diff --git a/application/single_app/config.py b/application/single_app/config.py
index 807e762ac..1a4ccda41 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -97,7 +97,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.261.041"
+VERSION = "0.261.042"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/functions_workspace_sections.py b/application/single_app/functions_workspace_sections.py
new file mode 100644
index 000000000..cf995ece5
--- /dev/null
+++ b/application/single_app/functions_workspace_sections.py
@@ -0,0 +1,236 @@
+# functions_workspace_sections.py
+
+"""Decide which sections of the personal workspace a given user may see.
+
+The personal workspace is assembled from eight independent capabilities, and whether any
+one of them is available depends on three different kinds of check:
+
+- plain application settings, such as ``allow_user_agents``
+- per-user role checks, such as file sync and workflows, which read app roles
+- governance policy, which can deny an individual user a capability the tenant enabled
+
+Those checks were previously spread between ``route_frontend_workspace`` and the Jinja
+conditions in ``workspace.html``. The V2 interface cannot read either, so rather than
+restate the rules a third time they are collected here and both interfaces call this. A
+capability added or retired in one place then reaches both surfaces at once, which is the
+same reasoning that keeps the chat catalog builders shared in ``route_backend_v2``.
+
+Each section reports *why* it is unavailable, not merely that it is. The V2 overview shows
+disabled sections with their reason, because a section that silently disappears is the main
+reason people cannot tell whether a capability is missing, broken, or simply not switched on
+for them.
+"""
+
+import logging
+
+from functions_appinsights import log_event
+from functions_file_sync import is_file_sync_enabled_for_user
+from functions_governance import (
+    is_action_scope_access_allowed,
+    is_governance_access_allowed,
+)
+from functions_settings import is_user_workflows_enabled_for_user
+
+# Order matters: it is the order the sections are presented in, within their groups.
+WORKSPACE_SECTION_IDS = (
+    "documents",
+    "sync",
+    "prompts",
+    "agents",
+    "actions",
+    "workflows",
+    "identities",
+    "endpoints",
+)
+
+# Grouping is reported with the availability so the two interfaces agree on where a
+# section belongs. "knowledge" is what the assistant can draw on, "automation" is what it
+# can do, and "connections" is the shared plumbing the other two reuse.
+WORKSPACE_SECTION_GROUPS = {
+    "documents": "knowledge",
+    "sync": "knowledge",
+    "prompts": "knowledge",
+    "agents": "automation",
+    "actions": "automation",
+    "workflows": "automation",
+    "identities": "connections",
+    "endpoints": "connections",
+}
+
+_DISABLED_BY_ADMIN = "Your administrator has not enabled this for your account."
+_DENIED_BY_GOVERNANCE = "Your administrator has restricted your access to this capability."
+
+
+def _governance_allows(feature_key, user_id, *, scope=None):
+    """Report whether governance permits a capability, without letting an error hide it.
+
+    Governance failures are treated as permissive here on purpose. This function only
+    decides whether to *show* a section; every underlying route re-checks governance and
+    answers 403 on its own. Failing closed would therefore hide a section the user is
+    entitled to without protecting anything, whereas failing open shows a section whose
+    endpoints still refuse the request.
+    """
+    try:
+        if scope is not None:
+            return bool(is_action_scope_access_allowed(feature_key, user_id, scope))
+        return bool(is_governance_access_allowed(feature_key, user_id))
+    except Exception as exc:
+        log_event(
+            f"[WORKSPACE_SECTIONS] Governance check failed for {feature_key}: {exc}",
+            extra={"user_id": user_id, "feature_key": feature_key},
+            level=logging.WARNING,
+            exceptionTraceback=True,
+        )
+        return True
+
+
+def _section(enabled, reason=None):
+    return {"enabled": bool(enabled), "reason": None if enabled else reason}
+
+
+def build_workspace_section_availability(
+    settings,
+    user_id,
+    *,
+    user_info=None,
+    user_roles=None,
+    file_sync_enabled=None,
+):
+    """Describe every personal workspace section for one user.
+
+    ``file_sync_enabled`` may be supplied by a caller that has already computed it, since
+    the check reads app roles and there is no reason to repeat it.
+
+    Returns a dict carrying the section map plus the two intermediate values callers need
+    in their own right: ``file_sync_enabled`` and the resolved ``governance`` flags.
+    """
+    source_settings = settings or {}
+    resolved_user_id = str(user_id or "")
+
+    if file_sync_enabled is None:
+        file_sync_enabled = False
+        if resolved_user_id:
+            try:
+                file_sync_enabled = bool(
+                    is_file_sync_enabled_for_user(
+                        source_settings,
+                        resolved_user_id,
+                        (user_info or {}).get("email"),
+                        user_info=user_info,
+                    )
+                )
+            except Exception as exc:
+                log_event(
+                    f"[WORKSPACE_SECTIONS] File sync availability check failed: {exc}",
+                    extra={"user_id": resolved_user_id},
+                    level=logging.WARNING,
+                    exceptionTraceback=True,
+                )
+    file_sync_enabled = bool(file_sync_enabled)
+
+    governance = {
+        "user_agents": _governance_allows("governance_user_agents", resolved_user_id),
+        "user_actions": _governance_allows(
+            "governance_user_actions", resolved_user_id, scope="personal"
+        ),
+        "user_endpoints": _governance_allows("governance_user_endpoints", resolved_user_id),
+        "global_endpoints": _governance_allows("governance_global_endpoints", resolved_user_id),
+    }
+
+    semantic_kernel_enabled = bool(source_settings.get("enable_semantic_kernel", False))
+    # Personal agents and actions additionally require the per-user Semantic Kernel switch;
+    # without it the tenant runs a shared kernel and personal definitions have nowhere to load.
+    personal_kernel = bool(source_settings.get("per_user_semantic_kernel", False)) and (
+        semantic_kernel_enabled
+    )
+    allow_agents = bool(source_settings.get("allow_user_agents", False))
+    allow_plugins = bool(source_settings.get("allow_user_plugins", False))
+    allow_endpoints = bool(source_settings.get("allow_user_custom_endpoints", False)) and bool(
+        source_settings.get("enable_multi_model_endpoints", False)
+    )
+
+    try:
+        workflows_enabled = bool(
+            is_user_workflows_enabled_for_user(source_settings, user_roles=user_roles)
+        )
+    except Exception as exc:
+        log_event(
+            f"[WORKSPACE_SECTIONS] Workflow availability check failed: {exc}",
+            extra={"user_id": resolved_user_id},
+            level=logging.WARNING,
+            exceptionTraceback=True,
+        )
+        workflows_enabled = False
+
+    agents_enabled = personal_kernel and allow_agents
+    actions_enabled = agents_enabled and allow_plugins
+
+    sections = {
+        # Documents and prompts have no capability of their own: reaching the workspace at
+        # all already required enable_user_workspace.
+        "documents": _section(True),
+        "prompts": _section(True),
+        "sync": _section(
+            file_sync_enabled,
+            "File sync is not enabled for your account, so external file sources cannot "
+            "be configured here.",
+        ),
+        # Identities serve file sync and actions, so either one being available is enough
+        # to justify managing stored credentials.
+        "identities": _section(
+            file_sync_enabled or semantic_kernel_enabled,
+            "Identities appear once file sync or agents are enabled, since they exist to "
+            "supply credentials to those.",
+        ),
+        "agents": _section(
+            agents_enabled and governance["user_agents"],
+            _DENIED_BY_GOVERNANCE
+            if agents_enabled and not governance["user_agents"]
+            else "Personal agents are not enabled for your account.",
+        ),
+        "actions": _section(
+            actions_enabled and governance["user_actions"],
+            _DENIED_BY_GOVERNANCE
+            if actions_enabled and not governance["user_actions"]
+            else "Personal actions are not enabled for your account.",
+        ),
+        "workflows": _section(
+            workflows_enabled,
+            "Personal workflows are not enabled for your account.",
+        ),
+        "endpoints": _section(
+            allow_endpoints and governance["user_endpoints"],
+            _DENIED_BY_GOVERNANCE
+            if allow_endpoints and not governance["user_endpoints"]
+            else "Personal model endpoints are not enabled for your account.",
+        ),
+    }
+
+    for section_id, section in sections.items():
+        section["group"] = WORKSPACE_SECTION_GROUPS[section_id]
+
+    return {
+        "enabled": bool(source_settings.get("enable_user_workspace", False)),
+        "file_sync_enabled": file_sync_enabled,
+        "governance": governance,
+        "sections": sections,
+    }
+
+
+def build_workspace_governance(settings, user_id, *, user_info=None, user_roles=None):
+    """Return only the governance flags, in the shape the classic workspace template uses."""
+    availability = build_workspace_section_availability(
+        settings,
+        user_id,
+        user_info=user_info,
+        user_roles=user_roles,
+    )
+    return availability["governance"]
+
+
+__all__ = [
+    "WORKSPACE_SECTION_GROUPS",
+    "WORKSPACE_SECTION_IDS",
+    "build_workspace_governance",
+    "build_workspace_section_availability",
+]
diff --git a/application/single_app/route_backend_agents.py b/application/single_app/route_backend_agents.py
index 30a967da0..dc05394f5 100644
--- a/application/single_app/route_backend_agents.py
+++ b/application/single_app/route_backend_agents.py
@@ -1049,6 +1049,93 @@ def get_assigned_knowledge_catalog_route():
     )
     return jsonify(catalog), 200
 
+def _find_personal_agent(user_id, agent_ref):
+    """Resolve a personal agent by id first, then by name.
+
+    Personal agents were addressed by name historically, but ``GET /api/user/agents`` can
+    merge personal and global agents and a name is editable, so an id is the only stable
+    handle. Both are accepted: the id keeps new clients correct, the name keeps the classic
+    interface working.
+    """
+    reference = str(agent_ref or '')
+    if not reference:
+        return None
+    agents = get_personal_agents(user_id)
+    for agent in agents:
+        if str(agent.get('id') or '') == reference:
+            return agent
+    for agent in agents:
+        if agent.get('name') == reference:
+            return agent
+    return None
+
+
+def _prepare_personal_agent_payload(user_id, agent, settings):
+    """Clean, enrich and validate a single personal agent.
+
+    This is the per-agent half of the bulk save, factored out so the per-item create and
+    update routes cannot drift from it. Returns ``(cleaned_agent, error_response)`` where
+    exactly one of the two is None.
+    """
+    if not settings.get('allow_user_custom_endpoints', False):
+        _strip_disallowed_local_custom_connection_fields(agent)
+
+    try:
+        cleaned_agent = sanitize_agent_payload(agent)
+    except AgentPayloadError as exc:
+        return None, (jsonify({'error': str(exc)}), 400)
+
+    cleaned_agent['is_global'] = False
+    cleaned_agent['is_group'] = False
+
+    try:
+        cleaned_agent = apply_assigned_knowledge_to_agent_payload(
+            cleaned_agent,
+            user_id=user_id,
+            agent_scope='personal',
+            is_admin=False,
+        )
+    except AssignedKnowledgeError as exc:
+        return None, (jsonify({'error': str(exc)}), 400)
+
+    validation_error = validate_agent(cleaned_agent)
+    if validation_error:
+        return None, (jsonify({'error': f'Agent validation failed: {validation_error}'}), 400)
+
+    return cleaned_agent, None
+
+
+def _create_personal_agent(user_id, payload):
+    """Create one personal agent from an object body."""
+    try:
+        ensure_governance_access('governance_user_agents', user_id)
+    except PermissionError as exc:
+        return jsonify({'error': str(exc)}), 403
+
+    if payload.get('is_global'):
+        return jsonify({'error': 'Global agents cannot be created here.'}), 400
+
+    settings = get_settings()
+    cleaned_agent, error = _prepare_personal_agent_payload(user_id, dict(payload), settings)
+    if error:
+        return error
+
+    existing = _find_personal_agent(user_id, cleaned_agent.get('name'))
+    if existing:
+        return jsonify({'error': f"An agent named '{cleaned_agent.get('name')}' already exists."}), 409
+
+    saved = save_personal_agent(user_id, cleaned_agent) or cleaned_agent
+    log_agent_creation(
+        user_id=user_id,
+        agent_id=saved.get('id', ''),
+        agent_name=saved.get('name', ''),
+        agent_display_name=saved.get('display_name', saved.get('name', '')),
+        scope='personal',
+    )
+    log_event("User agent created", extra={"user_id": user_id, "agent_name": saved.get('name', '')})
+    return jsonify(saved), 201
+
+
 @bpa.route('/api/user/agents', methods=['POST'])
 @swagger_route(
     security=get_auth_security()
@@ -1057,37 +1144,31 @@ def get_assigned_knowledge_catalog_route():
 @user_required
 @enabled_required("allow_user_agents")
 def set_user_agents():
+    """Create one agent, or replace the whole collection.
+
+    An object body creates a single agent and is the supported form. An array body replaces
+    every personal agent at once; it is retained because the classic interface still saves
+    that way, but it is deprecated -- concurrent editors overwrite each other's work, and a
+    dropped element is an unintended delete. New callers should use POST with an object,
+    PATCH for edits and DELETE for removals.
+    """
     user_id = get_current_user_id()
-    agents = request.json if isinstance(request.json, list) else []
+    payload = request.get_json(silent=True)
+
+    if isinstance(payload, dict):
+        return _create_personal_agent(user_id, payload)
+
+    agents = payload if isinstance(payload, list) else []
     settings = get_settings()
-    # If custom endpoints are not allowed, strip deployment settings for endpoint, key, and api-revision
-    if not settings.get('allow_user_custom_endpoints', False):
-        for agent in agents:
-            _strip_disallowed_local_custom_connection_fields(agent)
 
     # Remove any global agents before saving
     filtered_agents = []
     for agent in agents:
         if agent.get('is_global', False):
             continue  # Skip global agents
-        try:
-            cleaned_agent = sanitize_agent_payload(agent)
-        except AgentPayloadError as exc:
-            return jsonify({'error': str(exc)}), 400
-        cleaned_agent['is_global'] = False
-        cleaned_agent['is_group'] = False
-        try:
-            cleaned_agent = apply_assigned_knowledge_to_agent_payload(
-                cleaned_agent,
-                user_id=user_id,
-                agent_scope='personal',
-                is_admin=False,
-            )
-        except AssignedKnowledgeError as exc:
-            return jsonify({'error': str(exc)}), 400
-        validation_error = validate_agent(cleaned_agent)
-        if validation_error:
-            return jsonify({'error': f'Agent validation failed: {validation_error}'}), 400
+        cleaned_agent, error = _prepare_personal_agent_payload(user_id, agent, settings)
+        if error:
+            return error
         filtered_agents.append(cleaned_agent)
 
     # Enforce global agent only if per_user_semantic_kernel is False
@@ -1134,42 +1215,126 @@ def set_user_agents():
     log_event("User agents updated", extra={"user_id": user_id, "agents_count": len(filtered_agents)})
     return jsonify({'success': True})
 
-# Add a DELETE endpoint for user agents (if not present)
-@bpa.route('/api/user/agents/<agent_name>', methods=['DELETE'])
+@bpa.route('/api/user/agents/<agent_id>', methods=['GET'])
 @swagger_route(
     security=get_auth_security()
 )
 @login_required
 @user_required
 @enabled_required("allow_user_agents")
-def delete_user_agent(agent_name):
+def get_user_agent(agent_id):
+    """Return one personal agent, addressed by id or by name."""
     user_id = get_current_user_id()
-    # Get current agents from personal_agents container
-    agents = get_personal_agents(user_id)
-    agent_to_delete = next((a for a in agents if a['name'] == agent_name), None)
+    try:
+        ensure_governance_access('governance_user_agents', user_id)
+    except PermissionError as exc:
+        return jsonify({'error': str(exc)}), 403
+
+    agent = _find_personal_agent(user_id, agent_id)
+    if not agent or not _is_agent_allowed_for_user_selection(user_id, agent):
+        return jsonify({'error': 'Agent not found.'}), 404
+
+    agent['is_global'] = False
+    agent['is_group'] = False
+    agent.setdefault('agent_type', 'local')
+    return jsonify(agent), 200
+
+
+@bpa.route('/api/user/agents/<agent_id>', methods=['PATCH'])
+@swagger_route(
+    security=get_auth_security()
+)
+@login_required
+@user_required
+@enabled_required("allow_user_agents")
+def update_user_agent(agent_id):
+    """Apply a partial update to one personal agent.
+
+    Only the supplied keys change, so an editor that knows about a subset of the agent's
+    fields cannot blank the rest -- which is what the whole-collection POST does whenever a
+    client round-trips a stale copy.
+    """
+    user_id = get_current_user_id()
+    try:
+        ensure_governance_access('governance_user_agents', user_id)
+    except PermissionError as exc:
+        return jsonify({'error': str(exc)}), 403
+
+    updates = request.get_json(silent=True)
+    if not isinstance(updates, dict):
+        return jsonify({'error': 'Agent payload must be an object.'}), 400
+
+    existing = _find_personal_agent(user_id, agent_id)
+    if not existing:
+        return jsonify({'error': 'Agent not found.'}), 404
+
+    merged = dict(existing)
+    merged.update(updates)
+    # The stored document is keyed on id, so it is carried over rather than taken from the
+    # body. That is also what makes a rename safe: the name changes, the document does not
+    # move, and no orphan is left behind.
+    merged['id'] = existing.get('id')
+
+    settings = get_settings()
+    cleaned_agent, error = _prepare_personal_agent_payload(user_id, merged, settings)
+    if error:
+        return error
+
+    saved = save_personal_agent(user_id, cleaned_agent) or cleaned_agent
+    log_agent_update(
+        user_id=user_id,
+        agent_id=saved.get('id', ''),
+        agent_name=saved.get('name', ''),
+        agent_display_name=saved.get('display_name', saved.get('name', '')),
+        scope='personal',
+    )
+    log_event("User agent updated", extra={"user_id": user_id, "agent_name": saved.get('name', '')})
+    return jsonify(saved), 200
+
+
+@bpa.route('/api/user/agents/<agent_id>', methods=['DELETE'])
+@swagger_route(
+    security=get_auth_security()
+)
+@login_required
+@user_required
+@enabled_required("allow_user_agents")
+def delete_user_agent(agent_id):
+    """Delete one personal agent, addressed by id or by name."""
+    user_id = get_current_user_id()
+    # The collection save enforces governance; deleting is just as destructive, so it is
+    # enforced here too rather than left to the container helper, which does not check.
+    try:
+        ensure_governance_access('governance_user_agents', user_id)
+    except PermissionError as exc:
+        return jsonify({'error': str(exc)}), 403
+
+    agent_to_delete = _find_personal_agent(user_id, agent_id)
     if not agent_to_delete:
         return jsonify({'error': 'Agent not found.'}), 404
-    
-    # Prevent deleting the agent that matches global_selected_agent
+
+    agent_name = agent_to_delete.get('name', agent_id)
+
+    # Checked before the delete, not after. The previous implementation deleted the agent
+    # and then returned 400 if the remaining agents did not match global_selected_agent,
+    # which reported failure for work that had already succeeded -- and did so on every
+    # delete whenever no global agent was configured, because the comparison was against
+    # None. The classic interface avoided this route entirely as a result.
     settings = get_settings()
-    global_selected_agent = settings.get('global_selected_agent', {})
+    global_selected_agent = settings.get('global_selected_agent', {}) or {}
     global_selected_name = global_selected_agent.get('name')
-    if agent_to_delete.get('name') == global_selected_name:
+    if global_selected_name and agent_name == global_selected_name:
         return jsonify({'error': 'Cannot delete the agent set as global_selected_agent. Please set another agent as global first.'}), 400
-    
-    # Delete from personal_agents container
-    delete_personal_agent(user_id, agent_name)
-    
-    # Log agent deletion activity
-    log_agent_deletion(user_id=user_id, agent_id=agent_to_delete.get('id', agent_name), agent_name=agent_name, scope='personal')
 
