@@ -131,6 +131,7 @@ import { useDebounce } from '@/hooks/use-debounce'
 import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
 import { useInlineRename } from '@/hooks/use-inline-rename'
 import { useOAuthReturnForKBConnectors } from '@/hooks/use-oauth-return'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useUrlSort } from '@/hooks/use-url-sort'
 
 const logger = createLogger('KnowledgeBase')
@@ -315,6 +316,7 @@ export function KnowledgeBase({
 
   useOAuthReturnForKBConnectors(id)
   const userPermissions = useUserPermissionsContext()
+  const { config: permissionConfig } = usePermissionConfig()
 
   const { mutate: updateDocumentMutation, mutateAsync: updateDocumentAsync } = useUpdateDocument()
   const { mutate: deleteDocumentMutation } = useDeleteDocument()
@@ -1011,11 +1013,9 @@ export function KnowledgeBase({
 
   const headerActions: ResourceAction[] = useMemo(
     () => [
-      {
-        text: 'Export',
-        icon: Download,
-        onSelect: () => downloadKnowledgeBaseExport(id),
-      },
+      ...(permissionConfig.disableKnowledgeBaseExport
+        ? []
+        : [{ text: 'Export', icon: Download, onSelect: () => downloadKnowledgeBaseExport(id) }]),
       ...(userPermissions.canEdit || userPermissions.isLoading
         ? [
             {
@@ -1036,6 +1036,7 @@ export function KnowledgeBase({
     ],
     [
       id,
+      permissionConfig.disableKnowledgeBaseExport,
       userPermissions.canEdit,
       userPermissions.isLoading,
       setShowAddConnectorModal,
 
@@ -1545,7 +1545,7 @@ export function Knowledge() {
           onOpenInNewTab={handleOpenInNewTab}
           onViewTags={handleViewTags}
           onCopyId={handleCopyId}
-          onExport={handleExport}
+          onExport={permissionConfig.disableKnowledgeBaseExport ? undefined : handleExport}
           onTogglePin={handleToggleBasePin}
           pinned={pinnedBaseIds.has(activeKnowledgeBase.id)}
           onEdit={handleEdit}
 
@@ -122,12 +122,26 @@ export function recordProjectedUseCaseAuditEntries(
   }
 }
 
+/**
+ * A workspace use case always answers `authorize`, so a caller that must run
+ * the funnel without executing (a `HEAD`, or a wrapping domain builder) can
+ * rely on it without a runtime guard.
+ */
+export type AuthorizedWorkspaceUseCase<O extends WorkspaceOperation, I, R> = OperationUseCase<
+  O,
+  I,
+  R
+> &
+  Required<Pick<OperationUseCase<O, I, R>, 'authorize'>>
+
 export function defineAuthorizedWorkspaceUseCase<
   const O extends WorkspaceOperation,
   I,
   C extends WorkspaceAuthorizationContext,
   R,
->(definition: AuthorizedWorkspaceUseCaseDefinition<O, I, C, R>): OperationUseCase<O, I, R> {
+>(
+  definition: AuthorizedWorkspaceUseCaseDefinition<O, I, C, R>
+): AuthorizedWorkspaceUseCase<O, I, R> {
   const resourceAuthorization = (() => {
     const { authorizeResource, operation } = definition
     const resourcePolicy = ('resourcePolicy' in operation ? operation.resourcePolicy : undefined) as
 
@@ -134,41 +134,89 @@ export function defineAuthorizedKnowledgeUseCase<
     }
   )
 
