "Belum ada kebijakan IP",
+  "settings.ipPolicyEmptyDescription": "Kebijakan adalah daftar alamat IP yang diizinkan mengakses.",
+  "settings.ipPolicyEmptyTitle": "Belum ada kebijakan IP di ruang kerja ini",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikasi",
   "settings.ipPolicyEnforcingNone": "0 aplikasi",
   "settings.ipPolicyEnforcingOne": "1 aplikasi",
diff --git a/web/i18n/locales/id-ID/deployments.json b/web/i18n/locales/id-ID/deployments.json
index 97f83ccc4e6324..c30b84039d6385 100644
--- a/web/i18n/locales/id-ID/deployments.json
+++ b/web/i18n/locales/id-ID/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "Aktif",
   "studio.accessControl.chipPartial": "{{n}} dari {{m}}",
   "studio.accessControl.chipPaused": "Dijeda",
-  "studio.accessControl.createIpPolicy": "Tambah kebijakan IP",
+  "studio.accessControl.createIpPolicy": "Buat kebijakan IP",
   "studio.accessControl.description": "Kontrol akses ke aplikasi ini dengan menerapkan kebijakan IP.",
   "studio.accessControl.downgradeDescription": "Kontrol akses tersedia pada paket Professional dan Team.",
   "studio.accessControl.downgradeTitle": "Aplikasi ini tidak lagi dilindungi",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "Kebijakan IP",
   "studio.accessControl.lockoutWarning": "IP Anda ({{ip}}) tidak tercakup dalam kebijakan ini. Anda mungkin kehilangan akses.",
   "studio.accessControl.manageIpPolicies": "Kelola kebijakan IP",
-  "studio.accessControl.notEnabled": "Belum diaktifkan",
+  "studio.accessControl.notEnabled": "Tidak dilindungi",
   "studio.accessControl.paywallDescription": "Batasi akses ke aplikasi ini hanya untuk alamat IP yang Anda percayai.",
   "studio.accessControl.paywallTitle": "Kontrol akses",
   "studio.accessControl.policyChanged": "Kebijakan ini telah berubah. Tinjau peringatan sebelum menyimpan lagi.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "Pilih setidaknya satu titik akses.",
   "studio.accessControl.selectPolicy": "Pilih kebijakan IP",
   "studio.accessControl.selectPolicyRequired": "Pilih kebijakan IP.",
+  "studio.accessControl.tooltipAllProtected": "Semua {{total}} titik akses dilindungi",
   "studio.accessControl.tooltipDowngraded": "Tidak lagi dilindungi — tersedia pada paket Professional dan Team",
   "studio.accessControl.tooltipOff": "Belum dikonfigurasi",
-  "studio.accessControl.tooltipPaused": "Dijeda — {{name}} sudah dikonfigurasi tetapi tidak diterapkan",
+  "studio.accessControl.tooltipPaused": "Dikonfigurasi, tetapi dijeda",
   "studio.accessControl.tooltipPro": "Kontrol akses tersedia pada paket Professional dan Team.",
   "studio.accessControl.tooltipProtected": "{{n}} dari {{total}} titik akses dilindungi",
   "studio.accessControl.turnOffConfirm": "Nonaktifkan",
diff --git a/web/i18n/locales/it-IT/common.json b/web/i18n/locales/it-IT/common.json
index b06a7130d59345..12918ed13d107d 100644
--- a/web/i18n/locales/it-IT/common.json
+++ b/web/i18n/locales/it-IT/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Le modifiche hanno effetto immediato ovunque sia applicata questa policy.",
   "settings.ipPolicyEmptyCreate": "Crea policy IP",
-  "settings.ipPolicyEmptyDescription": "Definisci gli indirizzi e gli intervalli IP consentiti,\nquindi applica la policy alle tue app.",
-  "settings.ipPolicyEmptyTitle": "Nessuna policy IP presente",
+  "settings.ipPolicyEmptyDescription": "Una policy è l'elenco degli indirizzi IP autorizzati ad accedere.",
+  "settings.ipPolicyEmptyTitle": "Non ci sono ancora policy IP in questo spazio di lavoro",
   "settings.ipPolicyEnforcingMany": "{{count}} app",
   "settings.ipPolicyEnforcingNone": "0 app",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/it-IT/deployments.json b/web/i18n/locales/it-IT/deployments.json
index aefb424781fed0..6448ad10a8060e 100644
--- a/web/i18n/locales/it-IT/deployments.json
+++ b/web/i18n/locales/it-IT/deployments.json
@@ -42,7 +42,7 @@
   "studio.accessControl.chipOn": "Attivato",
   "studio.accessControl.chipPartial": "{{n}} di {{m}}",
   "studio.accessControl.chipPaused": "In pausa",
-  "studio.accessControl.createIpPolicy": "Aggiungi policy IP",
+  "studio.accessControl.createIpPolicy": "Crea policy IP",
   "studio.accessControl.description": "Controlla l’accesso a questa app applicando una policy IP.",
   "studio.accessControl.downgradeDescription": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
   "studio.accessControl.downgradeTitle": "Questa app non è più protetta",
@@ -52,7 +52,7 @@
   "studio.accessControl.ipPolicy": "Policy IP",
   "studio.accessControl.lockoutWarning": "Il tuo IP ({{ip}}) non è incluso in questa policy. Potresti perdere l’accesso.",
   "studio.accessControl.manageIpPolicies": "Gestisci le policy IP",
-  "studio.accessControl.notEnabled": "Non abilitato",
+  "studio.accessControl.notEnabled": "Non protetto",
   "studio.accessControl.paywallDescription": "Limita l’accesso a questa app agli indirizzi IP di cui ti fidi.",
   "studio.accessControl.paywallTitle": "Controllo degli accessi",
   "studio.accessControl.policyChanged": "Questa policy è cambiata. Controlla l’avviso prima di salvare di nuovo.",
@@ -74,9 +74,10 @@
   "studio.accessControl.selectAccessPoint": "Scegli almeno un punto di accesso.",
   "studio.accessControl.selectPolicy": "Seleziona una policy IP",
   "studio.accessControl.selectPolicyRequired": "Seleziona una policy IP.",
+  "studio.accessControl.tooltipAllProtected": "Tutti i {{total}} punti di accesso sono protetti",
   "studio.accessControl.tooltipDowngraded": "Non più protetta — disponibile nei piani Professional e Team",
   "studio.accessControl.tooltipOff": "Non configurato",
-  "studio.accessControl.tooltipPaused": "In pausa — {{name}} è configurata ma non viene applicata",
+  "studio.accessControl.tooltipPaused": "Configurato, ma in pausa",
   "studio.accessControl.tooltipPro": "Il controllo degli accessi è disponibile nei piani Professional e Team.",
   "studio.accessControl.tooltipProtected": "{{n}} punti di accesso su {{total}} sono protetti",
   "studio.accessControl.turnOffConfirm": "Disattiva",
diff --git a/web/i18n/locales/ja-JP/common.json b/web/i18n/locales/ja-JP/common.json
index e5aa7199f62306..6fb7e3e6d4251c 100644
--- a/web/i18n/locales/ja-JP/common.json
+++ b/web/i18n/locales/ja-JP/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "IP ポリシーを編集",
   "settings.ipPolicyEditUsedBy": "変更は、このポリシーが適用されているすべての箇所に即時反映されます。",
   "settings.ipPolicyEmptyCreate": "IP ポリシーを作成",
-  "settings.ipPolicyEmptyDescription": "許可する IP アドレスと範囲を定義し、\nポリシーをアプリに適用します。",
-  "settings.ipPolicyEmptyTitle": "IP ポリシーはまだありません",
+  "settings.ipPolicyEmptyDescription": "ポリシーは、アクセスを許可する IP アドレスの一覧です。",
+  "settings.ipPolicyEmptyTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "settings.ipPolicyEnforcingMany": "{{count}} 個のアプリ",
   "settings.ipPolicyEnforcingNone": "0 個のアプリ",
   "settings.ipPolicyEnforcingOne": "1 個のアプリ",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index 71c5751d4e9623..10748d8a9d7d66 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "オン",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "一時停止",
-  "studio.accessControl.createIpPolicy": "IP ポリシーを追加",
+  "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
   "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP ポリシー",
   "studio.accessControl.lockoutWarning": "あなたの IP（{{ip}}）はこのポリシーに含まれていません。アクセスできなくなる可能性があります。",
   "studio.accessControl.manageIpPolicies": "IP ポリシーを管理",
-  "studio.accessControl.notEnabled": "未有効",
+  "studio.accessControl.notEnabled": "保護されていません",
   "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
   "studio.accessControl.paywallTitle": "アクセス制御",
   "studio.accessControl.policyChanged": "このポリシーは変更されました。警告を確認してから再度保存してください。",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "少なくとも 1 つのアクセスポイントを選択してください。",
   "studio.accessControl.selectPolicy": "IP ポリシーを選択",
   "studio.accessControl.selectPolicyRequired": "IP ポリシーを選択してください。",
+  "studio.accessControl.tooltipAllProtected": "{{total}} 個すべてのアクセスポイントが保護されています",
   "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます",
   "studio.accessControl.tooltipOff": "未設定",
-  "studio.accessControl.tooltipPaused": "一時停止 — {{name}} は設定済みですが適用されていません",
+  "studio.accessControl.tooltipPaused": "設定済みですが一時停止中です",
   "studio.accessControl.tooltipPro": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.tooltipProtected": "{{total}} 個のアクセスポイントのうち {{n}} 個が保護されています",
   "studio.accessControl.turnOffConfirm": "オフにする",
diff --git a/web/i18n/locales/ko-KR/common.json b/web/i18n/locales/ko-KR/common.json
index d7c09f9fb58d0b..0609ab2fa731fd 100644
--- a/web/i18n/locales/ko-KR/common.json
+++ b/web/i18n/locales/ko-KR/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "이 정책이 적용된 모든 곳에 변경 사항이 즉시 반영됩니다.",
   "settings.ipPolicyEmptyCreate": "IP 정책 만들기",
-  "settings.ipPolicyEmptyDescription": "허용할 IP 주소와 범위를 정의한 후\n앱에 정책을 적용하세요.",
-  "settings.ipPolicyEmptyTitle": "아직 IP 정책이 없습니다",
+  "settings.ipPolicyEmptyDescription": "정책은 접근이 허용된 IP 주소 목록입니다.",
+  "settings.ipPolicyEmptyTitle": "이 작업 공간에는 아직 IP 정책이 없습니다",
   "settings.ipPolicyEnforcingMany": "앱 {{count}}개",
   "settings.ipPolicyEnforcingNone": "앱 0개",
   "settings.ipPolicyEnforcingOne": "앱 1개",
diff --git a/web/i18n/locales/ko-KR/deployments.json b/web/i18n/locales/ko-KR/deployments.json
index a13497d4724428..b54fe50ba327ee 100644
--- a/web/i18n/locales/ko-KR/deployments.json
+++ b/web/i18n/locales/ko-KR/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "켜짐",
   "studio.accessControl.chipPartial": "{{m}}개 중 {{n}}개",
   "studio.accessControl.chipPaused": "일시 중지",
-  "studio.accessControl.createIpPolicy": "IP 정책 추가",
+  "studio.accessControl.createIpPolicy": "IP 정책 만들기",
   "studio.accessControl.description": "IP 정책을 적용하여 이 앱에 대한 접근을 제어합니다.",
   "studio.accessControl.downgradeDescription": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
   "studio.accessControl.downgradeTitle": "이 앱은 더 이상 보호되지 않습니다",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP 정책",
   "studio.accessControl.lockoutWarning": "현재 IP({{ip}})가 이 정책에 포함되어 있지 않습니다. 접근 권한을 잃을 수 있습니다.",
   "studio.accessControl.manageIpPolicies": "IP 정책 관리",
-  "studio.accessControl.notEnabled": "활성화되지 않음",
+  "studio.accessControl.notEnabled": "보호되지 않음",
   "studio.accessControl.paywallDescription": "신뢰하는 IP 주소에서만 이 앱에 접근할 수 있도록 제한합니다.",
   "studio.accessControl.paywallTitle": "접근 제어",
   "studio.accessControl.policyChanged": "이 정책이 변경되었습니다. 다시 저장하기 전에 경고를 확인하세요.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "접근 지점을 하나 이상 선택하세요.",
   "studio.accessControl.selectPolicy": "IP 정책 선택",
   "studio.accessControl.selectPolicyRequired": "IP 정책을 선택하세요.",
+  "studio.accessControl.tooltipAllProtected": "접근 지점 {{total}}개가 모두 보호되고 있습니다",
   "studio.accessControl.tooltipDowngraded": "더 이상 보호되지 않음 — Professional 및 Team 요금제에서 사용 가능",
   "studio.accessControl.tooltipOff": "설정되지 않음",
-  "studio.accessControl.tooltipPaused": "일시 중지됨 — {{name}} 정책이 설정되었지만 적용되지 않고 있습니다",
+  "studio.accessControl.tooltipPaused": "설정되었지만 일시 중지됨",
   "studio.accessControl.tooltipPro": "접근 제어는 Professional 및 Team 요금제에서 사용할 수 있습니다.",
   "studio.accessControl.tooltipProtected": "접근 지점 {{total}}개 중 {{n}}개가 보호되고 있습니다",
   "studio.accessControl.turnOffConfirm": "끄기",
diff --git a/web/i18n/locales/lo-LA/common.json b/web/i18n/locales/lo-LA/common.json
index cf421b0d064f61..39cf19a96e9171 100644
--- a/web/i18n/locales/lo-LA/common.json
+++ b/web/i18n/locales/lo-LA/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "ການປ່ຽນແປງຈະມີຜົນທັນທີໃນທຸກບ່ອນທີ່ນຳໃຊ້ນະໂຍບາຍນີ້.",
   "settings.ipPolicyEmptyCreate": "ສ້າງນະໂຍບາຍ IP",
-  "settings.ipPolicyEmptyDescription": "ກຳນົດທີ່ຢູ່ IP ແລະຊ່ວງ IP ທີ່ອະນຸຍາດ,\nແລ້ວນຳໃຊ້ນະໂຍບາຍກັບແອັບຂອງທ່ານ.",
-  "settings.ipPolicyEmptyTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP",
+  "settings.ipPolicyEmptyDescription": "ນະໂຍບາຍແມ່ນລາຍຊື່ທີ່ຢູ່ IP ທີ່ອະນຸຍາດໃຫ້ເຂົ້າເຖິງ.",
+  "settings.ipPolicyEmptyTitle": "ຍັງບໍ່ມີນະໂຍບາຍ IP ໃນພື້ນທີ່ເຮັດວຽກນີ້",
   "settings.ipPolicyEnforcingMany": "{{count}} ແອັບ",
   "settings.ipPolicyEnforcingNone": "0 ແອັບ",
   "settings.ipPolicyEnforcingOne": "1 ແອັບ",
diff --git a/web/i18n/locales/lo-LA/deployments.json b/web/i18n/locales/lo-LA/deployments.json
index d4874f61f49821..82a343cf61f20d 100644
--- a/web/i18n/locales/lo-LA/deployments.json
+++ b/web/i18n/locales/lo-LA/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "ເປີດ",
   "studio.accessControl.chipPartial": "{{n}} ຈາກ {{m}}",
   "studio.accessControl.chipPaused": "ຢຸດຊົ່ວຄາວ",
-  "studio.accessControl.createIpPolicy": "ເພີ່ມນະໂຍບາຍ IP",
+  "studio.accessControl.createIpPolicy": "ສ້າງນະໂຍບາຍ IP",
   "studio.accessControl.description": "ຄວບຄຸມການເຂົ້າເຖິງແອັບນີ້ໂດຍນຳໃຊ້ນະໂຍບາຍ IP.",
   "studio.accessControl.downgradeDescription": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
   "studio.accessControl.downgradeTitle": "ແອັບນີ້ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "ນະໂຍບາຍ IP",
   "studio.accessControl.lockoutWarning": "IP ຂອງທ່ານ ({{ip}}) ບໍ່ຢູ່ໃນນະໂຍບາຍນີ້. ທ່ານອາດສູນເສຍສິດເຂົ້າເຖິງ.",
   "studio.accessControl.manageIpPolicies": "ຈັດການນະໂຍບາຍ IP",
-  "studio.accessControl.notEnabled": "ຍັງບໍ່ໄດ້ເປີດໃຊ້",
+  "studio.accessControl.notEnabled": "ບໍ່ໄດ້ຮັບການປົກປ້ອງ",
   "studio.accessControl.paywallDescription": "ຈຳກັດການເຂົ້າເຖິງແອັບນີ້ໃຫ້ສະເພາະທີ່ຢູ່ IP ທີ່ທ່ານເຊື່ອຖື.",
   "studio.accessControl.paywallTitle": "ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.policyChanged": "ນະໂຍບາຍນີ້ໄດ້ປ່ຽນແປງແລ້ວ. ກວດເບິ່ງຄຳເຕືອນກ່ອນບັນທຶກອີກຄັ້ງ.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "ກະລຸນາເລືອກຈຸດເຂົ້າເຖິງຢ່າງໜ້ອຍໜຶ່ງຈຸດ.",
   "studio.accessControl.selectPolicy": "ເລືອກນະໂຍບາຍ IP",
   "studio.accessControl.selectPolicyRequired": "ກະລຸນາເລືອກນະໂຍບາຍ IP.",
+  "studio.accessControl.tooltipAllProtected": "ຈຸດເຂົ້າເຖິງທັງໝົດ {{total}} ຈຸດໄດ້ຮັບການປົກປ້ອງ",
   "studio.accessControl.tooltipDowngraded": "ບໍ່ໄດ້ຮັບການປົກປ້ອງອີກຕໍ່ໄປ — ມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team",
   "studio.accessControl.tooltipOff": "ຍັງບໍ່ໄດ້ຕັ້ງຄ່າ",
-  "studio.accessControl.tooltipPaused": "ຢຸດຊົ່ວຄາວ — {{name}} ຖືກຕັ້ງຄ່າແລ້ວ ແຕ່ຍັງບໍ່ໄດ້ນຳໃຊ້",
+  "studio.accessControl.tooltipPaused": "ຕັ້ງຄ່າແລ້ວ ແຕ່ຢຸດໄວ້ຊົ່ວຄາວ",
   "studio.accessControl.tooltipPro": "ການຄວບຄຸມການເຂົ້າເຖິງມີໃຫ້ໃຊ້ໃນແຜນ Professional ແລະ Team.",
   "studio.accessControl.tooltipProtected": "{{n}} ຈາກ {{total}} ຈຸດເຂົ້າເຖິງໄດ້ຮັບການປົກປ້ອງ",
   "studio.accessControl.turnOffConfirm": "ປິດ",
diff --git a/web/i18n/locales/nl-NL/common.json b/web/i18n/locales/nl-NL/common.json
index c58185d91d478d..6fb0882840639f 100644
--- a/web/i18n/locales/nl-NL/common.json
+++ b/web/i18n/locales/nl-NL/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Wijzigingen worden onmiddellijk van kracht overal waar dit beleid wordt toegepast.",
   "settings.ipPolicyEmptyCreate": "IP-beleid maken",
-  "settings.ipPolicyEmptyDescription": "Definieer toegestane IP-adressen en IP-bereiken\nen pas het beleid toe op je apps.",
-  "settings.ipPolicyEmptyTitle": "Nog geen IP-beleid",
+  "settings.ipPolicyEmptyDescription": "Een beleid is de lijst met IP-adressen die toegang hebben.",
+  "settings.ipPolicyEmptyTitle": "Deze werkruimte heeft nog geen IP-beleid",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/nl-NL/deployments.json b/web/i18n/locales/nl-NL/deployments.json
index 31d98fd5177951..53d06f8a01c862 100644
--- a/web/i18n/locales/nl-NL/deployments.json
+++ b/web/i18n/locales/nl-NL/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "Aan",
   "studio.accessControl.chipPartial": "{{n}} van {{m}}",
   "studio.accessControl.chipPaused": "Gepauzeerd",
-  "studio.accessControl.createIpPolicy": "IP-beleid toevoegen",
+  "studio.accessControl.createIpPolicy": "IP-beleid maken",
   "studio.accessControl.description": "Beheer de toegang tot deze app door een IP-beleid toe te passen.",
   "studio.accessControl.downgradeDescription": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
   "studio.accessControl.downgradeTitle": "Deze app is niet meer beschermd",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP-beleid",
   "studio.accessControl.lockoutWarning": "Je IP-adres ({{ip}}) staat niet in dit beleid. Je kunt de toegang verliezen.",
   "studio.accessControl.manageIpPolicies": "IP-beleid beheren",
-  "studio.accessControl.notEnabled": "Niet ingeschakeld",
+  "studio.accessControl.notEnabled": "Niet beschermd",
   "studio.accessControl.paywallDescription": "Beperk de toegang tot deze app tot IP-adressen die je vertrouwt.",
   "studio.accessControl.paywallTitle": "Toegangsbeheer",
   "studio.accessControl.policyChanged": "Dit beleid is gewijzigd. Bekijk de waarschuwing voordat je opnieuw opslaat.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "Kies ten minste één toegangspunt.",
   "studio.accessControl.selectPolicy": "Selecteer een IP-beleid",
   "studio.accessControl.selectPolicyRequired": "Selecteer een IP-beleid.",
+  "studio.accessControl.tooltipAllProtected": "Alle {{total}} toegangspunten zijn beschermd",
   "studio.accessControl.tooltipDowngraded": "Niet langer beschermd — beschikbaar in de Professional- en Team-abonnementen",
   "studio.accessControl.tooltipOff": "Niet ingesteld",
-  "studio.accessControl.tooltipPaused": "Gepauzeerd — {{name}} is ingesteld maar wordt niet toegepast",
+  "studio.accessControl.tooltipPaused": "Geconfigureerd, maar gepauzeerd",
   "studio.accessControl.tooltipPro": "Toegangsbeheer is beschikbaar in de Professional- en Team-abonnementen.",
   "studio.accessControl.tooltipProtected": "{{n}} van de {{total}} toegangspunten zijn beschermd",
   "studio.accessControl.turnOffConfirm": "Uitschakelen",
diff --git a/web/i18n/locales/pl-PL/common.json b/web/i18n/locales/pl-PL/common.json
index 732ef358825d3c..989495f30914ee 100644
--- a/web/i18n/locales/pl-PL/common.json
+++ b/web/i18n/locales/pl-PL/common.json
@@ -276,9 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Zmiany obowiązują natychmiast wszędzie tam, gdzie stosowana jest ta polityka.",
-  "settings.ipPolicyEmptyCreate": "Utwórz zasady IP",
-  "settings.ipPolicyEmptyDescription": "Określ dozwolone adresy i zakresy IP,\na następnie zastosuj zasady do swoich aplikacji.",
-  "settings.ipPolicyEmptyTitle": "Brak zasad IP",
+  "settings.ipPolicyEmptyCreate": "Utwórz politykę IP",
+  "settings.ipPolicyEmptyDescription": "Polityka to lista adresów IP, które mają prawo dostępu.",
+  "settings.ipPolicyEmptyTitle": "W tym obszarze roboczym nie ma jeszcze polityk IP",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacji",
   "settings.ipPolicyEnforcingNone": "0 aplikacji",
   "settings.ipPolicyEnforcingOne": "1 aplikacja",
diff --git a/web/i18n/locales/pl-PL/deployments.json b/web/i18n/locales/pl-PL/deployments.json
index 103c43158cc7e7..77b9f0771113f8 100644
--- a/web/i18n/locales/pl-PL/deployments.json
+++ b/web/i18n/locales/pl-PL/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipOn": "Włączone",
   "studio.accessControl.chipPartial": "{{n}} z {{m}}",
   "studio.accessControl.chipPaused": "Wstrzymane",
-  "studio.accessControl.createIpPolicy": "Dodaj politykę IP",
+  "studio.accessControl.createIpPolicy": "Utwórz politykę IP",
   "studio.accessControl.description": "Kontroluj dostęp do tej aplikacji, stosując politykę IP.",
   "studio.accessControl.downgradeDescription": "Kontrola dostępu jest dostępna w planach Professional i Team.",
   "studio.accessControl.downgradeTitle": "Ta aplikacja nie jest już chroniona",
@@ -53,7 +53,7 @@
   "studio.accessControl.ipPolicy": "Polityka IP",
   "studio.accessControl.lockoutWarning": "Twój adres IP ({{ip}}) nie jest uwzględniony w tej polityce. Możesz utracić dostęp.",
   "studio.accessControl.manageIpPolicies": "Zarządzaj politykami IP",
-  "studio.accessControl.notEnabled": "Niewłączone",
+  "studio.accessControl.notEnabled": "Brak ochrony",
   "studio.accessControl.paywallDescription": "Ogranicz dostęp do tej aplikacji do zaufanych adresów IP.",
   "studio.accessControl.paywallTitle": "Kontrola dostępu",
   "studio.accessControl.policyChanged": "Ta polityka uległa zmianie. Sprawdź ostrzeżenie przed ponownym zapisaniem.",
@@ -75,9 +75,10 @@
   "studio.accessControl.selectAccessPoint": "Wybierz co najmniej jeden punkt dostępu.",
   "studio.accessControl.selectPolicy": "Wybierz politykę IP",
   "studio.accessControl.selectPolicyRequired": "Wybierz politykę IP.",
+  "studio.accessControl.tooltipAllProtected": "Wszystkie punkty dostępu są chronione ({{total}})",
   "studio.accessControl.tooltipDowngraded": "Aplikacja nie jest już chroniona — funkcja dostępna w planach Professional i Team",
   "studio.accessControl.tooltipOff": "Nieskonfigurowane",
-  "studio.accessControl.tooltipPaused": "Wstrzymane — polityka {{name}} jest skonfigurowana, ale nie jest stosowana",
+  "studio.accessControl.tooltipPaused": "Skonfigurowano, ale wstrzymano",
   "studio.accessControl.tooltipPro": "Kontrola dostępu jest dostępna w planach Professional i Team.",
   "studio.accessControl.tooltipProtected": "Liczba chronionych punktów dostępu: {{n}} z {{total}}",
   "studio.accessControl.turnOffConfirm": "Wyłącz",
diff --git a/web/i18n/locales/pt-BR/common.json b/web/i18n/locales/pt-BR/common.json
index 3833d3591ef207..2f9ea170d77297 100644
--- a/web/i18n/locales/pt-BR/common.json
+++ b/web/i18n/locales/pt-BR/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "As alterações entram em vigor imediatamente onde esta política estiver aplicada.",
   "settings.ipPolicyEmptyCreate": "Criar política de IP",
-  "settings.ipPolicyEmptyDescription": "Defina os endereços e intervalos de IP permitidos\ne aplique a política aos seus aplicativos.",
-  "settings.ipPolicyEmptyTitle": "Ainda não há políticas de IP",
+  "settings.ipPolicyEmptyDescription": "Uma política é a lista de endereços IP com acesso permitido.",
+  "settings.ipPolicyEmptyTitle": "Ainda não há políticas de IP neste espaço de trabalho",
   "settings.ipPolicyEnforcingMany": "{{count}} apps",
   "settings.ipPolicyEnforcingNone": "0 apps",
   "settings.ipPolicyEnforcingOne": "1 app",
diff --git a/web/i18n/locales/pt-BR/deployments.json b/web/i18n/locales/pt-BR/deployments.json
index 5b9d2e6312a941..68c0efef67aa71 100644
--- a/web/i18n/locales/pt-BR/deployments.json
+++ b/web/i18n/locales/pt-BR/deployments.json
@@ -42,7 +42,7 @@
   "studio.accessControl.chipOn": "Ativado",
   "studio.accessControl.chipPartial": "{{n}} de {{m}}",
   "studio.accessControl.chipPaused": "Pausado",
-  "studio.accessControl.createIpPolicy": "Adicionar política de IP",
+  "studio.accessControl.createIpPolicy": "Criar política de IP",
   "studio.accessControl.description": "Controle o acesso a este aplicativo aplicando uma política de IP.",
   "studio.accessControl.downgradeDescription": "O controle de acesso está disponível nos planos Professional e Team.",
   "studio.accessControl.downgradeTitle": "Este aplicativo não está mais protegido",
@@ -52,7 +52,7 @@
   "studio.accessControl.ipPolicy": "Política de IP",
   "studio.accessControl.lockoutWarning": "Seu IP ({{ip}}) não está incluído nesta política. Você pode perder o acesso.",
   "studio.accessControl.manageIpPolicies": "Gerenciar políticas de IP",
-  "studio.accessControl.notEnabled": "Não habilitado",
+  "studio.accessControl.notEnabled": "Sem proteção",
   "studio.accessControl.paywallDescription": "Restrinja o acesso a este aplicativo a endereços IP confiáveis.",
   "studio.accessControl.paywallTitle": "Controle de acesso",
   "studio.accessControl.policyChanged": "Esta política mudou. Revise o aviso antes de salvar novamente.",
@@ -74,9 +74,10 @@
   "studio.accessControl.selectAccessPoint": "Escolha pelo menos um ponto de acesso.",
   "studio.accessControl.selectPolicy": "Selecione uma política de IP",
   "studio.accessControl.selectPolicyRequired": "Selecione uma política de IP.",
+  "studio.accessControl.tooltipAllProtected": "Todos os {{total}} pontos de acesso estão protegidos",
   "studio.accessControl.tooltipDowngraded": "Não está mais protegido — disponível nos planos Professional e Team",
   "studio.accessControl.tooltipOff": "Não configurado",
-  "studio.accessControl.tooltipPaused": "Pausado — {{name}} está configurada, mas não está sendo aplicada",
+  "studio.accessControl.tooltipPaused": "Configurado, mas pausado",
   "studio.accessControl.tooltipPro": "O controle de acesso está disponível nos planos Professional e Team.",
   "studio.accessControl.tooltipProtected": "{{n}} de {{total}} pontos de acesso estão protegidos",
   "studio.accessControl.turnOffConfirm": "Desativar",
diff --git a/web/i18n/locales/ro-RO/common.json b/web/i18n/locales/ro-RO/common.json
index 64648e1f1976d5..012acf1e234894 100644
--- a/web/i18n/locales/ro-RO/common.json
+++ b/web/i18n/locales/ro-RO/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Modificările se aplică imediat oriunde este utilizată această politică.",
   "settings.ipPolicyEmptyCreate": "Creează o politică IP",
-  "settings.ipPolicyEmptyDescription": "Definește adresele și intervalele IP permise,\napoi aplică politica aplicațiilor tale.",
-  "settings.ipPolicyEmptyTitle": "Nu există încă politici IP",
+  "settings.ipPolicyEmptyDescription": "O politică este lista adreselor IP cărora li se permite accesul.",
+  "settings.ipPolicyEmptyTitle": "Nu există încă politici IP în acest spațiu de lucru",
   "settings.ipPolicyEnforcingMany": "{{count}} aplicații",
   "settings.ipPolicyEnforcingNone": "0 aplicații",
   "settings.ipPolicyEnforcingOne": "1 aplicație",
diff --git a/web/i18n/locales/ro-RO/deployments.json b/web/i18n/locales/ro-RO/deployments.json
index 863cbac93522c4..687d4a734db875 100644
--- a/web/i18n/locales/ro-RO/deployments.json
+++ b/web/i18n/locales/ro-RO/deployments.json
@@ -42,7 +42,7 @@
   "studio.accessControl.chipOn": "Activat",
   "studio.accessControl.chipPartial": "{{n}} din {{m}}",
   "studio.accessControl.chipPaused": "Pauză",
-  "studio.accessControl.createIpPolicy": "Adăugați o politică IP",
+  "studio.accessControl.createIpPolicy": "Creează o politică IP",
   "studio.accessControl.description": "Controlați accesul la această aplicație aplicând o politică IP.",
   "studio.accessControl.downgradeDescription": "Controlul accesului este disponibil în planurile Professional și Team.",
   "studio.accessControl.downgradeTitle": "Această aplicație nu mai este protejată",
@@ -52,7 +52,7 @@
   "studio.accessControl.ipPolicy": "Politică IP",
   "studio.accessControl.lockoutWarning": "Adresa dvs. IP ({{ip}}) nu este inclusă în această politică. Puteți pierde accesul.",
   "studio.accessControl.manageIpPolicies": "Gestionați politicile IP",
-  "studio.accessControl.notEnabled": "Neactivat",
+  "studio.accessControl.notEnabled": "Neprotejat",
   "studio.accessControl.paywallDescription": "Limitați accesul la această aplicație la adresele IP de încredere.",
   "studio.accessControl.paywallTitle": "Controlul accesului",
   "studio.accessControl.policyChanged": "Această politică s-a modificat. Verificați avertismentul înainte de a salva din nou.",
@@ -74,9 +74,10 @@
   "studio.accessControl.selectAccessPoint": "Alegeți cel puțin un punct de acces.",
   "studio.accessControl.selectPolicy": "Selectați o politică IP",
   "studio.accessControl.selectPolicyRequired": "Selectați o politică IP.",
+  "studio.accessControl.tooltipAllProtected": "Toate cele {{total}} puncte de acces sunt protejate",
   "studio.accessControl.tooltipDowngraded": "Nu mai este protejată — disponibil în planurile Professional și Team",
   "studio.accessControl.tooltipOff": "Neconfigurat",
-  "studio.accessControl.tooltipPaused": "În pauză — {{name}} este configurată, dar nu este aplicată",
+  "studio.accessControl.tooltipPaused": "Configurat, dar pus pe pauză",
   "studio.accessControl.tooltipPro": "Controlul accesului este disponibil în planurile Professional și Team.",
   "studio.accessControl.tooltipProtected": "{{n}} din {{total}} puncte de acces sunt protejate",
   "studio.accessControl.turnOffConfirm": "Dezactivați",
diff --git a/web/i18n/locales/ru-RU/common.json b/web/i18n/locales/ru-RU/common.json
index 2964702a76d12d..eb3fd5aceef2f2 100644
--- a/web/i18n/locales/ru-RU/common.json
+++ b/web/i18n/locales/ru-RU/common.json
@@ -276,9 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Изменения вступают в силу немедленно везде, где применяется эта политика.",
-  "settings.ipPolicyEmptyCreate": "Создать политику IP",
-  "settings.ipPolicyEmptyDescription": "Укажите разрешённые IP-адреса и диапазоны,\nзатем примените политику к своим приложениям.",
-  "settings.ipPolicyEmptyTitle": "Политик IP пока нет",
+  "settings.ipPolicyEmptyCreate": "Создать IP-политику",
+  "settings.ipPolicyEmptyDescription": "Политика — это список IP-адресов, которым разрешён доступ.",
+  "settings.ipPolicyEmptyTitle": "В этом рабочем пространстве пока нет IP-политик",
   "settings.ipPolicyEnforcingMany": "{{count}} приложений",
   "settings.ipPolicyEnforcingNone": "0 приложений",
   "settings.ipPolicyEnforcingOne": "1 приложение",
diff --git a/web/i18n/locales/ru-RU/deployments.json b/web/i18n/locales/ru-RU/deployments.json
index 01088c67443fc0..6b74ca63302c01 100644
--- a/web/i18n/locales/ru-RU/deployments.json
+++ b/web/i18n/locales/ru-RU/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipOn": "Вкл.",
   "studio.accessControl.chipPartial": "{{n}} из {{m}}",
   "studio.accessControl.chipPaused": "Пауза",
-  "studio.accessControl.createIpPolicy": "Добавить IP-политику",
+  "studio.accessControl.createIpPolicy": "Создать IP-политику",
   "studio.accessControl.description": "Управляйте доступом к этому приложению с помощью IP-политики.",
   "studio.accessControl.downgradeDescription": "Управление доступом доступно в тарифах Professional и Team.",
   "studio.accessControl.downgradeTitle": "Это приложение больше не защищено",
@@ -53,7 +53,7 @@
   "studio.accessControl.ipPolicy": "IP-политика",
   "studio.accessControl.lockoutWarning": "Ваш IP-адрес ({{ip}}) не включён в эту политику. Вы можете потерять доступ.",
   "studio.accessControl.manageIpPolicies": "Управление IP-политиками",
-  "studio.accessControl.notEnabled": "Не включено",
+  "studio.accessControl.notEnabled": "Не защищено",
   "studio.accessControl.paywallDescription": "Разрешите доступ к этому приложению только с доверенных IP-адресов.",
   "studio.accessControl.paywallTitle": "Контроль доступа",
   "studio.accessControl.policyChanged": "Эта политика изменилась. Прочитайте предупреждение перед повторным сохранением.",
@@ -75,9 +75,10 @@
   "studio.accessControl.selectAccessPoint": "Выберите хотя бы одну точку доступа.",
   "studio.accessControl.selectPolicy": "Выберите IP-политику",
   "studio.accessControl.selectPolicyRequired": "Выберите IP-политику.",
+  "studio.accessControl.tooltipAllProtected": "Защищены все точки доступа: {{total}}",
   "studio.accessControl.tooltipDowngraded": "Больше не защищено — доступно на тарифах Professional и Team",
   "studio.accessControl.tooltipOff": "Не настроено",
-  "studio.accessControl.tooltipPaused": "Приостановлено — политика {{name}} настроена, но не применяется",
+  "studio.accessControl.tooltipPaused": "Настроено, но приостановлено",
   "studio.accessControl.tooltipPro": "Управление доступом доступно в тарифах Professional и Team.",
   "studio.accessControl.tooltipProtected": "Защищено точек доступа: {{n}} из {{total}}",
   "studio.accessControl.turnOffConfirm": "Выключить",
diff --git a/web/i18n/locales/sl-SI/common.json b/web/i18n/locales/sl-SI/common.json
index 4e0c35a3480b57..79ce70cd25f5ac 100644
--- a/web/i18n/locales/sl-SI/common.json
+++ b/web/i18n/locales/sl-SI/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Spremembe začnejo veljati takoj povsod, kjer se uporablja ta pravilnik.",
   "settings.ipPolicyEmptyCreate": "Ustvari pravilnik IP",
-  "settings.ipPolicyEmptyDescription": "Določite dovoljene naslove in obsege IP,\nnato pravilnik uporabite za svoje aplikacije.",
-  "settings.ipPolicyEmptyTitle": "Pravilnikov IP še ni",
+  "settings.ipPolicyEmptyDescription": "Pravilnik je seznam naslovov IP, ki jim je dovoljen dostop.",
+  "settings.ipPolicyEmptyTitle": "V tem delovnem prostoru še ni pravilnikov IP",
   "settings.ipPolicyEnforcingMany": "{{count}} aplikacij",
   "settings.ipPolicyEnforcingNone": "0 aplikacij",
   "settings.ipPolicyEnforcingOne": "1 aplikacija",
diff --git a/web/i18n/locales/sl-SI/deployments.json b/web/i18n/locales/sl-SI/deployments.json
index ae95404e8ff417..3ec18692c6a17f 100644
--- a/web/i18n/locales/sl-SI/deployments.json
+++ b/web/i18n/locales/sl-SI/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipOn": "Vklopljeno",
   "studio.accessControl.chipPartial": "{{n}} od {{m}}",
   "studio.accessControl.chipPaused": "Začasno ustavljeno",
-  "studio.accessControl.createIpPolicy": "Dodaj pravilnik IP",
+  "studio.accessControl.createIpPolicy": "Ustvari pravilnik IP",
   "studio.accessControl.description": "Nadzirajte dostop do te aplikacije z uporabo pravilnika IP.",
   "studio.accessControl.downgradeDescription": "Nadzor dostopa je na voljo v paketih Professional in Team.",
   "studio.accessControl.downgradeTitle": "Ta aplikacija ni več zaščitena",
@@ -53,7 +53,7 @@
   "studio.accessControl.ipPolicy": "Pravilnik IP",
   "studio.accessControl.lockoutWarning": "Vaš naslov IP ({{ip}}) ni vključen v ta pravilnik. Lahko izgubite dostop.",
   "studio.accessControl.manageIpPolicies": "Upravljaj pravilnike IP",
-  "studio.accessControl.notEnabled": "Ni omogočeno",
+  "studio.accessControl.notEnabled": "Ni zaščiteno",
   "studio.accessControl.paywallDescription": "Omejite dostop do te aplikacije na naslove IP, ki jim zaupate.",
   "studio.accessControl.paywallTitle": "Nadzor dostopa",
   "studio.accessControl.policyChanged": "Ta pravilnik se je spremenil. Pred ponovnim shranjevanjem preglejte opozorilo.",
@@ -75,9 +75,10 @@
   "studio.accessControl.selectAccessPoint": "Izberite vsaj eno dostopno točko.",
   "studio.accessControl.selectPolicy": "Izberite pravilnik IP",
   "studio.accessControl.selectPolicyRequired": "Izberite pravilnik IP.",
+  "studio.accessControl.tooltipAllProtected": "Zaščitene so vse dostopne točke ({{total}})",
   "studio.accessControl.tooltipDowngraded": "Ni več zaščitena — na voljo v paketih Professional in Team",
   "studio.accessControl.tooltipOff": "Ni nastavljeno",
-  "studio.accessControl.tooltipPaused": "Začasno ustavljeno — {{name}} je nastavljen, vendar se ne uveljavlja",
+  "studio.accessControl.tooltipPaused": "Nastavljeno, vendar začasno ustavljeno",
   "studio.accessControl.tooltipPro": "Nadzor dostopa je na voljo v paketih Professional in Team.",
   "studio.accessControl.tooltipProtected": "Zaščitene dostopne točke: {{n}} od {{total}}",
   "studio.accessControl.turnOffConfirm": "Izklopi",
diff --git a/web/i18n/locales/th-TH/common.json b/web/i18n/locales/th-TH/common.json
index 3f1bc18c18a6f8..af82c943d9a23e 100644
--- a/web/i18n/locales/th-TH/common.json
+++ b/web/i18n/locales/th-TH/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "การเปลี่ยนแปลงจะมีผลทันทีในทุกที่ที่ใช้นโยบายนี้",
   "settings.ipPolicyEmptyCreate": "สร้างนโยบาย IP",
-  "settings.ipPolicyEmptyDescription": "กำหนดที่อยู่และช่วง IP ที่อนุญาต\nแล้วนำนโยบายไปใช้กับแอปของคุณ",
-  "settings.ipPolicyEmptyTitle": "ยังไม่มีนโยบาย IP",
+  "settings.ipPolicyEmptyDescription": "นโยบายคือรายการที่อยู่ IP ที่ได้รับอนุญาตให้เข้าถึง",
+  "settings.ipPolicyEmptyTitle": "ยังไม่มีนโยบาย IP ในพื้นที่ทำงานนี้",
   "settings.ipPolicyEnforcingMany": "{{count}} แอป",
   "settings.ipPolicyEnforcingNone": "0 แอป",
   "settings.ipPolicyEnforcingOne": "1 แอป",
diff --git a/web/i18n/locales/th-TH/deployments.json b/web/i18n/locales/th-TH/deployments.json
index c4e6e064535e71..d7e9cfc9c7576c 100644
--- a/web/i18n/locales/th-TH/deployments.json
+++ b/web/i18n/locales/th-TH/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "เปิด",
   "studio.accessControl.chipPartial": "{{n}} จาก {{m}}",
   "studio.accessControl.chipPaused": "หยุดชั่วคราว",
-  "studio.accessControl.createIpPolicy": "เพิ่มนโยบาย IP",
+  "studio.accessControl.createIpPolicy": "สร้างนโยบาย IP",
   "studio.accessControl.description": "ควบคุมการเข้าถึงแอปนี้โดยใช้นโยบาย IP",
   "studio.accessControl.downgradeDescription": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
   "studio.accessControl.downgradeTitle": "แอปนี้ไม่ได้รับการปกป้องอีกต่อไป",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "นโยบาย IP",
   "studio.accessControl.lockoutWarning": "IP ของคุณ ({{ip}}) ไม่ได้อยู่ในนโยบายนี้ คุณอาจสูญเสียสิทธิ์การเข้าถึง",
   "studio.accessControl.manageIpPolicies": "จัดการนโยบาย IP",
-  "studio.accessControl.notEnabled": "ยังไม่เปิดใช้งาน",
+  "studio.accessControl.notEnabled": "ไม่ได้รับการป้องกัน",
   "studio.accessControl.paywallDescription": "จำกัดการเข้าถึงแอปนี้เฉพาะที่อยู่ IP ที่คุณเชื่อถือ",
   "studio.accessControl.paywallTitle": "การควบคุมการเข้าถึง",
   "studio.accessControl.policyChanged": "นโยบายนี้มีการเปลี่ยนแปลง โปรดตรวจสอบคำเตือนก่อนบันทึกอีกครั้ง",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "โปรดเลือกจุดเข้าใช้งานอย่างน้อยหนึ่งจุด",
   "studio.accessControl.selectPolicy": "เลือกนโยบาย IP",
   "studio.accessControl.selectPolicyRequired": "โปรดเลือกนโยบาย IP",
+  "studio.accessControl.tooltipAllProtected": "จุดเข้าถึงทั้ง {{total}} จุดได้รับการป้องกัน",
   "studio.accessControl.tooltipDowngraded": "ไม่ได้รับการป้องกันอีกต่อไป — ใช้งานได้ในแพ็กเกจ Professional และ Team",
   "studio.accessControl.tooltipOff": "ยังไม่ได้ตั้งค่า",
-  "studio.accessControl.tooltipPaused": "หยุดชั่วคราว — ตั้งค่า {{name}} แล้ว แต่ยังไม่ได้บังคับใช้",
+  "studio.accessControl.tooltipPaused": "ตั้งค่าแล้ว แต่หยุดไว้ชั่วคราว",
   "studio.accessControl.tooltipPro": "การควบคุมการเข้าถึงพร้อมใช้งานในแผน Professional และ Team",
   "studio.accessControl.tooltipProtected": "จุดเข้าถึง {{n}} จาก {{total}} จุดได้รับการป้องกัน",
   "studio.accessControl.turnOffConfirm": "ปิด",
diff --git a/web/i18n/locales/tr-TR/common.json b/web/i18n/locales/tr-TR/common.json
index 7b5a5023e2f04c..3ff124d3d3ca07 100644
--- a/web/i18n/locales/tr-TR/common.json
+++ b/web/i18n/locales/tr-TR/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Değişiklikler bu politikanın uygulandığı her yerde hemen geçerli olur.",
   "settings.ipPolicyEmptyCreate": "IP politikası oluştur",
-  "settings.ipPolicyEmptyDescription": "İzin verilen IP adreslerini ve aralıklarını tanımlayın,\nardından politikayı uygulamalarınıza uygulayın.",
-  "settings.ipPolicyEmptyTitle": "Henüz IP politikası yok",
+  "settings.ipPolicyEmptyDescription": "Politika, erişimine izin verilen IP adreslerinin listesidir.",
+  "settings.ipPolicyEmptyTitle": "Bu çalışma alanında henüz IP politikası yok",
   "settings.ipPolicyEnforcingMany": "{{count}} uygulama",
   "settings.ipPolicyEnforcingNone": "0 uygulama",
   "settings.ipPolicyEnforcingOne": "1 uygulama",
diff --git a/web/i18n/locales/tr-TR/deployments.json b/web/i18n/locales/tr-TR/deployments.json
index 35fe32c5876eb8..66fd830e65e824 100644
--- a/web/i18n/locales/tr-TR/deployments.json
+++ b/web/i18n/locales/tr-TR/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "Açık",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "Duraklatıldı",
-  "studio.accessControl.createIpPolicy": "IP politikası ekle",
+  "studio.accessControl.createIpPolicy": "IP politikası oluştur",
   "studio.accessControl.description": "Bir IP politikası uygulayarak bu uygulamaya erişimi denetleyin.",
   "studio.accessControl.downgradeDescription": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
   "studio.accessControl.downgradeTitle": "Bu uygulama artık korunmuyor",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP politikası",
   "studio.accessControl.lockoutWarning": "IP adresiniz ({{ip}}) bu politikada yer almıyor. Erişiminizi kaybedebilirsiniz.",
   "studio.accessControl.manageIpPolicies": "IP politikalarını yönet",
-  "studio.accessControl.notEnabled": "Etkin değil",
+  "studio.accessControl.notEnabled": "Korunmuyor",
   "studio.accessControl.paywallDescription": "Bu uygulamaya erişimi güvendiğiniz IP adresleriyle sınırlayın.",
   "studio.accessControl.paywallTitle": "Erişim kontrolü",
   "studio.accessControl.policyChanged": "Bu politika değişti. Yeniden kaydetmeden önce uyarıyı inceleyin.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "Lütfen en az bir erişim noktası seçin.",
   "studio.accessControl.selectPolicy": "Bir IP politikası seçin",
   "studio.accessControl.selectPolicyRequired": "Lütfen bir IP politikası seçin.",
+  "studio.accessControl.tooltipAllProtected": "{{total}} erişim noktasının tamamı korunuyor",
   "studio.accessControl.tooltipDowngraded": "Artık korunmuyor — Professional ve Team planlarında kullanılabilir",
   "studio.accessControl.tooltipOff": "Yapılandırılmadı",
-  "studio.accessControl.tooltipPaused": "Duraklatıldı — {{name}} yapılandırıldı ancak uygulanmıyor",
+  "studio.accessControl.tooltipPaused": "Yapılandırılmış ancak duraklatılmış",
   "studio.accessControl.tooltipPro": "Erişim kontrolü Professional ve Team planlarında kullanılabilir.",
   "studio.accessControl.tooltipProtected": "{{total}} erişim noktasından {{n}} tanesi korunuyor",
   "studio.accessControl.turnOffConfirm": "Kapat",
diff --git a/web/i18n/locales/uk-UA/common.json b/web/i18n/locales/uk-UA/common.json
index 6f550f04b65d01..64c39527f2534a 100644
--- a/web/i18n/locales/uk-UA/common.json
+++ b/web/i18n/locales/uk-UA/common.json
@@ -276,9 +276,9 @@
   "settings.ipPolicyDialogDescription": "Specify which IP addresses or ranges can access your apps.",
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Зміни набувають чинності негайно всюди, де застосовується ця політика.",
-  "settings.ipPolicyEmptyCreate": "Створити політику IP",
-  "settings.ipPolicyEmptyDescription": "Визначте дозволені IP-адреси та діапазони,\nа потім застосуйте політику до своїх застосунків.",
-  "settings.ipPolicyEmptyTitle": "Політик IP ще немає",
+  "settings.ipPolicyEmptyCreate": "Створити IP-політику",
+  "settings.ipPolicyEmptyDescription": "Політика — це список IP-адрес, яким дозволено доступ.",
+  "settings.ipPolicyEmptyTitle": "У цьому робочому просторі ще немає IP-політик",
   "settings.ipPolicyEnforcingMany": "{{count}} застосунків",
   "settings.ipPolicyEnforcingNone": "0 застосунків",
   "settings.ipPolicyEnforcingOne": "1 застосунок",
diff --git a/web/i18n/locales/uk-UA/deployments.json b/web/i18n/locales/uk-UA/deployments.json
index 35c89bb5053407..a2fa2fee19fa0b 100644
--- a/web/i18n/locales/uk-UA/deployments.json
+++ b/web/i18n/locales/uk-UA/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipOn": "Увімк.",
   "studio.accessControl.chipPartial": "{{n}} із {{m}}",
   "studio.accessControl.chipPaused": "Призупинено",
-  "studio.accessControl.createIpPolicy": "Додати IP-політику",
+  "studio.accessControl.createIpPolicy": "Створити IP-політику",
   "studio.accessControl.description": "Керуйте доступом до цього застосунку за допомогою IP-політики.",
   "studio.accessControl.downgradeDescription": "Керування доступом доступне в планах Professional і Team.",
   "studio.accessControl.downgradeTitle": "Цей застосунок більше не захищено",
@@ -53,7 +53,7 @@
   "studio.accessControl.ipPolicy": "IP-політика",
   "studio.accessControl.lockoutWarning": "Вашу IP-адресу ({{ip}}) не включено до цієї політики. Ви можете втратити доступ.",
   "studio.accessControl.manageIpPolicies": "Керувати IP-політиками",
-  "studio.accessControl.notEnabled": "Не ввімкнено",
+  "studio.accessControl.notEnabled": "Не захищено",
   "studio.accessControl.paywallDescription": "Дозвольте доступ до цього застосунку лише з довірених IP-адрес.",
   "studio.accessControl.paywallTitle": "Контроль доступу",
   "studio.accessControl.policyChanged": "Цю політику змінено. Перегляньте попередження перед повторним збереженням.",
@@ -75,9 +75,10 @@
   "studio.accessControl.selectAccessPoint": "Виберіть принаймні одну точку доступу.",
   "studio.accessControl.selectPolicy": "Виберіть IP-політику",
   "studio.accessControl.selectPolicyRequired": "Виберіть IP-політику.",
+  "studio.accessControl.tooltipAllProtected": "Захищено всі точки доступу: {{total}}",
   "studio.accessControl.tooltipDowngraded": "Більше не захищено — доступно в тарифах Professional і Team",
   "studio.accessControl.tooltipOff": "Не налаштовано",
-  "studio.accessControl.tooltipPaused": "Призупинено — політику {{name}} налаштовано, але вона не застосовується",
+  "studio.accessControl.tooltipPaused": "Налаштовано, але призупинено",
   "studio.accessControl.tooltipPro": "Керування доступом доступне в планах Professional і Team.",
   "studio.accessControl.tooltipProtected": "Захищено точок доступу: {{n}} із {{total}}",
   "studio.accessControl.turnOffConfirm": "Вимкнути",
diff --git a/web/i18n/locales/vi-VN/common.json b/web/i18n/locales/vi-VN/common.json
index 43954768e696b2..c0ceac8528187b 100644
--- a/web/i18n/locales/vi-VN/common.json
+++ b/web/i18n/locales/vi-VN/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "Edit IP Policy",
   "settings.ipPolicyEditUsedBy": "Các thay đổi có hiệu lực ngay lập tức ở mọi nơi áp dụng chính sách này.",
   "settings.ipPolicyEmptyCreate": "Tạo chính sách IP",
-  "settings.ipPolicyEmptyDescription": "Xác định địa chỉ và dải IP được phép,\nsau đó áp dụng chính sách cho ứng dụng của bạn.",
-  "settings.ipPolicyEmptyTitle": "Chưa có chính sách IP",
+  "settings.ipPolicyEmptyDescription": "Chính sách là danh sách các địa chỉ IP được phép truy cập.",
+  "settings.ipPolicyEmptyTitle": "Chưa có chính sách IP nào trong không gian làm việc này",
   "settings.ipPolicyEnforcingMany": "{{count}} ứng dụng",
   "settings.ipPolicyEnforcingNone": "0 ứng dụng",
   "settings.ipPolicyEnforcingOne": "1 ứng dụng",
diff --git a/web/i18n/locales/vi-VN/deployments.json b/web/i18n/locales/vi-VN/deployments.json
index e5be0c30c591f3..7b3c72b73dc2e5 100644
--- a/web/i18n/locales/vi-VN/deployments.json
+++ b/web/i18n/locales/vi-VN/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "Bật",
   "studio.accessControl.chipPartial": "{{n}} trên {{m}}",
   "studio.accessControl.chipPaused": "Tạm dừng",
-  "studio.accessControl.createIpPolicy": "Thêm chính sách IP",
+  "studio.accessControl.createIpPolicy": "Tạo chính sách IP",
   "studio.accessControl.description": "Kiểm soát quyền truy cập ứng dụng này bằng cách áp dụng chính sách IP.",
   "studio.accessControl.downgradeDescription": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
   "studio.accessControl.downgradeTitle": "Ứng dụng này không còn được bảo vệ",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "Chính sách IP",
   "studio.accessControl.lockoutWarning": "IP của bạn ({{ip}}) không nằm trong chính sách này. Bạn có thể mất quyền truy cập.",
   "studio.accessControl.manageIpPolicies": "Quản lý chính sách IP",
-  "studio.accessControl.notEnabled": "Chưa bật",
+  "studio.accessControl.notEnabled": "Không được bảo vệ",
   "studio.accessControl.paywallDescription": "Chỉ cho phép truy cập ứng dụng này từ các địa chỉ IP mà bạn tin cậy.",
   "studio.accessControl.paywallTitle": "Kiểm soát truy cập",
   "studio.accessControl.policyChanged": "Chính sách này đã thay đổi. Hãy xem lại cảnh báo trước khi lưu lại.",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "Vui lòng chọn ít nhất một điểm truy cập.",
   "studio.accessControl.selectPolicy": "Chọn chính sách IP",
   "studio.accessControl.selectPolicyRequired": "Vui lòng chọn chính sách IP.",
+  "studio.accessControl.tooltipAllProtected": "Tất cả {{total}} điểm truy cập đều được bảo vệ",
   "studio.accessControl.tooltipDowngraded": "Không còn được bảo vệ — có trong các gói Professional và Team",
   "studio.accessControl.tooltipOff": "Chưa thiết lập",
-  "studio.accessControl.tooltipPaused": "Đã tạm dừng — {{name}} đã được cấu hình nhưng chưa được áp dụng",
+  "studio.accessControl.tooltipPaused": "Đã cấu hình nhưng đang tạm dừng",
   "studio.accessControl.tooltipPro": "Tính năng kiểm soát truy cập có trong các gói Professional và Team.",
   "studio.accessControl.tooltipProtected": "{{n}} trong số {{total}} điểm truy cập được bảo vệ",
   "studio.accessControl.turnOffConfirm": "Tắt",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index 021a80faea3f81..81def6a39671e2 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "编辑 IP 策略",
   "settings.ipPolicyEditUsedBy": "修改将立即对所有引用此策略的应用生效。",
   "settings.ipPolicyEmptyCreate": "创建 IP 策略",
-  "settings.ipPolicyEmptyDescription": "定义允许访问的 IP 地址和网段，\n然后将策略应用到你的应用。",
-  "settings.ipPolicyEmptyTitle": "暂无 IP 策略",
+  "settings.ipPolicyEmptyDescription": "策略是允许访问的 IP 地址列表。",
+  "settings.ipPolicyEmptyTitle": "当前工作空间还没有 IP 策略",
   "settings.ipPolicyEnforcingMany": "{{count}} 个",
   "settings.ipPolicyEnforcingNone": "0 个",
   "settings.ipPolicyEnforcingOne": "1 个",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 6cbfb118168b92..58e12bfe176027 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "开启",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "暂停",
-  "studio.accessControl.createIpPolicy": "添加 IP 策略",
+  "studio.accessControl.createIpPolicy": "创建 IP 策略",
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
   "studio.accessControl.downgradeDescription": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP 策略",
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能会失去访问权限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
-  "studio.accessControl.notEnabled": "未启用",
+  "studio.accessControl.notEnabled": "未受保护",
   "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
   "studio.accessControl.paywallTitle": "访问控制",
   "studio.accessControl.policyChanged": "此策略已发生变化，请确认风险提示后再次保存。",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "请至少选择一个访问入口。",
   "studio.accessControl.selectPolicy": "选择 IP 策略",
   "studio.accessControl.selectPolicyRequired": "请选择一条 IP 策略。",
+  "studio.accessControl.tooltipAllProtected": "全部 {{total}} 个访问入口均受保护",
   "studio.accessControl.tooltipDowngraded": "已不再受保护，适用于 Professional 和 Team 套餐",
   "studio.accessControl.tooltipOff": "尚未配置",
-  "studio.accessControl.tooltipPaused": "已暂停 — {{name}} 已配置但未生效",
+  "studio.accessControl.tooltipPaused": "已配置但已暂停",
   "studio.accessControl.tooltipPro": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.tooltipProtected": "{{total}} 个访问入口中有 {{n}} 个受到保护",
   "studio.accessControl.turnOffConfirm": "关闭",
diff --git a/web/i18n/locales/zh-Hant/common.json b/web/i18n/locales/zh-Hant/common.json
index db506f29e39675..34be55d2d00342 100644
--- a/web/i18n/locales/zh-Hant/common.json
+++ b/web/i18n/locales/zh-Hant/common.json
@@ -277,8 +277,8 @@
   "settings.ipPolicyEditTitle": "編輯 IP 策略",
   "settings.ipPolicyEditUsedBy": "修改將立即對所有套用此原則的應用程式生效。",
   "settings.ipPolicyEmptyCreate": "建立 IP 策略",
-  "settings.ipPolicyEmptyDescription": "定義允許存取的 IP 位址與網段，\n再將策略套用至你的應用程式。",
-  "settings.ipPolicyEmptyTitle": "尚無 IP 策略",
+  "settings.ipPolicyEmptyDescription": "策略是允許存取的 IP 位址清單。",
+  "settings.ipPolicyEmptyTitle": "目前工作區還沒有 IP 策略",
   "settings.ipPolicyEnforcingMany": "{{count}} 個應用",
   "settings.ipPolicyEnforcingNone": "0 個應用",
   "settings.ipPolicyEnforcingOne": "1 個應用",
diff --git a/web/i18n/locales/zh-Hant/deployments.json b/web/i18n/locales/zh-Hant/deployments.json
index 804bae19b7e44a..7a020cce993a26 100644
--- a/web/i18n/locales/zh-Hant/deployments.json
+++ b/web/i18n/locales/zh-Hant/deployments.json
@@ -41,7 +41,7 @@
   "studio.accessControl.chipOn": "開啟",
   "studio.accessControl.chipPartial": "{{n}} / {{m}}",
   "studio.accessControl.chipPaused": "暫停",
-  "studio.accessControl.createIpPolicy": "新增 IP 原則",
+  "studio.accessControl.createIpPolicy": "建立 IP 策略",
   "studio.accessControl.description": "透過套用 IP 原則來控制對此應用程式的存取。",
   "studio.accessControl.downgradeDescription": "存取控制功能適用於 Professional 和 Team 方案。",
   "studio.accessControl.downgradeTitle": "此應用程式已不再受保護",
@@ -51,7 +51,7 @@
   "studio.accessControl.ipPolicy": "IP 策略",
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能會失去存取權限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
-  "studio.accessControl.notEnabled": "未啟用",
+  "studio.accessControl.notEnabled": "未受保護",
   "studio.accessControl.paywallDescription": "僅允許您信任的 IP 位址存取此應用程式。",
   "studio.accessControl.paywallTitle": "存取控制",
   "studio.accessControl.policyChanged": "此原則已變更，請確認風險提示後再次儲存。",
@@ -73,9 +73,10 @@
   "studio.accessControl.selectAccessPoint": "請至少選擇一個要保護的存取點。",
   "studio.accessControl.selectPolicy": "選擇策略",
   "studio.accessControl.selectPolicyRequired": "請選擇一項 IP 原則。",
+  "studio.accessControl.tooltipAllProtected": "全部 {{total}} 個存取點均受保護",
   "studio.accessControl.tooltipDowngraded": "已不再受保護，適用於 Professional 和 Team 方案",
   "studio.accessControl.tooltipOff": "尚未設定",
-  "studio.accessControl.tooltipPaused": "已暫停 — {{name}} 已設定但未生效",
+  "studio.accessControl.tooltipPaused": "已設定但已暫停",
   "studio.accessControl.tooltipPro": "存取控制功能適用於 Professional 和 Team 方案。",
   "studio.accessControl.tooltipProtected": "{{total}} 個存取點中有 {{n}} 個受到保護",
   "studio.accessControl.turnOffConfirm": "關閉",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 54b8e6dee7ec7f..8654013504ad24 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -1827,9 +1827,9 @@ export default interface Resources {
     'settings.ipPolicyDialogDescription': 'Specify which IP addresses or ranges can access your apps.'
     'settings.ipPolicyEditTitle': 'Edit IP Policy'
     'settings.ipPolicyEditUsedBy': 'Changes take effect immediately wherever this policy is applied.'
-    'settings.ipPolicyEmptyCreate': 'Create IP Policy'
-    'settings.ipPolicyEmptyDescription': 'Define allowed IP addresses and ranges,\nthen apply the policy to your apps.'
-    'settings.ipPolicyEmptyTitle': 'No IP policies yet'
+    'settings.ipPolicyEmptyCreate': 'Create an IP policy'
+    'settings.ipPolicyEmptyDescription': 'A policy is the list of IP addresses allowed in.'
+    'settings.ipPolicyEmptyTitle': 'No IP policies in this workspace yet'
     'settings.ipPolicyEnforcingMany': '{{count}} apps'
     'settings.ipPolicyEnforcingNone': '0 apps'
     'settings.ipPolicyEnforcingOne': '1 app'
@@ -3000,7 +3000,7 @@ export default interface Resources {
     'studio.accessControl.chipOn': 'ON'
     'studio.accessControl.chipPartial': '{{n}} of {{m}}'
     'studio.accessControl.chipPaused': 'Pause'
-    'studio.accessControl.createIpPolicy': 'Add an IP policy'
+    'studio.accessControl.createIpPolicy': 'Create an IP policy'
     'studio.accessControl.description': 'Control access to this app by applying an IP policy.'
     'studio.accessControl.downgradeDescription': 'Access control is available on Professional and Team plans.'
     'studio.accessControl.downgradeTitle': 'This app is no longer protected'
@@ -3010,7 +3010,7 @@ export default interface Resources {
     'studio.accessControl.ipPolicy': 'IP Policy'
     'studio.accessControl.lockoutWarning': "Your IP ({{ip}}) isn't in this policy. You may lose access."
     'studio.accessControl.manageIpPolicies': 'Manage IP policies'
-    'studio.accessControl.notEnabled': 'Not enabled'
+    'studio.accessControl.notEnabled': 'Not protected'
     'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.'
     'studio.accessControl.paywallTitle': 'Access Control'
     'studio.accessControl.policyChanged': 'This policy changed. Review the warning before saving again.'
@@ -3029,12 +3029,13 @@ export default interface Resources {
     'studio.accessControl.restrictedTo': 'Restricted to {{name}}'
     'studio.accessControl.saveAnyway': 'Save anyway'
     'studio.accessControl.saveWithoutOwnIp': 'Save without your own IP?'
-    'studio.accessControl.selectAccessPoint': 'Please choose at least one access point.'
+    'studio.accessControl.selectAccessPoint': 'Please select at least one access point.'
     'studio.accessControl.selectPolicy': 'Select an IP policy'
     'studio.accessControl.selectPolicyRequired': 'Please select an IP policy.'
+    'studio.accessControl.tooltipAllProtected': 'All {{total}} access points are protected'
     'studio.accessControl.tooltipDowngraded': 'No longer protected — available on Professional and Team plans'
     'studio.accessControl.tooltipOff': 'Not set up'
-    'studio.accessControl.tooltipPaused': 'Paused — {{name}} is configured but not enforcing'
+    'studio.accessControl.tooltipPaused': 'Configured but paused'
     'studio.accessControl.tooltipPro': 'Access control is available on Professional and Team plans.'
     'studio.accessControl.tooltipProtected': '{{n}} of {{total}} access points are protected'
     'studio.accessControl.turnOffConfirm': 'Turn off'

