diff --git a/apps/docs/content/docs/platform/enterprise/scim/entra.mdx b/apps/docs/content/docs/platform/enterprise/scim/entra.mdx
index b5dd7863028..e8b1faf06e7 100644
--- a/apps/docs/content/docs/platform/enterprise/scim/entra.mdx
+++ b/apps/docs/content/docs/platform/enterprise/scim/entra.mdx
@@ -11,7 +11,7 @@ Use a non-gallery enterprise application in Microsoft Entra ID to create, update
 
 ## Before you start
 
-- Use an Enterprise organization in Sim and an organization owner or admin account.
+- On Sim Cloud, use an Enterprise organization. Use an organization owner or admin account to configure provisioning.
 - [Verify each provisioned email domain](/platform/enterprise/verified-domains).
 - Use an Entra administrator who can create enterprise applications and manage provisioning.
 - Make Sim reachable by Entra over HTTPS. Self-hosted deployments must meet the [SCIM rollout requirements](/platform/enterprise/scim#deployment-and-upgrades).
@@ -20,6 +20,8 @@ Automated user provisioning is available with Entra ID Free. Group provisioning
 
 Start with dedicated test accounts. Provisioned members use a seat and receive workspace access through mappings or existing grants.
 
+An existing SAML or OIDC sign-in setup can remain in place. Use the same account email for authentication and provisioning, and review app assignments if they use separate enterprise applications. See [Plan membership and access](/platform/enterprise/scim#plan-membership-and-access) for the distinction between sign-in, organization membership, workspace access, and permission policy.
+
 ## Connect Entra to Sim
 
 <Steps>
@@ -101,12 +103,13 @@ Sim deactivation suspends access while retaining membership, ownership, and the
 
 ## Provision groups and verify access
 
-With P1 or higher, create a security group with **Assigned** membership and add test accounts as direct members. Assign it under **Users and groups**. Review **Attribute mapping** and keep group provisioning enabled.
+With P1 or higher, create a security group with **Assigned** membership and add test accounts as direct members. Assign it under **Users and groups**. Review **Attribute mapping** and keep group provisioning enabled. Create the target workspace and a dedicated permission group in Sim, configuring that policy's restrictions and workspace scope before mapping it.
 
 1. Run **Provision on demand** for one group and select up to five test members, or wait for a scheduled cycle. Nested membership is unsupported; see [Microsoft group assignment](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-user-or-group-access-portal).
-2. Once the group appears under **Single sign-on → Provisioning → Group mappings** in Sim, map it to a workspace, permission group, or organization admin role. Start with a workspace mapping and confirm access.
-3. Remove a test member from the group while retaining a separate direct app assignment. After synchronization, confirm the directory workspace grant is withdrawn while the account remains active.
-4. Add the member back and verify access returns.
+2. Once the group appears under **Single sign-on → Provisioning → Group mappings** in Sim, add a **Workspace** mapping and a **Permission group** mapping to the policy created above. Confirm both workspace access and policy restrictions. A permission-group mapping alone does not grant workspace access; an organization-admin mapping is a separate privilege.
+3. For automatic policy matching, enable **Provisioning rules → Manage rules → Match permission groups by name**. Names must match an existing non-default Sim permission group exactly, including case. Select **Reconcile now** for groups already synced. Sim does not create the permission group.
+4. Remove a test member from the group while retaining a separate direct app assignment. After synchronization, confirm the directory workspace grant is withdrawn while the account remains active. Check the [fallback policy](/platform/enterprise/scim#how-access-is-withdrawn) on any workspace the person can still access.
+5. Add the member back and verify access and restrictions return.
 
 Read [How access is withdrawn](/platform/enterprise/scim#how-access-is-withdrawn) before mapping groups that overlap manual access.
 
@@ -133,6 +136,8 @@ Issue a replacement token in Sim while the current one remains active. In Entra'
 | Disablement or deletion has not reached Sim | Inspect the scheduled log, `IsSoftDeleted` mapping to `active`, enabled **Update** actions, and accidental deletion protection. Confirm **Skip out of scope deletions** is disabled. A connection test does not verify lifecycle changes. |
 | Group assignment is unavailable | Check licensing. Free supports individual assignment; group assignment and provisioning require an upgrade. |
 | Member has no workspace access | Provision the directory group and add a Sim workspace mapping. User provisioning adds organization membership. |
+| Member has access but the expected policy does not apply | Check **Group mappings** for unassigned members. Resolve overlapping membership or workspace scope under **Permission groups**, then select **Reconcile now**. For name matching, also check the exact group name. |
+| A removed mapping returns | Turn off name matching or use different names before removing a same-name mapping. See [mapping behavior](/platform/enterprise/scim#map-directory-groups). |
 | A disabled member still uses a seat | Deactivation suspends access; organization removal is separate. |
 
 Use Entra's **Provisioning logs** and Sim's **Provisioning → Activity**. Invalid or revoked tokens appear only in Entra because Sim cannot associate them with a connection.
diff --git a/apps/docs/content/docs/platform/enterprise/scim/index.mdx b/apps/docs/content/docs/platform/enterprise/scim/index.mdx
index a3630aefa7c..7909411b026 100644
--- a/apps/docs/content/docs/platform/enterprise/scim/index.mdx
+++ b/apps/docs/content/docs/platform/enterprise/scim/index.mdx
@@ -5,6 +5,7 @@ description: Sync organization members and group-based access from your identity
 
 import { Callout } from 'fumadocs-ui/components/callout'
 import { Step, Steps } from 'fumadocs-ui/components/steps'
+import { Image } from '@/components/ui/image'
 import { Tab, Tabs } from '@/components/ui/tabs'
 
 Directory provisioning uses SCIM 2.0, a standard protocol for syncing accounts, to create, update, and deactivate organization members from your identity provider. Map directory groups to workspace access, permission groups, or the organization admin role.
@@ -17,19 +18,36 @@ Configure [SSO](/platform/enterprise/sso) separately for authentication. SCIM ca
 - [Verify every email domain](/platform/enterprise/verified-domains) you will provision. Sim refuses account creation or an email change to an unverified domain.
 - On self-hosted deployments, enable SSO to reach **Single sign-on → Provisioning**, and enable SCIM. The enterprise master pair enables both; individual setup uses `SSO_ENABLED`, `NEXT_PUBLIC_SSO_ENABLED`, `SCIM_ENABLED`, and `NEXT_PUBLIC_SCIM_ENABLED`. See [Self-hosted SSO setup](/platform/enterprise/sso#self-hosted-setup) and [Deployment and upgrades](#deployment-and-upgrades).
 
+## Plan membership and access
+
+If your organization already uses SAML or OIDC, keep that sign-in configuration. SCIM adds directory synchronization alongside it. Configure these four controls separately:
+
+| Control | What it decides |
+| --- | --- |
+| SSO | How a person authenticates. Use the same account email in SSO and provisioning. |
+| SCIM user provisioning | Whether the person is an organization member and whether their account is active. |
+| Workspace mapping | Which workspace the person can access, at Read, Write, or Admin level. |
+| Permission-group mapping | Which models, integrations, and actions the person can use in the permission group's selected workspaces. It does not grant workspace access. |
+
+Create the workspaces and [permission groups](/platform/enterprise/access-control#create-and-configure-a-group) in Sim before mapping directory groups. For example, map a pushed `Finance` group to **Finance workspace → Write** and to a dedicated **Finance policy** permission group scoped to that workspace. These can be two mappings on the same directory group.
+
+Configure a restrictive organization default permission group for people who retain workspace access after leaving a mapped policy group. Sim selects one governing policy per person and workspace; it does not intersect every policy attached to their directory groups. Review [policy selection and conflicts](/platform/enterprise/access-control#general) before rolling out overlapping groups.
+
 ## What it does
 
 | Directory request | Sim behavior |
 | --- | --- |
 | Provision a person | Creates or links an account and adds new organization members as Members. Workspace access requires a mapping or existing grant. |
-| Update name or email | Updates the account. An email change ends its sessions. |
+| Update name or email | Updates the account. An email change ends its sessions and OAuth grants. |
 | Deactivate a person | Suspends sign-in and personal API keys, and blocks scheduled runs or triggers acting as that person. Ownership, credentials, grants, and workspace history are retained. Shared workspace keys keep working. |
 | Reactivate a person | Lifts the suspension. Current group memberships and mappings govern directory access. |
-| Send SCIM `DELETE` | Removes organization membership, ends sessions, deletes personal API keys, and reassigns owned resources. The Sim account survives. |
+| Send SCIM `DELETE` | Removes organization membership, ends sessions and OAuth grants, deletes personal API keys, and reassigns owned resources. The Sim account survives. |
 | Add or remove group membership | Applies or withdraws the group's mapped access. |
 
 Deactivation itself does not withdraw grants. Group or mapping changes can still withdraw access and reassign ownership while someone is suspended. A deactivated member keeps their seat until removed from the organization.
 
+Deactivation stops the person's active Chat runs. Reactivation permits new runs; it does not resume runs stopped during suspension.
+
 Deactivation deletes the member's sessions and stops personal API-key authentication when it completes. Organization security-version invalidation reaches cached browser sessions on other application instances within up to 60 seconds.
 
 Sim refuses directory suspension or removal of an organization owner. Transfer ownership in Sim first.
@@ -124,7 +142,7 @@ Select **Test Connection**, enable group management if you will map groups, then
 
 Under **Provisioning → Group mappings**, map each synced group to one or more targets:
 
-- A **Permission group**, which governs models, integrations, and capabilities.
+- A **Permission group**, which governs models, integrations, and capabilities in its selected workspaces. Create and configure it in Sim first; this mapping does not grant workspace access.
 - A **Workspace**, with **Read**, **Write**, or **Admin** access.
 - The **Organization admin** role.
 
@@ -134,9 +152,15 @@ When multiple groups grant the same workspace at different levels, the strongest
   Mapping a permission group permanently switches it to explicit membership: it applies only to its members, and an empty mapped group applies to nobody. A group that previously applied to everyone in its workspaces stops doing so when mapped. Use permission groups created for directory membership rather than existing organization-wide groups.
 </Callout>
 
-Under **Provisioning rules → Manage rules**, **Match permission groups by name** maps new or renamed directory groups to existing non-default permission groups with an exact, case-sensitive name match. Sim does not create permission groups. A rename updates automatic mappings and preserves manually added ones.
+Under **Provisioning rules → Manage rules**, **Match permission groups by name** maps new or renamed directory groups to existing non-default permission groups with an exact, case-sensitive name match. Sim does not create permission groups. These mappings are labeled **Automatic**. A rename updates automatic mappings and preserves manually added ones.
 
 For groups already synced before enabling name matching, select **Reconcile now** or wait for scheduled reconciliation.
+
+Turning off name matching stops future automatic matching; it does not remove existing mappings. Before removing a mapping whose target still has the same name, turn off **Match permission groups by name** or change the names so they no longer match. Otherwise a later group push or reconciliation can recreate it. A manually added mapping keeps its target when the directory group is renamed.
+
+A person can belong to only one explicit permission group for a given workspace. A conflicting policy assignment can be skipped even when the directory group itself synchronizes successfully. **Group mappings** shows how many directory members are not assigned to each mapped policy. Open **Permission groups**, resolve the overlapping membership or workspace scope, then select **Reconcile now**. Confirm the warning clears and the person's effective restrictions are correct.
+
+<Image src="/static/enterprise/scim-group-mappings.png" alt="Directory group mappings with an automatic permission-group match, workspace access, and a warning for an unassigned policy membership" width={769} height={314} variant="detail" />
 </Step>
 </Steps>
 
@@ -144,8 +168,12 @@ For groups already synced before enabling name matching, select **Reconcile now*
 
 Sim tracks grants made through directory mappings. Removing a member from a group or removing its mapping withdraws the tracked access.
 
+Other directory mappings and independent access can still keep the person in a workspace. Removing a permission-group membership changes their governing policy; it does not remove workspace access. Sim then uses another applicable workspace policy, the organization default, or no permission-group restrictions if neither exists. An empty mapped group applies to nobody and never turns into an all-members policy. Verify both workspace access and the fallback policy when testing a removal.
+
 **Lock managed membership** is enabled by default on a new connection. It makes the directory authoritative for provisioned members: Sim refuses manual invitations, workspace grants, workspace role changes, and organization role changes for them. Manual access already held when a mapping begins covering it becomes directory-managed and is withdrawn with that mapping. Administrators can still remove access in an emergency.
 
+The lock does not prevent editing permission-group membership directly in Sim. A manual removal can be restored by reconciliation, and a manual addition to an overlapping policy can block a directory assignment. Manage mapped policy membership through the directory and check **Group mappings** for unassigned members after resolving conflicts.
+
 With locking off, prior manual workspace access is preserved. If a member had manual Read access and a directory mapping raises it to Admin, removing the mapping restores Read. A role manually raised above the directory's level also remains. [Older grants have a baseline limitation](#deployment-and-upgrades).
 
 You can manually invite people the directory does not manage. For managed members with locking on, grant access through directory groups.
@@ -162,12 +190,16 @@ Connection switches, rules, tokens, and mappings save immediately. **Provisionin
 
 **Provisioning → Activity** shows recent authenticated requests, their status, and failure details. A wrong, expired, or revoked token cannot be associated with a connection, so its authentication error appears only in the provider's logs.
 
-**Reconcile now** reapplies group mappings and changed connection rules. For scheduled reconciliation, call `GET /api/cron/scim-reconcile` with the configured `CRON_SECRET`. Helm and production Docker Compose include an hourly schedule when their cron service is configured and running. This endpoint runs directly; it does not require Trigger.dev. See [Background schedules](/platform/enterprise/self-hosted#schedule-the-background-jobs).
+**Reconcile now** reapplies stored group memberships, mappings, and changed connection rules. It does not fetch changes from Okta or Entra. If a directory change has not reached Sim, inspect the provider's provisioning job and retry or repush there first.
+
+For scheduled reconciliation, call `GET /api/cron/scim-reconcile` with the configured `CRON_SECRET`. Helm and production Docker Compose include an hourly schedule when their cron service is configured and running. This endpoint runs directly; it does not require Trigger.dev. See [Background schedules](/platform/enterprise/self-hosted#schedule-the-background-jobs).
 
 ## Disable provisioning
 
 Turning the connection off stops synchronization; it does not reverse suspension or prior access changes. Deactivated members stay deactivated. To restore an account without the directory, remove it from the organization and invite it again.
 