-    # Check if there are any agents left and if they match global_selected_agent
-    remaining_agents = get_personal_agents(user_id)
-    if len(remaining_agents) > 0:
-        found = any(a.get('name') == global_selected_name for a in remaining_agents)
-        if not found:
-            return jsonify({'error': 'There must be at least one agent matching the global_selected_agent.'}), 400
-  
+    if not delete_personal_agent(user_id, agent_to_delete.get('id') or agent_name):
+        return jsonify({'error': 'Agent not found.'}), 404
+
+    log_agent_deletion(
+        user_id=user_id,
+        agent_id=agent_to_delete.get('id', agent_name),
+        agent_name=agent_name,
+        scope='personal',
+    )
     log_event("User agent deleted", extra={"user_id": user_id, "agent_name": agent_name})
     return jsonify({'success': True})
 
diff --git a/application/single_app/route_backend_models.py b/application/single_app/route_backend_models.py
index 652b1558f..4192ea2db 100644
--- a/application/single_app/route_backend_models.py
+++ b/application/single_app/route_backend_models.py
@@ -22,6 +22,7 @@
 from azure.identity import DefaultAzureCredential, ClientSecretCredential, get_bearer_token_provider
 import re
 import requests
+import uuid
 
 
 def _get_configured_models(settings, setting_key):
@@ -798,28 +799,27 @@ def get_user_model_endpoints():
         })
 
 
-    @bp.route('/api/user/model-endpoints', methods=['POST'])
-    @swagger_route(security=get_auth_security())
-    @login_required
-    @user_required
-    @enabled_required('allow_user_custom_endpoints')
-    def save_user_model_endpoints():
-        user_id = get_current_user_id()
-        try:
-            ensure_governance_access("governance_user_endpoints", user_id)
-        except PermissionError as exc:
-            return jsonify({"error": str(exc)}), 403
-        data = request.get_json() or {}
-        incoming = data.get("endpoints", [])
-        if not isinstance(incoming, list):
-            return jsonify({"error": "endpoints must be a list."}), 400
-
+    def _load_personal_endpoints(user_id):
+        """Read the caller's stored personal endpoints as a list."""
         user_settings = get_user_settings(user_id)
-        existing = user_settings.get("settings", {}).get("personal_model_endpoints", [])
-
-        merged = merge_model_endpoints_with_existing(incoming, existing)
-
-        normalized, _ = normalize_model_endpoints(merged)
+        endpoints = user_settings.get("settings", {}).get("personal_model_endpoints", [])
+        return endpoints if isinstance(endpoints, list) else []
+
+    def _find_personal_endpoint(endpoints, endpoint_id):
+        reference = str(endpoint_id or "")
+        for endpoint in endpoints:
+            if isinstance(endpoint, dict) and str(endpoint.get("id") or "") == reference:
+                return endpoint
+        return None
+
+    def _persist_personal_endpoints(user_id, normalized, existing):
+        """Save a full endpoint list, moving Key Vault secrets to match.
+
+        Secrets are handled in three passes because each endpoint can carry them: saved
+        endpoints write theirs, changed endpoints have the superseded version cleaned up,
+        and endpoints that are gone have theirs deleted. Skipping the last one would leave
+        orphaned secrets behind after a delete.
+        """
         existing_by_id = {
             endpoint.get("id"): endpoint
             for endpoint in existing
@@ -861,6 +861,163 @@ def save_user_model_endpoints():
                 keyvault_model_endpoint_delete_helper(endpoint, endpoint_id, scope="user")
 
         update_user_settings(user_id, {"personal_model_endpoints": saved_endpoints})
+        return saved_endpoints
+
+    def _single_endpoint_response(saved_endpoints, endpoint_id, status):
+        saved = _find_personal_endpoint(saved_endpoints, endpoint_id)
+        sanitized = sanitize_model_endpoints_for_frontend([saved]) if saved else []
+        return jsonify({"endpoint": sanitized[0] if sanitized else {}}), status
+
+    def _create_personal_model_endpoint(user_id, payload):
+        """Add one endpoint to the caller's stored list."""
+        if not isinstance(payload, dict) or not payload:
+            return jsonify({"error": "Model endpoint payload must be an object."}), 400
+
+        existing = _load_personal_endpoints(user_id)
+        candidate = dict(payload)
+        endpoint_id = str(candidate.get("id") or "").strip()
+        if not endpoint_id:
+            endpoint_id = str(uuid.uuid4())
+        elif _find_personal_endpoint(existing, endpoint_id):
+            return jsonify({"error": "A model endpoint with that id already exists."}), 409
+        candidate["id"] = endpoint_id
+
+        normalized, _ = normalize_model_endpoints(list(existing) + [candidate])
+        saved_endpoints = _persist_personal_endpoints(user_id, normalized, existing)
+        return _single_endpoint_response(saved_endpoints, endpoint_id, 201)
+
+    @bp.route('/api/user/model-endpoints', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def save_user_model_endpoints():
+        """Create one endpoint, or replace the whole collection.
+
+        A body carrying an ``endpoints`` list replaces every personal endpoint at once. That
+        is how the classic interface saves, so it is retained, but it is deprecated: the
+        client has to send back endpoints it never edited, and a stale copy silently
+        overwrites another tab's work. Any other object body creates a single endpoint.
+        """
+        user_id = get_current_user_id()
+        try:
+            ensure_governance_access("governance_user_endpoints", user_id)
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+        data = request.get_json() or {}
+
+        if "endpoints" not in data:
+            return _create_personal_model_endpoint(user_id, data)
+
+        incoming = data.get("endpoints", [])
+        if not isinstance(incoming, list):
+            return jsonify({"error": "endpoints must be a list."}), 400
+
+        existing = _load_personal_endpoints(user_id)
+
+        merged = merge_model_endpoints_with_existing(incoming, existing)
+
+        normalized, _ = normalize_model_endpoints(merged)
+        _persist_personal_endpoints(user_id, normalized, existing)
+        return jsonify({"success": True})
+
+
+    @bp.route('/api/user/model-endpoints/<endpoint_id>', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def get_user_model_endpoint(endpoint_id):
+        """Return one personal model endpoint, with its secrets stripped."""
+        user_id = get_current_user_id()
+        try:
+            ensure_governance_access("governance_user_endpoints", user_id)
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+
+        endpoint = _find_personal_endpoint(_load_personal_endpoints(user_id), endpoint_id)
+        if not endpoint:
+            return jsonify({"error": "Model endpoint not found."}), 404
+
+        sanitized = sanitize_model_endpoints_for_frontend([endpoint])
+        return jsonify({"endpoint": sanitized[0] if sanitized else {}})
+
+
+    @bp.route('/api/user/model-endpoints/<endpoint_id>', methods=['PATCH'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def update_user_model_endpoint(endpoint_id):
+        """Apply a partial update to one personal model endpoint.
+
+        The stored endpoint is merged with the supplied keys server-side, so a client that
+        never received the secret values -- they are stripped on the way out -- cannot blank
+        them by sending the object back.
+        """
+        user_id = get_current_user_id()
+        try:
+            ensure_governance_access("governance_user_endpoints", user_id)
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+
+        updates = request.get_json(silent=True)
+        if not isinstance(updates, dict):
+            return jsonify({"error": "Model endpoint payload must be an object."}), 400
+
+        existing = _load_personal_endpoints(user_id)
+        current = _find_personal_endpoint(existing, endpoint_id)
+        if not current:
+            return jsonify({"error": "Model endpoint not found."}), 404
+
+        merged_endpoint = merge_model_endpoint_payload(current, {**updates, "id": current.get("id")})
+        replaced = [
+            merged_endpoint
+            if isinstance(endpoint, dict) and str(endpoint.get("id") or "") == str(endpoint_id)
+            else endpoint
+            for endpoint in existing
+        ]
+
+        normalized, _ = normalize_model_endpoints(replaced)
+        saved_endpoints = _persist_personal_endpoints(user_id, normalized, existing)
+        return _single_endpoint_response(saved_endpoints, current.get("id"), 200)
+
+
+    @bp.route('/api/user/model-endpoints/<endpoint_id>', methods=['DELETE'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def delete_user_model_endpoint(endpoint_id):
+        """Remove one personal model endpoint and its stored secrets.
+
+        Unlike the collection save, this reads the stored list server-side, so it cannot
+        drop an endpoint the caller could not see. That is the case
+        ``merge_model_endpoints_with_existing`` has to defend against when a whole list
+        arrives from a browser.
+        """
+        user_id = get_current_user_id()
+        try:
+            ensure_governance_access("governance_user_endpoints", user_id)
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+
+        existing = _load_personal_endpoints(user_id)
+        if not _find_personal_endpoint(existing, endpoint_id):
+            return jsonify({"error": "Model endpoint not found."}), 404
+
+        remaining = [
+            endpoint
+            for endpoint in existing
+            if not (isinstance(endpoint, dict) and str(endpoint.get("id") or "") == str(endpoint_id))
+        ]
+
+        normalized, _ = normalize_model_endpoints(remaining)
+        _persist_personal_endpoints(user_id, normalized, existing)
+        log_event(
+            "User model endpoint deleted",
+            extra={"user_id": user_id, "endpoint_id": endpoint_id},
+        )
         return jsonify({"success": True})
 
 
diff --git a/application/single_app/route_backend_plugins.py b/application/single_app/route_backend_plugins.py
index ebfd0350b..d6add5ac9 100644
--- a/application/single_app/route_backend_plugins.py
+++ b/application/single_app/route_backend_plugins.py
@@ -958,14 +958,227 @@ def get_user_plugins():
     else:
         return jsonify(plugins)
 
+def _prepare_personal_action_payload(user_id, plugin):
+    """Clean, default and validate a single personal action.
+
+    This is the per-action half of the bulk save, factored out so the per-item create and
+    update routes apply exactly the same identity checks, manifest validation and MCP
+    destination policy. Returns ``(plugin_to_save, error_response)`` with exactly one set.
+    """
+    plugin_to_save = dict(plugin)
+    # Remove is_global if present
+    if 'is_global' in plugin_to_save:
+        del plugin_to_save['is_global']
+
+    # Ensure required fields have default values
+    plugin_to_save.setdefault('name', '')
+    plugin_to_save.setdefault('displayName', plugin_to_save.get('name', ''))
+    plugin_to_save.setdefault('description', '')
+    plugin_to_save.setdefault('metadata', {})
+    plugin_to_save.setdefault('additionalFields', {})
+
+    # Remove storage-managed fields that are not part of the plugin manifest schema,
+    # but preserve the action ID so existing records can be updated in place.
+    for field in PLUGIN_STORAGE_MANAGED_FIELDS:
+        if field == 'id':
+            continue
+        plugin_to_save.pop(field, None)
+
+    # Handle endpoint based on plugin type. Read before the defaults below fill it in, so
+    # the manifest check still sees the type the caller actually declared.
+    plugin_type = plugin_to_save.get('type', '')
+    plugin_to_save.setdefault('endpoint', '')
+    _apply_plugin_runtime_defaults(plugin_to_save)
+    mcp_stdio_error = _reject_non_admin_mcp_stdio(plugin_to_save, scope_label='personal')
+    if mcp_stdio_error:
+        return None, (jsonify({'error': mcp_stdio_error}), 400)
+    try:
+        _validate_action_identity_for_scope(
+            plugin_to_save,
+            WORKSPACE_IDENTITY_SCOPE_PERSONAL,
+            user_id,
+        )
+    except (ValueError, LookupError, PermissionError):
+        return None, (jsonify({'error': 'Action identity configuration is invalid.'}), 400)
+
+    # Ensure auth has default structure
+    if 'auth' not in plugin_to_save:
+        plugin_to_save['auth'] = {'type': 'identity'}
+    elif not isinstance(plugin_to_save['auth'], dict):
+        plugin_to_save['auth'] = {'type': 'identity'}
+    elif 'type' not in plugin_to_save['auth']:
+        plugin_to_save['auth']['type'] = 'identity'
+
+    # Auto-fill type from metadata if missing or empty
+    if not plugin_to_save.get('type'):
+        if plugin_to_save.get('metadata', {}).get('type'):
+            plugin_to_save['type'] = plugin_to_save['metadata']['type']
+        else:
+            plugin_to_save['type'] = 'unknown'  # Default type
+
+    debug_print(f"Plugin build: {_redact_plugin_for_logging(plugin_to_save)}")
+    validation_error = validate_plugin(plugin_to_save)
+    if validation_error:
+        return None, (jsonify({'error': f'Plugin validation failed: {validation_error}'}), 400)
+    is_valid, validation_errors = PluginHealthChecker.validate_plugin_manifest(plugin_to_save, plugin_type)
+    if not is_valid:
+        return None, (jsonify({'error': f'Plugin validation failed: {"; ".join(validation_errors)}'}), 400)
+
+    try:
+        _enforce_mcp_destination_policy(
+            plugin_to_save,
+            WORKSPACE_IDENTITY_SCOPE_PERSONAL,
+            user_id,
+            operation='personal_action_save',
+            user_id=user_id,
+        )
+    except McpDestinationPolicyError:
+        return None, (jsonify({'error': 'MCP destination is not allowed by governance policy.'}), 403)
+    except ValueError:
+        return None, (jsonify({'error': 'MCP destination configuration is invalid.'}), 400)
+
+    return plugin_to_save, None
+
+
+def _save_personal_action_or_error(user_id, plugin_to_save):
+    """Persist one personal action, mapping the storage failures onto HTTP responses."""
+    try:
+        return save_personal_action(user_id, plugin_to_save), None
+    except ValueError as exc:
+        debug_print(f"Validation error saving personal action for user {user_id}: {exc}")
+        return None, (jsonify({'error': ACTION_VALIDATION_ERROR_MESSAGE}), 400)
+    except PermissionError as exc:
+        debug_print(f"Governance denied saving personal action for user {user_id}: {exc}")
+        return None, (jsonify({'error': ACTION_PERMISSION_ERROR_MESSAGE}), 403)
+    except RuntimeError as exc:
+        debug_print(f"Key Vault error saving personal action for user {user_id}: {exc}")
+        return None, (jsonify({'error': ACTION_KEY_VAULT_ERROR_MESSAGE}), 500)
+    except Exception as exc:
+        debug_print(f"Error saving personal action for user {user_id}: {exc}")
+        return None, (jsonify({'error': 'Failed to save plugin'}), 500)
+
+
+def _create_personal_action(user_id, payload):
+    """Create one personal action from an object body."""
+    name = str(payload.get('name') or '').strip()
+    if not name:
+        return jsonify({'error': 'Action name is required.'}), 400
+
+    global_plugin_names = set(
+        p['name'].lower() for p in get_global_actions() if 'name' in p
+    )
+    if name.lower() in global_plugin_names:
+        return jsonify({'error': f"'{name}' is the name of a global action."}), 409
+
+    if get_personal_action(user_id, name, return_type=SecretReturnType.NAME):
+        return jsonify({'error': f"An action named '{name}' already exists."}), 409
+
+    plugin_to_save, error = _prepare_personal_action_payload(user_id, payload)
+    if error:
+        return error
+
+    saved, error = _save_personal_action_or_error(user_id, plugin_to_save)
+    if error:
+        return error
+
+    saved = saved or plugin_to_save
+    log_action_creation(
+        user_id=user_id,
+        action_id=saved.get('id', ''),
+        action_name=saved.get('name', ''),
+        action_type=saved.get('type', ''),
+        scope='personal',
+    )
+    log_event("User plugin created", extra={"user_id": user_id, "plugin_name": saved.get('name', '')})
+    return jsonify(saved), 201
+
+
+@bpap.route('/api/user/plugins/<action_id>', methods=['GET'])
+@swagger_route(security=get_auth_security())
+@login_required
+@user_required
+def get_user_plugin(action_id):
+    """Return one personal action, addressed by id or by name."""
+    user_id = get_current_user_id()
+    try:
+        action = get_personal_action(user_id, action_id, return_type=SecretReturnType.NAME)
+    except PermissionError:
+        return jsonify({'error': ACTION_PERMISSION_ERROR_MESSAGE}), 403
+    if not action:
+        return jsonify({'error': 'Plugin not found.'}), 404
+    action['is_global'] = False
+    return jsonify(action), 200
+
+
+@bpap.route('/api/user/plugins/<action_id>', methods=['PATCH'])
+@swagger_route(security=get_auth_security())
+@login_required
+@user_required
+@enabled_required("allow_user_plugins")
+def update_user_plugin(action_id):
+    """Apply a partial update to one personal action.
+
+    Only the supplied keys change. The whole-collection POST cannot express this: a client
+    that does not know about a field has to send it back verbatim or lose it.
+    """
+    user_id = get_current_user_id()
+    updates = request.get_json(silent=True)
+    if not isinstance(updates, dict):
+        return jsonify({'error': 'Action payload must be an object.'}), 400
+
+    try:
+        existing = get_personal_action(user_id, action_id, return_type=SecretReturnType.NAME)
+    except PermissionError:
+        return jsonify({'error': ACTION_PERMISSION_ERROR_MESSAGE}), 403
+    if not existing:
+        return jsonify({'error': 'Plugin not found.'}), 404
+
+    merged = dict(existing)
+    merged.update(updates)
+    # The stored document is keyed on id, so it is carried over rather than taken from the
+    # body; that keeps a rename from orphaning the existing record.
+    merged['id'] = existing.get('id')
+
+    plugin_to_save, error = _prepare_personal_action_payload(user_id, merged)
+    if error:
+        return error
+
+    saved, error = _save_personal_action_or_error(user_id, plugin_to_save)
+    if error:
+        return error
+
+    saved = saved or plugin_to_save
+    log_action_update(
+        user_id=user_id,
+        action_id=saved.get('id', ''),
+        action_name=saved.get('name', ''),
+        action_type=saved.get('type', ''),
+        scope='personal',
+    )
+    log_event("User plugin updated", extra={"user_id": user_id, "plugin_name": saved.get('name', '')})
+    return jsonify(saved), 200
+
+
 @bpap.route('/api/user/plugins', methods=['POST'])
 @swagger_route(security=get_auth_security())
 @login_required
 @user_required
 @enabled_required("allow_user_plugins")
 def set_user_plugins():
+    """Create one action, or replace the whole collection.
+
+    An object body creates a single action and is the supported form. An array body
+    replaces every personal action at once; it is retained because the classic interface
+    still saves that way, but it is deprecated -- concurrent editors overwrite each other,
+    and an omitted element is an unintended delete.
+    """
     user_id = get_current_user_id()
-    plugins = request.json if isinstance(request.json, list) else []
+    payload = request.get_json(silent=True)
+
+    if isinstance(payload, dict):
+        return _create_personal_action(user_id, payload)
+
+    plugins = payload if isinstance(payload, list) else []
     
