fix(copilot): preserve organization folder delegation restrictions

Author: waleedlatif1

apps/sim/lib/knowledge/application/operations.test.ts

@@ -212,14 +212,24 @@ describe('knowledge operation registry', () => {
     ).toBe(true)
   })
 
-  it('allows delegated callers only on semantic knowledge and document operations', () => {
+  it('allows Copilot folder discovery without delegating folder mutations or upload completion', () => {
     expect(knowledgeOperations.list.principalKinds).toContain('delegated')
     expect(knowledgeOperations.search.principalKinds).toContain('delegated')
     expect(knowledgeOperations.uploadDocument.principalKinds).toContain('delegated')
     expect(knowledgeOperations.updateDocument.principalKinds).toContain('delegated')
     expect(knowledgeOperations.updateTag.principalKinds).toContain('delegated')
     expect(knowledgeOperations.syncConnector.principalKinds).toContain('delegated')
-    expect(knowledgeOperations.listFolders.principalKinds).not.toContain('delegated')
+    expect(knowledgeOperations.listFolders.principalKinds).toContain('delegated')
+    expect(knowledgeOperations.listFolders.delegatedServices).toEqual(['copilot'])
+    expect(knowledgeOperations.listFolders.minimumRole).toBe('read')
+    for (const operation of [
+      knowledgeOperations.createFolder,
+      knowledgeOperations.relocateFolder,
+      knowledgeOperations.deleteFolder,
+    ]) {
+      expect(operation.principalKinds).not.toContain('delegated')
+      expect(operation.delegatedServices).toBeUndefined()
+    }
     expect(knowledgeOperations.uploadComplete.principalKinds).not.toContain('delegated')
     expect(knowledgeOperations.list.delegatedServices).toEqual(['copilot'])
     expect(knowledgeOperations.search.delegatedServices).toEqual(['copilot', 'executor'])

apps/sim/lib/knowledge/application/operations.ts

@@ -15,12 +15,19 @@ export type ScopedKnowledgeOperation<O extends WorkspaceOperation = WorkspaceOpe
   readonly organizationOperation: OrganizationOperation
 }
 
+interface KnowledgeOperationOptions {
+  organizationDelegation?: 'deny'
+}
+
 /** Binds organization policy to the same semantic operation declared for workspace access. */
 function defineKnowledgeOperation<const O extends WorkspaceOperation>(
-  operation: O
+  operation: O,
+  options?: KnowledgeOperationOptions
 ): ScopedKnowledgeOperation<O> {
   const supportsOrganizationDelegation =
-    operation.minimumRole === 'read' && operation.delegatedServices?.includes('copilot')
+    options?.organizationDelegation !== 'deny' &&
+    operation.minimumRole === 'read' &&
+    operation.delegatedServices?.includes('copilot')
   const organizationOperation = defineOrganizationOperation({
     id: operation.id,
     capability: operation.capability,
@@ -258,7 +265,9 @@ export const knowledgeOperations = {
       workspaceApiKey: 'allow',
       capability: 'knowledge.use',
       ...ALL_PRINCIPAL_POLICY,
-    })
+    }),
+    /** Folder mentions resolve workspace folders; organization delegation stays disabled. */
+    { organizationDelegation: 'deny' }
   ),
   createFolder: defineKnowledgeOperation(
     defineWorkspaceOperation({