From d7394a4657c2577d0c804de67eafdca85abc869d Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 17:35:00 +0800
Subject: [PATCH 087/108] fix(web): route new Agent access points to Agent page
 (SNP-943)

---
 .../[appId]/__tests__/layout-main.spec.tsx    | 69 +++++++++++++++----
 .../(appDetailLayout)/[appId]/layout-main.tsx | 17 ++++-
 2 files changed, 71 insertions(+), 15 deletions(-)

diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
index d78d024cf3e3fb..870888e49ddf67 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/__tests__/layout-main.spec.tsx
@@ -265,23 +265,64 @@ describe('AppDetailLayout', () => {
     expect(useStore.getState().appDetail?.id).toBe('app-1')
   })
 
-  it('should allow users with Access Point view permission to open the page directly', async () => {
-    mockPathname = '/app/app-1/access-point'
-    mockAppResponse.mockResolvedValue(
-      createAppDetail({ permission_keys: [AppACLPermission.AccessPointView] }),
-    )
+  it.each([AppModeEnum.WORKFLOW, AppModeEnum.AGENT_CHAT])(
+    'should allow users with Access Point view permission to open a %s page directly',
+    async (mode) => {
+      mockPathname = '/app/app-1/access-point'
+      mockAppResponse.mockResolvedValue(
+        createAppDetail({ mode, permission_keys: [AppACLPermission.AccessPointView] }),
+      )
 
-    render(
-      <AppDetailLayout appId="app-1">
-        <div>App page content</div>
-      </AppDetailLayout>,
-    )
+      render(
+        <AppDetailLayout appId="app-1">
+          <div>App page content</div>
+        </AppDetailLayout>,
+      )
 
-    await waitForAppContent()
+      await waitForAppContent()
 
-    expect(mockReplace).not.toHaveBeenCalled()
-    expect(useStore.getState().appDetail?.id).toBe('app-1')
-  })
+      expect(mockReplace).not.toHaveBeenCalled()
+      expect(useStore.getState().appDetail?.id).toBe('app-1')
+    },
+  )
+
+  it.each([
+    {
+      source: 'fetched Agent',
+      cached: false,
+      agentId: 'agent-1',
+      destination: '/agents/agent-1/access',
+    },
+    {
+      source: 'cached Agent',
+      cached: true,
+      agentId: 'agent-1',
+      destination: '/agents/agent-1/access',
+    },
+    { source: 'unbound Agent', cached: false, agentId: null, destination: '/agents' },
+  ])(
+    'redirects the legacy Access Point URL for a $source without rendering generic app content',
+    async ({ cached, agentId, destination }) => {
+      mockPathname = '/app/app-1/access-point'
+      const agentApp = createAppDetail({
+        mode: AppModeEnum.AGENT,
+        bound_agent_id: agentId,
+        permission_keys: [AppACLPermission.AccessPointView],
+      })
+      mockAppResponse.mockResolvedValue(agentApp)
+      if (cached) useStore.getState().setAppDetail(agentApp)
+
+      render(
+        <AppDetailLayout appId="app-1">
+          <div>App page content</div>
+        </AppDetailLayout>,
+      )
+
+      expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+      await waitFor(() => expect(mockReplace).toHaveBeenCalledWith(destination))
+      expect(screen.queryByText('App page content')).not.toBeInTheDocument()
+    },
+  )
 
   it('should redirect access point pages when view permission is missing', async () => {
     mockPathname = '/app/app-1/access-point'
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
index e68e93e3de3dda..6c4d6c3e674afe 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
@@ -87,6 +87,8 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
   )
   const shouldBlockAgentResourceAccess =
     routeAppDetail?.mode === AppModeEnum.AGENT && pathname.endsWith('/access-config')
+  const shouldRedirectAgentAccessPoint =
+    routeAppDetail?.mode === AppModeEnum.AGENT && pathname.endsWith('/access-point')
   const canViewAccessPoint =
     routeAppDetail?.id === appId &&
     currentWorkspace.id &&
@@ -154,6 +156,15 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
       return
     if (routeAppDetail.id !== appId) return
 
+    if (shouldRedirectAgentAccessPoint) {
+      router.replace(
+        routeAppDetail.bound_agent_id
+          ? `/agents/${routeAppDetail.bound_agent_id}/access`
+          : '/agents',
+      )
+      return
+    }
+
     const appACLCapabilities = getAppACLCapabilities(routeAppDetail.permission_keys, {
       currentUserId,
       resourceMaintainer: routeAppDetail.maintainer,
@@ -220,12 +231,16 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
     routeAppDetail,
     router,
     setAppDetail,
+    shouldRedirectAgentAccessPoint,
     workspacePermissionKeys,
   ])
 
   const isWorkflowPage = pathname.endsWith('/workflow')
   const content =
-    !appDetail || shouldBlockAgentResourceAccess || shouldBlockAccessPointAccess ? (
+    !appDetail ||
+    shouldBlockAgentResourceAccess ||
+    shouldRedirectAgentAccessPoint ||
+    shouldBlockAccessPointAccess ? (
       <div className="flex min-w-0 grow items-center justify-center bg-background-body">
         <LoadingPlaceholder />
       </div>

From 28021e95d5ba826514e2dfc627d67f1be5c0107d Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Sat, 10 Oct 2026 17:49:44 +0800
Subject: [PATCH 088/108] fix(api): preserve IP policy display entries and
 user-facing conflicts

---
 .../console/workspace/network_access_group.py |  2 +-
 api/services/network_access_group_service.py  |  9 ++-
 .../workspace/test_network_access_group.py    | 39 ++++++++++++-
 .../test_network_access_group_service.py      | 57 +++++++++++++++++++
 4 files changed, 102 insertions(+), 5 deletions(-)

diff --git a/api/controllers/console/workspace/network_access_group.py b/api/controllers/console/workspace/network_access_group.py
index 830925c8eb2f1e..3952195a1a205f 100644
--- a/api/controllers/console/workspace/network_access_group.py
+++ b/api/controllers/console/workspace/network_access_group.py
@@ -212,7 +212,7 @@ def _translate_upstream_error(exc: NetworkAccessGroupUpstreamError) -> Exception
     if exc.status_code == 409:
         message_by_reason = {
             "NETWORK_ACCESS_VERSION_CONFLICT": "The network access resource changed. Refresh it and try again.",
-            "NETWORK_ACCESS_GROUP_NAME_CONFLICT": "A network access group with this name already exists.",
+            "NETWORK_ACCESS_GROUP_NAME_CONFLICT": "An IP policy with this name already exists.",
             "NETWORK_ACCESS_GROUP_LIMIT": "This workspace has reached the network access group limit.",
         }
         return Conflict(message_by_reason.get(exc.reason or "", "The network access resource is in conflict."))
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index a9ec1c6356a0fc..940af7a457f88e 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -430,16 +430,19 @@ def _normalize_ip_address(
 
     @staticmethod
     def _normalize_ip_network(raw_cidr: object) -> ipaddress.IPv4Network | ipaddress.IPv6Network:
+        """Normalize a management display entry for matching without rewriting it."""
         if not isinstance(raw_cidr, str) or "%" in raw_cidr:
             raise TypeError("policy CIDR must be a string")
         address_value, separator, prefix_value = raw_cidr.partition("/")
-        if not separator:
-            raise ValueError("policy CIDR must include a prefix length")
+        if separator and (not prefix_value.isascii() or not prefix_value.isdecimal()):
+            raise ValueError("policy CIDR prefix must be a decimal length")
         original_address = ipaddress.ip_address(address_value)
+        # Management replies preserve bare IPs and CIDR host bits for display.
+        # ip_network assigns a host prefix to bare IPs and masks only this local value.
         network = ipaddress.ip_network(raw_cidr, strict=False)
         if not isinstance(original_address, ipaddress.IPv6Address) or original_address.ipv4_mapped is None:
             return network
-        prefix_length = int(prefix_value)
+        prefix_length = network.prefixlen
         if prefix_length < 96:
             raise ValueError("IPv4-mapped IPv6 policy prefixes must be at least /96")
         return ipaddress.IPv4Network((original_address.ipv4_mapped, prefix_length - 96), strict=False)
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index abf4c9fbaeaddb..0f87566c0ceada 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -292,7 +292,7 @@ def test_upstream_error_mapping(status_code: int, expected_exception: type[HTTPE
     ("reason", "expected_message"),
     [
         ("NETWORK_ACCESS_VERSION_CONFLICT", "changed"),
-        ("NETWORK_ACCESS_GROUP_NAME_CONFLICT", "already exists"),
+        ("NETWORK_ACCESS_GROUP_NAME_CONFLICT", "An IP policy with this name already exists."),
         ("NETWORK_ACCESS_GROUP_LIMIT", "reached"),
     ],
 )
@@ -303,6 +303,43 @@ def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, ex
     assert expected_message in error.description
 
 
+@pytest.mark.parametrize("mutation", ["create", "update"])
+def test_duplicate_policy_name_mutations_preserve_conflict_and_public_message(mutation: str) -> None:
+    service = MagicMock()
+    upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_GROUP_NAME_CONFLICT")
+    service.create_group.side_effect = upstream_error
+    service.update_group.side_effect = upstream_error
+
+    def invoke_mutation() -> None:
+        if mutation == "create":
+            api = CurrentWorkspaceNetworkAccessGroupsApi()
+            unwrap(api.post)(
+                api,
+                req_data=NetworkAccessGroupCreatePayload(name="Office", allowed_cidrs=["203.0.113.7"]),
+                request_context=_request_context(),
+            )
+        else:
+            detail_api = CurrentWorkspaceNetworkAccessGroupApi()
+            unwrap(detail_api.put)(
+                detail_api,
+                req_data=NetworkAccessGroupUpdatePayload(
+                    name="Office", allowed_cidrs=["203.0.113.7"], expected_version=2
+                ),
+                request_context=_request_context(),
+                group_id=UUID(GROUP_ID),
+            )
+
+    with _application_services(service), pytest.raises(Conflict) as exc_info:
+        invoke_mutation()
+
+    assert exc_info.value.code == 409
+    assert exc_info.value.description == "An IP policy with this name already exists."
+    assert exc_info.value.__cause__ is upstream_error
+    assert upstream_error.reason == "NETWORK_ACCESS_GROUP_NAME_CONFLICT"
+    assert service.create_group.call_count == (1 if mutation == "create" else 0)
+    assert service.update_group.call_count == (1 if mutation == "update" else 0)
+
+
 def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None:
     assert isinstance(
         _translate_upstream_error(NetworkAccessGroupUpstreamError(400, "INVALID_SECRET_KEY")),
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index adc3148bec778b..5cbdea8fd8dadf 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -782,6 +782,24 @@ def test_current_ip_check_does_not_read_ip_when_tenant_scoped_policy_lookup_fail
         (["::ffff:203.0.113.0/120"], "203.0.113.7", True),
         (["2001:db8::/32"], "2001:db8:1::1", True),
         (["2001:db8::/48"], "2001:db9::1", False),
+        (["203.0.113.7"], "203.0.113.7", True),
+        (["203.0.113.7"], "203.0.113.8", False),
+        (["0.0.0.0"], "203.0.113.7", False),
+        (["2001:db8::1"], "2001:db8::1", True),
+        (["2001:db8::1"], "2001:db8::2", False),
+        (["2001:0DB8:0000:0000:0000:0000:0000:0001"], "2001:db8::1", True),
+        (["2001:db8::1"], "2001:0db8:0:0:0:0:0:1", True),
+        (["::"], "2001:db8::1", False),
+        (["203.0.113.77/24"], "203.0.113.7", True),
+        (["203.0.113.77/24"], "203.0.114.7", False),
+        (["2001:db8:1::beef/64"], "2001:db8:1::42", True),
+        (["2001:db8:1::beef/64"], "2001:db8:2::42", False),
+        (["::ffff:203.0.113.7"], "203.0.113.7", True),
+        (["::ffff:203.0.113.7"], "203.0.113.8", False),
+        (["::ffff:203.0.113.129/120"], "203.0.113.7", True),
+        (["::ffff:203.0.113.129/120"], "203.0.114.7", False),
+        (["::ffff:203.0.113.129/96"], "198.51.100.7", True),
+        (["::ffff:203.0.113.129/96"], "2001:db8::1", False),
     ],
 )
 def test_current_ip_check_matches_ipv4_ipv6_and_mapped_addresses_consistently(
@@ -801,13 +819,52 @@ def test_current_ip_check_matches_ipv4_ipv6_and_mapped_addresses_consistently(
     assert result.allowed is expected
 
 
+def test_current_ip_check_preserves_display_spelling_and_order_without_rewriting_policy() -> None:
+    harness = _harness()
+    display_entries = (
+        "203.0.113.9",
+        "2001:0DB8:0000:0000:0000:0000:0000:0001",
+        "198.51.100.77/24",
+        "::ffff:203.0.113.129/120",
+    )
+    group = _group(allowed_cidrs=display_entries)
+    harness.control_plane.get_group.return_value = group
+
+    result = harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=lambda: "2001:db8::1")
+    displayed = harness.service.get_group(_context(), group_id=GROUP_ID)
+
+    assert result.allowed is True
+    assert group.allowed_cidrs == display_entries
+    assert displayed.allowed_cidrs == display_entries
+    harness.control_plane.create_group.assert_not_called()
+    harness.control_plane.update_group.assert_not_called()
+    harness.control_plane.update_app_binding.assert_not_called()
+
+
 @pytest.mark.parametrize(
     "allowed_cidrs",
     [
         [],
         ["0.0.0.0/0", "not-a-cidr"],
         ["fe80::1%eth0/128"],
+        ["fe80::1%eth0"],
         ["::ffff:0:0/80"],
+        ["::ffff:203.0.113.7/95"],
+        ["203.0.113.7/255.255.255.0"],
+        ["203.0.113.7/0.0.0.255"],
+        ["203.0.113.7/"],
+        ["203.0.113.7/24/1"],
+        ["203.0.113.7/+24"],
+        ["203.0.113.7/２４"],
+        ["203.0.113.7/33"],
+        ["2001:db8::1/129"],
+        ["192.168.01.1"],
+        ["2001:db8:::1"],
+        ["203.0.113.7 "],
+        [" 203.0.113.7"],
+        [""],
+        ["203.0.113.7", "not-an-ip"],
+        ["203.0.113.0/24", "::ffff:203.0.113.7/95"],
     ],
 )
 def test_current_ip_check_rejects_malformed_policy_without_short_circuiting(

From a38498343949c30cf2baad6b065d191d291896db Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 18:05:00 +0800
Subject: [PATCH 089/108] fix(web): pluralize IP policy summary counts
 (SNP-938)

---
 .../__tests__/config-panel.spec.tsx           | 91 ++++++++++++-------
 .../access-control/__tests__/index.spec.tsx   | 80 ++++++++--------
 web/i18n/locales/ar-TN/deployments.json       |  7 +-
 web/i18n/locales/az-AZ/deployments.json       |  2 +
 web/i18n/locales/de-DE/deployments.json       |  3 +-
 web/i18n/locales/en-US/deployments.json       |  3 +-
 web/i18n/locales/es-ES/deployments.json       |  4 +-
 web/i18n/locales/fa-IR/deployments.json       |  3 +-
 web/i18n/locales/fr-FR/deployments.json       |  4 +-
 web/i18n/locales/hi-IN/deployments.json       |  3 +-
 web/i18n/locales/id-ID/deployments.json       |  3 +-
 web/i18n/locales/it-IT/deployments.json       |  4 +-
 web/i18n/locales/ja-JP/deployments.json       |  3 +-
 web/i18n/locales/ko-KR/deployments.json       |  3 +-
 web/i18n/locales/lo-LA/deployments.json       |  3 +-
 web/i18n/locales/nl-NL/deployments.json       |  3 +-
 web/i18n/locales/pl-PL/deployments.json       |  5 +-
 web/i18n/locales/pt-BR/deployments.json       |  4 +-
 web/i18n/locales/ro-RO/deployments.json       |  4 +-
 web/i18n/locales/ru-RU/deployments.json       |  5 +-
 web/i18n/locales/sl-SI/deployments.json       |  5 +-
 web/i18n/locales/th-TH/deployments.json       |  3 +-
 web/i18n/locales/tr-TR/deployments.json       |  3 +-
 web/i18n/locales/uk-UA/deployments.json       |  5 +-
 web/i18n/locales/vi-VN/deployments.json       |  3 +-
 web/i18n/locales/zh-Hans/deployments.json     |  3 +-
 web/i18n/locales/zh-Hant/deployments.json     |  3 +-
 web/i18n/resources.generated.d.ts             |  4 +-
 28 files changed, 173 insertions(+), 93 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index aacf01e8234221..ab485b3bd1ce34 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -3,8 +3,15 @@ import type { AccessControlDraft, AccessControlPolicy } from '../draft'
 import { Popover, PopoverContent, PopoverTrigger } from '@langgenius/dify-ui/popover'
 import { screen } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
 import { useState } from 'react'
+import { initReactI18next } from 'react-i18next'
 import { ACCESS_POINT_ORDER } from '@/app/components/app/deploy/utils/access-point'
+import appOverviewTranslations from '@/i18n/locales/en-US/app-overview.json'
+import commonTranslations from '@/i18n/locales/en-US/common.json'
+import deploymentTranslations from '@/i18n/locales/en-US/deployments.json'
+import navigationTranslations from '@/i18n/locales/en-US/navigation.json'
+import toolsTranslations from '@/i18n/locales/en-US/tools.json'
 import { render } from '@/test/console/render'
 import { AccessControlConfigPanel } from '../config-panel'
 import { createDefaultAccessControlDraft } from '../draft'
@@ -22,20 +29,26 @@ const policies: AccessControlPolicy[] = [
   },
 ]
 
-const translations = vi.hoisted(() => ({
-  'operation.cancel': 'Cancel',
-  'operation.save': 'Save',
-  'overview.apiInfo.title': 'Backend Service API',
-  'overview.appInfo.title': 'Web App',
-  'mcp.server.title': 'MCP Server',
-  'settings.ipPolicies': 'IP Policies',
-  'settings.trigger': 'Trigger',
-}))
+vi.unmock('react-i18next')
 
-vi.mock('react-i18next', async () => {
-  const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  const { default: deploymentTranslations } = await import('@/i18n/locales/en-US/deployments.json')
-  return createReactI18nextMock({ ...translations, ...deploymentTranslations })
+beforeEach(async () => {
+  await createInstance()
+    .use(initReactI18next)
+    .init({
+      lng: 'en-US',
+      fallbackLng: 'en-US',
+      keySeparator: false,
+      interpolation: { escapeValue: false },
+      resources: {
+        'en-US': {
+          appOverview: appOverviewTranslations,
+          common: commonTranslations,
+          deployments: deploymentTranslations,
+          navigation: navigationTranslations,
+          tools: toolsTranslations,
+        },
+      },
+    })
 })
 
 function PanelHarness({
@@ -46,6 +59,7 @@ function PanelHarness({
   onManagePolicies = vi.fn(),
   canManagePolicies = true,
   readOnly = false,
+  availablePolicies = policies,
 }: {
   ipCheck?: NetworkAccessGroupCurrentIpCheckResponse
   initialDraft?: AccessControlDraft
@@ -54,6 +68,7 @@ function PanelHarness({
   onManagePolicies?: () => void
   canManagePolicies?: boolean
   readOnly?: boolean
+  availablePolicies?: AccessControlPolicy[]
 }) {
   const [draft, setDraft] = useState(initialDraft)
   const onCancel = vi.fn()
@@ -68,7 +83,7 @@ function PanelHarness({
           appIcon={{}}
           canManagePolicies={canManagePolicies}
           readOnly={readOnly}
-          policies={policies}
+          policies={availablePolicies}
           ipCheck={ipCheck}
           onCancel={onCancel}
           onCreatePolicy={onCreatePolicy}
@@ -102,26 +117,40 @@ describe('AccessControlConfigPanel', () => {
     expect(screen.getByRole('switch', { name: 'Trigger' })).toHaveAttribute('aria-disabled', 'true')
   })
 
-  it('enables save after a policy is selected', async () => {
-    const user = userEvent.setup()
-    const onSave = vi.fn()
-    render(<PanelHarness onSave={onSave} />)
+  it.each([
+    { addressCount: 3, remainder: '1 more address' },
+    { addressCount: 4, remainder: '2 more addresses' },
+  ])(
+    'summarizes $remainder and enables save after selecting a policy',
+    async ({ addressCount, remainder }) => {
+      const user = userEvent.setup()
+      const onSave = vi.fn()
+      render(
+        <PanelHarness
+          availablePolicies={policies.map((policy) => ({
+            ...policy,
+            allowed_cidrs: policy.allowed_cidrs.slice(0, addressCount),
+          }))}
+          onSave={onSave}
+        />,
+      )
 
-    await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
+      await user.click(await screen.findByRole('option', { name: /Internal Network/ }))
 
-    expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
-    expect(
-      screen.getByText('Allows 203.0.113.42/32, 198.51.100.0/24 and 2 more addresses'),
-    ).toBeInTheDocument()
-    expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
-    expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
-      'aria-disabled',
-      'true',
-    )
+      expect(screen.queryByText('Please select an IP policy.')).not.toBeInTheDocument()
+      expect(
+        screen.getByText(`Allows 203.0.113.42/32, 198.51.100.0/24 and ${remainder}`),
+      ).toBeInTheDocument()
+      expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled()
+      expect(screen.getByRole('switch', { name: 'Web App' })).not.toHaveAttribute(
+        'aria-disabled',
+        'true',
+      )
 
-    await user.click(screen.getByRole('button', { name: 'Save' }))
-    expect(onSave).toHaveBeenCalledTimes(1)
-  })
+      await user.click(screen.getByRole('button', { name: 'Save' }))
+      expect(onSave).toHaveBeenCalledTimes(1)
+    },
+  )
 
   it.each([null, 'internal-network'])(
     'opens policy creation from the policy list with selected policy %s',
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 64f4122e946b6f..0f1ed87dbb1dd5 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -9,7 +9,14 @@ import type {
 } from '@dify/contracts/api/console/workspaces/types.gen'
 import { act, screen, waitFor, within } from '@testing-library/react'
 import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
+import { initReactI18next } from 'react-i18next'
 import { trackEvent } from '@/app/components/base/amplitude'
+import appOverviewTranslations from '@/i18n/locales/en-US/app-overview.json'
+import commonTranslations from '@/i18n/locales/en-US/common.json'
+import deploymentTranslations from '@/i18n/locales/en-US/deployments.json'
+import navigationTranslations from '@/i18n/locales/en-US/navigation.json'
+import toolsTranslations from '@/i18n/locales/en-US/tools.json'
 import { consoleQuery } from '@/service/console'
 import {
   createNetworkAccessGroupFixture,
@@ -23,29 +30,7 @@ import { AccessControlEntry } from '..'
 const mockSetPricing = vi.fn()
 vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
 const mockSetSettingsDestination = vi.fn()
-const accessControlTranslations = vi.hoisted(() => ({
-  'operation.back': 'Back',
-  'operation.cancel': 'Cancel',
-  'operation.close': 'Close',
-  'operation.save': 'Save',
-  'overview.apiInfo.title': 'Backend Service API',
-  'overview.appInfo.title': 'Web App',
-  'mcp.server.title': 'MCP Server',
-  'settings.ipPolicies': 'IP Policies',
-  'settings.ipPolicyAddEntry': 'Add',
-  'settings.ipPolicyAllowlist': 'Allowlist',
-  'settings.ipPolicyAllowlistHelp':
-    'Single addresses (203.0.113.42) or CIDR ranges (10.0.0.0/8). IPv4 and IPv6 are both accepted.',
-  'settings.ipPolicyCreate': 'Create',
-  'settings.ipPolicyDialogDescription':
-    'Specify which IP addresses or ranges can access your apps.',
-  'settings.ipPolicyName': 'Name',
-  'settings.ipPolicyNamePlaceholder': 'e.g. Internal Network',
-  'settings.ipPolicyNewTitle': 'New IP Policy',
-  'settings.ipPolicyRemoveEntry': 'Remove entry',
-  'settings.trigger': 'Trigger',
-  'operation.edit': 'Edit',
-}))
+vi.unmock('react-i18next')
 
 vi.mock('nuqs', async (importOriginal) => {
   const actual = await importOriginal<typeof import('nuqs')>()
@@ -58,17 +43,6 @@ vi.mock('nuqs', async (importOriginal) => {
   }
 })
 
-vi.mock('react-i18next', async () => {
-  const { createReactI18nextMock } = await import('@/test/i18n-mock')
-  const { default: deploymentTranslations } = await import('@/i18n/locales/en-US/deployments.json')
-  const { default: commonTranslations } = await import('@/i18n/locales/en-US/common.json')
-  return createReactI18nextMock({
-    ...commonTranslations,
-    ...accessControlTranslations,
-    ...deploymentTranslations,
-  })
-})
-
 const renderEntry = ({
   plan,
   deploymentEdition = 'CLOUD',
@@ -136,7 +110,24 @@ const metadataResponse = (request: Request) => {
     return Response.json({ client_ip: '203.0.113.42' })
 }
 
-beforeEach(() => {
+beforeEach(async () => {
+  await createInstance()
+    .use(initReactI18next)
+    .init({
+      lng: 'en-US',
+      fallbackLng: 'en-US',
+      keySeparator: false,
+      interpolation: { escapeValue: false },
+      resources: {
+        'en-US': {
+          appOverview: appOverviewTranslations,
+          common: commonTranslations,
+          deployments: deploymentTranslations,
+          navigation: navigationTranslations,
+          tools: toolsTranslations,
+        },
+      },
+    })
   const fallback = vi.mocked(globalThis.fetch).getMockImplementation()!
   vi.mocked(globalThis.fetch).mockImplementation(
     async (input, init) => metadataResponse(new Request(input, init)) ?? fallback(input, init),
@@ -552,11 +543,23 @@ describe('AccessControlEntry', () => {
     expect(mockSetPricing).not.toHaveBeenCalled()
   })
 
-  it('shows the saved binding status for a paid workspace', async () => {
+  it.each([
+    { addressCount: 3, remainder: '1 more address' },
+    { addressCount: 4, remainder: '2 more addresses' },
+  ])('shows a saved policy summary with $remainder', async ({ addressCount, remainder }) => {
     const user = userEvent.setup()
     renderEntry({
       plan: 'professional',
-      groups: [createNetworkAccessGroupFixture()],
+      groups: [
+        createNetworkAccessGroupFixture({
+          allowed_cidrs: [
+            '203.0.113.42/32',
+            '198.51.100.0/24',
+            '192.0.2.1/32',
+            '192.0.2.2/32',
+          ].slice(0, addressCount),
+        }),
+      ],
       binding: {
         id: 'binding-1',
         tenant_id: 'workspace-1',
@@ -573,6 +576,9 @@ describe('AccessControlEntry', () => {
     expect(within(getChip()).getByText('ON')).toBeInTheDocument()
     await user.click(getChip())
     expect(screen.getByText('Restricted to Internal Network')).toBeInTheDocument()
+    expect(
+      screen.getByText(`Allows 203.0.113.42/32, 198.51.100.0/24 and ${remainder}`),
+    ).toBeInTheDocument()
     expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeChecked()
   })
 
diff --git a/web/i18n/locales/ar-TN/deployments.json b/web/i18n/locales/ar-TN/deployments.json
index e3363c1c3b3589..4512c97fcc3dd4 100644
--- a/web/i18n/locales/ar-TN/deployments.json
+++ b/web/i18n/locales/ar-TN/deployments.json
@@ -59,7 +59,12 @@
   "studio.accessControl.paywallDescription": "اسمح بالوصول إلى هذا التطبيق من عناوين IP التي تثق بها فقط.",
   "studio.accessControl.paywallTitle": "التحكّم في الوصول",
   "studio.accessControl.policyChanged": "تغيّرت هذه السياسة. راجع التحذير قبل الحفظ مجددًا.",
-  "studio.accessControl.policySummaryMany": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_few": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_many": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_one": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_other": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_two": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_zero": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
   "studio.accessControl.policySummaryNone": "لا يسمح بأي عناوين",
   "studio.accessControl.policySummaryOne": "يسمح بـ {{address}}",
   "studio.accessControl.policySummaryTwo": "يسمح بـ {{first}} و{{second}}",
diff --git a/web/i18n/locales/az-AZ/deployments.json b/web/i18n/locales/az-AZ/deployments.json
index ffbc1bf2c7e1ac..6fd2d34668cac1 100644
--- a/web/i18n/locales/az-AZ/deployments.json
+++ b/web/i18n/locales/az-AZ/deployments.json
@@ -36,6 +36,8 @@
   "studio.accessControl.addressCount_other": "{{count}} ünvan",
   "studio.accessControl.createIpPolicy": "IP siyasəti yarat",
   "studio.accessControl.notEnabled": "Qorunmur",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} və daha {{count}} ünvana icazə verir",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} və daha {{count}} ünvana icazə verir",
   "studio.accessControl.selectAccessPoint": "Ən azı bir giriş nöqtəsi seçin.",
   "studio.accessControl.tooltipAllProtected": "Bütün {{total}} giriş nöqtəsi qorunur",
   "studio.accessControl.tooltipPaused": "Konfiqurasiya edilib, lakin müvəqqəti dayandırılıb",
diff --git a/web/i18n/locales/de-DE/deployments.json b/web/i18n/locales/de-DE/deployments.json
index 8c0f3e2cc20da2..238c2d15e1b5d2 100644
--- a/web/i18n/locales/de-DE/deployments.json
+++ b/web/i18n/locales/de-DE/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Beschränken Sie den Zugriff auf diese App auf vertrauenswürdige IP-Adressen.",
   "studio.accessControl.paywallTitle": "Zugriffskontrolle",
   "studio.accessControl.policyChanged": "Diese Richtlinie wurde geändert. Prüfen Sie die Warnung, bevor Sie erneut speichern.",
-  "studio.accessControl.policySummaryMany": "Erlaubt {{listed}} und {{count}} weitere Adressen",
+  "studio.accessControl.policySummaryMany_one": "Erlaubt {{listed}} und {{count}} weitere Adresse",
+  "studio.accessControl.policySummaryMany_other": "Erlaubt {{listed}} und {{count}} weitere Adressen",
   "studio.accessControl.policySummaryNone": "Erlaubt keine Adressen",
   "studio.accessControl.policySummaryOne": "Erlaubt {{address}}",
   "studio.accessControl.policySummaryTwo": "Erlaubt {{first}} und {{second}}",
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index bc2dc39f427763..fb5db0f650b9c9 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
   "studio.accessControl.policyChanged": "This policy changed. Review the warning before saving again.",
-  "studio.accessControl.policySummaryMany": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryMany_one": "Allows {{listed}} and {{count}} more address",
+  "studio.accessControl.policySummaryMany_other": "Allows {{listed}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
   "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
diff --git a/web/i18n/locales/es-ES/deployments.json b/web/i18n/locales/es-ES/deployments.json
index 92640a80dc6a2e..5eb7381dfff382 100644
--- a/web/i18n/locales/es-ES/deployments.json
+++ b/web/i18n/locales/es-ES/deployments.json
@@ -56,7 +56,9 @@
   "studio.accessControl.paywallDescription": "Restringe el acceso a esta aplicación a direcciones IP de confianza.",
   "studio.accessControl.paywallTitle": "Control de acceso",
   "studio.accessControl.policyChanged": "Esta política ha cambiado. Revisa la advertencia antes de volver a guardar.",
-  "studio.accessControl.policySummaryMany": "Permite {{listed}} y {{count}} direcciones más",
+  "studio.accessControl.policySummaryMany_many": "Permite {{listed}} y {{count}} direcciones más",
+  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} y {{count}} dirección más",
+  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} y {{count}} direcciones más",
   "studio.accessControl.policySummaryNone": "No permite ninguna dirección",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} y {{second}}",
diff --git a/web/i18n/locales/fa-IR/deployments.json b/web/i18n/locales/fa-IR/deployments.json
index 2b2f879c96d1c5..d9d9a32f68086e 100644
--- a/web/i18n/locales/fa-IR/deployments.json
+++ b/web/i18n/locales/fa-IR/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "دسترسی به این برنامه را به نشانی‌های IP مورد اعتماد خود محدود کنید.",
   "studio.accessControl.paywallTitle": "کنترل دسترسی",
   "studio.accessControl.policyChanged": "این خط‌مشی تغییر کرده است. پیش از ذخیره مجدد، هشدار را بررسی کنید.",
-  "studio.accessControl.policySummaryMany": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
   "studio.accessControl.policySummaryNone": "هیچ نشانی‌ای مجاز نیست",
   "studio.accessControl.policySummaryOne": "{{address}} را مجاز می‌کند",
   "studio.accessControl.policySummaryTwo": "{{first}} و {{second}} را مجاز می‌کند",
diff --git a/web/i18n/locales/fr-FR/deployments.json b/web/i18n/locales/fr-FR/deployments.json
index a2bb01cd99d214..52c146cdef3521 100644
--- a/web/i18n/locales/fr-FR/deployments.json
+++ b/web/i18n/locales/fr-FR/deployments.json
@@ -56,7 +56,9 @@
   "studio.accessControl.paywallDescription": "Limitez l’accès à cette application aux adresses IP de confiance.",
   "studio.accessControl.paywallTitle": "Contrôle d’accès",
   "studio.accessControl.policyChanged": "Cette politique a changé. Vérifiez l’avertissement avant d’enregistrer à nouveau.",
-  "studio.accessControl.policySummaryMany": "Autorise {{listed}} et {{count}} autres adresses",
+  "studio.accessControl.policySummaryMany_many": "Autorise {{listed}} et {{count}} autres adresses",
+  "studio.accessControl.policySummaryMany_one": "Autorise {{listed}} et {{count}} autre adresse",
+  "studio.accessControl.policySummaryMany_other": "Autorise {{listed}} et {{count}} autres adresses",
   "studio.accessControl.policySummaryNone": "N’autorise aucune adresse",
   "studio.accessControl.policySummaryOne": "Autorise {{address}}",
   "studio.accessControl.policySummaryTwo": "Autorise {{first}} et {{second}}",
diff --git a/web/i18n/locales/hi-IN/deployments.json b/web/i18n/locales/hi-IN/deployments.json
index a1eed234868eed..47ebfad182cca4 100644
--- a/web/i18n/locales/hi-IN/deployments.json
+++ b/web/i18n/locales/hi-IN/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "इस ऐप की पहुँच को केवल भरोसेमंद IP पतों तक सीमित करें।",
   "studio.accessControl.paywallTitle": "पहुँच नियंत्रण",
   "studio.accessControl.policyChanged": "यह नीति बदल गई है। दोबारा सहेजने से पहले चेतावनी की समीक्षा करें।",
-  "studio.accessControl.policySummaryMany": "{{listed}} और {{count}} अन्य पतों को अनुमति देता है",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} और {{count}} अन्य पते को अनुमति देता है",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} और {{count}} अन्य पतों को अनुमति देता है",
   "studio.accessControl.policySummaryNone": "किसी भी पते को अनुमति नहीं देता",
   "studio.accessControl.policySummaryOne": "{{address}} को अनुमति देता है",
   "studio.accessControl.policySummaryTwo": "{{first}} और {{second}} को अनुमति देता है",
diff --git a/web/i18n/locales/id-ID/deployments.json b/web/i18n/locales/id-ID/deployments.json
index c30b84039d6385..bd4d97ac709f5a 100644
--- a/web/i18n/locales/id-ID/deployments.json
+++ b/web/i18n/locales/id-ID/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Batasi akses ke aplikasi ini hanya untuk alamat IP yang Anda percayai.",
   "studio.accessControl.paywallTitle": "Kontrol akses",
   "studio.accessControl.policyChanged": "Kebijakan ini telah berubah. Tinjau peringatan sebelum menyimpan lagi.",
-  "studio.accessControl.policySummaryMany": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
+  "studio.accessControl.policySummaryMany_one": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
+  "studio.accessControl.policySummaryMany_other": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
   "studio.accessControl.policySummaryNone": "Tidak mengizinkan alamat apa pun",
   "studio.accessControl.policySummaryOne": "Mengizinkan {{address}}",
   "studio.accessControl.policySummaryTwo": "Mengizinkan {{first}} dan {{second}}",
diff --git a/web/i18n/locales/it-IT/deployments.json b/web/i18n/locales/it-IT/deployments.json
index 6448ad10a8060e..2ca2467b090df4 100644
--- a/web/i18n/locales/it-IT/deployments.json
+++ b/web/i18n/locales/it-IT/deployments.json
@@ -56,7 +56,9 @@
   "studio.accessControl.paywallDescription": "Limita l’accesso a questa app agli indirizzi IP di cui ti fidi.",
   "studio.accessControl.paywallTitle": "Controllo degli accessi",
   "studio.accessControl.policyChanged": "Questa policy è cambiata. Controlla l’avviso prima di salvare di nuovo.",
-  "studio.accessControl.policySummaryMany": "Consente {{listed}} e altri {{count}} indirizzi",
+  "studio.accessControl.policySummaryMany_many": "Consente {{listed}} e altri {{count}} indirizzi",
+  "studio.accessControl.policySummaryMany_one": "Consente {{listed}} e {{count}} altro indirizzo",
+  "studio.accessControl.policySummaryMany_other": "Consente {{listed}} e altri {{count}} indirizzi",
   "studio.accessControl.policySummaryNone": "Non consente alcun indirizzo",
   "studio.accessControl.policySummaryOne": "Consente {{address}}",
   "studio.accessControl.policySummaryTwo": "Consente {{first}} e {{second}}",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index 10748d8a9d7d66..e1a85081d7c45e 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
   "studio.accessControl.paywallTitle": "アクセス制御",
   "studio.accessControl.policyChanged": "このポリシーは変更されました。警告を確認してから再度保存してください。",
-  "studio.accessControl.policySummaryMany": "{{listed}} とさらに {{count}} 件のアドレスを許可",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} とさらに {{count}} 件のアドレスを許可",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} とさらに {{count}} 件のアドレスを許可",
   "studio.accessControl.policySummaryNone": "許可するアドレスはありません",
   "studio.accessControl.policySummaryOne": "{{address}} を許可",
   "studio.accessControl.policySummaryTwo": "{{first}} と {{second}} を許可",
diff --git a/web/i18n/locales/ko-KR/deployments.json b/web/i18n/locales/ko-KR/deployments.json
index b54fe50ba327ee..f3d8c2e69575e9 100644
--- a/web/i18n/locales/ko-KR/deployments.json
+++ b/web/i18n/locales/ko-KR/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "신뢰하는 IP 주소에서만 이 앱에 접근할 수 있도록 제한합니다.",
   "studio.accessControl.paywallTitle": "접근 제어",
   "studio.accessControl.policyChanged": "이 정책이 변경되었습니다. 다시 저장하기 전에 경고를 확인하세요.",
-  "studio.accessControl.policySummaryMany": "{{listed}} 및 {{count}}개의 추가 주소 허용",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} 및 {{count}}개의 추가 주소 허용",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} 및 {{count}}개의 추가 주소 허용",
   "studio.accessControl.policySummaryNone": "허용된 주소 없음",
   "studio.accessControl.policySummaryOne": "{{address}} 허용",
   "studio.accessControl.policySummaryTwo": "{{first}} 및 {{second}} 허용",
diff --git a/web/i18n/locales/lo-LA/deployments.json b/web/i18n/locales/lo-LA/deployments.json
index 82a343cf61f20d..6bd222772b8af0 100644
--- a/web/i18n/locales/lo-LA/deployments.json
+++ b/web/i18n/locales/lo-LA/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "ຈຳກັດການເຂົ້າເຖິງແອັບນີ້ໃຫ້ສະເພາະທີ່ຢູ່ IP ທີ່ທ່ານເຊື່ອຖື.",
   "studio.accessControl.paywallTitle": "ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.policyChanged": "ນະໂຍບາຍນີ້ໄດ້ປ່ຽນແປງແລ້ວ. ກວດເບິ່ງຄຳເຕືອນກ່ອນບັນທຶກອີກຄັ້ງ.",
-  "studio.accessControl.policySummaryMany": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
+  "studio.accessControl.policySummaryMany_one": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
+  "studio.accessControl.policySummaryMany_other": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
   "studio.accessControl.policySummaryNone": "ບໍ່ອະນຸຍາດທີ່ຢູ່ໃດເລີຍ",
   "studio.accessControl.policySummaryOne": "ອະນຸຍາດ {{address}}",
   "studio.accessControl.policySummaryTwo": "ອະນຸຍາດ {{first}} ແລະ {{second}}",
diff --git a/web/i18n/locales/nl-NL/deployments.json b/web/i18n/locales/nl-NL/deployments.json
index 53d06f8a01c862..d7cfc6ff20f717 100644
--- a/web/i18n/locales/nl-NL/deployments.json
+++ b/web/i18n/locales/nl-NL/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Beperk de toegang tot deze app tot IP-adressen die je vertrouwt.",
   "studio.accessControl.paywallTitle": "Toegangsbeheer",
   "studio.accessControl.policyChanged": "Dit beleid is gewijzigd. Bekijk de waarschuwing voordat je opnieuw opslaat.",
-  "studio.accessControl.policySummaryMany": "Staat {{listed}} en {{count}} andere adressen toe",
+  "studio.accessControl.policySummaryMany_one": "Staat {{listed}} en {{count}} ander adres toe",
+  "studio.accessControl.policySummaryMany_other": "Staat {{listed}} en {{count}} andere adressen toe",
   "studio.accessControl.policySummaryNone": "Staat geen adressen toe",
   "studio.accessControl.policySummaryOne": "Staat {{address}} toe",
   "studio.accessControl.policySummaryTwo": "Staat {{first}} en {{second}} toe",
diff --git a/web/i18n/locales/pl-PL/deployments.json b/web/i18n/locales/pl-PL/deployments.json
index 77b9f0771113f8..f2396cddfe2de9 100644
--- a/web/i18n/locales/pl-PL/deployments.json
+++ b/web/i18n/locales/pl-PL/deployments.json
@@ -57,7 +57,10 @@
   "studio.accessControl.paywallDescription": "Ogranicz dostęp do tej aplikacji do zaufanych adresów IP.",
   "studio.accessControl.paywallTitle": "Kontrola dostępu",
   "studio.accessControl.policyChanged": "Ta polityka uległa zmianie. Sprawdź ostrzeżenie przed ponownym zapisaniem.",
-  "studio.accessControl.policySummaryMany": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
   "studio.accessControl.policySummaryNone": "Nie zezwala na żadne adresy",
   "studio.accessControl.policySummaryOne": "Zezwala na {{address}}",
   "studio.accessControl.policySummaryTwo": "Zezwala na {{first}} i {{second}}",
diff --git a/web/i18n/locales/pt-BR/deployments.json b/web/i18n/locales/pt-BR/deployments.json
index 68c0efef67aa71..f6b7db2cfd08dc 100644
--- a/web/i18n/locales/pt-BR/deployments.json
+++ b/web/i18n/locales/pt-BR/deployments.json
@@ -56,7 +56,9 @@
   "studio.accessControl.paywallDescription": "Restrinja o acesso a este aplicativo a endereços IP confiáveis.",
   "studio.accessControl.paywallTitle": "Controle de acesso",
   "studio.accessControl.policyChanged": "Esta política mudou. Revise o aviso antes de salvar novamente.",
-  "studio.accessControl.policySummaryMany": "Permite {{listed}} e mais {{count}} endereços",
+  "studio.accessControl.policySummaryMany_many": "Permite {{listed}} e mais {{count}} endereços",
+  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} e mais {{count}} endereço",
+  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} e mais {{count}} endereços",
   "studio.accessControl.policySummaryNone": "Não permite nenhum endereço",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} e {{second}}",
diff --git a/web/i18n/locales/ro-RO/deployments.json b/web/i18n/locales/ro-RO/deployments.json
index 687d4a734db875..a9f7fc4cb30e07 100644
--- a/web/i18n/locales/ro-RO/deployments.json
+++ b/web/i18n/locales/ro-RO/deployments.json
@@ -56,7 +56,9 @@
   "studio.accessControl.paywallDescription": "Limitați accesul la această aplicație la adresele IP de încredere.",
   "studio.accessControl.paywallTitle": "Controlul accesului",
   "studio.accessControl.policyChanged": "Această politică s-a modificat. Verificați avertismentul înainte de a salva din nou.",
-  "studio.accessControl.policySummaryMany": "Permite {{listed}} și încă {{count}} adrese",
+  "studio.accessControl.policySummaryMany_few": "Permite {{listed}} și încă {{count}} adrese",
+  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} și încă {{count}} adresă",
+  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} și încă {{count}} de adrese",
   "studio.accessControl.policySummaryNone": "Nu permite nicio adresă",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} și {{second}}",
diff --git a/web/i18n/locales/ru-RU/deployments.json b/web/i18n/locales/ru-RU/deployments.json
index 6b74ca63302c01..a577554d8f21bf 100644
--- a/web/i18n/locales/ru-RU/deployments.json
+++ b/web/i18n/locales/ru-RU/deployments.json
@@ -57,7 +57,10 @@
   "studio.accessControl.paywallDescription": "Разрешите доступ к этому приложению только с доверенных IP-адресов.",
   "studio.accessControl.paywallTitle": "Контроль доступа",
   "studio.accessControl.policyChanged": "Эта политика изменилась. Прочитайте предупреждение перед повторным сохранением.",
-  "studio.accessControl.policySummaryMany": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
   "studio.accessControl.policySummaryNone": "Нет разрешённых адресов",
   "studio.accessControl.policySummaryOne": "Разрешён {{address}}",
   "studio.accessControl.policySummaryTwo": "Разрешены {{first}} и {{second}}",
diff --git a/web/i18n/locales/sl-SI/deployments.json b/web/i18n/locales/sl-SI/deployments.json
index 3ec18692c6a17f..11804d54fda253 100644
--- a/web/i18n/locales/sl-SI/deployments.json
+++ b/web/i18n/locales/sl-SI/deployments.json
@@ -57,7 +57,10 @@
   "studio.accessControl.paywallDescription": "Omejite dostop do te aplikacije na naslove IP, ki jim zaupate.",
   "studio.accessControl.paywallTitle": "Nadzor dostopa",
   "studio.accessControl.policyChanged": "Ta pravilnik se je spremenil. Pred ponovnim shranjevanjem preglejte opozorilo.",
-  "studio.accessControl.policySummaryMany": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_two": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
   "studio.accessControl.policySummaryNone": "Ne dovoljuje nobenega naslova",
   "studio.accessControl.policySummaryOne": "Dovoljuje {{address}}",
   "studio.accessControl.policySummaryTwo": "Dovoljuje {{first}} in {{second}}",
diff --git a/web/i18n/locales/th-TH/deployments.json b/web/i18n/locales/th-TH/deployments.json
index d7e9cfc9c7576c..a99d68d73815fd 100644
--- a/web/i18n/locales/th-TH/deployments.json
+++ b/web/i18n/locales/th-TH/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "จำกัดการเข้าถึงแอปนี้เฉพาะที่อยู่ IP ที่คุณเชื่อถือ",
   "studio.accessControl.paywallTitle": "การควบคุมการเข้าถึง",
   "studio.accessControl.policyChanged": "นโยบายนี้มีการเปลี่ยนแปลง โปรดตรวจสอบคำเตือนก่อนบันทึกอีกครั้ง",
-  "studio.accessControl.policySummaryMany": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
+  "studio.accessControl.policySummaryMany_one": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
+  "studio.accessControl.policySummaryMany_other": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
   "studio.accessControl.policySummaryNone": "ไม่อนุญาตที่อยู่ใดเลย",
   "studio.accessControl.policySummaryOne": "อนุญาต {{address}}",
   "studio.accessControl.policySummaryTwo": "อนุญาต {{first}} และ {{second}}",
diff --git a/web/i18n/locales/tr-TR/deployments.json b/web/i18n/locales/tr-TR/deployments.json
index 66fd830e65e824..20939e46ccbed1 100644
--- a/web/i18n/locales/tr-TR/deployments.json
+++ b/web/i18n/locales/tr-TR/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Bu uygulamaya erişimi güvendiğiniz IP adresleriyle sınırlayın.",
   "studio.accessControl.paywallTitle": "Erişim kontrolü",
   "studio.accessControl.policyChanged": "Bu politika değişti. Yeniden kaydetmeden önce uyarıyı inceleyin.",
-  "studio.accessControl.policySummaryMany": "{{listed}} ve {{count}} adrese daha izin verir",
+  "studio.accessControl.policySummaryMany_one": "{{listed}} ve {{count}} adrese daha izin verir",
+  "studio.accessControl.policySummaryMany_other": "{{listed}} ve {{count}} adrese daha izin verir",
   "studio.accessControl.policySummaryNone": "Hiçbir adrese izin vermez",
   "studio.accessControl.policySummaryOne": "{{address}} adresine izin verir",
   "studio.accessControl.policySummaryTwo": "{{first}} ve {{second}} adreslerine izin verir",
diff --git a/web/i18n/locales/uk-UA/deployments.json b/web/i18n/locales/uk-UA/deployments.json
index a2fa2fee19fa0b..a8ce718848969f 100644
--- a/web/i18n/locales/uk-UA/deployments.json
+++ b/web/i18n/locales/uk-UA/deployments.json
@@ -57,7 +57,10 @@
   "studio.accessControl.paywallDescription": "Дозвольте доступ до цього застосунку лише з довірених IP-адрес.",
   "studio.accessControl.paywallTitle": "Контроль доступу",
   "studio.accessControl.policyChanged": "Цю політику змінено. Перегляньте попередження перед повторним збереженням.",
-  "studio.accessControl.policySummaryMany": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Дозволено {{listed}} та додаткові адреси: {{count}}",
   "studio.accessControl.policySummaryNone": "Немає дозволених адрес",
   "studio.accessControl.policySummaryOne": "Дозволено {{address}}",
   "studio.accessControl.policySummaryTwo": "Дозволено {{first}} і {{second}}",
diff --git a/web/i18n/locales/vi-VN/deployments.json b/web/i18n/locales/vi-VN/deployments.json
index 7b3c72b73dc2e5..055ed8d3183756 100644
--- a/web/i18n/locales/vi-VN/deployments.json
+++ b/web/i18n/locales/vi-VN/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "Chỉ cho phép truy cập ứng dụng này từ các địa chỉ IP mà bạn tin cậy.",
   "studio.accessControl.paywallTitle": "Kiểm soát truy cập",
   "studio.accessControl.policyChanged": "Chính sách này đã thay đổi. Hãy xem lại cảnh báo trước khi lưu lại.",
-  "studio.accessControl.policySummaryMany": "Cho phép {{listed}} và {{count}} địa chỉ khác",
+  "studio.accessControl.policySummaryMany_one": "Cho phép {{listed}} và {{count}} địa chỉ khác",
+  "studio.accessControl.policySummaryMany_other": "Cho phép {{listed}} và {{count}} địa chỉ khác",
   "studio.accessControl.policySummaryNone": "Không cho phép địa chỉ nào",
   "studio.accessControl.policySummaryOne": "Cho phép {{address}}",
   "studio.accessControl.policySummaryTwo": "Cho phép {{first}} và {{second}}",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 58e12bfe176027..76c5787249979e 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
   "studio.accessControl.paywallTitle": "访问控制",
   "studio.accessControl.policyChanged": "此策略已发生变化，请确认风险提示后再次保存。",
-  "studio.accessControl.policySummaryMany": "允许 {{listed}} 以及另外 {{count}} 个地址",
+  "studio.accessControl.policySummaryMany_one": "允许 {{listed}} 以及另外 {{count}} 个地址",
+  "studio.accessControl.policySummaryMany_other": "允许 {{listed}} 以及另外 {{count}} 个地址",
   "studio.accessControl.policySummaryNone": "未允许任何地址",
   "studio.accessControl.policySummaryOne": "允许 {{address}}",
   "studio.accessControl.policySummaryTwo": "允许 {{first}} 和 {{second}}",
diff --git a/web/i18n/locales/zh-Hant/deployments.json b/web/i18n/locales/zh-Hant/deployments.json
index 7a020cce993a26..43f3b9d8606699 100644
--- a/web/i18n/locales/zh-Hant/deployments.json
+++ b/web/i18n/locales/zh-Hant/deployments.json
@@ -55,7 +55,8 @@
   "studio.accessControl.paywallDescription": "僅允許您信任的 IP 位址存取此應用程式。",
   "studio.accessControl.paywallTitle": "存取控制",
   "studio.accessControl.policyChanged": "此原則已變更，請確認風險提示後再次儲存。",
-  "studio.accessControl.policySummaryMany": "允許 {{listed}} 以及另外 {{count}} 個地址",
+  "studio.accessControl.policySummaryMany_one": "允許 {{listed}} 以及另外 {{count}} 個地址",
+  "studio.accessControl.policySummaryMany_other": "允許 {{listed}} 以及另外 {{count}} 個地址",
   "studio.accessControl.policySummaryNone": "未允許任何地址",
   "studio.accessControl.policySummaryOne": "允許 {{address}}",
   "studio.accessControl.policySummaryTwo": "允許 {{first}} 和 {{second}}",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 8654013504ad24..42631ee6e1bec9 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -3014,7 +3014,9 @@ export default interface Resources {
     'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.'
     'studio.accessControl.paywallTitle': 'Access Control'
     'studio.accessControl.policyChanged': 'This policy changed. Review the warning before saving again.'
-    'studio.accessControl.policySummaryMany': 'Allows {{listed}} and {{count}} more addresses'
+    'studio.accessControl.policySummaryMany':
+      | 'Allows {{listed}} and {{count}} more address'
+      | 'Allows {{listed}} and {{count}} more addresses'
     'studio.accessControl.policySummaryNone': 'Allows no addresses'
     'studio.accessControl.policySummaryOne': 'Allows {{address}}'
     'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}'

From fc821e212ce47630fbca97e823a9acb7767a639f Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Sat, 10 Oct 2026 18:29:24 +0800
Subject: [PATCH 090/108] fix(web): preserve IP policy address input (SNP-944)

---
 .../__tests__/policy-dialog.spec.tsx          | 20 ++++++++---
 .../__tests__/validate-ip-entry.spec.ts       | 33 ++++++++++++-------
 .../ip-policies-page/validate-ip-entry.ts     |  9 +----
 3 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
index 2acde90d3983ac..c1f331e738e3bc 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-dialog.spec.tsx
@@ -113,7 +113,7 @@ describe('IpPolicyDialog', () => {
 
     expect(onSubmit).toHaveBeenCalledWith({
       name: 'Internal Network',
-      allowed_cidrs: ['10.0.0.0/8', '203.0.113.42/32'],
+      allowed_cidrs: ['10.0.0.0/8', '203.0.113.42'],
     })
   })
 })
@@ -192,7 +192,7 @@ describe('trusted current IP and allowlist editing', () => {
   })
 
   it.each(['create', 'edit'] as const)(
-    'accepts a mapped IPv6 address in %s mode and submits it to the server',
+    'preserves address spelling and order when submitting in %s mode',
     async (mode) => {
       const user = userEvent.setup()
       const onSubmit = vi.fn()
@@ -201,7 +201,13 @@ describe('trusted current IP and allowlist editing', () => {
           open
           mode={mode}
           initialName="Office"
-          initialEntries={['::ffff:203.0.113.42/128']}
+          initialEntries={[
+            '192.168.1.1',
+            '10.0.0.0/8',
+            '2001:db8::1',
+            '2001:0DB8:0000:0000:0000:0000:0000:0001',
+            '::ffff:203.0.113.42/128',
+          ]}
           onOpenChange={vi.fn()}
           onSubmit={onSubmit}
         />,
@@ -209,7 +215,13 @@ describe('trusted current IP and allowlist editing', () => {
       await user.click(screen.getByRole('button', { name: mode === 'create' ? 'Create' : 'Save' }))
       expect(onSubmit).toHaveBeenCalledWith({
         name: 'Office',
-        allowed_cidrs: ['::ffff:203.0.113.42/128'],
+        allowed_cidrs: [
+          '192.168.1.1',
+          '10.0.0.0/8',
+          '2001:db8::1',
+          '2001:0DB8:0000:0000:0000:0000:0000:0001',
+          '::ffff:203.0.113.42/128',
+        ],
       })
     },
   )
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
index 1ad5c99d1a9d39..8b422a7397bff9 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/validate-ip-entry.spec.ts
@@ -5,7 +5,6 @@ import {
   IP_POLICY_CIDR_MAX_COUNT,
   IP_POLICY_NAME_MAX_LENGTH,
   isSameIpAddress,
-  toAllowedCidr,
   validateIpEntry,
 } from '../validate-ip-entry'
 
@@ -140,19 +139,29 @@ describe('collectIpAddresses', () => {
   })
 })
 
-describe('toAllowedCidr', () => {
-  it('appends /32 to bare IPv4 addresses and /128 to bare IPv6 addresses', () => {
-    expect(toAllowedCidr('203.0.113.42')).toBe('203.0.113.42/32')
-    expect(toAllowedCidr('::1')).toBe('::1/128')
-    expect(toAllowedCidr('10.0.0.0/8')).toBe('10.0.0.0/8')
-  })
-})
-
 describe('collectAllowedCidrs', () => {
-  it('normalizes submitted entries to CIDR notation', () => {
-    expect(collectAllowedCidrs([' 203.0.113.42 ', '', '10.0.0.0/8'])).toEqual([
-      '203.0.113.42/32',
+  it('preserves address spelling and order while trimming and dropping blank rows', () => {
+    expect(
+      collectAllowedCidrs([
+        ' 192.168.1.1 ',
+        '',
+        '10.0.0.0/8',
+        '2001:db8::1',
+        '2001:0DB8:0000:0000:0000:0000:0000:0001',
+        '::ffff:203.0.113.42',
+        '203.0.113.42/32',
+        '2001:db8::2/128',
+        '10.2.3.4/8',
+      ]),
+    ).toEqual([
+      '192.168.1.1',
       '10.0.0.0/8',
+      '2001:db8::1',
+      '2001:0DB8:0000:0000:0000:0000:0000:0001',
+      '::ffff:203.0.113.42',
+      '203.0.113.42/32',
+      '2001:db8::2/128',
+      '10.2.3.4/8',
     ])
   })
 })
diff --git a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
index 7563cdc6994631..92b8890dcb4773 100644
--- a/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
+++ b/web/app/components/header/account-setting/ip-policies-page/validate-ip-entry.ts
@@ -128,15 +128,8 @@ export function collectIpAddresses(entries: readonly string[]) {
   return entries.map((entry) => entry.trim()).filter((entry) => entry.length > 0)
 }
 
-export function toAllowedCidr(entry: string): string {
-  const value = entry.trim()
-  if (value.includes('/')) return value
-  if (value.includes(':')) return `${value}/128`
-  return `${value}/32`
-}
-
 export function collectAllowedCidrs(entries: readonly string[]) {
-  return collectIpAddresses(entries).map(toAllowedCidr)
+  return collectIpAddresses(entries)
 }
 
 /** Compare host entries, including compressed and IPv4-mapped IPv6, without matching ranges. */

From 3c7c41170a42ce8665d5e1eac69d3cde887759b4 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:38:31 +0800
Subject: [PATCH 091/108] fix(web): align IP access control translations
 (SNP-949)