     # Get global plugin names (case-insensitive)
     global_plugins = get_global_actions()
@@ -984,77 +1197,9 @@ def set_user_plugins():
     for plugin in plugins:
         if plugin.get('name', '').lower() in global_plugin_names:
             continue  # Skip global plugins
-        plugin_to_save = dict(plugin)
-        # Remove is_global if present
-        if 'is_global' in plugin_to_save:
-            del plugin_to_save['is_global']
-        
-        # Ensure required fields have default values
-        plugin_to_save.setdefault('name', '')
-        plugin_to_save.setdefault('displayName', plugin_to_save.get('name', ''))
-        plugin_to_save.setdefault('description', '')
-        plugin_to_save.setdefault('metadata', {})
-        plugin_to_save.setdefault('additionalFields', {})
-        
-        # Remove storage-managed fields that are not part of the plugin manifest schema,
-        # but preserve the action ID so existing records can be updated in place.
-        for field in PLUGIN_STORAGE_MANAGED_FIELDS:
-            if field == 'id':
-                continue
-            plugin_to_save.pop(field, None)
-        
-        # Handle endpoint based on plugin type
-        plugin_type = plugin_to_save.get('type', '')
-        plugin_to_save.setdefault('endpoint', '')
-        _apply_plugin_runtime_defaults(plugin_to_save)
-        mcp_stdio_error = _reject_non_admin_mcp_stdio(plugin_to_save, scope_label='personal')
-        if mcp_stdio_error:
-            return jsonify({'error': mcp_stdio_error}), 400
-        try:
-            _validate_action_identity_for_scope(
-                plugin_to_save,
-                WORKSPACE_IDENTITY_SCOPE_PERSONAL,
-                user_id,
-            )
-        except (ValueError, LookupError, PermissionError):
-            return jsonify({'error': 'Action identity configuration is invalid.'}), 400
-        
-        # Ensure auth has default structure
-        if 'auth' not in plugin_to_save:
-            plugin_to_save['auth'] = {'type': 'identity'}
-        elif not isinstance(plugin_to_save['auth'], dict):
-            plugin_to_save['auth'] = {'type': 'identity'}
-        elif 'type' not in plugin_to_save['auth']:
-            plugin_to_save['auth']['type'] = 'identity'
-        
-        # Auto-fill type from metadata if missing or empty
-        if not plugin_to_save.get('type'):
-            if plugin_to_save.get('metadata', {}).get('type'):
-                plugin_to_save['type'] = plugin_to_save['metadata']['type']
-            else:
-                plugin_to_save['type'] = 'unknown'  # Default type
-        
-        debug_print(f"Plugin build: {_redact_plugin_for_logging(plugin_to_save)}")
-        validation_error = validate_plugin(plugin_to_save)
-        if validation_error:
-            return jsonify({'error': f'Plugin validation failed: {validation_error}'}), 400
-        is_valid, validation_errors = PluginHealthChecker.validate_plugin_manifest(plugin_to_save, plugin_type)
-        if not is_valid:
-            return jsonify({'error': f'Plugin validation failed: {"; ".join(validation_errors)}'}), 400
-
-        try:
-            _enforce_mcp_destination_policy(
-                plugin_to_save,
-                WORKSPACE_IDENTITY_SCOPE_PERSONAL,
-                user_id,
-                operation='personal_action_save',
-                user_id=user_id,
-            )
-        except McpDestinationPolicyError:
-            return jsonify({'error': 'MCP destination is not allowed by governance policy.'}), 403
-        except ValueError:
-            return jsonify({'error': 'MCP destination configuration is invalid.'}), 400
-        
+        plugin_to_save, error = _prepare_personal_action_payload(user_id, plugin)
+        if error:
+            return error
         filtered_plugins.append(plugin_to_save)
         new_plugin_names.add(plugin_to_save['name'])
         if plugin_to_save.get('id'):
@@ -1109,24 +1254,31 @@ def set_user_plugins():
     log_event("User plugins updated", extra={"user_id": user_id, "plugins_count": len(filtered_plugins)})
     return jsonify({'success': True})
 
-@bpap.route('/api/user/plugins/<plugin_name>', methods=['DELETE'])
+@bpap.route('/api/user/plugins/<action_id>', methods=['DELETE'])
 @swagger_route(security=get_auth_security())
 @login_required
 @user_required
-def delete_user_plugin(plugin_name):
+def delete_user_plugin(action_id):
+    """Delete one personal action, addressed by id or by name.
+
+    Deliberately not gated on ``allow_user_plugins``. Creating and editing are, but removing
+    an action only reduces what a user has configured, and gating it would strand existing
+    actions with no way to clean them up after an administrator turns the capability off.
+    Governance is still enforced, inside ``delete_personal_action``.
+    """
     user_id = get_current_user_id()
 
     # Try to delete from personal_actions container
     try:
-        deleted = delete_personal_action(user_id, plugin_name)
+        deleted = delete_personal_action(user_id, action_id)
     except PermissionError:
         return jsonify({'error': 'You are not authorized to delete this action.'}), 403
     
     if not deleted:
         return jsonify({'error': 'Plugin not found.'}), 404
     
-    log_action_deletion(user_id=user_id, action_id=plugin_name, action_name=plugin_name, scope='personal')
-    log_event("User plugin deleted", extra={"user_id": user_id, "plugin_name": plugin_name})
+    log_action_deletion(user_id=user_id, action_id=action_id, action_name=action_id, scope='personal')
+    log_event("User plugin deleted", extra={"user_id": user_id, "plugin_name": action_id})
     return jsonify({'success': True})
 
 
diff --git a/application/single_app/route_backend_v2.py b/application/single_app/route_backend_v2.py
index 042111987..04b505185 100644
--- a/application/single_app/route_backend_v2.py
+++ b/application/single_app/route_backend_v2.py
@@ -66,6 +66,7 @@
     is_source_review_enabled_for_user,
     is_url_access_enabled_for_user,
 )
+from functions_workspace_sections import build_workspace_section_availability
 from route_frontend_chats import (
     _build_chat_model_catalog,
     _build_chat_prompt_catalog,
@@ -395,6 +396,22 @@ def v2_bootstrap():
                 stored_workspace_id if stored_workspace_id in visible_workspace_ids else None
             )
 
+            # Which workspace sections this user may see. Computed server-side because the
+            # answer combines settings, app-role checks and governance policy, and only
+            # `enable_*` keys reach `features` above -- `allow_user_agents`,
+            # `allow_user_plugins`, `per_user_semantic_kernel` and the file sync and
+            # governance checks would all be invisible to the SPA otherwise.
+            workspace = {"enabled": False, "sections": {}}
+            try:
+                workspace = build_workspace_section_availability(
+                    settings,
+                    user_id,
+                    user_info=current_user_info,
+                    user_roles=current_user_roles,
+                )
+            except Exception as exc:
+                logger.warning(f"[V2_BOOTSTRAP] Failed to resolve workspace sections: {exc}")
+
             payload = {
                 "version": VERSION,
                 "user": {
@@ -425,6 +442,7 @@ def v2_bootstrap():
                 },
                 "admin_nav": ADMIN_NAV if "Admin" in current_user_roles else [],
                 "notices": _build_notices(public_settings, user_settings_dict),
+                "workspace": workspace,
                 "settings": public_settings,
             }
 
diff --git a/application/single_app/route_frontend_workspace.py b/application/single_app/route_frontend_workspace.py
index 77fd1107e..07d1a5c97 100644
--- a/application/single_app/route_frontend_workspace.py
+++ b/application/single_app/route_frontend_workspace.py
@@ -5,11 +5,11 @@
 from config import *
 from functions_authentication import *
 from functions_group import get_user_groups
-from functions_governance import filter_governed_model_endpoints, is_action_scope_access_allowed, is_governance_access_allowed
+from functions_governance import filter_governed_model_endpoints
 from functions_public_workspaces import get_user_visible_public_workspace_docs
 from functions_settings import *
-from functions_file_sync import is_file_sync_enabled_for_user
 from functions_source_review import is_url_access_enabled_for_user
+from functions_workspace_sections import build_workspace_section_availability
 from swagger_wrapper import swagger_route, get_auth_security
 
 def register_route_frontend_workspace(bp):
@@ -38,10 +38,20 @@ def workspace():
             settings,
             user_roles=current_user_roles,
         )
-        file_sync_enabled = is_file_sync_enabled_for_user(settings, user_id, user_info.get('email'), user_info=user_info) if user_id else False
         if not user_id:
             print("User not authenticated.")
             return redirect(url_for('frontend_authentication.login'))
+
+        # Shared with the V2 interface so the two cannot disagree about which sections of
+        # the personal workspace a user may see.
+        workspace_availability = build_workspace_section_availability(
+            settings,
+            user_id,
+            user_info=user_info,
+            user_roles=current_user_roles,
+        )
+        file_sync_enabled = workspace_availability['file_sync_enabled']
+
         
         query = """
             SELECT VALUE COUNT(1)
@@ -69,12 +79,7 @@ def workspace():
             enable_audio=enable_audio_uploads
         )
         
-        workspace_governance = {
-            "user_agents": is_governance_access_allowed("governance_user_agents", user_id),
-            "user_actions": is_action_scope_access_allowed("governance_user_actions", user_id, "personal"),
-            "user_endpoints": is_governance_access_allowed("governance_user_endpoints", user_id),
-            "global_endpoints": is_governance_access_allowed("governance_global_endpoints", user_id),
-        }
+        workspace_governance = workspace_availability['governance']
 
         personal_endpoints = user_settings.get("settings", {}).get("personal_model_endpoints", [])
         personal_model_endpoints = sanitize_model_endpoints_for_frontend(
diff --git a/application/v2_ui/src/App.tsx b/application/v2_ui/src/App.tsx
index 0f067b7eb..079b34857 100644
--- a/application/v2_ui/src/App.tsx
+++ b/application/v2_ui/src/App.tsx
@@ -13,7 +13,7 @@ import { initializeTheme, hydrateUiPreferences } from './stores/uiStore';
 import { ChatPage } from './pages/ChatPage';
 import { AdminSettingsPage } from './pages/AdminSettingsPage';
 import { SettingsPage } from './pages/SettingsPage';
-import { WorkspacePage } from './pages/WorkspacePage';
+import { WorkspacePage } from './pages/workspace/WorkspacePage';
 import { PlaceholderPage } from './pages/PlaceholderPage';
 
 function BootScreen() {
@@ -110,6 +110,9 @@ export function App() {
                 <Route path="/" element={<Navigate to="/chat" replace />} />
                 <Route path="/chat" element={<ChatPage />} />
                 <Route path="/workspace" element={<WorkspacePage />} />
+                {/* Sections are real paths rather than a query parameter, so a link to one
+                    reads as what it is and survives being shared. */}
+                <Route path="/workspace/:section" element={<WorkspacePage />} />
                 <Route path="/settings" element={<SettingsPage />} />
                 <Route path="/admin" element={<AdminSettingsPage />} />
                 <Route
diff --git a/application/v2_ui/src/components/layout/Sidebar.tsx b/application/v2_ui/src/components/layout/Sidebar.tsx
index adf320f58..c4c4142dd 100644
--- a/application/v2_ui/src/components/layout/Sidebar.tsx
+++ b/application/v2_ui/src/components/layout/Sidebar.tsx
@@ -38,13 +38,27 @@ interface NavItem {
     to: string;
     label: string;
     icon: typeof MessagesSquare;
+    /** Hover text. Two entries are easily confused without it, so both say what they are. */
+    hint?: string;
     adminOnly?: boolean;
 }
 
 const NAV_ITEMS: NavItem[] = [
     { to: '/chat', label: 'Chats', icon: MessagesSquare },
-    { to: '/agents', label: 'Agents', icon: Sparkles },
-    { to: '/workspace', label: 'My Workspace', icon: FolderOpen },
+    {
+        to: '/agents',
+        label: 'Agents',
+        icon: Sparkles,
+        // Distinct from My Workspace > Agents, which is where you build your own. This is
+        // the catalogue of every agent you are allowed to use, wherever it came from.
+        hint: 'Browse every agent you can use',
+    },
+    {
+        to: '/workspace',
+        label: 'My Workspace',
+        icon: FolderOpen,
+        hint: 'Your documents, prompts, agents and automation',
+    },
     { to: '/groups', label: 'Group Workspaces', icon: Users },
     { to: '/public', label: 'Public Workspaces', icon: Globe2 },
     { to: '/admin', label: 'Admin Settings', icon: Settings, adminOnly: true },
@@ -226,7 +240,7 @@ export function Sidebar() {
                     <li key={item.to}>
                         <NavLink
                             to={item.to}
-                            title={collapsed ? item.label : undefined}
+                            title={collapsed ? item.label : item.hint}
                             className={({ isActive }) =>
                                 clsx(
                                     'flex items-center gap-2.5 rounded-xl px-3 py-2 text-sm transition-colors',
diff --git a/application/v2_ui/src/components/workspace/primitives.tsx b/application/v2_ui/src/components/workspace/primitives.tsx
new file mode 100644
index 000000000..8ab18bdff
--- /dev/null
+++ b/application/v2_ui/src/components/workspace/primitives.tsx
@@ -0,0 +1,283 @@
+// primitives.tsx
+// Shared building blocks for the personal workspace sections.
+//
+// The eight sections list very different things, but they all list *something*, and each
+// one having its own idea of a row, a spinner and an empty state is how a page stops
+// feeling like one page. These carry that shape so a section only supplies what is
+// genuinely specific to it.
+
+import { useEffect, useRef, useState } from 'react';
+import { clsx } from 'clsx';
+import { Loader2, Search } from 'lucide-react';
+import type { ReactNode } from 'react';
+import { EmptyState, GlassPanel, Skeleton } from '../ui/primitives';
+
+export function SectionIntro({
+    title,
+    description,
+    actions,
+}: {
+    title: string;
+    description: string;
+    actions?: ReactNode;
+}) {
+    return (
+        <div className="flex flex-wrap items-start justify-between gap-3">
+            <div className="min-w-0">
+                <h2 className="text-base font-semibold text-text-1">{title}</h2>
+                <p className="mt-0.5 max-w-2xl text-sm text-text-3">{description}</p>
+            </div>
+            {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
+        </div>
+    );
+}
+
+export function SectionSearch({
+    value,
+    onChange,
+    placeholder,
+}: {
+    value: string;
+    onChange: (next: string) => void;
+    placeholder: string;
+}) {
+    return (
+        <div className="relative">
+            <Search
+                size={15}
+                className="pointer-events-none absolute top-1/2 left-3 -translate-y-1/2 text-text-3"
+            />
+            <input
+                type="search"
+                value={value}
+                onChange={(event) => onChange(event.target.value)}
+                placeholder={placeholder}
+                aria-label={placeholder}
+                className="w-full rounded-xl border border-edge bg-surface-1 py-2 pr-3 pl-9 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+            />
+        </div>
+    );
+}
+
+export function SectionError({ message }: { message: string }) {
+    return (
+        <GlassPanel elevation="flat" className="p-3 text-sm text-danger" role="alert">
+            {message}
+        </GlassPanel>
+    );
+}
+
+export function SectionSkeleton({ rows = 4 }: { rows?: number }) {
+    return (
+        <div className="space-y-2">
+            {Array.from({ length: rows }).map((_, index) => (
+                <Skeleton key={index} className="h-14 w-full" />
+            ))}
+        </div>
+    );
+}
+
+/**
+ * The list body of a section: skeleton, error, empty state or rows.
+ *
+ * The error is rendered above the rows rather than instead of them, which matters for the
+ * delete flows: they put the list back as it was and then report why, and replacing the
+ * list would hide the very rows the message refers to.
+ */
+export function SectionList<T>({
+    items,
+    loading,
+    error,
+    emptyIcon,
+    emptyTitle,
+    emptyDescription,
+    emptyAction,
+    getKey,
+    renderItem,
+}: {
+    items: T[];
+    loading: boolean;
+    error?: string | null;
+    emptyIcon?: ReactNode;
+    emptyTitle: string;
+    emptyDescription?: string;
+    emptyAction?: ReactNode;
+    getKey: (item: T, index: number) => string;
+    renderItem: (item: T) => ReactNode;
+}) {
+    return (
+        <div className="space-y-3">
+            {error ? <SectionError message={error} /> : null}
+
+            {loading ? <SectionSkeleton /> : null}
+
+            {!loading && items.length === 0 ? (
+                <EmptyState
+                    icon={emptyIcon}
+                    title={emptyTitle}
+                    description={emptyDescription}
+                    action={emptyAction}
+                />
+            ) : null}
+
+            {items.length > 0 ? (
+                <ul className="space-y-2">
+                    {items.map((item, index) => (
+                        <li key={getKey(item, index)}>{renderItem(item)}</li>
+                    ))}
+                </ul>
+            ) : null}
+        </div>
+    );
+}
+
+export function ResourceRow({
+    icon,
+    title,
+    subtitle,
+    meta,
+    actions,
+}: {
+    icon?: ReactNode;
+    title: ReactNode;
+    subtitle?: ReactNode;
+    meta?: ReactNode;
+    actions?: ReactNode;
+}) {
+    return (
+        <GlassPanel elevation="flat" className="flex items-center gap-3 p-3">
+            {icon ? <span className="shrink-0 text-text-3">{icon}</span> : null}
+            <div className="min-w-0 flex-1">
+                <div className="truncate text-sm text-text-1">{title}</div>
+                {subtitle ? (
+                    <div className="mt-0.5 truncate text-xs text-text-3">{subtitle}</div>
+                ) : null}
+            </div>
+            {meta ? <div className="flex shrink-0 items-center gap-2">{meta}</div> : null}
+            {actions ? <div className="flex shrink-0 items-center gap-1">{actions}</div> : null}
+        </GlassPanel>
+    );
+}
+
+export function Pill({
+    children,
+    tone = 'neutral',
+}: {
+    children: ReactNode;
+    tone?: 'neutral' | 'ok' | 'warn' | 'danger' | 'accent';
+}) {
+    const toneClass = {
+        neutral: 'bg-surface-2 text-text-2',
+        ok: 'bg-ok-soft text-ok',
+        warn: 'bg-warn-soft text-warn',
+        danger: 'bg-danger-soft text-danger',
+        accent: 'bg-accent-soft text-accent',
+    }[tone];
+
+    return (
+        <span
+            className={clsx(
+                'rounded-full px-2 py-0.5 text-[11px] leading-none font-medium whitespace-nowrap',
+                toneClass,
+            )}
+        >
+            {children}
+        </span>
+    );
+}
+
+export function RowAction({
+    icon,
+    label,
+    onClick,
+    disabled = false,
+    busy = false,
+    danger = false,
+}: {
+    icon: ReactNode;
+    label: string;
+    onClick: () => void;
+    disabled?: boolean;
+    busy?: boolean;
+    danger?: boolean;
+}) {
+    return (
+        <button
+            type="button"
+            onClick={onClick}
+            disabled={disabled || busy}
+            aria-label={label}
+            title={label}
+            className={clsx(
+                'rounded-lg p-1.5 transition-colors disabled:cursor-not-allowed disabled:opacity-40',
+                danger
+                    ? 'text-text-3 hover:bg-danger-soft hover:text-danger'
+                    : 'text-text-3 hover:bg-surface-2 hover:text-text-1',
+            )}
+        >
+            {busy ? <Loader2 size={15} className="animate-spin" /> : icon}
+        </button>
+    );
+}
+
+/**
+ * A destructive action that asks first, in place.
+ *
+ * A native confirm() dialog would do, but it stops the whole tab and reads as a browser
+ * warning rather than as part of the page. Arming the button keeps the question next to the
+ * row it refers to, and it disarms itself so a button left armed cannot be triggered later
+ * by a stray click.
+ */
+export function ConfirmAction({
+    icon,
+    label,
+    confirmLabel,
+    onConfirm,
+    busy = false,
+    disabled = false,
+}: {
+    icon: ReactNode;
+    label: string;
+    confirmLabel: string;
+    onConfirm: () => void;
+    busy?: boolean;
+    disabled?: boolean;
+}) {
+    const [armed, setArmed] = useState(false);
+    const timer = useRef<number | undefined>(undefined);
+
+    useEffect(() => {
+        if (!armed) {
+            return;
+        }
+        timer.current = window.setTimeout(() => setArmed(false), 4000);
+        return () => window.clearTimeout(timer.current);
+    }, [armed]);
+
+    if (!armed) {
+        return (
+            <RowAction
+                icon={icon}
+                label={label}
+                onClick={() => setArmed(true)}
+                busy={busy}
+                disabled={disabled}
+                danger
+            />
+        );
+    }
+
+    return (
+        <button
+            type="button"
+            onClick={() => {
+                setArmed(false);
+                onConfirm();
+            }}
+            disabled={busy}
+            className="rounded-lg bg-danger-soft px-2 py-1 text-[11px] font-semibold text-danger transition-colors hover:bg-danger hover:text-white disabled:opacity-50"
+        >
+            {busy ? 'Working' : confirmLabel}
+        </button>
+    );
+}
diff --git a/application/v2_ui/src/components/workspace/useSectionResource.ts b/application/v2_ui/src/components/workspace/useSectionResource.ts
new file mode 100644
index 000000000..9a029e768
--- /dev/null
+++ b/application/v2_ui/src/components/workspace/useSectionResource.ts
@@ -0,0 +1,79 @@
+// useSectionResource.ts
+// Loading, refreshing and error state for a workspace section's collection.
+//
+// Each section otherwise repeats the same twenty lines, and they tend to repeat them
+// slightly differently: the interesting parts are the two that are easy to get wrong.
+// A request in flight when the section changes is aborted, and a response that arrives
+// after a newer request started is discarded, so switching sections quickly cannot leave
+// one section showing another's rows.
+
+import { useCallback, useEffect, useRef, useState } from 'react';
+
+/** Turn anything thrown into something worth showing a user. */
+export function errorMessage(error: unknown, fallback: string): string {
+    if (error instanceof Error && error.message) {
+        return error.message;
+    }
+    return fallback;
+}
+
+export interface SectionResource<T> {
+    items: T[];
+    loading: boolean;
+    error: string | null;
+    /** Refetch from the server. */
+    refresh: () => Promise<void>;
+    /** Apply a local change, for optimistic updates that a failure can roll back. */
+    setItems: (next: T[]) => void;
+    setError: (message: string | null) => void;
+}
+
+export function useSectionResource<T>(
+    load: (signal: AbortSignal) => Promise<T[]>,
+    failureMessage: string,
+): SectionResource<T> {
+    const [items, setItems] = useState<T[]>([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState<string | null>(null);
+
+    // Identifies the newest request. A response whose token no longer matches belongs to a
+    // superseded request and is dropped rather than rendered.
+    const requestToken = useRef(0);
+    const abortRef = useRef<AbortController | null>(null);
+    const loadRef = useRef(load);
+    loadRef.current = load;
+
+    const refresh = useCallback(async () => {
+        abortRef.current?.abort();
+        const controller = new AbortController();
+        abortRef.current = controller;
+
+        requestToken.current += 1;
+        const token = requestToken.current;
+
+        setLoading(true);
+        setError(null);
+        try {
+            const next = await loadRef.current(controller.signal);
+            if (token === requestToken.current) {
+                setItems(next);
+            }
+        } catch (loadError) {
+            if (controller.signal.aborted || token !== requestToken.current) {
+                return;
+            }
+            setError(errorMessage(loadError, failureMessage));
+        } finally {
+            if (token === requestToken.current) {
+                setLoading(false);
+            }
+        }
+    }, [failureMessage]);
+
+    useEffect(() => {
+        void refresh();
+        return () => abortRef.current?.abort();
+    }, [refresh]);
+
+    return { items, loading, error, refresh, setItems, setError };
+}
diff --git a/application/v2_ui/src/lib/types.ts b/application/v2_ui/src/lib/types.ts
index 59e2733fc..d9c992007 100644
--- a/application/v2_ui/src/lib/types.ts
+++ b/application/v2_ui/src/lib/types.ts
@@ -134,6 +134,126 @@ export interface WorkspaceTag {
     color?: string;
 }
 