+While the connection is disabled, **Lock managed membership** and **Disable just-in-time provisioning** no longer apply. Manual membership changes and the SSO provider's first-sign-in setting govern those operations again. Review them before disabling the connection; disabling synchronization is not an offboarding action.
+
 ## Deployment and upgrades
 
 Apply database migrations before the new application code. The SCIM tables and suspension fields are additive, allowing older code to run against the expanded schema during rollout.
diff --git a/apps/docs/content/docs/platform/enterprise/scim/okta.mdx b/apps/docs/content/docs/platform/enterprise/scim/okta.mdx
index f5cf8d12c66..f64d84f95eb 100644
--- a/apps/docs/content/docs/platform/enterprise/scim/okta.mdx
+++ b/apps/docs/content/docs/platform/enterprise/scim/okta.mdx
@@ -11,13 +11,15 @@ Connect an Okta SCIM 2.0 integration to create, update, and deactivate Sim organ
 
 ## Before you start
 
-- Use an Enterprise organization in Sim and an organization owner or admin account.
+- On Sim Cloud, use an Enterprise organization. Use an organization owner or admin account to configure provisioning.
 - [Verify each provisioned email domain](/platform/enterprise/verified-domains).
 - Use an Okta administrator with access to application provisioning.
 - Make the Sim deployment reachable by Okta over HTTPS. Self-hosted deployments must meet the [SCIM rollout requirements](/platform/enterprise/scim#deployment-and-upgrades).
 
 Start with a test account and a dedicated group. Provisioned members use a seat and receive workspace access through mappings or existing grants.
 
+Keep an existing SAML or OIDC sign-in integration when adding provisioning. If provisioning uses a separate Okta app, assign the intended users to both apps and map the same account email. App assignment, pushed group membership, workspace access, and permission policy are separate controls; see [Plan membership and access](/platform/enterprise/scim#plan-membership-and-access).
+
 ## Choose an integration
 
 SCIM support depends on how the Okta app was created:
@@ -31,7 +33,7 @@ SCIM support depends on how the Okta app was created:
 See [Okta's custom-app SCIM instructions](https://help.okta.com/en-us/Content/Topics/apps/apps_app_integration_wizard_scim.htm). If the provisioning option is missing, confirm that the feature is enabled for your Okta organization.
 
 <Callout type="warn">
-  The Header Auth Test App walkthrough below is for evaluation. [Okta support limits SCIM Test Apps to development and testing](https://support.okta.com/help/s/article/What-are-SCIM-20-Test-Apps?language=en_US), although its developer guide also describes private template integrations. For production, confirm a supported integration route for your Okta organization using the corresponding official instructions. This guide does not establish a published or certified Sim OIN integration.
+  [Okta limits SCIM Test Apps to development and testing](https://support.okta.com/help/s/article/What-are-SCIM-20-Test-Apps?language=en_US). Use a supported custom app for production; the Header Auth Test App walkthrough and screenshots below are for evaluation. This guide does not establish a published or certified Sim OIN integration.
 </Callout>
 
 ### Connect a supported custom app
@@ -40,7 +42,7 @@ See [Okta's custom-app SCIM instructions](https://help.okta.com/en-us/Content/To
 2. In the supported Okta app, enable SCIM. For a Classic SAML or SWA app, open **General → App Settings → Edit**, set **Provisioning** to **SCIM**, and save.
 3. Open **Provisioning → Integration** and configure **SCIM connector base URL** with Sim's Base URL. Set **Unique identifier field for users** to `userName`.
 4. Enable the supported push actions needed for your deployment: **Push New Users**, **Push Profile Updates**, and **Push Groups** for group-based access.
-5. Configure **HTTP Header** authentication to send `Authorization: Bearer <your-sim-token>`. Use the chosen integration's documented credential fields; they differ from the Test App's **API Token** field below.
+5. Select **HTTP Header** authentication. In the Classic custom app's **Authorization** field, enter `Bearer <your-sim-token>`. This is a Sim-issued token, not an Okta API token. Other creation experiences may label the credential field differently.
 6. Test and save the connection. Under **Provisioning → To App**, enable user creation, attribute updates, and deactivation. Leave password synchronization disabled.
 
 Use an application username and primary email in a domain verified by Sim. If Okta usernames differ from email addresses, review the attribute mappings before assigning members. Then complete the lifecycle and group checks below.
@@ -106,10 +108,13 @@ Okta sends deactivation, not SCIM user `DELETE`. Sim suspends access while retai
 
 Use separate groups for app assignment and Group Push; Okta does not support using the same group for both. Assign accounts to the app first.
 
+For example, use `Sim users` to assign the app and `Finance` as the pushed group. Create a dedicated permission group in Sim with the restrictions and workspace scope Finance members need. A pushed directory group does not create that policy or its workspaces.
+
 1. Under **Push Groups → Find groups by name**, select the group.
 2. Leave **Push group memberships immediately** enabled. For a new downstream group, save with **Create Group** selected.
-3. In Sim, open **Single sign-on → Provisioning → Group mappings** and map the synced group to a workspace, permission group, or organization admin role. Workspace access requires a workspace mapping. Name matching can map existing permission groups automatically.
-4. Confirm a test member gains workspace access. Remove it from the pushed group while keeping its app assignment, and confirm the directory grant is withdrawn. Add it back and verify access returns without another account being created.
+3. In Sim, open **Single sign-on → Provisioning → Group mappings**. Add a **Workspace** mapping at the intended level and a **Permission group** mapping to the policy created above. A permission-group mapping alone does not grant workspace access. You can also map the organization admin role when that is intended.
+4. To match policies automatically, enable **Provisioning rules → Manage rules → Match permission groups by name**. The pushed name must exactly match an existing non-default Sim permission group, including case. Select **Reconcile now** for groups already synced. Workspace access still needs its own mapping or existing grant.
+5. Confirm a test member gains workspace access and the expected policy restrictions. Remove it from the pushed group while keeping its app assignment, then verify both directory-grant withdrawal and the [fallback policy](/platform/enterprise/scim#how-access-is-withdrawn) on any workspace it can still access. Add it back and verify access returns without another account being created.
 
 <Image src="/static/enterprise/okta/group-push.png" alt="Header Auth Test App Group Push selecting an engineering group and Create Group for the downstream group" width={1001} height={927} className="mx-auto h-auto w-full max-w-xl" />
 
@@ -128,6 +133,8 @@ Test credentials, save, and confirm a successful provisioning request before rev
 | Credential test fails | For Header Auth, include `Bearer `. Check the complete HTTPS URL, token expiry, provisioning switch, and network reachability. |
 | User creation fails | Verify the email domain, available seats, and whether the account belongs to another Sim organization. |
 | Member has no workspace access | Push the group and add a workspace mapping. App assignment creates organization membership. |
+| Member has access but the expected policy does not apply | Check **Group mappings** for unassigned members. Resolve overlapping membership or workspace scope under **Permission groups**, then select **Reconcile now**. For name matching, also check the exact group name. |
+| A removed mapping returns | Turn off name matching or use different names before removing a same-name mapping. See [mapping behavior](/platform/enterprise/scim#map-directory-groups). |
 | Name or membership updates do not arrive | Check app assignment, provisioning actions, attribute mappings, and Group Push status. |
 | A pushed group is missing members | Confirm those accounts are active and successfully assigned to the app. After activation, repush the group; see [Okta Group Push troubleshooting](https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-group-push-troubleshoot.htm). |
 | A deactivated member still uses a seat | Deactivation suspends access; remove organization membership to complete that offboarding step. |
diff --git a/apps/docs/public/static/enterprise/scim-group-mappings.png b/apps/docs/public/static/enterprise/scim-group-mappings.png
new file mode 100644
index 00000000000..fd5c703944b
Binary files /dev/null and b/apps/docs/public/static/enterprise/scim-group-mappings.png differ
diff --git a/apps/sim/ee/access-control/components/group-detail.tsx b/apps/sim/ee/access-control/components/group-detail.tsx
index d0ebf019166..a061a333d9e 100644
--- a/apps/sim/ee/access-control/components/group-detail.tsx
+++ b/apps/sim/ee/access-control/components/group-detail.tsx
@@ -1588,7 +1588,9 @@ export function GroupDetail({
                   <div className='flex items-center justify-between gap-3'>
                     <span className='text-[var(--text-muted)] text-small'>
                       {members.length === 0
-                        ? 'Applies to all members of its workspaces. Add members to restrict it to specific people.'
+                        ? group.membershipMode === 'inherit'
+                          ? 'Applies to all members of its workspaces. Add members to restrict it to specific people.'
+                          : 'No members assigned.'
                         : `Restricted to ${members.length} member${members.length === 1 ? '' : 's'}`}
                     </span>
                     <Chip
diff --git a/apps/sim/ee/scim/TESTING.md b/apps/sim/ee/scim/TESTING.md
index 3abfe6d9d81..b7be55731e0 100644
--- a/apps/sim/ee/scim/TESTING.md
+++ b/apps/sim/ee/scim/TESTING.md
@@ -68,9 +68,19 @@ timeout.
 - Group membership idempotency and membership-only replacement timestamps.
 - Workspace, organization-role, and permission-group mappings, reconciliation,
   drift repair, withdrawal, and preservation of pre-existing manual workspace access.
+- Automatic group renames through PATCH and PUT, including a destination already
+  mapped manually; the old policy is withdrawn immediately.
+- Mapping status when overlapping workspace policies prevent assignment, followed
+  by conflict recovery and reconciliation.
+- A concurrent membership-lock change while a group removal waits on the
+  organization lock; withdrawal uses the committed setting.
+- Concurrent name-matching changes while POST, PUT, and PATCH wait on the
+  organization lock; mapping uses the committed setting in both toggle directions.
 - Managed-membership enforcement through the actual batch invitation and
   workspace permission APIs, including successful edits to unmanaged members.
-- Session revocation on deactivation, membership retention, directory
+- Session revocation on deactivation and permanent OAuth grant revocation on
+  directory deletion, including an actual OAuth API request after deletion.
+- Membership retention, directory
   reactivation, manual suspension protection, owner protection, and account
   relinking after deletion and rehire.
 - Credential scopes, overlapping rotation, the active credential limit,
@@ -115,6 +125,20 @@ which verifies that SCIM's `disableJit` setting blocks fresh SSO membership,
 preserves existing membership, and permits JIT when disabled. These checks run
 the admission operation and Enterprise entitlement reads through PostgreSQL.
 
+The real PostgreSQL/Redis suite
+`lib/mothership/request/application/removal-stops-runs.integration.ts` verifies
+that deactivation writes durable Stops for admitted Chat runs, including concurrent
+interactive and headless admission. Reactivation cannot revive those runs or a
+headless run admitted during suspension. An existing account first provisioned
+inactive is stopped, and a rolled-back suspension emits no durable or delivered Stop.
+
+## Verification dates and limits
+
+The October 28, 2026 audit exercised the current app using the local HTTP harness,
+real PostgreSQL/Redis integration suites, and the browser UI with synthetic data.
+It did not connect to a live provider tenant. The live-provider results below are
+from September 2026 and describe that run, not certification of every later change.
+
 ## Live Okta verification
 
