[bug] Cloud: workspace admin gets org_write_denied on addSpec after model-side execute resume

[dsivaasi]

Executor version

Executor Cloud (hosted, 2026-09-03). No local executor --version — this is the cloud MCP at https://executor.sh/<org>/mcp.

How do you run Executor?

Executor Cloud

Operating system

Linux

Integration involved

Built-in executor.openapi.addSpec / executor.coreTools.policies.create (catalog write), called through execute. MCP client is Grok Bot / Cursor with elicitation_mode=model.

What happened

A workspace admin (confirmed in the Cloud UI: user shown on the org, Integrations page, + Add integration available) cannot add an OpenAPI integration or create an org policy via MCP.

execute pauses on openapi.addSpec (and on policies.create with owner: "org"). Model-side resume with action: accept and content: "{}" then returns:

{
  "ok": false,
  "error": {
    "code": "org_write_denied",
    "message": "Adding connections or changing workspace settings requires a workspace admin."
  }
}

The same identity can create a user-owned policy (policies.create owner: "user" succeeds after the same pause/accept). The same admin can add integrations from the web UI.

Reproduced with both:

• OAuth MCP session on https://executor.sh/<org>/mcp
• A workspace API key sent as Authorization: Bearer on a separate MCP server pointing at the same URL

So this is not “the human is not an admin”. It looks like model-side resume is not carrying the admin bit onto catalog writes, while the browser session is.

Related but different: #1778 (model resume / paused execution across MCP sessions). Here resume finds the execution and then the mutation is denied.

What you expected

A workspace admin’s MCP execute → pause → model resume accept should be allowed to openapi.addSpec and policies.create with owner: "org", same as + Add integration in the Cloud UI.

Steps to reproduce

1. Sign in to Executor Cloud as a workspace admin. Confirm admin in the UI (Integrations, + Add integration).
2. Connect an MCP client to https://executor.sh/<org>/mcp with elicitation_mode=model (OAuth, or Authorization: Bearer API key).
3. Via execute, call tools.executor.coreTools.policies.create({ owner: "org", pattern: "some-slug.org.*", action: "approve" }) (or tools.executor.openapi.addSpec with a small OpenAPI blob + new slug).
4. Execution pauses: “Approve executor.coreTools.policies.create?” / “Add an OpenAPI integration”. Empty requested schema.
5. Call resume with executionId from the pause, action: "accept", content: "{}".
6. Observe org_write_denied.
7. Repeat step 3 with owner: "user" — that succeeds.
8. Add the same integration from the Cloud UI as the same user — that succeeds.

Diagnostics / logs

No desktop diagnostics zip (Cloud + remote MCP). Error payload is the org_write_denied object above. No API keys or tokens included.

Before you submit

• I searched the open issues for a duplicate.
• I removed all keys, tokens, and credentials from this report.