+/**
+ * Entities behind the personal workspace sections.
+ *
+ * Every one of these routes returns more fields than the list views read, and several add
+ * fields over time, so each type is deliberately open. Only the fields the UI actually
+ * renders or sends are named; anything else stays available through the index signature
+ * rather than being dropped on the way through.
+ */
+export interface WorkspacePrompt {
+    id: string;
+    name?: string;
+    content?: string;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceIdentity {
+    id: string;
+    name?: string;
+    description?: string;
+    auth_type?: string;
+    username?: string;
+    scope_type?: string;
+    scope_id?: string;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceSyncSource {
+    id: string;
+    name?: string;
+    source_type?: string;
+    identity_id?: string;
+    remote_path?: string;
+    enabled?: boolean;
+    sync_interval_minutes?: number;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceSyncRun {
+    id: string;
+    source_id?: string;
+    status?: string;
+    started_at?: string;
+    completed_at?: string;
+    triggered_by?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceAgent {
+    id: string;
+    name?: string;
+    display_name?: string;
+    description?: string;
+    instructions?: string;
+    /** True for agents supplied by an administrator, which a user may not edit or delete. */
+    is_global?: boolean;
+    is_group?: boolean;
+    agent_type?: string;
+    tags?: string[];
+    actions_to_load?: string[];
+    [key: string]: unknown;
+}
+
+export interface WorkspaceAction {
+    id: string;
+    name?: string;
+    displayName?: string;
+    description?: string;
+    /** Which connector this action is, for example `mcp`, `openapi` or `sql_query`. */
+    type?: string;
+    endpoint?: string;
+    is_global?: boolean;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceWorkflow {
+    id: string;
+    name?: string;
+    description?: string;
+    status?: string;
+    active_run_id?: string | null;
+    created_at?: string;
+    updated_at?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceWorkflowRun {
+    id: string;
+    workflow_id?: string;
+    status?: string;
+    started_at?: string;
+    completed_at?: string;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceModelEndpointModel {
+    id?: string;
+    deploymentName?: string;
+    modelName?: string;
+    displayName?: string;
+    enabled?: boolean;
+    [key: string]: unknown;
+}
+
+export interface WorkspaceModelEndpoint {
+    id: string;
+    name?: string;
+    provider?: string;
+    enabled?: boolean;
+    connection?: Record<string, unknown>;
+    auth?: Record<string, unknown>;
+    models?: WorkspaceModelEndpointModel[];
+    [key: string]: unknown;
+}
+
 /** Where a cited document lives, from functions_citation_tracking._scope_from_citation. */
 export interface UsedDocumentScope {
     type?: 'personal' | 'group' | 'public' | string;
@@ -484,10 +604,37 @@ export interface BootstrapPayload {
         ai: AiNoticeConfig;
         web_search: WebSearchNoticeConfig;
     };
+    /**
+     * Which personal workspace sections this user may see.
+     *
+     * Resolved server-side by functions_workspace_sections, because the answer combines
+     * plain settings, app-role checks and governance policy. `features` cannot carry it:
+     * it only forwards `enable_*` keys, so `allow_user_agents`, `allow_user_plugins`,
+     * `per_user_semantic_kernel` and `allow_user_custom_endpoints` would all be missing,
+     * and the file sync and governance checks are not settings keys at all.
+     */
+    workspace: WorkspaceAvailability;
     /** Sanitized settings. Never contains keys, secrets or connection strings. */
     settings: Json;
 }
 