+  /**
+   * Resolves and authorizes the context every branch below shares, so `authorize`
+   * and `execute` cannot drift apart. An organization base is fully authorized
+   * here; a workspace base still owes the workspace funnel, which the returned
+   * scope tells the caller to run.
+   */
+  async function resolveAuthorizedContext({
+    principal,
+    input,
+  }: {
+    principal: Principal
+    input: I
+  }): Promise<
+    | { scope: 'organization'; principal: KnowledgePrincipalForOperation<O>; context: C }
+    | {
+        scope: 'workspace'
+        principal: KnowledgePrincipalForOperation<O>
+        context: WorkspaceContext
+      }
+  > {
+    requireKnowledgePrincipal(principal, definition.operation)
+    const context = await definition.resolveContext({ principal, input })
+    if (context.organizationId) {
+      await authorizeOrganizationOperation(
+        principal,
+        definition.operation.organizationOperation,
+        context
+      )
+      return { scope: 'organization', principal, context }
+    }
+    if (principal.kind === 'organization_delegated')
+      throw new OrchestrationError('not_found', 'Knowledge base not found')
+    assertWorkspaceKnowledgeContext(context)
+    return { scope: 'workspace', principal, context }
+  }
+
+  function recordAudit(resultContext: AuthorizedKnowledgeUseCaseResultContext<O, I, C, R>): void {
+    const projectedAudit = definition.projectAudit?.(resultContext)
+    if (projectedAudit === undefined) return
+    const auditEntries = Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit]
+    if (auditEntries.length === 0) return
+    const organizationId = resultContext.context.organizationId ?? undefined
+    recordProjectedUseCaseAuditEntries(
+      definition.operation,
+      organizationId ? undefined : resultContext.context.workspaceId,
+      resultContext.principal,
+      resultContext.request,
+      auditEntries,
+      organizationId
+    )
+  }
+
   return {
     operation: definition.operation,
+    async authorize({ principal, input, request }) {
+      const resolved = await resolveAuthorizedContext({ principal, input })
+      if (resolved.scope !== 'workspace') return
+      await workspaceUseCase.authorize({
+        principal: resolved.principal,
+        input: { originalInput: input, context: resolved.context },
+        request,
+      })
+    },
     async execute({ principal, input, request }) {
-      requireKnowledgePrincipal(principal, definition.operation)
-      const context = await definition.resolveContext({ principal, input })
-      if (context.organizationId) {
-        await authorizeOrganizationOperation(
-          principal,
-          definition.operation.organizationOperation,
-          context
-        )
-        const result = await definition.execute({ principal, input, context, request })
-        const resultContext = { principal, input, context, request, result }
-        const projectedAudit = definition.projectAudit?.(resultContext)
-        if (projectedAudit !== undefined) {
-          recordProjectedUseCaseAuditEntries(
-            definition.operation,
-            undefined,
-            principal,
-            request,
-            Array.isArray(projectedAudit) ? projectedAudit : [projectedAudit],
-            context.organizationId
-          )
-        }
-        await definition.afterSuccess?.(resultContext)
-        return result
+      const resolved = await resolveAuthorizedContext({ principal, input })
+      if (resolved.scope === 'workspace') {
+        return workspaceUseCase.execute({
+          principal: resolved.principal,
+          input: { originalInput: input, context: resolved.context },
+          request,
+        })
       }
-      if (principal.kind === 'organization_delegated')
-        throw new OrchestrationError('not_found', 'Knowledge base not found')
-      assertWorkspaceKnowledgeContext(context)
-      return workspaceUseCase.execute({
-        principal,
-        input: { originalInput: input, context },
+      const executionContext = {
+        principal: resolved.principal,
+        input,
+        context: resolved.context,
         request,
-      })
+      }
+      const result = await definition.execute(executionContext)
+      const resultContext = { ...executionContext, result }
+      recordAudit(resultContext)
+      await definition.afterSuccess?.(resultContext)
+      return result
     },
   }
 }
@@ -181,6 +181,21 @@ describe('exportKnowledgeBase', () => {
     expect(mocks.recordAudit).not.toHaveBeenCalled()
   })
 