 The private **SCIM 2.0 Test App (Header Auth)** has also been exercised through
diff --git a/apps/sim/ee/scim/components/group-mappings.tsx b/apps/sim/ee/scim/components/group-mappings.tsx
new file mode 100644
index 00000000000..af52d2f9519
--- /dev/null
+++ b/apps/sim/ee/scim/components/group-mappings.tsx
@@ -0,0 +1,332 @@
+'use client'
+
+import { useState } from 'react'
+import { Chip, ChipConfirmModal, ChipSelect, ChipTag, toast } from '@sim/emcn'
+import { X } from '@sim/emcn/icons'
+import { getErrorMessage } from '@sim/utils/errors'
+import { useSettingsUnsavedGuard } from '@/components/settings/use-settings-unsaved-guard'
+import type {
+  ScimGroupMappingBody,
+  ScimGroupMappingView,
+} from '@/lib/api/contracts/organization-scim'
+import type { PermissionGroup } from '@/lib/api/contracts/permission-groups'
+import {
+  SettingsEmptyState,
+  SettingsQueryErrorState,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
+import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
+import {
+  useOrganizationWorkspaces,
+  usePermissionGroups,
+} from '@/ee/access-control/hooks/permission-groups'
+import {
+  type MappingTargetKind,
+  PERMISSION_OPTIONS,
+  TARGET_KIND_OPTIONS,
+  type WorkspacePermission,
+} from '@/ee/scim/components/options'
+import {
+  useDeleteScimGroupMapping,
+  useScimGroupMappings,
+  useUpsertScimGroupMapping,
+} from '@/ee/scim/hooks/scim'
+
+function describeMapping(
+  mapping: ScimGroupMappingView,
+  names: { permissionGroups: Map<string, string>; workspaces: Map<string, string> }
+): string {
+  switch (mapping.targetKind) {
+    case 'permission_group':
+      return names.permissionGroups.get(mapping.permissionGroupId ?? '') ?? 'Permission group'
+    case 'workspace': {
+      const name = names.workspaces.get(mapping.workspaceId ?? '') ?? 'Workspace'
+      const level = PERMISSION_OPTIONS.find((o) => o.value === mapping.permissionType)?.label
+      return level ? `${name} · ${level}` : name
+    }
+    case 'org_role':
+      return 'Organization admin'
+  }
+}
+
+interface AddMappingProps {
+  organizationId: string
+  groupId: string
+  permissionGroups: PermissionGroup[]
+  workspaces: Array<{ id: string; name: string }>
+}
+
+function AddMapping({ organizationId, groupId, permissionGroups, workspaces }: AddMappingProps) {
+  const upsertMapping = useUpsertScimGroupMapping()
+  const [targetKind, setTargetKind] = useState<MappingTargetKind>('permission_group')
+  const [targetId, setTargetId] = useState('')
+  const [permission, setPermission] = useState<WorkspacePermission>('read')
+  const discardMapping = () => {
+    setTargetKind('permission_group')
+    setTargetId('')
+    setPermission('read')
+  }
+  useSettingsUnsavedGuard({
+    isDirty: targetKind !== 'permission_group' || Boolean(targetId) || permission !== 'read',
+    navigationBlocked: upsertMapping.isPending,
+    onDiscard: discardMapping,
+  })
+
+  function buildBody(): ScimGroupMappingBody | null {
+    switch (targetKind) {
+      case 'permission_group':
+        return targetId ? { groupId, targetKind, permissionGroupId: targetId } : null
+      case 'workspace':
+        return targetId
+          ? { groupId, targetKind, workspaceId: targetId, permissionType: permission }
+          : null
+      case 'org_role':
+        return { groupId, targetKind, role: 'admin' }
+    }
+  }
+
+  const body = buildBody()
+  const selectedPermissionGroup =
+    targetKind === 'permission_group'
+      ? permissionGroups.find((group) => group.id === targetId)
+      : undefined
+  const changesAllMembersPolicy =
+    selectedPermissionGroup?.membershipMode === 'inherit' &&
+    selectedPermissionGroup.memberCount === 0 &&
+    selectedPermissionGroup.workspaces.length > 0
+
+  async function handleAdd() {
+    if (!body || upsertMapping.isPending) return
+    try {
+      const result = await upsertMapping.mutateAsync({ organizationId, body })
+      discardMapping()
+      if ((result.mapping.unassignedMemberCount ?? 0) > 0) {
+        toast.info('Mapping saved. Some permission-group memberships need attention below.')
+      } else {
+        toast.success(
+          `Mapping saved. Checked ${result.reconciledUsers} member${result.reconciledUsers === 1 ? '' : 's'}.`
+        )
+      }
+    } catch (error) {
+      toast.error(getErrorMessage(error, 'Failed to add mapping'))
+    }
+  }
+
+  const targetOptions = targetKind === 'permission_group' ? permissionGroups : workspaces
+
+  return (
+    <div className='flex flex-col gap-2'>
+      <div className='flex flex-wrap items-center gap-2'>
+        <ChipSelect
+          disabled={upsertMapping.isPending}
+          aria-label='Mapping target type'
+          align='start'
+          value={targetKind}
+          onChange={(next) => {
+            setTargetKind(next as MappingTargetKind)
+            setTargetId('')
+            setPermission('read')
+          }}
+          options={[...TARGET_KIND_OPTIONS]}
+        />
+        {targetKind !== 'org_role' && (
+          <ChipSelect
+            disabled={upsertMapping.isPending}
+            aria-label={targetKind === 'workspace' ? 'Workspace' : 'Permission group'}
+            align='start'
+            searchable
+            placeholder={targetKind === 'workspace' ? 'Choose a workspace' : 'Choose a group'}
+            value={targetId}
+            onChange={setTargetId}
+            options={targetOptions.map((target) => ({ value: target.id, label: target.name }))}
+          />
+        )}
+        {targetKind === 'workspace' && (
+          <ChipSelect
+            disabled={upsertMapping.isPending}
+            aria-label='Workspace permission'
+            align='start'
+            value={permission}
+            onChange={(next) => setPermission(next as WorkspacePermission)}
+            options={[...PERMISSION_OPTIONS]}
+          />
+        )}
+        <Chip variant='primary' onClick={handleAdd} disabled={!body || upsertMapping.isPending}>
+          {upsertMapping.isPending ? 'Adding...' : 'Add mapping'}
+        </Chip>
+      </div>
+      {changesAllMembersPolicy && (
+        <p className='text-[var(--text-muted)] text-caption'>
+          This permission group currently governs everyone in its workspaces. Mapping it switches it
+          permanently to selected members. Other members will use the remaining permission policy.
+        </p>
+      )}
+    </div>
+  )
+}
+
+interface GroupMappingsProps {
+  organizationId: string
+  active: boolean
+  autoMapByName: boolean
+  onReconcile: () => Promise<void>
+  reconciling: boolean
+}
+
+export function GroupMappings({
+  organizationId,
+  active,
+  autoMapByName,
+  onReconcile,
+  reconciling,
+}: GroupMappingsProps) {
+  const {
+    data: groups,
+    isLoading,
+    isError,
+    error,
+    isFetching,
+    refetch,
+  } = useScimGroupMappings(organizationId, active)
+  const { data: allPermissionGroups = [] } = usePermissionGroups(organizationId, active)
+  /** The default group governs by having no members, so it cannot be a membership target. */
+  const permissionGroups = allPermissionGroups.filter((group) => !group.isDefault)
+  const { data: workspaces = [] } = useOrganizationWorkspaces(organizationId, active)
+  const deleteMapping = useDeleteScimGroupMapping()
+  const [pendingRemoveId, setPendingRemoveId] = useState<string | null>(null)
+  const pendingRemove = groups
+    ?.flatMap((group) => group.mappings)
+    .find((mapping) => mapping.id === pendingRemoveId)
+
+  const names = {
+    permissionGroups: new Map(permissionGroups.map((group) => [group.id, group.name])),
+    workspaces: new Map(workspaces.map((workspace) => [workspace.id, workspace.name])),
+  }
+  const automaticMatchRemains =
+    pendingRemove?.targetKind === 'permission_group' &&
+    autoMapByName &&
+    (pendingRemove.source === 'automatic' ||
+      names.permissionGroups.get(pendingRemove.permissionGroupId ?? '') ===
+        pendingRemove.groupDisplayName)
+
+  async function handleRemove() {
+    if (!pendingRemove || deleteMapping.isPending) return
+    try {
+      await deleteMapping.mutateAsync({ organizationId, mappingId: pendingRemove.id })
+      setPendingRemoveId(null)
+      toast.success('Mapping removed')
+    } catch (error) {
+      toast.error(getErrorMessage(error, 'Failed to remove mapping'))
+    }
+  }
+
+  if (isLoading) {
+    return <SettingsEmptyState variant='inline'>Loading groups...</SettingsEmptyState>
+  }
+  if (groups === undefined && isError) {
+    return (
+      <SettingsQueryErrorState
+        error={error}
+        fallback='Failed to load directory groups'
+        isRetrying={isFetching}
+        onRetry={() => void refetch()}
+        variant='inline'
+      />
+    )
+  }
+  if (!groups || groups.length === 0) {
+    return (
+      <SettingsEmptyState variant='inline'>
+        No groups yet. Push a group from your identity provider and it appears here.
+      </SettingsEmptyState>
+    )
+  }
+
+  return (
+    <>
+      <div className='flex flex-col gap-5'>
+        {groups.map((group) => {
+          const unassignedMappings = group.mappings.filter(
+            (mapping) => (mapping.unassignedMemberCount ?? 0) > 0
+          )
+          return (
+            <div key={group.id} className='flex flex-col gap-3'>
+              <SettingsResourceRow
+                title={group.displayName}
+                description={`${group.memberCount} member${group.memberCount === 1 ? '' : 's'}`}
+              />
+              <div className='flex flex-col gap-3'>
+                {group.mappings.length > 0 && (
+                  <div className='flex flex-wrap gap-1.5'>
+                    {group.mappings.map((mapping) => (
+                      <ChipTag
+                        key={mapping.id}
+                        variant='gray'
+                        rightIcon={X}
+                        rightIconLabel={`Remove ${describeMapping(mapping, names)} mapping`}
+                        rightIconDisabled={deleteMapping.isPending}
+                        onRightIconClick={() => setPendingRemoveId(mapping.id)}
+                      >
+                        {describeMapping(mapping, names)}
+                        {mapping.source === 'automatic' ? ' · Automatic' : ''}
+                      </ChipTag>
+                    ))}
+                  </div>
+                )}
+                {unassignedMappings.length > 0 && (
+                  <div className='flex flex-col gap-2'>
+                    {unassignedMappings.map((mapping) => (
+                      <p key={mapping.id} className='text-[var(--text-error)] text-caption'>
+                        {describeMapping(mapping, names)}: {mapping.unassignedMemberCount} directory
+                        {mapping.unassignedMemberCount === 1 ? ' member is' : ' members are'} not
+                        assigned.
+                      </p>
+                    ))}
+                    <p className='text-[var(--text-muted)] text-caption'>
+                      A member can belong to only one permission group per workspace. Review
+                      overlapping memberships in Permission groups, then reconcile.
+                    </p>
+                    <div>
+                      <Chip onClick={onReconcile} disabled={reconciling}>
+                        {reconciling ? 'Reconciling...' : 'Reconcile now'}
+                      </Chip>
+                    </div>
+                  </div>
+                )}
+                <AddMapping
+                  organizationId={organizationId}
+                  groupId={group.id}
+                  permissionGroups={permissionGroups}
+                  workspaces={workspaces}
+                />
+              </div>
+            </div>
+          )
+        })}
+      </div>
+      <ChipConfirmModal
+        open={active && pendingRemove !== undefined}
+        onOpenChange={(open) => !open && setPendingRemoveId(null)}
+        title='Remove mapping'
+        text={[
+          'Remove the mapping to ',
+          { text: pendingRemove ? describeMapping(pendingRemove, names) : '', bold: true },
+          '? ',
+          pendingRemove?.targetKind === 'permission_group'
+            ? 'Members may keep workspace access under a different permission policy.'
+            : 'Directory-managed access from this mapping will be withdrawn unless another mapping grants it. Existing manual access may remain.',
+          ...(automaticMatchRemains
+            ? [
+                ' Name matching is enabled and can recreate this mapping. Turn off Match permission groups by name first to keep it removed.',
+              ]
+            : []),
+        ]}
+        confirm={{
+          label: 'Remove',
+          onClick: handleRemove,
+          pending: deleteMapping.isPending,
+          pendingLabel: 'Removing...',
+        }}
+      />
+    </>
+  )
+}
diff --git a/apps/sim/ee/scim/components/scim-section.tsx b/apps/sim/ee/scim/components/scim-section.tsx
index 0874809a6ae..193aea825f2 100644
--- a/apps/sim/ee/scim/components/scim-section.tsx
+++ b/apps/sim/ee/scim/components/scim-section.tsx
@@ -18,15 +18,13 @@ import {
   Switch,
   toast,
 } from '@sim/emcn'
-import { Key, X } from '@sim/emcn/icons'
+import { Key } from '@sim/emcn/icons'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useSettingsUnsavedGuard } from '@/components/settings/use-settings-unsaved-guard'
 import type {
   ScimActivityEntry,
   ScimConnectionView,
   ScimCredentialView,
-  ScimGroupMappingBody,
-  ScimGroupMappingView,
 } from '@/lib/api/contracts/organization-scim'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
 import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
@@ -39,30 +37,20 @@ import {
   SettingsResourceRow,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
-import {
-  useOrganizationWorkspaces,
-  usePermissionGroups,
-} from '@/ee/access-control/hooks/permission-groups'
 import { SettingRow } from '@/ee/components/setting-row'
+import { GroupMappings } from '@/ee/scim/components/group-mappings'
 import {
   CREDENTIAL_EXPIRY_OPTIONS,
   type CredentialExpiry,
-  type MappingTargetKind,
-  PERMISSION_OPTIONS,
   SETTING_TOGGLES,
-  TARGET_KIND_OPTIONS,
-  type WorkspacePermission,
 } from '@/ee/scim/components/options'
 import {
   useConfigureScimConnection,
-  useDeleteScimGroupMapping,
   useIssueScimCredential,
   useReconcileScimConnection,
   useRevokeScimCredential,
   useScimActivity,
   useScimConnection,
-  useScimGroupMappings,
-  useUpsertScimGroupMapping,
 } from '@/ee/scim/hooks/scim'
 import { useSettingsDirtyStore } from '@/stores/settings/dirty/store'
 
@@ -85,23 +73,6 @@ function formatRelative(iso: string | null): string {
   return RELATIVE_TIME.format(Math.round(hours / 24), 'day')
 }
 
-function describeMapping(
-  mapping: ScimGroupMappingView,
-  names: { permissionGroups: Map<string, string>; workspaces: Map<string, string> }
-): string {
-  switch (mapping.targetKind) {
-    case 'permission_group':
-      return names.permissionGroups.get(mapping.permissionGroupId ?? '') ?? 'Permission group'
-    case 'workspace': {
-      const name = names.workspaces.get(mapping.workspaceId ?? '') ?? 'Workspace'
-      const level = PERMISSION_OPTIONS.find((o) => o.value === mapping.permissionType)?.label
-      return level ? `${name} · ${level}` : name
-    }
-    case 'org_role':
-      return 'Organization admin'
-  }
-}
-
 interface CredentialRowProps {
   credential: ScimCredentialView
   onRevoke: (credential: ScimCredentialView) => void
@@ -125,198 +96,6 @@ function CredentialRow({ credential, onRevoke }: CredentialRowProps) {
   )
 }
 
-interface AddMappingProps {
-  organizationId: string
-  groupId: string
-  permissionGroups: Array<{ id: string; name: string }>
-  workspaces: Array<{ id: string; name: string }>
-}
-
-function AddMapping({ organizationId, groupId, permissionGroups, workspaces }: AddMappingProps) {
-  const upsertMapping = useUpsertScimGroupMapping()
-  const [targetKind, setTargetKind] = useState<MappingTargetKind>('permission_group')
-  const [targetId, setTargetId] = useState('')
-  const [permission, setPermission] = useState<WorkspacePermission>('read')
-  const discardMapping = () => {
-    setTargetKind('permission_group')
-    setTargetId('')
-    setPermission('read')
-  }
-  useSettingsUnsavedGuard({
-    isDirty: targetKind !== 'permission_group' || Boolean(targetId) || permission !== 'read',
-    navigationBlocked: upsertMapping.isPending,
-    onDiscard: discardMapping,
-  })
-
-  function buildBody(): ScimGroupMappingBody | null {
-    switch (targetKind) {
-      case 'permission_group':
-        return targetId ? { groupId, targetKind, permissionGroupId: targetId } : null
-      case 'workspace':
-        return targetId
-          ? { groupId, targetKind, workspaceId: targetId, permissionType: permission }
-          : null
-      case 'org_role':
-        return { groupId, targetKind, role: 'admin' }
-    }
-  }
-
-  const body = buildBody()
-
-  async function handleAdd() {
-    if (!body || upsertMapping.isPending) return
-    try {
-      const result = await upsertMapping.mutateAsync({ organizationId, body })
-      discardMapping()
-      toast.success(
-        result.reconciledUsers === 0
-          ? 'Mapping added'
-          : `Mapping added and applied to ${result.reconciledUsers} member${result.reconciledUsers === 1 ? '' : 's'}`
-      )
-    } catch (error) {
-      toast.error(getErrorMessage(error, 'Failed to add mapping'))
-    }
-  }
-
-  const targetOptions = targetKind === 'permission_group' ? permissionGroups : workspaces
-
-  return (
-    <div className='flex flex-wrap items-center gap-2'>
-      <ChipSelect
-        disabled={upsertMapping.isPending}
-        aria-label='Mapping target type'
-        align='start'
-        value={targetKind}
-        onChange={(next) => {
-          setTargetKind(next as MappingTargetKind)
-          setTargetId('')
-          setPermission('read')
-        }}
-        options={[...TARGET_KIND_OPTIONS]}
-      />
-      {targetKind !== 'org_role' && (
-        <ChipSelect
-          disabled={upsertMapping.isPending}
-          aria-label={targetKind === 'workspace' ? 'Workspace' : 'Permission group'}
-          align='start'
-          searchable
-          placeholder={targetKind === 'workspace' ? 'Choose a workspace' : 'Choose a group'}
-          value={targetId}
-          onChange={setTargetId}
-          options={targetOptions.map((target) => ({ value: target.id, label: target.name }))}
-        />
-      )}
-      {targetKind === 'workspace' && (
-        <ChipSelect
-          disabled={upsertMapping.isPending}
-          aria-label='Workspace permission'
-          align='start'
-          value={permission}
-          onChange={(next) => setPermission(next as WorkspacePermission)}
-          options={[...PERMISSION_OPTIONS]}
-        />
-      )}
-      <Chip variant='primary' onClick={handleAdd} disabled={!body || upsertMapping.isPending}>
-        {upsertMapping.isPending ? 'Adding...' : 'Add mapping'}
-      </Chip>
-    </div>
-  )
-}
-
-interface GroupMappingsProps {
-  organizationId: string
-  active: boolean
-}
-
-function GroupMappings({ organizationId, active }: GroupMappingsProps) {
-  const {
-    data: groups,
-    isLoading,
-    isError,
-    error,
-    isFetching,
-    refetch,
-  } = useScimGroupMappings(organizationId, active)
-  const { data: allPermissionGroups = [] } = usePermissionGroups(organizationId, active)
-  /** The default group governs by having no members, so it cannot be a membership target. */
-  const permissionGroups = allPermissionGroups.filter((group) => !group.isDefault)
-  const { data: workspaces = [] } = useOrganizationWorkspaces(organizationId, active)
-  const deleteMapping = useDeleteScimGroupMapping()
-
-  const names = {
-    permissionGroups: new Map(permissionGroups.map((group) => [group.id, group.name])),
-    workspaces: new Map(workspaces.map((workspace) => [workspace.id, workspace.name])),
-  }
-
-  async function handleRemove(mapping: ScimGroupMappingView) {
-    try {
-      await deleteMapping.mutateAsync({ organizationId, mappingId: mapping.id })
-      toast.success('Mapping removed')
-    } catch (error) {
-      toast.error(getErrorMessage(error, 'Failed to remove mapping'))
-    }
-  }
-
-  if (isLoading) {
-    return <SettingsEmptyState variant='inline'>Loading groups...</SettingsEmptyState>
-  }
-  if (groups === undefined && isError) {
-    return (
-      <SettingsQueryErrorState
-        error={error}
-        fallback='Failed to load directory groups'
-        isRetrying={isFetching}
-        onRetry={() => void refetch()}
-        variant='inline'
-      />
-    )
-  }
-  if (!groups || groups.length === 0) {
-    return (
-      <SettingsEmptyState variant='inline'>
-        No groups yet. Push a group from your identity provider and it appears here.
-      </SettingsEmptyState>
-    )
-  }
-
-  return (
-    <div className='flex flex-col gap-5'>
-      {groups.map((group) => (
-        <div key={group.id} className='flex flex-col gap-3'>
-          <SettingsResourceRow
-            title={group.displayName}
-            description={`${group.memberCount} member${group.memberCount === 1 ? '' : 's'}`}
-          />
-          <div className='flex flex-col gap-3'>
-            {group.mappings.length > 0 && (
-              <div className='flex flex-wrap gap-1.5'>
-                {group.mappings.map((mapping) => (
-                  <ChipTag
-                    key={mapping.id}
-                    variant='gray'
-                    rightIcon={X}
-                    rightIconLabel='Remove mapping'
-                    rightIconDisabled={deleteMapping.isPending}
-                    onRightIconClick={() => void handleRemove(mapping)}
-                  >
-                    {describeMapping(mapping, names)}
-                  </ChipTag>
-                ))}
-              </div>
-            )}
-            <AddMapping
-              organizationId={organizationId}
-              groupId={group.id}
-              permissionGroups={permissionGroups}
-              workspaces={workspaces}
-            />
-          </div>
-        </div>
-      ))}
-    </div>
-  )
-}
-
 interface ActivityListProps {
   organizationId: string
   active: boolean
@@ -447,7 +226,7 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
       const corrections = report.grantsAdded + report.grantsRemoved
       toast.success(
         corrections === 0
-          ? `Checked ${report.reconciledUsers} members; nothing to correct`
+          ? `Checked ${report.reconciledUsers} members. Review Group mappings for assignment status.`
           : `Checked ${report.reconciledUsers} members; corrected ${corrections} grant${corrections === 1 ? '' : 's'}`
       )
     } catch (error) {
@@ -564,7 +343,13 @@ function ConnectionDetails({ organizationId, connection, active }: ConnectionDet
           label='Directory groups'
           description='Map directory groups to permission groups, workspaces, or the organization admin role.'
         >
-          <GroupMappings organizationId={organizationId} active={active} />
+          <GroupMappings
+            organizationId={organizationId}
+            active={active}
+            autoMapByName={connection.settings.autoMapPermissionGroupsByName === true}
+            onReconcile={handleReconcile}
+            reconciling={reconcile.isPending}
+          />
         </SettingRow>
       </SettingsSection>
 