---
 .../access-control/__tests__/index.spec.tsx   |  7 ++++++-
 .../access-control/policy-field.tsx           |  3 ++-
 .../access-control/status-panel.tsx           |  6 ++++--
 web/i18n/locales/ar-TN/deployments.json       | 13 ++++++------
 web/i18n/locales/az-AZ/deployments.json       |  5 +++--
 web/i18n/locales/de-DE/deployments.json       |  5 +++--
 web/i18n/locales/en-US/deployments.json       |  5 +++--
 web/i18n/locales/es-ES/deployments.json       |  7 ++++---
 web/i18n/locales/fa-IR/deployments.json       |  5 +++--
 web/i18n/locales/fr-FR/deployments.json       |  7 ++++---
 web/i18n/locales/hi-IN/deployments.json       |  5 +++--
 web/i18n/locales/id-ID/deployments.json       |  5 +++--
 web/i18n/locales/it-IT/deployments.json       |  7 ++++---
 web/i18n/locales/ja-JP/deployments.json       | 21 ++++++++++---------
 web/i18n/locales/ko-KR/deployments.json       |  5 +++--
 web/i18n/locales/lo-LA/deployments.json       |  5 +++--
 web/i18n/locales/nl-NL/deployments.json       |  5 +++--
 web/i18n/locales/pl-PL/deployments.json       |  9 ++++----
 web/i18n/locales/pt-BR/deployments.json       |  7 ++++---
 web/i18n/locales/ro-RO/deployments.json       |  7 ++++---
 web/i18n/locales/ru-RU/deployments.json       |  9 ++++----
 web/i18n/locales/sl-SI/deployments.json       |  9 ++++----
 web/i18n/locales/th-TH/deployments.json       |  5 +++--
 web/i18n/locales/tr-TR/deployments.json       |  5 +++--
 web/i18n/locales/uk-UA/deployments.json       |  9 ++++----
 web/i18n/locales/vi-VN/deployments.json       |  5 +++--
 web/i18n/locales/zh-Hans/common.json          |  4 ++--
 web/i18n/locales/zh-Hans/deployments.json     | 21 ++++++++++---------
 web/i18n/locales/zh-Hant/deployments.json     |  5 +++--
 web/i18n/resources.generated.d.ts             |  5 +++--
 30 files changed, 125 insertions(+), 91 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 0f1ed87dbb1dd5..ef1d44c4d551d5 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -1043,10 +1043,15 @@ describe('supported access points and binding permission', () => {
           expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument(),
         )
         expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).not.toBeChecked()
-        expect(screen.getByText('Configured but paused')).toBeInTheDocument()
+        expect(
+          screen.getByText('Paused — Internal Network is configured but not enforcing'),
+        ).toBeInTheDocument()
         expect(within(getChip()).getByText('Pause')).toBeInTheDocument()
         expect(screen.queryByText(/Protecting/)).not.toBeInTheDocument()
         expect(screen.queryByRole('button', { name: 'Cancel' })).not.toBeInTheDocument()
+        await waitFor(() =>
+          expect(screen.getByRole('switch', { name: 'Restrict by IP address' })).toBeEnabled(),
+        )
         await user.click(screen.getByRole('switch', { name: 'Restrict by IP address' }))
         await waitFor(() => expect(payloads).toHaveLength(2))
         expect(payloads[1]).toEqual({
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index 7cc984aeec613e..ff048fd5619f1b 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -230,7 +230,8 @@ export function AccessControlPolicyField({
               : summary.moreCount > 0
                 ? t(($) => $['studio.accessControl.policySummaryMany'], {
                     ns: 'deployments',
-                    listed: summary.listed.join(', '),
+                    first: summary.listed[0] ?? '',
+                    second: summary.listed[1] ?? '',
                     count: summary.moreCount,
                   })
                 : t(($) => $['studio.accessControl.policySummaryTwo'], {
diff --git a/web/app/components/app/access-point/access-control/status-panel.tsx b/web/app/components/app/access-point/access-control/status-panel.tsx
index 180a5cf78da947..9964b6510e309d 100644
--- a/web/app/components/app/access-point/access-control/status-panel.tsx
+++ b/web/app/components/app/access-point/access-control/status-panel.tsx
@@ -105,8 +105,9 @@ export function AccessControlStatusPanel({
             </FieldLabel>
             <p className="system-xs-regular text-text-tertiary">
               {!enabled
-                ? t(($) => $['studio.accessControl.tooltipPaused'], {
+                ? t(($) => $['studio.accessControl.pausedDescription'], {
                     ns: 'deployments',
+                    name: policyName ?? '',
                   })
                 : coverage.inServiceCount > 0 && coverage.coveredCount === coverage.inServiceCount
                   ? t(($) => $['studio.accessControl.protectingAll'], {
@@ -153,7 +154,8 @@ export function AccessControlStatusPanel({
                   : summary.moreCount > 0
                     ? t(($) => $['studio.accessControl.policySummaryMany'], {
                         ns: 'deployments',
-                        listed: summary.listed.join(', '),
+                        first: summary.listed[0] ?? '',
+                        second: summary.listed[1] ?? '',
                         count: summary.moreCount,
                       })
                     : t(($) => $['studio.accessControl.policySummaryTwo'], {
diff --git a/web/i18n/locales/ar-TN/deployments.json b/web/i18n/locales/ar-TN/deployments.json
index 4512c97fcc3dd4..4ab047e0c6bf27 100644
--- a/web/i18n/locales/ar-TN/deployments.json
+++ b/web/i18n/locales/ar-TN/deployments.json
@@ -56,15 +56,16 @@
   "studio.accessControl.lockoutWarning": "عنوان IP الخاص بك ({{ip}}) غير مشمول بهذه السياسة. قد تفقد إمكانية الوصول.",
   "studio.accessControl.manageIpPolicies": "إدارة سياسات IP",
   "studio.accessControl.notEnabled": "غير محمي",
+  "studio.accessControl.pausedDescription": "متوقفة مؤقتًا — تم إعداد {{name}} ولكنها غير مطبّقة",
   "studio.accessControl.paywallDescription": "اسمح بالوصول إلى هذا التطبيق من عناوين IP التي تثق بها فقط.",
   "studio.accessControl.paywallTitle": "التحكّم في الوصول",
   "studio.accessControl.policyChanged": "تغيّرت هذه السياسة. راجع التحذير قبل الحفظ مجددًا.",
-  "studio.accessControl.policySummaryMany_few": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
-  "studio.accessControl.policySummaryMany_many": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
-  "studio.accessControl.policySummaryMany_one": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
-  "studio.accessControl.policySummaryMany_other": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
-  "studio.accessControl.policySummaryMany_two": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
-  "studio.accessControl.policySummaryMany_zero": "يسمح بـ {{listed}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_few": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_many": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_one": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_other": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_two": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
+  "studio.accessControl.policySummaryMany_zero": "يسمح بـ {{first}}, {{second}} و{{count}} من العناوين الأخرى",
   "studio.accessControl.policySummaryNone": "لا يسمح بأي عناوين",
   "studio.accessControl.policySummaryOne": "يسمح بـ {{address}}",
   "studio.accessControl.policySummaryTwo": "يسمح بـ {{first}} و{{second}}",
diff --git a/web/i18n/locales/az-AZ/deployments.json b/web/i18n/locales/az-AZ/deployments.json
index 6fd2d34668cac1..a143deb19f372c 100644
--- a/web/i18n/locales/az-AZ/deployments.json
+++ b/web/i18n/locales/az-AZ/deployments.json
@@ -36,8 +36,9 @@
   "studio.accessControl.addressCount_other": "{{count}} ünvan",
   "studio.accessControl.createIpPolicy": "IP siyasəti yarat",
   "studio.accessControl.notEnabled": "Qorunmur",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} və daha {{count}} ünvana icazə verir",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} və daha {{count}} ünvana icazə verir",
+  "studio.accessControl.pausedDescription": "Dayandırılıb — {{name}} konfiqurasiya edilib, lakin tətbiq edilmir",
+  "studio.accessControl.policySummaryMany_one": "{{first}}, {{second}} və daha {{count}} ünvana icazə verir",
+  "studio.accessControl.policySummaryMany_other": "{{first}}, {{second}} və daha {{count}} ünvana icazə verir",
   "studio.accessControl.selectAccessPoint": "Ən azı bir giriş nöqtəsi seçin.",
   "studio.accessControl.tooltipAllProtected": "Bütün {{total}} giriş nöqtəsi qorunur",
   "studio.accessControl.tooltipPaused": "Konfiqurasiya edilib, lakin müvəqqəti dayandırılıb",
diff --git a/web/i18n/locales/de-DE/deployments.json b/web/i18n/locales/de-DE/deployments.json
index 238c2d15e1b5d2..1fbbd15900ded0 100644
--- a/web/i18n/locales/de-DE/deployments.json
+++ b/web/i18n/locales/de-DE/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "Ihre IP-Adresse ({{ip}}) ist nicht in dieser Richtlinie enthalten. Sie könnten den Zugriff verlieren.",
   "studio.accessControl.manageIpPolicies": "IP-Richtlinien verwalten",
   "studio.accessControl.notEnabled": "Nicht geschützt",
+  "studio.accessControl.pausedDescription": "Pausiert — {{name}} ist konfiguriert, wird aber nicht angewendet",
   "studio.accessControl.paywallDescription": "Beschränken Sie den Zugriff auf diese App auf vertrauenswürdige IP-Adressen.",
   "studio.accessControl.paywallTitle": "Zugriffskontrolle",
   "studio.accessControl.policyChanged": "Diese Richtlinie wurde geändert. Prüfen Sie die Warnung, bevor Sie erneut speichern.",
-  "studio.accessControl.policySummaryMany_one": "Erlaubt {{listed}} und {{count}} weitere Adresse",
-  "studio.accessControl.policySummaryMany_other": "Erlaubt {{listed}} und {{count}} weitere Adressen",
+  "studio.accessControl.policySummaryMany_one": "Erlaubt {{first}}, {{second}} und {{count}} weitere Adresse",
+  "studio.accessControl.policySummaryMany_other": "Erlaubt {{first}}, {{second}} und {{count}} weitere Adressen",
   "studio.accessControl.policySummaryNone": "Erlaubt keine Adressen",
   "studio.accessControl.policySummaryOne": "Erlaubt {{address}}",
   "studio.accessControl.policySummaryTwo": "Erlaubt {{first}} und {{second}}",
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index fb5db0f650b9c9..a0dee02cad75d9 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "Your IP ({{ip}}) isn't in this policy. You may lose access.",
   "studio.accessControl.manageIpPolicies": "Manage IP policies",
   "studio.accessControl.notEnabled": "Not protected",
+  "studio.accessControl.pausedDescription": "Paused — {{name}} is configured but not enforcing",
   "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
   "studio.accessControl.paywallTitle": "Access Control",
   "studio.accessControl.policyChanged": "This policy changed. Review the warning before saving again.",
-  "studio.accessControl.policySummaryMany_one": "Allows {{listed}} and {{count}} more address",
-  "studio.accessControl.policySummaryMany_other": "Allows {{listed}} and {{count}} more addresses",
+  "studio.accessControl.policySummaryMany_one": "Allows {{first}}, {{second}} and {{count}} more address",
+  "studio.accessControl.policySummaryMany_other": "Allows {{first}}, {{second}} and {{count}} more addresses",
   "studio.accessControl.policySummaryNone": "Allows no addresses",
   "studio.accessControl.policySummaryOne": "Allows {{address}}",
   "studio.accessControl.policySummaryTwo": "Allows {{first}} and {{second}}",
diff --git a/web/i18n/locales/es-ES/deployments.json b/web/i18n/locales/es-ES/deployments.json
index 5eb7381dfff382..d0a000eb460d9e 100644
--- a/web/i18n/locales/es-ES/deployments.json
+++ b/web/i18n/locales/es-ES/deployments.json
@@ -53,12 +53,13 @@
   "studio.accessControl.lockoutWarning": "Tu IP ({{ip}}) no está incluida en esta política. Podrías perder el acceso.",
   "studio.accessControl.manageIpPolicies": "Gestionar políticas de IP",
   "studio.accessControl.notEnabled": "Sin protección",
+  "studio.accessControl.pausedDescription": "En pausa — {{name}} está configurada, pero no se aplica",
   "studio.accessControl.paywallDescription": "Restringe el acceso a esta aplicación a direcciones IP de confianza.",
   "studio.accessControl.paywallTitle": "Control de acceso",
   "studio.accessControl.policyChanged": "Esta política ha cambiado. Revisa la advertencia antes de volver a guardar.",
-  "studio.accessControl.policySummaryMany_many": "Permite {{listed}} y {{count}} direcciones más",
-  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} y {{count}} dirección más",
-  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} y {{count}} direcciones más",
+  "studio.accessControl.policySummaryMany_many": "Permite {{first}}, {{second}} y {{count}} direcciones más",
+  "studio.accessControl.policySummaryMany_one": "Permite {{first}}, {{second}} y {{count}} dirección más",
+  "studio.accessControl.policySummaryMany_other": "Permite {{first}}, {{second}} y {{count}} direcciones más",
   "studio.accessControl.policySummaryNone": "No permite ninguna dirección",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} y {{second}}",
diff --git a/web/i18n/locales/fa-IR/deployments.json b/web/i18n/locales/fa-IR/deployments.json
index d9d9a32f68086e..4450c2d09c79a8 100644
--- a/web/i18n/locales/fa-IR/deployments.json
+++ b/web/i18n/locales/fa-IR/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "نشانی IP شما ({{ip}}) در این خط‌مشی نیست. ممکن است دسترسی خود را از دست بدهید.",
   "studio.accessControl.manageIpPolicies": "مدیریت خط‌مشی‌های IP",
   "studio.accessControl.notEnabled": "محافظت نمی‌شود",
+  "studio.accessControl.pausedDescription": "متوقف شده — {{name}} پیکربندی شده است اما اعمال نمی‌شود",
   "studio.accessControl.paywallDescription": "دسترسی به این برنامه را به نشانی‌های IP مورد اعتماد خود محدود کنید.",
   "studio.accessControl.paywallTitle": "کنترل دسترسی",
   "studio.accessControl.policyChanged": "این خط‌مشی تغییر کرده است. پیش از ذخیره مجدد، هشدار را بررسی کنید.",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} و {{count}} نشانی دیگر را مجاز می‌کند",
+  "studio.accessControl.policySummaryMany_one": "{{first}}, {{second}} و {{count}} نشانی دیگر را مجاز می‌کند",
+  "studio.accessControl.policySummaryMany_other": "{{first}}, {{second}} و {{count}} نشانی دیگر را مجاز می‌کند",
   "studio.accessControl.policySummaryNone": "هیچ نشانی‌ای مجاز نیست",
   "studio.accessControl.policySummaryOne": "{{address}} را مجاز می‌کند",
   "studio.accessControl.policySummaryTwo": "{{first}} و {{second}} را مجاز می‌کند",
diff --git a/web/i18n/locales/fr-FR/deployments.json b/web/i18n/locales/fr-FR/deployments.json
index 52c146cdef3521..9f3ca2d2bfca55 100644
--- a/web/i18n/locales/fr-FR/deployments.json
+++ b/web/i18n/locales/fr-FR/deployments.json
@@ -53,12 +53,13 @@
   "studio.accessControl.lockoutWarning": "Votre IP ({{ip}}) n’est pas incluse dans cette politique. Vous risquez de perdre l’accès.",
   "studio.accessControl.manageIpPolicies": "Gérer les politiques IP",
   "studio.accessControl.notEnabled": "Non protégé",
+  "studio.accessControl.pausedDescription": "En pause — {{name}} est configurée, mais n’est pas appliquée",
   "studio.accessControl.paywallDescription": "Limitez l’accès à cette application aux adresses IP de confiance.",
   "studio.accessControl.paywallTitle": "Contrôle d’accès",
   "studio.accessControl.policyChanged": "Cette politique a changé. Vérifiez l’avertissement avant d’enregistrer à nouveau.",
-  "studio.accessControl.policySummaryMany_many": "Autorise {{listed}} et {{count}} autres adresses",
-  "studio.accessControl.policySummaryMany_one": "Autorise {{listed}} et {{count}} autre adresse",
-  "studio.accessControl.policySummaryMany_other": "Autorise {{listed}} et {{count}} autres adresses",
+  "studio.accessControl.policySummaryMany_many": "Autorise {{first}}, {{second}} et {{count}} autres adresses",
+  "studio.accessControl.policySummaryMany_one": "Autorise {{first}}, {{second}} et {{count}} autre adresse",
+  "studio.accessControl.policySummaryMany_other": "Autorise {{first}}, {{second}} et {{count}} autres adresses",
   "studio.accessControl.policySummaryNone": "N’autorise aucune adresse",
   "studio.accessControl.policySummaryOne": "Autorise {{address}}",
   "studio.accessControl.policySummaryTwo": "Autorise {{first}} et {{second}}",
diff --git a/web/i18n/locales/hi-IN/deployments.json b/web/i18n/locales/hi-IN/deployments.json
index 47ebfad182cca4..bd8fdb6dc9a9ce 100644
--- a/web/i18n/locales/hi-IN/deployments.json
+++ b/web/i18n/locales/hi-IN/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "आपका IP ({{ip}}) इस नीति में शामिल नहीं है। आप पहुँच खो सकते हैं।",
   "studio.accessControl.manageIpPolicies": "IP नीतियाँ प्रबंधित करें",
   "studio.accessControl.notEnabled": "सुरक्षित नहीं है",
+  "studio.accessControl.pausedDescription": "रोका गया — {{name}} कॉन्फ़िगर की गई है, लेकिन लागू नहीं है",
   "studio.accessControl.paywallDescription": "इस ऐप की पहुँच को केवल भरोसेमंद IP पतों तक सीमित करें।",
   "studio.accessControl.paywallTitle": "पहुँच नियंत्रण",
   "studio.accessControl.policyChanged": "यह नीति बदल गई है। दोबारा सहेजने से पहले चेतावनी की समीक्षा करें।",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} और {{count}} अन्य पते को अनुमति देता है",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} और {{count}} अन्य पतों को अनुमति देता है",
+  "studio.accessControl.policySummaryMany_one": "{{first}}, {{second}} और {{count}} अन्य पते को अनुमति देता है",
+  "studio.accessControl.policySummaryMany_other": "{{first}}, {{second}} और {{count}} अन्य पतों को अनुमति देता है",
   "studio.accessControl.policySummaryNone": "किसी भी पते को अनुमति नहीं देता",
   "studio.accessControl.policySummaryOne": "{{address}} को अनुमति देता है",
   "studio.accessControl.policySummaryTwo": "{{first}} और {{second}} को अनुमति देता है",
diff --git a/web/i18n/locales/id-ID/deployments.json b/web/i18n/locales/id-ID/deployments.json
index bd4d97ac709f5a..38318b8f4f095f 100644
--- a/web/i18n/locales/id-ID/deployments.json
+++ b/web/i18n/locales/id-ID/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "IP Anda ({{ip}}) tidak tercakup dalam kebijakan ini. Anda mungkin kehilangan akses.",
   "studio.accessControl.manageIpPolicies": "Kelola kebijakan IP",
   "studio.accessControl.notEnabled": "Tidak dilindungi",
+  "studio.accessControl.pausedDescription": "Dijeda — {{name}} sudah dikonfigurasi tetapi belum diterapkan",
   "studio.accessControl.paywallDescription": "Batasi akses ke aplikasi ini hanya untuk alamat IP yang Anda percayai.",
   "studio.accessControl.paywallTitle": "Kontrol akses",
   "studio.accessControl.policyChanged": "Kebijakan ini telah berubah. Tinjau peringatan sebelum menyimpan lagi.",
-  "studio.accessControl.policySummaryMany_one": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
-  "studio.accessControl.policySummaryMany_other": "Mengizinkan {{listed}} dan {{count}} alamat lainnya",
+  "studio.accessControl.policySummaryMany_one": "Mengizinkan {{first}}, {{second}} dan {{count}} alamat lainnya",
+  "studio.accessControl.policySummaryMany_other": "Mengizinkan {{first}}, {{second}} dan {{count}} alamat lainnya",
   "studio.accessControl.policySummaryNone": "Tidak mengizinkan alamat apa pun",
   "studio.accessControl.policySummaryOne": "Mengizinkan {{address}}",
   "studio.accessControl.policySummaryTwo": "Mengizinkan {{first}} dan {{second}}",
diff --git a/web/i18n/locales/it-IT/deployments.json b/web/i18n/locales/it-IT/deployments.json
index 2ca2467b090df4..33781ce34ce753 100644
--- a/web/i18n/locales/it-IT/deployments.json
+++ b/web/i18n/locales/it-IT/deployments.json
@@ -53,12 +53,13 @@
   "studio.accessControl.lockoutWarning": "Il tuo IP ({{ip}}) non è incluso in questa policy. Potresti perdere l’accesso.",
   "studio.accessControl.manageIpPolicies": "Gestisci le policy IP",
   "studio.accessControl.notEnabled": "Non protetto",
+  "studio.accessControl.pausedDescription": "In pausa — {{name}} è configurata ma non viene applicata",
   "studio.accessControl.paywallDescription": "Limita l’accesso a questa app agli indirizzi IP di cui ti fidi.",
   "studio.accessControl.paywallTitle": "Controllo degli accessi",
   "studio.accessControl.policyChanged": "Questa policy è cambiata. Controlla l’avviso prima di salvare di nuovo.",
-  "studio.accessControl.policySummaryMany_many": "Consente {{listed}} e altri {{count}} indirizzi",
-  "studio.accessControl.policySummaryMany_one": "Consente {{listed}} e {{count}} altro indirizzo",
-  "studio.accessControl.policySummaryMany_other": "Consente {{listed}} e altri {{count}} indirizzi",
+  "studio.accessControl.policySummaryMany_many": "Consente {{first}}, {{second}} e altri {{count}} indirizzi",
+  "studio.accessControl.policySummaryMany_one": "Consente {{first}}, {{second}} e {{count}} altro indirizzo",
+  "studio.accessControl.policySummaryMany_other": "Consente {{first}}, {{second}} e altri {{count}} indirizzi",
   "studio.accessControl.policySummaryNone": "Non consente alcun indirizzo",
   "studio.accessControl.policySummaryOne": "Consente {{address}}",
   "studio.accessControl.policySummaryTwo": "Consente {{first}} e {{second}}",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index e1a85081d7c45e..7424a7395f4649 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -49,39 +49,40 @@
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
   "studio.accessControl.ipPolicy": "IP ポリシー",
-  "studio.accessControl.lockoutWarning": "あなたの IP（{{ip}}）はこのポリシーに含まれていません。アクセスできなくなる可能性があります。",
+  "studio.accessControl.lockoutWarning": "お使いの IP（{{ip}}）はこのポリシーに含まれていません。アクセスできなくなる可能性があります。",
   "studio.accessControl.manageIpPolicies": "IP ポリシーを管理",
   "studio.accessControl.notEnabled": "保護されていません",
+  "studio.accessControl.pausedDescription": "一時停止中、{{name}} は設定済みですが適用されていません",
   "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
   "studio.accessControl.paywallTitle": "アクセス制御",
   "studio.accessControl.policyChanged": "このポリシーは変更されました。警告を確認してから再度保存してください。",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} とさらに {{count}} 件のアドレスを許可",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} とさらに {{count}} 件のアドレスを許可",
+  "studio.accessControl.policySummaryMany_one": "{{first}}、{{second}} と他 {{count}} 件のアドレスを許可",
+  "studio.accessControl.policySummaryMany_other": "{{first}}、{{second}} と他 {{count}} 件のアドレスを許可",
   "studio.accessControl.policySummaryNone": "許可するアドレスはありません",
   "studio.accessControl.policySummaryOne": "{{address}} を許可",
   "studio.accessControl.policySummaryTwo": "{{first}} と {{second}} を許可",
   "studio.accessControl.previewAppName": "コードコンパニオン",
   "studio.accessControl.previewCaption": "このアプリは、組織のネットワーク上でのみ利用できます。",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "稼働中のアクセスポイント {{count}} 件すべてを保護しています。",
-  "studio.accessControl.protectingPartial": "稼働中のアクセスポイント {{m}} 件中 {{n}} 件を保護しています。",
+  "studio.accessControl.protectingAll": "{{count}} 個のアクセスポイントすべてを保護中",
+  "studio.accessControl.protectingPartial": "アクセスポイント {{m}} 個中 {{n}} 個を保護中",
   "studio.accessControl.protectsCoverage": "{{n}} / {{m}} 個のアクセスポイントを保護",
   "studio.accessControl.readyToResume": "再開できます",
   "studio.accessControl.restrictByIp": "IP アドレスで制限",
-  "studio.accessControl.restrictedTo": "{{name}} に制限",
+  "studio.accessControl.restrictedTo": "{{name}} に制限中",
   "studio.accessControl.saveAnyway": "保存する",
   "studio.accessControl.saveWithoutOwnIp": "自分の IP を含めずに保存しますか？",
   "studio.accessControl.selectAccessPoint": "少なくとも 1 つのアクセスポイントを選択してください。",
   "studio.accessControl.selectPolicy": "IP ポリシーを選択",
   "studio.accessControl.selectPolicyRequired": "IP ポリシーを選択してください。",
-  "studio.accessControl.tooltipAllProtected": "{{total}} 個すべてのアクセスポイントが保護されています",
+  "studio.accessControl.tooltipAllProtected": "{{total}} 個のアクセスポイントすべてが保護されています",
   "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます",
   "studio.accessControl.tooltipOff": "未設定",
-  "studio.accessControl.tooltipPaused": "設定済みですが一時停止中です",
+  "studio.accessControl.tooltipPaused": "設定済み、一時停止中",
   "studio.accessControl.tooltipPro": "アクセス制御は Professional および Team プランで利用できます。",
-  "studio.accessControl.tooltipProtected": "{{total}} 個のアクセスポイントのうち {{n}} 個が保護されています",
+  "studio.accessControl.tooltipProtected": "アクセスポイント {{total}} 個中 {{n}} 個が保護されています",
   "studio.accessControl.turnOffConfirm": "オフにする",
-  "studio.accessControl.turnOffDescription": "すべてのアクセスポイントが任意の IP アドレスからアクセス可能になります。設定は保持されます。",
+  "studio.accessControl.turnOffDescription": "すべてのアクセスポイントが任意の IP アドレスからアクセス可能になります。設定内容は保持されます。",
   "studio.accessControl.turnOffTitle": "IP アクセス制御をオフにしますか？",
   "studio.accessControl.turnOn": "アクセス制御をオンにする",
   "studio.accessControl.viewIpPolicies": "IP ポリシーを表示",
diff --git a/web/i18n/locales/ko-KR/deployments.json b/web/i18n/locales/ko-KR/deployments.json
index f3d8c2e69575e9..a391d83346458d 100644
--- a/web/i18n/locales/ko-KR/deployments.json
+++ b/web/i18n/locales/ko-KR/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "현재 IP({{ip}})가 이 정책에 포함되어 있지 않습니다. 접근 권한을 잃을 수 있습니다.",
   "studio.accessControl.manageIpPolicies": "IP 정책 관리",
   "studio.accessControl.notEnabled": "보호되지 않음",
+  "studio.accessControl.pausedDescription": "일시 중지됨 — {{name}} 정책이 설정되어 있지만 적용되지 않습니다",
   "studio.accessControl.paywallDescription": "신뢰하는 IP 주소에서만 이 앱에 접근할 수 있도록 제한합니다.",
   "studio.accessControl.paywallTitle": "접근 제어",
   "studio.accessControl.policyChanged": "이 정책이 변경되었습니다. 다시 저장하기 전에 경고를 확인하세요.",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} 및 {{count}}개의 추가 주소 허용",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} 및 {{count}}개의 추가 주소 허용",
+  "studio.accessControl.policySummaryMany_one": "{{first}}, {{second}} 및 {{count}}개의 추가 주소 허용",
+  "studio.accessControl.policySummaryMany_other": "{{first}}, {{second}} 및 {{count}}개의 추가 주소 허용",
   "studio.accessControl.policySummaryNone": "허용된 주소 없음",
   "studio.accessControl.policySummaryOne": "{{address}} 허용",
   "studio.accessControl.policySummaryTwo": "{{first}} 및 {{second}} 허용",
diff --git a/web/i18n/locales/lo-LA/deployments.json b/web/i18n/locales/lo-LA/deployments.json
index 6bd222772b8af0..b5cafe6ecc9db8 100644
--- a/web/i18n/locales/lo-LA/deployments.json
+++ b/web/i18n/locales/lo-LA/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "IP ຂອງທ່ານ ({{ip}}) ບໍ່ຢູ່ໃນນະໂຍບາຍນີ້. ທ່ານອາດສູນເສຍສິດເຂົ້າເຖິງ.",
   "studio.accessControl.manageIpPolicies": "ຈັດການນະໂຍບາຍ IP",
   "studio.accessControl.notEnabled": "ບໍ່ໄດ້ຮັບການປົກປ້ອງ",
+  "studio.accessControl.pausedDescription": "ຢຸດຊົ່ວຄາວ — {{name}} ຖືກຕັ້ງຄ່າແລ້ວ ແຕ່ຍັງບໍ່ໄດ້ນຳໃຊ້",
   "studio.accessControl.paywallDescription": "ຈຳກັດການເຂົ້າເຖິງແອັບນີ້ໃຫ້ສະເພາະທີ່ຢູ່ IP ທີ່ທ່ານເຊື່ອຖື.",
   "studio.accessControl.paywallTitle": "ການຄວບຄຸມການເຂົ້າເຖິງ",
   "studio.accessControl.policyChanged": "ນະໂຍບາຍນີ້ໄດ້ປ່ຽນແປງແລ້ວ. ກວດເບິ່ງຄຳເຕືອນກ່ອນບັນທຶກອີກຄັ້ງ.",
-  "studio.accessControl.policySummaryMany_one": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
-  "studio.accessControl.policySummaryMany_other": "ອະນຸຍາດ {{listed}} ແລະອີກ {{count}} ທີ່ຢູ່",
+  "studio.accessControl.policySummaryMany_one": "ອະນຸຍາດ {{first}}, {{second}} ແລະອີກ {{count}} ທີ່ຢູ່",
+  "studio.accessControl.policySummaryMany_other": "ອະນຸຍາດ {{first}}, {{second}} ແລະອີກ {{count}} ທີ່ຢູ່",
   "studio.accessControl.policySummaryNone": "ບໍ່ອະນຸຍາດທີ່ຢູ່ໃດເລີຍ",
   "studio.accessControl.policySummaryOne": "ອະນຸຍາດ {{address}}",
   "studio.accessControl.policySummaryTwo": "ອະນຸຍາດ {{first}} ແລະ {{second}}",
diff --git a/web/i18n/locales/nl-NL/deployments.json b/web/i18n/locales/nl-NL/deployments.json
index d7cfc6ff20f717..40ce0e7aa58c17 100644
--- a/web/i18n/locales/nl-NL/deployments.json
+++ b/web/i18n/locales/nl-NL/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "Je IP-adres ({{ip}}) staat niet in dit beleid. Je kunt de toegang verliezen.",
   "studio.accessControl.manageIpPolicies": "IP-beleid beheren",
   "studio.accessControl.notEnabled": "Niet beschermd",
+  "studio.accessControl.pausedDescription": "Gepauzeerd — {{name}} is geconfigureerd, maar wordt niet toegepast",
   "studio.accessControl.paywallDescription": "Beperk de toegang tot deze app tot IP-adressen die je vertrouwt.",
   "studio.accessControl.paywallTitle": "Toegangsbeheer",
   "studio.accessControl.policyChanged": "Dit beleid is gewijzigd. Bekijk de waarschuwing voordat je opnieuw opslaat.",
-  "studio.accessControl.policySummaryMany_one": "Staat {{listed}} en {{count}} ander adres toe",
-  "studio.accessControl.policySummaryMany_other": "Staat {{listed}} en {{count}} andere adressen toe",
+  "studio.accessControl.policySummaryMany_one": "Staat {{first}}, {{second}} en {{count}} ander adres toe",
+  "studio.accessControl.policySummaryMany_other": "Staat {{first}}, {{second}} en {{count}} andere adressen toe",
   "studio.accessControl.policySummaryNone": "Staat geen adressen toe",
   "studio.accessControl.policySummaryOne": "Staat {{address}} toe",
   "studio.accessControl.policySummaryTwo": "Staat {{first}} en {{second}} toe",
diff --git a/web/i18n/locales/pl-PL/deployments.json b/web/i18n/locales/pl-PL/deployments.json
index f2396cddfe2de9..4b4d96c1c3f725 100644
--- a/web/i18n/locales/pl-PL/deployments.json
+++ b/web/i18n/locales/pl-PL/deployments.json
@@ -54,13 +54,14 @@
   "studio.accessControl.lockoutWarning": "Twój adres IP ({{ip}}) nie jest uwzględniony w tej polityce. Możesz utracić dostęp.",
   "studio.accessControl.manageIpPolicies": "Zarządzaj politykami IP",
   "studio.accessControl.notEnabled": "Brak ochrony",
+  "studio.accessControl.pausedDescription": "Wstrzymano — {{name}} jest skonfigurowana, ale nie jest stosowana",
   "studio.accessControl.paywallDescription": "Ogranicz dostęp do tej aplikacji do zaufanych adresów IP.",
   "studio.accessControl.paywallTitle": "Kontrola dostępu",
   "studio.accessControl.policyChanged": "Ta polityka uległa zmianie. Sprawdź ostrzeżenie przed ponownym zapisaniem.",
-  "studio.accessControl.policySummaryMany_few": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
-  "studio.accessControl.policySummaryMany_many": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
-  "studio.accessControl.policySummaryMany_one": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
-  "studio.accessControl.policySummaryMany_other": "Zezwala na {{listed}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Zezwala na {{first}}, {{second}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Zezwala na {{first}}, {{second}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Zezwala na {{first}}, {{second}} oraz dodatkowe adresy: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Zezwala na {{first}}, {{second}} oraz dodatkowe adresy: {{count}}",
   "studio.accessControl.policySummaryNone": "Nie zezwala na żadne adresy",
   "studio.accessControl.policySummaryOne": "Zezwala na {{address}}",
   "studio.accessControl.policySummaryTwo": "Zezwala na {{first}} i {{second}}",
diff --git a/web/i18n/locales/pt-BR/deployments.json b/web/i18n/locales/pt-BR/deployments.json
index f6b7db2cfd08dc..e5a38e2f73bbb3 100644
--- a/web/i18n/locales/pt-BR/deployments.json
+++ b/web/i18n/locales/pt-BR/deployments.json
@@ -53,12 +53,13 @@
   "studio.accessControl.lockoutWarning": "Seu IP ({{ip}}) não está incluído nesta política. Você pode perder o acesso.",
   "studio.accessControl.manageIpPolicies": "Gerenciar políticas de IP",
   "studio.accessControl.notEnabled": "Sem proteção",
+  "studio.accessControl.pausedDescription": "Pausada — {{name}} está configurada, mas não está sendo aplicada",
   "studio.accessControl.paywallDescription": "Restrinja o acesso a este aplicativo a endereços IP confiáveis.",
   "studio.accessControl.paywallTitle": "Controle de acesso",
   "studio.accessControl.policyChanged": "Esta política mudou. Revise o aviso antes de salvar novamente.",
-  "studio.accessControl.policySummaryMany_many": "Permite {{listed}} e mais {{count}} endereços",
-  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} e mais {{count}} endereço",
-  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} e mais {{count}} endereços",
+  "studio.accessControl.policySummaryMany_many": "Permite {{first}}, {{second}} e mais {{count}} endereços",
+  "studio.accessControl.policySummaryMany_one": "Permite {{first}}, {{second}} e mais {{count}} endereço",
+  "studio.accessControl.policySummaryMany_other": "Permite {{first}}, {{second}} e mais {{count}} endereços",
   "studio.accessControl.policySummaryNone": "Não permite nenhum endereço",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} e {{second}}",
diff --git a/web/i18n/locales/ro-RO/deployments.json b/web/i18n/locales/ro-RO/deployments.json
index a9f7fc4cb30e07..dbc83f03bab9d6 100644
--- a/web/i18n/locales/ro-RO/deployments.json
+++ b/web/i18n/locales/ro-RO/deployments.json
@@ -53,12 +53,13 @@
   "studio.accessControl.lockoutWarning": "Adresa dvs. IP ({{ip}}) nu este inclusă în această politică. Puteți pierde accesul.",
   "studio.accessControl.manageIpPolicies": "Gestionați politicile IP",
   "studio.accessControl.notEnabled": "Neprotejat",
+  "studio.accessControl.pausedDescription": "În pauză — {{name}} este configurată, dar nu este aplicată",
   "studio.accessControl.paywallDescription": "Limitați accesul la această aplicație la adresele IP de încredere.",
   "studio.accessControl.paywallTitle": "Controlul accesului",
   "studio.accessControl.policyChanged": "Această politică s-a modificat. Verificați avertismentul înainte de a salva din nou.",
-  "studio.accessControl.policySummaryMany_few": "Permite {{listed}} și încă {{count}} adrese",
-  "studio.accessControl.policySummaryMany_one": "Permite {{listed}} și încă {{count}} adresă",
-  "studio.accessControl.policySummaryMany_other": "Permite {{listed}} și încă {{count}} de adrese",
+  "studio.accessControl.policySummaryMany_few": "Permite {{first}}, {{second}} și încă {{count}} adrese",
+  "studio.accessControl.policySummaryMany_one": "Permite {{first}}, {{second}} și încă {{count}} adresă",
+  "studio.accessControl.policySummaryMany_other": "Permite {{first}}, {{second}} și încă {{count}} de adrese",
   "studio.accessControl.policySummaryNone": "Nu permite nicio adresă",
   "studio.accessControl.policySummaryOne": "Permite {{address}}",
   "studio.accessControl.policySummaryTwo": "Permite {{first}} și {{second}}",
diff --git a/web/i18n/locales/ru-RU/deployments.json b/web/i18n/locales/ru-RU/deployments.json
index a577554d8f21bf..feafe41f7a7430 100644
--- a/web/i18n/locales/ru-RU/deployments.json
+++ b/web/i18n/locales/ru-RU/deployments.json
@@ -54,13 +54,14 @@
   "studio.accessControl.lockoutWarning": "Ваш IP-адрес ({{ip}}) не включён в эту политику. Вы можете потерять доступ.",
   "studio.accessControl.manageIpPolicies": "Управление IP-политиками",
   "studio.accessControl.notEnabled": "Не защищено",
+  "studio.accessControl.pausedDescription": "Приостановлено — {{name}} настроена, но не применяется",
   "studio.accessControl.paywallDescription": "Разрешите доступ к этому приложению только с доверенных IP-адресов.",
   "studio.accessControl.paywallTitle": "Контроль доступа",
   "studio.accessControl.policyChanged": "Эта политика изменилась. Прочитайте предупреждение перед повторным сохранением.",
-  "studio.accessControl.policySummaryMany_few": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
-  "studio.accessControl.policySummaryMany_many": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
-  "studio.accessControl.policySummaryMany_one": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
-  "studio.accessControl.policySummaryMany_other": "Разрешены {{listed}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Разрешены {{first}}, {{second}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Разрешены {{first}}, {{second}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Разрешены {{first}}, {{second}} и дополнительные адреса: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Разрешены {{first}}, {{second}} и дополнительные адреса: {{count}}",
   "studio.accessControl.policySummaryNone": "Нет разрешённых адресов",
   "studio.accessControl.policySummaryOne": "Разрешён {{address}}",
   "studio.accessControl.policySummaryTwo": "Разрешены {{first}} и {{second}}",
diff --git a/web/i18n/locales/sl-SI/deployments.json b/web/i18n/locales/sl-SI/deployments.json
index 11804d54fda253..fddc784817581f 100644
--- a/web/i18n/locales/sl-SI/deployments.json
+++ b/web/i18n/locales/sl-SI/deployments.json
@@ -54,13 +54,14 @@
   "studio.accessControl.lockoutWarning": "Vaš naslov IP ({{ip}}) ni vključen v ta pravilnik. Lahko izgubite dostop.",
   "studio.accessControl.manageIpPolicies": "Upravljaj pravilnike IP",
   "studio.accessControl.notEnabled": "Ni zaščiteno",
+  "studio.accessControl.pausedDescription": "Začasno ustavljeno — {{name}} je nastavljena, vendar se ne uporablja",
   "studio.accessControl.paywallDescription": "Omejite dostop do te aplikacije na naslove IP, ki jim zaupate.",
   "studio.accessControl.paywallTitle": "Nadzor dostopa",
   "studio.accessControl.policyChanged": "Ta pravilnik se je spremenil. Pred ponovnim shranjevanjem preglejte opozorilo.",
-  "studio.accessControl.policySummaryMany_few": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
-  "studio.accessControl.policySummaryMany_one": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
-  "studio.accessControl.policySummaryMany_other": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
-  "studio.accessControl.policySummaryMany_two": "Dovoljuje {{listed}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Dovoljuje {{first}}, {{second}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Dovoljuje {{first}}, {{second}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Dovoljuje {{first}}, {{second}} in dodatne naslove: {{count}}",
+  "studio.accessControl.policySummaryMany_two": "Dovoljuje {{first}}, {{second}} in dodatne naslove: {{count}}",
   "studio.accessControl.policySummaryNone": "Ne dovoljuje nobenega naslova",
   "studio.accessControl.policySummaryOne": "Dovoljuje {{address}}",
   "studio.accessControl.policySummaryTwo": "Dovoljuje {{first}} in {{second}}",
diff --git a/web/i18n/locales/th-TH/deployments.json b/web/i18n/locales/th-TH/deployments.json
index a99d68d73815fd..fef8e7a1fd879d 100644
--- a/web/i18n/locales/th-TH/deployments.json
+++ b/web/i18n/locales/th-TH/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "IP ของคุณ ({{ip}}) ไม่ได้อยู่ในนโยบายนี้ คุณอาจสูญเสียสิทธิ์การเข้าถึง",
   "studio.accessControl.manageIpPolicies": "จัดการนโยบาย IP",
   "studio.accessControl.notEnabled": "ไม่ได้รับการป้องกัน",
+  "studio.accessControl.pausedDescription": "หยุดชั่วคราว — กำหนดค่า {{name}} แล้ว แต่ยังไม่ได้บังคับใช้",
   "studio.accessControl.paywallDescription": "จำกัดการเข้าถึงแอปนี้เฉพาะที่อยู่ IP ที่คุณเชื่อถือ",
   "studio.accessControl.paywallTitle": "การควบคุมการเข้าถึง",
   "studio.accessControl.policyChanged": "นโยบายนี้มีการเปลี่ยนแปลง โปรดตรวจสอบคำเตือนก่อนบันทึกอีกครั้ง",
-  "studio.accessControl.policySummaryMany_one": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
-  "studio.accessControl.policySummaryMany_other": "อนุญาต {{listed}} และอีก {{count}} ที่อยู่",
+  "studio.accessControl.policySummaryMany_one": "อนุญาต {{first}}, {{second}} และอีก {{count}} ที่อยู่",
+  "studio.accessControl.policySummaryMany_other": "อนุญาต {{first}}, {{second}} และอีก {{count}} ที่อยู่",
   "studio.accessControl.policySummaryNone": "ไม่อนุญาตที่อยู่ใดเลย",
   "studio.accessControl.policySummaryOne": "อนุญาต {{address}}",
   "studio.accessControl.policySummaryTwo": "อนุญาต {{first}} และ {{second}}",
diff --git a/web/i18n/locales/tr-TR/deployments.json b/web/i18n/locales/tr-TR/deployments.json
index 20939e46ccbed1..db04b213dd9400 100644
--- a/web/i18n/locales/tr-TR/deployments.json
+++ b/web/i18n/locales/tr-TR/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "IP adresiniz ({{ip}}) bu politikada yer almıyor. Erişiminizi kaybedebilirsiniz.",
   "studio.accessControl.manageIpPolicies": "IP politikalarını yönet",
   "studio.accessControl.notEnabled": "Korunmuyor",
+  "studio.accessControl.pausedDescription": "Duraklatıldı — {{name}} yapılandırıldı ancak uygulanmıyor",
   "studio.accessControl.paywallDescription": "Bu uygulamaya erişimi güvendiğiniz IP adresleriyle sınırlayın.",
   "studio.accessControl.paywallTitle": "Erişim kontrolü",
   "studio.accessControl.policyChanged": "Bu politika değişti. Yeniden kaydetmeden önce uyarıyı inceleyin.",
-  "studio.accessControl.policySummaryMany_one": "{{listed}} ve {{count}} adrese daha izin verir",
-  "studio.accessControl.policySummaryMany_other": "{{listed}} ve {{count}} adrese daha izin verir",
+  "studio.accessControl.policySummaryMany_one": "{{first}}, {{second}} ve {{count}} adrese daha izin verir",
+  "studio.accessControl.policySummaryMany_other": "{{first}}, {{second}} ve {{count}} adrese daha izin verir",
   "studio.accessControl.policySummaryNone": "Hiçbir adrese izin vermez",
   "studio.accessControl.policySummaryOne": "{{address}} adresine izin verir",
   "studio.accessControl.policySummaryTwo": "{{first}} ve {{second}} adreslerine izin verir",
diff --git a/web/i18n/locales/uk-UA/deployments.json b/web/i18n/locales/uk-UA/deployments.json
index a8ce718848969f..0dd7ddacb6830f 100644
--- a/web/i18n/locales/uk-UA/deployments.json
+++ b/web/i18n/locales/uk-UA/deployments.json
@@ -54,13 +54,14 @@
   "studio.accessControl.lockoutWarning": "Вашу IP-адресу ({{ip}}) не включено до цієї політики. Ви можете втратити доступ.",
   "studio.accessControl.manageIpPolicies": "Керувати IP-політиками",
   "studio.accessControl.notEnabled": "Не захищено",
+  "studio.accessControl.pausedDescription": "Призупинено — {{name}} налаштована, але не застосовується",
   "studio.accessControl.paywallDescription": "Дозвольте доступ до цього застосунку лише з довірених IP-адрес.",
   "studio.accessControl.paywallTitle": "Контроль доступу",
   "studio.accessControl.policyChanged": "Цю політику змінено. Перегляньте попередження перед повторним збереженням.",
-  "studio.accessControl.policySummaryMany_few": "Дозволено {{listed}} та додаткові адреси: {{count}}",
-  "studio.accessControl.policySummaryMany_many": "Дозволено {{listed}} та додаткові адреси: {{count}}",
-  "studio.accessControl.policySummaryMany_one": "Дозволено {{listed}} та додаткові адреси: {{count}}",
-  "studio.accessControl.policySummaryMany_other": "Дозволено {{listed}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_few": "Дозволено {{first}}, {{second}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_many": "Дозволено {{first}}, {{second}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_one": "Дозволено {{first}}, {{second}} та додаткові адреси: {{count}}",
+  "studio.accessControl.policySummaryMany_other": "Дозволено {{first}}, {{second}} та додаткові адреси: {{count}}",
   "studio.accessControl.policySummaryNone": "Немає дозволених адрес",
   "studio.accessControl.policySummaryOne": "Дозволено {{address}}",
   "studio.accessControl.policySummaryTwo": "Дозволено {{first}} і {{second}}",
diff --git a/web/i18n/locales/vi-VN/deployments.json b/web/i18n/locales/vi-VN/deployments.json
index 055ed8d3183756..ea66785ac297bf 100644
--- a/web/i18n/locales/vi-VN/deployments.json
+++ b/web/i18n/locales/vi-VN/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "IP của bạn ({{ip}}) không nằm trong chính sách này. Bạn có thể mất quyền truy cập.",
   "studio.accessControl.manageIpPolicies": "Quản lý chính sách IP",
   "studio.accessControl.notEnabled": "Không được bảo vệ",
+  "studio.accessControl.pausedDescription": "Đã tạm dừng — {{name}} đã được cấu hình nhưng chưa được áp dụng",
   "studio.accessControl.paywallDescription": "Chỉ cho phép truy cập ứng dụng này từ các địa chỉ IP mà bạn tin cậy.",
   "studio.accessControl.paywallTitle": "Kiểm soát truy cập",
   "studio.accessControl.policyChanged": "Chính sách này đã thay đổi. Hãy xem lại cảnh báo trước khi lưu lại.",
-  "studio.accessControl.policySummaryMany_one": "Cho phép {{listed}} và {{count}} địa chỉ khác",
-  "studio.accessControl.policySummaryMany_other": "Cho phép {{listed}} và {{count}} địa chỉ khác",
+  "studio.accessControl.policySummaryMany_one": "Cho phép {{first}}, {{second}} và {{count}} địa chỉ khác",
+  "studio.accessControl.policySummaryMany_other": "Cho phép {{first}}, {{second}} và {{count}} địa chỉ khác",
   "studio.accessControl.policySummaryNone": "Không cho phép địa chỉ nào",
   "studio.accessControl.policySummaryOne": "Cho phép {{address}}",
   "studio.accessControl.policySummaryTwo": "Cho phép {{first}} và {{second}}",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index 81def6a39671e2..3e0872b914ab03 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -265,7 +265,7 @@
   "settings.ipPolicyColumnIpEntries": "IP 条目",
   "settings.ipPolicyColumnName": "名称",
   "settings.ipPolicyColumnUpdatedAt": "更新时间",
-  "settings.ipPolicyColumnUsedBy": "引用应用",
+  "settings.ipPolicyColumnUsedBy": "生效应用",
   "settings.ipPolicyCreate": "创建",
   "settings.ipPolicyCurrentIp": "你当前的 IP 是 {{ip}}",
   "settings.ipPolicyCurrentIpError": "无法检查您的 IP 地址，请重试。",
@@ -295,7 +295,7 @@
   "settings.ipPolicyNewTitle": "新建 IP 策略",
   "settings.ipPolicyRemoveEntry": "删除条目",
   "settings.ipPolicyUsedBy": "仍有 {{count}} 个应用在引用",
-  "settings.ipPolicyUsedByLabel": "引用应用",
+  "settings.ipPolicyUsedByLabel": "生效中",
   "settings.ipPolicyUsedBy_one": "仍有 {{count}} 个应用在引用",
   "sort.cancelled": "已取消对 {{item}} 的排序。",
   "sort.finished": "已确认 {{item}} 位于第 {{position}} 项，共 {{count}} 项。",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 76c5787249979e..08df5dd9d53327 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -49,39 +49,40 @@
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.entryLabel": "访问控制",
   "studio.accessControl.ipPolicy": "IP 策略",
-  "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能会失去访问权限。",
+  "studio.accessControl.lockoutWarning": "您的 IP（{{ip}}）不在此策略中，您可能会失去访问权限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
-  "studio.accessControl.notEnabled": "未受保护",
+  "studio.accessControl.notEnabled": "未保护",
+  "studio.accessControl.pausedDescription": "已暂停，{{name}} 已配置但未生效",
   "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
   "studio.accessControl.paywallTitle": "访问控制",
   "studio.accessControl.policyChanged": "此策略已发生变化，请确认风险提示后再次保存。",
-  "studio.accessControl.policySummaryMany_one": "允许 {{listed}} 以及另外 {{count}} 个地址",
-  "studio.accessControl.policySummaryMany_other": "允许 {{listed}} 以及另外 {{count}} 个地址",
+  "studio.accessControl.policySummaryMany_one": "允许 {{first}}、{{second}} 及另外 {{count}} 个地址",
+  "studio.accessControl.policySummaryMany_other": "允许 {{first}}、{{second}} 及另外 {{count}} 个地址",
   "studio.accessControl.policySummaryNone": "未允许任何地址",
   "studio.accessControl.policySummaryOne": "允许 {{address}}",
   "studio.accessControl.policySummaryTwo": "允许 {{first}} 和 {{second}}",
   "studio.accessControl.previewAppName": "代码助手",
   "studio.accessControl.previewCaption": "此应用仅允许在组织网络中访问。",
   "studio.accessControl.proBadge": "PRO",
-  "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个在服务中的访问入口。",
-  "studio.accessControl.protectingPartial": "正在保护 {{n}} / {{m}} 个在服务中的访问入口。",
+  "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个访问入口",
+  "studio.accessControl.protectingPartial": "正在保护 {{m}} 个访问入口中的 {{n}} 个",
   "studio.accessControl.protectsCoverage": "保护 {{n}} / {{m}} 个访问入口",
   "studio.accessControl.readyToResume": "可恢复",
-  "studio.accessControl.restrictByIp": "按 IP 地址限制",
+  "studio.accessControl.restrictByIp": "按 IP 地址限制访问",
   "studio.accessControl.restrictedTo": "已限制为 {{name}}",
   "studio.accessControl.saveAnyway": "仍要保存",
   "studio.accessControl.saveWithoutOwnIp": "在不含你自己的 IP 的情况下保存？",
   "studio.accessControl.selectAccessPoint": "请至少选择一个访问入口。",
   "studio.accessControl.selectPolicy": "选择 IP 策略",
   "studio.accessControl.selectPolicyRequired": "请选择一条 IP 策略。",
-  "studio.accessControl.tooltipAllProtected": "全部 {{total}} 个访问入口均受保护",
+  "studio.accessControl.tooltipAllProtected": "全部 {{total}} 个访问入口均已保护",
   "studio.accessControl.tooltipDowngraded": "已不再受保护，适用于 Professional 和 Team 套餐",
   "studio.accessControl.tooltipOff": "尚未配置",
   "studio.accessControl.tooltipPaused": "已配置但已暂停",
   "studio.accessControl.tooltipPro": "访问控制功能适用于 Professional 和 Team 套餐。",
-  "studio.accessControl.tooltipProtected": "{{total}} 个访问入口中有 {{n}} 个受到保护",
+  "studio.accessControl.tooltipProtected": "{{total}} 个访问入口中的 {{n}} 个已保护",
   "studio.accessControl.turnOffConfirm": "关闭",
-  "studio.accessControl.turnOffDescription": "所有访问入口都将可从任意 IP 地址访问。你的配置将被保留。",
+  "studio.accessControl.turnOffDescription": "所有访问入口将对任意 IP 地址开放。您的配置会被保留。",
   "studio.accessControl.turnOffTitle": "关闭 IP 访问控制？",
   "studio.accessControl.turnOn": "开启访问控制",
   "studio.accessControl.viewIpPolicies": "查看 IP 策略",
diff --git a/web/i18n/locales/zh-Hant/deployments.json b/web/i18n/locales/zh-Hant/deployments.json
index 43f3b9d8606699..83acbc46d92b26 100644
--- a/web/i18n/locales/zh-Hant/deployments.json
+++ b/web/i18n/locales/zh-Hant/deployments.json
@@ -52,11 +52,12 @@
   "studio.accessControl.lockoutWarning": "你的 IP（{{ip}}）不在此策略中。你可能會失去存取權限。",
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
   "studio.accessControl.notEnabled": "未受保護",
+  "studio.accessControl.pausedDescription": "已暫停，{{name}} 已設定但尚未生效",
   "studio.accessControl.paywallDescription": "僅允許您信任的 IP 位址存取此應用程式。",
   "studio.accessControl.paywallTitle": "存取控制",
   "studio.accessControl.policyChanged": "此原則已變更，請確認風險提示後再次儲存。",
-  "studio.accessControl.policySummaryMany_one": "允許 {{listed}} 以及另外 {{count}} 個地址",
-  "studio.accessControl.policySummaryMany_other": "允許 {{listed}} 以及另外 {{count}} 個地址",
+  "studio.accessControl.policySummaryMany_one": "允許 {{first}}, {{second}} 以及另外 {{count}} 個地址",
+  "studio.accessControl.policySummaryMany_other": "允許 {{first}}, {{second}} 以及另外 {{count}} 個地址",
   "studio.accessControl.policySummaryNone": "未允許任何地址",
   "studio.accessControl.policySummaryOne": "允許 {{address}}",
   "studio.accessControl.policySummaryTwo": "允許 {{first}} 和 {{second}}",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 42631ee6e1bec9..1d80277514f975 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -3011,12 +3011,13 @@ export default interface Resources {
     'studio.accessControl.lockoutWarning': "Your IP ({{ip}}) isn't in this policy. You may lose access."
     'studio.accessControl.manageIpPolicies': 'Manage IP policies'
     'studio.accessControl.notEnabled': 'Not protected'
+    'studio.accessControl.pausedDescription': 'Paused — {{name}} is configured but not enforcing'
     'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.'
     'studio.accessControl.paywallTitle': 'Access Control'
     'studio.accessControl.policyChanged': 'This policy changed. Review the warning before saving again.'
     'studio.accessControl.policySummaryMany':
-      | 'Allows {{listed}} and {{count}} more address'
-      | 'Allows {{listed}} and {{count}} more addresses'
+      | 'Allows {{first}}, {{second}} and {{count}} more address'
+      | 'Allows {{first}}, {{second}} and {{count}} more addresses'
     'studio.accessControl.policySummaryNone': 'Allows no addresses'
     'studio.accessControl.policySummaryOne': 'Allows {{address}}'
     'studio.accessControl.policySummaryTwo': 'Allows {{first}} and {{second}}'

From 879bbca917006fe6ae068227a0d28dbff54820b3 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:38:50 +0800
Subject: [PATCH 092/108] fix(web): keep settings visible during content
 loading (SNP-953)

---
 .../__tests__/settings-loading.spec.tsx       | 156 ++++++++++++++++++
 .../header/account-setting/index.tsx          |  30 ++--
 2 files changed, 173 insertions(+), 13 deletions(-)
 create mode 100644 web/app/components/header/account-setting/__tests__/settings-loading.spec.tsx

diff --git a/web/app/components/header/account-setting/__tests__/settings-loading.spec.tsx b/web/app/components/header/account-setting/__tests__/settings-loading.spec.tsx
new file mode 100644
index 00000000000000..43766d89274b8b
--- /dev/null
+++ b/web/app/components/header/account-setting/__tests__/settings-loading.spec.tsx
@@ -0,0 +1,156 @@
+import type { Resource } from 'i18next'
+import type { AccountSettingTab } from '../constants'
+import { act, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { NuqsTestingAdapter } from 'nuqs/adapters/testing'
+import { Suspense, useState } from 'react'
+import { I18nClientProvider } from '@/app/components/provider/i18n'
+import { seedNetworkAccessGroups } from '@/test/console/network-access'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
+import { ACCOUNT_SETTING_TAB } from '../constants'
+import AccountSetting from '../index'
+
+vi.unmock('react-i18next')
+const mocks = vi.hoisted(() => ({ loadResource: vi.fn() }))
+vi.mock('@/i18n/load-resource', () => ({ loadI18nResource: mocks.loadResource }))
+
+vi.mock('@/context/workspace-state', async () => {
+  const { createWorkspaceStateModuleMock } = await import('@/test/console/state-fixture')
+  return createWorkspaceStateModuleMock(() => ({
+    currentWorkspace: { id: 'workspace-1', name: 'Workspace', role: 'owner' },
+    isCurrentWorkspaceManager: true,
+    isCurrentWorkspaceOwner: true,
+  }))
+})
+vi.mock('@/context/permission-state', async () => {
+  const { createPermissionStateModuleMock } = await import('@/test/console/state-fixture')
+  return createPermissionStateModuleMock(() => ({
+    workspacePermissionKeys: ['workspace.member.manage'],
+  }))
+})
+vi.mock('@/service/use-common', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('@/service/use-common')>()),
+  useMembers: () => ({ data: { accounts: [] }, refetch: vi.fn() }),
+}))
+vi.mock('@/service/access-control/use-workspace-roles', () => ({
+  useWorkspaceRoleList: () => ({ data: { pages: [] }, isLoading: false }),
+}))
+vi.mock('@/hooks/use-breakpoints', () => ({
+  MediaType: { mobile: 'mobile', tablet: 'tablet', pc: 'pc' },
+  default: () => 'pc',
+}))
+vi.mock('@/app/components/billing/billing-page', () => ({ default: () => null }))
+vi.mock('@/app/components/custom/custom-page', () => ({ default: () => null }))
+vi.mock('../access-rules-page', () => ({ default: () => null }))
+vi.mock('../permissions-page', () => ({ default: () => null }))
+vi.mock('../preference-page', () => ({ default: () => null }))
+vi.mock('../workflow-log-archives-page', () => ({ default: () => null }))
+
+const resources: Resource = {
+  'en-US': {
+    appLog: {},
+    billing: {},
+    custom: {},
+    accountSettings: {},
+    common: {
+      loading: 'Loading',
+      'operation.close': 'Close',
+      'settings.ipPolicies': 'IP Policies',
+      'settings.ipPolicyEmptyTitle': 'No IP policies yet',
+    },
+    navigation: {
+      'settings.settings': 'Settings',
+      'settings.members': 'Members',
+    },
+    workspaceMembers: {
+      'members.invite': 'Invite members',
+      'members.inviteTeamMember': 'Invite team member',
+    },
+  },
+}
+
+function Settings() {
+  const [activeTab, setActiveTab] = useState<AccountSettingTab>(ACCOUNT_SETTING_TAB.MEMBERS)
+  return (
+    <AccountSetting
+      activeTab={activeTab}
+      onTabChangeAction={setActiveTab}
+      onCancelAction={() => {}}
+    />
+  )
+}
+
+function renderSettings() {
+  const queryClient = createConsoleQueryClient()
+  seedNetworkAccessGroups(queryClient, { entitled: true, groups: [] })
+  return renderWithConsoleQuery(
+    <I18nClientProvider locale="en-US" resource={resources}>
+      <NuqsTestingAdapter>
+        <Suspense fallback={<span>Loading settings</span>}>
+          <Settings />
+        </Suspense>
+      </NuqsTestingAdapter>
+    </I18nClientProvider>,
+    {
+      queryClient,
+      systemFeatures: { deployment_edition: 'CLOUD', is_email_setup: true },
+      features: { billing: { subscription: { plan: 'team' } } },
+    },
+  )
+}
+
+function deferNamespace(namespace: string) {
+  let finishLoading!: () => void
+  const pending = new Promise<void>((resolve) => {
+    finishLoading = resolve
+  })
+  mocks.loadResource.mockImplementation(async (_locale: string, requested: string) => {
+    if (requested === namespace) await pending
+    return { default: {} }
+  })
+  return async () => {
+    await act(async () => {
+      finishLoading()
+      await pending
+    })
+  }
+}
+
+describe('Settings content loading', () => {
+  beforeEach(() => {
+    mocks.loadResource.mockReset()
+  })
+
+  it('keeps the dialog and navigation visible while a tab loads its translations', async () => {
+    const user = userEvent.setup()
+    const finishLoading = deferNamespace('deployments')
+    renderSettings()
+    await user.click(await screen.findByRole('button', { name: 'IP Policies' }))
+
+    await waitFor(() => {
+      expect(mocks.loadResource).toHaveBeenCalledWith('en-US', 'deployments')
+    })
+    expect(screen.getByRole('dialog', { name: 'Settings' })).toBeVisible()
+    expect(screen.getByRole('button', { name: 'Members' })).toBeVisible()
+    expect(screen.queryByText('Loading settings')).not.toBeInTheDocument()
+
+    await finishLoading()
+    expect(await screen.findByRole('heading', { name: 'No IP policies yet' })).toBeVisible()
+  })
+
+  it('keeps the Settings shell visible while opening a nested dialog for the first time', async () => {
+    const user = userEvent.setup()
+    const finishLoading = deferNamespace('permission')
+    renderSettings()
+    await user.click(await screen.findByRole('button', { name: 'Invite members' }))
+
+    await waitFor(() => {
+      expect(mocks.loadResource).toHaveBeenCalledWith('en-US', 'permission')
+    })
+    expect(screen.getByText('Settings', { selector: 'div' })).toBeVisible()
+    expect(screen.queryByText('Loading settings')).not.toBeInTheDocument()
+
+    await finishLoading()
+    expect(await screen.findByRole('dialog', { name: 'Invite team member' })).toBeVisible()
+  })
+})
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index d88302a3ad9f90..4159823bbadc52 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -11,8 +11,9 @@ import {
 } from '@langgenius/dify-ui/scroll-area'
 import { useQuery, useSuspenseQuery } from '@tanstack/react-query'
 import { useAtomValue } from 'jotai'
-import { useRef } from 'react'
+import { Suspense, useRef } from 'react'
 import { useTranslation } from 'react-i18next'
+import { LoadingPlaceholder } from '@/app/components/base/loading-placeholder'
 import BillingPage from '@/app/components/billing/billing-page'
 import CustomPage from '@/app/components/custom/custom-page'
 import { ACCOUNT_SETTING_TAB } from '@/app/components/header/account-setting/constants'
@@ -274,18 +275,21 @@ export default function AccountSetting({
                   </div>
                 )}
                 <div className="max-w-full min-w-0 px-4 pt-6 sm:px-8">
-                  {activeMenu === ACCOUNT_SETTING_TAB.MEMBERS && <MembersPage />}
-                  {activeMenu === ACCOUNT_SETTING_TAB.IP_POLICIES && <IpPoliciesPage />}
-                  {activeMenu === ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS && (
-                    <PermissionsPage containerRef={scrollContainerRef} />
-                  )}
-                  {activeMenu === ACCOUNT_SETTING_TAB.PERMISSION_SET && <AccessRulesPage />}
-                  {activeMenu === ACCOUNT_SETTING_TAB.BILLING && <BillingPage />}
-                  {activeMenu === ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES && (
-                    <WorkflowLogArchivesPage />
-                  )}
-                  {activeMenu === ACCOUNT_SETTING_TAB.CUSTOM && <CustomPage />}
-                  {activeMenu === ACCOUNT_SETTING_TAB.PREFERENCES && <PreferencePage />}
+                  {/* First-use translations and queries must not suspend the dialog shell. */}
+                  <Suspense fallback={<LoadingPlaceholder className="py-10" />}>
+                    {activeMenu === ACCOUNT_SETTING_TAB.MEMBERS && <MembersPage />}
+                    {activeMenu === ACCOUNT_SETTING_TAB.IP_POLICIES && <IpPoliciesPage />}
+                    {activeMenu === ACCOUNT_SETTING_TAB.ROLES_AND_PERMISSIONS && (
+                      <PermissionsPage containerRef={scrollContainerRef} />
+                    )}
+                    {activeMenu === ACCOUNT_SETTING_TAB.PERMISSION_SET && <AccessRulesPage />}
+                    {activeMenu === ACCOUNT_SETTING_TAB.BILLING && <BillingPage />}
+                    {activeMenu === ACCOUNT_SETTING_TAB.WORKFLOW_LOG_ARCHIVES && (
+                      <WorkflowLogArchivesPage />
+                    )}
+                    {activeMenu === ACCOUNT_SETTING_TAB.CUSTOM && <CustomPage />}
+                    {activeMenu === ACCOUNT_SETTING_TAB.PREFERENCES && <PreferencePage />}
+                  </Suspense>
                 </div>
               </ScrollAreaContent>
             </ScrollAreaViewport>

From 0d5e7da4b8af3bd20884aadc148745a1eff57d5b Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:40:44 +0800
Subject: [PATCH 093/108] fix(web): clarify read-only IP policy details
 (SNP-950)