+  /** The manifest is written last, so a value the format rejects must fail before any byte streams. */
+  it('refuses a base whose stored values the bundle format cannot describe', async () => {
+    mocks.listDocuments.mockResolvedValueOnce([
+      { ...documents[0], tags: { tag1: 'x'.repeat(10_001) } },
+    ])
+
+    await expect(
+      exportKnowledgeBase.execute({
+        principal,
+        input: { knowledgeBaseId: 'knowledge-1', vectors: true },
+      })
+    ).rejects.toMatchObject({ code: 'conflict' })
+    expect(mocks.recordAudit).not.toHaveBeenCalled()
+  })
+
   it('propagates an oversized base without recording audit', async () => {
     mocks.listDocuments.mockRejectedValueOnce(
       new OrchestrationError('payload_too_large', 'Knowledge base has 2001 documents')
 
@@ -3,8 +3,15 @@ import type { Principal } from '@sim/auth/principal'
 import { defineAuthorizedKnowledgeUseCase } from '@/lib/knowledge/application/authorized-knowledge-use-case'
 import { resolveActiveKnowledgeBaseContext } from '@/lib/knowledge/application/contexts'
 import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import { KNOWLEDGE_BUNDLE_VERSION } from '@/lib/knowledge/constants'
 import { toKbEmbeddingDimensions } from '@/lib/knowledge/embedding-models'
-import type { KnowledgeBundleManifest, KnowledgeBundleTag } from '@/lib/knowledge/transfer/bundle'
+import {
+  assertDescribableByBundle,
+  bundleEntryPaths,
+  type KnowledgeBundleManifest,
+  type KnowledgeBundleTag,
+  toManifestDocument,
+} from '@/lib/knowledge/transfer/bundle'
 import {
   type ExportableChunk,
   type ExportableDocument,
@@ -50,7 +57,7 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
       listExportableTags(knowledgeBase.id),
       listExportableDocuments(knowledgeBase.id),
     ])
-    return {
+    const bundle: KnowledgeBaseExportBundle = {
       knowledgeBase: {
         name: knowledgeBase.name,
         description: knowledgeBase.description,
@@ -65,6 +72,17 @@ export const exportKnowledgeBase = defineAuthorizedKnowledgeUseCase({
       documents,
       chunks: (documentId) => iterateDocumentChunks(documentId, input.vectors ? dimension : null),
     }
+    assertDescribableByBundle({
+      version: KNOWLEDGE_BUNDLE_VERSION,
+      exportedAt: new Date().toISOString(),
+      embedding: bundle.embedding,
+      knowledgeBase: bundle.knowledgeBase,
+      tags,
+      documents: documents.map((document) =>
+        toManifestDocument(document, bundleEntryPaths(document), 0)
+      ),
+    })
+    return bundle
   },
   projectAudit: ({ context, input, result }) => ({
     action: AuditAction.KNOWLEDGE_BASE_EXPORTED,
 
@@ -12,6 +12,7 @@ describe('knowledge operation registry', () => {
     expect(ids).toEqual([
       'knowledge.list',
       'knowledge.read',
+      'knowledge.export',
       'knowledge.create',
       'knowledge.update',
       'knowledge.delete',
 
@@ -1,5 +1,6 @@
 import { z } from 'zod'
 import { chunkingConfigSchema } from '@/lib/api/contracts/knowledge/base'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { KB_EMBEDDING_STORAGE_DIMENSIONS } from '@/lib/embeddings/catalog'
 import {
   ALL_TAG_SLOTS,
@@ -13,6 +14,7 @@ import {
   SUPPORTED_FIELD_TYPES,
 } from '@/lib/knowledge/constants'
 import { MAX_DOCUMENT_CHUNKS } from '@/lib/knowledge/documents/document-processing-error'
+import type { ExportableDocument } from '@/lib/knowledge/transfer/export-source'
 import { MAX_KNOWLEDGE_DOCUMENT_FILE_SIZE } from '@/lib/uploads/shared/types'
 import { safeZipLeafName } from '@/lib/uploads/zip-entry-path'
 
@@ -69,7 +71,7 @@ export const knowledgeBundleTagSchema = z
     message: 'Tag slot does not belong to its field type',
   })
 