diff --git a/apps/sim/ee/scim/hooks/scim.ts b/apps/sim/ee/scim/hooks/scim.ts
index 2f3ef2a8a8b..c472a129720 100644
--- a/apps/sim/ee/scim/hooks/scim.ts
+++ b/apps/sim/ee/scim/hooks/scim.ts
@@ -13,6 +13,7 @@ import {
   type ScimGroupMappingBody,
   upsertScimGroupMappingContract,
 } from '@/lib/api/contracts/organization-scim'
+import { permissionGroupKeys } from '@/hooks/queries/utils/permission-group-keys'
 
 export const SCIM_CONNECTION_STALE_TIME = 30 * 1000
 export const SCIM_MAPPINGS_STALE_TIME = 30 * 1000
@@ -54,6 +55,7 @@ export function useScimGroupMappings(organizationId?: string, enabled = true) {
     },
     enabled: Boolean(organizationId) && enabled,
     staleTime: SCIM_MAPPINGS_STALE_TIME,
+    refetchInterval: SCIM_ACTIVITY_REFETCH_INTERVAL,
   })
 }
 
@@ -138,6 +140,7 @@ export function useUpsertScimGroupMapping() {
       requestJson(upsertScimGroupMappingContract, { params: { id: organizationId }, body }),
     onSettled: (_data, _error, { organizationId }) => {
       queryClient.invalidateQueries({ queryKey: scimKeys.mappings(organizationId) })
+      queryClient.invalidateQueries({ queryKey: permissionGroupKeys.all })
     },
   })
 }
@@ -154,6 +157,7 @@ export function useDeleteScimGroupMapping() {
       requestJson(deleteScimGroupMappingContract, { params: { id: organizationId, mappingId } }),
     onSettled: (_data, _error, { organizationId }) => {
       queryClient.invalidateQueries({ queryKey: scimKeys.mappings(organizationId) })
+      queryClient.invalidateQueries({ queryKey: permissionGroupKeys.all })
     },
   })
 }
@@ -166,6 +170,7 @@ export function useReconcileScimConnection() {
     onSettled: (_data, _error, organizationId) => {
       queryClient.invalidateQueries({ queryKey: scimKeys.connection(organizationId) })
       queryClient.invalidateQueries({ queryKey: scimKeys.mappings(organizationId) })
+      queryClient.invalidateQueries({ queryKey: permissionGroupKeys.all })
     },
   })
 }
diff --git a/apps/sim/ee/scim/lib/application/admin/mappings.ts b/apps/sim/ee/scim/lib/application/admin/mappings.ts
index 62b8e5d762b..f4bfe427c5d 100644
--- a/apps/sim/ee/scim/lib/application/admin/mappings.ts
+++ b/apps/sim/ee/scim/lib/application/admin/mappings.ts
@@ -2,14 +2,15 @@ import { AuditAction, AuditResourceType } from '@sim/audit'
 import { db } from '@sim/db'
 import {
   permissionGroup,
-  type ScimConnectionSettings,
+  permissionGroupMember,
   scimConnection,
   scimGroup,
   scimGroupMapping,
   scimGroupMember,
+  scimUser,
 } from '@sim/db/schema'
 import { generateId } from '@sim/utils/id'
-import { and, count, eq, sql } from 'drizzle-orm'
+import { and, count, eq, isNull, sql } from 'drizzle-orm'
 import type { ScimGroupMappingView } from '@/lib/api/contracts/organization-scim'
 import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
@@ -43,18 +44,23 @@ const MAPPING_COLUMNS = {
   workspaceId: scimGroupMapping.workspaceId,
   permissionType: scimGroupMapping.permissionType,
   role: scimGroupMapping.role,
+  source: scimGroupMapping.source,
 } as const
 
-function toMappingView(row: {
-  id: string
-  groupId: string
-  groupDisplayName: string
-  targetKind: string
-  permissionGroupId: string | null
-  workspaceId: string | null
-  permissionType: 'admin' | 'write' | 'read' | null
-  role: string | null
-}): ScimGroupMappingView {
+function toMappingView(
+  row: {
+    id: string
+    groupId: string
+    groupDisplayName: string
+    targetKind: string
+    permissionGroupId: string | null
+    workspaceId: string | null
+    permissionType: 'admin' | 'write' | 'read' | null
+    role: string | null
+    source: string
+  },
+  unassignedMemberCount: number | null
+): ScimGroupMappingView {
   return {
     id: row.id,
     groupId: row.groupId,
@@ -64,9 +70,49 @@ function toMappingView(row: {
     workspaceId: row.workspaceId,
     permissionType: row.permissionType,
     role: row.role,
+    source: row.source as ScimGroupMappingView['source'],
+    unassignedMemberCount,
   }
 }
 
+/** Reads actual membership so skipped or subsequently removed assignments stay visible. */
+async function unassignedPermissionGroupMemberCounts(params: {
+  connectionId: string
+  organizationId: string
+  groupId?: string
+}): Promise<Map<string, number>> {
+  const rows = await db
+    .select({ mappingId: scimGroupMapping.id, value: count() })
+    .from(scimGroupMapping)
+    .innerJoin(scimGroup, eq(scimGroup.id, scimGroupMapping.groupId))
+    .innerJoin(scimGroupMember, eq(scimGroupMember.groupId, scimGroup.id))
+    .innerJoin(
+      scimUser,
+      and(
+        eq(scimUser.id, scimGroupMember.scimUserId),
+        eq(scimUser.connectionId, scimGroup.connectionId)
+      )
+    )
+    .leftJoin(
+      permissionGroupMember,
+      and(
+        eq(permissionGroupMember.permissionGroupId, scimGroupMapping.permissionGroupId),
+        eq(permissionGroupMember.organizationId, params.organizationId),
+        eq(permissionGroupMember.userId, scimUser.userId)
+      )
+    )
+    .where(
+      and(
+        eq(scimGroup.connectionId, params.connectionId),
+        eq(scimGroupMapping.targetKind, 'permission_group'),
+        isNull(permissionGroupMember.id),
+        params.groupId ? eq(scimGroup.id, params.groupId) : undefined
+      )
+    )
+    .groupBy(scimGroupMapping.id)
+  return new Map(rows.map((row) => [row.mappingId, Number(row.value)]))
+}
+
 export const listScimGroupMappings = defineAuthorizedScimAdminUseCase({
   operation: scimAdminOperations.read,
   async execute({ input }: ScimAdminUseCaseArgs<{ organizationId: string }>) {
@@ -77,7 +123,7 @@ export const listScimGroupMappings = defineAuthorizedScimAdminUseCase({
       .limit(1)
     if (!connection) return { groups: [] }
 
-    const [groups, mappings, counts] = await Promise.all([
+    const [groups, mappings, counts, unassignedCounts] = await Promise.all([
       db
         .select({ id: scimGroup.id, displayName: scimGroup.displayName })
         .from(scimGroup)
@@ -94,13 +140,22 @@ export const listScimGroupMappings = defineAuthorizedScimAdminUseCase({
         .innerJoin(scimGroup, eq(scimGroup.id, scimGroupMember.groupId))
         .where(eq(scimGroup.connectionId, connection.id))
         .groupBy(scimGroupMember.groupId),
+      unassignedPermissionGroupMemberCounts({
+        connectionId: connection.id,
+        organizationId: input.organizationId,
+      }),
     ])
 
     const memberCounts = new Map(counts.map((row) => [row.groupId, Number(row.value)]))
     const mappingsByGroup = new Map<string, ScimGroupMappingView[]>()
     for (const row of mappings) {
       const list = mappingsByGroup.get(row.groupId) ?? []
-      list.push(toMappingView(row))
+      list.push(
+        toMappingView(
+          row,
+          row.targetKind === 'permission_group' ? (unassignedCounts.get(row.id) ?? 0) : null
+        )
+      )
       mappingsByGroup.set(row.groupId, list)
     }
 
@@ -120,7 +175,6 @@ async function reconcileGroupMembers(params: {
   connectionId: string
   organizationId: string
   groupId: string
-  settings: ScimConnectionSettings
 }): Promise<number> {
   const members = await db
     .select({ scimUserId: scimGroupMember.scimUserId })
@@ -131,7 +185,6 @@ async function reconcileGroupMembers(params: {
     connectionId: params.connectionId,
     organizationId: params.organizationId,
     scimUserIds: members.map((row) => row.scimUserId),
-    settings: params.settings,
   })
   return members.length
 }
@@ -269,11 +322,22 @@ export const upsertScimGroupMapping = defineAuthorizedScimAdminUseCase({
       connectionId: connection.id,
       organizationId: context.organizationId,
       groupId: group.id,
-      settings: connection.settings,
     })
 
+    const unassignedCounts =
+      input.targetKind === 'permission_group'
+        ? await unassignedPermissionGroupMemberCounts({
+            connectionId: connection.id,
+            organizationId: context.organizationId,
+            groupId: group.id,
+          })
+        : null
+
     return {
-      mapping: toMappingView({ ...mapping, groupDisplayName: group.displayName }),
+      mapping: toMappingView(
+        { ...mapping, groupDisplayName: group.displayName },
+        unassignedCounts ? (unassignedCounts.get(mapping.id) ?? 0) : null
+      ),
       reconciledUsers,
     }
   },
@@ -310,7 +374,6 @@ export const deleteScimGroupMapping = defineAuthorizedScimAdminUseCase({
       connectionId: connection.id,
       organizationId: context.organizationId,
       groupId: mapping.groupId,
-      settings: connection.settings,
     })
 
     return { success: true as const, reconciledUsers, mapping }
diff --git a/apps/sim/ee/scim/lib/application/groups/manage-groups.test.ts b/apps/sim/ee/scim/lib/application/groups/manage-groups.test.ts
index 7b469c7a426..ec66b05d1af 100644
--- a/apps/sim/ee/scim/lib/application/groups/manage-groups.test.ts
+++ b/apps/sim/ee/scim/lib/application/groups/manage-groups.test.ts
@@ -77,6 +77,7 @@ describe('replaceScimGroup', () => {
     queueTableRows(scimConnection, [
       { id: 'conn-1', organizationId: 'org-1', status: 'active', settings: {} },
     ])
+    queueTableRows(scimConnection, [{ status: 'active', settings: {} }])
     let group = { ...initialGroup }
     const memberIds = new Set(['user-1'])
     mocks.findGroup.mockImplementation(async () => group)
diff --git a/apps/sim/ee/scim/lib/application/groups/manage-groups.ts b/apps/sim/ee/scim/lib/application/groups/manage-groups.ts
index 2ad3f480e59..ba1d03fb197 100644
--- a/apps/sim/ee/scim/lib/application/groups/manage-groups.ts
+++ b/apps/sim/ee/scim/lib/application/groups/manage-groups.ts
@@ -1,6 +1,6 @@
 import { AuditAction, AuditResourceType } from '@sim/audit'
 import { db } from '@sim/db'
-import { scimGroup } from '@sim/db/schema'
+import { type ScimConnectionSettings, scimConnection, scimGroup } from '@sim/db/schema'
 import { and, eq, ne } from 'drizzle-orm'
 import type { ScimPatchOperation } from '@/lib/api/contracts/scim'
 import { acquireOrganizationMutationLock } from '@/lib/billing/organizations/membership'
@@ -57,11 +57,26 @@ import {
  */
 async function withGroupWrite<T extends { stoppedRuns: StoppedRun[] }>(
   context: ScimUseCaseContext,
-  work: (tx: DbTransaction) => Promise<T>
+  work: (tx: DbTransaction, settings: ScimConnectionSettings) => Promise<T>
 ): Promise<Omit<T, 'stoppedRuns'>> {
   const { stoppedRuns, ...result } = await db.transaction(async (tx) => {
     await acquireOrganizationMutationLock(tx, context.organizationId)
-    return work(tx)
+    const [connection] = await tx
+      .select({ status: scimConnection.status, settings: scimConnection.settings })
+      .from(scimConnection)
+      .where(
+        and(
+          eq(scimConnection.id, context.connection.id),
+          eq(scimConnection.organizationId, context.organizationId)
+        )
+      )
+      .limit(1)
+    if (!connection || connection.status !== 'active') {
+      throw new ScimError(401, undefined, 'Invalid SCIM token', {
+        'WWW-Authenticate': 'Bearer realm="SCIM"',
+      })
+    }
+    return work(tx, connection.settings)
   })
   deliverRunStops(stoppedRuns)
   return result
@@ -185,7 +200,7 @@ export const createScimGroup = defineAuthorizedScimUseCase({
     context,
   }: ScimUseCaseArgs<CreateScimGroupInput>): Promise<ScimGroupWriteResult> {
     const { group } = input
-    return withGroupWrite(context, async (tx) => {
+    return withGroupWrite(context, async (tx, settings) => {
       await assertDisplayNameAvailable(tx, {
         connectionId: context.connection.id,
         displayName: group.displayName,
@@ -202,7 +217,7 @@ export const createScimGroup = defineAuthorizedScimUseCase({
       }
       await assertMemberCount(tx, created.id)
 