---
 .../ip-policies-page/__tests__/index.spec.tsx          |  5 +++++
 .../account-setting/ip-policies-page/policy-dialog.tsx | 10 +---------
 web/i18n/locales/ar-TN/common.json                     |  1 +
 web/i18n/locales/az-AZ/common.json                     |  1 +
 web/i18n/locales/de-DE/common.json                     |  1 +
 web/i18n/locales/en-US/common.json                     |  1 +
 web/i18n/locales/es-ES/common.json                     |  1 +
 web/i18n/locales/fa-IR/common.json                     |  1 +
 web/i18n/locales/fr-FR/common.json                     |  1 +
 web/i18n/locales/hi-IN/common.json                     |  1 +
 web/i18n/locales/id-ID/common.json                     |  1 +
 web/i18n/locales/it-IT/common.json                     |  1 +
 web/i18n/locales/ja-JP/common.json                     |  1 +
 web/i18n/locales/ko-KR/common.json                     |  1 +
 web/i18n/locales/lo-LA/common.json                     |  1 +
 web/i18n/locales/nl-NL/common.json                     |  1 +
 web/i18n/locales/pl-PL/common.json                     |  1 +
 web/i18n/locales/pt-BR/common.json                     |  1 +
 web/i18n/locales/ro-RO/common.json                     |  1 +
 web/i18n/locales/ru-RU/common.json                     |  1 +
 web/i18n/locales/sl-SI/common.json                     |  1 +
 web/i18n/locales/th-TH/common.json                     |  1 +
 web/i18n/locales/tr-TR/common.json                     |  1 +
 web/i18n/locales/uk-UA/common.json                     |  1 +
 web/i18n/locales/vi-VN/common.json                     |  1 +
 web/i18n/locales/zh-Hans/common.json                   |  1 +
 web/i18n/locales/zh-Hant/common.json                   |  1 +
 web/i18n/resources.generated.d.ts                      |  1 +
 28 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index 77fef851640e5c..b283bf4272d577 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -80,6 +80,11 @@ describe('IpPoliciesPage', () => {
       await user.keyboard('{Enter}')
 
       const dialog = screen.getByRole('dialog', { name: 'Internal Network' })
+      expect(dialog).toHaveAccessibleDescription(
+        'Only the workspace owner and admins can edit IP policies.',
+      )
+      expect(within(dialog).getAllByText('Internal Network')).toHaveLength(1)
+      expect(within(dialog).queryByText('Name')).not.toBeInTheDocument()
       expect(trackEvent).toHaveBeenCalledWith('ip_policy_interaction', {
         action: 'settings_tab_viewed',
       })
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
index f6923947875303..607827e623433a 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-dialog.tsx
@@ -108,7 +108,7 @@ export function IpPolicyDialog({
             </DialogTitle>
             <DialogDescription className="system-sm-regular text-text-tertiary">
               {mode === 'view'
-                ? t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })
+                ? t(($) => $['settings.ipPolicyViewDescription'], { ns: 'common' })
                 : t(($) => $['settings.ipPolicyDialogDescription'], { ns: 'common' })}
             </DialogDescription>
           </div>
@@ -128,14 +128,6 @@ export function IpPolicyDialog({
         {mode === 'view' ? (
           <div className="flex min-h-0 flex-1 flex-col gap-6 overflow-y-auto">
             <dl className="flex flex-col gap-6">
-              <div className="flex flex-col gap-3">
-                <dt className="system-sm-medium text-text-primary">
-                  {t(($) => $['settings.ipPolicyName'], { ns: 'common' })}
-                </dt>
-                <dd className="system-sm-regular wrap-anywhere text-text-secondary">
-                  {initialName}
-                </dd>
-              </div>
               <div className="flex flex-col gap-3">
                 <dt className="system-sm-medium text-text-primary">
                   {t(($) => $['settings.ipPolicyAllowlist'], { ns: 'common' })}
diff --git a/web/i18n/locales/ar-TN/common.json b/web/i18n/locales/ar-TN/common.json
index 0907cce2f48f11..b8009f5c61326c 100644
--- a/web/i18n/locales/ar-TN/common.json
+++ b/web/i18n/locales/ar-TN/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "لا تزال مستخدمة في {{count}} من التطبيقات",
   "settings.ipPolicyUsedByLabel": "مستخدم بواسطة",
   "settings.ipPolicyUsedBy_one": "لا تزال مستخدمة في {{count}} من التطبيقات",
+  "settings.ipPolicyViewDescription": "يمكن لمالك مساحة العمل والمسؤولين فقط تعديل سياسات IP.",
   "sort.cancelled": "تم إلغاء ترتيب {{item}}.",
   "sort.finished": "تم وضع {{item}} في الموضع {{position}} من {{count}}.",
   "sort.handle": "إعادة ترتيب {{item}}",
diff --git a/web/i18n/locales/az-AZ/common.json b/web/i18n/locales/az-AZ/common.json
index f2c80849b801ae..763aef683f6687 100644
--- a/web/i18n/locales/az-AZ/common.json
+++ b/web/i18n/locales/az-AZ/common.json
@@ -259,6 +259,7 @@
   "settings.ipPolicyEmptyCreate": "IP siyasəti yarat",
   "settings.ipPolicyEmptyDescription": "Siyasət girişə icazə verilən IP ünvanlarının siyahısıdır.",
   "settings.ipPolicyEmptyTitle": "Bu iş məkanında hələ IP siyasəti yoxdur",
+  "settings.ipPolicyViewDescription": "IP siyasətlərini yalnız iş sahəsinin sahibi və administratorları redaktə edə bilər.",
   "sort.cancelled": "{{item}} elementinin sıralanması ləğv edildi.",
   "sort.finished": "{{item}} elementi {{count}} mövqe arasında {{position}} nömrəli mövqeyə yerləşdirildi.",
   "sort.handle": "{{item}} elementinin sırasını dəyiş",
diff --git a/web/i18n/locales/de-DE/common.json b/web/i18n/locales/de-DE/common.json
index ba9bb72d4a8c55..f1965c8a56fa88 100644
--- a/web/i18n/locales/de-DE/common.json
+++ b/web/i18n/locales/de-DE/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Noch von {{count}} Apps verwendet",
   "settings.ipPolicyUsedByLabel": "Verwendet von",
   "settings.ipPolicyUsedBy_one": "Noch von {{count}} App verwendet",
+  "settings.ipPolicyViewDescription": "Nur der Eigentümer und die Administratoren des Arbeitsbereichs können IP-Richtlinien bearbeiten.",
   "sort.cancelled": "Sortierung von {{item}} abgebrochen.",
   "sort.finished": "{{item}} an Position {{position}} von {{count}} abgelegt.",
   "sort.handle": "{{item}} umsortieren",
diff --git a/web/i18n/locales/en-US/common.json b/web/i18n/locales/en-US/common.json
index 281bec043f3348..a3f002a101558e 100644
--- a/web/i18n/locales/en-US/common.json
+++ b/web/i18n/locales/en-US/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Still used by {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Used by",
   "settings.ipPolicyUsedBy_one": "Still used by {{count}} app",
+  "settings.ipPolicyViewDescription": "Only the workspace owner and admins can edit IP policies.",
   "sort.cancelled": "Sorting {{item}} cancelled.",
   "sort.finished": "Placed {{item}} at position {{position}} of {{count}}.",
   "sort.handle": "Reorder {{item}}",
diff --git a/web/i18n/locales/es-ES/common.json b/web/i18n/locales/es-ES/common.json
index 413efb12d15c10..11807dcef24a9f 100644
--- a/web/i18n/locales/es-ES/common.json
+++ b/web/i18n/locales/es-ES/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Todavía la usan {{count}} aplicaciones",
   "settings.ipPolicyUsedByLabel": "Usado por",
   "settings.ipPolicyUsedBy_one": "Todavía la usa {{count}} aplicación",
+  "settings.ipPolicyViewDescription": "Solo el propietario y los administradores del espacio de trabajo pueden editar las políticas de IP.",
   "sort.cancelled": "Ordenación de {{item}} cancelada.",
   "sort.finished": "{{item}} colocado en la posición {{position}} de {{count}}.",
   "sort.handle": "Reordenar {{item}}",
diff --git a/web/i18n/locales/fa-IR/common.json b/web/i18n/locales/fa-IR/common.json
index fa1d31a52ad106..168b898d55a355 100644
--- a/web/i18n/locales/fa-IR/common.json
+++ b/web/i18n/locales/fa-IR/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "هنوز در {{count}} برنامه استفاده می‌شود",
   "settings.ipPolicyUsedByLabel": "استفاده‌شده توسط",
   "settings.ipPolicyUsedBy_one": "هنوز در {{count}} برنامه استفاده می‌شود",
+  "settings.ipPolicyViewDescription": "فقط مالک و مدیران فضای کاری می‌توانند سیاست‌های IP را ویرایش کنند.",
   "sort.cancelled": "مرتب‌سازی {{item}} لغو شد.",
   "sort.finished": "{{item}} در جایگاه {{position}} از {{count}} قرار گرفت.",
   "sort.handle": "تغییر ترتیب {{item}}",
diff --git a/web/i18n/locales/fr-FR/common.json b/web/i18n/locales/fr-FR/common.json
index 1ee46f3ca9476d..ae095d403e3f43 100644
--- a/web/i18n/locales/fr-FR/common.json
+++ b/web/i18n/locales/fr-FR/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Encore utilisée par {{count}} applications",
   "settings.ipPolicyUsedByLabel": "Utilisé par",
   "settings.ipPolicyUsedBy_one": "Encore utilisée par {{count}} application",
+  "settings.ipPolicyViewDescription": "Seuls le propriétaire et les administrateurs de l’espace de travail peuvent modifier les politiques IP.",
   "sort.cancelled": "Tri de {{item}} annulé.",
   "sort.finished": "{{item}} placé à la position {{position}} sur {{count}}.",
   "sort.handle": "Réordonner {{item}}",
diff --git a/web/i18n/locales/hi-IN/common.json b/web/i18n/locales/hi-IN/common.json
index 3abd3a4ee351ca..40525a3958c30a 100644
--- a/web/i18n/locales/hi-IN/common.json
+++ b/web/i18n/locales/hi-IN/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "अभी भी {{count}} ऐप में उपयोग की जा रही है",
   "settings.ipPolicyUsedByLabel": "इनके द्वारा उपयोग",
   "settings.ipPolicyUsedBy_one": "अभी भी {{count}} ऐप में उपयोग की जा रही है",
+  "settings.ipPolicyViewDescription": "केवल कार्यक्षेत्र के स्वामी और व्यवस्थापक ही IP नीतियों को संपादित कर सकते हैं।",
   "sort.cancelled": "{{item}} का क्रम बदलना रद्द किया गया।",
   "sort.finished": "{{item}} को {{count}} में से स्थान {{position}} पर रखा गया।",
   "sort.handle": "{{item}} का क्रम बदलें",
diff --git a/web/i18n/locales/id-ID/common.json b/web/i18n/locales/id-ID/common.json
index d195325cbd4553..c9e637f438ec92 100644
--- a/web/i18n/locales/id-ID/common.json
+++ b/web/i18n/locales/id-ID/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Masih digunakan oleh {{count}} aplikasi",
   "settings.ipPolicyUsedByLabel": "Digunakan oleh",
   "settings.ipPolicyUsedBy_one": "Masih digunakan oleh {{count}} aplikasi",
+  "settings.ipPolicyViewDescription": "Hanya pemilik dan admin ruang kerja yang dapat mengedit kebijakan IP.",
   "sort.cancelled": "Pengurutan {{item}} dibatalkan.",
   "sort.finished": "{{item}} ditempatkan pada posisi {{position}} dari {{count}}.",
   "sort.handle": "Urutkan ulang {{item}}",
diff --git a/web/i18n/locales/it-IT/common.json b/web/i18n/locales/it-IT/common.json
index 12918ed13d107d..7f8ee75122589e 100644
--- a/web/i18n/locales/it-IT/common.json
+++ b/web/i18n/locales/it-IT/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Ancora utilizzata da {{count}} app",
   "settings.ipPolicyUsedByLabel": "Usato da",
   "settings.ipPolicyUsedBy_one": "Ancora utilizzata da {{count}} app",
+  "settings.ipPolicyViewDescription": "Solo il proprietario e gli amministratori dello spazio di lavoro possono modificare le policy IP.",
   "sort.cancelled": "Riordinamento di {{item}} annullato.",
   "sort.finished": "{{item}} posizionato al posto {{position}} di {{count}}.",
   "sort.handle": "Riordina {{item}}",
diff --git a/web/i18n/locales/ja-JP/common.json b/web/i18n/locales/ja-JP/common.json
index 6fb7e3e6d4251c..457eaef23feee1 100644
--- a/web/i18n/locales/ja-JP/common.json
+++ b/web/i18n/locales/ja-JP/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "まだ {{count}} 個のアプリで使用中",
   "settings.ipPolicyUsedByLabel": "使用中のアプリ",
   "settings.ipPolicyUsedBy_one": "まだ {{count}} 個のアプリで使用中",
+  "settings.ipPolicyViewDescription": "IP ポリシーを編集できるのはワークスペースの Owner と Admin のみです。",
   "sort.cancelled": "{{item}} の並べ替えをキャンセルしました。",
   "sort.finished": "{{item}} を {{count}} 件中 {{position}} 番目に確定しました。",
   "sort.handle": "{{item}} を並べ替え",
diff --git a/web/i18n/locales/ko-KR/common.json b/web/i18n/locales/ko-KR/common.json
index 0609ab2fa731fd..b7992d2d6b1fce 100644
--- a/web/i18n/locales/ko-KR/common.json
+++ b/web/i18n/locales/ko-KR/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "아직 {{count}}개의 앱에서 사용 중",
   "settings.ipPolicyUsedByLabel": "사용 중",
   "settings.ipPolicyUsedBy_one": "아직 {{count}}개의 앱에서 사용 중",
+  "settings.ipPolicyViewDescription": "워크스페이스 소유자와 관리자만 IP 정책을 수정할 수 있습니다.",
   "sort.cancelled": "{{item}} 순서 변경을 취소했습니다.",
   "sort.finished": "{{item}} 항목을 {{count}}개 중 {{position}}번째에 배치했습니다.",
   "sort.handle": "{{item}} 순서 변경",
diff --git a/web/i18n/locales/lo-LA/common.json b/web/i18n/locales/lo-LA/common.json
index 39cf19a96e9171..0671eb3d8d1c3c 100644
--- a/web/i18n/locales/lo-LA/common.json
+++ b/web/i18n/locales/lo-LA/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "ຍັງມີ {{count}} ແອັບທີ່ໃຊ້ຢູ່",
   "settings.ipPolicyUsedByLabel": "ຖືກໃຊ້ໂດຍ",
   "settings.ipPolicyUsedBy_one": "ຍັງມີ {{count}} ແອັບທີ່ໃຊ້ຢູ່",
+  "settings.ipPolicyViewDescription": "ມີພຽງເຈົ້າຂອງ ແລະ ຜູ້ດູແລພື້ນທີ່ເຮັດວຽກເທົ່ານັ້ນທີ່ສາມາດແກ້ໄຂນະໂຍບາຍ IP ໄດ້.",
   "sort.cancelled": "ຍົກເລີກການຈັດລຳດັບ {{item}} ແລ້ວ.",
   "sort.finished": "ວາງ {{item}} ຢູ່ລຳດັບ {{position}} ຈາກ {{count}} ແລ້ວ.",
   "sort.handle": "ຈັດລຳດັບ {{item}} ໃໝ່",
diff --git a/web/i18n/locales/nl-NL/common.json b/web/i18n/locales/nl-NL/common.json
index 6fb0882840639f..ba3b00ba4bf8d9 100644
--- a/web/i18n/locales/nl-NL/common.json
+++ b/web/i18n/locales/nl-NL/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Nog in gebruik door {{count}} apps",
   "settings.ipPolicyUsedByLabel": "Gebruikt door",
   "settings.ipPolicyUsedBy_one": "Nog in gebruik door {{count}} apps",
+  "settings.ipPolicyViewDescription": "Alleen de eigenaar en beheerders van de werkruimte kunnen IP-beleid bewerken.",
   "sort.cancelled": "Sorteren van {{item}} geannuleerd.",
   "sort.finished": "{{item}} neergezet op positie {{position}} van {{count}}.",
   "sort.handle": "{{item}} opnieuw ordenen",
diff --git a/web/i18n/locales/pl-PL/common.json b/web/i18n/locales/pl-PL/common.json
index 989495f30914ee..8085b16851a573 100644
--- a/web/i18n/locales/pl-PL/common.json
+++ b/web/i18n/locales/pl-PL/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Liczba aplikacji nadal korzystających z tej polityki: {{count}}",
   "settings.ipPolicyUsedByLabel": "Używane przez",
   "settings.ipPolicyUsedBy_one": "Liczba aplikacji nadal korzystających z tej polityki: {{count}}",
+  "settings.ipPolicyViewDescription": "Tylko właściciel i administratorzy obszaru roboczego mogą edytować zasady IP.",
   "sort.cancelled": "Anulowano sortowanie {{item}}.",
   "sort.finished": "Umieszczono {{item}} na pozycji {{position}} z {{count}}.",
   "sort.handle": "Zmień kolejność {{item}}",
diff --git a/web/i18n/locales/pt-BR/common.json b/web/i18n/locales/pt-BR/common.json
index 2f9ea170d77297..f19a1fe937006d 100644
--- a/web/i18n/locales/pt-BR/common.json
+++ b/web/i18n/locales/pt-BR/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Ainda usada por {{count}} aplicativos",
   "settings.ipPolicyUsedByLabel": "Usado por",
   "settings.ipPolicyUsedBy_one": "Ainda usada por {{count}} aplicativo",
+  "settings.ipPolicyViewDescription": "Somente o proprietário e os administradores do espaço de trabalho podem editar as políticas de IP.",
   "sort.cancelled": "Ordenação de {{item}} cancelada.",
   "sort.finished": "{{item}} colocado na posição {{position}} de {{count}}.",
   "sort.handle": "Reordenar {{item}}",
diff --git a/web/i18n/locales/ro-RO/common.json b/web/i18n/locales/ro-RO/common.json
index 012acf1e234894..a5eaac72ec5d07 100644
--- a/web/i18n/locales/ro-RO/common.json
+++ b/web/i18n/locales/ro-RO/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Numărul de aplicații care încă folosesc politica: {{count}}",
   "settings.ipPolicyUsedByLabel": "Folosit de",
   "settings.ipPolicyUsedBy_one": "Numărul de aplicații care încă folosesc politica: {{count}}",
+  "settings.ipPolicyViewDescription": "Doar proprietarul și administratorii spațiului de lucru pot edita politicile IP.",
   "sort.cancelled": "Sortarea pentru {{item}} a fost anulată.",
   "sort.finished": "{{item}} plasat la poziția {{position}} din {{count}}.",
   "sort.handle": "Reordonează {{item}}",
diff --git a/web/i18n/locales/ru-RU/common.json b/web/i18n/locales/ru-RU/common.json
index eb3fd5aceef2f2..53c29a323be77d 100644
--- a/web/i18n/locales/ru-RU/common.json
+++ b/web/i18n/locales/ru-RU/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Количество приложений, всё ещё использующих политику: {{count}}",
   "settings.ipPolicyUsedByLabel": "Используется",
   "settings.ipPolicyUsedBy_one": "Количество приложений, всё ещё использующих политику: {{count}}",
+  "settings.ipPolicyViewDescription": "Только владелец и администраторы рабочего пространства могут редактировать политики IP.",
   "sort.cancelled": "Сортировка {{item}} отменена.",
   "sort.finished": "{{item}} размещён на позиции {{position}} из {{count}}.",
   "sort.handle": "Изменить порядок: {{item}}",
diff --git a/web/i18n/locales/sl-SI/common.json b/web/i18n/locales/sl-SI/common.json
index 79ce70cd25f5ac..4454a46ef540d9 100644
--- a/web/i18n/locales/sl-SI/common.json
+++ b/web/i18n/locales/sl-SI/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Število aplikacij, ki še uporabljajo pravilnik: {{count}}",
   "settings.ipPolicyUsedByLabel": "Uporablja",
   "settings.ipPolicyUsedBy_one": "Število aplikacij, ki še uporabljajo pravilnik: {{count}}",
+  "settings.ipPolicyViewDescription": "Pravila IP lahko urejajo samo lastnik in skrbniki delovnega prostora.",
   "sort.cancelled": "Razvrščanje {{item}} preklicano.",
   "sort.finished": "{{item}} postavljen na položaj {{position}} od {{count}}.",
   "sort.handle": "Prerazporedi {{item}}",
diff --git a/web/i18n/locales/th-TH/common.json b/web/i18n/locales/th-TH/common.json
index af82c943d9a23e..7ca416df43f335 100644
--- a/web/i18n/locales/th-TH/common.json
+++ b/web/i18n/locales/th-TH/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "ยังมี {{count}} แอปที่ใช้นโยบายนี้อยู่",
   "settings.ipPolicyUsedByLabel": "ถูกใช้โดย",
   "settings.ipPolicyUsedBy_one": "ยังมี {{count}} แอปที่ใช้นโยบายนี้อยู่",
+  "settings.ipPolicyViewDescription": "เฉพาะเจ้าของและผู้ดูแลระบบของพื้นที่ทำงานเท่านั้นที่สามารถแก้ไขนโยบาย IP ได้",
   "sort.cancelled": "ยกเลิกการเรียงลำดับ {{item}} แล้ว",
   "sort.finished": "วาง {{item}} ที่ตำแหน่ง {{position}} จาก {{count}} แล้ว",
   "sort.handle": "เรียงลำดับ {{item}} ใหม่",
diff --git a/web/i18n/locales/tr-TR/common.json b/web/i18n/locales/tr-TR/common.json
index 3ff124d3d3ca07..be6b1e269ac173 100644
--- a/web/i18n/locales/tr-TR/common.json
+++ b/web/i18n/locales/tr-TR/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Hâlâ {{count}} uygulama tarafından kullanılıyor",
   "settings.ipPolicyUsedByLabel": "Kullanan",
   "settings.ipPolicyUsedBy_one": "Hâlâ {{count}} uygulama tarafından kullanılıyor",
+  "settings.ipPolicyViewDescription": "IP politikalarını yalnızca çalışma alanının sahibi ve yöneticileri düzenleyebilir.",
   "sort.cancelled": "{{item}} sıralaması iptal edildi.",
   "sort.finished": "{{item}}, {{count}} öğeden {{position}}. sıraya yerleştirildi.",
   "sort.handle": "{{item}} sırasını değiştir",
diff --git a/web/i18n/locales/uk-UA/common.json b/web/i18n/locales/uk-UA/common.json
index 64c39527f2534a..184efa630f3968 100644
--- a/web/i18n/locales/uk-UA/common.json
+++ b/web/i18n/locales/uk-UA/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Кількість застосунків, які досі використовують політику: {{count}}",
   "settings.ipPolicyUsedByLabel": "Використовується",
   "settings.ipPolicyUsedBy_one": "Кількість застосунків, які досі використовують політику: {{count}}",
+  "settings.ipPolicyViewDescription": "Лише власник і адміністратори робочого простору можуть редагувати політики IP.",
   "sort.cancelled": "Сортування {{item}} скасовано.",
   "sort.finished": "{{item}} розміщено на позиції {{position}} з {{count}}.",
   "sort.handle": "Змінити порядок: {{item}}",
diff --git a/web/i18n/locales/vi-VN/common.json b/web/i18n/locales/vi-VN/common.json
index c0ceac8528187b..4db0806b55a8e3 100644
--- a/web/i18n/locales/vi-VN/common.json
+++ b/web/i18n/locales/vi-VN/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "Vẫn được {{count}} ứng dụng sử dụng",
   "settings.ipPolicyUsedByLabel": "Được dùng bởi",
   "settings.ipPolicyUsedBy_one": "Vẫn được {{count}} ứng dụng sử dụng",
+  "settings.ipPolicyViewDescription": "Chỉ chủ sở hữu và quản trị viên không gian làm việc mới có thể chỉnh sửa chính sách IP.",
   "sort.cancelled": "Đã hủy sắp xếp {{item}}.",
   "sort.finished": "Đã đặt {{item}} ở vị trí {{position}} trên {{count}}.",
   "sort.handle": "Sắp xếp lại {{item}}",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index 3e0872b914ab03..6f61bfa8ad56e8 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "仍有 {{count}} 个应用在引用",
   "settings.ipPolicyUsedByLabel": "生效中",
   "settings.ipPolicyUsedBy_one": "仍有 {{count}} 个应用在引用",
+  "settings.ipPolicyViewDescription": "只有工作空间的 Owner 和 Admin 可以编辑 IP 策略。",
   "sort.cancelled": "已取消对 {{item}} 的排序。",
   "sort.finished": "已确认 {{item}} 位于第 {{position}} 项，共 {{count}} 项。",
   "sort.handle": "调整 {{item}} 的顺序",
diff --git a/web/i18n/locales/zh-Hant/common.json b/web/i18n/locales/zh-Hant/common.json
index 34be55d2d00342..626caa24400fb0 100644
--- a/web/i18n/locales/zh-Hant/common.json
+++ b/web/i18n/locales/zh-Hant/common.json
@@ -297,6 +297,7 @@
   "settings.ipPolicyUsedBy": "仍有 {{count}} 個應用程式在使用",
   "settings.ipPolicyUsedByLabel": "被用於",
   "settings.ipPolicyUsedBy_one": "仍有 {{count}} 個應用程式在使用",
+  "settings.ipPolicyViewDescription": "只有工作空間的 Owner 和 Admin 可以編輯 IP 策略。",
   "sort.cancelled": "已取消對 {{item}} 的排序。",
   "sort.finished": "已確認 {{item}} 位於第 {{position}} 項，共 {{count}} 項。",
   "sort.handle": "調整 {{item}} 的順序",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 1d80277514f975..aef257c31a6dec 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -1847,6 +1847,7 @@ export default interface Resources {
     'settings.ipPolicyRemoveEntry': 'Remove entry'
     'settings.ipPolicyUsedBy': 'Still used by {{count}} apps' | 'Still used by {{count}} app'
     'settings.ipPolicyUsedByLabel': 'Used by'
+    'settings.ipPolicyViewDescription': 'Only the workspace owner and admins can edit IP policies.'
     'sort.cancelled': 'Sorting {{item}} cancelled.'
     'sort.finished': 'Placed {{item}} at position {{position}} of {{count}}.'
     'sort.handle': 'Reorder {{item}}'

From accae157c8222d6def4148ef3618542eb069f32b Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:42:51 +0800
Subject: [PATCH 094/108] fix(web): correct editor IP policy empty states
 (SNP-954)

---
 .../access-control/__tests__/config-panel.spec.tsx   | 12 ++++++++++++
 .../app/access-point/access-control/policy-field.tsx |  8 ++++----
 .../ip-policies-page/__tests__/index.spec.tsx        |  4 ++++
 .../account-setting/ip-policies-page/index.tsx       |  4 +++-
 web/i18n/locales/ja-JP/deployments.json              |  2 +-
 web/i18n/locales/zh-Hans/deployments.json            |  2 +-
 6 files changed, 25 insertions(+), 7 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
index ab485b3bd1ce34..4cf86dec1d0973 100644
--- a/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/config-panel.spec.tsx
@@ -97,6 +97,18 @@ function PanelHarness({
 }
 
 describe('AccessControlConfigPanel', () => {
+  it('keeps the empty-state title and explains how editors can get a policy created', () => {
+    render(<PanelHarness availablePolicies={[]} canManagePolicies={false} />)
+
+    expect(screen.getByText('No IP policies in this workspace yet')).toAppearBefore(
+      screen.getByText('Ask a workspace owner or admin to create one.'),
+    )
+    expect(
+      screen.queryByText('A policy is the list of IP addresses allowed in.'),
+    ).not.toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
+  })
+
   it('opens the policy select when policies exist and none is selected', async () => {
     render(<PanelHarness />)
 
diff --git a/web/app/components/app/access-point/access-control/policy-field.tsx b/web/app/components/app/access-point/access-control/policy-field.tsx
index ff048fd5619f1b..da585d0d033270 100644
--- a/web/app/components/app/access-point/access-control/policy-field.tsx
+++ b/web/app/components/app/access-point/access-control/policy-field.tsx
@@ -77,12 +77,12 @@ export function AccessControlPolicyField({
       <div className="flex w-full flex-col items-center gap-3 overflow-hidden rounded-lg border border-dashed border-divider-regular px-4 py-5">
         <div className="flex w-full flex-col gap-1 text-center">
           <p className="system-sm-medium text-text-secondary">
-            {canManagePolicies
-              ? t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })
-              : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
+            {t(($) => $['studio.accessControl.emptyPoliciesTitle'], { ns: 'deployments' })}
           </p>
           <p className="system-xs-regular text-text-tertiary">
-            {t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })}
+            {canManagePolicies
+              ? t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })
+              : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
           </p>
         </div>
         {canCreatePolicy ? (
diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
index b283bf4272d577..dbee54d30f08ef 100644
--- a/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/index.spec.tsx
@@ -718,6 +718,10 @@ describe('IpPoliciesPage', () => {
     expect(
       screen.getByRole('heading', { name: 'No IP policies in this workspace yet' }),
     ).toBeInTheDocument()
+    expect(screen.getByText('Ask a workspace owner or admin to create one.')).toBeInTheDocument()
+    expect(
+      screen.queryByText('A policy is the list of IP addresses allowed in.'),
+    ).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Create an IP policy' })).not.toBeInTheDocument()
     expect(screen.queryByRole('button', { name: 'Add' })).not.toBeInTheDocument()
     expect(trackEvent).toHaveBeenCalledExactlyOnceWith('ip_policy_interaction', {
diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index 7a5f27140a80e4..b558b92de75e7e 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -190,7 +190,9 @@ export default function IpPoliciesPage() {
               {t(($) => $['settings.ipPolicyEmptyTitle'], { ns: 'common' })}
             </h3>
             <p className="system-sm-regular leading-5 whitespace-pre-line text-text-tertiary">
-              {t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })}
+              {canManagePolicies
+                ? t(($) => $['settings.ipPolicyEmptyDescription'], { ns: 'common' })
+                : t(($) => $['studio.accessControl.emptyPoliciesReadOnly'], { ns: 'deployments' })}
             </p>
           </div>
           {canManagePolicies && (
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index 7424a7395f4649..5ba719e179ac5b 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -45,7 +45,7 @@
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
   "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランで利用できます。",
   "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
-  "studio.accessControl.emptyPoliciesReadOnly": "ワークスペースのオーナーまたは管理者に作成を依頼してください。",
+  "studio.accessControl.emptyPoliciesReadOnly": "ワークスペースの Owner または Admin に作成を依頼してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
   "studio.accessControl.ipPolicy": "IP ポリシー",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 08df5dd9d53327..0ca118ece3ed0b 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -45,7 +45,7 @@
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
   "studio.accessControl.downgradeDescription": "访问控制功能适用于 Professional 和 Team 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
-  "studio.accessControl.emptyPoliciesReadOnly": "请联系工作空间所有者或管理员创建 IP 策略。",
+  "studio.accessControl.emptyPoliciesReadOnly": "请联系工作空间的 Owner 或 Admin 创建。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
   "studio.accessControl.entryLabel": "访问控制",
   "studio.accessControl.ipPolicy": "IP 策略",

From 033d99a03fc1fa2412b531b04de8aafc2d7735e7 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:43:21 +0800
Subject: [PATCH 095/108] fix(web): preserve input-aware menu and panel focus
 (SNP-952)

---
 .../__tests__/focus.browser.spec.tsx          |  63 ++++++++++
 .../app/access-point/access-control/index.tsx |   5 +
 .../__tests__/focus.browser.spec.tsx          | 114 ++++++++++++++++++
 .../header/account-dropdown/index.tsx         |  35 +++++-
 4 files changed, 215 insertions(+), 2 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/focus.browser.spec.tsx
 create mode 100644 web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx

diff --git a/web/app/components/app/access-point/access-control/__tests__/focus.browser.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/focus.browser.spec.tsx
new file mode 100644
index 00000000000000..ef955ae37cd25b
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/focus.browser.spec.tsx
@@ -0,0 +1,63 @@
+import { userEvent } from 'vite-plus/test/browser'
+import { render } from 'vitest-browser-react'
+import { seedAppNetworkAccessGroup, seedNetworkAccessGroups } from '@/test/console/network-access'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { createNuqsTestWrapper } from '@/test/nuqs-testing'
+import { AccessControlEntry } from '..'
+
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
+
+async function renderEntry() {
+  const { queryClient, wrapper: ConsoleProvider } = createConsoleQueryWrapper({
+    currentWorkspace: { role: 'owner' },
+    systemFeatures: { deployment_edition: 'CLOUD' },
+  })
+  seedNetworkAccessGroups(queryClient)
+  seedAppNetworkAccessGroup(queryClient, 'app-1')
+  const { wrapper: NuqsProvider } = createNuqsTestWrapper()
+  return render(
+    <ConsoleProvider>
+      <NuqsProvider>
+        <div style={{ padding: 40 }}>
+          <button type="button">Before access control</button>
+          <AccessControlEntry
+            appMode="chat"
+            appId="app-1"
+            appIcon={{}}
+            isPublished={false}
+            canEditBinding
+          />
+        </div>
+      </NuqsProvider>
+    </ConsoleProvider>,
+  )
+}
+
+// Unit DOM tests cannot reproduce the native focus-visible state caused by popup autofocus.
+it('opens Access Control with the pointer without highlighting the close button', async () => {
+  const screen = await renderEntry()
+  await screen.getByRole('button', { name: /studio.accessControl.entryLabel/ }).click()
+  const dialog = screen.getByRole('dialog')
+  await expect.element(dialog).toBeVisible()
+  const close = dialog.getByRole('button', { name: 'common.operation.close' })
+  await expect.element(dialog).toHaveFocus()
+  expect(close.element().matches(':focus-visible')).toBe(false)
+  await close.click()
+  await expect.element(dialog).not.toBeInTheDocument()
+})
+
+it('keeps the Access Control close button visibly focused when opened with the keyboard', async () => {
+  const screen = await renderEntry()
+  await screen.getByRole('button', { name: 'Before access control' }).click()
+  await userEvent.keyboard('{Tab}{Enter}')
+  const dialog = screen.getByRole('dialog')
+  const close = dialog.getByRole('button', { name: 'common.operation.close' })
+  await expect.element(close).toHaveFocus()
+  expect(close.element().matches(':focus-visible')).toBe(true)
+  expect(getComputedStyle(close.element()).boxShadow).not.toBe('none')
+  await userEvent.keyboard('{Enter}')
+  await expect.element(dialog).not.toBeInTheDocument()
+  await expect
+    .element(screen.getByRole('button', { name: /studio.accessControl.entryLabel/ }))
+    .toHaveFocus()
+})
diff --git a/web/app/components/app/access-point/access-control/index.tsx b/web/app/components/app/access-point/access-control/index.tsx
index c55fb6d59a589b..8a84c7255628dc 100644
--- a/web/app/components/app/access-point/access-control/index.tsx
+++ b/web/app/components/app/access-point/access-control/index.tsx
@@ -149,6 +149,7 @@ function AccessControlSession({
     consoleQuery.workspaces.current.networkAccessGroups.post.mutationOptions(),
   )
   const [open, setOpen] = useState(false)
+  const panelRef = useRef<HTMLDivElement>(null)
   const [view, setView] = useState<'config' | 'status'>('status')
   const [showBack, setShowBack] = useState(false)
   const [draft, setDraft] = useState<AccessControlDraft | null>(null)
@@ -532,6 +533,10 @@ function AccessControlSession({
             />
           </TooltipTrigger>
           <PopoverContent
+            ref={panelRef}
+            initialFocus={(interactionType) =>
+              interactionType === 'keyboard' || interactionType === '' ? true : panelRef.current
+            }
             placement="bottom-end"
             className="w-100 rounded-2xl border-divider-regular p-0 backdrop-blur-[5px] transition-none data-starting-style:scale-100 data-starting-style:opacity-100"
           >
diff --git a/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx b/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx
new file mode 100644
index 00000000000000..48260fba07790b
--- /dev/null
+++ b/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx
@@ -0,0 +1,114 @@
+import { Dialog, DialogContent, DialogTitle } from '@langgenius/dify-ui/dialog'
+import { useQueryState } from 'nuqs'
+import { userEvent } from 'vite-plus/test/browser'
+import { render } from 'vitest-browser-react'
+import {
+  settingsQueryParamName,
+  settingsQueryParser,
+} from '@/app/components/header/account-setting/query-params'
+import AccountSection from '@/app/components/main-nav/components/account-section'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { createNuqsTestWrapper } from '@/test/nuqs-testing'
+
+vi.mock('@/service/use-common', () => ({ useLogout: () => ({ mutate: vi.fn() }) }))
+vi.mock('next-themes', () => ({
+  useTheme: () => ({ theme: 'system', setTheme: vi.fn() }),
+}))
+
+// The settings contents are outside the menu's focus contract; retain a real destination dialog.
+function PreferencesDestination() {
+  const [destination] = useQueryState(settingsQueryParamName, settingsQueryParser)
+  return (
+    <Dialog open={destination === 'preferences'}>
+      <DialogContent>
+        <DialogTitle>Preferences destination</DialogTitle>
+        <label>
+          Preference
+          <input />
+        </label>
+      </DialogContent>
+    </Dialog>
+  )
+}
+
+async function renderAccount() {
+  const { wrapper: ConsoleProvider } = createConsoleQueryWrapper({
+    accountProfile: { name: 'Current User', email: 'current@example.com' },
+    features: { education: { enabled: false } },
+  })
+  const { wrapper: NuqsProvider } = createNuqsTestWrapper()
+  return render(
+    <ConsoleProvider>
+      <NuqsProvider>
+        <div style={{ padding: 40 }}>
+          <button type="button">Before account</button>
+          <AccountSection />
+        </div>
+        <PreferencesDestination />
+      </NuqsProvider>
+    </ConsoleProvider>,
+  )
+}
+
+// Chromium supplies the native focus-visible heuristic after menu focus restoration.
+it.each(['outside', 'Escape'])(
+  'does not highlight a pointer-opened account trigger after %s dismissal',
+  async (dismiss) => {
+    const screen = await renderAccount()
+    const trigger = screen.getByRole('button', {
+      name: 'Current User accountSettings.account.account',
+    })
+    await trigger.click()
+    await expect.element(screen.getByRole('menu')).toBeVisible()
+    if (dismiss === 'Escape') await userEvent.keyboard('{Escape}')
+    else
+      await screen
+        .getByRole('presentation')
+        .filter({ hasNotText: 'current@example.com' })
+        .click({ position: { x: 10, y: 600 } })
+    await expect.element(screen.getByRole('menu')).not.toBeInTheDocument()
+    if (dismiss === 'Escape') await expect.element(trigger).toHaveFocus()
+    expect(trigger.element().matches(':focus-visible')).toBe(false)
+  },
+)
+
+it('keeps focus in Preferences after the account menu finishes closing', async () => {
+  const settings = globalThis as typeof globalThis & { BASE_UI_ANIMATIONS_DISABLED: boolean }
+  const animationsDisabled = settings.BASE_UI_ANIMATIONS_DISABLED
+  settings.BASE_UI_ANIMATIONS_DISABLED = false
+  try {
+    const screen = await renderAccount()
+    await screen
+      .getByRole('button', { name: 'Current User accountSettings.account.account' })
+      .click()
+    await screen.getByRole('menuitem', { name: 'navigation.settings.preferences' }).click()
+    const input = screen.getByRole('textbox', { name: 'Preference' })
+    await expect.element(input).toHaveFocus()
+    await expect.element(screen.getByRole('menu')).not.toBeInTheDocument()
+    await expect.element(input).toHaveFocus()
+  } finally {
+    settings.BASE_UI_ANIMATIONS_DISABLED = animationsDisabled
+  }
+})
+
+it.each(['keyboard', 'pointer then keyboard'])(
+  'keeps visible focus after %s navigation and Escape dismissal',
+  async (interaction) => {
+    const screen = await renderAccount()
+    const trigger = screen.getByRole('button', {
+      name: 'Current User accountSettings.account.account',
+    })
+    if (interaction === 'keyboard') {
+      await screen.getByRole('button', { name: 'Before account' }).click()
+      await userEvent.keyboard('{Tab}{Enter}')
+    } else {
+      await trigger.click()
+      await userEvent.keyboard('{ArrowDown}')
+    }
+    await expect.element(screen.getByRole('menu')).toBeVisible()
+    await userEvent.keyboard('{Escape}')
+    await expect.element(trigger).toHaveFocus()
+    expect(trigger.element().matches(':focus-visible')).toBe(true)
+    expect(getComputedStyle(trigger.element()).boxShadow).not.toBe('none')
+  },
+)
diff --git a/web/app/components/header/account-dropdown/index.tsx b/web/app/components/header/account-dropdown/index.tsx
index a9ecc994bfa865..4ef253a77dfc65 100644
--- a/web/app/components/header/account-dropdown/index.tsx
+++ b/web/app/components/header/account-dropdown/index.tsx
@@ -22,7 +22,7 @@ import {
 import { useQuery, useSuspenseQuery } from '@tanstack/react-query'
 import { useTheme } from 'next-themes'
 import { useQueryState } from 'nuqs'
-import { useSyncExternalStore } from 'react'
+import { useRef, useSyncExternalStore } from 'react'
 import { useTranslation } from 'react-i18next'
 import PremiumBadge from '@/app/components/base/premium-badge'
 import {
@@ -214,6 +214,9 @@ function MainNavMenuContent({ onLogout }: MainNavMenuContentProps) {
 }
 
 export default function AccountDropdown({ trigger }: AccountDropdownProps) {
+  const triggerRef = useRef<HTMLButtonElement>(null)
+  const popupRef = useRef<HTMLDivElement>(null)
+  const keyboardNavigationRef = useRef(false)
   const isHydrating = useSyncExternalStore(
     subscribeHydrationState,
     getHydrationSnapshot,
@@ -225,14 +228,42 @@ export default function AccountDropdown({ trigger }: AccountDropdownProps) {
 
   return (
     <div>
-      <DropdownMenu>
+      <DropdownMenu
+        onOpenChange={(open, { event }) => {
+          if (open)
+            keyboardNavigationRef.current =
+              event.type.startsWith('key') ||
+              (event.type === 'click' && 'detail' in event && event.detail === 0)
+        }}
+      >
         <DropdownMenuTrigger
+          ref={triggerRef}
+          onKeyDownCapture={(event) => {
+            if (event.key !== 'Escape') keyboardNavigationRef.current = true
+          }}
           disabled={isHydrating}
           render={trigger({
             ariaLabel: t(($) => $['account.account'], { ns: 'accountSettings' }),
           })}
         />
         <DropdownMenuContent
+          ref={popupRef}
+          onKeyDownCapture={(event) => {
+            if (event.key !== 'Escape') keyboardNavigationRef.current = true
+          }}
+          finalFocus={(interactionType) => {
+            const activeElement = document.activeElement
+            if (
+              activeElement !== document.body &&
+              activeElement !== triggerRef.current &&
+              !popupRef.current?.contains(activeElement)
+            )
+              return false
+            if (keyboardNavigationRef.current || interactionType !== 'keyboard') return true
+            // Escape alone should not turn a pointer-opened menu into keyboard navigation.
+            triggerRef.current?.focus({ preventScroll: true, focusVisible: false })
+            return false
+          }}
           placement="top-start"
           sideOffset={6}
           alignOffset={4}

From a76ed55f9a55a1d00b87d57ea7e135a71e9bbbb8 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 17:45:28 +0800
Subject: [PATCH 096/108] fix(web): align sandbox access control upgrade copy
 (SNP-955)

---
 .../access-control/__tests__/index.spec.tsx        | 14 ++++++++------
 web/i18n/locales/en-US/deployments.json            |  6 +++---
 web/i18n/locales/ja-JP/deployments.json            |  8 ++++----
 web/i18n/locales/zh-Hans/deployments.json          |  6 +++---
 web/i18n/resources.generated.d.ts                  |  6 +++---
 5 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index ef1d44c4d551d5..067659f9d67908 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -322,9 +322,7 @@ describe('AccessControlEntry', () => {
     expect(within(chip).getByText('PRO')).toBeInTheDocument()
     expect(within(chip).queryByRole('button')).not.toBeInTheDocument()
     await user.hover(chip)
-    expect(
-      await screen.findByText('Access control is available on Professional and Team plans.'),
-    ).toBeInTheDocument()
+    expect(await screen.findByText('Available on Professional and Team plans')).toBeInTheDocument()
     expect(screen.queryByText(/No longer protected/)).not.toBeInTheDocument()
   })
 
@@ -369,7 +367,11 @@ describe('AccessControlEntry', () => {
 
     await user.click(getChip())
 
-    expect(screen.getByText('Restrict this app to IP addresses you trust.')).toBeInTheDocument()
+    expect(
+      screen.getByRole('dialog', { name: 'Restrict this app to IP addresses you trust' }),
+    ).toHaveAccessibleDescription(
+      'Only requests from the IP policies you choose can reach this app’s access points. Available on Professional and Team plans.',
+    )
     expect(
       screen.getByText("This app is only available on your organization's network."),
     ).toBeInTheDocument()
@@ -393,13 +395,13 @@ describe('AccessControlEntry', () => {
     renderEntry({ plan: 'sandbox' })
 
     await user.click(getChip())
-    expect(screen.getByText('Restrict this app to IP addresses you trust.')).toBeInTheDocument()
+    expect(screen.getByText('Restrict this app to IP addresses you trust')).toBeInTheDocument()
 
     await user.keyboard('{Escape}')
 
     await waitFor(() => {
       expect(
-        screen.queryByText('Restrict this app to IP addresses you trust.'),
+        screen.queryByText('Restrict this app to IP addresses you trust'),
       ).not.toBeInTheDocument()
     })
     expect(mockSetPricing).not.toHaveBeenCalled()
diff --git a/web/i18n/locales/en-US/deployments.json b/web/i18n/locales/en-US/deployments.json
index a0dee02cad75d9..ab5f122f9d1c72 100644
--- a/web/i18n/locales/en-US/deployments.json
+++ b/web/i18n/locales/en-US/deployments.json
@@ -53,8 +53,8 @@
   "studio.accessControl.manageIpPolicies": "Manage IP policies",
   "studio.accessControl.notEnabled": "Not protected",
   "studio.accessControl.pausedDescription": "Paused — {{name}} is configured but not enforcing",
-  "studio.accessControl.paywallDescription": "Restrict this app to IP addresses you trust.",
-  "studio.accessControl.paywallTitle": "Access Control",
+  "studio.accessControl.paywallDescription": "Only requests from the IP policies you choose can reach this app’s access points. Available on Professional and Team plans.",
+  "studio.accessControl.paywallTitle": "Restrict this app to IP addresses you trust",
   "studio.accessControl.policyChanged": "This policy changed. Review the warning before saving again.",
   "studio.accessControl.policySummaryMany_one": "Allows {{first}}, {{second}} and {{count}} more address",
   "studio.accessControl.policySummaryMany_other": "Allows {{first}}, {{second}} and {{count}} more addresses",
@@ -79,7 +79,7 @@
   "studio.accessControl.tooltipDowngraded": "No longer protected — available on Professional and Team plans",
   "studio.accessControl.tooltipOff": "Not set up",
   "studio.accessControl.tooltipPaused": "Configured but paused",
-  "studio.accessControl.tooltipPro": "Access control is available on Professional and Team plans.",
+  "studio.accessControl.tooltipPro": "Available on Professional and Team plans",
   "studio.accessControl.tooltipProtected": "{{n}} of {{total}} access points are protected",
   "studio.accessControl.turnOffConfirm": "Turn off",
   "studio.accessControl.turnOffDescription": "All access points will be reachable from any IP address. Your configuration will be kept.",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index 5ba719e179ac5b..9211c058000e75 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -53,8 +53,8 @@
   "studio.accessControl.manageIpPolicies": "IP ポリシーを管理",
   "studio.accessControl.notEnabled": "保護されていません",
   "studio.accessControl.pausedDescription": "一時停止中、{{name}} は設定済みですが適用されていません",
-  "studio.accessControl.paywallDescription": "信頼できる IP アドレスからのみ、このアプリにアクセスできるようにします。",
-  "studio.accessControl.paywallTitle": "アクセス制御",
+  "studio.accessControl.paywallDescription": "選択した IP ポリシーからのリクエストのみがこのアプリのアクセスポイントに到達できます。Professional および Team プランでご利用いただけます。",
+  "studio.accessControl.paywallTitle": "信頼できる IP アドレスのみにこのアプリへのアクセスを制限",
   "studio.accessControl.policyChanged": "このポリシーは変更されました。警告を確認してから再度保存してください。",
   "studio.accessControl.policySummaryMany_one": "{{first}}、{{second}} と他 {{count}} 件のアドレスを許可",
   "studio.accessControl.policySummaryMany_other": "{{first}}、{{second}} と他 {{count}} 件のアドレスを許可",
@@ -79,12 +79,12 @@
   "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます",
   "studio.accessControl.tooltipOff": "未設定",
   "studio.accessControl.tooltipPaused": "設定済み、一時停止中",
-  "studio.accessControl.tooltipPro": "アクセス制御は Professional および Team プランで利用できます。",
+  "studio.accessControl.tooltipPro": "Professional および Team プランでご利用いただけます",
   "studio.accessControl.tooltipProtected": "アクセスポイント {{total}} 個中 {{n}} 個が保護されています",
   "studio.accessControl.turnOffConfirm": "オフにする",
   "studio.accessControl.turnOffDescription": "すべてのアクセスポイントが任意の IP アドレスからアクセス可能になります。設定内容は保持されます。",
   "studio.accessControl.turnOffTitle": "IP アクセス制御をオフにしますか？",
-  "studio.accessControl.turnOn": "アクセス制御をオンにする",
+  "studio.accessControl.turnOn": "アクセス制御を有効にする",
   "studio.accessControl.viewIpPolicies": "IP ポリシーを表示",
   "studio.accessPoint.apiDescription": "HTTP 経由でアプリをサービスに統合",
   "studio.accessPoint.description": "このアプリにアクセスするすべての方法。アクセスポイントは実行中のバージョンのみに対応します。",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index 0ca118ece3ed0b..f95940ce4db1ee 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -53,8 +53,8 @@
   "studio.accessControl.manageIpPolicies": "管理 IP 策略",
   "studio.accessControl.notEnabled": "未保护",
   "studio.accessControl.pausedDescription": "已暂停，{{name}} 已配置但未生效",
-  "studio.accessControl.paywallDescription": "将此应用限制为仅允许你信任的 IP 地址访问。",
-  "studio.accessControl.paywallTitle": "访问控制",
+  "studio.accessControl.paywallDescription": "只有来自所选 IP 策略的请求才能访问此应用的访问入口。适用于 Professional 和 Team 套餐。",
+  "studio.accessControl.paywallTitle": "仅允许可信 IP 地址访问此应用",
   "studio.accessControl.policyChanged": "此策略已发生变化，请确认风险提示后再次保存。",
   "studio.accessControl.policySummaryMany_one": "允许 {{first}}、{{second}} 及另外 {{count}} 个地址",
   "studio.accessControl.policySummaryMany_other": "允许 {{first}}、{{second}} 及另外 {{count}} 个地址",
@@ -79,7 +79,7 @@
   "studio.accessControl.tooltipDowngraded": "已不再受保护，适用于 Professional 和 Team 套餐",
   "studio.accessControl.tooltipOff": "尚未配置",
   "studio.accessControl.tooltipPaused": "已配置但已暂停",
-  "studio.accessControl.tooltipPro": "访问控制功能适用于 Professional 和 Team 套餐。",
+  "studio.accessControl.tooltipPro": "适用于 Professional 和 Team 套餐",
   "studio.accessControl.tooltipProtected": "{{total}} 个访问入口中的 {{n}} 个已保护",
   "studio.accessControl.turnOffConfirm": "关闭",
   "studio.accessControl.turnOffDescription": "所有访问入口将对任意 IP 地址开放。您的配置会被保留。",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index aef257c31a6dec..838076ad6f88bb 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -3013,8 +3013,8 @@ export default interface Resources {
     'studio.accessControl.manageIpPolicies': 'Manage IP policies'
     'studio.accessControl.notEnabled': 'Not protected'
     'studio.accessControl.pausedDescription': 'Paused — {{name}} is configured but not enforcing'
-    'studio.accessControl.paywallDescription': 'Restrict this app to IP addresses you trust.'
-    'studio.accessControl.paywallTitle': 'Access Control'
+    'studio.accessControl.paywallDescription': 'Only requests from the IP policies you choose can reach this app’s access points. Available on Professional and Team plans.'
+    'studio.accessControl.paywallTitle': 'Restrict this app to IP addresses you trust'
     'studio.accessControl.policyChanged': 'This policy changed. Review the warning before saving again.'
     'studio.accessControl.policySummaryMany':
       | 'Allows {{first}}, {{second}} and {{count}} more address'
@@ -3040,7 +3040,7 @@ export default interface Resources {
     'studio.accessControl.tooltipDowngraded': 'No longer protected — available on Professional and Team plans'
     'studio.accessControl.tooltipOff': 'Not set up'
     'studio.accessControl.tooltipPaused': 'Configured but paused'
-    'studio.accessControl.tooltipPro': 'Access control is available on Professional and Team plans.'
+    'studio.accessControl.tooltipPro': 'Available on Professional and Team plans'
     'studio.accessControl.tooltipProtected': '{{n}} of {{total}} access points are protected'
     'studio.accessControl.turnOffConfirm': 'Turn off'
     'studio.accessControl.turnOffDescription': 'All access points will be reachable from any IP address. Your configuration will be kept.'

From 1ac214e91e4eeade8a0c3d9832bb58471913a0ab Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 12 Oct 2026 22:57:41 +0800
Subject: [PATCH 097/108] fix: clear stale account menu pointer focus ring
 (SNP-952)

---
 .../__tests__/focus.browser.spec.tsx          | 37 +++++++++++++++++++
 .../header/account-dropdown/index.tsx         | 32 ++++++++++++----
 2 files changed, 61 insertions(+), 8 deletions(-)

diff --git a/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx b/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx
index 48260fba07790b..6948fae18cb696 100644
--- a/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx
+++ b/web/app/components/header/account-dropdown/__tests__/focus.browser.spec.tsx
@@ -112,3 +112,40 @@ it.each(['keyboard', 'pointer then keyboard'])(
     expect(getComputedStyle(trigger.element()).boxShadow).not.toBe('none')
   },
 )
+
+it('clears the keyboard focus ring when the same account menu is reopened and dismissed with the pointer', async () => {
+  const settings = globalThis as typeof globalThis & { BASE_UI_ANIMATIONS_DISABLED: boolean }
+  const animationsDisabled = settings.BASE_UI_ANIMATIONS_DISABLED
+  settings.BASE_UI_ANIMATIONS_DISABLED = false
+  try {
+    const screen = await renderAccount()
+    const trigger = screen.getByRole('button', {
+      name: 'Current User accountSettings.account.account',
+    })
+    const menu = screen.getByRole('menu')
+    const dismissWithPointer = async () => {
+      await trigger.click()
+      await expect.element(menu).toBeVisible()
+      await screen
+        .getByRole('presentation')
+        .filter({ hasNotText: 'current@example.com' })
+        .click({ position: { x: 10, y: 600 } })
+      await expect.element(menu).not.toBeInTheDocument()
+      expect(trigger.element().matches(':focus-visible')).toBe(false)
+    }
+
+    await dismissWithPointer()
+
+    await screen.getByRole('button', { name: 'Before account' }).click()
+    await userEvent.keyboard('{Tab}{Enter}{ArrowDown}')
+    await expect.element(menu).toBeVisible()
+    await userEvent.keyboard('{Escape}')
+    await expect.element(menu).not.toBeInTheDocument()
+    await expect.element(trigger).toHaveFocus()
+    expect(trigger.element().matches(':focus-visible')).toBe(true)
+
+    await dismissWithPointer()
+  } finally {
+    settings.BASE_UI_ANIMATIONS_DISABLED = animationsDisabled
+  }
+})
diff --git a/web/app/components/header/account-dropdown/index.tsx b/web/app/components/header/account-dropdown/index.tsx
index 4ef253a77dfc65..bfd2519d18255e 100644
--- a/web/app/components/header/account-dropdown/index.tsx
+++ b/web/app/components/header/account-dropdown/index.tsx
@@ -252,16 +252,32 @@ export default function AccountDropdown({ trigger }: AccountDropdownProps) {
             if (event.key !== 'Escape') keyboardNavigationRef.current = true
           }}
           finalFocus={(interactionType) => {
-            const activeElement = document.activeElement
+            const canRestoreFocus = () => {
+              const activeElement = document.activeElement
+              return (
+                activeElement === document.body ||
+                activeElement === triggerRef.current ||
+                !!popupRef.current?.contains(activeElement)
+              )
+            }
             if (
-              activeElement !== document.body &&
-              activeElement !== triggerRef.current &&
-              !popupRef.current?.contains(activeElement)
+              interactionType === 'touch' ||
+              interactionType === '' ||
+              (interactionType === 'keyboard' && keyboardNavigationRef.current)
             )
-              return false
-            if (keyboardNavigationRef.current || interactionType !== 'keyboard') return true
-            // Escape alone should not turn a pointer-opened menu into keyboard navigation.
-            triggerRef.current?.focus({ preventScroll: true, focusVisible: false })
+              return canRestoreFocus()
+            // Restore after dismissal, respecting focus moved into a destination dialog.
+            queueMicrotask(() => {
+              if (!canRestoreFocus()) return
+              const triggerElement = triggerRef.current
+              // Focusing an already focused element does not update its focus-visible state.
+              if (
+                document.activeElement === triggerElement &&
+                triggerElement?.matches(':focus-visible')
+              )
+                triggerElement.blur()
+              triggerElement?.focus({ preventScroll: true, focusVisible: false })
+            })
             return false
           }}
           placement="top-start"

From 2b8d97b645a01f638856b3c1754e5fb678e2b0d4 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 00:08:15 +0800
Subject: [PATCH 098/108] fix(web): extend IP policy row interaction area
 (SNP-956)

---
 .../__tests__/policy-item.browser.spec.tsx    | 78 +++++++++++++++++++
 .../ip-policies-page/policy-item.tsx          | 11 ++-
 2 files changed, 85 insertions(+), 4 deletions(-)
 create mode 100644 web/app/components/header/account-setting/ip-policies-page/__tests__/policy-item.browser.spec.tsx

diff --git a/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-item.browser.spec.tsx b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-item.browser.spec.tsx
new file mode 100644
index 00000000000000..4d8b2c16c5c64a
--- /dev/null
+++ b/web/app/components/header/account-setting/ip-policies-page/__tests__/policy-item.browser.spec.tsx
@@ -0,0 +1,78 @@
+import { userEvent } from 'vite-plus/test/browser'
+import { render } from 'vitest-browser-react'
+import { createNetworkAccessGroupFixture } from '@/test/console/network-access'
+import { createConsoleQueryWrapper } from '@/test/console/query-data'
+import { PolicyItem } from '../policy-item'
+
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
+
+async function renderPolicy(canMutate = true) {
+  const group = createNetworkAccessGroupFixture()
+  const onView = vi.fn()
+  const onEdit = vi.fn()
+  const { wrapper: ConsoleProvider } = createConsoleQueryWrapper()
+  const screen = await render(
+    <ConsoleProvider>
+      <button type="button">Before policy</button>
+      <section aria-label="IP policy row" style={{ width: 800 }}>
+        <PolicyItem group={group} canMutate={canMutate} onView={onView} onEdit={onEdit} />
+      </section>
+    </ConsoleProvider>,
+  )
+  return { screen, group, onView, onEdit }
+}
+
+// Real hit testing catches the row padding that unit clicks on the name button do not reach.
+it.each([true, false])(
+  'opens the policy from padding on every side of the row (can manage: %s)',
+  async (canMutate) => {
+    const { screen, group, onView, onEdit } = await renderPolicy(canMutate)
+    const row = screen.getByRole('region', { name: 'IP policy row' })
+    const { width, height } = row.element().getBoundingClientRect()
+    const positions = [
+      { x: width / 2, y: 2 },
+      { x: width / 2, y: height - 2 },
+      { x: 2, y: height / 2 },
+      { x: width - 2, y: height / 2 },
+    ]
+    if (!canMutate) positions.push({ x: width - 20, y: height / 2 })
+
+    for (const [index, position] of positions.entries()) {
+      await row.click({ position })
+      expect(onView).toHaveBeenCalledTimes(index + 1)
+      expect(onView).toHaveBeenLastCalledWith(group)
+    }
+    expect(onEdit).not.toHaveBeenCalled()
+  },
+)
+
+it('keeps the row and its separate actions reachable with pointer and keyboard', async () => {
+  const { screen, group, onView, onEdit } = await renderPolicy()
+  const policy = screen.getByRole('button', { name: group.name })
+  const more = screen.getByRole('button', { name: /common.operation.moreActionsFor/ })
+
+  await more.click()
+  await screen.getByRole('menuitem', { name: 'common.operation.edit' }).click()
+  expect(onEdit).toHaveBeenCalledExactlyOnceWith(group)
+  expect(onView).not.toHaveBeenCalled()
+
+  await more.click()
+  await screen.getByRole('menuitem', { name: 'common.operation.delete' }).click()
+  const confirmation = screen.getByRole('alertdialog')
+  await expect.element(confirmation).toBeVisible()
+  expect(onView).not.toHaveBeenCalled()
+  await confirmation.getByRole('button', { name: 'common.operation.cancel' }).click()
+  await expect.element(confirmation).not.toBeInTheDocument()
+
+  await screen.getByRole('button', { name: 'Before policy' }).click()
+  await userEvent.tab()
+  await expect.element(policy).toHaveFocus()
+  expect(policy.element().matches(':focus-visible')).toBe(true)
+  await userEvent.keyboard('{Enter}')
+  expect(onView).toHaveBeenCalledExactlyOnceWith(group)
+  await userEvent.tab()
+  await expect.element(more).toHaveFocus()
+  await userEvent.keyboard('{Enter}')
+  await expect.element(screen.getByRole('menu')).toBeVisible()
+  expect(onView).toHaveBeenCalledTimes(1)
+})
diff --git a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
index eb81ab256eeab7..c03aad767e299f 100644
--- a/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/policy-item.tsx
@@ -83,11 +83,14 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
   }
 
   return (
-    <div className={`${policyRowClassName} border-b border-divider-subtle py-3`}>
+    <div
+      className={`${policyRowClassName} relative border-b border-divider-subtle py-3 hover:bg-state-base-hover`}
+    >
+      {/* Extend the native button's hit area across the row without nesting the actions. */}
       <Button
         variant="ghost"
         aria-label={group.name}
-        className="h-auto min-w-0 flex-1 justify-start gap-0 rounded-none p-0 text-left"
+        className="h-auto min-w-0 flex-1 justify-start gap-0 overflow-visible rounded-none p-0 text-left after:absolute after:inset-0 hover:bg-transparent"
         onClick={() => onView(group)}
       >
         <span className={`${policyNameColClassName} system-sm-medium text-text-secondary`}>
@@ -103,7 +106,7 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
           {formatTimeFromNow(Date.parse(group.updated_at))}
         </span>
       </Button>
-      <div className={policyActionsColClassName}>
+      <div className={`${policyActionsColClassName} pointer-events-none relative`}>
         {canMutate && (
           <DropdownMenu open={menuOpen} onOpenChange={setMenuOpen}>
             <Tooltip>
@@ -117,7 +120,7 @@ export function PolicyItem({ group, canMutate, onView, onEdit }: PolicyItemProps
                           ns: 'common',
                           name: group.name,
                         })}
-                        className="data-popup-open:bg-state-base-hover"
+                        className="pointer-events-auto data-popup-open:bg-state-base-hover"
                       >
                         <span aria-hidden className="i-ri-more-fill size-4 text-text-tertiary" />
                       </IconButton>

From f956aa8c92bbae88624ad7fa3fc012d7adebae9d Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 00:50:48 +0800
Subject: [PATCH 099/108] fix: respect Normal member access point read
 permissions

---
 oxlint-suppressions.json                      |   2 +-
 .../__tests__/built-in-access-points.spec.tsx |  58 +++-
 .../__tests__/built-in-permissions.spec.tsx   | 257 ++++++++++++++++++
 .../access-point/__tests__/mcp-card.spec.tsx  |   3 +-
 .../built-in-access-points/index.tsx          |  56 +++-
 .../built-in-access-points/mcp-card.tsx       |  16 +-
 web/app/components/app/access-point/index.tsx |   4 +
 web/service/use-tools.ts                      |  33 +--
 8 files changed, 376 insertions(+), 53 deletions(-)
 create mode 100644 web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx

diff --git a/oxlint-suppressions.json b/oxlint-suppressions.json
index 156a7a824397ab..959677683c2944 100644
--- a/oxlint-suppressions.json
+++ b/oxlint-suppressions.json
@@ -4471,7 +4471,7 @@
   },
   "web/service/use-tools.ts": {
     "@tanstack/query/prefer-query-options": {
-      "count": 15
+      "count": 13
     },
     "no-restricted-imports": {
       "count": 1
diff --git a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
index 04406ecc119070..f1c3f55322f1f0 100644
--- a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
@@ -1,5 +1,5 @@
 import { screen } from '@testing-library/react'
-import { render } from '@/test/console/render'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { BuiltInAccessPoints } from '../built-in-access-points'
 
 const mocks = vi.hoisted(() => ({
@@ -111,6 +111,7 @@ describe('BuiltInAccessPoints', () => {
   it('renders the unpublished state across all access point cards', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -148,6 +149,7 @@ describe('BuiltInAccessPoints', () => {
 