-const bundleDocumentSchema = z
+export const knowledgeBundleDocumentSchema = z
   .object({
     id: z.string().regex(BUNDLE_DOCUMENT_ID_PATTERN, 'Document id must be a short identifier'),
     filename: z.string().min(1).max(MAX_BUNDLE_TEXT_LENGTH),
@@ -151,7 +153,7 @@ export const knowledgeBundleManifestSchema = z
           names.add(name)
         }
       }),
-    documents: z.array(bundleDocumentSchema).max(MAX_KNOWLEDGE_BUNDLE_DOCUMENTS),
+    documents: z.array(knowledgeBundleDocumentSchema).max(MAX_KNOWLEDGE_BUNDLE_DOCUMENTS),
   })
   .strict()
 
@@ -207,6 +209,31 @@ export function fileEntryPath(documentId: string, filename: string): string {
   return `files/${documentId}/${safeBundleLeafName(filename)}`
 }
 
+/** Where an exportable document's entries sit inside the bundle, or `null` for entries it does not carry. */
+export function bundleEntryPaths(
+  document: Pick<ExportableDocument, 'id' | 'filename' | 'file' | 'hasChunks'>
+): KnowledgeBundleEntryPaths {
+  return {
+    file: document.file ? fileEntryPath(document.id, document.filename) : null,
+    chunks: document.hasChunks ? chunksEntryPath(document.id) : null,
+  }
+}
+
+/**
+ * Refuses an export whose stored values the bundle format cannot describe,
+ * before any byte streams: the manifest is written last, so a value the import
+ * side would reject must surface as a clear error rather than a truncated archive.
+ */
+export function assertDescribableByBundle(manifest: unknown): void {
+  const result = knowledgeBundleManifestSchema.safeParse(manifest)
+  if (result.success) return
+  const [issue] = result.error.issues
+  throw new OrchestrationError(
+    'conflict',
+    `Knowledge base cannot be exported: ${issue.path.join('.')} ${issue.message}`
+  )
+}
+
 /** A filesystem-safe leaf name for a bundle entry or the bundle download itself. */
 export function safeBundleLeafName(name: string): string {
   return safeZipLeafName(name).slice(0, MAX_BUNDLE_LEAF_NAME_LENGTH)
 
@@ -7,9 +7,8 @@ import { decodeDataUriWithinLimit } from '@/lib/file-parsers/data-uri'
 import type { KnowledgeBaseExportBundle } from '@/lib/knowledge/application/exports'
 import { KNOWLEDGE_BUNDLE_VERSION } from '@/lib/knowledge/constants'
 import {
-  chunksEntryPath,
+  bundleEntryPaths,
   encodeVectorBase64,
-  fileEntryPath,
   KNOWLEDGE_BUNDLE_MANIFEST_ENTRY,
   type KnowledgeBundleChunkLine,
   type KnowledgeBundleDocument,
@@ -96,21 +95,19 @@ async function appendBundleEntries(
 ): Promise<void> {
   const documents: KnowledgeBundleDocument[] = []
   for (const document of bundle.documents) {
-    let file: string | null = null
-    if (document.file) {
-      file = fileEntryPath(document.id, document.filename)
-      await appendEntry(archive, await openFileSource(document.file), file)
+    const entries = bundleEntryPaths(document)
+    if (document.file && entries.file) {
+      await appendEntry(archive, await openFileSource(document.file), entries.file)
     }
-    const chunks = document.hasChunks ? chunksEntryPath(document.id) : null
-    const chunkCount = chunks
+    const chunkCount = entries.chunks
       ? await appendChunkEntry(
           archive,
           bundle.chunks(document.id),
           bundle.embedding.vectorsIncluded,
-          chunks
+          entries.chunks
         )
       : 0
-    documents.push(toManifestDocument(document, { file, chunks }, chunkCount))
+    documents.push(toManifestDocument(document, entries, chunkCount))
   }
 
   const manifest: KnowledgeBundleManifest = {