@@ -93,6 +93,7 @@ describe('organization settings navigation', () => {
       'governance:access-control',
       'governance:sso',
       'governance:sessions',
+      'governance:network',
       'governance:data-retention',
       'governance:data-drains',
       'sim-search:integrations',
 
@@ -52,6 +52,7 @@ vi.mock('@/app/workspace/[workspaceId]/settings/navigation', () => ({
       'audit-logs',
       'sso',
       'sessions',
+      'network',
       'data-retention',
       'data-drains',
       'whitelabeling',
 
@@ -45,6 +45,7 @@ describe('unified settings navigation', () => {
       { id: 'self-host', label: 'Self hosting', section: 'platform' },
       { id: 'sso', label: 'Single sign-on', section: 'organization' },
       { id: 'sessions', label: 'Session policies', section: 'organization' },
+      { id: 'network', label: 'Network', section: 'organization' },
       { id: 'data-retention', label: 'Data retention', section: 'organization' },
       { id: 'data-drains', label: 'Data drains', section: 'organization' },
       { id: 'whitelabeling', label: 'White-labeling', section: 'organization' },
@@ -91,6 +92,7 @@ describe('unified settings navigation', () => {
       'whitelabeling',
       'sso',
       'sessions',
+      'network',
       'data-retention',
       'data-drains',
     ])
 
@@ -7,6 +7,10 @@ import {
 } from '@sim/testing'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
 import { createTimeoutAbortController, getExecutionDeadlineAt } from '@/lib/core/execution-limits'
+import {
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { getBlock } from '@/blocks/registry'
 import { BlockType } from '@/executor/constants'
@@ -28,6 +32,21 @@ const mockWorkflowLogger = vi.mocked(loggerMock.createLogger).mock.results[
   vi.mocked(createLogger).mock.calls.findIndex(([name]) => name === 'WorkflowBlockHandler')
 ].value
 
+const outboundMocks = vi.hoisted(() => ({
+  enabled: vi.fn(() => false),
+  workspace: vi.fn(),
+  route: vi.fn(async (organizationId: string | null | undefined) => ({ organizationId })),
+}))
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: outboundMocks.enabled,
+  resolveOutboundRoute: outboundMocks.route,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadActiveWorkspaceApplicationContext: outboundMocks.workspace,
+}))
+
+beforeEach(() => outboundMocks.enabled.mockReturnValue(false))
+
 const {
   mockExecutorExecute,
   mockCreateSnapshot,
@@ -632,7 +651,9 @@ describe('WorkflowBlockHandler', () => {
       expect(mockGetPersonalAndWorkspaceEnv).not.toHaveBeenCalled()
     })
 
-    it('resolves a source-scoped billing attribution for custom block children', async () => {
+    it('resolves source billing and routing for custom block children', async () => {
+      outboundMocks.enabled.mockReturnValue(true)
+      outboundMocks.workspace.mockResolvedValue({ workspaceOrganizationId: 'source-org' })
       const consumerAttribution = { actorUserId: 'consumer-1', workspaceId: 'workspace-consumer' }
       const sourceAttribution = { actorUserId: 'owner-9', workspaceId: 'workspace-source' }
       const customBlock = {
@@ -688,9 +709,18 @@ describe('WorkflowBlockHandler', () => {
         }
       })
       mockCreateSnapshot.mockResolvedValue({ snapshot: { id: 'snapshot-1' } })
-      mockExecutorExecute.mockResolvedValue({ success: true, output: { data: 'ok' } })
+      mockExecutorExecute.mockImplementationOnce(async () => {
+        await resolveCurrentOutboundRoute()
+        expect(outboundMocks.route).toHaveBeenLastCalledWith('source-org')
+        return { success: true, output: { data: 'ok' } }
+      })
 
-      await handler.execute(ctx, customBlock, {})
+      await runWithOutboundOrganization('consumer-org', async () => {
+        await handler.execute(ctx, customBlock, {})
+        await resolveCurrentOutboundRoute()
+        expect(outboundMocks.route).toHaveBeenLastCalledWith('consumer-org')
+      })
+      expect(outboundMocks.workspace).toHaveBeenCalledExactlyOnceWith('workspace-source')
 
       expect(mockReadWorkflowDefinitionAsExecutor).toHaveBeenCalledWith(
         expect.objectContaining({
 
