feat(managed-agent): require vault-authorization ack when a vault is selected

Both blocks now render a "Vault authorization" switch immediately below
the Credential vaults picker: "I own or am authorized to use these
vaults. I understand this means this agent can assume the identity
granted by them." The tool rejects execution with an actionable error
when `vaults` is non-empty and the ack is not checked, so a workflow
author cannot silently attach an OAuth vault to an agent they aren't
authorized to run under.

Why runtime, not subblock-level required: Sim's `condition` engine
uses strict equality against a single value, so it cannot natively
express "field is a non-empty array". Enforcing at execute time keeps
the ack always visible (users see the warning up front) and fails
closed on run.

Also lifted the truthy-check into a shared `isTruthyAck` helper in
`tools/managed_agent/normalizers.ts` — handles the real boolean, plus
the `"true" | "1" | "yes"` string forms that switch values can arrive
as depending on serialization. Four cases covered:
- `true` accepted
- `"true"` / `"True"` / `"1"` / `"yes"` accepted (case-insensitive,
  whitespace-trimmed)
- Every other string / `false` / `undefined` / non-string non-boolean
  rejected

Tests: 91 pass (4 new for `isTruthyAck`).

Author: Ricardo DeMatos

apps/sim/blocks/blocks/managed_agent_cloud.ts

@@ -78,6 +78,20 @@ export const ManagedAgentCloudBlock: BlockConfig = {
       dependsOn: ['connection'],
       fetchOptions: fetchManagedAgentVaultOptions,
     },
+    {
+      // Security ack — enforced at execution time when at least one vault
+      // is selected. Rendered as a plain switch (with the same wording as
+      // the design spec) rather than a bespoke amber banner, to stay
+      // consistent with the rest of Sim's sub-block styling. The tool
+      // rejects execution with an actionable error if `vaults` is
+      // non-empty but this is false.
+      id: 'vaultsAck',
+      title: 'Vault authorization',
+      type: 'switch',
+      required: false,
+      description:
+        'I own or am authorized to use these vaults. I understand this means this agent can assume the identity granted by them. Required when at least one vault is selected above.',
+    },
     {
       // Memory store — attached as a `memory_store` resource entry.
       id: 'memoryStoreId',
@@ -156,6 +170,11 @@ export const ManagedAgentCloudBlock: BlockConfig = {
     environment: { type: 'string', description: 'Cloud environment id.' },
     environmentType: { type: 'string', description: 'Always "cloud" for this block.' },
     vaults: { type: 'json', description: 'Vault ids for MCP auth (array of strings).' },
+    vaultsAck: {
+      type: 'boolean',
+      description:
+        'Workflow-author acknowledgement that they are authorized to use the attached vaults. Required when `vaults` is non-empty.',
+    },
     memoryStoreId: { type: 'string', description: 'Optional Agent Memory Store id.' },
     memoryAccess: {
       type: 'string',

apps/sim/blocks/blocks/managed_agent_self_hosted.ts

@@ -129,6 +129,16 @@ export const ManagedAgentSelfHostedBlock: BlockConfig = {
       dependsOn: ['connection'],
       fetchOptions: fetchManagedAgentVaultOptions,
     },
+    {
+      // Security ack — enforced at execution time when at least one vault
+      // is selected. See the sibling comment on `managed_agent_cloud.ts`.
+      id: 'vaultsAck',
+      title: 'Vault authorization',
+      type: 'switch',
+      required: false,
+      description:
+        'I own or am authorized to use these vaults. I understand this means this agent can assume the identity granted by them. Required when at least one vault is selected above.',
+    },
     ...memorySubBlocks,
     {
       id: 'agent',
@@ -175,6 +185,11 @@ export const ManagedAgentSelfHostedBlock: BlockConfig = {
     environment: { type: 'string', description: 'Self-hosted environment id.' },
     environmentType: { type: 'string', description: 'Always "self_hosted" for this block.' },
     vaults: { type: 'json', description: 'Vault ids for MCP auth (array of strings).' },
+    vaultsAck: {
+      type: 'boolean',
+      description:
+        'Workflow-author acknowledgement that they are authorized to use the attached vaults. Required when `vaults` is non-empty.',
+    },
     memoryStoreId: {
       type: 'string',
       description:

apps/sim/tools/managed_agent/normalizers.test.ts

@@ -3,6 +3,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import {
+  isTruthyAck,
   normalizeEnvType,
   normalizeFiles,
   normalizeMemoryAccess,
@@ -204,3 +205,29 @@ describe('normalizeSessionParameters', () => {
     expect(normalizeSessionParameters('[broken')).toBeUndefined()
   })
 })
+
+describe('isTruthyAck', () => {
+  it('accepts the real boolean true', () => {
+    expect(isTruthyAck(true)).toBe(true)
+  })
+
+  it('accepts common string checked-forms (case-insensitive, trimmed)', () => {
+    for (const on of ['true', 'True', 'TRUE', '1', 'yes', 'YES', '  true  ']) {
+      expect(isTruthyAck(on)).toBe(true)
+    }
+  })
+
+  it('rejects false, empty, and every other string form', () => {
+    for (const off of [false, '', '   ', 'false', '0', 'no', 'off', 'random']) {
+      expect(isTruthyAck(off)).toBe(false)
+    }
+  })
+
+  it('rejects undefined / null / non-string non-boolean values', () => {
+    expect(isTruthyAck(undefined)).toBe(false)
+    expect(isTruthyAck(null)).toBe(false)
+    expect(isTruthyAck(1)).toBe(false)
+    expect(isTruthyAck({})).toBe(false)
+    expect(isTruthyAck([])).toBe(false)
+  })
+})

apps/sim/tools/managed_agent/normalizers.ts

@@ -25,6 +25,20 @@ export function normalizeMemoryAccess(
   return undefined
 }
 
+/**
+ * A subblock's `switch` value may arrive as a real boolean or as a
+ * string (`"true"`, `"1"`, `"yes"`) depending on how the workflow was
+ * serialized. Treat every reasonable "checked" form as truthy; anything
+ * else — including `false`, empty string, `undefined`, non-string
+ * non-boolean values — as not-checked.
+ */
+export function isTruthyAck(value: unknown): boolean {
+  if (value === true) return true
+  if (typeof value !== 'string') return false
+  const normalized = value.trim().toLowerCase()
+  return normalized === 'true' || normalized === '1' || normalized === 'yes'
+}
+
 /**
  * Coerces the block's file table (a JSON array of `{fileId, mountPath?}`
  * or the raw table-subblock shape `Array<{Key: string, Value: string}>`)

apps/sim/tools/managed_agent/run_session.server.ts

@@ -16,6 +16,7 @@ import {
   sendUserMessage,
 } from '@/lib/managed-agents/session-client'
 import {
+  isTruthyAck,
   normalizeEnvType,
   normalizeFiles,
   normalizeMemoryAccess,
@@ -114,6 +115,19 @@ const impl: ManagedAgentServerImpl = async (
   }
 
   const vaultIds = normalizeStringList(params.vaults)
+  if (vaultIds.length > 0 && !isTruthyAck(params.vaultsAck)) {
+    // Security ack — enforced here rather than at the subblock level
+    // because Sim's `condition` engine cannot natively test array-
+    // non-empty. Fails closed: attaching any vault requires an explicit
+    // confirmation that the workflow author is authorized to use it,
+    // since the session runs with the vault's credentials.
+    return {
+      success: false,
+      output: {},
+      error:
+        'Vault authorization is required — check the "I own or am authorized to use these vaults" acknowledgement on the block, or remove the selected vault(s).',
+    }
+  }
   const memoryStoreId = params.memoryStoreId?.trim() || undefined
   const memoryAccess = normalizeMemoryAccess(params.memoryAccess)
   const files = normalizeFiles(params.files)

apps/sim/tools/managed_agent/run_session.ts

@@ -87,6 +87,13 @@ export const managedAgentRunSessionTool: ToolConfig<
       visibility: 'user-only',
       description: 'Zero or more vault ids for MCP tool auth.',
     },
+    vaultsAck: {
+      type: 'boolean',
+      required: false,
+      visibility: 'user-only',
+      description:
+        "Workflow-author acknowledgement that they are authorized to use the attached vaults. Must be true when `vaults` is non-empty; the tool rejects execution otherwise.",
+    },
     memoryStoreId: {
       type: 'string',
       required: false,

apps/sim/tools/managed_agent/types.ts

@@ -20,6 +20,15 @@ export interface ManagedAgentRunSessionParams {
   environmentType?: 'cloud' | 'self_hosted' | string
   /** Zero or more vault ids for MCP auth. Empty array allowed. */
   vaults?: string[]
+  /**
+   * Workflow-author acknowledgement that they are authorized to use the
+   * attached vaults ("I own or am authorized to use these vaults; I
+   * understand this means this agent can assume the identity granted by
+   * them"). Required to be `true` when `vaults` is non-empty. Enforced by
+   * the tool at execution time, not at the block subblock level, because
+   * the subblock condition engine cannot natively test array-non-empty.
+   */
+  vaultsAck?: boolean | string
   /** Optional Agent Memory Store id. */
   memoryStoreId?: string
   /**