+/** The group a workspace section belongs to, as reported by the server. */
+export type WorkspaceSectionGroup = 'knowledge' | 'automation' | 'connections';
+
+export interface WorkspaceSectionAvailability {
+    enabled: boolean;
+    /** Why the section is unavailable. Null when it is enabled. */
+    reason: string | null;
+    group: WorkspaceSectionGroup;
+}
+
+export interface WorkspaceAvailability {
+    enabled: boolean;
+    file_sync_enabled?: boolean;
+    governance?: Record<string, boolean>;
+    sections: Record<string, WorkspaceSectionAvailability>;
+}
+
 /**
  * A single decoded SSE frame from POST /api/chat/stream.
  *
diff --git a/application/v2_ui/src/lib/workspaceApi.ts b/application/v2_ui/src/lib/workspaceApi.ts
new file mode 100644
index 000000000..d2e4d2ba0
--- /dev/null
+++ b/application/v2_ui/src/lib/workspaceApi.ts
@@ -0,0 +1,224 @@
+// workspaceApi.ts
+// Every call the personal workspace sections make.
+//
+// The routes behind these sections grew independently and do not share a response shape:
+// prompts, identities, sync sources and workflows wrap their collection in a named key,
+// while agents and actions return a bare array. Rather than make each section deal with
+// that, the differences are absorbed here and every function returns a plain array or a
+// plain entity.
+//
+// Per-item writes are used throughout. Agents, actions and endpoints also accept a
+// whole-collection POST, but that form requires the client to send back rows it never
+// edited, so a stale tab silently reverts another one's work. Nothing here uses it.
+
+import { api } from './apiClient';
+import type {
+    WorkspaceAction,
+    WorkspaceAgent,
+    WorkspaceIdentity,
+    WorkspaceModelEndpoint,
+    WorkspacePrompt,
+    WorkspaceSyncRun,
+    WorkspaceSyncSource,
+    WorkspaceWorkflow,
+    WorkspaceWorkflowRun,
+} from './types';
+
+/** Coerce a response that should be a list into one, whatever shape it arrived in. */
+function asArray<T>(value: unknown, key?: string): T[] {
+    if (Array.isArray(value)) {
+        return value as T[];
+    }
+    if (key && value && typeof value === 'object') {
+        const nested = (value as Record<string, unknown>)[key];
+        if (Array.isArray(nested)) {
+            return nested as T[];
+        }
+    }
+    return [];
+}
+
+/* -------------------------------------------------------------------------- Prompts */
+
+/**
+ * List personal prompts.
+ *
+ * Paging and search are server-side. The default page size is large because the section
+ * renders a single scrolling list rather than paged controls.
+ */
+export async function fetchPrompts(
+    { search = '', pageSize = 500 }: { search?: string; pageSize?: number } = {},
+    signal?: AbortSignal,
+): Promise<WorkspacePrompt[]> {
+    const params = new URLSearchParams({ page: '1', page_size: String(pageSize) });
+    if (search.trim()) {
+        params.set('search_term', search.trim());
+    }
+    const response = await api.get<unknown>(`/api/prompts?${params.toString()}`, signal);
+    return asArray<WorkspacePrompt>(response, 'prompts');
+}
+
+export const createPrompt = (name: string, content: string) =>
+    api.post<WorkspacePrompt>('/api/prompts', { name, content });
+
+export const updatePrompt = (promptId: string, updates: { name?: string; content?: string }) =>
+    api.patch<WorkspacePrompt>(`/api/prompts/${encodeURIComponent(promptId)}`, updates);
+
+export const deletePrompt = (promptId: string) =>
+    api.delete<{ message?: string }>(`/api/prompts/${encodeURIComponent(promptId)}`);
+
+/* ----------------------------------------------------------------------- Identities */
+
+export async function fetchIdentities(signal?: AbortSignal): Promise<WorkspaceIdentity[]> {
+    const response = await api.get<unknown>(
+        '/api/workspace-identities/personal/identities',
+        signal,
+    );
+    return asArray<WorkspaceIdentity>(response, 'identities');
+}
+
+export const deleteIdentity = (identityId: string) =>
+    api.delete<{ message?: string }>(
+        `/api/workspace-identities/personal/identities/${encodeURIComponent(identityId)}`,
+    );
+
+/* --------------------------------------------------------------------- File sources */
+
+export async function fetchSyncSources(signal?: AbortSignal): Promise<WorkspaceSyncSource[]> {
+    const response = await api.get<unknown>('/api/file-sync/personal/sources', signal);
+    return asArray<WorkspaceSyncSource>(response, 'sources');
+}
+
+export async function fetchSyncRuns(
+    sourceId: string,
+    signal?: AbortSignal,
+): Promise<WorkspaceSyncRun[]> {
+    const response = await api.get<unknown>(
+        `/api/file-sync/personal/sources/${encodeURIComponent(sourceId)}/runs`,
+        signal,
+    );
+    return asArray<WorkspaceSyncRun>(response, 'runs');
+}
+
+/** Queue a sync. The route answers 202 with the run it created, not a finished result. */
+export const startSyncRun = (sourceId: string) =>
+    api.post<{ run?: WorkspaceSyncRun }>(
+        `/api/file-sync/personal/sources/${encodeURIComponent(sourceId)}/sync`,
+    );
+
+/**
+ * Delete a sync source.
+ *
+ * `delete_associated_files` is read from the body, so it is sent explicitly rather than
+ * left to the server's default: whether the documents a source produced also disappear is
+ * too consequential to leave implicit.
+ */
+export const deleteSyncSource = (sourceId: string, deleteAssociatedFiles = false) =>
+    api.delete<{ message?: string }>(
+        `/api/file-sync/personal/sources/${encodeURIComponent(sourceId)}`,
+        { delete_associated_files: deleteAssociatedFiles },
+    );
+
+/* --------------------------------------------------------------------------- Agents */
+
+/**
+ * Reserve an agent id.
+ *
+ * The agent schema requires a UUID on the way in -- validation runs before storage would
+ * assign one -- so a new agent needs an id before it can be saved. It is taken from the
+ * server rather than generated in the browser because `crypto.randomUUID` is only present
+ * in a secure context, and this has to work wherever the app is served from.
+ */
+export async function generateAgentId(): Promise<string> {
+    const response = await api.get<{ id?: string }>('/api/agents/generate_id');
+    return String(response?.id ?? '');
+}
+
+export async function fetchAgents(signal?: AbortSignal): Promise<WorkspaceAgent[]> {
+    const response = await api.get<unknown>('/api/user/agents', signal);
+    return asArray<WorkspaceAgent>(response, 'agents');
+}
+
+export const fetchAgent = (agentId: string, signal?: AbortSignal) =>
+    api.get<WorkspaceAgent>(`/api/user/agents/${encodeURIComponent(agentId)}`, signal);
+
+export const createAgent = (agent: Partial<WorkspaceAgent>) =>
+    api.post<WorkspaceAgent>('/api/user/agents', agent);
+
+export const updateAgent = (agentId: string, updates: Partial<WorkspaceAgent>) =>
+    api.patch<WorkspaceAgent>(`/api/user/agents/${encodeURIComponent(agentId)}`, updates);
+
+export const deleteAgent = (agentId: string) =>
+    api.delete<{ success?: boolean }>(`/api/user/agents/${encodeURIComponent(agentId)}`);
+
+/* -------------------------------------------------------------------------- Actions */
+
+export async function fetchActions(signal?: AbortSignal): Promise<WorkspaceAction[]> {
+    const response = await api.get<unknown>('/api/user/plugins', signal);
+    return asArray<WorkspaceAction>(response, 'plugins');
+}
+
+export const fetchAction = (actionId: string, signal?: AbortSignal) =>
+    api.get<WorkspaceAction>(`/api/user/plugins/${encodeURIComponent(actionId)}`, signal);
+
+export const deleteAction = (actionId: string) =>
+    api.delete<{ success?: boolean }>(`/api/user/plugins/${encodeURIComponent(actionId)}`);
+
+/* ------------------------------------------------------------------------ Workflows */
+
+export async function fetchWorkflows(signal?: AbortSignal): Promise<WorkspaceWorkflow[]> {
+    const response = await api.get<unknown>('/api/user/workflows', signal);
+    return asArray<WorkspaceWorkflow>(response, 'workflows');
+}
+
+export async function fetchWorkflowRuns(
+    workflowId: string,
+    signal?: AbortSignal,
+): Promise<WorkspaceWorkflowRun[]> {
+    const response = await api.get<unknown>(
+        `/api/user/workflows/${encodeURIComponent(workflowId)}/runs`,
+        signal,
+    );
+    return asArray<WorkspaceWorkflowRun>(response, 'runs');
+}
+
+export const startWorkflowRun = (workflowId: string) =>
+    api.post<WorkspaceWorkflowRun>(`/api/user/workflows/${encodeURIComponent(workflowId)}/run`);
+
+export const cancelWorkflow = (workflowId: string) =>
+    api.post<unknown>(`/api/user/workflows/${encodeURIComponent(workflowId)}/cancel`);
+
+export const deleteWorkflow = (workflowId: string) =>
+    api.delete<{ success?: boolean }>(`/api/user/workflows/${encodeURIComponent(workflowId)}`);
+
+/* ------------------------------------------------------------------------ Endpoints */
+
+export async function fetchModelEndpoints(
+    signal?: AbortSignal,
+): Promise<WorkspaceModelEndpoint[]> {
+    const response = await api.get<unknown>('/api/user/model-endpoints', signal);
+    return asArray<WorkspaceModelEndpoint>(response, 'endpoints');
+}
+
+/**
+ * Update one endpoint.
+ *
+ * Sent as a partial update rather than the whole endpoint, because the values that come
+ * back from the server have their secrets stripped. Posting that object back would blank
+ * the stored key; a PATCH carrying only what changed cannot.
+ */
+export async function updateModelEndpoint(
+    endpointId: string,
+    updates: Partial<WorkspaceModelEndpoint>,
+): Promise<WorkspaceModelEndpoint | null> {
+    const response = await api.patch<{ endpoint?: WorkspaceModelEndpoint }>(
+        `/api/user/model-endpoints/${encodeURIComponent(endpointId)}`,
+        updates,
+    );
+    return response?.endpoint ?? null;
+}
+
+export const deleteModelEndpoint = (endpointId: string) =>
+    api.delete<{ success?: boolean }>(
+        `/api/user/model-endpoints/${encodeURIComponent(endpointId)}`,
+    );
diff --git a/application/v2_ui/src/lib/workspaceSections.ts b/application/v2_ui/src/lib/workspaceSections.ts
new file mode 100644
index 000000000..7e45d3a01
--- /dev/null
+++ b/application/v2_ui/src/lib/workspaceSections.ts
@@ -0,0 +1,133 @@
+// workspaceSections.ts
+// Grouping and availability rules for the personal workspace.
+//
+// Deliberately free of React and of the section registry, which carries icons and
+// components: everything here is a plain function over plain data so the rules can be
+// exercised directly in a test without a renderer.
+//
+// The workspace is assembled from eight capabilities that an administrator can enable
+// independently, which is why a flat list of tabs reads as arbitrary. Grouping them by what
+// they are *for* gives the page a shape that survives any particular tenant's
+// configuration: knowledge is what the assistant can draw on, automation is what it can do,
+// and connections is the shared setup the other two reuse.
+
+import type { WorkspaceAvailability, WorkspaceSectionGroup } from './types';
+
+export interface WorkspaceGroupMeta {
+    id: WorkspaceSectionGroup;
+    label: string;
+    /** One line saying what the group is for. Shown on the overview and above the rail. */
+    blurb: string;
+}
+
+export const WORKSPACE_GROUPS: WorkspaceGroupMeta[] = [
+    {
+        id: 'knowledge',
+        label: 'Knowledge',
+        blurb: 'What your assistant can draw on.',
+    },
+    {
+        id: 'automation',
+        label: 'Automation',
+        blurb: 'What your assistant can do.',
+    },
+    {
+        id: 'connections',
+        label: 'Connections',
+        blurb: 'Shared setup the other sections reuse.',
+    },
+];
+
+export interface WorkspaceSectionDescriptor {
+    id: string;
+    group: WorkspaceSectionGroup;
+}
+
+export interface ResolvedWorkspaceSection<T extends WorkspaceSectionDescriptor> {
+    section: T;
+    enabled: boolean;
+    /** Why the section is unavailable, straight from the server. Null when enabled. */
+    reason: string | null;
+}
+
+export interface WorkspaceSectionGroupView<T extends WorkspaceSectionDescriptor> {
+    group: WorkspaceGroupMeta;
+    sections: ResolvedWorkspaceSection<T>[];
+}
+
+const MISSING_SECTION_REASON = 'This section is not available in this deployment.';
+
+/**
+ * Pair each known section with the server's verdict on it.
+ *
+ * A section the server does not mention is treated as unavailable rather than as available.
+ * The alternative fails open: a capability the server has stopped reporting would render a
+ * section whose endpoints refuse every request.
+ */
+export function resolveWorkspaceSections<T extends WorkspaceSectionDescriptor>(
+    descriptors: readonly T[],
+    availability: WorkspaceAvailability | null | undefined,
+): ResolvedWorkspaceSection<T>[] {
+    const sections = availability?.sections ?? {};
+    return descriptors.map((section) => {
+        const state = sections[section.id];
+        if (!state) {
+            return { section, enabled: false, reason: MISSING_SECTION_REASON };
+        }
+        return {
+            section,
+            enabled: Boolean(state.enabled),
+            reason: state.enabled ? null : (state.reason ?? MISSING_SECTION_REASON),
+        };
+    });
+}
+
+/**
+ * The sections that belong in the navigation rail.
+ *
+ * Only enabled ones. A disabled section is still described on the overview, where there is
+ * room to say *why* it is unavailable -- which is the part that stops people wondering
+ * whether a capability is missing, broken, or simply not switched on for them. A dead entry
+ * in the rail would carry no such explanation.
+ */
+export function navigableSections<T extends WorkspaceSectionDescriptor>(
+    resolved: readonly ResolvedWorkspaceSection<T>[],
+): ResolvedWorkspaceSection<T>[] {
+    return resolved.filter((entry) => entry.enabled);
+}
+
+/** Group sections for display, dropping groups that ended up with nothing in them. */
+export function groupWorkspaceSections<T extends WorkspaceSectionDescriptor>(
+    resolved: readonly ResolvedWorkspaceSection<T>[],
+): WorkspaceSectionGroupView<T>[] {
+    return WORKSPACE_GROUPS.map((group) => ({
+        group,
+        sections: resolved.filter((entry) => entry.section.group === group.id),
+    })).filter((view) => view.sections.length > 0);
+}
+
+/**
+ * Which section to show when none was asked for, or when the one asked for is unavailable.
+ *
+ * Returns null when nothing is enabled, which the page renders as an empty state rather
+ * than redirecting somewhere the user did not ask to go.
+ */
+export function defaultSectionId<T extends WorkspaceSectionDescriptor>(
+    resolved: readonly ResolvedWorkspaceSection<T>[],
+    requested?: string | null,
+): string | null {
+    if (requested) {
+        const match = resolved.find((entry) => entry.section.id === requested);
+        if (match?.enabled) {
+            return match.section.id;
+        }
+    }
+    return navigableSections(resolved)[0]?.section.id ?? null;
+}
+
+/** True when the user has at least one section available. */
+export function hasAnyWorkspaceSection<T extends WorkspaceSectionDescriptor>(
+    resolved: readonly ResolvedWorkspaceSection<T>[],
+): boolean {
+    return resolved.some((entry) => entry.enabled);
+}
diff --git a/application/v2_ui/src/pages/WorkspacePage.tsx b/application/v2_ui/src/pages/WorkspacePage.tsx
deleted file mode 100644
index 441543231..000000000
--- a/application/v2_ui/src/pages/WorkspacePage.tsx
+++ /dev/null
@@ -1,299 +0,0 @@
-// WorkspacePage.tsx
-// Personal workspace documents: list, search, tag filter, upload and delete.
-
-import { useEffect, useMemo, useRef, useState } from 'react';
-import { clsx } from 'clsx';
-import { FileText, Loader2, Search, Trash2, Upload } from 'lucide-react';
-import {
-    deletePersonalDocument,
-    fetchPersonalDocumentTags,
-    fetchPersonalDocuments,
-    uploadDocument,
-} from '../lib/endpoints';
-import { PageHeader } from '../components/layout/PageHeader';
-import { EmptyState, GlassButton, GlassPanel, Skeleton } from '../components/ui/primitives';
-import type { WorkspaceDocument, WorkspaceTag } from '../lib/types';
-
-/**
- * Reduce a tag of any shape to its name.
- *
- * Tags arrive in more than one form: /api/documents/tags returns
- * `{name, count, color}` objects, while a document's own `tags` field may be an array of
- * strings or a comma-separated string. Rendering an object directly is what caused React
- * error #31 on this page, so every tag is funnelled through here.
- */
-function tagName(tag: unknown): string {
-    if (typeof tag === 'string') {
-        return tag.trim();
-    }
-    if (tag && typeof tag === 'object' && 'name' in tag) {
-        return String((tag as { name: unknown }).name ?? '').trim();
-    }
-    return '';
-}
-
-function normalizeTags(tags: unknown): string[] {
-    if (Array.isArray(tags)) {
-        return tags.map(tagName).filter(Boolean);
-    }
-    if (typeof tags === 'string' && tags.trim()) {
-        return tags.split(',').map((tag) => tag.trim()).filter(Boolean);
-    }
-    return [];
-}
-
-function ProcessingBadge({ document }: { document: WorkspaceDocument }) {
-    const percent = Number(document.percentage_complete ?? 100);
-    const complete = Number.isFinite(percent) ? percent >= 100 : true;
-
-    if (complete) {
-        return (
-            <span className="rounded-full bg-ok-soft px-2 py-0.5 text-[11px] font-medium text-ok">
-                Ready
-            </span>
-        );
-    }
-
-    return (
-        <span className="flex items-center gap-1 rounded-full bg-warn-soft px-2 py-0.5 text-[11px] font-medium text-warn">
-            <Loader2 size={10} className="animate-spin" />
-            {Math.round(percent)}%
-        </span>
-    );
-}
-
-export function WorkspacePage() {
-    const [documents, setDocuments] = useState<WorkspaceDocument[]>([]);
-    const [tags, setTags] = useState<WorkspaceTag[]>([]);
-    const [loading, setLoading] = useState(true);
-    const [error, setError] = useState<string | null>(null);
-    const [query, setQuery] = useState('');
-    const [activeTag, setActiveTag] = useState<string | null>(null);
-    const [uploading, setUploading] = useState(false);
-
-    const fileInputRef = useRef<HTMLInputElement>(null);
-
-    const load = async () => {
-        setLoading(true);
-        setError(null);
-        try {
-            const [documentsResponse, tagsResponse] = await Promise.all([
-                fetchPersonalDocuments(),
-                fetchPersonalDocumentTags().catch(() => ({ tags: [] })),
-            ]);
-            // The endpoint has used both `documents` and `items` as its collection key.
-            setDocuments(documentsResponse.documents ?? documentsResponse.items ?? []);
-            setTags(tagsResponse.tags ?? []);
-        } catch (loadError) {
-            setError(
-                loadError instanceof Error ? loadError.message : 'Failed to load documents.',
-            );
-        } finally {
-            setLoading(false);
-        }
-    };
-
-    useEffect(() => {
-        void load();
-    }, []);
-
-    const visible = useMemo(() => {
-        const needle = query.trim().toLowerCase();
-        return documents.filter((document) => {
-            const name = String(document.file_name ?? document.title ?? '').toLowerCase();
-            if (needle && !name.includes(needle)) {
-                return false;
-            }
-            if (activeTag && !normalizeTags(document.tags).includes(activeTag)) {
-                return false;
-            }
-            return true;
-        });
-    }, [documents, query, activeTag]);
-
-    const onSelectFile = async (event: React.ChangeEvent<HTMLInputElement>) => {
-        const file = event.target.files?.[0];
-        if (!file) {
-            return;
-        }
-        setUploading(true);
-        try {
-            await uploadDocument(file, null);
-            await load();
-        } catch (uploadError) {
-            setError(
-                uploadError instanceof Error
-                    ? uploadError.message
-                    : `Could not upload ${file.name}.`,
-            );
-        } finally {
-            setUploading(false);
-            event.target.value = '';
-        }
-    };
-
-    const onDelete = async (document: WorkspaceDocument) => {
-        const id = String(document.id ?? document.document_id ?? '');
-        if (!id) {
-            return;
-        }
-        const previous = documents;
-        setDocuments(documents.filter((item) => (item.id ?? item.document_id) !== id));
-        try {
-            await deletePersonalDocument(id);
-        } catch (deleteError) {
-            setDocuments(previous);
-            setError(
-                deleteError instanceof Error ? deleteError.message : 'Could not delete document.',
-            );
-        }
-    };
-
-    return (
-        <>
-            <PageHeader
-                title="My workspace"
-                description="Private documents available for grounded chat"
-                actions={
-                    <>
-                        <input
-                            ref={fileInputRef}
-                            type="file"
-                            className="hidden"
-                            onChange={onSelectFile}
-                        />
-                        <GlassButton
-                            variant="primary"
-                            size="sm"
-                            disabled={uploading}
-                            onClick={() => fileInputRef.current?.click()}
-                        >
-                            {uploading ? (
-                                <Loader2 size={14} className="animate-spin" />
-                            ) : (
-                                <Upload size={14} />
-                            )}
-                            Upload
-                        </GlassButton>
-                    </>
-                }
-            />
-
-            <div className="min-h-0 flex-1 overflow-y-auto p-4">
-                <div className="mx-auto max-w-4xl space-y-4">
-                    <div className="flex flex-wrap items-center gap-2">
-                        <div className="relative min-w-[16rem] flex-1">
-                            <Search
-                                size={15}
-                                className="pointer-events-none absolute top-1/2 left-3 -translate-y-1/2 text-text-3"
-                            />
-                            <input
-                                type="search"
-                                value={query}
-                                onChange={(event) => setQuery(event.target.value)}
-                                placeholder="Search documents"
-                                aria-label="Search documents"
-                                className="w-full rounded-xl border border-edge bg-surface-1 py-2 pr-3 pl-9 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
-                            />
-                        </div>
-
-                        {tags.slice(0, 8).map((tag) => {
-                            const name = tagName(tag);
-                            if (!name) {
-                                return null;
-                            }
-                            return (
-                                <button
-                                    key={name}
-                                    type="button"
-                                    onClick={() => setActiveTag(activeTag === name ? null : name)}
-                                    className={clsx(
-                                        'rounded-full border px-2.5 py-1 text-xs transition-colors',
-                                        activeTag === name
-                                            ? 'border-transparent bg-accent-soft text-accent'
-                                            : 'border-edge bg-surface-1 text-text-2 hover:bg-surface-2',
-                                    )}
-                                >
-                                    {name}
-                                    {typeof tag === 'object' && tag.count ? (
-                                        <span className="ml-1 opacity-60">{tag.count}</span>
-                                    ) : null}
-                                </button>
-                            );
-                        })}
-                    </div>
-
-                    {error && (
-                        <GlassPanel elevation="flat" className="p-3 text-sm text-danger">
-                            {error}
-                        </GlassPanel>
-                    )}
-
-                    {loading && (
-                        <div className="space-y-2">
-                            {Array.from({ length: 5 }).map((_, index) => (
-                                <Skeleton key={index} className="h-14 w-full" />
-                            ))}
-                        </div>
-                    )}
-
-                    {!loading && visible.length === 0 && !error && (
-                        <EmptyState
-                            icon={<FileText size={28} />}
-                            title={
-                                documents.length === 0
-                                    ? 'No documents yet'
-                                    : 'No documents match your filters'
-                            }
-                            description={
-                                documents.length === 0
-                                    ? 'Upload a file to make it available for grounded chat.'
-                                    : undefined
-                            }
-                        />
-                    )}
-
-                    <ul className="space-y-2">
-                        {visible.map((document) => {
-                            const id = String(document.id ?? document.document_id ?? '');
-                            const documentTags = normalizeTags(document.tags);
-                            return (
-                                <li key={id}>
-                                    <GlassPanel
-                                        elevation="flat"
-                                        className="flex items-center gap-3 p-3"
-                                    >
-                                        <FileText size={17} className="shrink-0 text-text-3" />
-                                        <div className="min-w-0 flex-1">
-                                            <p className="truncate text-sm text-text-1">
-                                                {String(
-                                                    document.file_name ??
-                                                        document.title ??
-                                                        'Untitled',
-                                                )}
-                                            </p>
-                                            {documentTags.length > 0 && (
-                                                <p className="mt-0.5 truncate text-xs text-text-3">
-                                                    {documentTags.join(' · ')}
-                                                </p>
-                                            )}
-                                        </div>
-                                        <ProcessingBadge document={document} />