@@ -5,7 +5,9 @@ import { isRecordLike } from '@sim/utils/object'
 import type { Variable, WorkflowState } from '@sim/workflow-types/workflow'
 import { resolveBillingAttribution } from '@/lib/billing/core/billing-attribution'
 import { getExecutionDeadlineAt } from '@/lib/core/execution-limits'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
 import { asOrchestrationError } from '@/lib/core/orchestration/types'
+import { resourceScopeFromOwner } from '@/lib/core/resource-scope'
 import { getExecutionEnvironment } from '@/lib/environment/utils'
 import { buildNextCallChain, validateCallChain } from '@/lib/execution/call-chain'
 import { readWorkflowDefinitionAsExecutor } from '@/lib/internal/workflows/read-definition'
@@ -908,7 +910,13 @@ export class WorkflowBlockHandler implements BlockHandler {
 
       const startTime = performance.now()
 
-      const result = await subExecutor.execute(workflowId)
+      const executeChild = () => subExecutor.execute(workflowId)
+      const result = await (isCustomBlock
+        ? withResourceOutboundScope(
+            resourceScopeFromOwner({ workspaceId: childWorkspaceId }),
+            executeChild
+          )
+        : executeChild())
       const executionResult = this.toExecutionResult(result)
       const duration = performance.now() - startTime
 
 
@@ -7,15 +7,16 @@ import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
 import { createGatewayDispatcher } from '@/lib/core/network/gateway.server'
 import { secureFetchWithPinnedIP } from '@/lib/core/security/input-validation.server'
 
-const [proxyPort, originPort] = process.argv.slice(2)
-if (!proxyPort || !originPort) throw new Error('Local fixture ports are required')
+const [proxyPort, originPort, certificatePath] = process.argv.slice(2)
+if (!proxyPort || !originPort || !certificatePath)
+  throw new Error('Local fixture ports and certificate are required')
 const gateway = {
   id: 'synthetic',
   url: `https://127.0.0.1:${proxyPort}`,
   servername: 'gateway.invalid',
   generation: 'test',
   token: 'a'.repeat(48),
-  ca: readFileSync(new URL('./gateway-test-cert.pem', import.meta.url), 'utf8'),
+  ca: readFileSync(certificatePath, 'utf8'),
 }
 const dispatcher = createGatewayDispatcher(gateway, {
   profile: 'selfHostedService',
 
@@ -1,9 +1,11 @@
-import { execFile } from 'node:child_process'
 /** @vitest-environment node */
-import { readFileSync } from 'node:fs'
+import { execFile } from 'node:child_process'
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs'
 import { createServer as httpServer } from 'node:http'
 import { createServer as httpsServer } from 'node:https'
 import { type AddressInfo, connect, type Socket } from 'node:net'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
 import { getCACertificates, setDefaultCACertificates } from 'node:tls'
 import { fileURLToPath } from 'node:url'
 import { promisify } from 'node:util'
@@ -30,8 +32,10 @@ import {
   secureFetchWithPinnedIP,
 } from '@/lib/core/security/input-validation.server'
 