-      const mapped = context.connection.settings.autoMapPermissionGroupsByName
+      const mapped = settings.autoMapPermissionGroupsByName
         ? await autoMapPermissionGroupByName(tx, {
             organizationId: context.organizationId,
             scimGroupId: created.id,
@@ -214,7 +229,6 @@ export const createScimGroup = defineAuthorizedScimUseCase({
         connectionId: context.connection.id,
         organizationId: context.organizationId,
         scimUserIds: memberIds,
-        settings: context.connection.settings,
       })
       if (mapped === 'mapped') {
         await settleMappedPermissionGroupsExplicit(tx, {
@@ -254,7 +268,7 @@ export const replaceScimGroup = defineAuthorizedScimUseCase({
     input,
     context,
   }: ScimUseCaseArgs<ReplaceScimGroupInput>): Promise<ScimGroupWriteResult> {
-    return withGroupWrite(context, async (tx) => {
+    return withGroupWrite(context, async (tx, settings) => {
       const current = await findScimGroupById(tx, context.connection.id, input.groupId)
       if (!current) throw notFound('SCIM Group not found')
 
@@ -278,7 +292,7 @@ export const replaceScimGroup = defineAuthorizedScimUseCase({
         })
       }
       let adopted = false
-      if (renamed && context.connection.settings.autoMapPermissionGroupsByName) {
+      if (renamed && settings.autoMapPermissionGroupsByName) {
         const mapped = await autoMapPermissionGroupByName(tx, {
           organizationId: context.organizationId,
           scimGroupId: current.id,
@@ -305,7 +319,6 @@ export const replaceScimGroup = defineAuthorizedScimUseCase({
         connectionId: context.connection.id,
         organizationId: context.organizationId,
         scimUserIds: [...touched],
-        settings: context.connection.settings,
       })
       if (adopted) {
         await settleMappedPermissionGroupsExplicit(tx, {
@@ -360,7 +373,7 @@ export const patchScimGroup = defineAuthorizedScimUseCase({
   }: ScimUseCaseArgs<PatchScimGroupInput>): Promise<PatchScimGroupResult> {
     const patch = parseGroupPatch(input.operations)
 
-    return withGroupWrite(context, async (tx) => {
+    return withGroupWrite(context, async (tx, settings) => {
       const current = await findScimGroupById(tx, context.connection.id, input.groupId)
       if (!current) throw notFound('SCIM Group not found')
 
@@ -404,11 +417,7 @@ export const patchScimGroup = defineAuthorizedScimUseCase({
             ...(externalIdChanged ? { externalId: patch.externalId } : {}),
           })
         }
-        if (
-          renamed &&
-          patch.displayName &&
-          context.connection.settings.autoMapPermissionGroupsByName
-        ) {
+        if (renamed && patch.displayName && settings.autoMapPermissionGroupsByName) {
           const mapped = await autoMapPermissionGroupByName(tx, {
             organizationId: context.organizationId,
             scimGroupId: current.id,
@@ -439,7 +448,6 @@ export const patchScimGroup = defineAuthorizedScimUseCase({
         connectionId: context.connection.id,
         organizationId: context.organizationId,
         scimUserIds: [...touched],
-        settings: context.connection.settings,
       })
       if (adopted) {
         await settleMappedPermissionGroupsExplicit(tx, {
@@ -493,7 +501,6 @@ export const deleteScimGroup = defineAuthorizedScimUseCase({
         connectionId: context.connection.id,
         organizationId: context.organizationId,
         scimUserIds: memberIds,
-        settings: context.connection.settings,
       })
       return {
         groupId: current.id,
diff --git a/apps/sim/ee/scim/lib/application/users/provision-user.test.ts b/apps/sim/ee/scim/lib/application/users/provision-user.test.ts
index eeead8bc2bb..d0d23302239 100644
--- a/apps/sim/ee/scim/lib/application/users/provision-user.test.ts
+++ b/apps/sim/ee/scim/lib/application/users/provision-user.test.ts
@@ -165,7 +165,7 @@ describe('provisionScimUser', () => {
     mocks.assertEmailAvailable.mockResolvedValue(undefined)
     mocks.consumeTombstone.mockResolvedValue(undefined)
     mocks.syncIdentity.mockResolvedValue(false)
-    mocks.suspend.mockResolvedValue(undefined)
+    mocks.suspend.mockResolvedValue({ suspended: true, sessionsRevoked: 0, stoppedRuns: [] })
     mocks.unsuspend.mockResolvedValue(undefined)
     mocks.isInstanceMode.mockReturnValue(false)
     mocks.getInstanceOrganizationId.mockResolvedValue(null)
diff --git a/apps/sim/ee/scim/lib/application/users/provision-user.ts b/apps/sim/ee/scim/lib/application/users/provision-user.ts
index a88375ac3a6..d63a401c9ad 100644
--- a/apps/sim/ee/scim/lib/application/users/provision-user.ts
+++ b/apps/sim/ee/scim/lib/application/users/provision-user.ts
@@ -10,6 +10,8 @@ import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import { ensureUserInOrganizationTx } from '@/lib/billing/organizations/membership'
 import { resolveOrganizationSeatPolicyTx } from '@/lib/billing/organizations/seat-policy'
 import { reconcileOrganizationSeats } from '@/lib/billing/organizations/seats'
+import type { StoppedRun } from '@/lib/mothership/async-runs/repository'
+import { deliverRunStops } from '@/lib/mothership/request/application/stop-delivery'
 import {
   getInstanceOrganizationId,
   isInstanceOrganizationMode,
@@ -155,6 +157,7 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
     }
 
     let provisioned: {
+      stoppedRuns: StoppedRun[]
       scimUserId: string
       joinedOrganization: boolean
       subscriptionId: string | undefined
@@ -205,12 +208,14 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
          * so a create can arrive already inactive and must land suspended rather
          * than briefly usable.
          */
+        let stoppedRuns: StoppedRun[] = []
         if (!attributes.active) {
-          await suspendMemberTx(tx, {
+          const suspension = await suspendMemberTx(tx, {
             userId,
             organizationId: context.organizationId,
             source: 'scim',
           })
+          stoppedRuns = suspension.stoppedRuns
         }
 
         await consumeTombstone(tx, {
@@ -222,13 +227,13 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
           connectionId: context.connection.id,
           organizationId: context.organizationId,
           scimUserId: inserted.id,
-          settings: context.connection.settings,
         })
         const record = await findScimUserById(tx, context.connection.id, inserted.id)
         if (!record) {
           throw new ScimError(500, undefined, 'The provisioned user could not be read back')
         }
         return {
+          stoppedRuns,
           scimUserId: inserted.id,
           joinedOrganization: !membership.alreadyMember,
           subscriptionId: seatPolicy.organizationSubscriptionId,
@@ -253,8 +258,10 @@ export const provisionScimUser = defineAuthorizedScimUseCase({
       }
       throw error
     }
+    const { stoppedRuns, ...result } = provisioned
+    deliverRunStops(stoppedRuns)
     return {
-      ...provisioned,
+      ...result,
       userId,
       createdAccount,
       organizationId: context.organizationId,
diff --git a/apps/sim/ee/scim/lib/application/users/update-user.test.ts b/apps/sim/ee/scim/lib/application/users/update-user.test.ts
index b809b8a8495..5d4061c2906 100644
--- a/apps/sim/ee/scim/lib/application/users/update-user.test.ts
+++ b/apps/sim/ee/scim/lib/application/users/update-user.test.ts
@@ -133,6 +133,7 @@ describe('user updates', () => {
   beforeEach(() => {
     resetDbChainMock()
     mocks.loadGroups.mockResolvedValue(new Map())
+    mocks.suspend.mockResolvedValue({ suspended: true, sessionsRevoked: 0, stoppedRuns: [] })
     mocks.reconcile.mockResolvedValue({ added: [], removed: [], raised: [], stoppedRuns: [] })
   })
 
diff --git a/apps/sim/ee/scim/lib/application/users/update-user.ts b/apps/sim/ee/scim/lib/application/users/update-user.ts
index 7361ec169c2..7b6518b5430 100644
--- a/apps/sim/ee/scim/lib/application/users/update-user.ts
+++ b/apps/sim/ee/scim/lib/application/users/update-user.ts
@@ -100,12 +100,14 @@ async function applyUserUpdate(
     await syncAccountIdentityTx(tx, { userId: current.userId, name: nextName })
   }
 
+  let stoppedRuns: StoppedRun[] = []
   if (deactivated) {
-    await suspendMemberTx(tx, {
+    const suspension = await suspendMemberTx(tx, {
       userId: current.userId,
       organizationId: context.organizationId,
       source: 'scim',
     })
+    stoppedRuns = suspension.stoppedRuns
   } else if (reactivated) {
     await unsuspendMemberTx(tx, { userId: current.userId, source: 'scim' })
   }
@@ -120,12 +122,13 @@ async function applyUserUpdate(
     connectionId: context.connection.id,
     organizationId: context.organizationId,
     scimUserId: current.id,
-    settings: context.connection.settings,
   })
 
   return {
     outcome: { emailChanged, deactivated, reactivated },
-    stoppedRuns: projection.stoppedRuns,
+    stoppedRuns: [
+      ...new Map([...stoppedRuns, ...projection.stoppedRuns].map((run) => [run.id, run])).values(),
+    ],
   }
 }
 
diff --git a/apps/sim/ee/scim/lib/projection/auto-map.ts b/apps/sim/ee/scim/lib/projection/auto-map.ts
index 629940e52a0..0d61a469e0e 100644
--- a/apps/sim/ee/scim/lib/projection/auto-map.ts
+++ b/apps/sim/ee/scim/lib/projection/auto-map.ts
@@ -65,7 +65,7 @@ export async function autoMapPermissionGroupByName(
       )
     )
     .limit(1)
-  if (existing) return 'already-mapped'
+  if (existing) return removed.length > 0 ? 'mapped' : 'already-mapped'
 
   /** The unique index is the arbiter when an administrator maps the same pair concurrently. */
   const inserted = await tx
@@ -80,7 +80,7 @@ export async function autoMapPermissionGroupByName(
     })
     .onConflictDoNothing()
     .returning({ id: scimGroupMapping.id })
-  return inserted.length > 0 ? 'mapped' : 'already-mapped'
+  return inserted.length > 0 || removed.length > 0 ? 'mapped' : 'already-mapped'
 }
 
 /**
diff --git a/apps/sim/ee/scim/lib/projection/reconcile-user.test.ts b/apps/sim/ee/scim/lib/projection/reconcile-user.test.ts
index 2a03b1d107e..35cd37aaaae 100644
--- a/apps/sim/ee/scim/lib/projection/reconcile-user.test.ts
+++ b/apps/sim/ee/scim/lib/projection/reconcile-user.test.ts
@@ -59,10 +59,10 @@ const params = {
   connectionId: 'conn-1',
   organizationId: 'org-1',
   scimUserId: 'su-1',
-  settings: {},
 }
 
 interface Scenario {
+  lockManualMembership?: boolean
   current?: Array<Record<string, unknown>>
   mappings?: Array<Record<string, unknown>>
   ownedWorkspaces?: string[]
@@ -72,6 +72,7 @@ interface Scenario {
 }
 
 function stage({
+  lockManualMembership = false,
   current = [],
   mappings = [],
   ownedWorkspaces = ['ws-1'],
@@ -79,7 +80,7 @@ function stage({
   actualGroups = [],
   actualRole = 'member',
 }: Scenario) {
-  queueTableRows(scimUser, [{ userId: 'u-1' }])
+  queueTableRows(scimUser, [{ userId: 'u-1', settings: { lockManualMembership } }])
   queueTableRows(scimProjectionGrant, current)
   queueTableRows(scimGroupMember, mappings)
   queueTableRows(
@@ -283,6 +284,7 @@ describe('reconcileUserProjection', () => {
 
   it('withdraws the entire covered access when managed membership is locked', async () => {
     stage({
+      lockManualMembership: true,
       current: [
         {
           targetKind: 'workspace',
@@ -294,7 +296,7 @@ describe('reconcileUserProjection', () => {
       ],
     })
     mocks.readPermission.mockResolvedValue('admin')
-    await reconcileUserProjection(db, { ...params, settings: { lockManualMembership: true } })
+    await reconcileUserProjection(db, params)
     expect(mocks.revokeWorkspace).toHaveBeenCalled()
     expect(mocks.lowerWorkspace).not.toHaveBeenCalled()
   })
@@ -321,14 +323,12 @@ describe('reconcileUserProjection', () => {
     })
     mocks.readPermission.mockResolvedValue('write')
     stage({
+      lockManualMembership: true,
       current: [
         { targetKind: 'workspace', targetId: 'ws-1', permissionType: 'write', origin: 'adopted' },
       ],
     })
-    const withdrawn = await reconcileUserProjection(db, {
-      ...params,
-      settings: { lockManualMembership: true },
-    })
+    const withdrawn = await reconcileUserProjection(db, params)
     expect(mocks.revokeWorkspace).toHaveBeenCalledWith(
       db,
       expect.objectContaining({ workspaceId: 'ws-1', userId: 'u-1' })
diff --git a/apps/sim/ee/scim/lib/projection/reconcile-user.ts b/apps/sim/ee/scim/lib/projection/reconcile-user.ts
index 15be39369c5..cfbc77b3549 100644
--- a/apps/sim/ee/scim/lib/projection/reconcile-user.ts
+++ b/apps/sim/ee/scim/lib/projection/reconcile-user.ts
@@ -3,7 +3,7 @@ import {
   member,
   permissionGroupMember,
   permissions,
-  type ScimConnectionSettings,
+  scimConnection,
   scimGroupMapping,
   scimGroupMember,
   scimProjectionGrant,
@@ -14,7 +14,10 @@ import { createLogger } from '@sim/logger'
 import type { PermissionType } from '@sim/platform-authz/workspace'
 import { generateId } from '@sim/utils/id'
 import { and, eq, inArray } from 'drizzle-orm'
-import { acquireOrganizationUserMutationLocks } from '@/lib/billing/organizations/membership'
+import {
+  acquireOrganizationMutationLock,
+  acquireOrganizationUserMutationLocks,
+} from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
 import type { StoppedRun } from '@/lib/mothership/async-runs/repository'
@@ -435,13 +438,20 @@ export async function reconcileUserProjection(
     connectionId: string
     organizationId: string
     scimUserId: string
-    settings: ScimConnectionSettings
   }
 ): Promise<ProjectionDelta> {
+  await acquireOrganizationMutationLock(tx, params.organizationId)
   const [record] = await tx
-    .select({ userId: scimUser.userId })
+    .select({ userId: scimUser.userId, settings: scimConnection.settings })
     .from(scimUser)
-    .where(and(eq(scimUser.id, params.scimUserId), eq(scimUser.connectionId, params.connectionId)))
+    .innerJoin(scimConnection, eq(scimConnection.id, scimUser.connectionId))
+    .where(
+      and(
+        eq(scimUser.id, params.scimUserId),
+        eq(scimUser.connectionId, params.connectionId),
+        eq(scimConnection.organizationId, params.organizationId)
+      )
+    )
     .limit(1)
 
   if (!record) return emptyDelta()
@@ -484,7 +494,7 @@ export async function reconcileUserProjection(
 
   const delta = emptyDelta()
   const accessEndedIn = new Set<string>()
-  const lockManualMembership = params.settings.lockManualMembership === true
+  const lockManualMembership = record.settings.lockManualMembership === true
 