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -177,7 +179,13 @@ describe('BuiltInAccessPoints', () => {
       enable_api: true,
     }
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(screen.getByText('deployments.studio.accessPoint.noPublishedTitle')).toBeInTheDocument()
@@ -188,7 +196,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ triggerModeDisabled: false }),
+      expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.triggerCard).not.toHaveBeenCalled()
     expect(mocks.useAppWorkflow).toHaveBeenCalledWith('app-1', expect.any(Object))
@@ -217,7 +225,13 @@ describe('BuiltInAccessPoints', () => {
       }
       mocks.workflow = workflow
       render(
-        <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+        <BuiltInAccessPoints
+          canViewLayout
+          appId="app-1"
+          canDeploy
+          canManageAccessPoint
+          canReleaseAndVersion
+        />,
       )
 
       expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability }))
@@ -232,6 +246,7 @@ describe('BuiltInAccessPoints', () => {
   it('uses Access Point management for every requested built-in operation', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -254,6 +269,7 @@ describe('BuiltInAccessPoints', () => {
   it('highlights only the targeted built-in access point card', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -280,7 +296,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(
@@ -290,7 +312,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ triggerModeDisabled: true }),
+      expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.triggerCard).toHaveBeenCalledWith(
       expect.objectContaining({ availability: 'available' }),
@@ -308,7 +330,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability: 'loading' }))
@@ -326,7 +354,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(
@@ -336,7 +370,13 @@ describe('BuiltInAccessPoints', () => {
 
   it('does not retry forbidden published workflow requests', () => {
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     const options = mocks.useAppWorkflow.mock.calls.at(-1)?.[1] as {
diff --git a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
new file mode 100644
index 00000000000000..7235694beb6ad2
--- /dev/null
+++ b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
@@ -0,0 +1,257 @@
+import type {
+  AppDetailWithSite,
+  WorkflowResponse,
+  WorkflowTriggerResponse,
+} from '@dify/contracts/api/console/apps/types.gen'
+import { screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import { toast } from '@/app/notifications'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
+import { createAppDetailFixture, createAppSiteFixture } from '@/test/fixtures/app'
+import { BuiltInAccessPoints } from '../built-in-access-points'
+
+vi.mock('@/app/notifications', () => ({ toast: { error: vi.fn(), success: vi.fn() } }))
+vi.mock('@/context/i18n', () => ({ useDocLink: () => (path: string) => path }))
+vi.mock('@/service/use-triggers', () => ({ useAllTriggerPlugins: () => ({ data: [] }) }))
+vi.mock('@/app/components/app/overview/customize', () => ({ default: () => null }))
+vi.mock('@/app/components/app/overview/settings', () => ({ default: () => null }))
+vi.mock('@/app/components/app/overview/embedded', () => ({ default: () => null }))
+
+const inService = 'agentV2.agentDetail.access.status.inService'
+const unavailable = 'deployments.health.ENVIRONMENT_STATUS_FAILED'
+const unpublishedTitle = 'deployments.studio.accessPoint.noPublishedTitle'
+const publishedPath = '/apps/app-1/workflows/publish'
+
+const getWebCard = () =>
+  screen.getByRole('region', { name: 'agentV2.agentDetail.access.webApp.title' })
+const getApiCard = () =>
+  screen.getByRole('region', { name: 'agentV2.agentDetail.access.serviceApi.title' })
+const getMcpCard = () => screen.getByRole('region', { name: 'tools.mcp.server.title' })
+const getTriggerCard = () => screen.getByRole('region', { name: 'navigation.settings.trigger' })
+
+const publishedWorkflow: WorkflowResponse = {
+  id: 'published-workflow',
+  graph: { nodes: [{ data: { type: 'start' } }] },
+  features: {},
+  conversation_variables: [],
+  environment_variables: [],
+  rag_pipeline_variables: [],
+  created_at: 1,
+  updated_at: 1,
+  hash: 'published-hash',
+  marked_comment: '',
+  marked_name: '',
+  tool_published: false,
+  version: 'published',
+}
+
+function renderAccessPoints({
+  mode = 'workflow',
+  role = 'normal',
+  published = true,
+  triggers = [],
+  workflow = publishedWorkflow,
+  rbacEnabled = false,
+  canViewLayout = role === 'owner',
+  triggerResponse,
+}: {
+  mode?: AppDetailWithSite['mode']
+  role?: 'normal' | 'owner'
+  published?: boolean
+  triggers?: WorkflowTriggerResponse[]
+  workflow?: WorkflowResponse | null
+  rbacEnabled?: boolean
+  canViewLayout?: boolean
+  triggerResponse?: Promise<Response>
+} = {}) {
+  const paths: string[] = []
+  vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+    const request = new Request(input, init)
+    const path = new URL(request.url).pathname.replace('/console/api', '')
+    if (request.method === 'POST' && path === '/apps/app-1/trigger-enable' && role === 'owner') {
+      const body = (await request.json()) as { trigger_id: string; enable_trigger: boolean }
+      triggers = triggers.map((trigger) =>
+        trigger.id === body.trigger_id
+          ? { ...trigger, status: body.enable_trigger ? 'enabled' : 'disabled' }
+          : trigger,
+      )
+      return Response.json({ result: 'success' })
+    }
+    if (request.method !== 'GET') throw new Error(`Unexpected mutation: ${request.method} ${path}`)
+    paths.push(path)
+    if (path === publishedPath) {
+      return role === 'normal' && !rbacEnabled
+        ? Response.json(
+            {
+              code: 'forbidden',
+              message: "You don't have the permission to access the requested resource.",
+            },
+            { status: 403 },
+          )
+        : Response.json(workflow)
+    }
+    if (path === '/apps/app-1/server')
+      return Response.json({ id: 'server-1', server_code: 'server-code', status: 'active' })
+    if (path === '/apps/app-1/triggers') return triggerResponse ?? Response.json({ data: triggers })
+    throw new Error(`Unexpected request: ${request.method} ${path}`)
+  })
+  useAppStore.setState({
+    appDetail: createAppDetailFixture({
+      mode,
+      site: createAppSiteFixture(),
+      workflow: published ? { id: 'published-workflow' } : null,
+    }),
+  })
+  renderWithConsoleQuery(
+    <BuiltInAccessPoints
+      appId="app-1"
+      canViewLayout={canViewLayout}
+      canDeploy={false}
+      canManageAccessPoint={role === 'owner'}
+      canReleaseAndVersion={role === 'owner'}
+    />,
+    {
+      currentWorkspace: { role },
+      systemFeatures: { deployment_edition: 'CLOUD', rbac_enabled: rbacEnabled },
+    },
+  )
+  return paths
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+it.each(['workflow', 'advanced-chat'] as const)(
+  'shows a published %s to Normal members without requesting its graph',
+  async (mode) => {
+    const paths = renderAccessPoints({ mode })
+
+    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+    expect(paths).not.toContain(publishedPath)
+    expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
+    expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
+    expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument()
+    expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+    expect(toast.error).not.toHaveBeenCalled()
+    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
+      expect(within(card).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
+    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(
+      mode === 'workflow' ? 1 : 0,
+    )
+  },
+)
+
+it('uses the app summary to identify an unpublished workflow for Normal members', async () => {
+  const paths = renderAccessPoints({ published: false })
+
+  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+  expect(paths).not.toContain(publishedPath)
+  expect(screen.getByText(unpublishedTitle)).toBeInTheDocument()
+  expect(within(getWebCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it('keeps published Owner access points available using the workflow graph', async () => {
+  const paths = renderAccessPoints({ role: 'owner' })
+
+  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
+  expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
+  expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
+  expect(within(getTriggerCard()).getByText(unavailable)).toBeInTheDocument()
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it.each(['disabled', 'unauthorized'])(
+  'preserves trigger-only availability for a Normal member when its trigger is %s',
+  async (status) => {
+    const paths = renderAccessPoints({
+      triggers: [
+        {
+          id: 'trigger-1',
+          node_id: 'trigger-node',
+          title: 'Published trigger',
+          trigger_type: 'trigger-webhook',
+          status,
+          icon: '',
+          provider_name: '',
+        },
+      ],
+    })
+
+    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+    expect(paths).not.toContain(publishedPath)
+    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
+      expect(within(card).getAllByText(unavailable).length).toBeGreaterThan(0)
+    expect(within(getTriggerCard()).getByText('Published trigger')).toBeInTheDocument()
+    expect(within(getTriggerCard()).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
+    expect(
+      screen.getByText('deployments.studio.accessPoint.triggerExclusiveNotice'),
+    ).toBeInTheDocument()
+    expect(toast.error).not.toHaveBeenCalled()
+  },
+)
+
+it('waits for published trigger metadata before showing Normal access point availability', async () => {
+  let finish!: (response: Response) => void
+  const triggerResponse = new Promise<Response>((resolve) => {
+    finish = resolve
+  })
+  const paths = renderAccessPoints({ triggerResponse })
+
+  await waitFor(() => expect(paths).toContain('/apps/app-1/triggers'))
+  expect(getWebCard()).toHaveAttribute('aria-busy', 'true')
+  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+
+  finish(Response.json({ data: [] }))
+  await waitFor(() => expect(within(getWebCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(1)
+  expect(paths).not.toContain(publishedPath)
+})
+
+it('honors RBAC layout access even for a Normal workspace member', async () => {
+  const paths = renderAccessPoints({ rbacEnabled: true, canViewLayout: true })
+
+  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it('keeps Owner MCP unavailable when the published graph has no Start node', async () => {
+  renderAccessPoints({ role: 'owner', workflow: { ...publishedWorkflow, graph: { nodes: [] } } })
+
+  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+  expect(within(getMcpCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
+  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+})
+
+it('refreshes the shared trigger query after an Owner changes a published trigger', async () => {
+  const user = userEvent.setup()
+  const paths = renderAccessPoints({
+    role: 'owner',
+    workflow: { ...publishedWorkflow, graph: { nodes: [{ data: { type: 'trigger-webhook' } }] } },
+    triggers: [
+      {
+        id: 'trigger-1',
+        node_id: 'trigger-node',
+        title: 'Published trigger',
+        trigger_type: 'trigger-webhook',
+        status: 'enabled',
+        icon: '',
+        provider_name: '',
+      },
+    ],
+  })
+
+  const toggle = await within(getTriggerCard()).findByRole('switch', { name: 'Published trigger' })
+  expect(toggle).toHaveAttribute('aria-checked', 'true')
+  await user.click(toggle)
+
+  await waitFor(() =>
+    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(2),
+  )
+  expect(toggle).toHaveAttribute('aria-checked', 'false')
+  expect(toast.error).not.toHaveBeenCalled()
+})
diff --git a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
index 4fd5ec63630054..1c1acc982adc44 100644
--- a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
@@ -118,9 +118,8 @@ function renderCard(cardAppInfo: AppDetailWithSite = appInfo, workflow?: Publish
       <MCPAccessPointCard
         appInfo={cardAppInfo}
         canManageAccessPoint
-        triggerModeDisabled={false}
+        availability="available"
         workflow={workflow}
-        workflowLoading={false}
       />
     </QueryClientProvider>,
   )
diff --git a/web/app/components/app/access-point/built-in-access-points/index.tsx b/web/app/components/app/access-point/built-in-access-points/index.tsx
index f0f3299f4ff827..0ac267998d7a33 100644
--- a/web/app/components/app/access-point/built-in-access-points/index.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/index.tsx
@@ -3,13 +3,16 @@
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { Button, buttonVariants } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { useSuspenseQuery } from '@tanstack/react-query'
+import { skipToken, useQuery, useSuspenseQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { LoadingPlaceholder } from '@/app/components/base/loading-placeholder'
 import { useDocLink } from '@/context/i18n'
+import { currentWorkspaceAtom, currentWorkspaceLoadingAtom } from '@/context/workspace-state'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
+import { consoleQuery } from '@/service/console'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { useAccessPointActions } from '../shared/use-access-point-actions'
 import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
@@ -20,6 +23,7 @@ import { WebAppAccessPointCard } from './web-app-card'
 
 type BuiltInAccessPointsProps = {
   appId: string
+  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -28,6 +32,7 @@ type BuiltInAccessPointsProps = {
 
 export function BuiltInAccessPoints({
   appId,
+  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -37,7 +42,13 @@ export function BuiltInAccessPoints({
   const docLink = useDocLink()
   const appInfo = useAppStore((state) => state.appDetail)
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo))
+  const workspace = useAtomValue(currentWorkspaceAtom)
+  const workspaceLoading = useAtomValue(currentWorkspaceLoadingAtom)
+  const canReadWorkflow =
+    canViewLayout &&
+    (systemFeatures.rbac_enabled ||
+      (!workspaceLoading && ['owner', 'admin', 'editor'].includes(workspace.role)))
+  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo) && canReadWorkflow)
   const {
     data: workflow,
     isError: workflowError,
@@ -49,15 +60,34 @@ export function BuiltInAccessPoints({
       return failureCount < 3
     },
   })
+  const useWorkflowSummary = Boolean(appInfo && isAdvancedApp(appInfo) && !canReadWorkflow)
+  const needsPublishedTriggers =
+    useWorkflowSummary && appInfo?.mode === 'workflow' && Boolean(appInfo.workflow?.id)
+  const triggersQuery = useQuery(
+    consoleQuery.apps.byAppId.triggers.get.queryOptions({
+      input: appInfo?.mode === 'workflow' ? { params: { app_id: appId } } : skipToken,
+      enabled: needsPublishedTriggers,
+      retry: false,
+    }),
+  )
   const actions = useAccessPointActions(appId, canManageAccessPoint)
 
   if (!appInfo) return <LoadingPlaceholder />
 
   const workflowState = getPublishedWorkflowState(appInfo, workflow)
-  const builtInLoading = workflowState.requiresPublishedWorkflow && workflowLoading
-  const appCardsUnavailable =
+  const isUnpublished = useWorkflowSummary ? !appInfo.workflow?.id : workflowState.isUnpublished
+  const hasTriggerNode = useWorkflowSummary
+    ? needsPublishedTriggers && Boolean(triggersQuery.data?.data.length)
+    : workflowState.hasTriggerNode
+  const builtInLoading =
     workflowState.requiresPublishedWorkflow &&
-    (workflowError || workflowState.isUnpublished || workflowState.hasTriggerNode)
+    (workspaceLoading ||
+      (shouldFetchWorkflow && workflowLoading) ||
+      (needsPublishedTriggers && triggersQuery.isPending))
+  const builtInError =
+    (shouldFetchWorkflow && workflowError) || (needsPublishedTriggers && triggersQuery.isError)
+  const appCardsUnavailable =
+    workflowState.requiresPublishedWorkflow && (builtInError || isUnpublished || hasTriggerNode)
   const appCardAvailability = builtInLoading
     ? 'loading'
     : appCardsUnavailable
@@ -65,13 +95,20 @@ export function BuiltInAccessPoints({
       : 'available'
   const triggerAvailability = builtInLoading
     ? 'loading'
-    : workflowState.isUnpublished || !workflowState.hasTriggerNode
+    : builtInError || isUnpublished || !hasTriggerNode
+      ? 'unavailable'
+      : 'available'
+  const mcpAvailability = builtInLoading
+    ? 'loading'
+    : appCardsUnavailable ||
+        (!workflowState.requiresPublishedWorkflow && !appInfo.model_config?.updated_at) ||
+        (canReadWorkflow && workflowState.isWorkflowApp && !workflowState.hasStartNode)
       ? 'unavailable'
       : 'available'
 
   return (
     <div className="flex h-full flex-col gap-2">
-      {workflowState.isUnpublished && !workflowLoading && !workflowError && (
+      {isUnpublished && !builtInLoading && !builtInError && (
         <div className="flex flex-col items-start gap-2 rounded-xl bg-background-section-burn p-3">
           <div className="flex flex-col gap-0.5">
             <span className="block system-md-semibold text-text-secondary">
@@ -127,8 +164,7 @@ export function BuiltInAccessPoints({
           appInfo={appInfo}
           canManageAccessPoint={canManageAccessPoint}
           workflow={workflow}
-          workflowLoading={workflowLoading}
-          triggerModeDisabled={workflowState.hasTriggerNode}
+          availability={mcpAvailability}
           highlighted={highlightedAccessPoint === 'mcp'}
         />
         {workflowState.isWorkflowApp && (
@@ -141,7 +177,7 @@ export function BuiltInAccessPoints({
         )}
       </div>
 
-      {workflowState.hasTriggerNode && (
+      {hasTriggerNode && (
         <div className="mt-2 flex min-h-10 items-center gap-2 rounded-xl bg-background-section-burn px-3 py-2 system-xs-regular text-text-tertiary">
           <span aria-hidden className="i-ri-information-line size-4 shrink-0" />
           <span>
diff --git a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
index 5e2c4f5ae08346..4366d788b69c53 100644
--- a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
@@ -2,6 +2,7 @@
 
 import type { AppDetailWithSite } from '@dify/contracts/api/console/apps/types.gen'
 import type { PublishedWorkflow } from '../shared/utils'
+import type { AccessPointAvailability } from '@/app/components/base/access-point/status'
 import {
   AlertDialog,
   AlertDialogCancelButton,
@@ -26,7 +27,6 @@ import {
   useMCPServerDetail,
   useRefreshMCPServerCode,
 } from '@/service/use-tools'
-import { AppModeEnum } from '@/types/app'
 import { useAccessPointStatusLabel } from '../shared/use-access-point-status-label'
 import { getPublishedWorkflowNodes, isAdvancedApp } from '../shared/utils'
 
@@ -34,23 +34,20 @@ type MCPAccessPointCardProps = {
   appInfo: AppDetailWithSite
   canManageAccessPoint: boolean
   highlighted?: boolean
-  triggerModeDisabled: boolean
+  availability: AccessPointAvailability
   workflow: PublishedWorkflow
-  workflowLoading: boolean
 }
 
 export function MCPAccessPointCard({
   appInfo,
   canManageAccessPoint,
   highlighted,
-  triggerModeDisabled,
+  availability,
   workflow,
-  workflowLoading,
 }: MCPAccessPointCardProps) {
   const { t } = useTranslation(['appOverview', 'common', 'deployments', 'tools'])
   const advancedApp = isAdvancedApp(appInfo)
   const basicApp = !advancedApp
-  const workflowApp = appInfo.mode === AppModeEnum.WORKFLOW
   const [showServerModal, setShowServerModal] = useState(false)
   const [showRegenerate, setShowRegenerate] = useState(false)
   const basicConfig = appInfo.model_config
@@ -84,11 +81,8 @@ export function MCPAccessPointCard({
     ? `${appInfo.api_base_url.replace(/\/v1$/, '')}/mcp/server/${detail?.server_code}/mcp`
     : '***********'
   const workflowNodes = getPublishedWorkflowNodes(workflow)
-  const missingStartNode =
-    workflowApp && !workflowNodes.some((node) => node.data.type === BlockEnum.Start)
-  const appUnpublished = advancedApp ? !workflow?.graph : !basicConfig?.updated_at
-  const loading = serverDetailLoading || (advancedApp && workflowLoading)
-  const unavailable = !loading && (appUnpublished || missingStartNode || triggerModeDisabled)
+  const loading = serverDetailLoading || availability === 'loading'
+  const unavailable = !loading && availability === 'unavailable'
 
   const basicAppInputs = useMemo(() => {
     if (!basicApp || !basicAppInputForm) return []
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index 0255ee9c946c46..2ca9b24cc15691 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -41,6 +41,7 @@ type AccessPointProps = {
 }
 
 type AccessPointContentProps = AccessPointProps & {
+  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -49,6 +50,7 @@ type AccessPointContentProps = AccessPointProps & {
 
 function AccessPointContent({
   appId,
+  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -147,6 +149,7 @@ function AccessPointContent({
             {selectedEnvironment === BUILT_IN_ENVIRONMENT_ID ? (
               <BuiltInAccessPoints
                 appId={appId}
+                canViewLayout={canViewLayout}
                 canDeploy={canDeploy}
                 canManageAccessPoint={canManageAccessPoint}
                 canReleaseAndVersion={canReleaseAndVersion}
@@ -190,6 +193,7 @@ export default function AccessPoint({ appId }: AccessPointProps) {
     <AccessPointStateBoundary appId={appId} environmentQueryEnabled={showEnvironmentTabs}>
       <AccessPointContent
         appId={appId}
+        canViewLayout={capabilities.canViewLayout}
         canDeploy={capabilities.canDeploy}
         canManageAccessPoint={capabilities.canManageAccessPoint}
         canReleaseAndVersion={capabilities.canReleaseAndVersion}
diff --git a/web/service/use-tools.ts b/web/service/use-tools.ts
index 002cbc9b2644c1..38d60fb725ec91 100644
--- a/web/service/use-tools.ts
+++ b/web/service/use-tools.ts
@@ -1,3 +1,4 @@
+import type { WorkflowTriggerResponse } from '@dify/contracts/api/console/apps/types.gen'
 import type { QueryKey, UseQueryOptions } from '@tanstack/react-query'
 import type {
   Collection,
@@ -8,9 +9,9 @@ import type {
 } from '@/app/components/tools/types'
 import type { RAGRecommendedPlugins, ToolWithProvider } from '@/app/components/workflow/types'
 import type { AppIconType } from '@/types/app'
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { CollectionType } from '@/app/components/tools/types'
-import { consoleClient } from '@/service/console'
+import { consoleClient, consoleQuery } from '@/service/console'
 import { del, get, post, put } from './base'
 import { useInvalid } from './use-base'
 
@@ -297,35 +298,27 @@ export const useInvalidateRAGRecommendedPlugins = () => {
 }
 
 // App Triggers API hooks
-export type AppTrigger = {
-  id: string
-  trigger_type: 'trigger-webhook' | 'trigger-schedule' | 'trigger-plugin'
-  title: string
-  node_id: string
-  provider_name: string
-  icon: string
-  status: 'enabled' | 'disabled' | 'unauthorized'
-  created_at: string
-  updated_at: string
-}
+export type AppTrigger = WorkflowTriggerResponse
 
 export const useAppTriggers = (
   appId: string | undefined,
   options?: Omit<UseQueryOptions<{ data: AppTrigger[] }>, 'queryKey' | 'queryFn'>,
 ) => {
-  return useQuery<{ data: AppTrigger[] }>({
-    queryKey: [NAME_SPACE, 'app-triggers', appId],
-    queryFn: () => get<{ data: AppTrigger[] }>(`/apps/${appId}/triggers`),
-    enabled: !!appId,
-    ...options, // Merge additional options while maintaining backward compatibility
-  })
+  return useQuery(
+    consoleQuery.apps.byAppId.triggers.get.queryOptions({
+      ...options,
+      input: appId ? { params: { app_id: appId } } : skipToken,
+    }),
+  )
 }
 
 export const useInvalidateAppTriggers = () => {
   const queryClient = useQueryClient()
   return (appId: string) => {
     return queryClient.invalidateQueries({
-      queryKey: [NAME_SPACE, 'app-triggers', appId],
+      queryKey: consoleQuery.apps.byAppId.triggers.get.queryKey({
+        input: { params: { app_id: appId } },
+      }),
     })
   }
 }

From 23e40a230a0a7b400baf18ad484f57edc31e1379 Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 00:51:13 +0800
Subject: [PATCH 100/108] fix: read member access status from a dedicated
 control plane endpoint

---
 .../entities/network_access_group_entities.py |  11 ++
 api/services/network_access_group_gateway.py  |  21 +++
 api/services/network_access_group_service.py  |  20 ++-
 .../workspace/test_network_access_group.py    | 150 ++++++++++++++++++
 .../test_network_access_group_service.py      |  32 +++-
 5 files changed, 224 insertions(+), 10 deletions(-)

diff --git a/api/services/entities/network_access_group_entities.py b/api/services/entities/network_access_group_entities.py
index 589d51ab29a087..521c348f7bab84 100644
--- a/api/services/entities/network_access_group_entities.py
+++ b/api/services/entities/network_access_group_entities.py
@@ -66,6 +66,17 @@ class NetworkAccessAppConfig:
     available_access_points: tuple[NetworkAccessPoint, ...] = ()
 
 
+@dataclass(frozen=True)
+class NetworkAccessAppStatusSnapshot:
+    """Control-plane entry state without policy identity or configuration."""
+
+    entitled: bool
+    configured: bool
+    enabled: bool
+    # Preserve legacy/future scopes so the service can project current App capabilities.
+    access_points: tuple[str, ...]
+
+
 @dataclass(frozen=True)
 class NetworkAccessAppStatus:
     """Public entry status without policy identity or configuration."""
diff --git a/api/services/network_access_group_gateway.py b/api/services/network_access_group_gateway.py
index 3d634012fabb74..86fc0b811949ac 100644
--- a/api/services/network_access_group_gateway.py
+++ b/api/services/network_access_group_gateway.py
@@ -24,6 +24,7 @@
 from services.billing_service import BillingService, _BillingHTTPStatusError
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessGroup,
@@ -176,6 +177,14 @@ class _BindingUpdateWire(_WireModel):
     effective_enabled: StrictBool = False
 
 
+class _AppStatusWire(_WireModel):
+    aliases = {"access_points": ("accessPoints",)}
+    entitled: StrictBool = False
+    configured: StrictBool = False
+    enabled: StrictBool = False
+    access_points: tuple[StrictStr, ...] = ()
+
+
 class _DeletedWire(_WireModel):
     deleted: StrictBool = False
 
@@ -322,6 +331,18 @@ def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str)
             wire.binding.record() if wire.binding is not None else None,
         )
 
+    @override
+    def get_app_status(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppStatusSnapshot:
+        wire = _decode(
+            _AppStatusWire,
+            self._send_request(
+                "GET",
+                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group/status",
+                params={"actor_account_id": actor_account_id},
+            ),
+        )
+        return NetworkAccessAppStatusSnapshot(wire.entitled, wire.configured, wire.enabled, wire.access_points)
+
     @override
     def update_app_binding(
         self,
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 940af7a457f88e..13b4e8b4717420 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -10,6 +10,7 @@
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
     NetworkAccessAppStatus,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -142,6 +143,10 @@ def delete_group(
 
     def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppConfig: ...
 
+    def get_app_status(
+        self, workspace_id: str, app_id: str, actor_account_id: str
+    ) -> NetworkAccessAppStatusSnapshot: ...
+
     def update_app_binding(
         self,
         workspace_id: str,
@@ -249,14 +254,15 @@ def get_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAcc
     def get_app_status(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppStatus:
         """Expose only the Access Point entry state to Normal workspace members."""
         self._ensure_workspace_role(context, _APP_STATUS_ROLES)
-        config = self._read_app_binding(context, app_id=app_id)
-        binding = config.binding
+        app = self._get_manageable_app(context.active_workspace_id, app_id)
+        available_access_points = self._available_access_points(app.mode)
+        status = self._control_plane.get_app_status(context.active_workspace_id, app.id, context.account_id)
         return NetworkAccessAppStatus(
-            entitled=config.entitled,
-            configured=bool(binding and binding.group_id),
-            enabled=bool(binding and binding.enabled),
-            covered_count=len(binding.access_points) if binding else 0,
-            available_count=len(config.available_access_points),
+            entitled=self._effective_entitlement(context.active_workspace_id, status.entitled),
+            configured=status.configured,
+            enabled=status.enabled,
+            covered_count=len(set(status.access_points).intersection(available_access_points)),
+            available_count=len(available_access_points),
         )
 
     def _read_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppConfig:
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 0f87566c0ceada..3a73dc30fdec1f 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -272,6 +272,114 @@ def test_app_status_serializes_only_entry_state() -> None:
     service.get_app_status.assert_called_once_with(_request_context(), app_id=APP_ID)
 
 
+@pytest.mark.parametrize("role", ["normal", "owner", "admin", "editor"])
+@pytest.mark.parametrize(
+    ("app_mode", "covered_count", "available_count"),
+    [
+        ("workflow", 3, 4),
+        ("advanced-chat", 2, 3),
+        ("chat", 2, 3),
+        ("completion", 2, 3),
+        ("agent-chat", 2, 3),
+        ("agent", 1, 2),
+    ],
+)
+def test_app_status_uses_minimal_upstream_route_and_filters_scopes_for_current_mode(
+    role: str, app_mode: str, covered_count: int, available_count: int
+) -> None:
+    response, requests = _typed_status_http_response(
+        {
+            "entitled": True,
+            "configured": True,
+            "enabled": True,
+            "accessPoints": ["webapp", "mcp", "trigger", "future_scope", "webapp"],
+            "group_id": GROUP_ID,
+            "allowed_cidrs": ["203.0.113.7/32"],
+        },
+        role=role,
+        app_mode=app_mode,
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {
+        "entitled": True,
+        "configured": True,
+        "enabled": True,
+        "covered_count": covered_count,
+        "available_count": available_count,
+    }
+    assert len(requests) == 1
+    assert requests[0].method == "GET"
+    assert requests[0].url.path == f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status"
+    assert dict(requests[0].url.params) == {"actor_account_id": ACCOUNT_ID}
+    assert requests[0].headers["Billing-Api-Secret-Key"] == "synthetic"
+
+
+@pytest.mark.parametrize(
+    ("wire", "paid", "expected"),
+    [
+        ({}, True, {"entitled": False, "configured": False, "enabled": False, "covered_count": 0}),
+        ({"entitled": True}, True, {"entitled": True, "configured": False, "enabled": False, "covered_count": 0}),
+        (
+            {"entitled": True, "configured": True, "access_points": ["webapp"]},
+            True,
+            {"entitled": True, "configured": True, "enabled": False, "covered_count": 1},
+        ),
+        (
+            {"entitled": True, "configured": True, "enabled": True, "access_points": ["webapp"]},
+            False,
+            {"entitled": False, "configured": True, "enabled": True, "covered_count": 1},
+        ),
+    ],
+)
+def test_app_status_preserves_saved_state_and_applies_local_entitlement(
+    wire: Mapping[str, object], paid: bool, expected: dict[str, object]
+) -> None:
+    response, _requests = _typed_status_http_response(wire, paid=paid)
+
+    assert response.status_code == 200
+    assert response.get_json() == {**expected, "available_count": 4}
+
+
+@pytest.mark.parametrize("role", ["dataset_operator", "unknown", None])
+def test_app_status_rejects_disallowed_roles_before_upstream_read(role: str | None) -> None:
+    response, requests = _typed_status_http_response({}, role=role)
+
+    assert response.status_code == 403
+    assert requests == []
+
+
+@pytest.mark.parametrize("upstream_status", [403, 404])
+def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(upstream_status: int) -> None:
+    response, requests = _typed_status_http_response({}, upstream_status=upstream_status)
+
+    assert response.status_code == upstream_status
+    assert len(requests) == 1
+    assert requests[0].url.path.endswith("/network-access-group/status")
+
+
+@pytest.mark.parametrize("field", ["entitled", "configured", "enabled"])
+@pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
+def test_app_status_rejects_non_boolean_flags(field: str, value: object) -> None:
+    response, _requests = _typed_status_http_response({field: value})
+
+    assert response.status_code == 502
+
+
+@pytest.mark.parametrize(
+    "wire",
+    [
+        {"access_points": "webapp"},
+        {"access_points": [1]},
+        {"access_points": ["webapp"], "accessPoints": ["mcp"]},
+    ],
+)
+def test_app_status_rejects_malformed_or_conflicting_scopes(wire: Mapping[str, object]) -> None:
+    response, _requests = _typed_status_http_response(wire)
+
+    assert response.status_code == 502
+
+
 @pytest.mark.parametrize(
     ("status_code", "expected_exception"),
     [
@@ -818,3 +926,45 @@ def binding() -> dict[str, object]:
 
         with _application_services(service):
             return app.test_client().get("/binding")
+
+
+def _typed_status_http_response(
+    wire: Mapping[str, object],
+    *,
+    role: str | None = "normal",
+    app_mode: str = "workflow",
+    paid: bool = True,
+    upstream_status: int = 200,
+) -> tuple[TestResponse, list[httpx.Request]]:
+    app = Flask(__name__)
+    app.testing = True
+    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
+    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, app_mode, "Test", None, None, None)
+    memberships.get_account_role.return_value = role
+    entitlement.is_paid_plan.return_value = paid
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        if request.url.path != f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status":
+            return httpx.Response(403, json={"reason": "FORBIDDEN"})
+        return httpx.Response(upstream_status, json=wire)
+
+    with httpx.Client(transport=httpx.MockTransport(respond)) as client:
+        gateway = NetworkAccessGroupGateway(
+            base_url="https://test.invalid",
+            fallback_base_url="",
+            secret_key="synthetic",
+            http_client=client,
+        )
+        service = NetworkAccessGroupService(
+            control_plane=gateway, apps=apps, memberships=memberships, entitlement=entitlement
+        )
+        api = AppNetworkAccessGroupStatusApi()
+
+        @app.get("/status")
+        def status() -> dict[str, object]:
+            return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
+
+        with _application_services(service):
+            return app.test_client().get("/status"), requests
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 5cbdea8fd8dadf..faeef4644c6193 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -8,6 +8,7 @@
 from machinery.context import RequestContext
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -128,6 +129,7 @@ def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "
     for method in (control_plane.get_group, control_plane.create_group, control_plane.update_group):
         method.return_value = _group()
     control_plane.get_app_binding.return_value = _config()
+    control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(True, False, False, ())
     control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(_binding(), False)
     control_plane.delete_group.return_value = True
     control_plane.cleanup_app_binding.return_value = True
@@ -342,8 +344,8 @@ def test_app_binding_rejects_disallowed_roles_before_app_lookup(operation: Mutat
 
 def test_normal_member_can_read_only_app_entry_status() -> None:
     harness = _harness(role="normal")
-    harness.control_plane.get_app_binding.return_value = _config(
-        _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "service_api"))
+    harness.control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(
+        entitled=True, configured=True, enabled=True, access_points=("webapp", "service_api")
     )
 
     status = harness.service.get_app_status(_context(), app_id=APP_ID)
@@ -355,7 +357,8 @@ def test_normal_member_can_read_only_app_entry_status() -> None:
     assert status.available_count == 4
     assert not hasattr(status, "group_id")
     assert not hasattr(status, "allowed_cidrs")
-    harness.control_plane.get_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.get_app_status.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.get_app_binding.assert_not_called()
 
 
 @pytest.mark.parametrize("role", ["dataset_operator", None])
@@ -366,6 +369,29 @@ def test_app_entry_status_rejects_roles_without_app_access(role: str | None) ->
         harness.service.get_app_status(_context(), app_id=APP_ID)
 
     harness.apps.get_manageable_app.assert_not_called()
+    harness.control_plane.get_app_status.assert_not_called()
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_app_status_rejects_missing_tenant_scoped_app_before_upstream_read() -> None:
+    harness = _harness(role="normal")
+    harness.apps.get_manageable_app.return_value = None
+
+    with pytest.raises(NetworkAccessGroupAppNotFoundError):
+        harness.service.get_app_status(_context(), app_id=APP_ID)
+
+    harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
+    harness.control_plane.get_app_status.assert_not_called()
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_app_status_rejects_unsupported_app_mode_before_upstream_read() -> None:
+    harness = _harness(role="normal", app_mode="unknown")
+
+    with pytest.raises(NetworkAccessGroupUnsupportedAppModeError):
+        harness.service.get_app_status(_context(), app_id=APP_ID)
+
+    harness.control_plane.get_app_status.assert_not_called()
     harness.control_plane.get_app_binding.assert_not_called()
 
 

From 60ef8073e7d5af5d93ad02d2e375c52d5170782b Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 00:53:27 +0800
Subject: [PATCH 101/108] revert: withdraw SNP-951 changes pending backend
 coordination

---
 .../entities/network_access_group_entities.py |  11 -
 api/services/network_access_group_gateway.py  |  21 --
 api/services/network_access_group_service.py  |  20 +-
 .../workspace/test_network_access_group.py    | 150 ----------
 .../test_network_access_group_service.py      |  32 +--
 oxlint-suppressions.json                      |   2 +-
 .../__tests__/built-in-access-points.spec.tsx |  58 +---
 .../__tests__/built-in-permissions.spec.tsx   | 257 ------------------
 .../access-point/__tests__/mcp-card.spec.tsx  |   3 +-
 .../built-in-access-points/index.tsx          |  56 +---
 .../built-in-access-points/mcp-card.tsx       |  16 +-
 web/app/components/app/access-point/index.tsx |   4 -
 web/service/use-tools.ts                      |  33 ++-
 13 files changed, 63 insertions(+), 600 deletions(-)
 delete mode 100644 web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx

diff --git a/api/services/entities/network_access_group_entities.py b/api/services/entities/network_access_group_entities.py
index 521c348f7bab84..589d51ab29a087 100644
--- a/api/services/entities/network_access_group_entities.py
+++ b/api/services/entities/network_access_group_entities.py
@@ -66,17 +66,6 @@ class NetworkAccessAppConfig:
     available_access_points: tuple[NetworkAccessPoint, ...] = ()
 
 
-@dataclass(frozen=True)
-class NetworkAccessAppStatusSnapshot:
-    """Control-plane entry state without policy identity or configuration."""
-
-    entitled: bool
-    configured: bool
-    enabled: bool
-    # Preserve legacy/future scopes so the service can project current App capabilities.
-    access_points: tuple[str, ...]
-
-
 @dataclass(frozen=True)
 class NetworkAccessAppStatus:
     """Public entry status without policy identity or configuration."""
diff --git a/api/services/network_access_group_gateway.py b/api/services/network_access_group_gateway.py
index 86fc0b811949ac..3d634012fabb74 100644
--- a/api/services/network_access_group_gateway.py
+++ b/api/services/network_access_group_gateway.py
@@ -24,7 +24,6 @@
 from services.billing_service import BillingService, _BillingHTTPStatusError
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
-    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessGroup,
@@ -177,14 +176,6 @@ class _BindingUpdateWire(_WireModel):
     effective_enabled: StrictBool = False
 
 
-class _AppStatusWire(_WireModel):
-    aliases = {"access_points": ("accessPoints",)}
-    entitled: StrictBool = False
-    configured: StrictBool = False
-    enabled: StrictBool = False
-    access_points: tuple[StrictStr, ...] = ()
-
-
 class _DeletedWire(_WireModel):
     deleted: StrictBool = False
 
@@ -331,18 +322,6 @@ def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str)
             wire.binding.record() if wire.binding is not None else None,
         )
 
-    @override
-    def get_app_status(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppStatusSnapshot:
-        wire = _decode(
-            _AppStatusWire,
-            self._send_request(
-                "GET",
-                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group/status",
-                params={"actor_account_id": actor_account_id},
-            ),
-        )
-        return NetworkAccessAppStatusSnapshot(wire.entitled, wire.configured, wire.enabled, wire.access_points)
-
     @override
     def update_app_binding(
         self,
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 13b4e8b4717420..940af7a457f88e 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -10,7 +10,6 @@
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
     NetworkAccessAppStatus,
-    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -143,10 +142,6 @@ def delete_group(
 
     def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppConfig: ...
 
-    def get_app_status(
-        self, workspace_id: str, app_id: str, actor_account_id: str
-    ) -> NetworkAccessAppStatusSnapshot: ...
-
     def update_app_binding(
         self,
         workspace_id: str,
@@ -254,15 +249,14 @@ def get_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAcc
     def get_app_status(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppStatus:
         """Expose only the Access Point entry state to Normal workspace members."""
         self._ensure_workspace_role(context, _APP_STATUS_ROLES)
-        app = self._get_manageable_app(context.active_workspace_id, app_id)
-        available_access_points = self._available_access_points(app.mode)
-        status = self._control_plane.get_app_status(context.active_workspace_id, app.id, context.account_id)
+        config = self._read_app_binding(context, app_id=app_id)
+        binding = config.binding
         return NetworkAccessAppStatus(
-            entitled=self._effective_entitlement(context.active_workspace_id, status.entitled),
-            configured=status.configured,
-            enabled=status.enabled,
-            covered_count=len(set(status.access_points).intersection(available_access_points)),
-            available_count=len(available_access_points),
+            entitled=config.entitled,
+            configured=bool(binding and binding.group_id),
+            enabled=bool(binding and binding.enabled),
+            covered_count=len(binding.access_points) if binding else 0,
+            available_count=len(config.available_access_points),
         )
 
     def _read_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppConfig:
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 3a73dc30fdec1f..0f87566c0ceada 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -272,114 +272,6 @@ def test_app_status_serializes_only_entry_state() -> None:
     service.get_app_status.assert_called_once_with(_request_context(), app_id=APP_ID)
 
 
-@pytest.mark.parametrize("role", ["normal", "owner", "admin", "editor"])
-@pytest.mark.parametrize(
-    ("app_mode", "covered_count", "available_count"),
-    [
-        ("workflow", 3, 4),
-        ("advanced-chat", 2, 3),
-        ("chat", 2, 3),
-        ("completion", 2, 3),
-        ("agent-chat", 2, 3),
-        ("agent", 1, 2),
-    ],
-)
-def test_app_status_uses_minimal_upstream_route_and_filters_scopes_for_current_mode(
-    role: str, app_mode: str, covered_count: int, available_count: int
-) -> None:
-    response, requests = _typed_status_http_response(
-        {
-            "entitled": True,
-            "configured": True,
-            "enabled": True,
-            "accessPoints": ["webapp", "mcp", "trigger", "future_scope", "webapp"],
-            "group_id": GROUP_ID,
-            "allowed_cidrs": ["203.0.113.7/32"],
-        },
-        role=role,
-        app_mode=app_mode,
-    )
-
-    assert response.status_code == 200
-    assert response.get_json() == {
-        "entitled": True,
-        "configured": True,
-        "enabled": True,
-        "covered_count": covered_count,
-        "available_count": available_count,
-    }
-    assert len(requests) == 1
-    assert requests[0].method == "GET"
-    assert requests[0].url.path == f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status"
-    assert dict(requests[0].url.params) == {"actor_account_id": ACCOUNT_ID}
-    assert requests[0].headers["Billing-Api-Secret-Key"] == "synthetic"
-
-
-@pytest.mark.parametrize(
-    ("wire", "paid", "expected"),
-    [
-        ({}, True, {"entitled": False, "configured": False, "enabled": False, "covered_count": 0}),
-        ({"entitled": True}, True, {"entitled": True, "configured": False, "enabled": False, "covered_count": 0}),
-        (
-            {"entitled": True, "configured": True, "access_points": ["webapp"]},
-            True,
-            {"entitled": True, "configured": True, "enabled": False, "covered_count": 1},
-        ),
-        (
-            {"entitled": True, "configured": True, "enabled": True, "access_points": ["webapp"]},
-            False,
-            {"entitled": False, "configured": True, "enabled": True, "covered_count": 1},
-        ),
-    ],
-)
-def test_app_status_preserves_saved_state_and_applies_local_entitlement(
-    wire: Mapping[str, object], paid: bool, expected: dict[str, object]
-) -> None:
-    response, _requests = _typed_status_http_response(wire, paid=paid)
-
-    assert response.status_code == 200
-    assert response.get_json() == {**expected, "available_count": 4}
-
-
-@pytest.mark.parametrize("role", ["dataset_operator", "unknown", None])
-def test_app_status_rejects_disallowed_roles_before_upstream_read(role: str | None) -> None:
-    response, requests = _typed_status_http_response({}, role=role)
-
-    assert response.status_code == 403
-    assert requests == []
-
-
-@pytest.mark.parametrize("upstream_status", [403, 404])
-def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(upstream_status: int) -> None:
-    response, requests = _typed_status_http_response({}, upstream_status=upstream_status)
-
-    assert response.status_code == upstream_status
-    assert len(requests) == 1
-    assert requests[0].url.path.endswith("/network-access-group/status")
-
-
-@pytest.mark.parametrize("field", ["entitled", "configured", "enabled"])
-@pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
-def test_app_status_rejects_non_boolean_flags(field: str, value: object) -> None:
-    response, _requests = _typed_status_http_response({field: value})
-
-    assert response.status_code == 502
-
-
-@pytest.mark.parametrize(
-    "wire",
-    [
-        {"access_points": "webapp"},
-        {"access_points": [1]},
-        {"access_points": ["webapp"], "accessPoints": ["mcp"]},
-    ],
-)
-def test_app_status_rejects_malformed_or_conflicting_scopes(wire: Mapping[str, object]) -> None:
-    response, _requests = _typed_status_http_response(wire)
-
-    assert response.status_code == 502
-
-
 @pytest.mark.parametrize(
     ("status_code", "expected_exception"),
     [
@@ -926,45 +818,3 @@ def binding() -> dict[str, object]:
 
         with _application_services(service):
             return app.test_client().get("/binding")
-
-
-def _typed_status_http_response(
-    wire: Mapping[str, object],
-    *,
-    role: str | None = "normal",
-    app_mode: str = "workflow",
-    paid: bool = True,
-    upstream_status: int = 200,
-) -> tuple[TestResponse, list[httpx.Request]]:
-    app = Flask(__name__)
-    app.testing = True
-    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
-    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, app_mode, "Test", None, None, None)
-    memberships.get_account_role.return_value = role
-    entitlement.is_paid_plan.return_value = paid
-    requests: list[httpx.Request] = []
-
-    def respond(request: httpx.Request) -> httpx.Response:
-        requests.append(request)
-        if request.url.path != f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status":
-            return httpx.Response(403, json={"reason": "FORBIDDEN"})
-        return httpx.Response(upstream_status, json=wire)
-
-    with httpx.Client(transport=httpx.MockTransport(respond)) as client:
-        gateway = NetworkAccessGroupGateway(
-            base_url="https://test.invalid",
-            fallback_base_url="",
-            secret_key="synthetic",
-            http_client=client,
-        )
-        service = NetworkAccessGroupService(
-            control_plane=gateway, apps=apps, memberships=memberships, entitlement=entitlement
-        )
-        api = AppNetworkAccessGroupStatusApi()
-
-        @app.get("/status")
-        def status() -> dict[str, object]:
-            return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
-
-        with _application_services(service):
-            return app.test_client().get("/status"), requests
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index faeef4644c6193..5cbdea8fd8dadf 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -8,7 +8,6 @@
 from machinery.context import RequestContext
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
-    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -129,7 +128,6 @@ def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "
     for method in (control_plane.get_group, control_plane.create_group, control_plane.update_group):
         method.return_value = _group()
     control_plane.get_app_binding.return_value = _config()
-    control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(True, False, False, ())
     control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(_binding(), False)
     control_plane.delete_group.return_value = True
     control_plane.cleanup_app_binding.return_value = True
@@ -344,8 +342,8 @@ def test_app_binding_rejects_disallowed_roles_before_app_lookup(operation: Mutat
 
 def test_normal_member_can_read_only_app_entry_status() -> None:
     harness = _harness(role="normal")
-    harness.control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(
-        entitled=True, configured=True, enabled=True, access_points=("webapp", "service_api")
+    harness.control_plane.get_app_binding.return_value = _config(
+        _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "service_api"))
     )
 
     status = harness.service.get_app_status(_context(), app_id=APP_ID)
@@ -357,8 +355,7 @@ def test_normal_member_can_read_only_app_entry_status() -> None:
     assert status.available_count == 4
     assert not hasattr(status, "group_id")
     assert not hasattr(status, "allowed_cidrs")
-    harness.control_plane.get_app_status.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
-    harness.control_plane.get_app_binding.assert_not_called()
+    harness.control_plane.get_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
 
 
 @pytest.mark.parametrize("role", ["dataset_operator", None])
@@ -369,29 +366,6 @@ def test_app_entry_status_rejects_roles_without_app_access(role: str | None) ->
         harness.service.get_app_status(_context(), app_id=APP_ID)
 
     harness.apps.get_manageable_app.assert_not_called()
-    harness.control_plane.get_app_status.assert_not_called()
-    harness.control_plane.get_app_binding.assert_not_called()
-
-
-def test_app_status_rejects_missing_tenant_scoped_app_before_upstream_read() -> None:
-    harness = _harness(role="normal")
-    harness.apps.get_manageable_app.return_value = None
-
-    with pytest.raises(NetworkAccessGroupAppNotFoundError):
-        harness.service.get_app_status(_context(), app_id=APP_ID)
-
-    harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
-    harness.control_plane.get_app_status.assert_not_called()
-    harness.control_plane.get_app_binding.assert_not_called()
-
-
-def test_app_status_rejects_unsupported_app_mode_before_upstream_read() -> None:
-    harness = _harness(role="normal", app_mode="unknown")
-
-    with pytest.raises(NetworkAccessGroupUnsupportedAppModeError):
-        harness.service.get_app_status(_context(), app_id=APP_ID)
-
-    harness.control_plane.get_app_status.assert_not_called()
     harness.control_plane.get_app_binding.assert_not_called()
 
 
diff --git a/oxlint-suppressions.json b/oxlint-suppressions.json
index 959677683c2944..156a7a824397ab 100644
--- a/oxlint-suppressions.json
+++ b/oxlint-suppressions.json
@@ -4471,7 +4471,7 @@
   },
   "web/service/use-tools.ts": {
     "@tanstack/query/prefer-query-options": {
-      "count": 13
+      "count": 15
     },
     "no-restricted-imports": {
       "count": 1
diff --git a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
index f1c3f55322f1f0..04406ecc119070 100644
--- a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
@@ -1,5 +1,5 @@
 import { screen } from '@testing-library/react'
-import { renderWithConsoleQuery as render } from '@/test/console/query-data'
+import { render } from '@/test/console/render'
 import { BuiltInAccessPoints } from '../built-in-access-points'
 
 const mocks = vi.hoisted(() => ({
@@ -111,7 +111,6 @@ describe('BuiltInAccessPoints', () => {
   it('renders the unpublished state across all access point cards', () => {
     render(
       <BuiltInAccessPoints
-        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -149,7 +148,6 @@ describe('BuiltInAccessPoints', () => {
 
     render(
       <BuiltInAccessPoints
-        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -179,13 +177,7 @@ describe('BuiltInAccessPoints', () => {
       enable_api: true,
     }
     render(
-      <BuiltInAccessPoints
-        canViewLayout
-        appId="app-1"
-        canDeploy
-        canManageAccessPoint
-        canReleaseAndVersion
-      />,
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
     )
 
     expect(screen.getByText('deployments.studio.accessPoint.noPublishedTitle')).toBeInTheDocument()
@@ -196,7 +188,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ availability: 'unavailable' }),
+      expect.objectContaining({ triggerModeDisabled: false }),
     )
     expect(mocks.triggerCard).not.toHaveBeenCalled()
     expect(mocks.useAppWorkflow).toHaveBeenCalledWith('app-1', expect.any(Object))
@@ -225,13 +217,7 @@ describe('BuiltInAccessPoints', () => {
       }
       mocks.workflow = workflow
       render(
-        <BuiltInAccessPoints
-          canViewLayout
-          appId="app-1"
-          canDeploy
-          canManageAccessPoint
-          canReleaseAndVersion
-        />,
+        <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
       )
 
       expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability }))
@@ -246,7 +232,6 @@ describe('BuiltInAccessPoints', () => {
   it('uses Access Point management for every requested built-in operation', () => {
     render(
       <BuiltInAccessPoints
-        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -269,7 +254,6 @@ describe('BuiltInAccessPoints', () => {
   it('highlights only the targeted built-in access point card', () => {
     render(
       <BuiltInAccessPoints
-        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -296,13 +280,7 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints
-        canViewLayout
-        appId="app-1"
-        canDeploy
-        canManageAccessPoint
-        canReleaseAndVersion
-      />,
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(
@@ -312,7 +290,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ availability: 'unavailable' }),
+      expect.objectContaining({ triggerModeDisabled: true }),
     )
     expect(mocks.triggerCard).toHaveBeenCalledWith(
       expect.objectContaining({ availability: 'available' }),
@@ -330,13 +308,7 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints
-        canViewLayout
-        appId="app-1"
-        canDeploy
-        canManageAccessPoint
-        canReleaseAndVersion
-      />,
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability: 'loading' }))
@@ -354,13 +326,7 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints
-        canViewLayout
-        appId="app-1"
-        canDeploy
-        canManageAccessPoint
-        canReleaseAndVersion
-      />,
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
     )
 
     expect(
@@ -370,13 +336,7 @@ describe('BuiltInAccessPoints', () => {
 
   it('does not retry forbidden published workflow requests', () => {
     render(
-      <BuiltInAccessPoints
-        canViewLayout
-        appId="app-1"
-        canDeploy
-        canManageAccessPoint
-        canReleaseAndVersion
-      />,
+      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
     )
 
     const options = mocks.useAppWorkflow.mock.calls.at(-1)?.[1] as {
diff --git a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
deleted file mode 100644
index 7235694beb6ad2..00000000000000
--- a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
+++ /dev/null
@@ -1,257 +0,0 @@
-import type {
-  AppDetailWithSite,
-  WorkflowResponse,
-  WorkflowTriggerResponse,
-} from '@dify/contracts/api/console/apps/types.gen'
-import { screen, waitFor, within } from '@testing-library/react'
-import userEvent from '@testing-library/user-event'
-import { useStore as useAppStore } from '@/app/components/app/store'
-import { toast } from '@/app/notifications'
-import { renderWithConsoleQuery } from '@/test/console/query-data'
-import { createAppDetailFixture, createAppSiteFixture } from '@/test/fixtures/app'
-import { BuiltInAccessPoints } from '../built-in-access-points'
-
-vi.mock('@/app/notifications', () => ({ toast: { error: vi.fn(), success: vi.fn() } }))
-vi.mock('@/context/i18n', () => ({ useDocLink: () => (path: string) => path }))
-vi.mock('@/service/use-triggers', () => ({ useAllTriggerPlugins: () => ({ data: [] }) }))
-vi.mock('@/app/components/app/overview/customize', () => ({ default: () => null }))
-vi.mock('@/app/components/app/overview/settings', () => ({ default: () => null }))
-vi.mock('@/app/components/app/overview/embedded', () => ({ default: () => null }))
-
-const inService = 'agentV2.agentDetail.access.status.inService'
-const unavailable = 'deployments.health.ENVIRONMENT_STATUS_FAILED'
-const unpublishedTitle = 'deployments.studio.accessPoint.noPublishedTitle'
-const publishedPath = '/apps/app-1/workflows/publish'
-
-const getWebCard = () =>
-  screen.getByRole('region', { name: 'agentV2.agentDetail.access.webApp.title' })
-const getApiCard = () =>
-  screen.getByRole('region', { name: 'agentV2.agentDetail.access.serviceApi.title' })
-const getMcpCard = () => screen.getByRole('region', { name: 'tools.mcp.server.title' })
-const getTriggerCard = () => screen.getByRole('region', { name: 'navigation.settings.trigger' })
-
-const publishedWorkflow: WorkflowResponse = {
-  id: 'published-workflow',
-  graph: { nodes: [{ data: { type: 'start' } }] },
-  features: {},
-  conversation_variables: [],
-  environment_variables: [],
-  rag_pipeline_variables: [],
-  created_at: 1,
-  updated_at: 1,
-  hash: 'published-hash',
-  marked_comment: '',
-  marked_name: '',
-  tool_published: false,
-  version: 'published',
-}
-
-function renderAccessPoints({
-  mode = 'workflow',
-  role = 'normal',
-  published = true,
-  triggers = [],
-  workflow = publishedWorkflow,
-  rbacEnabled = false,
-  canViewLayout = role === 'owner',
-  triggerResponse,
-}: {
-  mode?: AppDetailWithSite['mode']
-  role?: 'normal' | 'owner'
-  published?: boolean
-  triggers?: WorkflowTriggerResponse[]
-  workflow?: WorkflowResponse | null
-  rbacEnabled?: boolean
-  canViewLayout?: boolean
-  triggerResponse?: Promise<Response>
-} = {}) {
-  const paths: string[] = []
-  vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
-    const request = new Request(input, init)
-    const path = new URL(request.url).pathname.replace('/console/api', '')
-    if (request.method === 'POST' && path === '/apps/app-1/trigger-enable' && role === 'owner') {
-      const body = (await request.json()) as { trigger_id: string; enable_trigger: boolean }
-      triggers = triggers.map((trigger) =>
-        trigger.id === body.trigger_id
-          ? { ...trigger, status: body.enable_trigger ? 'enabled' : 'disabled' }
-          : trigger,
-      )
-      return Response.json({ result: 'success' })
-    }
-    if (request.method !== 'GET') throw new Error(`Unexpected mutation: ${request.method} ${path}`)
-    paths.push(path)
-    if (path === publishedPath) {
-      return role === 'normal' && !rbacEnabled
-        ? Response.json(
-            {
-              code: 'forbidden',
-              message: "You don't have the permission to access the requested resource.",
-            },
-            { status: 403 },
-          )
-        : Response.json(workflow)
-    }
-    if (path === '/apps/app-1/server')
-      return Response.json({ id: 'server-1', server_code: 'server-code', status: 'active' })
-    if (path === '/apps/app-1/triggers') return triggerResponse ?? Response.json({ data: triggers })
-    throw new Error(`Unexpected request: ${request.method} ${path}`)
-  })
-  useAppStore.setState({
-    appDetail: createAppDetailFixture({
-      mode,
-      site: createAppSiteFixture(),
-      workflow: published ? { id: 'published-workflow' } : null,
-    }),
-  })
-  renderWithConsoleQuery(
-    <BuiltInAccessPoints
-      appId="app-1"
-      canViewLayout={canViewLayout}
-      canDeploy={false}
-      canManageAccessPoint={role === 'owner'}
-      canReleaseAndVersion={role === 'owner'}
-    />,
-    {
-      currentWorkspace: { role },
-      systemFeatures: { deployment_edition: 'CLOUD', rbac_enabled: rbacEnabled },
-    },
-  )
-  return paths
-}
-
-beforeEach(() => {
-  vi.clearAllMocks()
-})
-
-it.each(['workflow', 'advanced-chat'] as const)(
-  'shows a published %s to Normal members without requesting its graph',
-  async (mode) => {
-    const paths = renderAccessPoints({ mode })
-
-    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
-    expect(paths).not.toContain(publishedPath)
-    expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
-    expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
-    expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument()
-    expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
-    expect(toast.error).not.toHaveBeenCalled()
-    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
-      expect(within(card).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
-    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(
-      mode === 'workflow' ? 1 : 0,
-    )
-  },
-)
-
-it('uses the app summary to identify an unpublished workflow for Normal members', async () => {
-  const paths = renderAccessPoints({ published: false })
-
-  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
-  expect(paths).not.toContain(publishedPath)
-  expect(screen.getByText(unpublishedTitle)).toBeInTheDocument()
-  expect(within(getWebCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
-  expect(toast.error).not.toHaveBeenCalled()
-})
-
-it('keeps published Owner access points available using the workflow graph', async () => {
-  const paths = renderAccessPoints({ role: 'owner' })
-
-  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
-  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
-  expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
-  expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
-  expect(within(getTriggerCard()).getByText(unavailable)).toBeInTheDocument()
-  expect(toast.error).not.toHaveBeenCalled()
-})
-
-it.each(['disabled', 'unauthorized'])(
-  'preserves trigger-only availability for a Normal member when its trigger is %s',
-  async (status) => {
-    const paths = renderAccessPoints({
-      triggers: [
-        {
-          id: 'trigger-1',
-          node_id: 'trigger-node',
-          title: 'Published trigger',
-          trigger_type: 'trigger-webhook',
-          status,
-          icon: '',
-          provider_name: '',
-        },
-      ],
-    })
-
-    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
-    expect(paths).not.toContain(publishedPath)
-    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
-      expect(within(card).getAllByText(unavailable).length).toBeGreaterThan(0)
-    expect(within(getTriggerCard()).getByText('Published trigger')).toBeInTheDocument()
-    expect(within(getTriggerCard()).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
-    expect(
-      screen.getByText('deployments.studio.accessPoint.triggerExclusiveNotice'),
-    ).toBeInTheDocument()
-    expect(toast.error).not.toHaveBeenCalled()
-  },
-)
-
-it('waits for published trigger metadata before showing Normal access point availability', async () => {
-  let finish!: (response: Response) => void
-  const triggerResponse = new Promise<Response>((resolve) => {
-    finish = resolve
-  })
-  const paths = renderAccessPoints({ triggerResponse })
-
-  await waitFor(() => expect(paths).toContain('/apps/app-1/triggers'))
-  expect(getWebCard()).toHaveAttribute('aria-busy', 'true')
-  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
-
-  finish(Response.json({ data: [] }))
-  await waitFor(() => expect(within(getWebCard()).getByText(inService)).toBeInTheDocument())
-  expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(1)
-  expect(paths).not.toContain(publishedPath)
-})
-
-it('honors RBAC layout access even for a Normal workspace member', async () => {
-  const paths = renderAccessPoints({ rbacEnabled: true, canViewLayout: true })
-
-  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
-  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
-  expect(toast.error).not.toHaveBeenCalled()
-})
-
-it('keeps Owner MCP unavailable when the published graph has no Start node', async () => {
-  renderAccessPoints({ role: 'owner', workflow: { ...publishedWorkflow, graph: { nodes: [] } } })
-
-  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
-  expect(within(getMcpCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
-  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
-})
-
-it('refreshes the shared trigger query after an Owner changes a published trigger', async () => {
-  const user = userEvent.setup()
-  const paths = renderAccessPoints({
-    role: 'owner',
-    workflow: { ...publishedWorkflow, graph: { nodes: [{ data: { type: 'trigger-webhook' } }] } },
-    triggers: [
-      {
-        id: 'trigger-1',
-        node_id: 'trigger-node',
-        title: 'Published trigger',
-        trigger_type: 'trigger-webhook',
-        status: 'enabled',
-        icon: '',
-        provider_name: '',
-      },
-    ],
-  })
-
-  const toggle = await within(getTriggerCard()).findByRole('switch', { name: 'Published trigger' })
-  expect(toggle).toHaveAttribute('aria-checked', 'true')
-  await user.click(toggle)
-
-  await waitFor(() =>
-    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(2),
-  )
-  expect(toggle).toHaveAttribute('aria-checked', 'false')
-  expect(toast.error).not.toHaveBeenCalled()
-})
diff --git a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
index 1c1acc982adc44..4fd5ec63630054 100644
--- a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
@@ -118,8 +118,9 @@ function renderCard(cardAppInfo: AppDetailWithSite = appInfo, workflow?: Publish
       <MCPAccessPointCard
         appInfo={cardAppInfo}
         canManageAccessPoint
-        availability="available"
+        triggerModeDisabled={false}
         workflow={workflow}
+        workflowLoading={false}
       />
     </QueryClientProvider>,
   )
diff --git a/web/app/components/app/access-point/built-in-access-points/index.tsx b/web/app/components/app/access-point/built-in-access-points/index.tsx
index 0ac267998d7a33..f0f3299f4ff827 100644
--- a/web/app/components/app/access-point/built-in-access-points/index.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/index.tsx
@@ -3,16 +3,13 @@
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { Button, buttonVariants } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { skipToken, useQuery, useSuspenseQuery } from '@tanstack/react-query'
-import { useAtomValue } from 'jotai'
+import { useSuspenseQuery } from '@tanstack/react-query'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { LoadingPlaceholder } from '@/app/components/base/loading-placeholder'
 import { useDocLink } from '@/context/i18n'
-import { currentWorkspaceAtom, currentWorkspaceLoadingAtom } from '@/context/workspace-state'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
-import { consoleQuery } from '@/service/console'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { useAccessPointActions } from '../shared/use-access-point-actions'
 import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
@@ -23,7 +20,6 @@ import { WebAppAccessPointCard } from './web-app-card'
 
 type BuiltInAccessPointsProps = {
   appId: string
-  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -32,7 +28,6 @@ type BuiltInAccessPointsProps = {
 
 export function BuiltInAccessPoints({
   appId,
-  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -42,13 +37,7 @@ export function BuiltInAccessPoints({
   const docLink = useDocLink()
   const appInfo = useAppStore((state) => state.appDetail)
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const workspace = useAtomValue(currentWorkspaceAtom)
-  const workspaceLoading = useAtomValue(currentWorkspaceLoadingAtom)
-  const canReadWorkflow =
-    canViewLayout &&
-    (systemFeatures.rbac_enabled ||
-      (!workspaceLoading && ['owner', 'admin', 'editor'].includes(workspace.role)))
-  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo) && canReadWorkflow)
+  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo))
   const {
     data: workflow,
     isError: workflowError,
@@ -60,34 +49,15 @@ export function BuiltInAccessPoints({
       return failureCount < 3
     },
   })
-  const useWorkflowSummary = Boolean(appInfo && isAdvancedApp(appInfo) && !canReadWorkflow)
-  const needsPublishedTriggers =
-    useWorkflowSummary && appInfo?.mode === 'workflow' && Boolean(appInfo.workflow?.id)
-  const triggersQuery = useQuery(
-    consoleQuery.apps.byAppId.triggers.get.queryOptions({
-      input: appInfo?.mode === 'workflow' ? { params: { app_id: appId } } : skipToken,
-      enabled: needsPublishedTriggers,
-      retry: false,
-    }),
-  )
   const actions = useAccessPointActions(appId, canManageAccessPoint)
 
   if (!appInfo) return <LoadingPlaceholder />
 
   const workflowState = getPublishedWorkflowState(appInfo, workflow)
-  const isUnpublished = useWorkflowSummary ? !appInfo.workflow?.id : workflowState.isUnpublished
-  const hasTriggerNode = useWorkflowSummary
-    ? needsPublishedTriggers && Boolean(triggersQuery.data?.data.length)
-    : workflowState.hasTriggerNode
-  const builtInLoading =
-    workflowState.requiresPublishedWorkflow &&
-    (workspaceLoading ||
-      (shouldFetchWorkflow && workflowLoading) ||
-      (needsPublishedTriggers && triggersQuery.isPending))
-  const builtInError =
-    (shouldFetchWorkflow && workflowError) || (needsPublishedTriggers && triggersQuery.isError)
+  const builtInLoading = workflowState.requiresPublishedWorkflow && workflowLoading
   const appCardsUnavailable =
-    workflowState.requiresPublishedWorkflow && (builtInError || isUnpublished || hasTriggerNode)
+    workflowState.requiresPublishedWorkflow &&
+    (workflowError || workflowState.isUnpublished || workflowState.hasTriggerNode)
   const appCardAvailability = builtInLoading
     ? 'loading'
     : appCardsUnavailable
@@ -95,20 +65,13 @@ export function BuiltInAccessPoints({
       : 'available'
   const triggerAvailability = builtInLoading
     ? 'loading'
-    : builtInError || isUnpublished || !hasTriggerNode
-      ? 'unavailable'
-      : 'available'
-  const mcpAvailability = builtInLoading
-    ? 'loading'
-    : appCardsUnavailable ||
-        (!workflowState.requiresPublishedWorkflow && !appInfo.model_config?.updated_at) ||
-        (canReadWorkflow && workflowState.isWorkflowApp && !workflowState.hasStartNode)
+    : workflowState.isUnpublished || !workflowState.hasTriggerNode
       ? 'unavailable'
       : 'available'
 
   return (
     <div className="flex h-full flex-col gap-2">
-      {isUnpublished && !builtInLoading && !builtInError && (
+      {workflowState.isUnpublished && !workflowLoading && !workflowError && (
         <div className="flex flex-col items-start gap-2 rounded-xl bg-background-section-burn p-3">
           <div className="flex flex-col gap-0.5">
             <span className="block system-md-semibold text-text-secondary">
@@ -164,7 +127,8 @@ export function BuiltInAccessPoints({
           appInfo={appInfo}
           canManageAccessPoint={canManageAccessPoint}
           workflow={workflow}
-          availability={mcpAvailability}
+          workflowLoading={workflowLoading}
+          triggerModeDisabled={workflowState.hasTriggerNode}
           highlighted={highlightedAccessPoint === 'mcp'}
         />
         {workflowState.isWorkflowApp && (
@@ -177,7 +141,7 @@ export function BuiltInAccessPoints({
         )}
       </div>
 
-      {hasTriggerNode && (
+      {workflowState.hasTriggerNode && (
         <div className="mt-2 flex min-h-10 items-center gap-2 rounded-xl bg-background-section-burn px-3 py-2 system-xs-regular text-text-tertiary">
           <span aria-hidden className="i-ri-information-line size-4 shrink-0" />
           <span>
diff --git a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
index 4366d788b69c53..5e2c4f5ae08346 100644
--- a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
@@ -2,7 +2,6 @@
 
 import type { AppDetailWithSite } from '@dify/contracts/api/console/apps/types.gen'
 import type { PublishedWorkflow } from '../shared/utils'
-import type { AccessPointAvailability } from '@/app/components/base/access-point/status'
 import {
   AlertDialog,
   AlertDialogCancelButton,
@@ -27,6 +26,7 @@ import {
   useMCPServerDetail,
   useRefreshMCPServerCode,
 } from '@/service/use-tools'
+import { AppModeEnum } from '@/types/app'
 import { useAccessPointStatusLabel } from '../shared/use-access-point-status-label'
 import { getPublishedWorkflowNodes, isAdvancedApp } from '../shared/utils'
 
@@ -34,20 +34,23 @@ type MCPAccessPointCardProps = {
   appInfo: AppDetailWithSite
   canManageAccessPoint: boolean
   highlighted?: boolean
-  availability: AccessPointAvailability
+  triggerModeDisabled: boolean
   workflow: PublishedWorkflow
+  workflowLoading: boolean
 }
 
 export function MCPAccessPointCard({
   appInfo,
   canManageAccessPoint,
   highlighted,
-  availability,
+  triggerModeDisabled,
   workflow,
+  workflowLoading,
 }: MCPAccessPointCardProps) {
   const { t } = useTranslation(['appOverview', 'common', 'deployments', 'tools'])
   const advancedApp = isAdvancedApp(appInfo)
   const basicApp = !advancedApp
+  const workflowApp = appInfo.mode === AppModeEnum.WORKFLOW
   const [showServerModal, setShowServerModal] = useState(false)
   const [showRegenerate, setShowRegenerate] = useState(false)
   const basicConfig = appInfo.model_config
@@ -81,8 +84,11 @@ export function MCPAccessPointCard({
     ? `${appInfo.api_base_url.replace(/\/v1$/, '')}/mcp/server/${detail?.server_code}/mcp`
     : '***********'
   const workflowNodes = getPublishedWorkflowNodes(workflow)
-  const loading = serverDetailLoading || availability === 'loading'
-  const unavailable = !loading && availability === 'unavailable'
+  const missingStartNode =
+    workflowApp && !workflowNodes.some((node) => node.data.type === BlockEnum.Start)
+  const appUnpublished = advancedApp ? !workflow?.graph : !basicConfig?.updated_at
+  const loading = serverDetailLoading || (advancedApp && workflowLoading)
+  const unavailable = !loading && (appUnpublished || missingStartNode || triggerModeDisabled)
 
   const basicAppInputs = useMemo(() => {
     if (!basicApp || !basicAppInputForm) return []
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index 2ca9b24cc15691..0255ee9c946c46 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -41,7 +41,6 @@ type AccessPointProps = {
 }
 
 type AccessPointContentProps = AccessPointProps & {
-  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -50,7 +49,6 @@ type AccessPointContentProps = AccessPointProps & {
 
 function AccessPointContent({
   appId,
-  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -149,7 +147,6 @@ function AccessPointContent({
             {selectedEnvironment === BUILT_IN_ENVIRONMENT_ID ? (
               <BuiltInAccessPoints
                 appId={appId}
-                canViewLayout={canViewLayout}
                 canDeploy={canDeploy}
                 canManageAccessPoint={canManageAccessPoint}
                 canReleaseAndVersion={canReleaseAndVersion}
@@ -193,7 +190,6 @@ export default function AccessPoint({ appId }: AccessPointProps) {
     <AccessPointStateBoundary appId={appId} environmentQueryEnabled={showEnvironmentTabs}>
       <AccessPointContent
         appId={appId}
-        canViewLayout={capabilities.canViewLayout}
         canDeploy={capabilities.canDeploy}
         canManageAccessPoint={capabilities.canManageAccessPoint}
         canReleaseAndVersion={capabilities.canReleaseAndVersion}
diff --git a/web/service/use-tools.ts b/web/service/use-tools.ts
index 38d60fb725ec91..002cbc9b2644c1 100644
--- a/web/service/use-tools.ts
+++ b/web/service/use-tools.ts
@@ -1,4 +1,3 @@
-import type { WorkflowTriggerResponse } from '@dify/contracts/api/console/apps/types.gen'
 import type { QueryKey, UseQueryOptions } from '@tanstack/react-query'
 import type {
   Collection,
@@ -9,9 +8,9 @@ import type {
 } from '@/app/components/tools/types'
 import type { RAGRecommendedPlugins, ToolWithProvider } from '@/app/components/workflow/types'
 import type { AppIconType } from '@/types/app'
-import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { CollectionType } from '@/app/components/tools/types'
-import { consoleClient, consoleQuery } from '@/service/console'
+import { consoleClient } from '@/service/console'
 import { del, get, post, put } from './base'
 import { useInvalid } from './use-base'
 