-const cert = readFileSync(new URL('./fixtures/gateway-test-cert.pem', import.meta.url), 'utf8')
-const key = readFileSync(new URL('./fixtures/gateway-test-key.pem', import.meta.url), 'utf8')
+const certificateDirectory = mkdtempSync(join(tmpdir(), 'gateway-tls-'))
+const certificatePath = join(certificateDirectory, 'cert.pem')
+const keyPath = join(certificateDirectory, 'key.pem')
+let cert = ''
 const sockets = new Set<Socket>()
 const admissions: Array<{
   token: string | undefined
@@ -54,11 +58,11 @@ const origin = httpServer(async (req, res) => {
   res.end(req.method === 'POST' ? Buffer.concat(chunks) : 'reached')
 })
 const proxiedPorts = new Set<number>()
-const secureOrigin = httpsServer({ cert, key }, (req, res) => {
+const secureOrigin = httpsServer((req, res) => {
   res.setHeader('x-via-proxy', proxiedPorts.has(req.socket.remotePort ?? 0) ? 'yes' : 'no')
   res.end('tls reached')
 })
-const proxy = httpsServer({ cert, key })
+const proxy = httpsServer()
 proxy.on('connect', (req, socket, head) => {
   socket.on('error', () => {})
   const tlsSocket = req.socket as Socket & { servername?: string }
@@ -88,6 +92,29 @@ let originPort = 0
 let securePort = 0
 const trust = getCACertificates('default')
 beforeAll(async () => {
+  await promisify(execFile)('openssl', [
+    'req',
+    '-x509',
+    '-newkey',
+    'rsa:2048',
+    '-sha256',
+    '-nodes',
+    '-keyout',
+    keyPath,
+    '-out',
+    certificatePath,
+    '-days',
+    '2',
+    '-subj',
+    '/CN=gateway.invalid',
+    '-addext',
+    'subjectAltName=DNS:gateway.invalid,DNS:localhost',
+    '-addext',
+    'extendedKeyUsage=serverAuth',
+  ])
+  cert = readFileSync(certificatePath, 'utf8')
+  const key = readFileSync(keyPath, 'utf8')
+  for (const server of [secureOrigin, proxy]) server.setSecureContext({ cert, key })
   setDefaultCACertificates([...trust, cert])
   for (const server of [origin, secureOrigin, proxy]) {
     server.on('connection', (socket) => {
@@ -120,6 +147,7 @@ afterAll(async () => {
     )
   )
   setDefaultCACertificates(trust)
+  rmSync(certificateDirectory, { recursive: true, force: true })
 })
 const url = () => `http://localhost:${originPort}`
 const options = { profile: 'selfHostedService' as const }
@@ -266,14 +294,13 @@ describe('organization gateways over real TLS CONNECT sockets', () => {
         fileURLToPath(new URL('./fixtures/gateway-runtime.fixture.ts', import.meta.url)),
         String((proxy.address() as AddressInfo).port),
         String(securePort),
+        certificatePath,
       ],
       {
         timeout: 15_000,
         env: {
           ...process.env,
-          NODE_EXTRA_CA_CERTS: fileURLToPath(
-            new URL('./fixtures/gateway-test-cert.pem', import.meta.url)
-          ),
+          NODE_EXTRA_CA_CERTS: certificatePath,
           OUTBOUND_ROUTING_SOURCE: 'env',
           OUTBOUND_ROUTING_CONFIG: JSON.stringify({
             schemaVersion: 1,
 
@@ -0,0 +1,66 @@
+/** @vitest-environment node */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  enabled: vi.fn(() => true),
+  workspace: vi.fn(),
+  route: vi.fn(async (organizationId: string | null | undefined) => ({ organizationId })),
+}))
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: mocks.enabled,
+  resolveOutboundRoute: mocks.route,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadActiveWorkspaceApplicationContext: mocks.workspace,
+}))
+
+import {
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
+import { withResourceOutboundScope } from '@/lib/core/network/resource-scope.server'
+
+describe('canonical resource outbound scope', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.enabled.mockReturnValue(true)
+  })
+
+  it.each(['publisher-org', null])(
+    'uses current workspace ownership %s and restores its caller',
+    async (organizationId) => {
+      mocks.workspace.mockResolvedValue({ workspaceOrganizationId: organizationId })
+      await runWithOutboundOrganization('caller-org', async () => {
+        expect(
+          await withResourceOutboundScope(
+            { kind: 'workspace', workspaceId: 'source-workspace' },
+            resolveCurrentOutboundRoute
+          )
+        ).toEqual({ organizationId })
+        expect(await resolveCurrentOutboundRoute()).toEqual({ organizationId: 'caller-org' })
+      })
+      expect(mocks.workspace).toHaveBeenCalledExactlyOnceWith('source-workspace')
+    }
+  )
+
+  it('rejects a missing or archived workspace before executing provider work', async () => {
+    mocks.workspace.mockResolvedValue(null)
+    await expect(
+      withResourceOutboundScope(
+        { kind: 'workspace', workspaceId: 'removed' },
+        resolveCurrentOutboundRoute
+      )
+    ).rejects.toMatchObject({ code: 'MISSING_SCOPE' })
+    expect(mocks.route).not.toHaveBeenCalled()
+  })
+
+  it('adds no workspace query when routing is unconfigured', async () => {
+    mocks.enabled.mockReturnValue(false)
+    const run = vi.fn(async () => 'done')
+    expect(await withResourceOutboundScope({ kind: 'workspace', workspaceId: 'source' }, run)).toBe(
+      'done'
+    )
+    expect(mocks.workspace).not.toHaveBeenCalled()
+    expect(run).toHaveBeenCalledOnce()
+  })
+})
@@ -0,0 +1,17 @@
+import { isOutboundRoutingEnabled } from '@/lib/core/network/config.server'
+import { runWithOutboundOrganization } from '@/lib/core/network/context.server'
+import { OutboundRoutingError } from '@/lib/core/network/routing'
+import type { ResourceScope } from '@/lib/core/resource-scope'
+import { loadActiveWorkspaceApplicationContext } from '@/lib/workspaces/application/workspace-context'
+
+/** Establishes routing after resource authorization, reloading current workspace ownership when needed. */
+export async function withResourceOutboundScope<T>(
+  scope: ResourceScope,
+  run: () => Promise<T>
+): Promise<T> {
+  if (!isOutboundRoutingEnabled()) return run()
+  if (scope.kind === 'organization') return runWithOutboundOrganization(scope.organizationId, run)
+  const workspace = await loadActiveWorkspaceApplicationContext(scope.workspaceId)
+  if (!workspace) throw new OutboundRoutingError('MISSING_SCOPE')
+  return runWithOutboundOrganization(workspace.workspaceOrganizationId, run)
+}
@@ -20,6 +20,17 @@ const mocks = vi.hoisted(() => ({
   completeMcpOAuth: vi.fn(),
   startMcpOAuth: vi.fn(),
   startOAuth: vi.fn(),
+  routingEnabled: vi.fn(() => false),
+  workspace: vi.fn(),
+  route: vi.fn(async (organizationId: string | null | undefined) => ({ organizationId })),
+}))
+
+vi.mock('@/lib/core/network/config.server', () => ({
+  isOutboundRoutingEnabled: mocks.routingEnabled,
+  resolveOutboundRoute: mocks.route,
+}))
+vi.mock('@/lib/workspaces/application/workspace-context', () => ({
+  loadActiveWorkspaceApplicationContext: mocks.workspace,
 }))
 