   /** Withdrawals first, so a move between groups frees its workspace slot. */
   for (const grant of plan.withdraw) {
@@ -621,7 +631,6 @@ export async function reconcileUsersProjection(
     connectionId: string
     organizationId: string
     scimUserIds: string[]
-    settings: ScimConnectionSettings
   }
 ): Promise<ProjectionDelta> {
   const total = emptyDelta()
@@ -630,7 +639,6 @@ export async function reconcileUsersProjection(
       connectionId: params.connectionId,
       organizationId: params.organizationId,
       scimUserId,
-      settings: params.settings,
     })
     addChanges(total, delta)
     total.stoppedRuns.push(...delta.stoppedRuns)
@@ -653,7 +661,6 @@ export async function reconcileUsersProjectionInBatches(params: {
   connectionId: string
   organizationId: string
   scimUserIds: string[]
-  settings: ScimConnectionSettings
 }): Promise<ProjectionChanges> {
   const changes: ProjectionChanges = { added: [], removed: [], raised: [] }
   const ids = [...new Set(params.scimUserIds)].sort()
diff --git a/apps/sim/ee/scim/lib/reconcile/job.test.ts b/apps/sim/ee/scim/lib/reconcile/job.test.ts
index f25a9ad6775..9b910ea80a4 100644
--- a/apps/sim/ee/scim/lib/reconcile/job.test.ts
+++ b/apps/sim/ee/scim/lib/reconcile/job.test.ts
@@ -67,10 +67,9 @@ function grantLease() {
   dbChainMockFns.returning.mockResolvedValueOnce([{ id: 'conn-1' }])
 }
 
-/** Queues the two connection reads one batch makes: the lease check, then the fresh settings. */
-function stageBatch(token: string, settings?: Record<string, unknown>) {
+/** Queues the lease check before a batch. */
+function stageBatch(token: string) {
   queueTableRows(scimConnection, [{ token }])
-  queueTableRows(scimConnection, settings ? [{ settings }] : [])
 }
 
 const setCalls = () =>
@@ -188,7 +187,7 @@ describe('reconcileConnection', () => {
   it('prunes the request log before the pass and releases the lease when a batch throws', async () => {
     grantLease()
     mocks.listScimUserIds.mockResolvedValueOnce(page(['su-1']))
-    stageBatch('run-1', {})
+    stageBatch('run-1')
     mocks.reconcileBatch.mockRejectedValueOnce(new Error('projection failed'))
 
     await expect(reconcileConnection(connection)).rejects.toThrow('projection failed')
@@ -228,7 +227,7 @@ describe('runScimReconcileSweep', () => {
 
     grantLease()
     mocks.listScimUserIds.mockResolvedValueOnce(page(['su-1', 'su-2'])).mockResolvedValueOnce([])
-    stageBatch('run-1', {})
+    stageBatch('run-1')
     mocks.reconcileBatch.mockResolvedValueOnce(delta(1, 0, 0))
 
     grantLease()
diff --git a/apps/sim/ee/scim/lib/reconcile/job.ts b/apps/sim/ee/scim/lib/reconcile/job.ts
index 18e44d5ba1d..61324842b82 100644
--- a/apps/sim/ee/scim/lib/reconcile/job.ts
+++ b/apps/sim/ee/scim/lib/reconcile/job.ts
@@ -220,23 +220,10 @@ export async function reconcileConnection(connection: {
         return null
       }
 
-      /**
-       * Settings are read per batch rather than from the row the due query
-       * returned: an administrator may change them while a long pass runs, and
-       * projecting a later batch with the old settings would then stamp the
-       * connection as reconciled against a policy it no longer has.
-       */
-      const [fresh] = await db
-        .select({ settings: scimConnection.settings })
-        .from(scimConnection)
-        .where(eq(scimConnection.id, connection.id))
-        .limit(1)
-
       const delta = await reconcileUsersProjectionInBatches({
         connectionId: connection.id,
         organizationId: connection.organizationId,
         scimUserIds: page.map((row) => row.id),
-        settings: fresh?.settings ?? connection.settings,
       })
       report.reconciledUsers += page.length
       report.grantsAdded += delta.added.length + delta.raised.length
diff --git a/apps/sim/lib/api/contracts/organization-scim.ts b/apps/sim/lib/api/contracts/organization-scim.ts
index e9eb7d34368..b2b05bf9cbc 100644
--- a/apps/sim/lib/api/contracts/organization-scim.ts
+++ b/apps/sim/lib/api/contracts/organization-scim.ts
@@ -94,6 +94,10 @@ const groupMappingSchema = z.object({
   workspaceId: z.string().nullable(),
   permissionType: z.enum(['admin', 'write', 'read']).nullable(),
   role: z.string().nullable(),
+  /** Optional while older application instances still serve the settings API. */
+  source: z.enum(['automatic', 'manual']).optional(),
+  /** Current directory members missing the mapped permission-group membership. */
+  unassignedMemberCount: z.number().int().min(0).max(5000).nullable().optional(),
 })
 
 export const listScimGroupMappingsContract = defineRouteContract({
diff --git a/apps/sim/lib/api/contracts/permission-groups.ts b/apps/sim/lib/api/contracts/permission-groups.ts
index fbc0f2a25c6..4f90be85298 100644
--- a/apps/sim/lib/api/contracts/permission-groups.ts
+++ b/apps/sim/lib/api/contracts/permission-groups.ts
@@ -52,6 +52,7 @@ export const permissionGroupSchema = z.object({
   creatorEmail: z.string().nullable(),
   memberCount: z.number(),
   isDefault: z.boolean(),
+  membershipMode: z.string().optional(),
   /**
    * Workspaces this group targets. Empty for the default group (which governs
    * every workspace) and for a non-default group scoped to nothing.
diff --git a/apps/sim/lib/billing/organizations/membership.ts b/apps/sim/lib/billing/organizations/membership.ts
index 0fb26bb379d..127a9b26e0c 100644
--- a/apps/sim/lib/billing/organizations/membership.ts
+++ b/apps/sim/lib/billing/organizations/membership.ts
@@ -24,6 +24,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, count, desc, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm'
+import { revokeUserOAuthGrants } from '@/lib/auth/oauth-access-token'
 import {
   invalidateMembershipCache,
   invalidateSecurityPolicyVersionCache,
@@ -1487,6 +1488,7 @@ export async function removeUserFromOrganization(
           ...(spareSessionToken ? { spareSessionToken } : {}),
           ...(spareSessionId ? { spareSessionId } : {}),
         })
+        if (revokePersonalApiKeys) await revokeUserOAuthGrants(userId, tx)
 
         if (workspaceIds.length === 0) {
           return {
diff --git a/apps/sim/lib/mothership/async-runs/repository.test.ts b/apps/sim/lib/mothership/async-runs/repository.test.ts
index dbbae17f179..372ee97b6ac 100644
--- a/apps/sim/lib/mothership/async-runs/repository.test.ts
+++ b/apps/sim/lib/mothership/async-runs/repository.test.ts
@@ -42,14 +42,15 @@ describe('run admission and early Stop', () => {
     expect(await requestRunStop(scope)).toBeNull()
     expect(dbChainMockFns.values).toHaveBeenCalledWith(scope)
     expect(dbChainMockFns.onConflictDoNothing).toHaveBeenCalled()
-    expect(dbChainMockFns.execute).toHaveBeenCalledTimes(2)
     expect(
-      hasMockCondition(
-        dbChainMockFns.where.mock.calls[0]?.[0],
-        (condition) =>
-          condition.type === 'eq' &&
-          condition.left === copilotRuns.userId &&
-          condition.right === scope.userId
+      dbChainMockFns.where.mock.calls.some(([predicate]) =>
+        hasMockCondition(
+          predicate,
+          (condition) =>
+            condition.type === 'eq' &&
+            condition.left === copilotRuns.userId &&
+            condition.right === scope.userId
+        )
       )
     ).toBe(true)
   })
@@ -148,12 +149,13 @@ describe('run admission and early Stop', () => {
       [copilotRequestStops.workspaceId, scope.workspaceId],
       [copilotRequestStops.streamId, scope.streamId],
     ]) {
-      /** The chat row is read first; the Stop lookup follows it. */
       expect(
-        hasMockCondition(
-          dbChainMockFns.where.mock.calls[1]?.[0],
-          (condition) =>
-            condition.type === 'eq' && condition.left === column && condition.right === value
+        dbChainMockFns.where.mock.calls.some(([predicate]) =>
+          hasMockCondition(
+            predicate,
+            (condition) =>
+              condition.type === 'eq' && condition.left === column && condition.right === value
+          )
         )
       ).toBe(true)
     }
@@ -167,12 +169,14 @@ describe('run admission and early Stop', () => {
       expect.objectContaining({ workspaceId: scope.workspaceId, status: 'active' })
     )
     expect(
-      hasMockCondition(
-        dbChainMockFns.where.mock.calls[0]?.[0],
-        (condition) =>
-          condition.type === 'eq' &&
-          condition.left === copilotChats.userId &&
-          condition.right === scope.userId
+      dbChainMockFns.where.mock.calls.some(([predicate]) =>
+        hasMockCondition(
+          predicate,
+          (condition) =>
+            condition.type === 'eq' &&
+            condition.left === copilotChats.userId &&
+            condition.right === scope.userId
+        )
       )
     ).toBe(true)
   })
diff --git a/apps/sim/lib/mothership/async-runs/repository.ts b/apps/sim/lib/mothership/async-runs/repository.ts
index e0d69b87c8a..ef9adbed548 100644
--- a/apps/sim/lib/mothership/async-runs/repository.ts
+++ b/apps/sim/lib/mothership/async-runs/repository.ts
@@ -9,6 +9,7 @@ import {
   copilotOrganizationRequestStops,
   copilotRequestStops,
   copilotRuns,
+  user,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { filterUndefined, toRecordOrNull } from '@sim/utils/object'
@@ -154,7 +155,7 @@ export interface CreateRunSegmentInput {
 
 type RunAdmissionTransaction = Parameters<Parameters<typeof db.transaction>[0]>[0]
 
-/** Serializes Stop and admission, including when no run row exists to lock yet. */
+/** Serializes account suspension, Stop and admission, even before a run row exists. */
 export async function withRunAdmissionLock<T>(
   userId: string,
   streamId: string,
@@ -162,6 +163,8 @@ export async function withRunAdmissionLock<T>(
 ): Promise<T> {
   return db.transaction(async (tx) => {
     await tx.execute(sql`SET LOCAL statement_timeout = '10s'`)
+    /** Lock the account before any chat/run writes; suspension updates it before scanning runs. */
+    await tx.select({ id: user.id }).from(user).where(eq(user.id, userId)).for('share')
     const key = JSON.stringify(['copilot-run-admission', userId, streamId])
     await acquireAdvisoryXactLock(tx, 'copilot_run_admission', key)
     return action(tx)
@@ -462,8 +465,10 @@ export async function insertRunSegment(tx: RunAdmissionTransaction, input: Creat
       workspaceId: copilotChats.workspaceId,
       organizationId: copilotChats.organizationId,
       deletedAt: copilotChats.deletedAt,
+      suspendedAt: user.suspendedAt,
     })
     .from(copilotChats)
+    .innerJoin(user, eq(user.id, copilotChats.userId))
     .where(and(eq(copilotChats.id, input.chatId), eq(copilotChats.userId, input.userId)))
     .for('share')
   const inheritsOwner = !input.workspaceId && !input.organizationId
@@ -475,7 +480,10 @@ export async function insertRunSegment(tx: RunAdmissionTransaction, input: Creat
     .from(table)
     .where(predicate)
     .limit(1)
-  const closedAt = stop?.stoppedAt ?? chat?.deletedAt
+  const closedAt = stop?.stoppedAt ?? chat?.deletedAt ?? chat?.suspendedAt
+  if (chat?.suspendedAt && !stop) {
+    await recordRunStopTx(tx, { ...input, workspaceId, organizationId }, false)
+  }
   const [run] = await tx
     .insert(copilotRuns)
     .values({
diff --git a/apps/sim/lib/mothership/request/application/removal-stops-runs.integration.ts b/apps/sim/lib/mothership/request/application/removal-stops-runs.integration.ts
index bdf0338e3ce..63cce9648e7 100644
--- a/apps/sim/lib/mothership/request/application/removal-stops-runs.integration.ts
+++ b/apps/sim/lib/mothership/request/application/removal-stops-runs.integration.ts
@@ -64,6 +64,7 @@ import { db } from '@sim/db'
 import {
   copilotAsyncToolCalls,
   copilotChats,
+  copilotOrganizationRequestStops,
   copilotRequestStops,
   copilotRuns,
   idempotencyKey,
@@ -73,6 +74,7 @@ import {
   scimConnection,
   scimGroupMapping,
   scimGroupMember,
+  ssoDomain,
   user,
   workspace,
 } from '@sim/db/schema'
@@ -107,6 +109,8 @@ import { revokeWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-acces
 import { removeWorkspaceMemberRecord } from '@/lib/workspaces/permissions/member-removal-store'
 import { DELETE as deleteWorkspace } from '@/app/api/workspaces/[id]/route'
 import { replaceScimGroup } from '@/ee/scim/lib/application/groups/manage-groups'
+import { provisionScimUser } from '@/ee/scim/lib/application/users/provision-user'
+import { patchScimUser } from '@/ee/scim/lib/application/users/update-user'
 import {
   PROJECTION_BATCH_SIZE,
   reconcileUsersProjectionInBatches,
@@ -278,15 +282,11 @@ async function runControl(run: SeededRun) {
 }
 
 async function hasStop(run: SeededRun) {
+  const table = run.organizationId ? copilotOrganizationRequestStops : copilotRequestStops
   const rows = await db
-    .select({ streamId: copilotRequestStops.streamId })
-    .from(copilotRequestStops)
-    .where(
-      and(
-        eq(copilotRequestStops.userId, run.userId),
-        eq(copilotRequestStops.streamId, run.streamId)
-      )
-    )
+    .select({ streamId: table.streamId })
+    .from(table)
+    .where(and(eq(table.userId, run.userId), eq(table.streamId, run.streamId)))
   return rows.length > 0
 }
 