-                                        <button
-                                            type="button"
-                                            onClick={() => void onDelete(document)}
-                                            aria-label={`Delete ${document.file_name ?? 'document'}`}
-                                            className="shrink-0 rounded-lg p-1.5 text-text-3 transition-colors hover:bg-danger-soft hover:text-danger"
-                                        >
-                                            <Trash2 size={15} />
-                                        </button>
-                                    </GlassPanel>
-                                </li>
-                            );
-                        })}
-                    </ul>
-                </div>
-            </div>
-        </>
-    );
-}
diff --git a/application/v2_ui/src/pages/workspace/ActionsSection.tsx b/application/v2_ui/src/pages/workspace/ActionsSection.tsx
new file mode 100644
index 000000000..6c845ce5b
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/ActionsSection.tsx
@@ -0,0 +1,153 @@
+// ActionsSection.tsx
+// Personal actions: the tools an agent is allowed to call.
+//
+// Listing and removal only. Each connector type has its own configuration -- endpoints,
+// credentials, query templates -- and there are more than twenty of them, so authoring
+// stays in the classic interface for now rather than being half-represented here.
+
+import { useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { Plug, Shield, Trash2 } from 'lucide-react';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import { deleteAction, fetchActions } from '../../lib/workspaceApi';
+import type { WorkspaceAction } from '../../lib/types';
+
+/** Render a connector type as something readable: `document_search` -> `Document search`. */
+export function actionTypeLabel(type: unknown): string {
+    const raw = String(type ?? '').trim();
+    if (!raw) {
+        return 'Unknown';
+    }
+    const spaced = raw.replace(/[_-]+/g, ' ');
+    return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+export function ActionsSection({ agentsEnabled }: { agentsEnabled: boolean }) {
+    const { items, loading, error, setItems, setError } = useSectionResource<WorkspaceAction>(
+        fetchActions,
+        'Failed to load actions.',
+    );
+
+    const [query, setQuery] = useState('');
+    const [busyId, setBusyId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((action) =>
+            `${action.displayName ?? ''} ${action.name ?? ''} ${action.type ?? ''}`
+                .toLowerCase()
+                .includes(needle),
+        );
+    }, [items, query]);
+
+    const onDelete = async (action: WorkspaceAction) => {
+        const previous = items;
+        const identifier = action.id || String(action.name ?? '');
+        setBusyId(identifier);
+        setItems(items.filter((item) => (item.id || item.name) !== (action.id || action.name)));
+        try {
+            await deleteAction(identifier);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the action.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Actions"
+                description="Tools an agent may call on your behalf, such as an API, a database or an MCP server. An action does nothing until an agent is given permission to use it."
+            />
+
+            <p className="text-xs text-text-3">
+                Adding and configuring actions is still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .{' '}
+                {agentsEnabled ? (
+                    <>
+                        Attach them to an{' '}
+                        <Link to="/workspace/agents" className="text-accent hover:underline">
+                            agent
+                        </Link>{' '}
+                        to put them to use.
+                    </>
+                ) : null}
+            </p>
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search actions" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<Plug size={28} />}
+                emptyTitle={
+                    items.length === 0 ? 'No actions yet' : 'No actions match your search'
+                }
+                emptyDescription={
+                    items.length === 0
+                        ? 'Actions let an agent reach a system outside this chat.'
+                        : undefined
+                }
+                getKey={(action, index) => String(action.id ?? action.name ?? index)}
+                renderItem={(action) => {
+                    const managed = Boolean(action.is_global);
+                    const identifier = action.id || String(action.name ?? '');
+                    return (
+                        <ResourceRow
+                            icon={<Plug size={17} />}
+                            title={String(action.displayName || action.name || 'Untitled action')}
+                            subtitle={
+                                String(action.description || '') ||
+                                String(action.endpoint || '')
+                            }
+                            meta={
+                                <>
+                                    <Pill>{actionTypeLabel(action.type)}</Pill>
+                                    {managed ? (
+                                        <Pill tone="accent">
+                                            <span className="flex items-center gap-1">
+                                                <Shield size={10} />
+                                                Provided
+                                            </span>
+                                        </Pill>
+                                    ) : null}
+                                </>
+                            }
+                            actions={
+                                managed ? undefined : (
+                                    <ConfirmAction
+                                        icon={<Trash2 size={15} />}
+                                        label={`Delete ${action.displayName ?? action.name ?? 'action'}`}
+                                        confirmLabel="Delete"
+                                        busy={busyId === identifier}
+                                        onConfirm={() => void onDelete(action)}
+                                    />
+                                )
+                            }
+                        />
+                    );
+                }}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/AgentsSection.tsx b/application/v2_ui/src/pages/workspace/AgentsSection.tsx
new file mode 100644
index 000000000..0911cd0fd
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/AgentsSection.tsx
@@ -0,0 +1,347 @@
+// AgentsSection.tsx
+// Personal agents: list, create, edit and delete.
+//
+// The editor covers identity and instructions. Binding a model, attaching actions and
+// assigning knowledge are not here yet and are still done in the classic interface; the
+// section says so rather than offering controls that do nothing.
+
+import { useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { Pencil, Plus, Shield, Sparkles, Trash2 } from 'lucide-react';
+import { GlassButton, GlassPanel } from '../../components/ui/primitives';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    RowAction,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import {
+    createAgent,
+    deleteAgent,
+    fetchAgents,
+    generateAgentId,
+    updateAgent,
+} from '../../lib/workspaceApi';
+import type { WorkspaceAgent } from '../../lib/types';
+
+interface DraftAgent {
+    id: string | null;
+    displayName: string;
+    description: string;
+    instructions: string;
+}
+
+const EMPTY_DRAFT: DraftAgent = {
+    id: null,
+    displayName: '',
+    description: '',
+    instructions: '',
+};
+
+/**
+ * Derive the stored `name` from what the user typed.
+ *
+ * The agent schema constrains `name` to letters, digits, underscore and dash, while the
+ * display name is free text. Rather than ask for both, the machine-readable one is derived
+ * and only the display name is edited.
+ */
+export function agentNameFromDisplayName(displayName: string): string {
+    const slug = displayName
+        .trim()
+        .replace(/[^A-Za-z0-9_-]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug || 'agent';
+}
+
+function AgentEditor({
+    draft,
+    saving,
+    onChange,
+    onSave,
+    onCancel,
+}: {
+    draft: DraftAgent;
+    saving: boolean;
+    onChange: (next: DraftAgent) => void;
+    onSave: () => void;
+    onCancel: () => void;
+}) {
+    const canSave = draft.displayName.trim().length > 0;
+
+    return (
+        <GlassPanel elevation="flat" className="space-y-3 p-4">
+            <div>
+                <label
+                    htmlFor="agent-display-name"
+                    className="mb-1 block text-xs font-medium text-text-2"
+                >
+                    Name
+                </label>
+                <input
+                    id="agent-display-name"
+                    type="text"
+                    value={draft.displayName}
+                    onChange={(event) =>
+                        onChange({ ...draft, displayName: event.target.value })
+                    }
+                    placeholder="Contract reviewer"
+                    className="w-full rounded-xl border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+                />
+                {draft.id === null && draft.displayName.trim() ? (
+                    <p className="mt-1 text-[11px] text-text-3">
+                        Stored as{' '}
+                        <code className="text-text-2">
+                            {agentNameFromDisplayName(draft.displayName)}
+                        </code>
+                    </p>
+                ) : null}
+            </div>
+
+            <div>
+                <label
+                    htmlFor="agent-description"
+                    className="mb-1 block text-xs font-medium text-text-2"
+                >
+                    Description
+                </label>
+                <input
+                    id="agent-description"
+                    type="text"
+                    value={draft.description}
+                    onChange={(event) =>
+                        onChange({ ...draft, description: event.target.value })
+                    }
+                    placeholder="Reviews contracts against our standard terms."
+                    className="w-full rounded-xl border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+                />
+            </div>
+
+            <div>
+                <label
+                    htmlFor="agent-instructions"
+                    className="mb-1 block text-xs font-medium text-text-2"
+                >
+                    Instructions
+                </label>
+                <textarea
+                    id="agent-instructions"
+                    rows={6}
+                    value={draft.instructions}
+                    onChange={(event) =>
+                        onChange({ ...draft, instructions: event.target.value })
+                    }
+                    placeholder="You are a careful contract reviewer. Quote the clause you are referring to before commenting on it."
+                    className="w-full resize-y rounded-xl border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+                />
+            </div>
+
+            <div className="flex justify-end gap-2">
+                <GlassButton size="sm" onClick={onCancel} disabled={saving}>
+                    Cancel
+                </GlassButton>
+                <GlassButton
+                    variant="primary"
+                    size="sm"
+                    onClick={onSave}
+                    disabled={!canSave || saving}
+                >
+                    {saving ? 'Saving' : draft.id ? 'Save changes' : 'Create agent'}
+                </GlassButton>
+            </div>
+        </GlassPanel>
+    );
+}
+
+export function AgentsSection({ actionsEnabled }: { actionsEnabled: boolean }) {
+    const { items, loading, error, refresh, setItems, setError } =
+        useSectionResource<WorkspaceAgent>(fetchAgents, 'Failed to load agents.');
+
+    const [query, setQuery] = useState('');
+    const [draft, setDraft] = useState<DraftAgent | null>(null);
+    const [saving, setSaving] = useState(false);
+    const [busyId, setBusyId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((agent) =>
+            `${agent.display_name ?? ''} ${agent.name ?? ''}`.toLowerCase().includes(needle),
+        );
+    }, [items, query]);
+
+    const onSave = async () => {
+        if (!draft) {
+            return;
+        }
+        setSaving(true);
+        setError(null);
+        try {
+            if (draft.id) {
+                await updateAgent(draft.id, {
+                    display_name: draft.displayName.trim(),
+                    description: draft.description,
+                    instructions: draft.instructions,
+                });
+            } else {
+                const id = await generateAgentId();
+                // Every one of these is required by the agent schema, which is checked
+                // before the record is stored, so a partial object is rejected outright.
+                await createAgent({
+                    id,
+                    name: agentNameFromDisplayName(draft.displayName),
+                    display_name: draft.displayName.trim(),
+                    description: draft.description,
+                    instructions: draft.instructions,
+                    is_global: false,
+                    is_group: false,
+                    actions_to_load: [],
+                    other_settings: {},
+                    max_completion_tokens: -1,
+                    agent_type: 'local',
+                });
+            }
+            setDraft(null);
+            await refresh();
+        } catch (saveError) {
+            setError(errorMessage(saveError, 'Could not save the agent.'));
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    const onDelete = async (agent: WorkspaceAgent) => {
+        const previous = items;
+        setBusyId(agent.id);
+        setItems(items.filter((item) => item.id !== agent.id));
+        try {
+            await deleteAgent(agent.id);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the agent.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Agents"
+                description="Assistants you configure once and reuse: an instruction set, and in time the knowledge and actions it is allowed to use. Agents you build here appear in the chat agent picker."
+                actions={
+                    <GlassButton
+                        variant="primary"
+                        size="sm"
+                        onClick={() => setDraft({ ...EMPTY_DRAFT })}
+                        disabled={Boolean(draft)}
+                    >
+                        <Plus size={14} />
+                        New agent
+                    </GlassButton>
+                }
+            />
+
+            <p className="text-xs text-text-3">
+                Binding a model, attaching{' '}
+                {actionsEnabled ? (
+                    <Link to="/workspace/actions" className="text-accent hover:underline">
+                        actions
+                    </Link>
+                ) : (
+                    'actions'
+                )}{' '}
+                and assigning knowledge are still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .
+            </p>
+
+            {draft ? (
+                <AgentEditor
+                    draft={draft}
+                    saving={saving}
+                    onChange={setDraft}
+                    onSave={() => void onSave()}
+                    onCancel={() => setDraft(null)}
+                />
+            ) : null}
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search agents" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<Sparkles size={28} />}
+                emptyTitle={items.length === 0 ? 'No agents yet' : 'No agents match your search'}
+                emptyDescription={
+                    items.length === 0
+                        ? 'Create an agent to reuse a set of instructions across conversations.'
+                        : undefined
+                }
+                getKey={(agent, index) => String(agent.id ?? agent.name ?? index)}
+                renderItem={(agent) => {
+                    // Administrator-supplied agents are listed because they are selectable in
+                    // chat, but they are not this user's to change.
+                    const managed = Boolean(agent.is_global);
+                    return (
+                        <ResourceRow
+                            icon={<Sparkles size={17} />}
+                            title={String(agent.display_name || agent.name || 'Untitled agent')}
+                            subtitle={String(agent.description || agent.name || '')}
+                            meta={
+                                managed ? (
+                                    <Pill tone="accent">
+                                        <span className="flex items-center gap-1">
+                                            <Shield size={10} />
+                                            Provided
+                                        </span>
+                                    </Pill>
+                                ) : undefined
+                            }
+                            actions={
+                                managed ? undefined : (
+                                    <>
+                                        <RowAction
+                                            icon={<Pencil size={15} />}
+                                            label={`Edit ${agent.display_name ?? agent.name ?? 'agent'}`}
+                                            onClick={() =>
+                                                setDraft({
+                                                    id: agent.id,
+                                                    displayName: String(
+                                                        agent.display_name || agent.name || '',
+                                                    ),
+                                                    description: String(agent.description ?? ''),
+                                                    instructions: String(
+                                                        agent.instructions ?? '',
+                                                    ),
+                                                })
+                                            }
+                                        />
+                                        <ConfirmAction
+                                            icon={<Trash2 size={15} />}
+                                            label={`Delete ${agent.display_name ?? agent.name ?? 'agent'}`}
+                                            confirmLabel="Delete"
+                                            busy={busyId === agent.id}
+                                            onConfirm={() => void onDelete(agent)}
+                                        />
+                                    </>
+                                )
+                            }
+                        />
+                    );
+                }}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/DocumentsSection.tsx b/application/v2_ui/src/pages/workspace/DocumentsSection.tsx
new file mode 100644
index 000000000..4487adf18
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/DocumentsSection.tsx
@@ -0,0 +1,283 @@
+// DocumentsSection.tsx
+// Personal documents: list, search, tag filter, upload and delete.
+//
+// Carried over from the single-purpose workspace page this section replaced. The behaviour
+// is unchanged; only its surroundings are.
+
+import { useEffect, useMemo, useRef, useState } from 'react';
+import { clsx } from 'clsx';
+import { FileText, FolderSync, Loader2, Trash2, Upload } from 'lucide-react';
+import { Link } from 'react-router-dom';
+import {
+    deletePersonalDocument,
+    fetchPersonalDocumentTags,
+    fetchPersonalDocuments,
+    uploadDocument,
+} from '../../lib/endpoints';
+import { GlassButton } from '../../components/ui/primitives';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import { errorMessage } from '../../components/workspace/useSectionResource';
+import type { WorkspaceDocument, WorkspaceTag } from '../../lib/types';
+
+/**
+ * Reduce a tag of any shape to its name.
+ *
+ * Tags arrive in more than one form: /api/documents/tags returns `{name, count, color}`
+ * objects, while a document's own `tags` field may be an array of strings or a
+ * comma-separated string. Rendering an object directly is what caused React error #31 on
+ * this page, so every tag is funnelled through here.
+ */
+function tagName(tag: unknown): string {
+    if (typeof tag === 'string') {
+        return tag.trim();
+    }
+    if (tag && typeof tag === 'object' && 'name' in tag) {
+        return String((tag as { name: unknown }).name ?? '').trim();
+    }
+    return '';
+}
+
+function normalizeTags(tags: unknown): string[] {
+    if (Array.isArray(tags)) {
+        return tags.map(tagName).filter(Boolean);
+    }
+    if (typeof tags === 'string' && tags.trim()) {
+        return tags.split(',').map((tag) => tag.trim()).filter(Boolean);
+    }
+    return [];
+}
+
+function ProcessingBadge({ document }: { document: WorkspaceDocument }) {
+    const percent = Number(document.percentage_complete ?? 100);
+    const complete = Number.isFinite(percent) ? percent >= 100 : true;
+
+    if (complete) {
+        return <Pill tone="ok">Ready</Pill>;
+    }
+
+    return (
+        <span className="flex items-center gap-1 rounded-full bg-warn-soft px-2 py-0.5 text-[11px] font-medium text-warn">
+            <Loader2 size={10} className="animate-spin" />
+            {Math.round(percent)}%
+        </span>
+    );
+}
+
+export function DocumentsSection({ syncEnabled }: { syncEnabled: boolean }) {
+    const [documents, setDocuments] = useState<WorkspaceDocument[]>([]);
+    const [tags, setTags] = useState<WorkspaceTag[]>([]);
+    const [loading, setLoading] = useState(true);
+    const [error, setError] = useState<string | null>(null);
+    const [query, setQuery] = useState('');
+    const [activeTag, setActiveTag] = useState<string | null>(null);
+    const [uploading, setUploading] = useState(false);
+    const [deletingId, setDeletingId] = useState<string | null>(null);
+
+    const fileInputRef = useRef<HTMLInputElement>(null);
+
+    const load = async () => {
+        setLoading(true);
+        setError(null);
+        try {
+            const [documentsResponse, tagsResponse] = await Promise.all([
+                fetchPersonalDocuments(),
+                fetchPersonalDocumentTags().catch(() => ({ tags: [] })),
+            ]);
+            // The endpoint has used both `documents` and `items` as its collection key.
+            setDocuments(documentsResponse.documents ?? documentsResponse.items ?? []);
+            setTags(tagsResponse.tags ?? []);
+        } catch (loadError) {
+            setError(errorMessage(loadError, 'Failed to load documents.'));
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    useEffect(() => {
+        void load();
+    }, []);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        return documents.filter((document) => {
+            const name = String(document.file_name ?? document.title ?? '').toLowerCase();
+            if (needle && !name.includes(needle)) {
+                return false;
+            }
+            if (activeTag && !normalizeTags(document.tags).includes(activeTag)) {
+                return false;
+            }
+            return true;
+        });
+    }, [documents, query, activeTag]);
+
+    const onSelectFile = async (event: React.ChangeEvent<HTMLInputElement>) => {
+        const file = event.target.files?.[0];
+        if (!file) {
+            return;
+        }
+        setUploading(true);
+        try {
+            await uploadDocument(file, null);
+            await load();
+        } catch (uploadError) {
+            setError(errorMessage(uploadError, `Could not upload ${file.name}.`));
+        } finally {
+            setUploading(false);
+            event.target.value = '';
+        }
+    };
+
+    const onDelete = async (document: WorkspaceDocument) => {
+        const id = String(document.id ?? document.document_id ?? '');
+        if (!id) {
+            return;
+        }
+        const previous = documents;
+        setDeletingId(id);
+        setDocuments(documents.filter((item) => (item.id ?? item.document_id) !== id));
+        try {
+            await deletePersonalDocument(id);
+        } catch (deleteError) {
+            setDocuments(previous);
+            setError(errorMessage(deleteError, 'Could not delete document.'));
+        } finally {
+            setDeletingId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Documents"
+                description="Files you upload here are indexed and can be cited in chat. Everything in this section is private to you."
+                actions={
+                    <>
+                        <input
+                            ref={fileInputRef}
+                            type="file"
+                            className="hidden"
+                            onChange={onSelectFile}
+                        />
+                        <GlassButton
+                            variant="primary"
+                            size="sm"
+                            disabled={uploading}
+                            onClick={() => fileInputRef.current?.click()}
+                        >
+                            {uploading ? (
+                                <Loader2 size={14} className="animate-spin" />
+                            ) : (
+                                <Upload size={14} />
+                            )}
+                            Upload
+                        </GlassButton>
+                    </>
+                }
+            />
+
+            {syncEnabled ? (
+                <p className="text-xs text-text-3">
+                    Documents can also arrive automatically from a{' '}
+                    <Link to="/workspace/sync" className="text-accent hover:underline">
+                        file source
+                    </Link>
+                    .
+                </p>
+            ) : null}
+
+            <div className="flex flex-wrap items-center gap-2">
+                <div className="min-w-[16rem] flex-1">
+                    <SectionSearch
+                        value={query}
+                        onChange={setQuery}
+                        placeholder="Search documents"
+                    />
+                </div>
+
+                {tags.slice(0, 8).map((tag) => {
+                    const name = tagName(tag);
+                    if (!name) {
+                        return null;
+                    }
+                    return (
+                        <button
+                            key={name}
+                            type="button"
+                            onClick={() => setActiveTag(activeTag === name ? null : name)}
+                            className={clsx(