@@ -298,27 +297,35 @@ export const useInvalidateRAGRecommendedPlugins = () => {
 }
 
 // App Triggers API hooks
-export type AppTrigger = WorkflowTriggerResponse
+export type AppTrigger = {
+  id: string
+  trigger_type: 'trigger-webhook' | 'trigger-schedule' | 'trigger-plugin'
+  title: string
+  node_id: string
+  provider_name: string
+  icon: string
+  status: 'enabled' | 'disabled' | 'unauthorized'
+  created_at: string
+  updated_at: string
+}
 
 export const useAppTriggers = (
   appId: string | undefined,
   options?: Omit<UseQueryOptions<{ data: AppTrigger[] }>, 'queryKey' | 'queryFn'>,
 ) => {
-  return useQuery(
-    consoleQuery.apps.byAppId.triggers.get.queryOptions({
-      ...options,
-      input: appId ? { params: { app_id: appId } } : skipToken,
-    }),
-  )
+  return useQuery<{ data: AppTrigger[] }>({
+    queryKey: [NAME_SPACE, 'app-triggers', appId],
+    queryFn: () => get<{ data: AppTrigger[] }>(`/apps/${appId}/triggers`),
+    enabled: !!appId,
+    ...options, // Merge additional options while maintaining backward compatibility
+  })
 }
 
 export const useInvalidateAppTriggers = () => {
   const queryClient = useQueryClient()
   return (appId: string) => {
     return queryClient.invalidateQueries({
-      queryKey: consoleQuery.apps.byAppId.triggers.get.queryKey({
-        input: { params: { app_id: appId } },
-      }),
+      queryKey: [NAME_SPACE, 'app-triggers', appId],
     })
   }
 }

From 2eb2029f162730b2f345b60a44259a39d3d029fa Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 10:11:10 +0800
Subject: [PATCH 102/108] fix(web): respect Normal member access point
 permissions (SNP-951)

---
 oxlint-suppressions.json                      |   2 +-
 .../__tests__/built-in-access-points.spec.tsx |  58 +++-
 .../__tests__/built-in-permissions.spec.tsx   | 257 ++++++++++++++++++
 .../access-point/__tests__/mcp-card.spec.tsx  |   3 +-
 .../built-in-access-points/index.tsx          |  56 +++-
 .../built-in-access-points/mcp-card.tsx       |  16 +-
 web/app/components/app/access-point/index.tsx |   4 +
 web/service/use-tools.ts                      |  33 +--
 8 files changed, 376 insertions(+), 53 deletions(-)
 create mode 100644 web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx

diff --git a/oxlint-suppressions.json b/oxlint-suppressions.json
index 156a7a824397ab..959677683c2944 100644
--- a/oxlint-suppressions.json
+++ b/oxlint-suppressions.json
@@ -4471,7 +4471,7 @@
   },
   "web/service/use-tools.ts": {
     "@tanstack/query/prefer-query-options": {
-      "count": 15
+      "count": 13
     },
     "no-restricted-imports": {
       "count": 1
diff --git a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
index 04406ecc119070..f1c3f55322f1f0 100644
--- a/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/built-in-access-points.spec.tsx
@@ -1,5 +1,5 @@
 import { screen } from '@testing-library/react'
-import { render } from '@/test/console/render'
+import { renderWithConsoleQuery as render } from '@/test/console/query-data'
 import { BuiltInAccessPoints } from '../built-in-access-points'
 
 const mocks = vi.hoisted(() => ({
@@ -111,6 +111,7 @@ describe('BuiltInAccessPoints', () => {
   it('renders the unpublished state across all access point cards', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -148,6 +149,7 @@ describe('BuiltInAccessPoints', () => {
 
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint={false}
@@ -177,7 +179,13 @@ describe('BuiltInAccessPoints', () => {
       enable_api: true,
     }
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(screen.getByText('deployments.studio.accessPoint.noPublishedTitle')).toBeInTheDocument()
@@ -188,7 +196,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ triggerModeDisabled: false }),
+      expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.triggerCard).not.toHaveBeenCalled()
     expect(mocks.useAppWorkflow).toHaveBeenCalledWith('app-1', expect.any(Object))
@@ -217,7 +225,13 @@ describe('BuiltInAccessPoints', () => {
       }
       mocks.workflow = workflow
       render(
-        <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+        <BuiltInAccessPoints
+          canViewLayout
+          appId="app-1"
+          canDeploy
+          canManageAccessPoint
+          canReleaseAndVersion
+        />,
       )
 
       expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability }))
@@ -232,6 +246,7 @@ describe('BuiltInAccessPoints', () => {
   it('uses Access Point management for every requested built-in operation', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -254,6 +269,7 @@ describe('BuiltInAccessPoints', () => {
   it('highlights only the targeted built-in access point card', () => {
     render(
       <BuiltInAccessPoints
+        canViewLayout
         appId="app-1"
         canDeploy
         canManageAccessPoint
@@ -280,7 +296,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(
@@ -290,7 +312,7 @@ describe('BuiltInAccessPoints', () => {
       expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.mcpCard).toHaveBeenCalledWith(
-      expect.objectContaining({ triggerModeDisabled: true }),
+      expect.objectContaining({ availability: 'unavailable' }),
     )
     expect(mocks.triggerCard).toHaveBeenCalledWith(
       expect.objectContaining({ availability: 'available' }),
@@ -308,7 +330,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(mocks.webCard).toHaveBeenCalledWith(expect.objectContaining({ availability: 'loading' }))
@@ -326,7 +354,13 @@ describe('BuiltInAccessPoints', () => {
     }
 
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     expect(
@@ -336,7 +370,13 @@ describe('BuiltInAccessPoints', () => {
 
   it('does not retry forbidden published workflow requests', () => {
     render(
-      <BuiltInAccessPoints appId="app-1" canDeploy canManageAccessPoint canReleaseAndVersion />,
+      <BuiltInAccessPoints
+        canViewLayout
+        appId="app-1"
+        canDeploy
+        canManageAccessPoint
+        canReleaseAndVersion
+      />,
     )
 
     const options = mocks.useAppWorkflow.mock.calls.at(-1)?.[1] as {
diff --git a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
new file mode 100644
index 00000000000000..7235694beb6ad2
--- /dev/null
+++ b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
@@ -0,0 +1,257 @@
+import type {
+  AppDetailWithSite,
+  WorkflowResponse,
+  WorkflowTriggerResponse,
+} from '@dify/contracts/api/console/apps/types.gen'
+import { screen, waitFor, within } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { useStore as useAppStore } from '@/app/components/app/store'
+import { toast } from '@/app/notifications'
+import { renderWithConsoleQuery } from '@/test/console/query-data'
+import { createAppDetailFixture, createAppSiteFixture } from '@/test/fixtures/app'
+import { BuiltInAccessPoints } from '../built-in-access-points'
+
+vi.mock('@/app/notifications', () => ({ toast: { error: vi.fn(), success: vi.fn() } }))
+vi.mock('@/context/i18n', () => ({ useDocLink: () => (path: string) => path }))
+vi.mock('@/service/use-triggers', () => ({ useAllTriggerPlugins: () => ({ data: [] }) }))
+vi.mock('@/app/components/app/overview/customize', () => ({ default: () => null }))
+vi.mock('@/app/components/app/overview/settings', () => ({ default: () => null }))
+vi.mock('@/app/components/app/overview/embedded', () => ({ default: () => null }))
+
+const inService = 'agentV2.agentDetail.access.status.inService'
+const unavailable = 'deployments.health.ENVIRONMENT_STATUS_FAILED'
+const unpublishedTitle = 'deployments.studio.accessPoint.noPublishedTitle'
+const publishedPath = '/apps/app-1/workflows/publish'
+
+const getWebCard = () =>
+  screen.getByRole('region', { name: 'agentV2.agentDetail.access.webApp.title' })
+const getApiCard = () =>
+  screen.getByRole('region', { name: 'agentV2.agentDetail.access.serviceApi.title' })
+const getMcpCard = () => screen.getByRole('region', { name: 'tools.mcp.server.title' })
+const getTriggerCard = () => screen.getByRole('region', { name: 'navigation.settings.trigger' })
+
+const publishedWorkflow: WorkflowResponse = {
+  id: 'published-workflow',
+  graph: { nodes: [{ data: { type: 'start' } }] },
+  features: {},
+  conversation_variables: [],
+  environment_variables: [],
+  rag_pipeline_variables: [],
+  created_at: 1,
+  updated_at: 1,
+  hash: 'published-hash',
+  marked_comment: '',
+  marked_name: '',
+  tool_published: false,
+  version: 'published',
+}
+
+function renderAccessPoints({
+  mode = 'workflow',
+  role = 'normal',
+  published = true,
+  triggers = [],
+  workflow = publishedWorkflow,
+  rbacEnabled = false,
+  canViewLayout = role === 'owner',
+  triggerResponse,
+}: {
+  mode?: AppDetailWithSite['mode']
+  role?: 'normal' | 'owner'
+  published?: boolean
+  triggers?: WorkflowTriggerResponse[]
+  workflow?: WorkflowResponse | null
+  rbacEnabled?: boolean
+  canViewLayout?: boolean
+  triggerResponse?: Promise<Response>
+} = {}) {
+  const paths: string[] = []
+  vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+    const request = new Request(input, init)
+    const path = new URL(request.url).pathname.replace('/console/api', '')
+    if (request.method === 'POST' && path === '/apps/app-1/trigger-enable' && role === 'owner') {
+      const body = (await request.json()) as { trigger_id: string; enable_trigger: boolean }
+      triggers = triggers.map((trigger) =>
+        trigger.id === body.trigger_id
+          ? { ...trigger, status: body.enable_trigger ? 'enabled' : 'disabled' }
+          : trigger,
+      )
+      return Response.json({ result: 'success' })
+    }
+    if (request.method !== 'GET') throw new Error(`Unexpected mutation: ${request.method} ${path}`)
+    paths.push(path)
+    if (path === publishedPath) {
+      return role === 'normal' && !rbacEnabled
+        ? Response.json(
+            {
+              code: 'forbidden',
+              message: "You don't have the permission to access the requested resource.",
+            },
+            { status: 403 },
+          )
+        : Response.json(workflow)
+    }
+    if (path === '/apps/app-1/server')
+      return Response.json({ id: 'server-1', server_code: 'server-code', status: 'active' })
+    if (path === '/apps/app-1/triggers') return triggerResponse ?? Response.json({ data: triggers })
+    throw new Error(`Unexpected request: ${request.method} ${path}`)
+  })
+  useAppStore.setState({
+    appDetail: createAppDetailFixture({
+      mode,
+      site: createAppSiteFixture(),
+      workflow: published ? { id: 'published-workflow' } : null,
+    }),
+  })
+  renderWithConsoleQuery(
+    <BuiltInAccessPoints
+      appId="app-1"
+      canViewLayout={canViewLayout}
+      canDeploy={false}
+      canManageAccessPoint={role === 'owner'}
+      canReleaseAndVersion={role === 'owner'}
+    />,
+    {
+      currentWorkspace: { role },
+      systemFeatures: { deployment_edition: 'CLOUD', rbac_enabled: rbacEnabled },
+    },
+  )
+  return paths
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+})
+
+it.each(['workflow', 'advanced-chat'] as const)(
+  'shows a published %s to Normal members without requesting its graph',
+  async (mode) => {
+    const paths = renderAccessPoints({ mode })
+
+    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+    expect(paths).not.toContain(publishedPath)
+    expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
+    expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
+    expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument()
+    expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+    expect(toast.error).not.toHaveBeenCalled()
+    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
+      expect(within(card).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
+    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(
+      mode === 'workflow' ? 1 : 0,
+    )
+  },
+)
+
+it('uses the app summary to identify an unpublished workflow for Normal members', async () => {
+  const paths = renderAccessPoints({ published: false })
+
+  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+  expect(paths).not.toContain(publishedPath)
+  expect(screen.getByText(unpublishedTitle)).toBeInTheDocument()
+  expect(within(getWebCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it('keeps published Owner access points available using the workflow graph', async () => {
+  const paths = renderAccessPoints({ role: 'owner' })
+
+  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
+  expect(within(getWebCard()).getByText(inService)).toBeInTheDocument()
+  expect(within(getApiCard()).getByText(inService)).toBeInTheDocument()
+  expect(within(getTriggerCard()).getByText(unavailable)).toBeInTheDocument()
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it.each(['disabled', 'unauthorized'])(
+  'preserves trigger-only availability for a Normal member when its trigger is %s',
+  async (status) => {
+    const paths = renderAccessPoints({
+      triggers: [
+        {
+          id: 'trigger-1',
+          node_id: 'trigger-node',
+          title: 'Published trigger',
+          trigger_type: 'trigger-webhook',
+          status,
+          icon: '',
+          provider_name: '',
+        },
+      ],
+    })
+
+    await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+    expect(paths).not.toContain(publishedPath)
+    for (const card of [getWebCard(), getApiCard(), getMcpCard()])
+      expect(within(card).getAllByText(unavailable).length).toBeGreaterThan(0)
+    expect(within(getTriggerCard()).getByText('Published trigger')).toBeInTheDocument()
+    expect(within(getTriggerCard()).getByRole('switch')).toHaveAttribute('aria-disabled', 'true')
+    expect(
+      screen.getByText('deployments.studio.accessPoint.triggerExclusiveNotice'),
+    ).toBeInTheDocument()
+    expect(toast.error).not.toHaveBeenCalled()
+  },
+)
+
+it('waits for published trigger metadata before showing Normal access point availability', async () => {
+  let finish!: (response: Response) => void
+  const triggerResponse = new Promise<Response>((resolve) => {
+    finish = resolve
+  })
+  const paths = renderAccessPoints({ triggerResponse })
+
+  await waitFor(() => expect(paths).toContain('/apps/app-1/triggers'))
+  expect(getWebCard()).toHaveAttribute('aria-busy', 'true')
+  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+
+  finish(Response.json({ data: [] }))
+  await waitFor(() => expect(within(getWebCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(1)
+  expect(paths).not.toContain(publishedPath)
+})
+
+it('honors RBAC layout access even for a Normal workspace member', async () => {
+  const paths = renderAccessPoints({ rbacEnabled: true, canViewLayout: true })
+
+  await waitFor(() => expect(within(getMcpCard()).getByText(inService)).toBeInTheDocument())
+  expect(paths.filter((path) => path === publishedPath)).toHaveLength(1)
+  expect(toast.error).not.toHaveBeenCalled()
+})
+
+it('keeps Owner MCP unavailable when the published graph has no Start node', async () => {
+  renderAccessPoints({ role: 'owner', workflow: { ...publishedWorkflow, graph: { nodes: [] } } })
+
+  await waitFor(() => expect(getMcpCard()).not.toHaveAttribute('aria-busy', 'true'))
+  expect(within(getMcpCard()).getAllByText(unavailable).length).toBeGreaterThan(0)
+  expect(screen.queryByText(unpublishedTitle)).not.toBeInTheDocument()
+})
+
+it('refreshes the shared trigger query after an Owner changes a published trigger', async () => {
+  const user = userEvent.setup()
+  const paths = renderAccessPoints({
+    role: 'owner',
+    workflow: { ...publishedWorkflow, graph: { nodes: [{ data: { type: 'trigger-webhook' } }] } },
+    triggers: [
+      {
+        id: 'trigger-1',
+        node_id: 'trigger-node',
+        title: 'Published trigger',
+        trigger_type: 'trigger-webhook',
+        status: 'enabled',
+        icon: '',
+        provider_name: '',
+      },
+    ],
+  })
+
+  const toggle = await within(getTriggerCard()).findByRole('switch', { name: 'Published trigger' })
+  expect(toggle).toHaveAttribute('aria-checked', 'true')
+  await user.click(toggle)
+
+  await waitFor(() =>
+    expect(paths.filter((path) => path === '/apps/app-1/triggers')).toHaveLength(2),
+  )
+  expect(toggle).toHaveAttribute('aria-checked', 'false')
+  expect(toast.error).not.toHaveBeenCalled()
+})
diff --git a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
index 4fd5ec63630054..1c1acc982adc44 100644
--- a/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/mcp-card.spec.tsx
@@ -118,9 +118,8 @@ function renderCard(cardAppInfo: AppDetailWithSite = appInfo, workflow?: Publish
       <MCPAccessPointCard
         appInfo={cardAppInfo}
         canManageAccessPoint
-        triggerModeDisabled={false}
+        availability="available"
         workflow={workflow}
-        workflowLoading={false}
       />
     </QueryClientProvider>,
   )
diff --git a/web/app/components/app/access-point/built-in-access-points/index.tsx b/web/app/components/app/access-point/built-in-access-points/index.tsx
index f0f3299f4ff827..0ac267998d7a33 100644
--- a/web/app/components/app/access-point/built-in-access-points/index.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/index.tsx
@@ -3,13 +3,16 @@
 import type { AccessPoint } from '@/app/components/app/deploy/utils/access-point'
 import { Button, buttonVariants } from '@langgenius/dify-ui/button'
 import { cn } from '@langgenius/dify-ui/cn'
-import { useSuspenseQuery } from '@tanstack/react-query'
+import { skipToken, useQuery, useSuspenseQuery } from '@tanstack/react-query'
+import { useAtomValue } from 'jotai'
 import { useTranslation } from 'react-i18next'
 import { useStore as useAppStore } from '@/app/components/app/store'
 import { LoadingPlaceholder } from '@/app/components/base/loading-placeholder'
 import { useDocLink } from '@/context/i18n'
+import { currentWorkspaceAtom, currentWorkspaceLoadingAtom } from '@/context/workspace-state'
 import { systemFeaturesQueryOptions } from '@/features/system-features/client'
 import Link from '@/next/link'
+import { consoleQuery } from '@/service/console'
 import { useAppWorkflow } from '@/service/use-workflow'
 import { useAccessPointActions } from '../shared/use-access-point-actions'
 import { getPublishedWorkflowState, isAdvancedApp } from '../shared/utils'
@@ -20,6 +23,7 @@ import { WebAppAccessPointCard } from './web-app-card'
 
 type BuiltInAccessPointsProps = {
   appId: string
+  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -28,6 +32,7 @@ type BuiltInAccessPointsProps = {
 
 export function BuiltInAccessPoints({
   appId,
+  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -37,7 +42,13 @@ export function BuiltInAccessPoints({
   const docLink = useDocLink()
   const appInfo = useAppStore((state) => state.appDetail)
   const { data: systemFeatures } = useSuspenseQuery(systemFeaturesQueryOptions())
-  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo))
+  const workspace = useAtomValue(currentWorkspaceAtom)
+  const workspaceLoading = useAtomValue(currentWorkspaceLoadingAtom)
+  const canReadWorkflow =
+    canViewLayout &&
+    (systemFeatures.rbac_enabled ||
+      (!workspaceLoading && ['owner', 'admin', 'editor'].includes(workspace.role)))
+  const shouldFetchWorkflow = Boolean(appInfo && isAdvancedApp(appInfo) && canReadWorkflow)
   const {
     data: workflow,
     isError: workflowError,
@@ -49,15 +60,34 @@ export function BuiltInAccessPoints({
       return failureCount < 3
     },
   })
+  const useWorkflowSummary = Boolean(appInfo && isAdvancedApp(appInfo) && !canReadWorkflow)
+  const needsPublishedTriggers =
+    useWorkflowSummary && appInfo?.mode === 'workflow' && Boolean(appInfo.workflow?.id)
+  const triggersQuery = useQuery(
+    consoleQuery.apps.byAppId.triggers.get.queryOptions({
+      input: appInfo?.mode === 'workflow' ? { params: { app_id: appId } } : skipToken,
+      enabled: needsPublishedTriggers,
+      retry: false,
+    }),
+  )
   const actions = useAccessPointActions(appId, canManageAccessPoint)
 
   if (!appInfo) return <LoadingPlaceholder />
 
   const workflowState = getPublishedWorkflowState(appInfo, workflow)
-  const builtInLoading = workflowState.requiresPublishedWorkflow && workflowLoading
-  const appCardsUnavailable =
+  const isUnpublished = useWorkflowSummary ? !appInfo.workflow?.id : workflowState.isUnpublished
+  const hasTriggerNode = useWorkflowSummary
+    ? needsPublishedTriggers && Boolean(triggersQuery.data?.data.length)
+    : workflowState.hasTriggerNode
+  const builtInLoading =
     workflowState.requiresPublishedWorkflow &&
-    (workflowError || workflowState.isUnpublished || workflowState.hasTriggerNode)
+    (workspaceLoading ||
+      (shouldFetchWorkflow && workflowLoading) ||
+      (needsPublishedTriggers && triggersQuery.isPending))
+  const builtInError =
+    (shouldFetchWorkflow && workflowError) || (needsPublishedTriggers && triggersQuery.isError)
+  const appCardsUnavailable =
+    workflowState.requiresPublishedWorkflow && (builtInError || isUnpublished || hasTriggerNode)
   const appCardAvailability = builtInLoading
     ? 'loading'
     : appCardsUnavailable
@@ -65,13 +95,20 @@ export function BuiltInAccessPoints({
       : 'available'
   const triggerAvailability = builtInLoading
     ? 'loading'
-    : workflowState.isUnpublished || !workflowState.hasTriggerNode
+    : builtInError || isUnpublished || !hasTriggerNode
+      ? 'unavailable'
+      : 'available'
+  const mcpAvailability = builtInLoading
+    ? 'loading'
+    : appCardsUnavailable ||
+        (!workflowState.requiresPublishedWorkflow && !appInfo.model_config?.updated_at) ||
+        (canReadWorkflow && workflowState.isWorkflowApp && !workflowState.hasStartNode)
       ? 'unavailable'
       : 'available'
 
   return (
     <div className="flex h-full flex-col gap-2">
-      {workflowState.isUnpublished && !workflowLoading && !workflowError && (
+      {isUnpublished && !builtInLoading && !builtInError && (
         <div className="flex flex-col items-start gap-2 rounded-xl bg-background-section-burn p-3">
           <div className="flex flex-col gap-0.5">
             <span className="block system-md-semibold text-text-secondary">
@@ -127,8 +164,7 @@ export function BuiltInAccessPoints({
           appInfo={appInfo}
           canManageAccessPoint={canManageAccessPoint}
           workflow={workflow}
-          workflowLoading={workflowLoading}
-          triggerModeDisabled={workflowState.hasTriggerNode}
+          availability={mcpAvailability}
           highlighted={highlightedAccessPoint === 'mcp'}
         />
         {workflowState.isWorkflowApp && (
@@ -141,7 +177,7 @@ export function BuiltInAccessPoints({
         )}
       </div>
 
-      {workflowState.hasTriggerNode && (
+      {hasTriggerNode && (
         <div className="mt-2 flex min-h-10 items-center gap-2 rounded-xl bg-background-section-burn px-3 py-2 system-xs-regular text-text-tertiary">
           <span aria-hidden className="i-ri-information-line size-4 shrink-0" />
           <span>
diff --git a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
index 5e2c4f5ae08346..4366d788b69c53 100644
--- a/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
+++ b/web/app/components/app/access-point/built-in-access-points/mcp-card.tsx
@@ -2,6 +2,7 @@
 
 import type { AppDetailWithSite } from '@dify/contracts/api/console/apps/types.gen'
 import type { PublishedWorkflow } from '../shared/utils'
+import type { AccessPointAvailability } from '@/app/components/base/access-point/status'
 import {
   AlertDialog,
   AlertDialogCancelButton,
@@ -26,7 +27,6 @@ import {
   useMCPServerDetail,
   useRefreshMCPServerCode,
 } from '@/service/use-tools'
-import { AppModeEnum } from '@/types/app'
 import { useAccessPointStatusLabel } from '../shared/use-access-point-status-label'
 import { getPublishedWorkflowNodes, isAdvancedApp } from '../shared/utils'
 
@@ -34,23 +34,20 @@ type MCPAccessPointCardProps = {
   appInfo: AppDetailWithSite
   canManageAccessPoint: boolean
   highlighted?: boolean
-  triggerModeDisabled: boolean
+  availability: AccessPointAvailability
   workflow: PublishedWorkflow
-  workflowLoading: boolean
 }
 
 export function MCPAccessPointCard({
   appInfo,
   canManageAccessPoint,
   highlighted,
-  triggerModeDisabled,
+  availability,
   workflow,
-  workflowLoading,
 }: MCPAccessPointCardProps) {
   const { t } = useTranslation(['appOverview', 'common', 'deployments', 'tools'])
   const advancedApp = isAdvancedApp(appInfo)
   const basicApp = !advancedApp
-  const workflowApp = appInfo.mode === AppModeEnum.WORKFLOW
   const [showServerModal, setShowServerModal] = useState(false)
   const [showRegenerate, setShowRegenerate] = useState(false)
   const basicConfig = appInfo.model_config
@@ -84,11 +81,8 @@ export function MCPAccessPointCard({
     ? `${appInfo.api_base_url.replace(/\/v1$/, '')}/mcp/server/${detail?.server_code}/mcp`
     : '***********'
   const workflowNodes = getPublishedWorkflowNodes(workflow)
-  const missingStartNode =
-    workflowApp && !workflowNodes.some((node) => node.data.type === BlockEnum.Start)
-  const appUnpublished = advancedApp ? !workflow?.graph : !basicConfig?.updated_at
-  const loading = serverDetailLoading || (advancedApp && workflowLoading)
-  const unavailable = !loading && (appUnpublished || missingStartNode || triggerModeDisabled)
+  const loading = serverDetailLoading || availability === 'loading'
+  const unavailable = !loading && availability === 'unavailable'
 
   const basicAppInputs = useMemo(() => {
     if (!basicApp || !basicAppInputForm) return []
diff --git a/web/app/components/app/access-point/index.tsx b/web/app/components/app/access-point/index.tsx
index 0255ee9c946c46..2ca9b24cc15691 100644
--- a/web/app/components/app/access-point/index.tsx
+++ b/web/app/components/app/access-point/index.tsx
@@ -41,6 +41,7 @@ type AccessPointProps = {
 }
 
 type AccessPointContentProps = AccessPointProps & {
+  canViewLayout: boolean
   canDeploy: boolean
   canManageAccessPoint: boolean
   canReleaseAndVersion: boolean
@@ -49,6 +50,7 @@ type AccessPointContentProps = AccessPointProps & {
 
 function AccessPointContent({
   appId,
+  canViewLayout,
   canDeploy,
   canManageAccessPoint,
   canReleaseAndVersion,
@@ -147,6 +149,7 @@ function AccessPointContent({
             {selectedEnvironment === BUILT_IN_ENVIRONMENT_ID ? (
               <BuiltInAccessPoints
                 appId={appId}
+                canViewLayout={canViewLayout}
                 canDeploy={canDeploy}
                 canManageAccessPoint={canManageAccessPoint}
                 canReleaseAndVersion={canReleaseAndVersion}
@@ -190,6 +193,7 @@ export default function AccessPoint({ appId }: AccessPointProps) {
     <AccessPointStateBoundary appId={appId} environmentQueryEnabled={showEnvironmentTabs}>
       <AccessPointContent
         appId={appId}
+        canViewLayout={capabilities.canViewLayout}
         canDeploy={capabilities.canDeploy}
         canManageAccessPoint={capabilities.canManageAccessPoint}
         canReleaseAndVersion={capabilities.canReleaseAndVersion}
diff --git a/web/service/use-tools.ts b/web/service/use-tools.ts
index 002cbc9b2644c1..38d60fb725ec91 100644
--- a/web/service/use-tools.ts
+++ b/web/service/use-tools.ts
@@ -1,3 +1,4 @@
+import type { WorkflowTriggerResponse } from '@dify/contracts/api/console/apps/types.gen'
 import type { QueryKey, UseQueryOptions } from '@tanstack/react-query'
 import type {
   Collection,
@@ -8,9 +9,9 @@ import type {
 } from '@/app/components/tools/types'
 import type { RAGRecommendedPlugins, ToolWithProvider } from '@/app/components/workflow/types'
 import type { AppIconType } from '@/types/app'
-import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
+import { skipToken, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { CollectionType } from '@/app/components/tools/types'
-import { consoleClient } from '@/service/console'
+import { consoleClient, consoleQuery } from '@/service/console'
 import { del, get, post, put } from './base'
 import { useInvalid } from './use-base'
 
@@ -297,35 +298,27 @@ export const useInvalidateRAGRecommendedPlugins = () => {
 }
 
 // App Triggers API hooks
-export type AppTrigger = {
-  id: string
-  trigger_type: 'trigger-webhook' | 'trigger-schedule' | 'trigger-plugin'
-  title: string
-  node_id: string
-  provider_name: string
-  icon: string
-  status: 'enabled' | 'disabled' | 'unauthorized'
-  created_at: string
-  updated_at: string
-}
+export type AppTrigger = WorkflowTriggerResponse
 
 export const useAppTriggers = (
   appId: string | undefined,
   options?: Omit<UseQueryOptions<{ data: AppTrigger[] }>, 'queryKey' | 'queryFn'>,
 ) => {
-  return useQuery<{ data: AppTrigger[] }>({
-    queryKey: [NAME_SPACE, 'app-triggers', appId],
-    queryFn: () => get<{ data: AppTrigger[] }>(`/apps/${appId}/triggers`),
-    enabled: !!appId,
-    ...options, // Merge additional options while maintaining backward compatibility
-  })
+  return useQuery(
+    consoleQuery.apps.byAppId.triggers.get.queryOptions({
+      ...options,
+      input: appId ? { params: { app_id: appId } } : skipToken,
+    }),
+  )
 }
 
 export const useInvalidateAppTriggers = () => {
   const queryClient = useQueryClient()
   return (appId: string) => {
     return queryClient.invalidateQueries({
-      queryKey: [NAME_SPACE, 'app-triggers', appId],
+      queryKey: consoleQuery.apps.byAppId.triggers.get.queryKey({
+        input: { params: { app_id: appId } },
+      }),
     })
   }
 }

From 1c72f7e85bc85cecdb18f2726092875b02ad6b0a Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 13 Oct 2026 10:14:24 +0800
Subject: [PATCH 103/108] test(web): support deploy branch customize dialog
 export

---
 .../app/access-point/__tests__/built-in-permissions.spec.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
index 7235694beb6ad2..032735254b0a05 100644
--- a/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/built-in-permissions.spec.tsx
@@ -14,7 +14,10 @@ import { BuiltInAccessPoints } from '../built-in-access-points'
 vi.mock('@/app/notifications', () => ({ toast: { error: vi.fn(), success: vi.fn() } }))
 vi.mock('@/context/i18n', () => ({ useDocLink: () => (path: string) => path }))
 vi.mock('@/service/use-triggers', () => ({ useAllTriggerPlugins: () => ({ data: [] }) }))
-vi.mock('@/app/components/app/overview/customize', () => ({ default: () => null }))
+vi.mock('@/app/components/app/overview/customize', () => ({
+  default: () => null,
+  CustomizeDialog: () => null,
+}))
 vi.mock('@/app/components/app/overview/settings', () => ({ default: () => null }))
 vi.mock('@/app/components/app/overview/embedded', () => ({ default: () => null }))
 

From 847d9365042f07f858d86b58e74cb8277087e0e6 Mon Sep 17 00:00:00 2001
From: Yansong Zhang <916125788@qq.com>
Date: Tue, 13 Oct 2026 12:00:52 +0800
Subject: [PATCH 104/108] fix: read member access status through a summary
 endpoint (SNP-951)

Coordinate with SaaS status-only authorization and cover the real BFF transport and cold-cache Normal UI path.

Co-authored-by: CodingOnStar <hanxujiang@dify.com>
---
 .../entities/network_access_group_entities.py |  11 ++
 api/services/network_access_group_gateway.py  |  21 +++
 api/services/network_access_group_service.py  |  20 ++-
 .../workspace/test_network_access_group.py    | 150 ++++++++++++++++++
 .../test_network_access_group_service.py      |  32 +++-
 .../access-control/__tests__/index.spec.tsx   |  21 ---
 .../__tests__/status-only.spec.tsx            | 136 ++++++++++++++++
 7 files changed, 360 insertions(+), 31 deletions(-)
 create mode 100644 web/app/components/app/access-point/access-control/__tests__/status-only.spec.tsx

diff --git a/api/services/entities/network_access_group_entities.py b/api/services/entities/network_access_group_entities.py
index 589d51ab29a087..521c348f7bab84 100644
--- a/api/services/entities/network_access_group_entities.py
+++ b/api/services/entities/network_access_group_entities.py
@@ -66,6 +66,17 @@ class NetworkAccessAppConfig:
     available_access_points: tuple[NetworkAccessPoint, ...] = ()
 
 
+@dataclass(frozen=True)
+class NetworkAccessAppStatusSnapshot:
+    """Control-plane entry state without policy identity or configuration."""
+
+    entitled: bool
+    configured: bool
+    enabled: bool
+    # Preserve legacy/future scopes so the service can project current App capabilities.
+    access_points: tuple[str, ...]
+
+
 @dataclass(frozen=True)
 class NetworkAccessAppStatus:
     """Public entry status without policy identity or configuration."""
diff --git a/api/services/network_access_group_gateway.py b/api/services/network_access_group_gateway.py
index 3d634012fabb74..86fc0b811949ac 100644
--- a/api/services/network_access_group_gateway.py
+++ b/api/services/network_access_group_gateway.py
@@ -24,6 +24,7 @@
 from services.billing_service import BillingService, _BillingHTTPStatusError
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessGroup,
@@ -176,6 +177,14 @@ class _BindingUpdateWire(_WireModel):
     effective_enabled: StrictBool = False
 
 
+class _AppStatusWire(_WireModel):
+    aliases = {"access_points": ("accessPoints",)}
+    entitled: StrictBool = False
+    configured: StrictBool = False
+    enabled: StrictBool = False
+    access_points: tuple[StrictStr, ...] = ()
+
+
 class _DeletedWire(_WireModel):
     deleted: StrictBool = False
 
@@ -322,6 +331,18 @@ def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str)
             wire.binding.record() if wire.binding is not None else None,
         )
 
+    @override
+    def get_app_status(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppStatusSnapshot:
+        wire = _decode(
+            _AppStatusWire,
+            self._send_request(
+                "GET",
+                f"/tenants/{workspace_id}/apps/{app_id}/network-access-group/status",
+                params={"actor_account_id": actor_account_id},
+            ),
+        )
+        return NetworkAccessAppStatusSnapshot(wire.entitled, wire.configured, wire.enabled, wire.access_points)
+
     @override
     def update_app_binding(
         self,
diff --git a/api/services/network_access_group_service.py b/api/services/network_access_group_service.py
index 940af7a457f88e..13b4e8b4717420 100644
--- a/api/services/network_access_group_service.py
+++ b/api/services/network_access_group_service.py
@@ -10,6 +10,7 @@
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
     NetworkAccessAppStatus,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -142,6 +143,10 @@ def delete_group(
 
     def get_app_binding(self, workspace_id: str, app_id: str, actor_account_id: str) -> NetworkAccessAppConfig: ...
 
+    def get_app_status(
+        self, workspace_id: str, app_id: str, actor_account_id: str
+    ) -> NetworkAccessAppStatusSnapshot: ...
+
     def update_app_binding(
         self,
         workspace_id: str,
@@ -249,14 +254,15 @@ def get_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAcc
     def get_app_status(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppStatus:
         """Expose only the Access Point entry state to Normal workspace members."""
         self._ensure_workspace_role(context, _APP_STATUS_ROLES)
-        config = self._read_app_binding(context, app_id=app_id)
-        binding = config.binding
+        app = self._get_manageable_app(context.active_workspace_id, app_id)
+        available_access_points = self._available_access_points(app.mode)
+        status = self._control_plane.get_app_status(context.active_workspace_id, app.id, context.account_id)
         return NetworkAccessAppStatus(
-            entitled=config.entitled,
-            configured=bool(binding and binding.group_id),
-            enabled=bool(binding and binding.enabled),
-            covered_count=len(binding.access_points) if binding else 0,
-            available_count=len(config.available_access_points),
+            entitled=self._effective_entitlement(context.active_workspace_id, status.entitled),
+            configured=status.configured,
+            enabled=status.enabled,
+            covered_count=len(set(status.access_points).intersection(available_access_points)),
+            available_count=len(available_access_points),
         )
 
     def _read_app_binding(self, context: RequestContext, *, app_id: str) -> NetworkAccessAppConfig:
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 0f87566c0ceada..3a73dc30fdec1f 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -272,6 +272,114 @@ def test_app_status_serializes_only_entry_state() -> None:
     service.get_app_status.assert_called_once_with(_request_context(), app_id=APP_ID)
 
 
+@pytest.mark.parametrize("role", ["normal", "owner", "admin", "editor"])
+@pytest.mark.parametrize(
+    ("app_mode", "covered_count", "available_count"),
+    [
+        ("workflow", 3, 4),
+        ("advanced-chat", 2, 3),
+        ("chat", 2, 3),
+        ("completion", 2, 3),
+        ("agent-chat", 2, 3),
+        ("agent", 1, 2),
+    ],
+)
+def test_app_status_uses_minimal_upstream_route_and_filters_scopes_for_current_mode(
+    role: str, app_mode: str, covered_count: int, available_count: int
+) -> None:
+    response, requests = _typed_status_http_response(
+        {
+            "entitled": True,
+            "configured": True,
+            "enabled": True,
+            "accessPoints": ["webapp", "mcp", "trigger", "future_scope", "webapp"],
+            "group_id": GROUP_ID,
+            "allowed_cidrs": ["203.0.113.7/32"],
+        },
+        role=role,
+        app_mode=app_mode,
+    )
+
+    assert response.status_code == 200
+    assert response.get_json() == {
+        "entitled": True,
+        "configured": True,
+        "enabled": True,
+        "covered_count": covered_count,
+        "available_count": available_count,
+    }
+    assert len(requests) == 1
+    assert requests[0].method == "GET"
+    assert requests[0].url.path == f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status"
+    assert dict(requests[0].url.params) == {"actor_account_id": ACCOUNT_ID}
+    assert requests[0].headers["Billing-Api-Secret-Key"] == "synthetic"
+
+
+@pytest.mark.parametrize(
+    ("wire", "paid", "expected"),
+    [
+        ({}, True, {"entitled": False, "configured": False, "enabled": False, "covered_count": 0}),
+        ({"entitled": True}, True, {"entitled": True, "configured": False, "enabled": False, "covered_count": 0}),
+        (
+            {"entitled": True, "configured": True, "access_points": ["webapp"]},
+            True,
+            {"entitled": True, "configured": True, "enabled": False, "covered_count": 1},
+        ),
+        (
+            {"entitled": True, "configured": True, "enabled": True, "access_points": ["webapp"]},
+            False,
+            {"entitled": False, "configured": True, "enabled": True, "covered_count": 1},
+        ),
+    ],
+)
+def test_app_status_preserves_saved_state_and_applies_local_entitlement(
+    wire: Mapping[str, object], paid: bool, expected: dict[str, object]
+) -> None:
+    response, _requests = _typed_status_http_response(wire, paid=paid)
+
+    assert response.status_code == 200
+    assert response.get_json() == {**expected, "available_count": 4}
+
+
+@pytest.mark.parametrize("role", ["dataset_operator", "unknown", None])
+def test_app_status_rejects_disallowed_roles_before_upstream_read(role: str | None) -> None:
+    response, requests = _typed_status_http_response({}, role=role)
+
+    assert response.status_code == 403
+    assert requests == []
+
+
+@pytest.mark.parametrize("upstream_status", [403, 404])
+def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(upstream_status: int) -> None:
+    response, requests = _typed_status_http_response({}, upstream_status=upstream_status)
+
+    assert response.status_code == upstream_status
+    assert len(requests) == 1
+    assert requests[0].url.path.endswith("/network-access-group/status")
+
+
+@pytest.mark.parametrize("field", ["entitled", "configured", "enabled"])
+@pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
+def test_app_status_rejects_non_boolean_flags(field: str, value: object) -> None:
+    response, _requests = _typed_status_http_response({field: value})
+
+    assert response.status_code == 502
+
+
+@pytest.mark.parametrize(
+    "wire",
+    [
+        {"access_points": "webapp"},
+        {"access_points": [1]},
+        {"access_points": ["webapp"], "accessPoints": ["mcp"]},
+    ],
+)
+def test_app_status_rejects_malformed_or_conflicting_scopes(wire: Mapping[str, object]) -> None:
+    response, _requests = _typed_status_http_response(wire)
+
+    assert response.status_code == 502
+
+
 @pytest.mark.parametrize(
     ("status_code", "expected_exception"),
     [
@@ -818,3 +926,45 @@ def binding() -> dict[str, object]:
 
         with _application_services(service):
             return app.test_client().get("/binding")
+
+
+def _typed_status_http_response(
+    wire: Mapping[str, object],
+    *,
+    role: str | None = "normal",
+    app_mode: str = "workflow",
+    paid: bool = True,
+    upstream_status: int = 200,
+) -> tuple[TestResponse, list[httpx.Request]]:
+    app = Flask(__name__)
+    app.testing = True
+    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
+    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, app_mode, "Test", None, None, None)
+    memberships.get_account_role.return_value = role
+    entitlement.is_paid_plan.return_value = paid
+    requests: list[httpx.Request] = []
+
+    def respond(request: httpx.Request) -> httpx.Response:
+        requests.append(request)
+        if request.url.path != f"/tenants/{TENANT_ID}/apps/{APP_ID}/network-access-group/status":
+            return httpx.Response(403, json={"reason": "FORBIDDEN"})
+        return httpx.Response(upstream_status, json=wire)
+
+    with httpx.Client(transport=httpx.MockTransport(respond)) as client:
+        gateway = NetworkAccessGroupGateway(
+            base_url="https://test.invalid",
+            fallback_base_url="",
+            secret_key="synthetic",
+            http_client=client,
+        )
+        service = NetworkAccessGroupService(
+            control_plane=gateway, apps=apps, memberships=memberships, entitlement=entitlement
+        )
+        api = AppNetworkAccessGroupStatusApi()
+
+        @app.get("/status")
+        def status() -> dict[str, object]:
+            return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
+
+        with _application_services(service):
+            return app.test_client().get("/status"), requests
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index 5cbdea8fd8dadf..faeef4644c6193 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -8,6 +8,7 @@
 from machinery.context import RequestContext
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
+    NetworkAccessAppStatusSnapshot,
     NetworkAccessBinding,
     NetworkAccessBindingUpdate,
     NetworkAccessCurrentIPCheck,
@@ -128,6 +129,7 @@ def _harness(*, role: str | None = "owner", paid: bool = True, app_mode: str = "
     for method in (control_plane.get_group, control_plane.create_group, control_plane.update_group):
         method.return_value = _group()
     control_plane.get_app_binding.return_value = _config()
+    control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(True, False, False, ())
     control_plane.update_app_binding.return_value = NetworkAccessBindingUpdate(_binding(), False)
     control_plane.delete_group.return_value = True
     control_plane.cleanup_app_binding.return_value = True
@@ -342,8 +344,8 @@ def test_app_binding_rejects_disallowed_roles_before_app_lookup(operation: Mutat
 
 def test_normal_member_can_read_only_app_entry_status() -> None:
     harness = _harness(role="normal")
-    harness.control_plane.get_app_binding.return_value = _config(
-        _binding(enabled=True, group_id=GROUP_ID, access_points=("webapp", "service_api"))
+    harness.control_plane.get_app_status.return_value = NetworkAccessAppStatusSnapshot(
+        entitled=True, configured=True, enabled=True, access_points=("webapp", "service_api")
     )
 
     status = harness.service.get_app_status(_context(), app_id=APP_ID)
@@ -355,7 +357,8 @@ def test_normal_member_can_read_only_app_entry_status() -> None:
     assert status.available_count == 4
     assert not hasattr(status, "group_id")
     assert not hasattr(status, "allowed_cidrs")
-    harness.control_plane.get_app_binding.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.get_app_status.assert_called_once_with(WORKSPACE_ID, APP_ID, ACCOUNT_ID)
+    harness.control_plane.get_app_binding.assert_not_called()
 
 
 @pytest.mark.parametrize("role", ["dataset_operator", None])
@@ -366,6 +369,29 @@ def test_app_entry_status_rejects_roles_without_app_access(role: str | None) ->
         harness.service.get_app_status(_context(), app_id=APP_ID)
 
     harness.apps.get_manageable_app.assert_not_called()
+    harness.control_plane.get_app_status.assert_not_called()
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_app_status_rejects_missing_tenant_scoped_app_before_upstream_read() -> None:
+    harness = _harness(role="normal")
+    harness.apps.get_manageable_app.return_value = None
+
+    with pytest.raises(NetworkAccessGroupAppNotFoundError):
+        harness.service.get_app_status(_context(), app_id=APP_ID)
+
+    harness.apps.get_manageable_app.assert_called_once_with(workspace_id=WORKSPACE_ID, app_id=APP_ID)
+    harness.control_plane.get_app_status.assert_not_called()
+    harness.control_plane.get_app_binding.assert_not_called()
+
+
+def test_app_status_rejects_unsupported_app_mode_before_upstream_read() -> None:
+    harness = _harness(role="normal", app_mode="unknown")
+
+    with pytest.raises(NetworkAccessGroupUnsupportedAppModeError):
+        harness.service.get_app_status(_context(), app_id=APP_ID)
+
+    harness.control_plane.get_app_status.assert_not_called()
     harness.control_plane.get_app_binding.assert_not_called()
 
 
diff --git a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
index 067659f9d67908..c96580daa378e1 100644
--- a/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-point/access-control/__tests__/index.spec.tsx
@@ -21,7 +21,6 @@ import { consoleQuery } from '@/service/console'
 import {
   createNetworkAccessGroupFixture,
   seedAppNetworkAccessGroup,
-  seedAppNetworkAccessGroupStatus,
   seedNetworkAccessGroups,
 } from '@/test/console/network-access'
 import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
@@ -70,16 +69,6 @@ const renderEntry = ({
     binding,
     available_access_points: availableAccessPoints,
   })
-  if (role === 'normal') {
-    seedAppNetworkAccessGroupStatus(queryClient, 'app-1', {
-      entitled,
-      configured: Boolean(binding?.group_id),
-      enabled: binding?.enabled ?? false,
-      covered_count: binding?.access_points.length ?? 0,
-      available_count: availableAccessPoints.length,
-    })
-  }
-
   return renderWithConsoleQuery(
     <AccessControlEntry
       appMode="chat"
@@ -1214,16 +1203,6 @@ describe('supported access points and binding permission', () => {
     expect(screen.queryByRole('button', { name: 'Save' })).not.toBeInTheDocument()
   })
 
-  it('shows Normal members the status but keeps the entry disabled', () => {
-    const binding = createBinding({ enabled: true, access_points: ['webapp', 'service_api'] })
-    renderEntry({ plan: 'professional', role: 'normal', binding })
-    const entry = screen.getByRole('button', { name: /Access Control/ })
-    expect(entry).toBeDisabled()
-    expect(entry).toHaveTextContent('2 of 3')
-    expect(screen.queryByText('Internal Network')).not.toBeInTheDocument()
-    expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
-  })
-
   it('hides the entry from Dataset Operators', () => {
     renderEntry({ plan: 'professional', role: 'dataset_operator' })
     expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
diff --git a/web/app/components/app/access-point/access-control/__tests__/status-only.spec.tsx b/web/app/components/app/access-point/access-control/__tests__/status-only.spec.tsx
new file mode 100644
index 00000000000000..251614dbc3e199
--- /dev/null
+++ b/web/app/components/app/access-point/access-control/__tests__/status-only.spec.tsx
@@ -0,0 +1,136 @@
+import type { AppNetworkAccessGroupStatusResponse } from '@dify/contracts/api/console/apps/types.gen'
+import { screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { createInstance } from 'i18next'
+import { initReactI18next } from 'react-i18next'
+import { toast } from '@/app/notifications'
+import deploymentTranslations from '@/i18n/locales/en-US/deployments.json'
+import { consoleQuery } from '@/service/console'
+import { clearRequestErrorToasts } from '@/service/request-error-toast'
+import { createConsoleQueryClient, renderWithConsoleQuery } from '@/test/console/query-data'
+import { AccessControlEntry } from '..'
+
+vi.unmock('react-i18next')
+vi.mock('@/app/components/base/amplitude', () => ({ trackEvent: vi.fn() }))
+vi.mock('@/app/notifications', () => ({ toast: { error: vi.fn() } }))
+
+const statusPath = '/apps/app-1/network-access-group/status'
+const requests: Request[] = []
+
+const createStatus = (
+  overrides: Partial<AppNetworkAccessGroupStatusResponse> = {},
+): AppNetworkAccessGroupStatusResponse => ({
+  entitled: true,
+  configured: true,
+  enabled: true,
+  covered_count: 3,
+  available_count: 3,
+  ...overrides,
+})
+
+const renderNormalEntry = (response: () => Response) => {
+  const queryClient = createConsoleQueryClient()
+  vi.mocked(globalThis.fetch).mockImplementation(async (input, init) => {
+    const request = new Request(input, init)
+    requests.push(request)
+    if (new URL(request.url).pathname.endsWith(statusPath) && request.method === 'GET')
+      return response()
+    return Response.json({ message: 'Unexpected privileged request' }, { status: 403 })
+  })
+
+  // Only workspace/edition metadata is seeded. The status must cross the real
+  // Console transport, without configuration or policy-list data in the cache.
+  return renderWithConsoleQuery(
+    <AccessControlEntry
+      appMode="chat"
+      appId="app-1"
+      appIcon={{}}
+      isPublished
+      canEditBinding={false}
+    />,
+    {
+      queryClient,
+      currentWorkspace: { role: 'normal' },
+      systemFeatures: { deployment_edition: 'CLOUD' },
+    },
+  )
+}
+
+const expectOnlyStatusRequest = () => {
+  expect(requests).toHaveLength(1)
+  expect(requests[0]!.method).toBe('GET')
+  expect(new URL(requests[0]!.url).pathname).toBe(`/console/api${statusPath}`)
+}
+
+beforeEach(async () => {
+  requests.length = 0
+  vi.mocked(toast.error).mockClear()
+  await createInstance()
+    .use(initReactI18next)
+    .init({
+      lng: 'en-US',
+      fallbackLng: 'en-US',
+      keySeparator: false,
+      interpolation: { escapeValue: false },
+      resources: { 'en-US': { deployments: deploymentTranslations } },
+    })
+})
+
+afterEach(() => {
+  for (const request of requests) clearRequestErrorToasts(request)
+})
+
+describe('Normal member Access Control status', () => {
+  it.each([
+    {
+      name: 'Off',
+      status: createStatus({ configured: false, enabled: false, covered_count: 0 }),
+      label: 'Off',
+    },
+    { name: 'Paused', status: createStatus({ enabled: false }), label: 'Paused' },
+    { name: 'On', status: createStatus(), label: 'On' },
+    { name: 'partial coverage', status: createStatus({ covered_count: 2 }), label: '2 of 3' },
+    { name: 'downgraded', status: createStatus({ entitled: false }), label: 'PRO' },
+  ])(
+    'loads $name from the status-only API without exposing configuration',
+    async ({ status, label }) => {
+      const user = userEvent.setup()
+      renderNormalEntry(() => Response.json(status))
+
+      expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+      const entry = await screen.findByRole('button', { name: /Access Control/ })
+      expect(entry).toBeDisabled()
+      expect(entry).toHaveTextContent(label)
+
+      await user.click(entry)
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+      expect(
+        screen.queryByRole('switch', { name: 'Restrict by IP address' }),
+      ).not.toBeInTheDocument()
+      expect(toast.error).not.toHaveBeenCalled()
+      expectOnlyStatusRequest()
+    },
+  )
+
+  it.each([403, 503])(
+    'does not show a false Off state or fetch configuration after HTTP %s',
+    async (status) => {
+      const message = status === 403 ? 'Access denied' : 'Service unavailable'
+      const rendered = renderNormalEntry(() => Response.json({ message }, { status }))
+
+      await waitFor(() => {
+        expect(
+          rendered.queryClient.getQueryState(
+            consoleQuery.apps.byAppId.networkAccessGroup.status.get.queryKey({
+              input: { params: { app_id: 'app-1' } },
+            }),
+          )?.status,
+        ).toBe('error')
+      })
+      expect(screen.queryByRole('button', { name: /Access Control/ })).not.toBeInTheDocument()
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument()
+      expect(toast.error).toHaveBeenCalledExactlyOnceWith(message)
+      expectOnlyStatusRequest()
+    },
+  )
+})

From 36ae13e4c8b4aec1adf5e9caa4f2eaa7e6e9200d Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Mon, 19 Oct 2026 16:31:24 +0800
Subject: [PATCH 105/108] fix(web): align IP access control plan messaging
 (SNP-985, SNP-986)

---
 .../header/account-setting/ip-policies-page/index.tsx  |  7 +++++++
 web/i18n/locales/ar-TN/common.json                     |  1 +
 web/i18n/locales/az-AZ/common.json                     |  1 +
 web/i18n/locales/de-DE/common.json                     |  1 +
 web/i18n/locales/en-US/common.json                     |  1 +
 web/i18n/locales/es-ES/common.json                     |  1 +
 web/i18n/locales/fa-IR/common.json                     |  1 +
 web/i18n/locales/fr-FR/common.json                     |  1 +
 web/i18n/locales/hi-IN/common.json                     |  1 +
 web/i18n/locales/id-ID/common.json                     |  1 +
 web/i18n/locales/it-IT/common.json                     |  1 +
 web/i18n/locales/ja-JP/common.json                     |  1 +
 web/i18n/locales/ja-JP/deployments.json                | 10 +++++-----
 web/i18n/locales/ko-KR/common.json                     |  1 +
 web/i18n/locales/lo-LA/common.json                     |  1 +
 web/i18n/locales/nl-NL/common.json                     |  1 +
 web/i18n/locales/pl-PL/common.json                     |  1 +
 web/i18n/locales/pt-BR/common.json                     |  1 +
 web/i18n/locales/ro-RO/common.json                     |  1 +
 web/i18n/locales/ru-RU/common.json                     |  1 +
 web/i18n/locales/sl-SI/common.json                     |  1 +
 web/i18n/locales/th-TH/common.json                     |  1 +
 web/i18n/locales/tr-TR/common.json                     |  1 +
 web/i18n/locales/uk-UA/common.json                     |  1 +
 web/i18n/locales/vi-VN/common.json                     |  1 +
 web/i18n/locales/zh-Hans/common.json                   |  1 +
 web/i18n/locales/zh-Hans/deployments.json              |  6 +++---
 web/i18n/locales/zh-Hant/common.json                   |  1 +
 web/i18n/resources.generated.d.ts                      |  1 +
 29 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/web/app/components/header/account-setting/ip-policies-page/index.tsx b/web/app/components/header/account-setting/ip-policies-page/index.tsx
index b558b92de75e7e..3f366464c42923 100644
--- a/web/app/components/header/account-setting/ip-policies-page/index.tsx
+++ b/web/app/components/header/account-setting/ip-policies-page/index.tsx
@@ -16,6 +16,7 @@ import {
   pricingQueryParamName,
   pricingQueryParser,
 } from '@/app/components/billing/pricing/query-params'
+import { currentWorkspaceAtom } from '@/context/workspace-state'
 import { getIpPolicyFailReason, trackNetworkAccessEvent } from '@/features/network-access/analytics'
 import {
   canManageNetworkAccessPoliciesAtom,
@@ -65,6 +66,7 @@ function IpPoliciesListSkeleton() {
 export default function IpPoliciesPage() {
   const { t } = useTranslation(['common', 'deployments'])
   const queryClient = useQueryClient()
+  const { plan } = useAtomValue(currentWorkspaceAtom)
   const canReadPolicies = useAtomValue(canReadNetworkAccessAtom)
   const canManagePolicies = useAtomValue(canManageNetworkAccessPoliciesAtom)
   const [_pricing, setPricing] = useQueryState(pricingQueryParamName, pricingQueryParser)
@@ -162,6 +164,11 @@ export default function IpPoliciesPage() {
           <p className="system-sm-regular text-text-tertiary">
             {t(($) => $['settings.ipPoliciesDescription'], { ns: 'common' })}
           </p>
+          {plan === 'sandbox' && (
+            <p className="system-xs-regular text-text-tertiary">
+              {t(($) => $['settings.ipPoliciesProPlanRequired'], { ns: 'common' })}
+            </p>
+          )}
         </div>
         {canManagePolicies && !isEmpty && (
           <Button
diff --git a/web/i18n/locales/ar-TN/common.json b/web/i18n/locales/ar-TN/common.json
index b8009f5c61326c..09898c6f28d2f5 100644
--- a/web/i18n/locales/ar-TN/common.json
+++ b/web/i18n/locales/ar-TN/common.json
@@ -258,6 +258,7 @@
   "resize.width": "العرض {{width}} بكسل",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "يتطلب تطبيق سياسة على تطبيق الاشتراك في خطة Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/az-AZ/common.json b/web/i18n/locales/az-AZ/common.json
index 763aef683f6687..3247a8b6e56781 100644
--- a/web/i18n/locales/az-AZ/common.json
+++ b/web/i18n/locales/az-AZ/common.json
@@ -256,6 +256,7 @@
   "resize.nodeHelp": "Ölçünü dəyişmək üçün ox düymələrindən istifadə edin. Daha böyük addımlar üçün Shift düyməsini basılı saxlayın. Home və ya Enter düyməsi ölçünü məzmuna uyğun kiçildir.",
   "resize.size": "{{width}} piksel enində, {{height}} piksel hündürlüyündə",
   "resize.width": "En: {{width}} piksel",
+  "settings.ipPoliciesProPlanRequired": "Tətbiqə siyasət tətbiq etmək üçün Pro planı tələb olunur",
   "settings.ipPolicyEmptyCreate": "IP siyasəti yarat",
   "settings.ipPolicyEmptyDescription": "Siyasət girişə icazə verilən IP ünvanlarının siyahısıdır.",
   "settings.ipPolicyEmptyTitle": "Bu iş məkanında hələ IP siyasəti yoxdur",
diff --git a/web/i18n/locales/de-DE/common.json b/web/i18n/locales/de-DE/common.json
index f1965c8a56fa88..7ef9de03cb0720 100644
--- a/web/i18n/locales/de-DE/common.json
+++ b/web/i18n/locales/de-DE/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Breite: {{width}} Pixel",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Das Anwenden einer Richtlinie auf eine App erfordert den Pro-Tarif",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/en-US/common.json b/web/i18n/locales/en-US/common.json
index a3f002a101558e..d0996d62e40e18 100644
--- a/web/i18n/locales/en-US/common.json
+++ b/web/i18n/locales/en-US/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Width: {{width}} pixels",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Applying a policy to an app requires the Pro plan",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/es-ES/common.json b/web/i18n/locales/es-ES/common.json
index 11807dcef24a9f..1c720f1f1fe453 100644
--- a/web/i18n/locales/es-ES/common.json
+++ b/web/i18n/locales/es-ES/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Ancho: {{width}} píxeles",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Aplicar una política a una aplicación requiere el plan Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/fa-IR/common.json b/web/i18n/locales/fa-IR/common.json
index 168b898d55a355..7a1b673c0a4d89 100644
--- a/web/i18n/locales/fa-IR/common.json
+++ b/web/i18n/locales/fa-IR/common.json
@@ -258,6 +258,7 @@
   "resize.width": "عرض: {{width}} پیکسل",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "اعمال سیاست روی یک برنامه به طرح Pro نیاز دارد",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/fr-FR/common.json b/web/i18n/locales/fr-FR/common.json
index ae095d403e3f43..044e712ae3c324 100644
--- a/web/i18n/locales/fr-FR/common.json
+++ b/web/i18n/locales/fr-FR/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Largeur : {{width}} pixels",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "L’application d’une politique à une application nécessite le forfait Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/hi-IN/common.json b/web/i18n/locales/hi-IN/common.json
index 40525a3958c30a..45e3cc93d57c86 100644
--- a/web/i18n/locales/hi-IN/common.json
+++ b/web/i18n/locales/hi-IN/common.json
@@ -258,6 +258,7 @@
   "resize.width": "चौड़ाई: {{width}} पिक्सेल",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "किसी ऐप पर नीति लागू करने के लिए Pro प्लान आवश्यक है",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/id-ID/common.json b/web/i18n/locales/id-ID/common.json
index c9e637f438ec92..b9f67526e2bb89 100644
--- a/web/i18n/locales/id-ID/common.json
+++ b/web/i18n/locales/id-ID/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Lebar: {{width}} piksel",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Menerapkan kebijakan ke aplikasi memerlukan paket Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/it-IT/common.json b/web/i18n/locales/it-IT/common.json
index 7f8ee75122589e..f64c9e0dc02a50 100644
--- a/web/i18n/locales/it-IT/common.json
+++ b/web/i18n/locales/it-IT/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Larghezza: {{width}} pixel",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Per applicare una policy a un’app è necessario il piano Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/ja-JP/common.json b/web/i18n/locales/ja-JP/common.json
index 457eaef23feee1..b9054c2cb86b94 100644
--- a/web/i18n/locales/ja-JP/common.json
+++ b/web/i18n/locales/ja-JP/common.json
@@ -258,6 +258,7 @@
   "resize.width": "幅：{{width}}ピクセル",
   "settings.ipPolicies": "IP ポリシー",
   "settings.ipPoliciesDescription": "アクセスを許可する IP アドレスまたは範囲を制御する、再利用可能なルール",
+  "settings.ipPoliciesProPlanRequired": "アプリへのポリシー適用には Pro プランが必要です",
   "settings.ipPolicyAddCurrentIp": "追加する",
   "settings.ipPolicyAddEntry": "追加",
   "settings.ipPolicyAllowlist": "許可リスト",
diff --git a/web/i18n/locales/ja-JP/deployments.json b/web/i18n/locales/ja-JP/deployments.json
index 9211c058000e75..a5616e94bf1610 100644
--- a/web/i18n/locales/ja-JP/deployments.json
+++ b/web/i18n/locales/ja-JP/deployments.json
@@ -43,8 +43,8 @@
   "studio.accessControl.chipPaused": "一時停止",
   "studio.accessControl.createIpPolicy": "IP ポリシーを作成",
   "studio.accessControl.description": "IP ポリシーを適用して、このアプリへのアクセスを制御します。",
-  "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランで利用できます。",
-  "studio.accessControl.downgradeTitle": "このアプリは保護されていません",
+  "studio.accessControl.downgradeDescription": "アクセス制御は Professional および Team プランでご利用いただけます。",
+  "studio.accessControl.downgradeTitle": "このアプリは保護されなくなりました",
   "studio.accessControl.emptyPoliciesReadOnly": "ワークスペースの Owner または Admin に作成を依頼してください。",
   "studio.accessControl.emptyPoliciesTitle": "このワークスペースにはまだ IP ポリシーがありません",
   "studio.accessControl.entryLabel": "アクセス制御",
@@ -66,8 +66,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "{{count}} 個のアクセスポイントすべてを保護中",
   "studio.accessControl.protectingPartial": "アクセスポイント {{m}} 個中 {{n}} 個を保護中",
-  "studio.accessControl.protectsCoverage": "{{n}} / {{m}} 個のアクセスポイントを保護",
-  "studio.accessControl.readyToResume": "再開できます",
+  "studio.accessControl.protectsCoverage": "アクセスポイント {{m}} 個中 {{n}} 個を保護",
+  "studio.accessControl.readyToResume": "再開の準備ができています",
   "studio.accessControl.restrictByIp": "IP アドレスで制限",
   "studio.accessControl.restrictedTo": "{{name}} に制限中",
   "studio.accessControl.saveAnyway": "保存する",
@@ -76,7 +76,7 @@
   "studio.accessControl.selectPolicy": "IP ポリシーを選択",
   "studio.accessControl.selectPolicyRequired": "IP ポリシーを選択してください。",
   "studio.accessControl.tooltipAllProtected": "{{total}} 個のアクセスポイントすべてが保護されています",
-  "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます",
+  "studio.accessControl.tooltipDowngraded": "保護されていません。Professional および Team プランでご利用いただけます。",
   "studio.accessControl.tooltipOff": "未設定",
   "studio.accessControl.tooltipPaused": "設定済み、一時停止中",
   "studio.accessControl.tooltipPro": "Professional および Team プランでご利用いただけます",
diff --git a/web/i18n/locales/ko-KR/common.json b/web/i18n/locales/ko-KR/common.json
index b7992d2d6b1fce..449fb624797a1e 100644
--- a/web/i18n/locales/ko-KR/common.json
+++ b/web/i18n/locales/ko-KR/common.json
@@ -258,6 +258,7 @@
   "resize.width": "너비: {{width}}픽셀",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "앱에 정책을 적용하려면 Pro 요금제가 필요합니다",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/lo-LA/common.json b/web/i18n/locales/lo-LA/common.json
index 0671eb3d8d1c3c..51dfdce723c669 100644
--- a/web/i18n/locales/lo-LA/common.json
+++ b/web/i18n/locales/lo-LA/common.json
@@ -258,6 +258,7 @@
   "resize.width": "ຄວາມກວ້າງ: {{width}} ພິກເຊລ",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "ການນຳໃຊ້ນະໂຍບາຍກັບແອັບຕ້ອງໃຊ້ແຜນ Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/nl-NL/common.json b/web/i18n/locales/nl-NL/common.json
index ba3b00ba4bf8d9..a7c20445e924f2 100644
--- a/web/i18n/locales/nl-NL/common.json
+++ b/web/i18n/locales/nl-NL/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Breedte: {{width}} pixels",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Voor het toepassen van een beleid op een app is het Pro-abonnement vereist",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/pl-PL/common.json b/web/i18n/locales/pl-PL/common.json
index 8085b16851a573..15c45951dde76e 100644
--- a/web/i18n/locales/pl-PL/common.json
+++ b/web/i18n/locales/pl-PL/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Szerokość: {{width}} pikseli",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Zastosowanie polityki do aplikacji wymaga planu Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/pt-BR/common.json b/web/i18n/locales/pt-BR/common.json
index f19a1fe937006d..ab715d11f419d4 100644
--- a/web/i18n/locales/pt-BR/common.json
+++ b/web/i18n/locales/pt-BR/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Largura: {{width}} pixels",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Aplicar uma política a um aplicativo requer o plano Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/ro-RO/common.json b/web/i18n/locales/ro-RO/common.json
index a5eaac72ec5d07..6054f6dbed6b66 100644
--- a/web/i18n/locales/ro-RO/common.json
+++ b/web/i18n/locales/ro-RO/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Lățime: {{width}} pixeli",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Aplicarea unei politici unei aplicații necesită planul Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/ru-RU/common.json b/web/i18n/locales/ru-RU/common.json
index 53c29a323be77d..412ceb77ce3e5b 100644
--- a/web/i18n/locales/ru-RU/common.json
+++ b/web/i18n/locales/ru-RU/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Ширина: {{width}} пикселей",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Для применения политики к приложению требуется тариф Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/sl-SI/common.json b/web/i18n/locales/sl-SI/common.json
index 4454a46ef540d9..9676edd5318ac4 100644
--- a/web/i18n/locales/sl-SI/common.json
+++ b/web/i18n/locales/sl-SI/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Širina: {{width}} slikovnih pik",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Za uporabo pravilnika v aplikaciji je potreben paket Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/th-TH/common.json b/web/i18n/locales/th-TH/common.json
index 7ca416df43f335..f7f83d2b618947 100644
--- a/web/i18n/locales/th-TH/common.json
+++ b/web/i18n/locales/th-TH/common.json
@@ -258,6 +258,7 @@
   "resize.width": "ความกว้าง: {{width}} พิกเซล",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "การใช้นโยบายกับแอปต้องใช้แพ็กเกจ Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/tr-TR/common.json b/web/i18n/locales/tr-TR/common.json
index be6b1e269ac173..cf907faf7da1db 100644
--- a/web/i18n/locales/tr-TR/common.json
+++ b/web/i18n/locales/tr-TR/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Genişlik: {{width}} piksel",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Bir uygulamaya politika uygulamak için Pro planı gereklidir",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/uk-UA/common.json b/web/i18n/locales/uk-UA/common.json
index 184efa630f3968..aebb88f98d054a 100644
--- a/web/i18n/locales/uk-UA/common.json
+++ b/web/i18n/locales/uk-UA/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Ширина: {{width}} пікселів",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Для застосування політики до застосунку потрібен тариф Pro",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/vi-VN/common.json b/web/i18n/locales/vi-VN/common.json
index 4db0806b55a8e3..b6c41fb78e7ea6 100644
--- a/web/i18n/locales/vi-VN/common.json
+++ b/web/i18n/locales/vi-VN/common.json
@@ -258,6 +258,7 @@
   "resize.width": "Chiều rộng: {{width}} pixel",
   "settings.ipPolicies": "IP Policies",
   "settings.ipPoliciesDescription": "Reusable rules that control which IP addresses or ranges can access your apps",
+  "settings.ipPoliciesProPlanRequired": "Cần có gói Pro để áp dụng chính sách cho ứng dụng",
   "settings.ipPolicyAddCurrentIp": "Add it",
   "settings.ipPolicyAddEntry": "Add",
   "settings.ipPolicyAllowlist": "Allowlist",
diff --git a/web/i18n/locales/zh-Hans/common.json b/web/i18n/locales/zh-Hans/common.json
index 6f61bfa8ad56e8..e0601054d266ca 100644
--- a/web/i18n/locales/zh-Hans/common.json
+++ b/web/i18n/locales/zh-Hans/common.json
@@ -258,6 +258,7 @@
   "resize.width": "宽度：{{width}} 像素",
   "settings.ipPolicies": "IP 策略",
   "settings.ipPoliciesDescription": "可复用的规则，用于控制允许访问的 IP 地址或网段",
+  "settings.ipPoliciesProPlanRequired": "将策略应用到应用需要 Pro 套餐",
   "settings.ipPolicyAddCurrentIp": "添加",
   "settings.ipPolicyAddEntry": "添加",
   "settings.ipPolicyAllowlist": "允许列表",
diff --git a/web/i18n/locales/zh-Hans/deployments.json b/web/i18n/locales/zh-Hans/deployments.json
index f95940ce4db1ee..8b05b45b571544 100644
--- a/web/i18n/locales/zh-Hans/deployments.json
+++ b/web/i18n/locales/zh-Hans/deployments.json
@@ -43,7 +43,7 @@
   "studio.accessControl.chipPaused": "暂停",
   "studio.accessControl.createIpPolicy": "创建 IP 策略",
   "studio.accessControl.description": "通过应用 IP 策略来控制对当前应用的访问。",
-  "studio.accessControl.downgradeDescription": "访问控制功能适用于 Professional 和 Team 套餐。",
+  "studio.accessControl.downgradeDescription": "访问控制适用于 Professional 和 Team 套餐。",
   "studio.accessControl.downgradeTitle": "此应用已不再受保护",
   "studio.accessControl.emptyPoliciesReadOnly": "请联系工作空间的 Owner 或 Admin 创建。",
   "studio.accessControl.emptyPoliciesTitle": "当前工作空间还没有 IP 策略",
@@ -66,8 +66,8 @@
   "studio.accessControl.proBadge": "PRO",
   "studio.accessControl.protectingAll": "正在保护全部 {{count}} 个访问入口",
   "studio.accessControl.protectingPartial": "正在保护 {{m}} 个访问入口中的 {{n}} 个",
-  "studio.accessControl.protectsCoverage": "保护 {{n}} / {{m}} 个访问入口",
-  "studio.accessControl.readyToResume": "可恢复",
+  "studio.accessControl.protectsCoverage": "保护 {{m}} 个访问入口中的 {{n}} 个",
+  "studio.accessControl.readyToResume": "待恢复",
   "studio.accessControl.restrictByIp": "按 IP 地址限制访问",
   "studio.accessControl.restrictedTo": "已限制为 {{name}}",
   "studio.accessControl.saveAnyway": "仍要保存",
diff --git a/web/i18n/locales/zh-Hant/common.json b/web/i18n/locales/zh-Hant/common.json
index 626caa24400fb0..2cc99aee5f8da4 100644
--- a/web/i18n/locales/zh-Hant/common.json
+++ b/web/i18n/locales/zh-Hant/common.json
@@ -258,6 +258,7 @@
   "resize.width": "寬度：{{width}} 像素",
   "settings.ipPolicies": "IP 策略",
   "settings.ipPoliciesDescription": "可重用的規則，用來控制允許存取的 IP 位址或網段",
+  "settings.ipPoliciesProPlanRequired": "將策略套用至應用程式需要 Pro 方案",
   "settings.ipPolicyAddCurrentIp": "加入",
   "settings.ipPolicyAddEntry": "新增",
   "settings.ipPolicyAllowlist": "允許清單",
diff --git a/web/i18n/resources.generated.d.ts b/web/i18n/resources.generated.d.ts
index 838076ad6f88bb..d3d6135933af40 100644
--- a/web/i18n/resources.generated.d.ts
+++ b/web/i18n/resources.generated.d.ts
@@ -1809,6 +1809,7 @@ export default interface Resources {
     'resize.width': 'Width: {{width}} pixels'
     'settings.ipPolicies': 'IP Policies'
     'settings.ipPoliciesDescription': 'Reusable rules that control which IP addresses or ranges can access your apps'
+    'settings.ipPoliciesProPlanRequired': 'Applying a policy to an app requires the Pro plan'
     'settings.ipPolicyAddCurrentIp': 'Add it'
     'settings.ipPolicyAddEntry': 'Add'
     'settings.ipPolicyAllowlist': 'Allowlist'