@@ -381,7 +381,7 @@ async function seedDirectory(organizationId: string, target: DirectoryTarget) {
     organizationId,
     connectionId,
     credentialId: generateId(),
-    scopes: ['groups:write'],
+    scopes: ['groups:write', 'users:write'],
   }
   /** Sets the group's members, as a directory's full-group PUT does. */
   const setGroupMembers = (memberIds: string[]) =>
@@ -391,9 +391,10 @@ async function seedDirectory(organizationId: string, target: DirectoryTarget) {
     })
   /** Re-projects these users in bounded transactions, as the scheduled pass and mapping edits do. */
   const reconcile = (scimUserIds: string[]) =>
-    reconcileUsersProjectionInBatches({ connectionId, organizationId, scimUserIds, settings: {} })
+    reconcileUsersProjectionInBatches({ connectionId, organizationId, scimUserIds })
   return {
     connectionId,
+    principal,
     groupId: group.id,
     setGroupMembers,
     reconcile,
@@ -768,6 +769,238 @@ describe.runIf(Boolean(redisUrl))('removing a run’s chat, owner or access stop
     expect(await runControl(ownerRun)).toEqual(LIVE)
   })
 
+  it('keeps directory-deactivated runs stopped after reactivation without withdrawing grants', async () => {
+    const ownerId = await seedUser()
+    const { organizationId, workspaceId } = await seedOrganization(ownerId)
+    const directory = await seedDirectory(organizationId, { workspaceId })
+    const suspended = await seedDirectoryMember(directory.connectionId, organizationId)
+    await directory.setGroupMembers([suspended.scimUserId])
+    const workspaceRun = await seedRun({ userId: suspended.userId, workspaceId })
+    const assistantRun = await seedRun({ userId: suspended.userId, organizationId })
+    const ownerRun = await seedRun({ userId: ownerId, workspaceId })
+
+    for (const active of [false, true]) {
+      await patchScimUser.execute({
+        principal: directory.principal,
+        input: {
+          scimUserId: suspended.scimUserId,
+          operations: [{ op: 'replace', path: 'active', value: active }],
+        },
+      })
+    }
+
+    expect(await hasStop(workspaceRun)).toBe(true)
+    expect(await hasStop(assistantRun)).toBe(true)
+    expect(await runControl(workspaceRun)).toEqual(STOPPED)
+    expect(await runControl(assistantRun)).toEqual(STOPPED)
+    await expect.poll(pushedStops).toEqual([workspaceRun.streamId, assistantRun.streamId].sort())
+    expect(await runControl(ownerRun)).toEqual(LIVE)
+    expect(
+      await db
+        .select({ permission: permissions.permissionType })
+        .from(permissions)
+        .where(and(eq(permissions.userId, suspended.userId), eq(permissions.entityId, workspaceId)))
+    ).toEqual([{ permission: 'write' }])
+    const freshRun = await seedRun({ userId: suspended.userId, workspaceId })
+    expect(await runControl(freshRun)).toEqual(LIVE)
+  })
+
+  it.each(['interactive', 'headless'] as const)(
+    'stops a concurrent %s admission when directory suspension races its insert',
+    async (kind) => {
+      const ownerId = await seedUser()
+      const { organizationId, workspaceId } = await seedOrganization(ownerId)
+      const directory = await seedDirectory(organizationId, { workspaceId })
+      const suspended = await seedDirectoryMember(directory.connectionId, organizationId)
+      await directory.setGroupMembers([suspended.scimUserId])
+      const chatId = await seedChat(suspended.userId, workspaceId)
+      const setActive = (active: boolean) =>
+        patchScimUser.execute({
+          principal: directory.principal,
+          input: {
+            scimUserId: suspended.scimUserId,
+            operations: [{ op: 'replace', path: 'active', value: active }],
+          },
+        })
+      const admit = async () => {
+        if (kind === 'headless') {
+          return (await admitHeadlessRun(suspended.userId, chatId, workspaceId)).seeded
+        }
+        const streamId = generateId()
+        const runId = generateId()
+        testStreams.add(streamId)
+        const sendClaim = { normalizedKey: `run-removal:${generateId()}`, claimToken: generateId() }
+        await db
+          .insert(idempotencyKey)
+          .values({ key: sendClaim.normalizedKey, result: { claimToken: sendClaim.claimToken } })
+        expect(await acquirePendingChatStream(chatId, streamId, 0)).toBe(true)
+        const lease = getLocalChatStreamLease(chatId, streamId)
+        if (!lease) throw new Error('The admission needs its chat lease')
+        const content = 'Summarize the quarter'
+        try {
+          await admitChatTurn.execute({
+            principal: createSessionPrincipal({
+              userId: suspended.userId,
+              sessionId: generateId(),
+            }),
+            input: {
+              chatId,
+              runId,
+              executionId: generateId(),
+              requestId: generateId(),
+              message: { id: streamId, content },
+              recovery: {
+                kind: 'interactive_stream',
+                goRoute: '/api/mothership',
+                clientToolPickupExpected: false,
+                request: {
+                  userId: suspended.userId,
+                  chatId,
+                  messageId: streamId,
+                  workspaceId,
+                  message: content,
+                },
+              },
+              lease,
+              sendClaim,
+              notifyWorkspaceStatus: false,
+            },
+          })
+        } finally {
+          await releasePendingChatStream(chatId, streamId, lease)
+        }
+        return { userId: suspended.userId, chatId, streamId, runId, workspaceId }
+      }
+
+      const pending = await whileHolding(chatId, async (holder) => {
+        const admission = admit()
+        const admitting = await lockWaiterBehind(holder)
+        let settled = false
+        const suspension = setActive(false)
+          .then(() => setActive(true))
+          .finally(() => {
+            settled = true
+          })
+        void suspension.catch(() => {})
+        await expect
+          .poll(async () => {
+            const waiting = await db.execute(sql`
+            SELECT pid FROM pg_stat_activity WHERE datname = current_database()
+              AND ${admitting}::int = ANY(pg_blocking_pids(pid))
+          `)
+            return settled || waiting.length > 0
+          })
+          .toBe(true)
+        return { admission, suspension }
+      })
+      const [run] = await Promise.all([pending.admission, pending.suspension])
+
+      expect(await hasStop(run)).toBe(true)
+      expect(await runControl(run)).toEqual(STOPPED)
+    }
+  )
+
+  it('keeps a headless run admitted during suspension stopped after reactivation', async () => {
+    const ownerId = await seedUser()
+    const { organizationId, workspaceId } = await seedOrganization(ownerId)
+    const directory = await seedDirectory(organizationId, { workspaceId })
+    const suspended = await seedDirectoryMember(directory.connectionId, organizationId)
+    await directory.setGroupMembers([suspended.scimUserId])
+    const setActive = (active: boolean) =>
+      patchScimUser.execute({
+        principal: directory.principal,
+        input: {
+          scimUserId: suspended.scimUserId,
+          operations: [{ op: 'replace', path: 'active', value: active }],
+        },
+      })
+    await setActive(false)
+    const { run, seeded } = await admitHeadlessRun(
+      suspended.userId,
+      await seedChat(suspended.userId, workspaceId),
+      workspaceId
+    )
+    await setActive(true)
+
+    expect(run.status).toBe('cancelled')
+    expect(await toolAdmissionClosedAt(seeded)).not.toBeNull()
+    expect(await runControl(seeded)).toEqual(STOPPED)
+  })
+
+  it('stops an existing member’s runs when first provisioned inactive', async () => {
+    const ownerId = await seedUser()
+    const { organizationId, workspaceId } = await seedOrganization(ownerId)
+    const directory = await seedDirectory(organizationId, { workspaceId })
+    const userId = await seedUser()
+    await db.insert(member).values({ id: generateId(), userId, organizationId, role: 'member' })
+    await grantWrite(userId, workspaceId)
+    await db.insert(ssoDomain).values({
+      id: generateId(),
+      organizationId,
+      domain: 'run-removal.test',
+      status: 'verified',
+      verificationToken: generateId(),
+    })
+    const run = await seedRun({ userId, workspaceId })
+
+    const provisioned = await provisionScimUser.execute({
+      principal: directory.principal,
+      input: {
+        attributes: {
+          userName: `${userId}@run-removal.test`,
+          active: false,
+          name: { formatted: 'Run removal fixture' },
+          emails: [{ value: `${userId}@run-removal.test`, primary: true }],
+        },
+      },
+    })
+
+    expect(provisioned.createdAccount).toBe(false)
+    expect(provisioned.resource.active).toBe(false)
+    expect(await hasStop(run)).toBe(true)
+    await expect.poll(pushedStops).toEqual([run.streamId])
+    await patchScimUser.execute({
+      principal: directory.principal,
+      input: {
+        scimUserId: provisioned.scimUserId,
+        operations: [{ op: 'replace', path: 'active', value: true }],
+      },
+    })
+    expect(await runControl(run)).toEqual(STOPPED)
+  })
+
+  it('does not stop runs when a directory deactivation rolls back', async () => {
+    const ownerId = await seedUser()
+    const { organizationId, workspaceId } = await seedOrganization(ownerId)
+    const directory = await seedDirectory(organizationId, { workspaceId })
+    const suspended = await seedDirectoryMember(directory.connectionId, organizationId)
+    await grantWrite(suspended.userId, workspaceId)
+    const run = await seedRun({ userId: suspended.userId, workspaceId })
+    await db.insert(scimGroupMember).values({
+      id: generateId(),
+      groupId: directory.groupId,
+      scimUserId: suspended.scimUserId,
+    })
+    const allowGrants = await refuseGrantsFor(suspended.scimUserId)
+    try {
+      await expect(
+        patchScimUser.execute({
+          principal: directory.principal,
+          input: {
+            scimUserId: suspended.scimUserId,
+            operations: [{ op: 'replace', path: 'active', value: false }],
+          },
+        })
+      ).rejects.toMatchObject(REFUSED)
+    } finally {
+      await allowGrants()
+    }
+
+    expect(requestedStops()).toEqual([])
+    expect(await hasStop(run)).toBe(false)
+    expect(await runControl(run)).toEqual(LIVE)
+  })
+
   it('pushes Stop for a directory demotion that ends an admin’s derived access', async () => {
     const ownerId = await seedUser()
     const { organizationId, workspaceId } = await seedOrganization(ownerId)
diff --git a/apps/sim/lib/organizations/members/lifecycle.test.ts b/apps/sim/lib/organizations/members/lifecycle.test.ts
index 2880b027e43..25824f1468a 100644
--- a/apps/sim/lib/organizations/members/lifecycle.test.ts
+++ b/apps/sim/lib/organizations/members/lifecycle.test.ts
@@ -125,7 +125,7 @@ describe('suspendMemberTx and unsuspendMemberTx', () => {
     dbChainMockFns.returning.mockResolvedValueOnce([{ id: 's-1' }])
     await expect(
       suspendMemberTx(db, { userId: 'u-1', organizationId: 'org-1', source: 'scim' })
-    ).resolves.toEqual({ suspended: true, sessionsRevoked: 1 })
+    ).resolves.toEqual({ suspended: true, sessionsRevoked: 1, stoppedRuns: [] })
     expect(mockAcquireLocks).toHaveBeenCalledTimes(1)
     expect(dbChainMockFns.set).toHaveBeenCalledWith(
       expect.objectContaining({ suspensionSource: 'scim', suspendedAt: expect.any(Date) })
diff --git a/apps/sim/lib/organizations/members/lifecycle.ts b/apps/sim/lib/organizations/members/lifecycle.ts
index af7fe445c35..f2f5d235711 100644
--- a/apps/sim/lib/organizations/members/lifecycle.ts
+++ b/apps/sim/lib/organizations/members/lifecycle.ts
@@ -5,7 +5,7 @@ import { and, eq, isNull } from 'drizzle-orm'
 import { acquireOrganizationUserMutationLocks } from '@/lib/billing/organizations/membership'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import type { DbOrTx, DbTransaction } from '@/lib/db/types'
-import type { StoppedRun } from '@/lib/mothership/async-runs/repository'
+import { type StoppedRun, stopLiveRunsTx } from '@/lib/mothership/async-runs/repository'
 import { revokeUserSessionsTx } from '@/lib/organizations/members/revocation'
 import { stopRunsWithoutWorkspaceAccessTx } from '@/lib/workspaces/access/workspace-access'
 
@@ -26,6 +26,8 @@ export type SuspensionSource = 'scim'
 export interface SuspendMemberResult {
   suspended: boolean
   sessionsRevoked: number
+  /** Deliver these durable Stops only after the suspension commits. */
+  stoppedRuns: StoppedRun[]
 }
 
 /**
@@ -37,8 +39,8 @@ export interface SuspendMemberResult {
  * is no server-side path to undo it. A directory deactivation is routine and
  * reversible — someone on leave, or moved between teams — so it must not destroy
  * the work they own. That includes their API keys: the key rows stay, and the
- * authentication paths refuse them while `suspendedAt` is set, so reactivation
- * restores every automation exactly as it was.
+ * authentication paths refuse them while `suspendedAt` is set. Reactivation
+ * permits new runs; already admitted Chat runs are durably stopped.
  */
 export async function suspendMemberTx(
   tx: DbTransaction,
@@ -73,7 +75,8 @@ export async function suspendMemberTx(
     organizationId: params.organizationId,
   })
 
-  return { suspended: Boolean(updated), sessionsRevoked: sessions.revoked }
+  const stoppedRuns = await stopLiveRunsTx(tx, { userId: params.userId })
+  return { suspended: Boolean(updated), sessionsRevoked: sessions.revoked, stoppedRuns }
 }
 