+                                'rounded-full border px-2.5 py-1 text-xs transition-colors',
+                                activeTag === name
+                                    ? 'border-transparent bg-accent-soft text-accent'
+                                    : 'border-edge bg-surface-1 text-text-2 hover:bg-surface-2',
+                            )}
+                        >
+                            {name}
+                            {typeof tag === 'object' && tag.count ? (
+                                <span className="ml-1 opacity-60">{tag.count}</span>
+                            ) : null}
+                        </button>
+                    );
+                })}
+            </div>
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<FileText size={28} />}
+                emptyTitle={
+                    documents.length === 0
+                        ? 'No documents yet'
+                        : 'No documents match your filters'
+                }
+                emptyDescription={
+                    documents.length === 0
+                        ? 'Upload a file to make it available for grounded chat.'
+                        : undefined
+                }
+                getKey={(document, index) =>
+                    String(document.id ?? document.document_id ?? index)
+                }
+                renderItem={(document) => {
+                    const id = String(document.id ?? document.document_id ?? '');
+                    const documentTags = normalizeTags(document.tags);
+                    return (
+                        <ResourceRow
+                            icon={<FileText size={17} />}
+                            title={String(document.file_name ?? document.title ?? 'Untitled')}
+                            subtitle={
+                                documentTags.length > 0 ? documentTags.join(' · ') : undefined
+                            }
+                            meta={<ProcessingBadge document={document} />}
+                            actions={
+                                <ConfirmAction
+                                    icon={<Trash2 size={15} />}
+                                    label={`Delete ${document.file_name ?? 'document'}`}
+                                    confirmLabel="Delete"
+                                    busy={deletingId === id}
+                                    onConfirm={() => void onDelete(document)}
+                                />
+                            }
+                        />
+                    );
+                }}
+            />
+
+            {syncEnabled ? null : (
+                <p className="flex items-center gap-1.5 text-xs text-text-3">
+                    <FolderSync size={13} />
+                    File sync is not enabled for your account, so documents can only be added
+                    by uploading them.
+                </p>
+            )}
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/EndpointsSection.tsx b/application/v2_ui/src/pages/workspace/EndpointsSection.tsx
new file mode 100644
index 000000000..3f3b96d9d
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/EndpointsSection.tsx
@@ -0,0 +1,172 @@
+// EndpointsSection.tsx
+// Personal model endpoints: list, enable or disable, and delete.
+//
+// The connection editor -- provider, API versions, authentication and the model list --
+// stays in the classic interface. What is here is the part that is safe to change without
+// a form: whether an endpoint is in play, and whether it should exist at all.
+
+import { useMemo, useState } from 'react';
+import { Power, Server, Trash2 } from 'lucide-react';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    RowAction,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import {
+    deleteModelEndpoint,
+    fetchModelEndpoints,
+    updateModelEndpoint,
+} from '../../lib/workspaceApi';
+import type { WorkspaceModelEndpoint } from '../../lib/types';
+
+const PROVIDER_LABELS: Record<string, string> = {
+    aoai: 'Azure OpenAI',
+    aifoundry: 'AI Foundry',
+    new_foundry: 'Foundry',
+};
+
+export function providerLabel(provider: unknown): string {
+    const raw = String(provider ?? '').trim();
+    return PROVIDER_LABELS[raw] ?? (raw || 'Endpoint');
+}
+
+export function EndpointsSection() {
+    const { items, loading, error, setItems, setError } =
+        useSectionResource<WorkspaceModelEndpoint>(
+            fetchModelEndpoints,
+            'Failed to load model endpoints.',
+        );
+
+    const [query, setQuery] = useState('');
+    const [busyId, setBusyId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((endpoint) =>
+            `${endpoint.name ?? ''} ${endpoint.provider ?? ''}`.toLowerCase().includes(needle),
+        );
+    }, [items, query]);
+
+    const onToggle = async (endpoint: WorkspaceModelEndpoint) => {
+        const previous = items;
+        const next = !endpoint.enabled;
+        setBusyId(endpoint.id);
+        setItems(
+            items.map((item) =>
+                item.id === endpoint.id ? { ...item, enabled: next } : item,
+            ),
+        );
+        try {
+            // A partial update, so the stripped secrets in the copy this page holds are
+            // never sent back and cannot overwrite what is stored.
+            await updateModelEndpoint(endpoint.id, { enabled: next });
+        } catch (toggleError) {
+            setItems(previous);
+            setError(errorMessage(toggleError, 'Could not update the endpoint.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    const onDelete = async (endpoint: WorkspaceModelEndpoint) => {
+        const previous = items;
+        setBusyId(endpoint.id);
+        setItems(items.filter((item) => item.id !== endpoint.id));
+        try {
+            await deleteModelEndpoint(endpoint.id);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the endpoint.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Endpoints"
+                description="Model endpoints of your own, used alongside the ones your administrator provides. Agents and workflows can be pointed at these."
+            />
+
+            <p className="text-xs text-text-3">
+                Adding an endpoint and editing its connection details are still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .
+            </p>
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search endpoints" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<Server size={28} />}
+                emptyTitle={
+                    items.length === 0 ? 'No endpoints yet' : 'No endpoints match your search'
+                }
+                emptyDescription={
+                    items.length === 0
+                        ? 'Add an endpoint to use a model your administrator has not published.'
+                        : undefined
+                }
+                getKey={(endpoint, index) => String(endpoint.id ?? index)}
+                renderItem={(endpoint) => {
+                    const modelCount = Array.isArray(endpoint.models)
+                        ? endpoint.models.length
+                        : 0;
+                    return (
+                        <ResourceRow
+                            icon={<Server size={17} />}
+                            title={String(endpoint.name ?? 'Untitled endpoint')}
+                            subtitle={`${providerLabel(endpoint.provider)}${
+                                modelCount
+                                    ? ` · ${modelCount} model${modelCount === 1 ? '' : 's'}`
+                                    : ''
+                            }`}
+                            meta={
+                                <Pill tone={endpoint.enabled ? 'ok' : 'neutral'}>
+                                    {endpoint.enabled ? 'Enabled' : 'Disabled'}
+                                </Pill>
+                            }
+                            actions={
+                                <>
+                                    <RowAction
+                                        icon={<Power size={15} />}
+                                        label={
+                                            endpoint.enabled
+                                                ? `Disable ${endpoint.name ?? 'endpoint'}`
+                                                : `Enable ${endpoint.name ?? 'endpoint'}`
+                                        }
+                                        busy={busyId === endpoint.id}
+                                        onClick={() => void onToggle(endpoint)}
+                                    />
+                                    <ConfirmAction
+                                        icon={<Trash2 size={15} />}
+                                        label={`Delete ${endpoint.name ?? 'endpoint'}`}
+                                        confirmLabel="Delete"
+                                        busy={busyId === endpoint.id}
+                                        onConfirm={() => void onDelete(endpoint)}
+                                    />
+                                </>
+                            }
+                        />
+                    );
+                }}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/FileSourcesSection.tsx b/application/v2_ui/src/pages/workspace/FileSourcesSection.tsx
new file mode 100644
index 000000000..7127a18a0
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/FileSourcesSection.tsx
@@ -0,0 +1,231 @@
+// FileSourcesSection.tsx
+// External file sources that feed the documents section.
+//
+// Called "Sync" in the classic interface, which describes the mechanism rather than the
+// purpose. What a user is doing here is pointing the workspace at somewhere their files
+// already live, so the section is named for that and says where the files end up.
+
+import { useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { ChevronDown, ChevronRight, FolderSync, Play, Trash2 } from 'lucide-react';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    RowAction,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import {
+    deleteSyncSource,
+    fetchSyncRuns,
+    fetchSyncSources,
+    startSyncRun,
+} from '../../lib/workspaceApi';
+import { statusTone } from './WorkflowsSection';
+import type { WorkspaceSyncRun, WorkspaceSyncSource } from '../../lib/types';
+
+const SOURCE_TYPE_LABELS: Record<string, string> = {
+    smb: 'Network share',
+    azure_files: 'Azure Files',
+    azure_blob: 'Azure Blob Storage',
+    onedrive: 'OneDrive',
+    google_drive: 'Google Drive',
+    google_shared_drive: 'Google shared drive',
+};
+
+export function sourceTypeLabel(sourceType: unknown): string {
+    const raw = String(sourceType ?? '').trim();
+    return SOURCE_TYPE_LABELS[raw] ?? (raw ? raw.replace(/[_-]+/g, ' ') : 'Unknown');
+}
+
+function formatTimestamp(value: unknown): string {
+    const raw = String(value ?? '');
+    if (!raw) {
+        return '';
+    }
+    const parsed = new Date(raw);
+    return Number.isNaN(parsed.valueOf()) ? raw : parsed.toLocaleString();
+}
+
+function SourceRuns({ sourceId }: { sourceId: string }) {
+    const { items, loading, error } = useSectionResource<WorkspaceSyncRun>(
+        (signal) => fetchSyncRuns(sourceId, signal),
+        'Failed to load sync history.',
+    );
+
+    if (loading) {
+        return <p className="px-3 pb-3 text-xs text-text-3">Loading history…</p>;
+    }
+    if (error) {
+        return <p className="px-3 pb-3 text-xs text-danger">{error}</p>;
+    }
+    if (items.length === 0) {
+        return <p className="px-3 pb-3 text-xs text-text-3">This source has not run yet.</p>;
+    }
+
+    return (
+        <ul className="space-y-1 px-3 pb-3">
+            {items.slice(0, 10).map((run) => (
+                <li key={run.id} className="flex items-center gap-2 text-xs text-text-3">
+                    <Pill tone={statusTone(run.status)}>{String(run.status ?? 'unknown')}</Pill>
+                    <span className="truncate">
+                        {formatTimestamp(run.started_at) || 'Not started'}
+                        {run.completed_at ? ` → ${formatTimestamp(run.completed_at)}` : ''}
+                    </span>
+                </li>
+            ))}
+        </ul>
+    );
+}
+
+export function FileSourcesSection() {
+    const { items, loading, error, refresh, setItems, setError } =
+        useSectionResource<WorkspaceSyncSource>(
+            fetchSyncSources,
+            'Failed to load file sources.',
+        );
+
+    const [query, setQuery] = useState('');
+    const [busyId, setBusyId] = useState<string | null>(null);
+    const [expandedId, setExpandedId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((source) =>
+            `${source.name ?? ''} ${source.remote_path ?? ''}`.toLowerCase().includes(needle),
+        );
+    }, [items, query]);
+
+    const onRun = async (source: WorkspaceSyncSource) => {
+        setBusyId(source.id);
+        setError(null);
+        try {
+            await startSyncRun(source.id);
+            await refresh();
+        } catch (runError) {
+            setError(errorMessage(runError, 'Could not start the sync.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    const onDelete = async (source: WorkspaceSyncSource) => {
+        const previous = items;
+        setBusyId(source.id);
+        setItems(items.filter((item) => item.id !== source.id));
+        try {
+            // The documents this source produced are deliberately kept. Removing a
+            // connection and discarding everything it ever brought in are different
+            // intentions, and only the first one was expressed here.
+            await deleteSyncSource(source.id, false);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the file source.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="File sources"
+                description="Places your files already live. Approved files are brought in and processed the same way an upload is, then appear in your documents."
+            />
+
+            <p className="text-xs text-text-3">
+                Files land in{' '}
+                <Link to="/workspace/documents" className="text-accent hover:underline">
+                    Documents
+                </Link>
+                . Adding and configuring a source is still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .
+            </p>
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search file sources" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<FolderSync size={28} />}
+                emptyTitle={
+                    items.length === 0 ? 'No file sources yet' : 'No sources match your search'
+                }
+                emptyDescription={
+                    items.length === 0
+                        ? 'Connect a source to bring documents in without uploading them one by one.'
+                        : undefined
+                }
+                getKey={(source, index) => String(source.id ?? index)}
+                renderItem={(source) => {
+                    const expanded = expandedId === source.id;
+                    return (
+                        <div>
+                            <ResourceRow
+                                icon={<FolderSync size={17} />}
+                                title={String(source.name ?? 'Untitled source')}
+                                subtitle={String(source.remote_path ?? '')}
+                                meta={
+                                    <>
+                                        <Pill>{sourceTypeLabel(source.source_type)}</Pill>
+                                        <Pill tone={source.enabled ? 'ok' : 'neutral'}>
+                                            {source.enabled ? 'Enabled' : 'Paused'}
+                                        </Pill>
+                                    </>
+                                }
+                                actions={
+                                    <>
+                                        <RowAction
+                                            icon={
+                                                expanded ? (
+                                                    <ChevronDown size={15} />
+                                                ) : (
+                                                    <ChevronRight size={15} />
+                                                )
+                                            }
+                                            label={
+                                                expanded
+                                                    ? 'Hide sync history'
+                                                    : 'Show sync history'
+                                            }
+                                            onClick={() =>
+                                                setExpandedId(expanded ? null : source.id)
+                                            }
+                                        />
+                                        <RowAction
+                                            icon={<Play size={15} />}
+                                            label={`Sync ${source.name ?? 'source'} now`}
+                                            busy={busyId === source.id}
+                                            onClick={() => void onRun(source)}
+                                        />
+                                        <ConfirmAction
+                                            icon={<Trash2 size={15} />}
+                                            label={`Delete ${source.name ?? 'source'}`}
+                                            confirmLabel="Delete"
+                                            busy={busyId === source.id}
+                                            onConfirm={() => void onDelete(source)}
+                                        />
+                                    </>
+                                }
+                            />
+                            {expanded ? <SourceRuns sourceId={source.id} /> : null}
+                        </div>
+                    );
+                }}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/IdentitiesSection.tsx b/application/v2_ui/src/pages/workspace/IdentitiesSection.tsx
new file mode 100644
index 000000000..a22cbb998
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/IdentitiesSection.tsx
@@ -0,0 +1,150 @@
+// IdentitiesSection.tsx
+// Saved credentials, used by file sources and actions.
+//
+// Named "Identities" throughout the application, which reliably reads as user sign-in
+// rather than as stored credentials, so the wording here is explicit about what these are
+// and what uses them.
+
+import { useMemo, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { KeyRound, Trash2 } from 'lucide-react';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import { deleteIdentity, fetchIdentities } from '../../lib/workspaceApi';
+import type { WorkspaceIdentity } from '../../lib/types';
+
+const AUTH_TYPE_LABELS: Record<string, string> = {
+    anonymous: 'Anonymous',
+    api_key: 'API key',
+    bearer_token: 'Bearer token',
+    client_secret: 'Client secret',
+    connection_string: 'Connection string',
+    managed_identity: 'Managed identity',
+    username_password: 'Username and password',
+};
+
+export function authTypeLabel(authType: unknown): string {
+    const raw = String(authType ?? '').trim();
+    return AUTH_TYPE_LABELS[raw] ?? (raw ? raw.replace(/[_-]+/g, ' ') : 'Unknown');
+}
+
+export function IdentitiesSection({
+    syncEnabled,
+    actionsEnabled,
+}: {
+    syncEnabled: boolean;
+    actionsEnabled: boolean;
+}) {
+    const { items, loading, error, setItems, setError } = useSectionResource<WorkspaceIdentity>(
+        fetchIdentities,
+        'Failed to load identities.',
+    );
+
+    const [query, setQuery] = useState('');
+    const [busyId, setBusyId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((identity) =>
+            `${identity.name ?? ''} ${identity.username ?? ''}`.toLowerCase().includes(needle),
+        );
+    }, [items, query]);
+
+    const onDelete = async (identity: WorkspaceIdentity) => {
+        const previous = items;
+        setBusyId(identity.id);
+        setItems(items.filter((item) => item.id !== identity.id));
+        try {
+            await deleteIdentity(identity.id);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the identity.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Identities"
+                description="Sign-in details you save once and reuse. These are credentials for the systems you connect to, not your own account. Secrets are held server-side and never sent back to the browser."
+            />
+
+            <p className="text-xs text-text-3">
+                Used by{' '}
+                {syncEnabled ? (
+                    <Link to="/workspace/sync" className="text-accent hover:underline">
+                        file sources
+                    </Link>
+                ) : (
+                    'file sources'
+                )}{' '}
+                and{' '}
+                {actionsEnabled ? (
+                    <Link to="/workspace/actions" className="text-accent hover:underline">
+                        actions
+                    </Link>
+                ) : (
+                    'actions'
+                )}
+                . Adding one is still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .
+            </p>
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search identities" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<KeyRound size={28} />}
+                emptyTitle={
+                    items.length === 0 ? 'No identities yet' : 'No identities match your search'
+                }
+                emptyDescription={
+                    items.length === 0
+                        ? 'Save a credential here to reuse it across file sources and actions.'
+                        : undefined
+                }
+                getKey={(identity, index) => String(identity.id ?? index)}
+                renderItem={(identity) => (
+                    <ResourceRow
+                        icon={<KeyRound size={17} />}
+                        title={String(identity.name ?? 'Untitled identity')}
+                        subtitle={
+                            String(identity.username ?? '') ||
+                            String(identity.description ?? '')
+                        }
+                        meta={<Pill>{authTypeLabel(identity.auth_type)}</Pill>}
+                        actions={
+                            <ConfirmAction
+                                icon={<Trash2 size={15} />}
+                                label={`Delete ${identity.name ?? 'identity'}`}
+                                confirmLabel="Delete"
+                                busy={busyId === identity.id}
+                                onConfirm={() => void onDelete(identity)}
+                            />
+                        }
+                    />
+                )}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/OverviewSection.tsx b/application/v2_ui/src/pages/workspace/OverviewSection.tsx
new file mode 100644
index 000000000..c39067f2e
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/OverviewSection.tsx
@@ -0,0 +1,208 @@
+// OverviewSection.tsx
+// The workspace landing page.
+//
+// This section exists because of a specific complaint: the workspace is eight capabilities
+// an administrator can enable independently, and a user faced with whichever subset they
+// happen to have cannot tell what the pieces are for or how they relate. So the overview
+// does three things a list of tabs cannot. It groups the sections by purpose, it states how
+// they feed one another, and it names the sections that are switched off along with the
+// reason -- because a section that silently disappears is indistinguishable from one that
+// is broken or that the user simply cannot find.
+
+import { useEffect, useState } from 'react';
+import { Link } from 'react-router-dom';
+import { ArrowRight, Lock } from 'lucide-react';
+import { GlassPanel } from '../../components/ui/primitives';
+import { SectionIntro } from '../../components/workspace/primitives';
+import { fetchPersonalDocuments } from '../../lib/endpoints';
+import {
+    fetchActions,
+    fetchAgents,
+    fetchIdentities,
+    fetchModelEndpoints,
+    fetchPrompts,
+    fetchSyncSources,
+    fetchWorkflows,
+} from '../../lib/workspaceApi';
+import { groupWorkspaceSections } from '../../lib/workspaceSections';
+import type { ResolvedWorkspaceSection } from '../../lib/workspaceSections';
+import type { WorkspaceSectionDefinition } from './sections';
+
+type CountMap = Record<string, number | undefined>;
+
+/** How to count the contents of each section, for the summary on its card. */
+const COUNT_LOADERS: Record<string, (signal: AbortSignal) => Promise<number>> = {
+    documents: async (signal) => {
+        const response = await fetchPersonalDocuments(1000, signal);
+        return (response.documents ?? response.items ?? []).length;
+    },
+    prompts: async (signal) => (await fetchPrompts({}, signal)).length,
+    sync: async (signal) => (await fetchSyncSources(signal)).length,
+    agents: async (signal) => (await fetchAgents(signal)).length,
+    actions: async (signal) => (await fetchActions(signal)).length,
+    workflows: async (signal) => (await fetchWorkflows(signal)).length,
+    identities: async (signal) => (await fetchIdentities(signal)).length,
+    endpoints: async (signal) => (await fetchModelEndpoints(signal)).length,
+};
+
+/**
+ * Count what is in each available section.
+ *
+ * Counts are decoration: a section whose count fails to load still renders, without one.
+ * Failing the whole overview because one collection was unreachable would be a poor trade,
+ * and several of these routes can legitimately refuse depending on governance.
+ */
+function useSectionCounts(sectionIds: string[]): CountMap {
+    const [counts, setCounts] = useState<CountMap>({});
+    const key = sectionIds.join(',');
+
+    useEffect(() => {
+        const controller = new AbortController();
+        const ids = key ? key.split(',') : [];
+
+        void Promise.all(
+            ids.map(async (id) => {
+                const loader = COUNT_LOADERS[id];
+                if (!loader) {
+                    return [id, undefined] as const;
+                }
+                try {
+                    return [id, await loader(controller.signal)] as const;
+                } catch {
+                    return [id, undefined] as const;
+                }
+            }),
+        ).then((entries) => {
+            if (!controller.signal.aborted) {
+                setCounts(Object.fromEntries(entries));
+            }
+        });
+
+        return () => controller.abort();
+    }, [key]);
+
+    return counts;
+}
+
+function SectionCard({
+    entry,
+    count,
+}: {
+    entry: ResolvedWorkspaceSection<WorkspaceSectionDefinition>;
+    count?: number;
+}) {
+    const { section, enabled, reason } = entry;
+    const Icon = section.icon;
+
+    if (!enabled) {
+        return (
+            <GlassPanel
+                elevation="flat"
+                className="flex gap-3 p-3 opacity-60"
+                aria-label={`${section.label} (unavailable)`}
+            >
+                <Icon size={17} className="mt-0.5 shrink-0 text-text-3" />
+                <div className="min-w-0">