From a3c958a90709df0d7a505225ea4779230a419afb Mon Sep 17 00:00:00 2001
From: CodingOnStar <hanxujiang@dify.com>
Date: Tue, 20 Oct 2026 11:25:46 +0800
Subject: [PATCH 106/108] fix: restore network access CI and management policy
 reads

---
 api/controllers/openapi/_app_settings.py      |   2 +-
 api/services/webapp_access_query_service.py   |   8 +
 .../common/test_access_response.py            | 170 +++++---
 .../common/test_app_access_error.py           |  19 +-
 .../workspace/test_network_access_group.py    | 393 ++++++++++++------
 .../unit_tests/controllers/mcp/test_mcp.py    |  16 +-
 .../mcp/test_mcp_request_errors.py            |   2 +-
 .../web/test_human_input_file_upload.py       |  12 +-
 .../web/test_public_app_admission.py          | 216 ++++++----
 .../unit_tests/controllers/web/test_site.py   |  18 +-
 .../controllers/web/test_web_login.py         |  39 +-
 .../test_network_access_group_repository.py   |  15 +-
 .../test_webapp_access_query_repository.py    |  23 +-
 .../test_network_access_group_gateway.py      | 146 +++----
 .../test_network_access_group_service.py      |  17 +-
 .../test_webapp_access_query_service.py       |  12 +
 .../test_remove_app_and_related_data_task.py  |  74 ++--
 .../environment-tabs.browser.spec.tsx         |   4 +
 .../access/__tests__/page.spec.tsx            |   6 +-
 web/features/app-access-error/state.ts        |   4 +-
 web/features/network-access/analytics.ts      |   2 +-
 web/test/console/network-access.ts            |  27 +-
 22 files changed, 719 insertions(+), 506 deletions(-)

diff --git a/api/controllers/openapi/_app_settings.py b/api/controllers/openapi/_app_settings.py
index 1278b0d6a64bb2..9228d7b32dfcd7 100644
--- a/api/controllers/openapi/_app_settings.py
+++ b/api/controllers/openapi/_app_settings.py
@@ -207,7 +207,7 @@ def reset_webapp(ctx: Context) -> WebAppToken:
 
 def webapp_access(ctx: Context) -> WebAppAccess:
     try:
-        access_mode = application_services().webapp_access.get_access_mode(app_id=ctx.app.id, app_code=None)
+        access_mode = application_services().webapp_access.get_configured_access_mode(app_id=ctx.app.id)
     except WebAppAccessUnavailableError as error:
         raise WebAppAccessUnavailable() from error
     return WebAppAccess(access_mode=access_mode)
diff --git a/api/services/webapp_access_query_service.py b/api/services/webapp_access_query_service.py
index 37fe08bb6bc11a..19ea1656581dcf 100644
--- a/api/services/webapp_access_query_service.py
+++ b/api/services/webapp_access_query_service.py
@@ -80,6 +80,14 @@ def get_access_mode(self, *, app_id: str | None, app_code: str | None) -> WebApp
         if not self._webapp_auth_enabled and not app_id and not app_code:
             return WebAppAccessMode.PUBLIC
         app_id = self.resolve_app_id(app_id=app_id, app_code=app_code)
+        return self.get_configured_access_mode(app_id=app_id)
+
+    def get_configured_access_mode(self, *, app_id: str) -> WebAppAccessMode:
+        """Read policy for an App already authorized by a management context.
+
+        Management must be able to configure unpublished or disabled sites.
+        Public callers must use get_access_mode to retain publication admission.
+        """
         if not self._webapp_auth_enabled:
             return WebAppAccessMode.PUBLIC
         return self._policy.get_access_mode(app_id)
diff --git a/api/tests/unit_tests/controllers/common/test_access_response.py b/api/tests/unit_tests/controllers/common/test_access_response.py
index 06c77fb2e8edf0..0081f5f5c001f8 100644
--- a/api/tests/unit_tests/controllers/common/test_access_response.py
+++ b/api/tests/unit_tests/controllers/common/test_access_response.py
@@ -5,7 +5,7 @@
 import logging
 from collections.abc import Buffer, Generator
 from contextlib import contextmanager
-from types import SimpleNamespace
+from dataclasses import dataclass
 from typing import Literal, Never, cast, override
 from unittest.mock import MagicMock
 
@@ -13,7 +13,9 @@
 from flask import Blueprint, Flask, Response, jsonify, request
 from flask.testing import FlaskClient
 from flask_restx import Namespace, Resource
+from pytest_mock import MockerFixture
 from sqlalchemy import Table
+from sqlalchemy.orm import Session, sessionmaker
 from werkzeug.exceptions import NotFound, Unauthorized
 
 import controllers.service_api.wraps as token_wraps
@@ -30,12 +32,46 @@
 from extensions import ext_request_logging
 from libs.external_api import ExternalApi
 from models.engine import db
-from models.model import ApiToken
+from models.model import ApiToken, App, AppMCPServer
 from services.app.mcp_server_service import AppMCPServerStatus
 from tests.unit_tests.config_override import apply_config_overrides
 
 type TokenClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
-type MCPClient = tuple[FlaskClient, MagicMock, MagicMock, MagicMock]
+
+
+@dataclass
+class SessionCalls:
+    session: Session
+    scalar: MagicMock
+    add: MagicMock
+    execute: MagicMock
+
+
+def _session_calls(mocker: MockerFixture) -> SessionCalls:
+    session = Session()
+    return SessionCalls(
+        session=session,
+        scalar=mocker.patch.object(session, "scalar"),
+        add=mocker.patch.object(session, "add"),
+        execute=mocker.patch.object(session, "execute"),
+    )
+
+
+def _mcp_server(app_id: str) -> AppMCPServer:
+    server = AppMCPServer(
+        app_id=app_id,
+        tenant_id="tenant",
+        status=AppMCPServerStatus.ACTIVE,
+        name="Fixture",
+        description="",
+        server_code="fixture",
+        parameters="{}",
+    )
+    server.id = "server"
+    return server
+
+
+type MCPClient = tuple[FlaskClient, SessionCalls, MagicMock, MagicMock]
 
 
 @pytest.fixture
@@ -47,7 +83,7 @@ def http_app() -> Flask:
 
 
 @pytest.fixture
-def token_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> TokenClient:
+def token_client(http_app: Flask, mocker: MockerFixture) -> TokenClient:
     bp = Blueprint("service_test", __name__, url_prefix="/v1")
     register_auth_error_response(bp, www_authenticate='Bearer realm="api"')
     api = ExternalApi(bp)
@@ -68,12 +104,11 @@ def get(self) -> Never:
 
     other_api.add_resource(OtherResource, "/info")
     http_app.register_blueprint(other)
-    cache_get = MagicMock(return_value=None)
-    fetch = MagicMock(side_effect=Unauthorized("Access token is invalid"))
-    usage = MagicMock()
-    monkeypatch.setattr(token_wraps.ApiTokenCache, "get", cache_get)
-    monkeypatch.setattr(token_wraps, "fetch_token_with_single_flight", fetch)
-    monkeypatch.setattr(token_wraps, "record_token_usage", usage)
+    cache_get = mocker.patch.object(token_wraps.ApiTokenCache, "get", return_value=None)
+    fetch = mocker.patch.object(
+        token_wraps, "fetch_token_with_single_flight", side_effect=Unauthorized("Access token is invalid")
+    )
+    usage = mocker.patch.object(token_wraps, "record_token_usage")
     return http_app.test_client(), cache_get, fetch, usage
 
 
@@ -122,10 +157,9 @@ def test_invalid_token_final_response_and_no_usage(token_client: TokenClient) ->
     usage.assert_not_called()
 
 
-def test_invalid_token_database_path_does_not_record_usage(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> None:
-    usage = MagicMock()
-    monkeypatch.setattr(token_service.ApiTokenCache, "set", MagicMock())
-    monkeypatch.setattr(token_service, "record_token_usage", usage)
+def test_invalid_token_database_path_does_not_record_usage(http_app: Flask, mocker: MockerFixture) -> None:
+    usage = mocker.patch.object(token_service, "record_token_usage")
+    mocker.patch.object(token_service.ApiTokenCache, "set")
     with http_app.app_context():
         cast(Table, ApiToken.__table__).create(db.engine)
         with pytest.raises(Unauthorized, match="Access token is invalid"):
@@ -135,7 +169,7 @@ def test_invalid_token_database_path_does_not_record_usage(http_app: Flask, monk
 
 def test_success_token_and_other_surface_are_not_rewritten(token_client: TokenClient) -> None:
     client, cache_get, _fetch, usage = token_client
-    cache_get.return_value = SimpleNamespace(id="existing")
+    cache_get.return_value = ApiToken(id="existing")
     response = client.get("/v1/info", headers={"Authorization": "bEaReR\tvalid-token"})
     assert response.status_code == 200
     assert response.get_json() == {"ok": True}
@@ -148,7 +182,7 @@ def test_success_token_and_other_surface_are_not_rewritten(token_client: TokenCl
 
 
 @pytest.fixture
-def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
+def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture) -> MCPClient:
     bp = Blueprint("mcp_test", __name__, url_prefix="/mcp")
     api = ExternalApi(bp)
     namespace = Namespace("mcp_test", path="/")
@@ -157,15 +191,18 @@ def mcp_client(http_app: Flask, monkeypatch: pytest.MonkeyPatch) -> MCPClient:
     api.add_namespace(namespace)
     http_app.register_blueprint(bp)
     monkeypatch.setattr(mcp, "mcp_ns", namespace)
-    session = MagicMock()  # guard-ignore: no-new-session-mock -- controls HTTP query results
-    maker = MagicMock()
-    maker.begin.return_value.__enter__.return_value = session
+    calls = _session_calls(mocker)
+    maker = sessionmaker()
+
+    @contextmanager
+    def begin() -> Generator[Session]:
+        yield calls.session
+
+    mocker.patch.object(maker, "begin", side_effect=begin)
     monkeypatch.setattr(mcp.session_factory, "get_session_maker", lambda: maker)
-    execute = MagicMock()
-    end_user = MagicMock()
-    monkeypatch.setattr(mcp, "handle_mcp_request", execute)
-    monkeypatch.setattr(mcp.MCPAppApi, "_retrieve_end_user", end_user)
-    return http_app.test_client(), session, execute, end_user
+    execute = mocker.patch.object(mcp, "handle_mcp_request")
+    end_user = mocker.patch.object(mcp.MCPAppApi, "_retrieve_end_user")
+    return http_app.test_client(), calls, execute, end_user
 
 
 @pytest.mark.parametrize("cached", [False, True])
@@ -212,7 +249,7 @@ def test_mcp_missing_identity_final_response_is_bounded_and_opaque(
     expected_id: bytes,
 ) -> None:
     client, session, execute, end_user = mcp_client
-    server = SimpleNamespace(app_id="private-app", tenant_id="tenant", status=AppMCPServerStatus.ACTIVE)
+    server = _mcp_server("private-app")
     if cached:
 
         @client.application.before_request
@@ -225,7 +262,7 @@ def cache_body() -> None:
         session.scalar.side_effect = [server, None]
     else:
         server.status = "inactive"
-        session.scalar.side_effect = [server, SimpleNamespace(id="private-app")]
+        session.scalar.side_effect = [server, App(id="private-app")]
     response = client.post("/mcp/server/missing-fixture/mcp", data=body, content_type="application/json")
     assert response.status_code == 404
     assert (
@@ -280,17 +317,18 @@ def test_mcp_debug_request_logging_preserves_raw_error_id(
     end_user.assert_not_called()
 
 
-def test_existing_mcp_keeps_normal_large_payload_and_response(
-    mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch
-) -> None:
+def test_existing_mcp_keeps_normal_large_payload_and_response(mcp_client: MCPClient, mocker: MockerFixture) -> None:
     client, session, _execute, _end_user = mcp_client
-    server = SimpleNamespace(id="server", tenant_id="tenant", app_id="existing-app", status=AppMCPServerStatus.ACTIVE)
-    app = SimpleNamespace(id="existing-app", tenant_id="tenant")
+    server = _mcp_server("existing-app")
+    app = App(id="existing-app", tenant_id="tenant")
     session.scalar.side_effect = [server, app, server, app]
-    monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", MagicMock(return_value=[]))
+    mocker.patch.object(mcp.MCPAppApi, "_get_user_input_form", return_value=[])
     expected_body = b'{"id":2,"jsonrpc":"2.0","result":{}}'
-    process = MagicMock(return_value=Response(expected_body, status=200, content_type="application/json"))
-    monkeypatch.setattr(mcp.MCPAppApi, "_process_mcp_message", process)
+    process = mocker.patch.object(
+        mcp.MCPAppApi,
+        "_process_mcp_message",
+        return_value=Response(expected_body, status=200, content_type="application/json"),
+    )
     payload = {
         "jsonrpc": "2.0",
         "method": "initialize",
@@ -311,8 +349,8 @@ def test_existing_mcp_keeps_normal_large_payload_and_response(
 def test_existing_mcp_still_validates_malformed_payload(mcp_client: MCPClient) -> None:
     client, session, execute, end_user = mcp_client
     session.scalar.side_effect = [
-        SimpleNamespace(id="server", tenant_id="tenant", app_id="existing-app", status=AppMCPServerStatus.ACTIVE),
-        SimpleNamespace(id="existing-app", tenant_id="tenant"),
+        _mcp_server("existing-app"),
+        App(id="existing-app", tenant_id="tenant"),
     ]
     response = client.post("/mcp/server/existing-fixture/mcp", data=b"{", content_type="application/json")
     assert response.status_code == 400
@@ -334,16 +372,16 @@ def test_existing_mcp_still_validates_malformed_payload(mcp_client: MCPClient) -
     ],
 )
 def test_mcp_reads_body_outside_sessions_and_rechecks_identity_before_execution(
-    mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch, change: str
+    mcp_client: MCPClient, monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture, change: str
 ) -> None:
     client, _session, execute, end_user = mcp_client
-    active_sessions: list[MagicMock] = []
-    opened: list[MagicMock] = []
+    active_sessions: list[Session] = []
+    opened: list[Session] = []
     read_sessions: list[bool] = []
-    initial_server = SimpleNamespace(id="server", tenant_id="tenant", app_id="app", status=AppMCPServerStatus.ACTIVE)
-    initial_app = SimpleNamespace(id="app", tenant_id="tenant")
-    fresh_server = SimpleNamespace(**vars(initial_server))
-    fresh_app = SimpleNamespace(**vars(initial_app))
+    initial_server = _mcp_server("app")
+    initial_app = App(id="app", tenant_id="tenant")
+    fresh_server = _mcp_server("app")
+    fresh_app = App(id="app", tenant_id="tenant")
     if change == "inactive":
         fresh_server.status = "inactive"
     elif change == "server-replaced":
@@ -352,16 +390,18 @@ def test_mcp_reads_body_outside_sessions_and_rechecks_identity_before_execution(
         fresh_server.app_id = fresh_app.id = "other-app"
     elif change == "tenant-changed":
         fresh_server.tenant_id = fresh_app.tenant_id = "other-tenant"
-    initial = MagicMock()
-    initial.scalar.side_effect = [None] if change == "initial-missing" else [initial_server, initial_app]
-    execution = MagicMock()
-    execution.scalar.side_effect = (
+    initial_calls = _session_calls(mocker)
+    initial = initial_calls.session
+    initial_calls.scalar.side_effect = [None] if change == "initial-missing" else [initial_server, initial_app]
+    execution_calls = _session_calls(mocker)
+    execution = execution_calls.session
+    execution_calls.scalar.side_effect = (
         [None] if change == "missing-server" else [fresh_server, None if change == "missing-app" else fresh_app]
     )
     remaining = iter((initial, execution))
 
     @contextmanager
-    def begin() -> Generator[MagicMock]:
+    def begin() -> Generator[Session]:
         session = next(remaining)
         opened.append(session)
         active_sessions.append(session)
@@ -370,11 +410,11 @@ def begin() -> Generator[MagicMock]:
         finally:
             active_sessions.pop()
 
-    monkeypatch.setattr(mcp.session_factory, "get_session_maker", lambda: SimpleNamespace(begin=begin))
-    form = MagicMock(return_value=[])
-    process = MagicMock(return_value=Response("ok", status=200))
-    monkeypatch.setattr(mcp.MCPAppApi, "_get_user_input_form", form)
-    monkeypatch.setattr(mcp.MCPAppApi, "_process_mcp_message", process)
+    maker = sessionmaker()
+    mocker.patch.object(maker, "begin", side_effect=begin)
+    monkeypatch.setattr(mcp.session_factory, "get_session_maker", lambda: maker)
+    form = mocker.patch.object(mcp.MCPAppApi, "_get_user_input_form", return_value=[])
+    process = mocker.patch.object(mcp.MCPAppApi, "_process_mcp_message", return_value=Response("ok", status=200))
     original_error = mcp.mcp_server_not_found_response
 
     def error_response() -> Response:
@@ -414,20 +454,22 @@ def readinto(self, buffer: Buffer) -> int:
         process.assert_not_called()
     execute.assert_not_called()
     end_user.assert_not_called()
-    initial.add.assert_not_called()
-    execution.add.assert_not_called()
+    initial_calls.add.assert_not_called()
+    execution_calls.add.assert_not_called()
 
 
 @pytest.mark.parametrize("route", ["webhook", "webhook-debug"])
 def test_webhook_missing_identity_uses_native_html_without_disclosing_id(
-    http_app: Flask, monkeypatch: pytest.MonkeyPatch, route: Literal["webhook", "webhook-debug"]
+    http_app: Flask, monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture, route: Literal["webhook", "webhook-debug"]
 ) -> None:
     monkeypatch.setattr(webhook, "request", request)
     monkeypatch.setattr(webhook, "jsonify", jsonify)
-    lookup = MagicMock(side_effect=ValueError("Webhook not found: private-fixture"))
-    execute = MagicMock()
-    monkeypatch.setattr(webhook.WebhookService, "get_webhook_trigger_and_workflow", lookup)
-    monkeypatch.setattr(webhook.WebhookService, "trigger_workflow_execution", execute)
+    mocker.patch.object(
+        webhook.WebhookService,
+        "get_webhook_trigger_and_workflow",
+        side_effect=ValueError("Webhook not found: private-fixture"),
+    )
+    execute = mocker.patch.object(webhook.WebhookService, "trigger_workflow_execution")
     handler = webhook.handle_webhook if route == "webhook" else webhook.handle_webhook_debug
     http_app.add_url_rule(f"/triggers/{route}/<string:webhook_id>", view_func=handler, methods=["POST"])
     response = http_app.test_client().post(f"/triggers/{route}/private-fixture", json={})
@@ -441,15 +483,15 @@ def test_webhook_missing_identity_uses_native_html_without_disclosing_id(
 
 @pytest.mark.parametrize("endpoint", ["123e4567-e89b-42d3-a456-426614174000", "invalid-id"])
 def test_plugin_callback_retains_its_json_error_contract(
-    http_app: Flask, monkeypatch: pytest.MonkeyPatch, endpoint: str
+    http_app: Flask, monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture, endpoint: str
 ) -> None:
     monkeypatch.setattr(plugin_trigger, "request", request)
     monkeypatch.setattr(plugin_trigger, "jsonify", jsonify)
-    monkeypatch.setattr(plugin_trigger.TriggerService, "process_endpoint", MagicMock(return_value=None))
-    monkeypatch.setattr(
+    mocker.patch.object(plugin_trigger.TriggerService, "process_endpoint", return_value=None)
+    mocker.patch.object(
         plugin_trigger.TriggerSubscriptionBuilderService,
         "process_builder_validation_endpoint",
-        MagicMock(return_value=None),
+        return_value=None,
     )
     http_app.add_url_rule(
         "/triggers/plugin/<string:endpoint_id>", view_func=plugin_trigger.trigger_endpoint, methods=["POST"]
diff --git a/api/tests/unit_tests/controllers/common/test_app_access_error.py b/api/tests/unit_tests/controllers/common/test_app_access_error.py
index ad51b38668e01c..f0eb6666b72c6d 100644
--- a/api/tests/unit_tests/controllers/common/test_app_access_error.py
+++ b/api/tests/unit_tests/controllers/common/test_app_access_error.py
@@ -1,13 +1,13 @@
 import json
 from collections.abc import Callable, Iterator
 from typing import Literal
-from unittest.mock import MagicMock
 from uuid import UUID
 
 import pytest
 from flask import Blueprint, Flask, Response
 from flask.typing import ResponseReturnValue
 from flask_restx import Resource
+from pytest_mock import MockerFixture
 from werkzeug.exceptions import NotFound
 from werkzeug.middleware.proxy_fix import ProxyFix
 
@@ -331,11 +331,12 @@ def test_success_and_non_404_errors_are_unchanged(prefix: str, status: int) -> N
 @pytest.mark.allow_error_contract_violations
 @pytest.mark.parametrize("path", ["/api/site", f"/console/api/apps/{APP_ID}"])
 @pytest.mark.parametrize("status", [200, 201, 204, 301, 302, 303, 304, 307, 308, 401, 500, 503])
-def test_non_candidate_statuses_do_not_parse_json(monkeypatch: pytest.MonkeyPatch, path: str, status: int) -> None:
+def test_non_candidate_statuses_do_not_parse_json(mocker: MockerFixture, path: str, status: int) -> None:
     body = b'{"code":"app_not_found","message":"unchanged","data":[1,2,3]}'
     original = Response(body, status=status, mimetype="application/json")
-    parse = MagicMock(side_effect=AssertionError("Non-candidate response must not be parsed"))
-    monkeypatch.setattr(original, "get_json", parse)
+    parse = mocker.patch.object(
+        original, "get_json", side_effect=AssertionError("Non-candidate response must not be parsed")
+    )
     app = _create_app(lambda: original)
 
     with app.test_request_context(path):
@@ -366,12 +367,11 @@ def test_non_candidate_statuses_do_not_parse_json(monkeypatch: pytest.MonkeyPatc
 )
 @pytest.mark.allow_error_contract_violations
 def test_route_and_surface_ineligible_errors_do_not_parse_json(
-    monkeypatch: pytest.MonkeyPatch, path: str, method: str, status: int
+    mocker: MockerFixture, path: str, method: str, status: int
 ) -> None:
     body = b'{"code":"app_not_found","message":"unchanged"}'
     original = Response(body, status=status, mimetype="application/json")
-    parse = MagicMock(side_effect=AssertionError("Ineligible error must not be parsed"))
-    monkeypatch.setattr(original, "get_json", parse)
+    parse = mocker.patch.object(original, "get_json", side_effect=AssertionError("Ineligible error must not be parsed"))
     app = _create_app(lambda: original)
 
     with app.test_request_context(path, method=method):
@@ -388,7 +388,7 @@ def test_route_and_surface_ineligible_errors_do_not_parse_json(
 @pytest.mark.parametrize("direct_passthrough", [False, True])
 @pytest.mark.allow_error_contract_violations
 def test_candidate_and_success_streams_never_parse_or_consume_response(
-    monkeypatch: pytest.MonkeyPatch, status: int, direct_passthrough: bool
+    mocker: MockerFixture, status: int, direct_passthrough: bool
 ) -> None:
     consumed: list[bool] = []
 
@@ -397,8 +397,7 @@ def stream() -> Iterator[str]:
         yield '{"code":"app_not_found"}'
 
     original = Response(stream(), status, mimetype="application/json", direct_passthrough=direct_passthrough)
-    parse = MagicMock(side_effect=AssertionError("Stream must not be parsed"))
-    monkeypatch.setattr(original, "get_json", parse)
+    parse = mocker.patch.object(original, "get_json", side_effect=AssertionError("Stream must not be parsed"))
     app = _create_app(lambda: original)
     with app.test_request_context("/api/site"):
         response = app.full_dispatch_request()
diff --git a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
index 3a73dc30fdec1f..c410d3942a93dc 100644
--- a/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
+++ b/api/tests/unit_tests/controllers/console/workspace/test_network_access_group.py
@@ -3,14 +3,15 @@
 from dataclasses import replace
 from datetime import UTC, datetime
 from inspect import unwrap
-from types import SimpleNamespace
-from unittest.mock import MagicMock, patch
+from unittest.mock import patch
 from uuid import UUID
 
 import httpx
 import pytest
 from flask import Flask, Response
 from pydantic import ValidationError
+from pytest_mock import MockerFixture
+from sqlalchemy.orm import sessionmaker
 from werkzeug.exceptions import BadGateway, BadRequest, Conflict, Forbidden, HTTPException, NotFound, ServiceUnavailable
 from werkzeug.test import TestResponse
 
@@ -33,9 +34,13 @@
 from controllers.console.wraps import validate_request
 from core.network_access.client_ip import NetworkAccessClientIPUnavailableError
 from enums import DeploymentEdition
+from extensions.ext_application_services import ApplicationServices
+from extensions.ext_login import DifyLoginManager
 from libs.login import AccountWithTenant
 from machinery.context import RequestContext
 from models.account import Account, AccountStatus
+from repositories.network_access_group_repository import SQLAlchemyNetworkAccessGroupAppRepository
+from repositories.workspace.workspace_repository import WorkspaceRepository
 from services.entities.network_access_group_entities import (
     NetworkAccessAppConfig,
     NetworkAccessAppStatus,
@@ -45,7 +50,7 @@
     NetworkAccessGroup,
     NetworkAccessGroupList,
 )
-from services.network_access_group_gateway import NetworkAccessGroupGateway
+from services.network_access_group_gateway import BillingNetworkAccessGroupEntitlementGateway, NetworkAccessGroupGateway
 from services.network_access_group_service import (
     NetworkAccessGroupAccessDeniedError,
     NetworkAccessGroupAppNotFoundError,
@@ -77,10 +82,10 @@ def _request_context() -> RequestContext:
 
 
 @contextmanager
-def _application_services(service: MagicMock | NetworkAccessGroupService) -> Generator[None]:
+def _application_services(services: ApplicationServices) -> Generator[None]:
     with patch(
         "controllers.console.workspace.network_access_group.application_services",
-        return_value=SimpleNamespace(network_access_groups=service),
+        return_value=services,
     ):
         yield
 
@@ -123,23 +128,31 @@ def _binding_payload(
     )
 
 
-def test_list_forwards_request_context_and_serializes_response() -> None:
-    service = MagicMock()
-    service.list_groups.return_value = NetworkAccessGroupList(TENANT_ID, True, (_group_payload(),))
+def test_list_forwards_request_context_and_serializes_response(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mock_list_groups = mocker.patch.object(
+        service, "list_groups", return_value=NetworkAccessGroupList(TENANT_ID, True, (_group_payload(),))
+    )
     api = CurrentWorkspaceNetworkAccessGroupsApi()
 
-    with _application_services(service):
+    with _application_services(account_application_services):
         result = unwrap(api.get)(api, request_context=_request_context())
 
-    service.list_groups.assert_called_once_with(_request_context())
+    mock_list_groups.assert_called_once_with(_request_context())
     assert result["tenant_id"] == TENANT_ID
     assert result["groups"][0]["version"] == 2
     assert result["groups"][0]["updated_at"] == "2026-08-21T00:00:00Z"
 
 
-def test_create_forwards_payload_and_returns_201() -> None:
-    service = MagicMock()
-    service.create_group.return_value = _group_payload()
+def test_create_forwards_payload_and_returns_201(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mock_create_group = mocker.patch.object(service, "create_group", return_value=_group_payload())
     request_payload = NetworkAccessGroupCreatePayload(
         name="Office network",
         description="Reusable office egress addresses",
@@ -147,14 +160,14 @@ def test_create_forwards_payload_and_returns_201() -> None:
     )
     api = CurrentWorkspaceNetworkAccessGroupsApi()
 
-    with _application_services(service):
+    with _application_services(account_application_services):
         body, status = unwrap(api.post)(
             api,
             req_data=request_payload,
             request_context=_request_context(),
         )
 
-    service.create_group.assert_called_once_with(
+    mock_create_group.assert_called_once_with(
         _request_context(),
         name="Office network",
         description="Reusable office egress addresses",
@@ -164,11 +177,14 @@ def test_create_forwards_payload_and_returns_201() -> None:
     assert body["group"]["id"] == GROUP_ID
 
 
-def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
-    service = MagicMock()
-    service.get_group.return_value = _group_payload()
-    service.update_group.return_value = _group_payload()
-    service.delete_group.return_value = True
+def test_group_detail_update_and_delete_forward_path_and_query_values(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mock_get_group = mocker.patch.object(service, "get_group", return_value=_group_payload())
+    mock_update_group = mocker.patch.object(service, "update_group", return_value=_group_payload())
+    mock_delete_group = mocker.patch.object(service, "delete_group", return_value=True)
     update_payload = NetworkAccessGroupUpdatePayload(
         name="Office network",
         description="Updated",
@@ -177,7 +193,7 @@ def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
     )
     api = CurrentWorkspaceNetworkAccessGroupApi()
 
-    with _application_services(service):
+    with _application_services(account_application_services):
         get_result = unwrap(api.get)(api, request_context=_request_context(), group_id=UUID(GROUP_ID))
         update_result = unwrap(api.put)(
             api,
@@ -192,8 +208,8 @@ def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
             group_id=UUID(GROUP_ID),
         )
 
-    service.get_group.assert_called_once_with(_request_context(), group_id=GROUP_ID)
-    service.update_group.assert_called_once_with(
+    mock_get_group.assert_called_once_with(_request_context(), group_id=GROUP_ID)
+    mock_update_group.assert_called_once_with(
         _request_context(),
         group_id=GROUP_ID,
         name="Office network",
@@ -201,26 +217,37 @@ def test_group_detail_update_and_delete_forward_path_and_query_values() -> None:
         allowed_cidrs=["203.0.113.0/24"],
         expected_version=1,
     )
-    service.delete_group.assert_called_once_with(_request_context(), group_id=GROUP_ID, expected_version=2)
+    mock_delete_group.assert_called_once_with(_request_context(), group_id=GROUP_ID, expected_version=2)
     assert get_result["group"]["id"] == GROUP_ID
     assert update_result["group"]["version"] == 2
     assert delete_result == {"deleted": True}
 
 
-def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
-    service = MagicMock()
-    service.get_app_binding.return_value = NetworkAccessAppConfig(
-        TENANT_ID,
-        APP_ID,
-        True,
-        False,
-        None,
-        ("webapp", "service_api", "mcp"),
+def test_app_get_and_put_forward_app_id_without_orm_models(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mock_get_app_binding = mocker.patch.object(
+        service,
+        "get_app_binding",
+        return_value=NetworkAccessAppConfig(
+            TENANT_ID,
+            APP_ID,
+            True,
+            False,
+            None,
+            ("webapp", "service_api", "mcp"),
+        ),
     )
-    service.update_app_binding.return_value = NetworkAccessBindingUpdate(
-        _binding_payload(),
-        True,
-        ("webapp", "service_api", "mcp"),
+    mock_update_app_binding = mocker.patch.object(
+        service,
+        "update_app_binding",
+        return_value=NetworkAccessBindingUpdate(
+            _binding_payload(),
+            True,
+            ("webapp", "service_api", "mcp"),
+        ),
     )
     request_payload = AppNetworkAccessGroupUpdatePayload(
         enabled=True,
@@ -230,7 +257,7 @@ def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
     )
     api = AppNetworkAccessGroupApi()
 
-    with _application_services(service):
+    with _application_services(account_application_services):
         get_result = unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
         put_result = unwrap(api.put)(
             api,
@@ -239,8 +266,8 @@ def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
             app_id=UUID(APP_ID),
         )
 
-    service.get_app_binding.assert_called_once_with(_request_context(), app_id=APP_ID)
-    service.update_app_binding.assert_called_once_with(
+    mock_get_app_binding.assert_called_once_with(_request_context(), app_id=APP_ID)
+    mock_update_app_binding.assert_called_once_with(
         _request_context(),
         app_id=APP_ID,
         enabled=True,
@@ -254,12 +281,17 @@ def test_app_get_and_put_forward_app_id_without_orm_models() -> None:
     assert put_result["effective_enabled"] is True
 
 
-def test_app_status_serializes_only_entry_state() -> None:
-    service = MagicMock()
-    service.get_app_status.return_value = NetworkAccessAppStatus(True, True, True, 2, 4)
+def test_app_status_serializes_only_entry_state(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mock_get_app_status = mocker.patch.object(
+        service, "get_app_status", return_value=NetworkAccessAppStatus(True, True, True, 2, 4)
+    )
     api = AppNetworkAccessGroupStatusApi()
 
-    with _application_services(service):
+    with _application_services(account_application_services):
         result = unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
 
     assert result == {
@@ -269,7 +301,7 @@ def test_app_status_serializes_only_entry_state() -> None:
         "covered_count": 2,
         "available_count": 4,
     }
-    service.get_app_status.assert_called_once_with(_request_context(), app_id=APP_ID)
+    mock_get_app_status.assert_called_once_with(_request_context(), app_id=APP_ID)
 
 
 @pytest.mark.parametrize("role", ["normal", "owner", "admin", "editor"])
@@ -285,9 +317,14 @@ def test_app_status_serializes_only_entry_state() -> None:
     ],
 )
 def test_app_status_uses_minimal_upstream_route_and_filters_scopes_for_current_mode(
-    role: str, app_mode: str, covered_count: int, available_count: int
+    account_application_services: ApplicationServices,
+    role: str,
+    app_mode: str,
+    covered_count: int,
+    available_count: int,
 ) -> None:
     response, requests = _typed_status_http_response(
+        account_application_services,
         {
             "entitled": True,
             "configured": True,
@@ -333,25 +370,32 @@ def test_app_status_uses_minimal_upstream_route_and_filters_scopes_for_current_m
     ],
 )
 def test_app_status_preserves_saved_state_and_applies_local_entitlement(
-    wire: Mapping[str, object], paid: bool, expected: dict[str, object]
+    account_application_services: ApplicationServices,
+    wire: Mapping[str, object],
+    paid: bool,
+    expected: dict[str, object],
 ) -> None:
-    response, _requests = _typed_status_http_response(wire, paid=paid)
+    response, _requests = _typed_status_http_response(account_application_services, wire, paid=paid)
 
     assert response.status_code == 200
     assert response.get_json() == {**expected, "available_count": 4}
 
 
 @pytest.mark.parametrize("role", ["dataset_operator", "unknown", None])
-def test_app_status_rejects_disallowed_roles_before_upstream_read(role: str | None) -> None:
-    response, requests = _typed_status_http_response({}, role=role)
+def test_app_status_rejects_disallowed_roles_before_upstream_read(
+    account_application_services: ApplicationServices, role: str | None
+) -> None:
+    response, requests = _typed_status_http_response(account_application_services, {}, role=role)
 
     assert response.status_code == 403
     assert requests == []
 
 
 @pytest.mark.parametrize("upstream_status", [403, 404])
-def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(upstream_status: int) -> None:
-    response, requests = _typed_status_http_response({}, upstream_status=upstream_status)
+def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(
+    account_application_services: ApplicationServices, upstream_status: int
+) -> None:
+    response, requests = _typed_status_http_response(account_application_services, {}, upstream_status=upstream_status)
 
     assert response.status_code == upstream_status
     assert len(requests) == 1
@@ -360,8 +404,10 @@ def test_app_status_does_not_fall_back_to_full_binding_after_upstream_error(upst
 
 @pytest.mark.parametrize("field", ["entitled", "configured", "enabled"])
 @pytest.mark.parametrize("value", ["false", "true", 0, 1, None])
-def test_app_status_rejects_non_boolean_flags(field: str, value: object) -> None:
-    response, _requests = _typed_status_http_response({field: value})
+def test_app_status_rejects_non_boolean_flags(
+    account_application_services: ApplicationServices, field: str, value: object
+) -> None:
+    response, _requests = _typed_status_http_response(account_application_services, {field: value})
 
     assert response.status_code == 502
 
@@ -374,8 +420,10 @@ def test_app_status_rejects_non_boolean_flags(field: str, value: object) -> None
         {"access_points": ["webapp"], "accessPoints": ["mcp"]},
     ],
 )
-def test_app_status_rejects_malformed_or_conflicting_scopes(wire: Mapping[str, object]) -> None:
-    response, _requests = _typed_status_http_response(wire)
+def test_app_status_rejects_malformed_or_conflicting_scopes(
+    account_application_services: ApplicationServices, wire: Mapping[str, object]
+) -> None:
+    response, _requests = _typed_status_http_response(account_application_services, wire)
 
     assert response.status_code == 502
 
@@ -412,11 +460,13 @@ def test_conflict_error_mapping_preserves_safe_actionable_reason(reason: str, ex
 
 
 @pytest.mark.parametrize("mutation", ["create", "update"])
-def test_duplicate_policy_name_mutations_preserve_conflict_and_public_message(mutation: str) -> None:
-    service = MagicMock()
+def test_duplicate_policy_name_mutations_preserve_conflict_and_public_message(
+    account_application_services: ApplicationServices, mocker: MockerFixture, mutation: str
+) -> None:
+    service = account_application_services.network_access_groups
     upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_GROUP_NAME_CONFLICT")
-    service.create_group.side_effect = upstream_error
-    service.update_group.side_effect = upstream_error
+    mock_create_group = mocker.patch.object(service, "create_group", side_effect=upstream_error)
+    mock_update_group = mocker.patch.object(service, "update_group", side_effect=upstream_error)
 
     def invoke_mutation() -> None:
         if mutation == "create":
@@ -437,15 +487,15 @@ def invoke_mutation() -> None:
                 group_id=UUID(GROUP_ID),
             )
 
-    with _application_services(service), pytest.raises(Conflict) as exc_info:
+    with _application_services(account_application_services), pytest.raises(Conflict) as exc_info:
         invoke_mutation()
 
     assert exc_info.value.code == 409
     assert exc_info.value.description == "An IP policy with this name already exists."
     assert exc_info.value.__cause__ is upstream_error
     assert upstream_error.reason == "NETWORK_ACCESS_GROUP_NAME_CONFLICT"
-    assert service.create_group.call_count == (1 if mutation == "create" else 0)
-    assert service.update_group.call_count == (1 if mutation == "update" else 0)
+    assert mock_create_group.call_count == (1 if mutation == "create" else 0)
+    assert mock_update_group.call_count == (1 if mutation == "update" else 0)
 
 
 def test_internal_secret_error_is_not_reported_as_tenant_input_failure() -> None:
@@ -489,14 +539,16 @@ def test_application_error_mapping(
 )
 @pytest.mark.parametrize("paid", [False, True], ids=["unpaid", "paid"])
 def test_mutation_paid_plan_admission_precedes_payload_validation(
-    mutation: Callable[..., object], paid: bool, config_overrides: Callable[..., None]
+    account_application_services: ApplicationServices,
+    mutation: Callable[..., object],
+    paid: bool,
+    config_overrides: Callable[..., None],
 ) -> None:
     app = Flask(__name__)
     config_overrides(DEPLOYMENT_EDITION=DeploymentEdition.CLOUD, LOGIN_DISABLED=False)
     account = Account(name="Policy editor", email="editor@example.com", status=AccountStatus.ACTIVE)
     account.id = ACCOUNT_ID
     identity = AccountWithTenant(account, TENANT_ID)
-    service = MagicMock()
     method = mutation.__name__.upper()
 
     def mutation_route() -> Response:
@@ -506,7 +558,10 @@ def mutation_route() -> Response:
     app.add_url_rule("/mutation", view_func=mutation_route, methods=[method])
 
     with (
-        _application_services(service),
+        patch(
+            "controllers.console.workspace.network_access_group.application_services",
+            return_value=account_application_services,
+        ) as service_provider,
         patch("libs.login._resolve_current_user", return_value=account),
         patch("libs.login.check_csrf_token") as csrf_check,
         patch("controllers.console.wraps.current_account_with_tenant", return_value=identity),
@@ -524,7 +579,7 @@ def mutation_route() -> Response:
     assert response.status_code == (422 if paid else 403)
     is_paid_plan.assert_called_once_with(TENANT_ID)
     csrf_check.assert_called_once()
-    assert service.method_calls == []
+    service_provider.assert_not_called()
     if paid:
         validate_payload.assert_called_once()
     else:
@@ -532,26 +587,36 @@ def mutation_route() -> Response:
         validate_payload.assert_not_called()
 
 
-def test_controller_maps_service_error_before_serialization() -> None:
-    service = MagicMock()
-    service.list_groups.side_effect = NetworkAccessGroupAccessDeniedError
+def test_controller_maps_service_error_before_serialization(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mocker.patch.object(service, "list_groups", side_effect=NetworkAccessGroupAccessDeniedError)
 
-    with _application_services(service), pytest.raises(Forbidden, match="workspace role"):
+    with _application_services(account_application_services), pytest.raises(Forbidden, match="workspace role"):
         unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
             CurrentWorkspaceNetworkAccessGroupsApi(),
             request_context=_request_context(),
         )
 
 
-def test_invalid_service_response_is_bad_gateway() -> None:
-    service = MagicMock()
-    service.list_groups.return_value = {
-        "tenant_id": TENANT_ID,
-        "entitled": True,
-        "groups": [{"allowed_cidrs": list[str]()}],
-    }
+def test_invalid_service_response_is_bad_gateway(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
+    mocker.patch.object(
+        service,
+        "list_groups",
+        return_value={
+            "tenant_id": TENANT_ID,
+            "entitled": True,
+            "groups": [{"allowed_cidrs": list[str]()}],
+        },
+    )
 
-    with _application_services(service), pytest.raises(BadGateway):
+    with _application_services(account_application_services), pytest.raises(BadGateway):
         unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
             CurrentWorkspaceNetworkAccessGroupsApi(),
             request_context=_request_context(),
@@ -605,10 +670,12 @@ def test_app_config_accepts_policy_id_alias_and_disabled_draft() -> None:
 
 
 def test_current_ip_check_uses_trusted_resolver_after_service_admission_and_disables_caching(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
     config_overrides: Callable[..., None],
 ) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
 
     def check_current_ip(
@@ -620,7 +687,7 @@ def check_current_ip(
         assert group_id == GROUP_ID
         return NetworkAccessCurrentIPCheck(client_ip_supplier(), True, 4)
 
-    service.check_current_ip.side_effect = check_current_ip
+    mocker.patch.object(service, "check_current_ip", side_effect=check_current_ip)
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
 
     with (
@@ -628,7 +695,7 @@ def check_current_ip(
             headers={"X-Forwarded-For": "203.0.113.7"},
             environ_base={"REMOTE_ADDR": "172.18.0.3"},
         ),
-        _application_services(service),
+        _application_services(account_application_services),
         patch(
             "controllers.console.workspace.network_access_group.resolve_network_access_client_ip",
             return_value="203.0.113.7",
@@ -642,18 +709,24 @@ def check_current_ip(
     assert resolve_client_ip.call_args.args[1] == "172.18.0.0/16"
 
 
-def test_current_ip_check_maps_unavailable_client_ip_to_503(config_overrides: Callable[..., None]) -> None:
+def test_current_ip_check_maps_unavailable_client_ip_to_503(
+    account_application_services: ApplicationServices, mocker: MockerFixture, config_overrides: Callable[..., None]
+) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
-    service.check_current_ip.side_effect = lambda _context, *, group_id, client_ip_supplier: (
-        client_ip_supplier() if group_id == GROUP_ID else None
+    mocker.patch.object(
+        service,
+        "check_current_ip",
+        side_effect=lambda _context, *, group_id, client_ip_supplier: (
+            client_ip_supplier() if group_id == GROUP_ID else None
+        ),
     )
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
 
     with (
         app.test_request_context(environ_base={"REMOTE_ADDR": "172.18.0.3"}),
-        _application_services(service),
+        _application_services(account_application_services),
         patch(
             "controllers.console.workspace.network_access_group.resolve_network_access_client_ip",
             side_effect=NetworkAccessClientIPUnavailableError,
@@ -664,19 +737,25 @@ def test_current_ip_check_maps_unavailable_client_ip_to_503(config_overrides: Ca
 
 
 def test_current_ip_check_fails_closed_when_trusted_proxy_config_is_empty(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
     config_overrides: Callable[..., None],
 ) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="")
-    service.check_current_ip.side_effect = lambda _context, *, group_id, client_ip_supplier: (
-        client_ip_supplier() if group_id == GROUP_ID else None
+    mocker.patch.object(
+        service,
+        "check_current_ip",
+        side_effect=lambda _context, *, group_id, client_ip_supplier: (
+            client_ip_supplier() if group_id == GROUP_ID else None
+        ),
     )
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPCheckApi()
 
     with (
         app.test_request_context(environ_base={"REMOTE_ADDR": "172.18.0.3"}),
-        _application_services(service),
+        _application_services(account_application_services),
         patch(
             "controllers.console.workspace.network_access_group.resolve_network_access_client_ip"
         ) as resolve_client_ip,
@@ -687,12 +766,15 @@ def test_current_ip_check_fails_closed_when_trusted_proxy_config_is_empty(
     resolve_client_ip.assert_not_called()
 
 
-def test_group_response_rejects_enforcing_count_greater_than_used_by_count() -> None:
-    service = MagicMock()
+def test_group_response_rejects_enforcing_count_greater_than_used_by_count(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
+    service = account_application_services.network_access_groups
     group = replace(_group_payload(app_ids=[APP_ID]), enforcing_count=2)
-    service.list_groups.return_value = NetworkAccessGroupList(TENANT_ID, True, (group,))
+    mocker.patch.object(service, "list_groups", return_value=NetworkAccessGroupList(TENANT_ID, True, (group,)))
 
-    with _application_services(service), pytest.raises(BadGateway, match="Invalid response"):
+    with _application_services(account_application_services), pytest.raises(BadGateway, match="Invalid response"):
         unwrap(CurrentWorkspaceNetworkAccessGroupsApi().get)(
             CurrentWorkspaceNetworkAccessGroupsApi(),
             request_context=_request_context(),
@@ -711,15 +793,20 @@ def test_group_response_rejects_enforcing_count_greater_than_used_by_count() ->
     ids=["ipv4", "ipv6", "mapped-ipv6", "untrusted-peer-spoof", "trusted-proxy-appended-peer"],
 )
 def test_current_ip_read_uses_trusted_resolver_and_ignores_client_supplied_ip(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
     config_overrides: Callable[..., None],
     peer: str,
     forwarded: str,
     expected: str,
 ) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
+    mock_get_group = mocker.patch.object(service, "get_group")
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
-    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: client_ip_supplier()
+    mock_get_current_ip = mocker.patch.object(
+        service, "get_current_ip", side_effect=lambda _context, *, client_ip_supplier: client_ip_supplier()
+    )
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
 
     with (
@@ -734,16 +821,16 @@ def test_current_ip_read_uses_trusted_resolver_and_ignores_client_supplied_ip(
             json={"client_ip": "192.0.2.1"},
             environ_base={"REMOTE_ADDR": peer},
         ),
-        _application_services(service),
+        _application_services(account_application_services),
     ):
         result = unwrap(api.get)(api, request_context=_request_context())
         response = app.process_response(app.make_response(result))
 
     assert result == {"client_ip": expected}
     assert response.headers["Cache-Control"] == "no-store"
-    assert service.get_current_ip.call_args.args == (_request_context(),)
-    assert set(service.get_current_ip.call_args.kwargs) == {"client_ip_supplier"}
-    service.get_group.assert_not_called()
+    assert mock_get_current_ip.call_args.args == (_request_context(),)
+    assert set(mock_get_current_ip.call_args.kwargs) == {"client_ip_supplier"}
+    mock_get_group.assert_not_called()
 
 
 @pytest.mark.parametrize(
@@ -758,12 +845,18 @@ def test_current_ip_read_uses_trusted_resolver_and_ignores_client_supplied_ip(
     ids=["missing-proxy-config", "invalid-proxy-config", "missing-xff", "invalid-xff", "all-trusted-hops"],
 )
 def test_current_ip_read_fails_closed_with_no_store_on_503(
-    config_overrides: Callable[..., None], trusted_proxies: str, forwarded: str | None
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+    config_overrides: Callable[..., None],
+    trusted_proxies: str,
+    forwarded: str | None,
 ) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
     config_overrides(NETWORK_ACCESS_TRUSTED_PROXY_CIDRS=trusted_proxies)
-    service.get_current_ip.side_effect = lambda _context, *, client_ip_supplier: client_ip_supplier()
+    mocker.patch.object(
+        service, "get_current_ip", side_effect=lambda _context, *, client_ip_supplier: client_ip_supplier()
+    )
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
 
     with (
@@ -771,7 +864,7 @@ def test_current_ip_read_fails_closed_with_no_store_on_503(
             headers={"X-Forwarded-For": forwarded} if forwarded is not None else {},
             environ_base={"REMOTE_ADDR": "172.18.0.3"},
         ),
-        _application_services(service),
+        _application_services(account_application_services),
     ):
         with pytest.raises(ServiceUnavailable, match="Current client IP is unavailable") as exc_info:
             unwrap(api.get)(api, request_context=_request_context())
@@ -781,15 +874,18 @@ def test_current_ip_read_fails_closed_with_no_store_on_503(
     assert response.headers["Cache-Control"] == "no-store"
 
 
-def test_current_ip_read_maps_role_denial_without_resolving_ip() -> None:
+def test_current_ip_read_maps_role_denial_without_resolving_ip(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+) -> None:
     app = Flask(__name__)
-    service = MagicMock()
-    service.get_current_ip.side_effect = NetworkAccessGroupAccessDeniedError
+    service = account_application_services.network_access_groups
+    mocker.patch.object(service, "get_current_ip", side_effect=NetworkAccessGroupAccessDeniedError)
     api = CurrentWorkspaceNetworkAccessGroupCurrentIPApi()
 
     with (
         app.test_request_context(),
-        _application_services(service),
+        _application_services(account_application_services),
         patch(
             "controllers.console.workspace.network_access_group.resolve_network_access_client_ip"
         ) as resolve_client_ip,
@@ -804,16 +900,22 @@ def test_current_ip_read_maps_role_denial_without_resolving_ip() -> None:
 
 
 @pytest.mark.parametrize("edition", [DeploymentEdition.COMMUNITY, DeploymentEdition.ENTERPRISE])
-def test_current_ip_read_is_cloud_only(config_overrides: Callable[..., None], edition: DeploymentEdition) -> None:
+def test_current_ip_read_is_cloud_only(
+    account_application_services: ApplicationServices,
+    mocker: MockerFixture,
+    config_overrides: Callable[..., None],
+    edition: DeploymentEdition,
+) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
+    mock_get_current_ip = mocker.patch.object(service, "get_current_ip")
     config_overrides(DEPLOYMENT_EDITION=edition, LOGIN_DISABLED=False)
     account = Account(name="Policy editor", email="editor@example.com", status=AccountStatus.ACTIVE)
     account.id = ACCOUNT_ID
 
     with (
         app.test_request_context(),
-        _application_services(service),
+        _application_services(account_application_services),
         patch("controllers.console.wraps._is_setup_completed", return_value=True),
         patch("libs.login._resolve_current_user", return_value=account),
         patch("libs.login.check_csrf_token") as csrf_check,
@@ -825,19 +927,22 @@ def test_current_ip_read_is_cloud_only(config_overrides: Callable[..., None], ed
         CurrentWorkspaceNetworkAccessGroupCurrentIPApi().get()
 
     csrf_check.assert_called_once()
-    service.get_current_ip.assert_not_called()
+    mock_get_current_ip.assert_not_called()
 
 
-def test_current_ip_read_requires_authenticated_account(config_overrides: Callable[..., None]) -> None:
+def test_current_ip_read_requires_authenticated_account(
+    account_application_services: ApplicationServices, mocker: MockerFixture, config_overrides: Callable[..., None]
+) -> None:
     app = Flask(__name__)
-    service = MagicMock()
+    service = account_application_services.network_access_groups
+    mock_get_current_ip = mocker.patch.object(service, "get_current_ip")
     config_overrides(DEPLOYMENT_EDITION=DeploymentEdition.CLOUD, LOGIN_DISABLED=False)
-    login_manager = MagicMock()
-    login_manager.unauthorized.return_value = Response(status=401)
+    login_manager = DifyLoginManager()
+    login_manager.unauthorized_handler(lambda: Response(status=401))
 
     with (
         app.test_request_context(),
-        _application_services(service),
+        _application_services(account_application_services),
         patch("libs.login._resolve_current_user", return_value=None),
         patch("libs.login._get_login_manager", return_value=login_manager),
     ):
@@ -845,7 +950,7 @@ def test_current_ip_read_requires_authenticated_account(config_overrides: Callab
 
     assert isinstance(response, Response)
     assert response.status_code == 401
-    service.get_current_ip.assert_not_called()
+    mock_get_current_ip.assert_not_called()
 
 
 def test_current_ip_read_response_schema_exposes_only_client_ip() -> None:
@@ -859,7 +964,7 @@ def test_current_ip_read_response_schema_exposes_only_client_ip() -> None:
 @pytest.mark.parametrize("group_field", ["group_id", "groupId", "policy_id", "policyId"])
 @pytest.mark.parametrize("stale_only", [False, True])
 def test_typed_gateway_service_controller_pipeline_preserves_binding_configuration(
-    group_field: str, stale_only: bool
+    account_application_services: ApplicationServices, group_field: str, stale_only: bool
 ) -> None:
     wire = {
         "tenantId": TENANT_ID,
@@ -878,7 +983,7 @@ def test_typed_gateway_service_controller_pipeline_preserves_binding_configurati
             "updatedAt": "2026-08-21T00:00:00Z",
         },
     }
-    response = _typed_binding_http_response(wire)
+    response = _typed_binding_http_response(account_application_services, wire)
     assert response.status_code == 200
     body = response.get_json()
     assert body["binding"]["enabled"] is True
@@ -889,25 +994,27 @@ def test_typed_gateway_service_controller_pipeline_preserves_binding_configurati
     assert wire["binding"]["accessPoints"] == (["future_scope"] if stale_only else ["webapp"])
 
 
-def test_malformed_upstream_response_maps_to_http_502_before_business_truthiness() -> None:
+def test_malformed_upstream_response_maps_to_http_502_before_business_truthiness(
+    account_application_services: ApplicationServices,
+) -> None:
     response = _typed_binding_http_response(
+        account_application_services,
         {
             "tenantId": TENANT_ID,
             "appId": APP_ID,
             "entitled": "false",
             "effectiveEnabled": False,
-        }
+        },
     )
     assert response.status_code == 502
 
 
-def _typed_binding_http_response(wire: Mapping[str, object]) -> TestResponse:
+def _typed_binding_http_response(services: ApplicationServices, wire: Mapping[str, object]) -> TestResponse:
     app = Flask(__name__)
     app.testing = True
-    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
-    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, "workflow", "Test", None, None, None)
-    memberships.get_account_role.return_value = "owner"
-    entitlement.is_paid_plan.return_value = True
+    apps = SQLAlchemyNetworkAccessGroupAppRepository(session_factory=sessionmaker())
+    memberships = WorkspaceRepository(session_factory=sessionmaker())
+    entitlement = BillingNetworkAccessGroupEntitlementGateway()
     with httpx.Client(transport=httpx.MockTransport(lambda _request: httpx.Response(200, json=wire))) as client:
         gateway = NetworkAccessGroupGateway(
             base_url="https://test.invalid",
@@ -924,11 +1031,21 @@ def _typed_binding_http_response(wire: Mapping[str, object]) -> TestResponse:
         def binding() -> dict[str, object]:
             return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
 
-        with _application_services(service):
+        with (
+            _application_services(replace(services, network_access_groups=service)),
+            patch.object(
+                apps,
+                "get_manageable_app",
+                return_value=NetworkAccessGroupAppRecord(APP_ID, "workflow", "Test", None, None, None),
+            ),
+            patch.object(memberships, "get_account_role", return_value="owner"),
+            patch.object(entitlement, "is_paid_plan", return_value=True),
+        ):
             return app.test_client().get("/binding")
 
 
 def _typed_status_http_response(
+    services: ApplicationServices,
     wire: Mapping[str, object],
     *,
     role: str | None = "normal",
@@ -938,10 +1055,9 @@ def _typed_status_http_response(
 ) -> tuple[TestResponse, list[httpx.Request]]:
     app = Flask(__name__)
     app.testing = True
-    apps, memberships, entitlement = MagicMock(), MagicMock(), MagicMock()
-    apps.get_manageable_app.return_value = NetworkAccessGroupAppRecord(APP_ID, app_mode, "Test", None, None, None)
-    memberships.get_account_role.return_value = role
-    entitlement.is_paid_plan.return_value = paid
+    apps = SQLAlchemyNetworkAccessGroupAppRepository(session_factory=sessionmaker())
+    memberships = WorkspaceRepository(session_factory=sessionmaker())
+    entitlement = BillingNetworkAccessGroupEntitlementGateway()
     requests: list[httpx.Request] = []
 
     def respond(request: httpx.Request) -> httpx.Response:
@@ -966,5 +1082,14 @@ def respond(request: httpx.Request) -> httpx.Response:
         def status() -> dict[str, object]:
             return unwrap(api.get)(api, request_context=_request_context(), app_id=UUID(APP_ID))
 
-        with _application_services(service):
+        with (
+            _application_services(replace(services, network_access_groups=service)),
+            patch.object(
+                apps,
+                "get_manageable_app",
+                return_value=NetworkAccessGroupAppRecord(APP_ID, app_mode, "Test", None, None, None),
+            ),
+            patch.object(memberships, "get_account_role", return_value=role),
+            patch.object(entitlement, "is_paid_plan", return_value=paid),
+        ):
             return app.test_client().get("/status"), requests
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp.py b/api/tests/unit_tests/controllers/mcp/test_mcp.py
index 1b2966d1bb2d91..088f085aa52d96 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp.py
@@ -237,12 +237,14 @@ def test_inactive_server(self):
         assert response.status_code == 404
         assert response.get_json()["error"]["message"] == "Server Not Found"
 
-    def test_invalid_payload(self):
+    def test_invalid_payload(self, mocker):
         fake_payload({"invalid": "data"})
 
         api = module.MCPAppApi()
-        api._get_mcp_server_and_app = MagicMock(
-            return_value=(_server(module.AppMCPServerStatus.ACTIVE), _app(module.AppMode.WORKFLOW))
+        mocker.patch.object(
+            api,
+            "_get_mcp_server_and_app",
+            return_value=(_server(module.AppMCPServerStatus.ACTIVE), _app(module.AppMode.WORKFLOW)),
         )
         post_fn = unwrap(api.post)
 
@@ -270,7 +272,7 @@ def test_unknown_method_without_request_id_is_ignored(self):
         assert response.status_code == 202
         assert response.data == b""
 
-    def test_server_not_found(self):
+    def test_server_not_found(self, mocker):
         """Test when MCP server doesn't exist"""
         fake_payload(
             {
@@ -286,7 +288,7 @@ def test_server_not_found(self):
         )
 
         api = module.MCPAppApi()
-        api._get_mcp_server_and_app = MagicMock(side_effect=module.MCPServerNotFoundError())
+        mocker.patch.object(api, "_get_mcp_server_and_app", side_effect=module.MCPServerNotFoundError())
 
         post_fn = unwrap(api.post)
 
@@ -294,7 +296,7 @@ def test_server_not_found(self):
         assert response.status_code == 404
         assert response.get_json()["error"]["message"] == "Server Not Found"
 
-    def test_app_not_found(self):
+    def test_app_not_found(self, mocker):
         """Test when app associated with server doesn't exist"""
         fake_payload(
             {
@@ -310,7 +312,7 @@ def test_app_not_found(self):
         )
 
         api = module.MCPAppApi()
-        api._get_mcp_server_and_app = MagicMock(side_effect=module.MCPServerNotFoundError())
+        mocker.patch.object(api, "_get_mcp_server_and_app", side_effect=module.MCPServerNotFoundError())
 
         post_fn = unwrap(api.post)
 
diff --git a/api/tests/unit_tests/controllers/mcp/test_mcp_request_errors.py b/api/tests/unit_tests/controllers/mcp/test_mcp_request_errors.py
index 4f1789490aa0ae..c6aa7bb035de65 100644
--- a/api/tests/unit_tests/controllers/mcp/test_mcp_request_errors.py
+++ b/api/tests/unit_tests/controllers/mcp/test_mcp_request_errors.py
@@ -39,7 +39,7 @@ def client(app: Flask) -> FlaskClient:
     return app.test_client()
 
 
-@pytest.fixture
+@pytest.fixture(autouse=True)
 def published_server(sqlite_session: Session) -> AppMCPServer:
     app_id = str(uuid4())
     tenant_id = str(uuid4())
diff --git a/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py b/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
index 4dbd0ede8cb945..42117e7fbe588e 100644
--- a/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
+++ b/api/tests/unit_tests/controllers/web/test_human_input_file_upload.py
@@ -9,6 +9,7 @@
 
 import pytest
 from flask import Flask
+from pytest_mock import MockerFixture
 
 import controllers.web.human_input_file_upload as upload_module
 from controllers.common.errors import (
@@ -28,6 +29,7 @@
     InvalidUploadTokenForbiddenError,
     InvalidUploadTokenUnauthorizedError,
 )
+from extensions.ext_application_services import ApplicationServices
 from models import Account
 from models.model import UploadFile
 from services.errors.file import (
@@ -333,14 +335,16 @@ def test_upload_maps_file_service_errors(
     service_error: Exception,
     http_error: type[Exception],
     remote: bool,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
-    service = MagicMock()
-    service.validate_upload_token.return_value = _upload_context()
+    service = account_application_services.human_input_file_uploads
+    mocker.patch.object(service, "validate_upload_token", return_value=_upload_context())
     if remote:
-        service.upload_remote_file.side_effect = service_error
+        mocker.patch.object(service, "upload_remote_file", side_effect=service_error)
         data = {"url": "https://example.com/file.txt"}
     else:
-        service.upload_local_file.side_effect = service_error
+        mocker.patch.object(service, "upload_local_file", side_effect=service_error)
         data = {"file": (BytesIO(b"content"), "sample.txt")}
     _patch_upload_service(monkeypatch, service)
 
diff --git a/api/tests/unit_tests/controllers/web/test_public_app_admission.py b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
index c6e2fa1bdfbb4d..427841eed16d19 100644
--- a/api/tests/unit_tests/controllers/web/test_public_app_admission.py
+++ b/api/tests/unit_tests/controllers/web/test_public_app_admission.py
@@ -1,19 +1,23 @@
 """Public bootstrap admission with real SQL repositories and the canonical hook."""
 