 /** Lifts a suspension, but only one raised by the same source. */
diff --git a/apps/sim/scripts/test-scim-e2e.ts b/apps/sim/scripts/test-scim-e2e.ts
index a9e3d592f56..747ce437e00 100644
--- a/apps/sim/scripts/test-scim-e2e.ts
+++ b/apps/sim/scripts/test-scim-e2e.ts
@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto'
 import { writeFile } from 'node:fs/promises'
 import { createLogger } from '@sim/logger'
 import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
 import { generateId, generateShortId } from '@sim/utils/id'
 import { isRecordLike } from '@sim/utils/object'
 import { makeSignature } from 'better-auth/crypto'
@@ -562,7 +563,7 @@ async function run() {
   )
 
   await check(
-    'An address change ends sessions and OAuth grants issued under the old one',
+    'Address changes and directory removal retire OAuth grants instead of restoring them after suspension',
     async () => {
       const carolEmail = `carol@${primary.domain}`
       const created = await scim(token, '/Users', {
@@ -621,6 +622,28 @@ async function run() {
           (await sql`select id from oauth_access_token where user_id = ${userId}`).length,
           0
         )
+
+        const rawToken = generateShortId(32)
+        const bearer = `sim_oat_${rawToken}`
+        await sql`insert into oauth_token_family (id, client_id, user_id, created_at, expires_at)
+        values (${generateId()}, ${clientId}, ${userId}, now(), now() + interval '1 day')`
+        await sql`insert into oauth_access_token (id, token, client_id, user_id, scopes, created_at, expires_at)
+        values (${generateId()}, ${createHash('sha256').update(rawToken).digest('hex')},
+          ${clientId}, ${userId}, ${['api:read']}, now(), now() + interval '1 hour')`
+        await request('/api/v2/workspaces', { token: bearer })
+        await patch(token, `/Users/${carolId}`, [{ op: 'replace', path: 'active', value: false }])
+        await request('/api/v2/workspaces', { token: bearer, expected: 401 })
+        await scim(token, `/Users/${carolId}`, { method: 'DELETE', expected: 204 })
+        await request('/api/v2/workspaces', { token: bearer, expected: 401 })
+        assert.equal(
+          (await sql`select id from oauth_token_family where user_id = ${userId}`).length,
+          0,
+          'Directory removal must retire refresh families as well as sessions'
+        )
+        assert.equal(
+          (await sql`select id from oauth_access_token where user_id = ${userId}`).length,
+          0
+        )
       } finally {
         await sql`delete from oauth_client where client_id = ${clientId}`
         await sql`delete from "user" where id = ${userId}`
@@ -715,6 +738,349 @@ async function run() {
     }
   )
 
+  await check(
+    'Renaming an automatically matched group withdraws its old policy even when the new target is already mapped',
+    async () => {
+      await admin(primary, '', {
+        method: 'PUT',
+        body: { settings: { autoMapPermissionGroupsByName: true } },
+      })
+      try {
+        for (const method of ['PATCH', 'PUT'] as const) {
+          const oldPolicyId = generateId()
+          const newPolicyId = generateId()
+          const oldName = `SCIM E2E ${method} Old policy`
+          const newName = `SCIM E2E ${method} New policy`
+          await sql`insert into permission_group (id, organization_id, name, created_by)
+          values (${oldPolicyId}, ${primary.orgId}, ${oldName}, ${primary.ownerId}),
+            (${newPolicyId}, ${primary.orgId}, ${newName}, ${primary.ownerId})`
+          const created = await scim(token, '/Groups', {
+            method: 'POST',
+            expected: 201,
+            body: {
+              schemas: [GROUP_SCHEMA],
+              displayName: oldName,
+              members: [{ value: aliceId }],
+            },
+          })
+          const renamedGroupId = string(created.body.id)
+          try {
+            await admin(primary, '/mappings', {
+              method: 'POST',
+              expected: 201,
+              body: {
+                groupId: renamedGroupId,
+                targetKind: 'permission_group',
+                permissionGroupId: newPolicyId,
+              },
+            })
+            assert.equal(
+              (
+                await sql`select id from permission_group_member where user_id = ${aliceUserId}
+                and permission_group_id in (${oldPolicyId}, ${newPolicyId})`
+              ).length,
+              2
+            )
+            if (method === 'PATCH') {
+              await patch(
+                token,
+                `/Groups/${renamedGroupId}`,
+                [{ op: 'replace', path: 'displayName', value: newName }],
+                204
+              )
+            } else {
+              await scim(token, `/Groups/${renamedGroupId}`, {
+                method,
+                body: {
+                  schemas: [GROUP_SCHEMA],
+                  displayName: newName,
+                  members: [{ value: aliceId }],
+                },
+              })
+            }
+            assert.equal(
+              (
+                await sql`select id from permission_group_member where permission_group_id = ${oldPolicyId}`
+              ).length,
+              0,
+              `${method} rename must immediately withdraw the old automatically matched policy`
+            )
+            assert.equal(
+              (
+                await sql`select id from scim_projection_grant where scim_user_id = ${aliceId}
+                and target_kind = 'permission_group' and target_id = ${oldPolicyId}`
+              ).length,
+              0
+            )
+            assert.equal(
+              (
+                await sql`select id from permission_group_member where permission_group_id = ${newPolicyId}`
+              ).length,
+              1
+            )
+          } finally {
+            await scim(token, `/Groups/${renamedGroupId}`, { method: 'DELETE', expected: 204 })
+            await sql`delete from permission_group where id in (${oldPolicyId}, ${newPolicyId})`
+          }
+        }
+      } finally {
+        await admin(primary, '', {
+          method: 'PUT',
+          body: { settings: { autoMapPermissionGroupsByName: false } },
+        })
+      }
+    }
+  )
+
+  await check(
+    'Mapping status exposes unapplied policy memberships and clears after conflict recovery',
+    async () => {
+      const firstPolicyId = generateId()
+      const secondPolicyId = generateId()
+      const conflictGroupIds: string[] = []
+      await sql`insert into permission_group (id, organization_id, name, membership_mode, created_by)
+      values (${firstPolicyId}, ${primary.orgId}, 'SCIM E2E first policy', 'explicit', ${primary.ownerId}),
+        (${secondPolicyId}, ${primary.orgId}, 'SCIM E2E second policy', 'explicit', ${primary.ownerId})`
+      for (const policyId of [firstPolicyId, secondPolicyId]) {
+        await sql`insert into permission_group_workspace (id, permission_group_id, workspace_id, organization_id)
+        values (${generateId()}, ${policyId}, ${primary.workspaceId}, ${primary.orgId})`
+      }
+      try {
+        for (const [index, policyId] of [firstPolicyId, secondPolicyId].entries()) {
+          const created = await scim(token, '/Groups', {
+            method: 'POST',
+            expected: 201,
+            body: {
+              schemas: [GROUP_SCHEMA],
+              displayName: `SCIM E2E conflict ${index}`,
+              members: [{ value: aliceId }],
+            },
+          })
+          const directoryGroupId = string(created.body.id)
+          conflictGroupIds.push(directoryGroupId)
+          await admin(primary, '/mappings', {
+            method: 'POST',
+            expected: 201,
+            body: {
+              groupId: directoryGroupId,
+              targetKind: 'permission_group',
+              permissionGroupId: policyId,
+            },
+          })
+        }
+        const mappings = (await admin(primary, '/mappings')).body.groups
+        assert(Array.isArray(mappings))
+        const conflicted = record(
+          mappings.find((value) => record(value).id === conflictGroupIds[1])
+        )
+        assert(Array.isArray(conflicted.mappings))
+        const pending = record(conflicted.mappings[0])
+        assert.equal(pending.source, 'manual')
+        assert.equal(
+          pending.unassignedMemberCount,
+          1,
+          'A saved mapping must expose the skipped member'
+        )
+        assert.equal(
+          (
+            await sql`select id from permission_group_member where permission_group_id = ${secondPolicyId}`
+          ).length,
+          0
+        )
+        await patch(
+          token,
+          `/Groups/${conflictGroupIds[0]}`,
+          [{ op: 'remove', path: `members[value eq "${aliceId}"]` }],
+          204
+        )
+        await admin(primary, '/reconcile', { method: 'POST' })
+        const recovered = (await admin(primary, '/mappings')).body.groups
+        assert(Array.isArray(recovered))
+        const recoveredGroup = record(
+          recovered.find((value) => record(value).id === conflictGroupIds[1])
+        )
+        assert(Array.isArray(recoveredGroup.mappings))
+        assert.equal(record(recoveredGroup.mappings[0]).unassignedMemberCount, 0)
+        assert.equal(
+          (
+            await sql`select id from permission_group_member where permission_group_id = ${secondPolicyId}`
+          ).length,
+          1
+        )
+      } finally {
+        for (const directoryGroupId of conflictGroupIds) {
+          await scim(token, `/Groups/${directoryGroupId}`, { method: 'DELETE', expected: 204 })
+        }
+        await sql`delete from permission_group where id in (${firstPolicyId}, ${secondPolicyId})`
+      }
+    }
+  )
+
+  for (const method of ['POST', 'PUT', 'PATCH'] as const) {
+    for (const enabled of [true, false]) {
+      await check(
+        `Group ${method} honors name matching changed to ${enabled} while waiting for the organization lock`,
+        async () => {
+          const policyId = generateId()
+          const name = `SCIM E2E ${method} concurrent ${enabled}`
+          let directoryGroupId: string | undefined
+          await sql`insert into permission_group (id, organization_id, name, created_by)
+          values (${policyId}, ${primary.orgId}, ${name}, ${primary.ownerId})`
+          try {
+            await admin(primary, '', {
+              method: 'PUT',
+              body: { settings: { autoMapPermissionGroupsByName: !enabled } },
+            })
+            if (method !== 'POST') {
+              const created = await scim(token, '/Groups', {
+                method: 'POST',
+                expected: 201,
+                body: {
+                  schemas: [GROUP_SCHEMA],
+                  displayName: `${name} before`,
+                  members: [{ value: aliceId }],
+                },
+              })
+              directoryGroupId = string(created.body.id)
+            }
+            let writing: Promise<unknown> | undefined
+            try {
+              await sql.begin(async (tx) => {
+                const [holder] = await tx`select pg_backend_pid() as pid,
+                pg_advisory_xact_lock(hashtextextended(${`organization-mutation:${primary.orgId}`}, 0))`
+                writing =
+                  method === 'PATCH'
+                    ? patch(
+                        token,
+                        `/Groups/${directoryGroupId}`,
+                        [{ op: 'replace', path: 'displayName', value: name }],
+                        204
+                      )
+                    : scim(token, method === 'POST' ? '/Groups' : `/Groups/${directoryGroupId}`, {
+                        method,
+                        expected: method === 'POST' ? 201 : 200,
+                        body: {
+                          schemas: [GROUP_SCHEMA],
+                          displayName: name,
+                          members: [{ value: aliceId }],
+                        },
+                      }).then((result) => {
+                        directoryGroupId = string(result.body.id)
+                      })
+                void writing.catch(() => {})
+                const deadline = performance.now() + 4000
+                for (;;) {
+                  const waiting = await sql`select pid from pg_stat_activity
+                  where wait_event = 'advisory' and ${holder.pid} = any(pg_blocking_pids(pid))`
+                  if (waiting.length > 0) break
+                  assert(
+                    performance.now() < deadline,
+                    'The group write must reach the organization lock'
+                  )
+                  await sleep(10)
+                }
+                await tx`update scim_connection
+                set settings = settings || ${tx.json({ autoMapPermissionGroupsByName: enabled })}::jsonb
+                where organization_id = ${primary.orgId}`
+              })
+            } finally {
+              await writing
+            }
+            assert(directoryGroupId, 'The group write must return its identifier')
+            const mappings = await sql`select id from scim_group_mapping
+            where group_id = ${directoryGroupId} and permission_group_id = ${policyId}`
+            assert.equal(
+              mappings.length,
+              enabled ? 1 : 0,
+              'The committed name-matching setting must govern the group write'
+            )
+          } finally {
+            if (directoryGroupId)
+              await scim(token, `/Groups/${directoryGroupId}`, { method: 'DELETE', expected: 204 })
+            await sql`delete from permission_group where id = ${policyId}`
+            await admin(primary, '', {
+              method: 'PUT',
+              body: { settings: { autoMapPermissionGroupsByName: false } },
+            })
+          }
+        }
+      )
+    }
+  }
+
+  await check(
+    'Group removal honors membership locking enabled while the request waits for the organization lock',
+    async () => {
+      await sql`insert into permissions (id, user_id, entity_type, entity_id, permission_type)
+      values (${generateId()}, ${aliceUserId}, 'workspace', ${primary.workspaceId}, 'read')`
+      const created = await scim(token, '/Groups', {
+        method: 'POST',
+        expected: 201,
+        body: {
+          schemas: [GROUP_SCHEMA],
+          displayName: 'SCIM E2E concurrent lock',
+          members: [{ value: aliceId }],
+        },
+      })
+      const lockedGroupId = string(created.body.id)
+      try {
+        await admin(primary, '/mappings', {
+          method: 'POST',
+          expected: 201,
+          body: {
+            groupId: lockedGroupId,
+            targetKind: 'workspace',
+            workspaceId: primary.workspaceId,
+            permissionType: 'read',
+          },
+        })
+        let removal: Promise<unknown> | undefined
+        try {
+          await sql.begin(async (tx) => {
+            const [holder] = await tx`select pg_backend_pid() as pid,
+              pg_advisory_xact_lock(hashtextextended(${`organization-mutation:${primary.orgId}`}, 0))`
+            removal = patch(
+              token,
+              `/Groups/${lockedGroupId}`,
+              [{ op: 'remove', path: `members[value eq "${aliceId}"]` }],
+              204
+            )
+            void removal.catch(() => {})
+            const deadline = performance.now() + 4000
+            for (;;) {
+              const waiting = await sql`select pid from pg_stat_activity
+                where wait_event = 'advisory' and ${holder.pid} = any(pg_blocking_pids(pid))`
+              if (waiting.length > 0) break
+              assert(
+                performance.now() < deadline,
+                'The group request must reach the organization lock'
+              )
+              await sleep(10)
+            }
+            await tx`update scim_connection
+              set settings = settings || '{"lockManualMembership":true}'::jsonb
+              where organization_id = ${primary.orgId}`
+          })
+        } finally {
+          await removal
+        }
+        assert.equal(
+          await permission(aliceUserId, primary.workspaceId),
+          undefined,
+          'A committed membership lock must govern the subsequent directory withdrawal'
+        )
+      } finally {
+        await scim(token, `/Groups/${lockedGroupId}`, { method: 'DELETE', expected: 204 })
+        await admin(primary, '', {
+          method: 'PUT',
+          body: { settings: { lockManualMembership: false } },
+        })
+        await sql`delete from permissions where user_id = ${aliceUserId}
+          and entity_type = 'workspace' and entity_id = ${primary.workspaceId}`
+      }
+    }
+  )
+
   await check(
     'Workspace, organization-role, and permission-group mappings project and withdraw access',
     async () => {