 vi.mock('@/lib/organizations/settings-access', () => ({
@@ -53,6 +64,10 @@ vi.mock('@/lib/credential-groups/trigger', () => ({
   fireCredentialGroupTrigger: mocks.fireTrigger,
 }))
 
+import {
+  resolveCurrentOutboundRoute,
+  runWithOutboundOrganization,
+} from '@/lib/core/network/context.server'
 import {
   completePublicCredentialGroupEnrollment,
   completePublicCredentialGroupMcpOAuth,
@@ -101,6 +116,7 @@ const oauthAttempt = {
 describe('public Credential Group enrollment application operations', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mocks.routingEnabled.mockReturnValue(false)
     mocks.bind.mockResolvedValue(undefined)
     mocks.memberAccess.mockResolvedValue({ isMember: false })
     mocks.searchAvailable.mockResolvedValue(true)
@@ -333,6 +349,33 @@ describe('public Credential Group enrollment application operations', () => {
       expect.objectContaining({ event: 'credential_reconnected', enrollmentStatus: 'completed' })
     )
   })
+  it.each(['organization', 'workspace'] as const)(
+    'scopes OAuth callbacks to the authorized %s and restores the caller',
+    async (kind) => {
+      mocks.routingEnabled.mockReturnValue(true)
+      mocks.workspace.mockResolvedValue({ workspaceOrganizationId: 'workspace-org' })
+      const owner =
+        kind === 'organization'
+          ? { organizationId: 'org-1', workspaceId: undefined }
+          : { workspaceId: 'workspace-1', organizationId: undefined }
+      const completion = await mocks.completeOAuth()
+      mocks.completeOAuth.mockImplementationOnce(async () => {
+        await resolveCurrentOutboundRoute()
+        return completion
+      })
+      await runWithOutboundOrganization('caller-org', async () => {
+        await completePublicCredentialGroupOAuth.execute({
+          principal: { ...principal, ...owner },
+          input: { attempt: { ...oauthAttempt, ...owner }, code: 'code' },
+        })
+        expect(mocks.route).toHaveBeenLastCalledWith(
+          kind === 'organization' ? 'org-1' : 'workspace-org'
+        )
+        await resolveCurrentOutboundRoute()
+        expect(mocks.route).toHaveBeenLastCalledWith('caller-org')
+      })
+    }
+  )
   it('rejects a consumed attempt after invitation rotation before exchanging its code', async () => {
     mocks.bind.mockRejectedValue(new Error('Invitation is invalid or expired'))
     await expect(