+from dataclasses import dataclass, replace
 from datetime import UTC, datetime
-from types import SimpleNamespace
 from unittest.mock import MagicMock
 from uuid import uuid4
 
 import pytest
 from flask import Flask
+from flask.testing import FlaskClient
+from pytest_mock import MockerFixture
 from sqlalchemy import func, select
 from sqlalchemy.exc import OperationalError
 from sqlalchemy.orm import Session, sessionmaker
 
 from controllers.web import app as app_controller
 from controllers.web import bp, login, passport, site, wraps
-from enums import DeploymentEdition, WebAppAccessMode
+from enums import DeploymentEdition
+from extensions.ext_application_services import ApplicationServices
+from libs.passport import PassportService
 from models.account import Tenant
 from models.enums import EndUserType
 from models.model import App, AppMode, CustomizeTokenStrategy, EndUser, Message, Site
@@ -21,25 +25,41 @@
 from repositories.app_definition_query_repository import AppDefinitionQueryRepository
 from repositories.web_passport_repository import WebPassportRepository
 from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
-from services import web_authentication_adapters
 from services.app_definition_query_service import AppDefinitionQueryService
 from services.entities.feature_entities import FeatureModel
+from services.file_service import FileService
 from services.web_app_runtime_query_service import WebAppRuntimeQueryService
 from services.web_authentication_adapters import PassportWebAppSessionGateway
-from services.web_authentication_service import WebAuthenticationService
+from services.web_passport_gateways import PassportTokenGateway
 from services.web_passport_service import WebPassportService
-from services.webapp_access_query_service import WebAppAccessQueryService
 from tests.unit_tests.config_override import apply_config_overrides
 
 
+@dataclass
+class AdmissionHarness:
+    app: App
+    old_user: EndUser
+    client: FlaskClient
+    services: ApplicationServices
+    issue: MagicMock
+    auth_calls: tuple[MagicMock, ...]
+    mode_lookup: MagicMock
+    login_verify: MagicMock
+    session_verify: MagicMock
+    metadata_calls: tuple[MagicMock, ...]
+    access_repo: WebAppAccessQueryRepository
+
+
 def _harness(
     session: Session,
     factory: sessionmaker[Session],
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    base_services: ApplicationServices,
     *,
     published: bool,
     missing: bool = False,
-) -> SimpleNamespace:
+) -> AdmissionHarness:
     app = App(
         id=str(uuid4()),
         tenant_id=str(uuid4()),
@@ -93,33 +113,34 @@ def _harness(
 
     access_repo = WebAppAccessQueryRepository(session_factory=factory)
     passport_repo = WebPassportRepository(session_factory=factory, generate_session_id=lambda: "new-session")
-    auth, tokens, policy = MagicMock(), MagicMock(), MagicMock()
-    policy.get_access_mode.return_value = WebAppAccessMode.PUBLIC
-    auth.is_webapp_auth_enabled.return_value = False
-    tokens.issue.return_value = "new-passport"
-    tokens.verify.return_value = {"app_id": app.id, "app_code": "fixture-code", "end_user_id": old_user.id}
-    access = WebAppAccessQueryService(
-        access=access_repo,
-        webapp_auth_enabled=False,
-        policy=policy,
-        get_access_modes=MagicMock(),
-        get_user_permissions=MagicMock(),
+    access = base_services.webapp_access
+    monkeypatch.setattr(access, "_access", access_repo)
+    monkeypatch.setattr(access, "_webapp_auth_enabled", False)
+    mode_lookup = mocker.spy(access._policy, "get_access_mode")
+    auth = base_services.web_passport._auth
+    auth_calls = (
+        mocker.spy(auth, "is_webapp_auth_enabled"),
+        mocker.spy(auth, "get_app_auth_type"),
+    )
+    tokens = PassportTokenGateway(passport=PassportService())
+    issue = mocker.patch.object(PassportService, "issue", return_value="new-passport")
+    mocker.patch.object(
+        PassportService,
+        "verify",
+        return_value={"app_id": app.id, "app_code": "fixture-code", "end_user_id": old_user.id},
     )
-    app_sessions = MagicMock(wraps=PassportWebAppSessionGateway(sessions=access_repo, app_access=access))
-    login_tokens = MagicMock()
+    app_sessions = PassportWebAppSessionGateway(sessions=access_repo, app_access=access)
+    session_verify = mocker.spy(app_sessions, "verify")
+    authentication = base_services.web_authentication
+    monkeypatch.setattr(authentication, "_app_access", access)
+    monkeypatch.setattr(authentication, "_app_sessions", app_sessions)
+    monkeypatch.setattr(authentication, "_private_app_access_enabled", False)
+    login_verify = mocker.spy(authentication._tokens, "verify_access_token")
     definitions = AppDefinitionQueryRepository(session_factory=factory)
-    services = SimpleNamespace(
+    services = replace(
+        base_services,
         webapp_access=access,
-        web_authentication=WebAuthenticationService(
-            accounts=MagicMock(),
-            passwords=MagicMock(),
-            tokens=login_tokens,
-            security=MagicMock(),
-            app_access=access,
-            app_sessions=app_sessions,
-            audit=MagicMock(),
-            private_app_access_enabled=False,
-        ),
+        web_authentication=authentication,
         web_passport=WebPassportService(
             passports=passport_repo,
             auth=auth,
@@ -127,21 +148,28 @@ def _harness(
             now=lambda: datetime.now(UTC),
             access_token_expire_minutes=60,
         ),
-        app_definitions=MagicMock(wraps=AppDefinitionQueryService(definitions=definitions, builtin_icon_url_prefix="")),
-        web_app_runtime=MagicMock(
-            wraps=WebAppRuntimeQueryService(
-                runtime=definitions,
-                file_service=MagicMock(),
-                workspace_features=lambda _: FeatureModel(),
-                files_url="https://files.example",
-                deployment_edition=DeploymentEdition.CLOUD,
-            )
+        app_definitions=AppDefinitionQueryService(definitions=definitions, builtin_icon_url_prefix=""),
+        web_app_runtime=WebAppRuntimeQueryService(
+            runtime=definitions,
+            file_service=FileService(session_factory=factory),
+            workspace_features=lambda _: FeatureModel(),
+            files_url="https://files.example",
+            deployment_edition=DeploymentEdition.CLOUD,
         ),
     )
+    metadata_calls = tuple(
+        mocker.spy(services.app_definitions, method)
+        for method in (
+            "get_mode",
+            "get_parameters",
+            "get_public_parameters",
+            "get_tool_icons",
+            "get_summary",
+            "get_site_configuration",
+        )
+    ) + (mocker.spy(services.web_app_runtime, "get_bootstrap"),)
     for module in (app_controller, login, passport, site, wraps):
         monkeypatch.setattr(module, "application_services", lambda: services)
-    monkeypatch.setattr(wraps, "PassportService", lambda: tokens)
-    monkeypatch.setattr(web_authentication_adapters, "PassportService", lambda: tokens)
     monkeypatch.setattr(wraps, "extract_webapp_passport", lambda *_: "old-passport")
     monkeypatch.setattr(login, "extract_webapp_passport", lambda *_: "old-passport")
     monkeypatch.setattr(wraps.SystemFeatureService, "is_webapp_auth_enabled", lambda: False)
@@ -153,18 +181,18 @@ def _harness(
     flask = Flask(__name__)
     flask.config.update(TESTING=True, RESTX_ERROR_404_HELP=False)
     flask.register_blueprint(bp)
-    return SimpleNamespace(
+    return AdmissionHarness(
         app=app,
         old_user=old_user,
         client=flask.test_client(),
         services=services,
-        tokens=tokens,
-        auth=auth,
-        mode_lookup=policy.get_access_mode,
-        login_tokens=login_tokens,
-        app_sessions=app_sessions,
+        issue=issue,
+        auth_calls=auth_calls,
+        mode_lookup=mode_lookup,
+        login_verify=login_verify,
+        session_verify=session_verify,
+        metadata_calls=metadata_calls,
         access_repo=access_repo,
-        passport_repo=passport_repo,
     )
 
 
@@ -184,10 +212,20 @@ def test_all_bootstrap_routes_share_404_before_user_or_metadata_side_effects(
     sqlite_session: Session,
     sqlite_session_factory: sessionmaker[Session],
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
     route: str,
     missing: bool,
 ) -> None:
-    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=False, missing=missing)
+    h = _harness(
+        sqlite_session,
+        sqlite_session_factory,
+        monkeypatch,
+        mocker,
+        account_application_services,
+        published=False,
+        missing=missing,
+    )
     response = h.client.get(
         "/api" + route,
         headers={"X-App-Code": "fixture-code"},
@@ -199,13 +237,12 @@ def test_all_bootstrap_routes_share_404_before_user_or_metadata_side_effects(
     )
     assert response.headers["Content-Type"] == "application/json"
     assert response.headers["Cache-Control"] == "no-store"
-    assert h.services.app_definitions.method_calls == []
-    assert h.services.web_app_runtime.method_calls == []
-    assert h.auth.method_calls == []
+    assert all(call.call_count == 0 for call in h.metadata_calls)
+    assert all(call.call_count == 0 for call in h.auth_calls)
     h.mode_lookup.assert_not_called()
-    h.tokens.issue.assert_not_called()
-    assert h.login_tokens.method_calls == []
-    h.app_sessions.verify.assert_not_called()
+    h.issue.assert_not_called()
+    h.login_verify.assert_not_called()
+    h.session_verify.assert_not_called()
     assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == (0 if missing else 1)
     assert sqlite_session.scalar(select(func.count()).select_from(WorkflowRun)) == 0
     assert sqlite_session.scalar(select(func.count()).select_from(Message)) == 0
@@ -213,24 +250,31 @@ def test_all_bootstrap_routes_share_404_before_user_or_metadata_side_effects(
 
 @pytest.mark.parametrize("route", ROUTES)
 def test_published_bootstrap_remains_successful_with_normal_passport_behavior(
-    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    route: str,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
-    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    h = _harness(
+        sqlite_session, sqlite_session_factory, monkeypatch, mocker, account_application_services, published=True
+    )
     response = h.client.get("/api" + route, headers={"X-App-Code": "fixture-code"})
     assert response.status_code == 200
     if route.startswith("/passport"):
         assert response.get_json() == {"access_token": "new-passport"}
-        h.tokens.issue.assert_called_once()
+        h.issue.assert_called_once()
         assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == 2
     else:
-        h.tokens.issue.assert_not_called()
+        h.issue.assert_not_called()
         assert sqlite_session.scalar(select(func.count()).select_from(EndUser)) == 1
         if route.startswith("/webapp"):
             assert response.get_json() == {"accessMode": "public"}
         elif route.startswith("/login"):
             assert response.get_json() == {"logged_in": True, "app_logged_in": True}
-            h.app_sessions.verify.assert_called_once_with(token="old-passport", app_code="fixture-code", user_id=None)
-            assert h.login_tokens.method_calls == []
+            h.session_verify.assert_called_once_with(token="old-passport", app_code="fixture-code", user_id=None)
+            h.login_verify.assert_not_called()
         elif route == "/site":
             assert response.get_json()["site"]["title"] == "Must not leak"
         elif route == "/meta":
@@ -241,9 +285,16 @@ def test_published_bootstrap_remains_successful_with_normal_passport_behavior(
 
 @pytest.mark.parametrize("route", ["/site", "/meta", "/parameters"])
 def test_old_passport_cannot_read_metadata_after_published_version_is_removed(
-    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    route: str,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
-    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    h = _harness(
+        sqlite_session, sqlite_session_factory, monkeypatch, mocker, account_application_services, published=True
+    )
     assert h.access_repo.is_app_available(h.app.id)
     h.app.workflow_id = None
     sqlite_session.commit()
@@ -253,8 +304,7 @@ def test_old_passport_cannot_read_metadata_after_published_version_is_removed(
     assert response.status_code == 404
     assert response.get_json()["code"] == "app_not_found"
     assert response.get_json()["client_ip"] == "203.0.113.42"
-    assert h.services.app_definitions.method_calls == []
-    assert h.services.web_app_runtime.method_calls == []
+    assert all(call.call_count == 0 for call in h.metadata_calls)
 
 
 @pytest.mark.parametrize("changed_owner", ["site-app", "end-user-app", "end-user-tenant"])
@@ -262,9 +312,13 @@ def test_old_passport_cannot_cross_persisted_app_or_tenant_owner_chain(
     sqlite_session: Session,
     sqlite_session_factory: sessionmaker[Session],
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
     changed_owner: str,
 ) -> None:
-    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=True)
+    h = _harness(
+        sqlite_session, sqlite_session_factory, monkeypatch, mocker, account_application_services, published=True
+    )
     if changed_owner == "site-app":
         persisted_site = sqlite_session.scalar(select(Site).where(Site.app_id == h.app.id))
         assert persisted_site is not None
@@ -277,28 +331,28 @@ def test_old_passport_cannot_cross_persisted_app_or_tenant_owner_chain(
     response = h.client.get("/api/site", headers={"X-App-Code": "fixture-code"})
     assert response.status_code == 404
     assert response.get_json()["code"] == "app_not_found"
-    assert h.services.web_app_runtime.method_calls == []
+    assert all(call.call_count == 0 for call in h.metadata_calls)
 
 
 @pytest.mark.parametrize("route", ROUTES)
 def test_real_database_failure_is_not_reclassified_as_unpublished(
-    sqlite_session: Session, sqlite_session_factory: sessionmaker[Session], monkeypatch: pytest.MonkeyPatch, route: str
+    sqlite_session: Session,
+    sqlite_session_factory: sessionmaker[Session],
+    monkeypatch: pytest.MonkeyPatch,
+    route: str,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
-    h = _harness(sqlite_session, sqlite_session_factory, monkeypatch, published=False)
-    failing_session = MagicMock()
+    h = _harness(
+        sqlite_session, sqlite_session_factory, monkeypatch, mocker, account_application_services, published=False
+    )
     failure = OperationalError("select", {}, RuntimeError("database unavailable"))
-    failing_session.__enter__.return_value.scalar.side_effect = failure
-    failing_session.__enter__.return_value.execute.side_effect = failure
-    failing_factory = MagicMock(return_value=failing_session)
-    h.access_repo._session_factory = failing_factory
-    h.passport_repo._session_factory = failing_factory
-    from repositories import web_passport_repository
-
-    monkeypatch.setattr(web_passport_repository.global_session_factory, "create_session", failing_factory)
+    mocker.patch.object(Session, "scalar", side_effect=failure)
+    mocker.patch.object(Session, "execute", side_effect=failure)
     response = h.client.get("/api" + route, headers={"X-App-Code": "fixture-code"})
     assert response.status_code == (503 if route.startswith(("/webapp", "/login")) else 500)
     assert response.get_json()["code"] != "app_not_found"
     assert "client_ip" not in response.get_json()
-    h.tokens.issue.assert_not_called()
-    assert h.login_tokens.method_calls == []
-    h.app_sessions.verify.assert_not_called()
+    h.issue.assert_not_called()
+    h.login_verify.assert_not_called()
+    h.session_verify.assert_not_called()
diff --git a/api/tests/unit_tests/controllers/web/test_site.py b/api/tests/unit_tests/controllers/web/test_site.py
index f55b4ff79d5bfa..246ac935bf769c 100644
--- a/api/tests/unit_tests/controllers/web/test_site.py
+++ b/api/tests/unit_tests/controllers/web/test_site.py
@@ -3,12 +3,15 @@
 
 import pytest
 from flask import Blueprint, Flask
+from pytest_mock import MockerFixture
 from werkzeug.exceptions import Forbidden, ServiceUnavailable
 
 from controllers.common.app_access_error import register_app_access_error_metadata
 from controllers.web import site as site_module
 from controllers.web.error import WebAppNotFoundError
+from extensions.ext_application_services import ApplicationServices
 from libs.external_api import ExternalApi
+from models.model import App, EndUser
 from services.app_definition_query_service import AppSiteConfiguration
 from services.web_app_runtime_query_service import (
     WebAppBootstrap,
@@ -100,7 +103,11 @@ def test_app_site_api_maps_unavailable_runtime_to_app_not_found() -> None:
     ],
 )
 def test_site_final_response_only_reclassifies_terminal_runtime_failure(
-    failure: Exception, status: int, monkeypatch: pytest.MonkeyPatch
+    failure: Exception,
+    status: int,
+    monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
     from controllers.web import wraps
 
@@ -111,15 +118,14 @@ def test_site_final_response_only_reclassifies_terminal_runtime_failure(
     api = ExternalApi(bp)
     api.add_resource(site_module.AppSiteApi, "/site")
     app.register_blueprint(bp)
-    runtime = MagicMock()
-    runtime.get_bootstrap.side_effect = failure
-    monkeypatch.setattr(site_module, "application_services", lambda: SimpleNamespace(web_app_runtime=runtime))
+    mocker.patch.object(account_application_services.web_app_runtime, "get_bootstrap", side_effect=failure)
+    monkeypatch.setattr(site_module, "application_services", lambda: account_application_services)
     monkeypatch.setattr(
         wraps,
         "decode_jwt_token",
         lambda: (
-            SimpleNamespace(id="fixture-app"),
-            SimpleNamespace(id="fixture-user", tenant_id="fixture-tenant", type="browser"),
+            App(id="fixture-app"),
+            EndUser(id="fixture-user", tenant_id="fixture-tenant", type="browser"),
         ),
     )
     apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
diff --git a/api/tests/unit_tests/controllers/web/test_web_login.py b/api/tests/unit_tests/controllers/web/test_web_login.py
index dba3956152f91b..62c1d39249861a 100644
--- a/api/tests/unit_tests/controllers/web/test_web_login.py
+++ b/api/tests/unit_tests/controllers/web/test_web_login.py
@@ -3,11 +3,11 @@
 from dataclasses import dataclass
 from inspect import unwrap
 from typing import override
-from unittest.mock import MagicMock
 
 import pytest
 from flask import Flask, Response
 from flask_restx import Api
+from pytest_mock import MockerFixture
 from sqlalchemy import func, select, text
 from sqlalchemy.orm import Session, sessionmaker
 
@@ -26,20 +26,18 @@
     LoginStatusQuery,
     LogoutApi,
 )
+from extensions.ext_application_services import ApplicationServices
 from machinery.context import RequestContext
 from models.enums import CustomizeTokenStrategy
 from models.model import App, AppModelConfig, EndUser, Site
-from repositories.webapp_access_query_repository import WebAppAccessQueryRepository
 from services.entities.authentication_entities import WebLoginStatus
 from services.web_authentication_service import (
     WebAccountBannedError,
     WebAuthenticationFailedError,
-    WebAuthenticationService,
     WebInvalidCodeError,
 )
 from services.webapp_access_query_service import (
     WebAppAccessAppNotFoundError,
-    WebAppAccessQueryService,
     WebAppAccessUnavailableError,
 )
 from tests.unit_tests.config_override import apply_config_overrides
@@ -186,6 +184,8 @@ def test_unavailable_identity_is_canonical_404_before_authentication(
     app: Flask,
     sqlite_session_factory: sessionmaker[Session],
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
     """Keep the IP-access contract across the new Web authentication service boundary."""
     from controllers.web import bp
@@ -224,26 +224,11 @@ def test_unavailable_identity_is_canonical_404_before_authentication(
         elif condition == "app-status-disabled":
             session.execute(text("UPDATE apps SET status='disabled' WHERE id=:app_id"), {"app_id": app_id})
 
-    policy = MagicMock()
-    tokens = MagicMock()
-    app_sessions = MagicMock()
-    access = WebAppAccessQueryService(
-        access=WebAppAccessQueryRepository(session_factory=sqlite_session_factory),
-        policy=policy,
-        webapp_auth_enabled=False,
-        get_access_modes=MagicMock(),
-        get_user_permissions=MagicMock(),
-    )
-    service = WebAuthenticationService(
-        accounts=MagicMock(),
-        passwords=MagicMock(),
-        tokens=tokens,
-        security=MagicMock(),
-        app_access=access,
-        app_sessions=app_sessions,
-        audit=MagicMock(),
-        private_app_access_enabled=False,
-    )
+    access = account_application_services.webapp_access
+    service = account_application_services.web_authentication
+    mode_lookup = mocker.spy(access._policy, "get_access_mode")
+    token_verify = mocker.spy(service._tokens, "verify_access_token")
+    session_verify = mocker.spy(service._app_sessions, "verify")
     bind_service(monkeypatch, service)
     monkeypatch.setattr(console_wraps, "_is_setup_completed", lambda: True)
     apply_config_overrides(monkeypatch, NETWORK_ACCESS_TRUSTED_PROXY_CIDRS="172.18.0.0/16")
@@ -258,9 +243,9 @@ def test_unavailable_identity_is_canonical_404_before_authentication(
     )
     assert response.headers["Content-Type"] == "application/json"
     assert response.headers["Cache-Control"] == "no-store"
-    policy.get_access_mode.assert_not_called()
-    tokens.verify_access_token.assert_not_called()
-    app_sessions.verify.assert_not_called()
+    mode_lookup.assert_not_called()
+    token_verify.assert_not_called()
+    session_verify.assert_not_called()
     with sqlite_session_factory() as session:
         assert session.scalar(select(func.count()).select_from(EndUser)) == 0
 
diff --git a/api/tests/unit_tests/repositories/test_network_access_group_repository.py b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
index 0e62ebf17b5bc0..11d82d88d51592 100644
--- a/api/tests/unit_tests/repositories/test_network_access_group_repository.py
+++ b/api/tests/unit_tests/repositories/test_network_access_group_repository.py
@@ -1,4 +1,4 @@
-from unittest.mock import MagicMock
+from unittest.mock import patch
 
 import pytest
 from sqlalchemy import event, text
@@ -239,10 +239,9 @@ def record_agent_select(_conn, _cursor, statement: str, _parameters, _context, _
     assert len(agent_selects) == 1
 
 
-def test_list_apps_maps_database_failures_to_query_error() -> None:
-    session_factory = MagicMock()
-    session = session_factory.return_value.__enter__.return_value
-    session.scalars.side_effect = SQLAlchemyError("database unavailable")
-
-    with pytest.raises(NetworkAccessGroupAppQueryError):
-        _repository(session_factory).list_apps(workspace_id=_WORKSPACE_ID, app_ids=[_APP_ID])
+def test_list_apps_maps_database_failures_to_query_error(sqlite_session_factory: sessionmaker[Session]) -> None:
+    with (
+        patch.object(Session, "scalars", side_effect=SQLAlchemyError("database unavailable")),
+        pytest.raises(NetworkAccessGroupAppQueryError),
+    ):
+        _repository(sqlite_session_factory).list_apps(workspace_id=_WORKSPACE_ID, app_ids=[_APP_ID])
diff --git a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
index 4ef0b59849e087..dc3adc6f325ec9 100644
--- a/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
+++ b/api/tests/unit_tests/repositories/test_webapp_access_query_repository.py
@@ -1,4 +1,4 @@
-from unittest.mock import MagicMock
+from unittest.mock import MagicMock, patch
 
 import pytest
 from sqlalchemy import Engine, event, select
@@ -255,25 +255,26 @@ def test_find_active_session_rejects_missing_records(
     assert repository.find_active_session(app_id=app_id, app_code=app_code, end_user_id=end_user_id) is None
 
 
-def test_find_app_id_by_code_maps_database_failures_to_unavailable() -> None:
+def test_find_app_id_by_code_maps_database_failures_to_unavailable(
+    sqlite_session_factory: sessionmaker[Session],
+) -> None:
     database_error = OperationalError("select", {}, RuntimeError("connection failed"))
-    session = MagicMock()
-    session.__enter__.return_value.scalar.side_effect = database_error
-    repository = WebAppAccessQueryRepository(session_factory=MagicMock(return_value=session))
+    repository = WebAppAccessQueryRepository(session_factory=sqlite_session_factory)
 
-    with pytest.raises(WebAppAccessUnavailableError) as raised:
+    with (
+        patch.object(Session, "scalar", side_effect=database_error),
+        pytest.raises(WebAppAccessUnavailableError) as raised,
+    ):
         repository.find_app_id_by_code("site-code")
 
     assert raised.value.__cause__ is database_error
 
 
-def test_find_app_id_by_code_does_not_hide_unknown_errors() -> None:
+def test_find_app_id_by_code_does_not_hide_unknown_errors(sqlite_session_factory: sessionmaker[Session]) -> None:
     failure = TypeError("repository bug")
-    session = MagicMock()
-    session.__enter__.return_value.scalar.side_effect = failure
-    repository = WebAppAccessQueryRepository(session_factory=MagicMock(return_value=session))
+    repository = WebAppAccessQueryRepository(session_factory=sqlite_session_factory)
 
-    with pytest.raises(TypeError) as raised:
+    with patch.object(Session, "scalar", side_effect=failure), pytest.raises(TypeError) as raised:
         repository.find_app_id_by_code("site-code")
 
     assert raised.value is failure
diff --git a/api/tests/unit_tests/services/test_network_access_group_gateway.py b/api/tests/unit_tests/services/test_network_access_group_gateway.py
index 7d7a9f42b31d62..2549c29da06eab 100644
--- a/api/tests/unit_tests/services/test_network_access_group_gateway.py
+++ b/api/tests/unit_tests/services/test_network_access_group_gateway.py
@@ -1,6 +1,6 @@
 from collections.abc import Callable, Generator
 from typing import Protocol, cast, override
-from unittest.mock import MagicMock, call, patch
+from unittest.mock import call, patch
 
 import httpx
 import pytest
@@ -53,7 +53,7 @@ class RecordingHTTPClient(httpx.Client):
     """Exercise httpx serialization while keeping all requests inside MockTransport."""
 
     def __init__(self) -> None:
-        self.response: httpx.Response | MagicMock = httpx.Response(200, json={})
+        self.response = httpx.Response(200, json={})
         self.request_calls: list[object] = []
         self.wire_requests: list[httpx.Request] = []
         super().__init__(
@@ -69,11 +69,7 @@ def request(self, *args: object, **kwargs: object) -> httpx.Response:
 
     def _respond(self, request: httpx.Request) -> httpx.Response:
         self.wire_requests.append(request)
-        if isinstance(self.response, httpx.Response):
-            return httpx.Response(
-                self.response.status_code, content=self.response.content, headers=self.response.headers
-            )
-        return httpx.Response(self.response.status_code, json=self.response.json())
+        return httpx.Response(self.response.status_code, content=self.response.content, headers=self.response.headers)
 
 
 class GatewayFactory(Protocol):
@@ -111,8 +107,7 @@ def create(
 
 def test_network_access_requests_use_independent_api_url_when_configured(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory()
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
+    response = httpx.Response(httpx.codes.OK, json={"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()})
     http_client.response = response
 
     gateway.list_groups(TENANT_ID, ACCOUNT_ID)
@@ -131,8 +126,7 @@ def test_network_access_requests_use_independent_api_url_when_configured(gateway
 
 def test_network_access_requests_fall_back_to_billing_api_url(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory(base_url="")
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()}
+    response = httpx.Response(httpx.codes.OK, json={"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()})
     http_client.response = response
 
     gateway.list_groups(TENANT_ID, ACCOUNT_ID)
@@ -181,14 +175,9 @@ def test_injected_http_client_keeps_timeout_and_remains_reusable(gateway_factory
 
 def test_group_list_and_item_reads_use_authenticated_saas_endpoints(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory(base_url="")
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.side_effect = [
-        {"tenant_id": TENANT_ID, "entitled": True, "groups": list[object]()},
-        {"group": _group_wire()},
-    ]
-    http_client.response = response
-
+    http_client.response = httpx.Response(200, json={"tenant_id": TENANT_ID, "entitled": True, "groups": []})
     list_result = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
+    http_client.response = httpx.Response(200, json={"group": _group_wire()})
     item_result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
 
     assert list_result.groups == ()
@@ -215,14 +204,7 @@ def test_group_list_and_item_reads_use_authenticated_saas_endpoints(gateway_fact
 
 def test_group_mutations_inject_actor_and_use_expected_version(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory(base_url="")
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.side_effect = [
-        {"group": _group_wire(version="1")},
-        {"group": _group_wire(version="2")},
-        {"deleted": True},
-    ]
-    http_client.response = response
-
+    http_client.response = httpx.Response(200, json={"group": _group_wire(version="1")})
     gateway.create_group(
         TENANT_ID,
         name="Office",
@@ -230,6 +212,7 @@ def test_group_mutations_inject_actor_and_use_expected_version(gateway_factory:
         allowed_cidrs=["203.0.113.7/32"],
         actor_account_id=ACCOUNT_ID,
     )
+    http_client.response = httpx.Response(200, json={"group": _group_wire(version="2")})
     gateway.update_group(
         TENANT_ID,
         GROUP_ID,
@@ -239,6 +222,7 @@ def test_group_mutations_inject_actor_and_use_expected_version(gateway_factory:
         expected_version=1,
         actor_account_id=ACCOUNT_ID,
     )
+    http_client.response = httpx.Response(200, json={"deleted": True})
     gateway.delete_group(
         TENANT_ID,
         GROUP_ID,
@@ -287,23 +271,18 @@ def test_group_mutations_inject_actor_and_use_expected_version(gateway_factory:
 
 def test_app_config_read_and_atomic_write_use_tenant_and_app_path(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory(base_url="")
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.side_effect = [
-        {"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None},
-        {
+    http_client.response = httpx.Response(
+        200, json={"tenant_id": TENANT_ID, "app_id": APP_ID, "entitled": True, "binding": None}
+    )
+    gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+    http_client.response = httpx.Response(
+        200,
+        json={
             "binding": _binding_wire(
                 enabled=True, group_id=GROUP_ID, access_points=["webapp", "service_api"], version="1"
             )
         },
-        {
-            "binding": _binding_wire(
-                enabled=False, group_id=GROUP_ID, access_points=["webapp", "service_api"], version="2"
-            )
-        },
-    ]
-    http_client.response = response
-
-    gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
+    )
     gateway.update_app_binding(
         TENANT_ID,
         APP_ID,
@@ -313,6 +292,14 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path(gateway_factor
         expected_version=0,
         actor_account_id=ACCOUNT_ID,
     )
+    http_client.response = httpx.Response(
+        200,
+        json={
+            "binding": _binding_wire(
+                enabled=False, group_id=GROUP_ID, access_points=["webapp", "service_api"], version="2"
+            )
+        },
+    )
     gateway.update_app_binding(
         TENANT_ID,
         APP_ID,
@@ -366,8 +353,7 @@ def test_app_config_read_and_atomic_write_use_tenant_and_app_path(gateway_factor
 
 def test_app_lifecycle_cleanup_uses_internal_secret_endpoint(gateway_factory: GatewayFactory) -> None:
     gateway, http_client = gateway_factory(base_url="")
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = {"deleted": True}
+    response = httpx.Response(httpx.codes.OK, json={"deleted": True})
     http_client.response = response
 
     result = gateway.cleanup_app_binding(TENANT_ID, APP_ID)
@@ -390,7 +376,7 @@ def test_network_access_group_request_preserves_upstream_status(
     status_code: int, gateway_factory: GatewayFactory
 ) -> None:
     gateway, _ = gateway_factory()
-    response = MagicMock(status_code=status_code)
+    response = httpx.Response(status_code)
     with (
         patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
@@ -402,8 +388,9 @@ def test_network_access_group_request_preserves_upstream_status(
 
 def test_network_access_group_request_preserves_upstream_reason(gateway_factory: GatewayFactory) -> None:
     gateway, _ = gateway_factory()
-    response = MagicMock(status_code=httpx.codes.CONFLICT)
-    response.json.return_value = {"code": 409, "reason": "NETWORK_ACCESS_VERSION_CONFLICT", "message": "internal"}
+    response = httpx.Response(
+        httpx.codes.CONFLICT, json={"code": 409, "reason": "NETWORK_ACCESS_VERSION_CONFLICT", "message": "internal"}
+    )
     with (
         patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupUpstreamError) as exc_info,
@@ -434,8 +421,7 @@ def test_network_access_group_request_maps_transport_failure_to_service_unavaila
 
 def test_network_access_group_request_rejects_non_object_response(gateway_factory: GatewayFactory) -> None:
     gateway, _ = gateway_factory()
-    response = MagicMock(status_code=httpx.codes.OK)
-    response.json.return_value = list[object]()
+    response = httpx.Response(httpx.codes.OK, json=list[object]())
     with (
         patch.object(gateway, "_send_http_request", return_value=response),
         pytest.raises(NetworkAccessGroupInvalidResponseError),
@@ -517,15 +503,13 @@ def test_billing_entitlement_gateway_does_not_mask_unexpected_value_error() -> N
 
 def test_protojson_defaults_are_materialized_before_service_boundary(gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    client.response = response
-    response.json.return_value = {"tenantId": TENANT_ID}
+    client.response = httpx.Response(200, json={"tenantId": TENANT_ID})
     groups = gateway.list_groups(TENANT_ID, ACCOUNT_ID)
     assert groups.entitled is False
     assert groups.groups == ()
 
     for binding in (None, _binding_wire()):
-        response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID, "binding": binding}
+        client.response = httpx.Response(200, json={"tenantId": TENANT_ID, "appId": APP_ID, "binding": binding})
         result = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
         assert result.entitled is False
         assert result.effective_enabled is False
@@ -537,9 +521,9 @@ def test_protojson_defaults_are_materialized_before_service_boundary(gateway_fac
             assert result.binding.access_points == ()
             assert result.binding.group_id is None
 
-    response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID}
+    client.response = httpx.Response(200, json={"tenantId": TENANT_ID, "appId": APP_ID})
     assert gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding is None
-    response.json.return_value = dict[str, object]()
+    client.response = httpx.Response(200, json={})
     assert gateway.cleanup_app_binding(TENANT_ID, APP_ID) is False
 
 
@@ -555,8 +539,7 @@ def test_policy_protojson_aliases_and_count_defaults_are_decoded_once(gateway_fa
         "createdAt": "2026-09-01T00:00:00Z",
         "updatedAt": "2026-09-01T00:00:00Z",
     }
-    response = MagicMock(status_code=200)
-    response.json.return_value = {"group": wire}
+    response = httpx.Response(200, json={"group": wire})
     client.response = response
     result = gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
     assert result.version == 9007199254740993
@@ -575,8 +558,9 @@ def test_binding_policy_aliases_and_nullable_references(
     alias: str, group_id: str | None, gateway_factory: GatewayFactory
 ) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = {"tenantId": TENANT_ID, "appId": APP_ID, "binding": _binding_wire(**{alias: group_id})}
+    response = httpx.Response(
+        200, json={"tenantId": TENANT_ID, "appId": APP_ID, "binding": _binding_wire(**{alias: group_id})}
+    )
     client.response = response
     binding = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding
     assert binding is not None
@@ -586,11 +570,13 @@ def test_binding_policy_aliases_and_nullable_references(
 def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload(gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
     scopes = ["webapp", "future_scope", "trigger"]
-    response = MagicMock(status_code=200)
-    response.json.return_value = {
-        "effectiveEnabled": True,
-        "binding": _binding_wire(enabled=True, policyId=GROUP_ID, accessPoints=scopes),
-    }
+    response = httpx.Response(
+        200,
+        json={
+            "effectiveEnabled": True,
+            "binding": _binding_wire(enabled=True, policyId=GROUP_ID, accessPoints=scopes),
+        },
+    )
     client.response = response
     result = gateway.update_app_binding(
         TENANT_ID,
@@ -611,8 +597,7 @@ def test_unknown_scopes_reach_service_without_aliases_or_mutable_payload(gateway
 @pytest.mark.parametrize("value", [True, False, 1.0, "1.5", "invalid", 0, -1, 2**63, str(2**63)])
 def test_invalid_versions_are_rejected_at_gateway(value: object, gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = {"group": _group_wire(version=value)}
+    response = httpx.Response(200, json={"group": _group_wire(version=value)})
     client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
@@ -621,8 +606,7 @@ def test_invalid_versions_are_rejected_at_gateway(value: object, gateway_factory
 @pytest.mark.parametrize("version", [1, "1", 2**63 - 1, str(2**63 - 1)])
 def test_int64_versions_do_not_lose_precision(version: int | str, gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = {"group": _group_wire(version=version)}
+    response = httpx.Response(200, json={"group": _group_wire(version=version)})
     client.response = response
     assert gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID).version == int(version)
 
@@ -634,8 +618,7 @@ def test_wire_flags_are_strict_booleans(field: str, value: object, gateway_facto
     binding = _binding_wire()
     payload: dict[str, object] = {"tenant_id": TENANT_ID, "app_id": APP_ID, "binding": binding}
     (binding if field == "enabled" else payload)[field] = value
-    response = MagicMock(status_code=200)
-    response.json.return_value = payload
+    response = httpx.Response(200, json=payload)
     client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
@@ -644,16 +627,25 @@ def test_wire_flags_are_strict_booleans(field: str, value: object, gateway_facto
 @pytest.mark.parametrize("alias", ["groupId", "policy_id", "policyId"])
 def test_conflicting_policy_aliases_fail_instead_of_selecting_one(alias: str, gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = {
-        "tenant_id": TENANT_ID,
-        "app_id": APP_ID,
-        "binding": _binding_wire(group_id=GROUP_ID, **{alias: APP_ID}),
-    }
+    response = httpx.Response(
+        200,
+        json={
+            "tenant_id": TENANT_ID,
+            "app_id": APP_ID,
+            "binding": _binding_wire(group_id=GROUP_ID, **{alias: APP_ID}),
+        },
+    )
     client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID)
-    response.json.return_value["binding"][alias] = GROUP_ID
+    client.response = httpx.Response(
+        200,
+        json={
+            "tenant_id": TENANT_ID,
+            "app_id": APP_ID,
+            "binding": _binding_wire(group_id=GROUP_ID, **{alias: GROUP_ID}),
+        },
+    )
     binding = gateway.get_app_binding(TENANT_ID, APP_ID, ACCOUNT_ID).binding
     assert binding is not None
     assert binding.group_id == GROUP_ID
@@ -664,8 +656,7 @@ def test_existing_policy_identity_fields_are_never_fabricated(
     payload: dict[str, object], gateway_factory: GatewayFactory
 ) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = payload
+    response = httpx.Response(200, json=payload)
     client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
@@ -675,8 +666,7 @@ def test_existing_policy_identity_fields_are_never_fabricated(
 @pytest.mark.parametrize("value", [True, 0.0, "0.5", -1])
 def test_invalid_policy_counts_are_rejected(field: str, value: object, gateway_factory: GatewayFactory) -> None:
     gateway, client = gateway_factory()
-    response = MagicMock(status_code=200)
-    response.json.return_value = {"group": _group_wire(**{field: value})}
+    response = httpx.Response(200, json={"group": _group_wire(**{field: value})})
     client.response = response
     with pytest.raises(NetworkAccessGroupInvalidResponseError):
         gateway.get_group(TENANT_ID, GROUP_ID, ACCOUNT_ID)
diff --git a/api/tests/unit_tests/services/test_network_access_group_service.py b/api/tests/unit_tests/services/test_network_access_group_service.py
index faeef4644c6193..26e32da620b01c 100644
--- a/api/tests/unit_tests/services/test_network_access_group_service.py
+++ b/api/tests/unit_tests/services/test_network_access_group_service.py
@@ -764,15 +764,17 @@ def test_current_ip_read_needs_no_policy_and_preserves_read_admission(role: str,
     harness.entitlement.is_paid_plan.assert_not_called()
 
 
+def _unexpected_client_ip_read() -> str:
+    pytest.fail("Client IP must not be read before role and policy admission")
+
+
 @pytest.mark.parametrize("role", ["normal", "dataset_operator", "unknown", None])
 def test_current_ip_read_rejects_disallowed_persisted_roles_before_reading_ip(role: str | None) -> None:
     harness = _harness(role=role)
-    supplier = MagicMock(return_value="203.0.113.7")
 
     with pytest.raises(NetworkAccessGroupAccessDeniedError):
-        harness.service.get_current_ip(_context(), client_ip_supplier=supplier)
+        harness.service.get_current_ip(_context(), client_ip_supplier=_unexpected_client_ip_read)
 
-    supplier.assert_not_called()
     assert harness.control_plane.method_calls == []
     assert harness.apps.method_calls == []
     harness.entitlement.is_paid_plan.assert_not_called()
@@ -781,24 +783,19 @@ def test_current_ip_read_rejects_disallowed_persisted_roles_before_reading_ip(ro
 @pytest.mark.parametrize("role", ["normal", "dataset_operator", None])
 def test_current_ip_check_rejects_role_before_policy_or_ip_lookup(role: str | None) -> None:
     harness = _harness(role=role)
-    supplier = MagicMock(return_value="203.0.113.7")
 
     with pytest.raises(NetworkAccessGroupAccessDeniedError):
-        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=supplier)
+        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=_unexpected_client_ip_read)
 
     harness.control_plane.get_group.assert_not_called()
-    supplier.assert_not_called()
 
 
 def test_current_ip_check_does_not_read_ip_when_tenant_scoped_policy_lookup_fails() -> None:
     harness = _harness(role="admin")
     harness.control_plane.get_group.side_effect = NetworkAccessGroupUpstreamError(404)
-    supplier = MagicMock(return_value="203.0.113.7")
 
     with pytest.raises(NetworkAccessGroupUpstreamError):
-        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=supplier)
-
-    supplier.assert_not_called()
+        harness.service.check_current_ip(_context(), group_id=GROUP_ID, client_ip_supplier=_unexpected_client_ip_read)
 
 
 @pytest.mark.parametrize(
diff --git a/api/tests/unit_tests/services/test_webapp_access_query_service.py b/api/tests/unit_tests/services/test_webapp_access_query_service.py
index 1b07e7eff08925..9212883b9ecd26 100644
--- a/api/tests/unit_tests/services/test_webapp_access_query_service.py
+++ b/api/tests/unit_tests/services/test_webapp_access_query_service.py
@@ -102,6 +102,18 @@ def test_disabled_auth_returns_public_before_resolving_app() -> None:
     assert fixture.policy.access_mode_calls == []
 
 
+@pytest.mark.parametrize("enabled", [True, False])
+def test_management_reads_configured_policy_without_publication_admission(enabled: bool) -> None:
+    fixture = _service(access=AccessQueryStub(available=False), enabled=enabled)
+
+    result = fixture.service.get_configured_access_mode(app_id="draft-app")
+
+    assert result is (WebAppAccessMode.PRIVATE if enabled else WebAppAccessMode.PUBLIC)
+    assert fixture.access.calls == []
+    assert fixture.access.availability_calls == []
+    assert fixture.policy.access_mode_calls == (["draft-app"] if enabled else [])
+
+
 @pytest.mark.parametrize("enabled", [True, False])
 @pytest.mark.parametrize("reference", ["code", "id"])
 def test_public_identity_resolution_does_not_load_authentication_settings(enabled: bool, reference: str) -> None:
diff --git a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
index c88a2817f50905..434997871a3094 100644
--- a/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
+++ b/api/tests/unit_tests/tasks/test_remove_app_and_related_data_task.py
@@ -2,15 +2,16 @@
 from collections.abc import Iterator, Sequence
 from contextlib import AbstractContextManager
 from datetime import UTC, datetime
-from types import SimpleNamespace
 from unittest.mock import MagicMock, call, patch
 from uuid import uuid4
 
 import pytest
+from pytest_mock import MockerFixture
 from sqlalchemy.orm import Session
 
 import tasks.remove_app_and_related_data_task as remove_app_task_module
 from enums import DeploymentEdition
+from extensions.ext_application_services import ApplicationServices
 from graphon.enums import WorkflowExecutionStatus
 from libs.archive_storage import ArchiveStorageNotConfiguredError
 from models import AppStar
@@ -124,13 +125,13 @@ def test_app_cleanup_removes_agent_bindings_before_workflows(monkeypatch: pytest
     delete_workflows.assert_called_once_with("tenant-1", "app-1")
 
 
-def test_cloud_app_cleanup_schedules_independent_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
-    apply_async = MagicMock()
+def test_cloud_app_cleanup_schedules_independent_binding_cleanup(
+    monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture
+) -> None:
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(
+    apply_async = mocker.patch.object(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
-        apply_async,
     )
 
     remove_app_task_module._schedule_app_network_access_group_binding_cleanup("tenant-1", "app-1")
@@ -141,13 +142,13 @@ def test_cloud_app_cleanup_schedules_independent_binding_cleanup(monkeypatch: py
     )
 
 
-def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: pytest.MonkeyPatch) -> None:
-    apply_async = MagicMock()
+def test_community_app_cleanup_does_not_schedule_binding_cleanup(
+    monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture
+) -> None:
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.COMMUNITY)
-    monkeypatch.setattr(
+    apply_async = mocker.patch.object(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
-        apply_async,
     )
 
     remove_app_task_module._schedule_app_network_access_group_binding_cleanup("tenant-1", "app-1")
@@ -155,39 +156,46 @@ def test_community_app_cleanup_does_not_schedule_binding_cleanup(monkeypatch: py
     apply_async.assert_not_called()
 
 
-def test_independent_binding_cleanup_task_succeeds(monkeypatch: pytest.MonkeyPatch) -> None:
-    service = MagicMock()
-    service.cleanup_app_binding.return_value = True
+def test_independent_binding_cleanup_task_succeeds(
+    monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture, account_application_services: ApplicationServices
+) -> None:
+    cleanup_binding = mocker.patch.object(
+        account_application_services.network_access_groups, "cleanup_app_binding", return_value=True
+    )
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
 
     with patch(
         "extensions.ext_application_services.application_services",
-        return_value=SimpleNamespace(network_access_groups=service),
+        return_value=account_application_services,
     ):
         remove_app_task_module.cleanup_app_network_access_group_binding_task.run(
             tenant_id="tenant-1",
             app_id="app-1",
         )
 
-    service.cleanup_app_binding.assert_called_once_with(workspace_id="tenant-1", app_id="app-1")
+    cleanup_binding.assert_called_once_with(workspace_id="tenant-1", app_id="app-1")
     assert remove_app_task_module.cleanup_app_network_access_group_binding_task.max_retries == 24
 
 
 def test_independent_binding_cleanup_task_retries_with_exponential_backoff(
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
+    account_application_services: ApplicationServices,
 ) -> None:
     upstream_error = NetworkAccessGroupUpstreamError(409, "NETWORK_ACCESS_APP_STILL_EXISTS")
     retry_error = RuntimeError("retry scheduled")
-    retry = MagicMock(side_effect=retry_error)
-    service = MagicMock()
-    service.cleanup_app_binding.side_effect = upstream_error
+    mocker.patch.object(
+        account_application_services.network_access_groups, "cleanup_app_binding", side_effect=upstream_error
+    )
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(remove_app_task_module.cleanup_app_network_access_group_binding_task, "retry", retry)
+    retry = mocker.patch.object(
+        remove_app_task_module.cleanup_app_network_access_group_binding_task, "retry", side_effect=retry_error
+    )
 
     with (
         patch(
             "extensions.ext_application_services.application_services",
-            return_value=SimpleNamespace(network_access_groups=service),
+            return_value=account_application_services,
         ),
         pytest.raises(RuntimeError, match="retry scheduled"),
     ):
@@ -204,19 +212,19 @@ def test_independent_binding_cleanup_task_retries_with_exponential_backoff(
 
 def test_parent_local_cleanup_failure_happens_after_binding_cleanup_is_scheduled(
     monkeypatch: pytest.MonkeyPatch,
+    mocker: MockerFixture,
 ) -> None:
     local_error = RuntimeError("local cleanup failed")
     retry_error = RuntimeError("parent retry scheduled")
-    apply_async = MagicMock()
-    retry = MagicMock(side_effect=retry_error)
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(
+    apply_async = mocker.patch.object(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
-        apply_async,
     )
-    monkeypatch.setattr(remove_app_task_module, "_delete_app_model_configs", MagicMock(side_effect=local_error))
-    monkeypatch.setattr(remove_app_task_module.remove_app_and_related_data_task, "retry", retry)
+    mocker.patch.object(remove_app_task_module, "_delete_app_model_configs", side_effect=local_error)
+    retry = mocker.patch.object(
+        remove_app_task_module.remove_app_and_related_data_task, "retry", side_effect=retry_error
+    )
 
     with pytest.raises(RuntimeError, match="parent retry scheduled"):
         remove_app_task_module.remove_app_and_related_data_task.run(tenant_id="tenant-1", app_id="app-1")
@@ -228,19 +236,21 @@ def test_parent_local_cleanup_failure_happens_after_binding_cleanup_is_scheduled
     retry.assert_called_once_with(exc=local_error, countdown=60)
 
 
-def test_parent_retries_before_local_cleanup_when_binding_schedule_fails(monkeypatch: pytest.MonkeyPatch) -> None:
+def test_parent_retries_before_local_cleanup_when_binding_schedule_fails(
+    monkeypatch: pytest.MonkeyPatch, mocker: MockerFixture
+) -> None:
     broker_error = RuntimeError("broker unavailable")
     retry_error = RuntimeError("parent retry scheduled")
-    retry = MagicMock(side_effect=retry_error)
-    first_local_cleanup = MagicMock()
     apply_config_overrides(monkeypatch, DEPLOYMENT_EDITION=DeploymentEdition.CLOUD)
-    monkeypatch.setattr(
+    mocker.patch.object(
         remove_app_task_module.cleanup_app_network_access_group_binding_task,
         "apply_async",
-        MagicMock(side_effect=broker_error),
+        side_effect=broker_error,
+    )
+    first_local_cleanup = mocker.patch.object(remove_app_task_module, "_delete_app_model_configs")
+    retry = mocker.patch.object(
+        remove_app_task_module.remove_app_and_related_data_task, "retry", side_effect=retry_error
     )
-    monkeypatch.setattr(remove_app_task_module, "_delete_app_model_configs", first_local_cleanup)
-    monkeypatch.setattr(remove_app_task_module.remove_app_and_related_data_task, "retry", retry)
 
     with pytest.raises(RuntimeError, match="parent retry scheduled"):
         remove_app_task_module.remove_app_and_related_data_task.run(tenant_id="tenant-1", app_id="app-1")
diff --git a/web/app/components/app/access-point/__tests__/environment-tabs.browser.spec.tsx b/web/app/components/app/access-point/__tests__/environment-tabs.browser.spec.tsx
index f7d7ee5cbdaed6..5a18dc76cc1491 100644
--- a/web/app/components/app/access-point/__tests__/environment-tabs.browser.spec.tsx
+++ b/web/app/components/app/access-point/__tests__/environment-tabs.browser.spec.tsx
@@ -5,6 +5,8 @@ import { page, userEvent } from 'vite-plus/test/browser'
 import { render } from 'vitest-browser-react'
 import { consoleQuery } from '@/service/console'
 import { seedAccountProfileQuery } from '@/test/console/account-profile'
+import { seedCurrentWorkspaceQuery } from '@/test/console/current-workspace'
+import { seedSystemFeatures } from '@/test/console/query-data'
 import { QueryClientTestProvider } from '@/test/console/query-provider'
 import { createAppDetailFixture } from '@/test/fixtures/app'
 import { createTestQueryClient } from '@/test/query-client'
@@ -37,6 +39,8 @@ vi.mock('@/app/components/app/access-point/deployed-environment-access-points',
 async function renderAccessPoint(names = ['test-1']) {
   const queryClient = createTestQueryClient()
   seedAccountProfileQuery(queryClient)
+  seedCurrentWorkspaceQuery(queryClient)
+  seedSystemFeatures(queryClient)
   queryClient.setQueryData(
     consoleQuery.apps.byAppId.get.queryKey({ input: { params: { app_id: 'app-1' } } }),
     createAppDetailFixture({
diff --git a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
index eed946f0d94bea..5d9147bda19f98 100644
--- a/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
+++ b/web/features/agent-v2/agent-detail/access/__tests__/page.spec.tsx
@@ -123,7 +123,7 @@ describe('Agent IP access configuration', () => {
     expect(screen.getByRole('switch', { name: 'Backend Service API' })).toBeChecked()
     expect(screen.queryByRole('switch', { name: 'MCP Server' })).not.toBeInTheDocument()
     expect(screen.queryByRole('switch', { name: 'Trigger' })).not.toBeInTheDocument()
-    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('button', { name: /Internal Network/ }))
     await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     await user.click(screen.getByRole('button', { name: 'Save' }))
 
@@ -175,7 +175,7 @@ describe('Agent IP access configuration', () => {
     const user = userEvent.setup()
     const { queryClient, rerender, renderPage } = setup()
     await user.click(await screen.findByRole('button', { name: /Access Control/ }))
-    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('button', { name: /Internal Network/ }))
     await user.click(screen.getByRole('switch', { name: 'Backend Service API' }))
 
     const second = createAgentFixture({ id: 'agent-2', app_id: 'second-app' })
@@ -202,7 +202,7 @@ describe('Agent IP access configuration', () => {
       Response.json({ allowed: false, client_ip: '203.0.113.42', policy_version: 1 }),
     )
     await user.click(screen.getByRole('button', { name: /Access Control/ }))
-    await user.click(screen.getByRole('option', { name: /Internal Network/ }))
+    await user.click(screen.getByRole('button', { name: /Internal Network/ }))
     await waitFor(() => expect(screen.getByRole('button', { name: 'Save' })).toBeEnabled())
     await user.click(screen.getByRole('button', { name: 'Save' }))
     expect(
diff --git a/web/features/app-access-error/state.ts b/web/features/app-access-error/state.ts
index 583184add298e8..0a32dc3e4715c2 100644
--- a/web/features/app-access-error/state.ts
+++ b/web/features/app-access-error/state.ts
@@ -148,7 +148,7 @@ export function getClientIp(data: unknown): string | undefined {
   return ipAddressSchema.safeParse(value).success ? value : undefined
 }
 
-export function isAppAccessErrorResponse(status: number, data: unknown, appIdentity = false) {
+function isAppAccessErrorResponse(status: number, data: unknown, appIdentity = false) {
   return (
     isIpAccessDeniedResponse(status, data) ||
     (status === 404 &&
@@ -204,7 +204,7 @@ export function captureAppAccessRequest(url: string, isPublicAPI = false, method
   }
 }
 
-export function throwIfAppAccessBlocked(scope: AppAccessScope | null) {
+function throwIfAppAccessBlocked(scope: AppAccessScope | null) {
   if (!hasAppAccessError(scope)) return
   const error = new DOMException('The app is no longer accessible.', 'AbortError')
   handledErrors.add(error)
diff --git a/web/features/network-access/analytics.ts b/web/features/network-access/analytics.ts
index 7cbf7633fb8c2f..e5d59c065f5d38 100644
--- a/web/features/network-access/analytics.ts
+++ b/web/features/network-access/analytics.ts
@@ -62,7 +62,7 @@ export type AccessControlSaveProperties = AccessControlAnalyticsContext & {
   is_current_ip_included: boolean
 }
 
-export type IpPolicySaveProperties = IpPolicyFormContext & {
+type IpPolicySaveProperties = IpPolicyFormContext & {
   mode: 'create' | 'edit'
   entry_count: number
   validation_error_types: IpPolicyValidationError[]
diff --git a/web/test/console/network-access.ts b/web/test/console/network-access.ts
index b3d584e34da145..f8c820083a8001 100644
--- a/web/test/console/network-access.ts
+++ b/web/test/console/network-access.ts
@@ -1,7 +1,4 @@
-import type {
-  AppNetworkAccessGroupResponse,
-  AppNetworkAccessGroupStatusResponse,
-} from '@dify/contracts/api/console/apps/types.gen'
+import type { AppNetworkAccessGroupResponse } from '@dify/contracts/api/console/apps/types.gen'
 import type {
   NetworkAccessGroupListResponse,
   NetworkAccessGroupResponse,
@@ -69,25 +66,3 @@ export function seedAppNetworkAccessGroup(
   )
   return data
 }
-
-export function seedAppNetworkAccessGroupStatus(
-  queryClient: QueryClient,
-  appId: string,
-  overrides: Partial<AppNetworkAccessGroupStatusResponse> = {},
-): AppNetworkAccessGroupStatusResponse {
-  const data: AppNetworkAccessGroupStatusResponse = {
-    entitled: true,
-    configured: false,
-    enabled: false,
-    covered_count: 0,
-    available_count: 3,
-    ...overrides,
-  }
-  queryClient.setQueryData(
-    consoleQuery.apps.byAppId.networkAccessGroup.status.get.queryOptions({
-      input: { params: { app_id: appId } },
-    }).queryKey,
-    data,
-  )
-  return data
-}

From 5d9d07a81ba0aa016463ed19b3bee22395e9eef4 Mon Sep 17 00:00:00 2001
From: yyh <yuanyouhuilyz@gmail.com>
Date: Tue, 20 Oct 2026 13:42:52 +0800
Subject: [PATCH 107/108] fix(web): keep error page height owned by its layout

---
 web/app/layout.tsx | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/web/app/layout.tsx b/web/app/layout.tsx
index 4479c6d0b42797..8af69ab5789966 100644
--- a/web/app/layout.tsx
+++ b/web/app/layout.tsx
@@ -72,12 +72,9 @@ export default async function RootLayout({ children }: { children: React.ReactNo
   const dehydratedState = errorDocument ? undefined : dehydrateSystemFeatures()
 
   return (
-    <html lang={locale} className={errorDocument ? 'h-full' : undefined} suppressHydrationWarning>
+    <html lang={locale} suppressHydrationWarning>
       <head>{!errorDocument && <ReactScanLoader />}</head>
-      <body
-        className={errorDocument ? 'h-full bg-background-body' : 'bg-background-body'}
-        {...datasetMap}
-      >
+      <body className="bg-background-body" {...datasetMap}>
         {!errorDocument && <CloudAnalytics />}
         <div className="isolate">
           <JotaiProvider>

From db6c466f0589e33900442ff9795c3f67919ab650 Mon Sep 17 00:00:00 2001
From: yyh <yuanyouhuilyz@gmail.com>
Date: Tue, 20 Oct 2026 13:44:42 +0800
Subject: [PATCH 108/108] docs(web): remove one-off document gate validation
 report

---
 web/docs/webapp-document-gate-validation.md | 49 ---------------------
 1 file changed, 49 deletions(-)
 delete mode 100644 web/docs/webapp-document-gate-validation.md

diff --git a/web/docs/webapp-document-gate-validation.md b/web/docs/webapp-document-gate-validation.md
deleted file mode 100644
index 6b549a4dc9d358..00000000000000
--- a/web/docs/webapp-document-gate-validation.md
+++ /dev/null
@@ -1,49 +0,0 @@
-# WebApp document gate: local validation, 2026-09-22
-
-Scope: local worktree only. No real Dify API, Gateway, tenant, application, or remote environment was contacted. The upstream was a synthetic HTTP server bound to loopback. Its successful response was the existing `{"accessMode":"public"}` contract; denial/missing used the canonical `404 app_not_found` body. All configured console/public API URLs also pointed to loopback. No real credential was used.
-
-## Final checks
-
-- Five focused Vitest suites: **108 tests passed**. Command from `web/`: `../node_modules/.bin/vp test run --project unit features/app-access-error/__tests__ __tests__/proxy-frame-options.spec.ts`.
-- `vp check` on all nine changed TypeScript/TSX files: **zero warnings, lint errors, and type errors**.
-- JSX accessibility check on root layout, unavailable document route, and existing generic error component: passed.
-- Documentation ESLint and `git diff --check`: passed.
-- The coordinating agent owns the repository-wide `vp run -w check`; its result is not claimed here.
-
-## Actual optimized Next.js runtime
-
-Next.js **16.3.4**, with the real Dify root layout and error-page component, not a mocked `NextResponse` or replacement page. Built the final code using:
-
-```sh
-./node_modules/.bin/next build --debug-build-paths 'app/webapp-unavailable/page.tsx,app/(shareLayout)/chat/[token]/page.tsx'
-```
-
-The selective optimized production build passed. It builds the changed document route, root layout, Proxy, and an unchanged allowed Chat route; it is not a claim that every application route received a full production build. The final run used `node .next/standalone/web/server.js`, a local synthetic ingress proof, an internal loopback upstream, and `NEXT_PUBLIC_BASE_PATH=/gate-test`.
-
-All nine HTTP cases below passed with redirects disabled. Header and HTML assertions were made on real responses. The document assertions checked actual `<h1>` and `<code>` markup, not text appearing inside serialized translation resources.
-
-| Case                                                    | Actual result                                                                                                                                                                        |
-| ------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Missing App, Host `saas.dify.dev`                       | 404, `text/html; charset=utf-8`, `Cache-Control: no-store`, no Location; generic heading and trusted test IP rendered in `<code>`                                                    |
-| Denied App, Host `saas-app.dify.dev`, iframe request    | Same 404/headers and generic content; no X-Frame-Options preventing embedding                                                                                                        |
-| RSC navigation with valid `_rsc` transport value        | 404, `text/x-component`, no-store, no Location; generic error component payload                                                                                                      |
-| Upstream dependency failure                             | 503, no-store, no rewrite/redirect to App-not-found                                                                                                                                  |
-| Missing ingress proof                                   | 503, no-store; no application rendering                                                                                                                                              |
-| Direct internal error route with forged query/header IP | 404, no-store; generic heading, neither fabricated nor unrelated trusted test IP rendered                                                                                            |
-| Allowed Chat                                            | Original route continues, 200; no error-route rewrite. Console bootstrap was deliberately unavailable in the local upstream, so this does not claim a successful real Chat execution |
-| Japanese browser language                               | 404, no-store; `<html lang="ja-JP">`, actual Japanese heading and trusted IP in `<code>`                                                                                             |
-| HEAD                                                    | 404, no-store, HTML content type, empty body                                                                                                                                         |
-
-The final HTML/body never contained the local ingress proof. Missing and denied **rendered `<main>` sections were byte-equal** for the same IP and language. The complete raw HTML is not claimed byte-equal: the existing sign-in return URL and Next routing serialization reflect the caller's own different requested URL. No App identity metadata or denial reason is fetched/rendered by the error route.
-
-## Regressions caught while validating
-
-1. A layout-only streamed `notFound()` was avoided. Proxy establishes status before rendering.
-2. The existing global system-features bootstrap could hide the generic error behind a loading/error screen. The trusted terminal error layout now avoids that Console dependency and generates neutral metadata.
-3. Removing Next's `_rsc` value made Next issue its cache-validation redirect. Only this framework-owned query field is preserved in the internal rewrite; arbitrary application query/IP fields are discarded.
-4. NextURL normalizes loopback IP hostnames to `localhost`. Binding the local test server to `127.0.0.1` made that normalized rewrite appear external; final runtime checks used a same-origin `localhost` bind and independently tested both deployed Host values. Production deployment still needs its own edge/Gateway trust regression.
-5. Development Next overrides document cache headers to `no-cache, must-revalidate`; the optimized standalone runtime confirmed the required exact `no-store` error header.
-
-## Deployment boundary
-
-This validates the Web adapter and real Next response behavior. It does not validate the actual Nginx overwrite rules, real Gateway source-IP interpretation, real backend publication queries, or public CDN behavior. The coordinating agent must verify those after deployment before claiming the full SaaS-dev regression complete.