+                    <p className="flex items-center gap-1.5 text-sm font-medium text-text-2">
+                        {section.label}
+                        <Lock size={11} className="text-text-3" />
+                    </p>
+                    <p className="mt-0.5 text-xs text-text-3">{section.blurb}</p>
+                    <p className="mt-1 text-xs text-text-3 italic">{reason}</p>
+                </div>
+            </GlassPanel>
+        );
+    }
+
+    return (
+        <Link to={`/workspace/${section.id}`} className="block">
+            <GlassPanel
+                elevation="flat"
+                className="flex h-full gap-3 p-3 transition-colors hover:bg-surface-2"
+            >
+                <Icon size={17} className="mt-0.5 shrink-0 text-accent" />
+                <div className="min-w-0 flex-1">
+                    <p className="flex items-center gap-2 text-sm font-medium text-text-1">
+                        {section.label}
+                        {typeof count === 'number' ? (
+                            <span className="rounded-full bg-surface-2 px-1.5 py-0.5 text-[11px] leading-none text-text-3">
+                                {count}
+                            </span>
+                        ) : null}
+                    </p>
+                    <p className="mt-0.5 text-xs text-text-3">{section.blurb}</p>
+                </div>
+            </GlassPanel>
+        </Link>
+    );
+}
+
+function Relationship({ parts }: { parts: string[] }) {
+    return (
+        <li className="flex flex-wrap items-center gap-1.5 text-xs text-text-3">
+            {parts.map((part, index) => (
+                <span key={part} className="flex items-center gap-1.5">
+                    {index > 0 ? <ArrowRight size={11} className="text-text-3" /> : null}
+                    <span className="rounded-md bg-surface-2 px-1.5 py-0.5 text-text-2">
+                        {part}
+                    </span>
+                </span>
+            ))}
+        </li>
+    );
+}
+
+export function OverviewSection({
+    resolved,
+}: {
+    resolved: ResolvedWorkspaceSection<WorkspaceSectionDefinition>[];
+}) {
+    const enabledIds = resolved
+        .filter((entry) => entry.enabled)
+        .map((entry) => entry.section.id);
+    const counts = useSectionCounts(enabledIds);
+    const groups = groupWorkspaceSections(resolved);
+
+    return (
+        <div className="space-y-6">
+            <SectionIntro
+                title="Overview"
+                description="Everything here is yours alone. The sections build on each other, so most people start with documents and add the rest only when they need them."
+            />
+
+            {groups.map(({ group, sections }) => (
+                <section key={group.id} className="space-y-2">
+                    <div>
+                        <h3 className="text-sm font-semibold text-text-1">{group.label}</h3>
+                        <p className="text-xs text-text-3">{group.blurb}</p>
+                    </div>
+                    <div className="grid gap-2 sm:grid-cols-2">
+                        {sections.map((entry) => (
+                            <SectionCard
+                                key={entry.section.id}
+                                entry={entry}
+                                count={counts[entry.section.id]}
+                            />
+                        ))}
+                    </div>
+                </section>
+            ))}
+
+            <GlassPanel elevation="flat" className="space-y-2 p-4">
+                <h3 className="text-sm font-semibold text-text-1">How these fit together</h3>
+                <ul className="space-y-1.5">
+                    <Relationship parts={['Identities', 'File sources', 'Documents']} />
+                    <Relationship parts={['Documents', 'Agents']} />
+                    <Relationship parts={['Actions', 'Agents']} />
+                    <Relationship parts={['Endpoints', 'Agents']} />
+                    <Relationship parts={['Agents', 'Workflows']} />
+                </ul>
+                <p className="text-xs text-text-3">
+                    Read left to right: the thing on the left is used by the thing on its
+                    right. Identities and endpoints exist to be reused, so they rarely need
+                    attention once set up.
+                </p>
+            </GlassPanel>
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/PromptsSection.tsx b/application/v2_ui/src/pages/workspace/PromptsSection.tsx
new file mode 100644
index 000000000..717219fa7
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/PromptsSection.tsx
@@ -0,0 +1,240 @@
+// PromptsSection.tsx
+// Saved prompts: create, edit, delete.
+//
+// The only section with a complete editor in this pass, because a prompt is only a name and
+// a body -- there is nothing to defer.
+
+import { useMemo, useState } from 'react';
+import { MessageSquareQuote, Pencil, Plus, Trash2 } from 'lucide-react';
+import { GlassButton, GlassPanel } from '../../components/ui/primitives';
+import {
+    ConfirmAction,
+    ResourceRow,
+    RowAction,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import {
+    createPrompt,
+    deletePrompt,
+    fetchPrompts,
+    updatePrompt,
+} from '../../lib/workspaceApi';
+import type { WorkspacePrompt } from '../../lib/types';
+
+interface DraftPrompt {
+    id: string | null;
+    name: string;
+    content: string;
+}
+
+const EMPTY_DRAFT: DraftPrompt = { id: null, name: '', content: '' };
+
+function PromptEditor({
+    draft,
+    saving,
+    onChange,
+    onSave,
+    onCancel,
+}: {
+    draft: DraftPrompt;
+    saving: boolean;
+    onChange: (next: DraftPrompt) => void;
+    onSave: () => void;
+    onCancel: () => void;
+}) {
+    const canSave = draft.name.trim().length > 0 && draft.content.trim().length > 0;
+
+    return (
+        <GlassPanel elevation="flat" className="space-y-3 p-4">
+            <div>
+                <label
+                    htmlFor="prompt-name"
+                    className="mb-1 block text-xs font-medium text-text-2"
+                >
+                    Name
+                </label>
+                <input
+                    id="prompt-name"
+                    type="text"
+                    value={draft.name}
+                    onChange={(event) => onChange({ ...draft, name: event.target.value })}
+                    placeholder="Weekly status summary"
+                    className="w-full rounded-xl border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+                />
+            </div>
+
+            <div>
+                <label
+                    htmlFor="prompt-content"
+                    className="mb-1 block text-xs font-medium text-text-2"
+                >
+                    Prompt
+                </label>
+                <textarea
+                    id="prompt-content"
+                    rows={6}
+                    value={draft.content}
+                    onChange={(event) => onChange({ ...draft, content: event.target.value })}
+                    placeholder="Summarise the attached documents as five bullet points, then list any open questions."
+                    className="w-full resize-y rounded-xl border border-edge bg-surface-1 px-3 py-2 text-sm text-text-1 placeholder:text-text-3 focus:border-accent focus:outline-none"
+                />
+            </div>
+
+            <div className="flex justify-end gap-2">
+                <GlassButton size="sm" onClick={onCancel} disabled={saving}>
+                    Cancel
+                </GlassButton>
+                <GlassButton
+                    variant="primary"
+                    size="sm"
+                    onClick={onSave}
+                    disabled={!canSave || saving}
+                >
+                    {saving ? 'Saving' : draft.id ? 'Save changes' : 'Create prompt'}
+                </GlassButton>
+            </div>
+        </GlassPanel>
+    );
+}
+
+export function PromptsSection() {
+    const { items, loading, error, refresh, setItems, setError } =
+        useSectionResource<WorkspacePrompt>(
+            (signal) => fetchPrompts({}, signal),
+            'Failed to load prompts.',
+        );
+
+    const [query, setQuery] = useState('');
+    const [draft, setDraft] = useState<DraftPrompt | null>(null);
+    const [saving, setSaving] = useState(false);
+    const [busyId, setBusyId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((prompt) =>
+            String(prompt.name ?? '').toLowerCase().includes(needle),
+        );
+    }, [items, query]);
+
+    const onSave = async () => {
+        if (!draft) {
+            return;
+        }
+        setSaving(true);
+        setError(null);
+        try {
+            if (draft.id) {
+                await updatePrompt(draft.id, {
+                    name: draft.name.trim(),
+                    content: draft.content,
+                });
+            } else {
+                await createPrompt(draft.name.trim(), draft.content);
+            }
+            setDraft(null);
+            await refresh();
+        } catch (saveError) {
+            setError(errorMessage(saveError, 'Could not save the prompt.'));
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    const onDelete = async (prompt: WorkspacePrompt) => {
+        const previous = items;
+        setBusyId(prompt.id);
+        setItems(items.filter((item) => item.id !== prompt.id));
+        try {
+            await deletePrompt(prompt.id);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the prompt.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Prompts"
+                description="Instructions you reuse. Saved prompts are offered in the chat composer, so a wording you have refined once does not have to be retyped."
+                actions={
+                    <GlassButton
+                        variant="primary"
+                        size="sm"
+                        onClick={() => setDraft({ ...EMPTY_DRAFT })}
+                        disabled={Boolean(draft)}
+                    >
+                        <Plus size={14} />
+                        New prompt
+                    </GlassButton>
+                }
+            />
+
+            {draft ? (
+                <PromptEditor
+                    draft={draft}
+                    saving={saving}
+                    onChange={setDraft}
+                    onSave={() => void onSave()}
+                    onCancel={() => setDraft(null)}
+                />
+            ) : null}
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search prompts" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<MessageSquareQuote size={28} />}
+                emptyTitle={items.length === 0 ? 'No prompts yet' : 'No prompts match your search'}
+                emptyDescription={
+                    items.length === 0
+                        ? 'Save a prompt to reuse it from the chat composer.'
+                        : undefined
+                }
+                getKey={(prompt, index) => String(prompt.id ?? index)}
+                renderItem={(prompt) => (
+                    <ResourceRow
+                        icon={<MessageSquareQuote size={17} />}
+                        title={String(prompt.name ?? 'Untitled prompt')}
+                        subtitle={String(prompt.content ?? '').slice(0, 140)}
+                        actions={
+                            <>
+                                <RowAction
+                                    icon={<Pencil size={15} />}
+                                    label={`Edit ${prompt.name ?? 'prompt'}`}
+                                    onClick={() =>
+                                        setDraft({
+                                            id: prompt.id,
+                                            name: String(prompt.name ?? ''),
+                                            content: String(prompt.content ?? ''),
+                                        })
+                                    }
+                                />
+                                <ConfirmAction
+                                    icon={<Trash2 size={15} />}
+                                    label={`Delete ${prompt.name ?? 'prompt'}`}
+                                    confirmLabel="Delete"
+                                    busy={busyId === prompt.id}
+                                    onConfirm={() => void onDelete(prompt)}
+                                />
+                            </>
+                        }
+                    />
+                )}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/WorkflowsSection.tsx b/application/v2_ui/src/pages/workspace/WorkflowsSection.tsx
new file mode 100644
index 000000000..91615de92
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/WorkflowsSection.tsx
@@ -0,0 +1,248 @@
+// WorkflowsSection.tsx
+// Personal workflows: list, run, cancel, inspect run history and delete.
+//
+// Designing a workflow -- its tasks, document actions and schedule -- stays in the classic
+// interface for now. What is here is the part you return to repeatedly: seeing what ran,
+// starting a run, and stopping one that should not continue.
+
+import { useMemo, useState } from 'react';
+import { Ban, ChevronDown, ChevronRight, Play, Trash2, Workflow } from 'lucide-react';
+import {
+    ConfirmAction,
+    Pill,
+    ResourceRow,
+    RowAction,
+    SectionIntro,
+    SectionList,
+    SectionSearch,
+} from '../../components/workspace/primitives';
+import {
+    errorMessage,
+    useSectionResource,
+} from '../../components/workspace/useSectionResource';
+import {
+    cancelWorkflow,
+    deleteWorkflow,
+    fetchWorkflowRuns,
+    fetchWorkflows,
+    startWorkflowRun,
+} from '../../lib/workspaceApi';
+import type { WorkspaceWorkflow, WorkspaceWorkflowRun } from '../../lib/types';
+
+/** Map a run or workflow status onto a pill colour. */
+export function statusTone(status: unknown): 'ok' | 'warn' | 'danger' | 'neutral' {
+    const value = String(status ?? '').toLowerCase();
+    if (['completed', 'succeeded', 'success', 'finished'].includes(value)) {
+        return 'ok';
+    }
+    if (['running', 'queued', 'pending', 'in_progress', 'started'].includes(value)) {
+        return 'warn';
+    }
+    if (['failed', 'error', 'cancelled', 'canceled'].includes(value)) {
+        return 'danger';
+    }
+    return 'neutral';
+}
+
+function formatTimestamp(value: unknown): string {
+    const raw = String(value ?? '');
+    if (!raw) {
+        return '';
+    }
+    const parsed = new Date(raw);
+    return Number.isNaN(parsed.valueOf()) ? raw : parsed.toLocaleString();
+}
+
+function RunHistory({ workflowId }: { workflowId: string }) {
+    const { items, loading, error } = useSectionResource<WorkspaceWorkflowRun>(
+        (signal) => fetchWorkflowRuns(workflowId, signal),
+        'Failed to load run history.',
+    );
+
+    if (loading) {
+        return <p className="px-3 pb-3 text-xs text-text-3">Loading runs…</p>;
+    }
+    if (error) {
+        return <p className="px-3 pb-3 text-xs text-danger">{error}</p>;
+    }
+    if (items.length === 0) {
+        return <p className="px-3 pb-3 text-xs text-text-3">This workflow has not run yet.</p>;
+    }
+
+    return (
+        <ul className="space-y-1 px-3 pb-3">
+            {items.slice(0, 10).map((run) => (
+                <li key={run.id} className="flex items-center gap-2 text-xs text-text-3">
+                    <Pill tone={statusTone(run.status)}>{String(run.status ?? 'unknown')}</Pill>
+                    <span className="truncate">
+                        {formatTimestamp(run.started_at) || 'Not started'}
+                        {run.completed_at ? ` → ${formatTimestamp(run.completed_at)}` : ''}
+                    </span>
+                </li>
+            ))}
+        </ul>
+    );
+}
+
+export function WorkflowsSection() {
+    const { items, loading, error, refresh, setItems, setError } =
+        useSectionResource<WorkspaceWorkflow>(fetchWorkflows, 'Failed to load workflows.');
+
+    const [query, setQuery] = useState('');
+    const [busyId, setBusyId] = useState<string | null>(null);
+    const [expandedId, setExpandedId] = useState<string | null>(null);
+
+    const visible = useMemo(() => {
+        const needle = query.trim().toLowerCase();
+        if (!needle) {
+            return items;
+        }
+        return items.filter((workflow) =>
+            `${workflow.name ?? ''} ${workflow.description ?? ''}`
+                .toLowerCase()
+                .includes(needle),
+        );
+    }, [items, query]);
+
+    const runAction = async (
+        workflow: WorkspaceWorkflow,
+        action: (id: string) => Promise<unknown>,
+        failure: string,
+    ) => {
+        setBusyId(workflow.id);
+        setError(null);
+        try {
+            await action(workflow.id);
+            await refresh();
+        } catch (actionError) {
+            setError(errorMessage(actionError, failure));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    const onDelete = async (workflow: WorkspaceWorkflow) => {
+        const previous = items;
+        setBusyId(workflow.id);
+        setItems(items.filter((item) => item.id !== workflow.id));
+        try {
+            await deleteWorkflow(workflow.id);
+        } catch (deleteError) {
+            setItems(previous);
+            setError(errorMessage(deleteError, 'Could not delete the workflow.'));
+        } finally {
+            setBusyId(null);
+        }
+    };
+
+    return (
+        <div className="space-y-4">
+            <SectionIntro
+                title="Workflows"
+                description="Repeatable tasks that run on their own, using a model or one of your agents. A workflow can run on a schedule or whenever you start it."
+            />
+
+            <p className="text-xs text-text-3">
+                Designing a workflow is still done in the{' '}
+                <a href="/workspace" className="text-accent hover:underline">
+                    classic workspace
+                </a>
+                .
+            </p>
+
+            <SectionSearch value={query} onChange={setQuery} placeholder="Search workflows" />
+
+            <SectionList
+                items={visible}
+                loading={loading}
+                error={error}
+                emptyIcon={<Workflow size={28} />}
+                emptyTitle={
+                    items.length === 0 ? 'No workflows yet' : 'No workflows match your search'
+                }
+                emptyDescription={
+                    items.length === 0
+                        ? 'A workflow repeats a task you would otherwise run by hand.'
+                        : undefined
+                }
+                getKey={(workflow, index) => String(workflow.id ?? index)}
+                renderItem={(workflow) => {
+                    const running = Boolean(workflow.active_run_id);
+                    const expanded = expandedId === workflow.id;
+                    return (
+                        <div>
+                            <ResourceRow
+                                icon={<Workflow size={17} />}
+                                title={String(workflow.name ?? 'Untitled workflow')}
+                                subtitle={String(workflow.description ?? '')}
+                                meta={
+                                    workflow.status ? (
+                                        <Pill tone={statusTone(workflow.status)}>
+                                            {String(workflow.status)}
+                                        </Pill>
+                                    ) : undefined
+                                }
+                                actions={
+                                    <>
+                                        <RowAction
+                                            icon={
+                                                expanded ? (
+                                                    <ChevronDown size={15} />
+                                                ) : (
+                                                    <ChevronRight size={15} />
+                                                )
+                                            }
+                                            label={
+                                                expanded
+                                                    ? 'Hide run history'
+                                                    : 'Show run history'
+                                            }
+                                            onClick={() =>
+                                                setExpandedId(expanded ? null : workflow.id)
+                                            }
+                                        />
+                                        {running ? (
+                                            <RowAction
+                                                icon={<Ban size={15} />}
+                                                label={`Cancel ${workflow.name ?? 'workflow'}`}
+                                                busy={busyId === workflow.id}
+                                                onClick={() =>
+                                                    void runAction(
+                                                        workflow,
+                                                        cancelWorkflow,
+                                                        'Could not cancel the workflow.',
+                                                    )
+                                                }
+                                            />
+                                        ) : (
+                                            <RowAction
+                                                icon={<Play size={15} />}
+                                                label={`Run ${workflow.name ?? 'workflow'}`}
+                                                busy={busyId === workflow.id}
+                                                onClick={() =>
+                                                    void runAction(
+                                                        workflow,
+                                                        startWorkflowRun,
+                                                        'Could not start the workflow.',
+                                                    )
+                                                }
+                                            />
+                                        )}
+                                        <ConfirmAction
+                                            icon={<Trash2 size={15} />}
+                                            label={`Delete ${workflow.name ?? 'workflow'}`}
+                                            confirmLabel="Delete"
+                                            busy={busyId === workflow.id}
+                                            onConfirm={() => void onDelete(workflow)}
+                                        />
+                                    </>
+                                }
+                            />
+                            {expanded ? <RunHistory workflowId={workflow.id} /> : null}
+                        </div>
+                    );
+                }}
+            />
+        </div>
+    );
+}
diff --git a/application/v2_ui/src/pages/workspace/WorkspacePage.tsx b/application/v2_ui/src/pages/workspace/WorkspacePage.tsx
new file mode 100644
index 000000000..4966fc54e
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/WorkspacePage.tsx
@@ -0,0 +1,150 @@
+// WorkspacePage.tsx
+// The personal workspace shell: header, grouped navigation rail, and the active section.
+//
+// The classic workspace presents these as eight sibling tabs, which reads as eight
+// unrelated things and hides the fact that most of them exist to serve one another. Here
+// they are grouped by purpose, with an overview in front, and the rail carries only what is
+// actually available -- everything else is accounted for on the overview, where there is
+// room to say why.
+
+import { useMemo } from 'react';
+import { NavLink, useParams } from 'react-router-dom';
+import { clsx } from 'clsx';
+import { LayoutGrid, Lock } from 'lucide-react';
+import { PageHeader } from '../../components/layout/PageHeader';
+import { EmptyState } from '../../components/ui/primitives';
+import { useBootstrapStore } from '../../stores/bootstrapStore';
+import {
+    groupWorkspaceSections,
+    navigableSections,
+    resolveWorkspaceSections,
+} from '../../lib/workspaceSections';
+import { OverviewSection } from './OverviewSection';
+import { WORKSPACE_SECTIONS, WORKSPACE_SECTIONS_BY_ID } from './sections';
+import type { WorkspaceSectionContext } from './sections';
+
+export function WorkspacePage() {
+    const workspace = useBootstrapStore((state) => state.data?.workspace);
+    const { section: requestedSection } = useParams<{ section?: string }>();
+
+    const resolved = useMemo(
+        () => resolveWorkspaceSections(WORKSPACE_SECTIONS, workspace),
+        [workspace],
+    );
+
+    const available = useMemo(() => navigableSections(resolved), [resolved]);
+    const groups = useMemo(() => groupWorkspaceSections(available), [available]);
+
+    const context: WorkspaceSectionContext = useMemo(
+        () => ({
+            isEnabled: (sectionId: string) =>
+                resolved.some((entry) => entry.section.id === sectionId && entry.enabled),
+        }),
+        [resolved],
+    );
+
+    // The whole page is gated on enable_user_workspace upstream, but the flag is reported
+    // here too so a disabled workspace explains itself rather than rendering an empty rail.
+    if (workspace && !workspace.enabled) {
+        return (
+            <div className="flex h-full min-h-0 flex-col">
+                <PageHeader title="My workspace" description="Your private documents and tools" />
+                <div className="min-h-0 flex-1 overflow-y-auto p-4">
+                    <EmptyState
+                        icon={<Lock size={28} />}
+                        title="Your workspace is not enabled"
+                        description="Your administrator has not enabled personal workspaces for this deployment."
+                    />
+                </div>
+            </div>
+        );
+    }
+
+    const activeEntry = requestedSection
+        ? resolved.find((entry) => entry.section.id === requestedSection)
+        : null;
+    const showOverview = !requestedSection;
+
+    const renderBody = () => {
+        if (showOverview) {
+            return <OverviewSection resolved={resolved} />;
+        }
+        if (!activeEntry) {
+            return (
+                <EmptyState
+                    icon={<LayoutGrid size={28} />}
+                    title="Section not found"
+                    description="That part of the workspace does not exist."
+                />
+            );
+        }
+        if (!activeEntry.enabled) {
+            // Reached by a bookmark or a shared link to a section that has since been turned
+            // off. The reason is the same one the overview shows.
+            return (
+                <EmptyState
+                    icon={<Lock size={28} />}
+                    title={`${activeEntry.section.label} is not available`}
+                    description={activeEntry.reason ?? undefined}
+                />
+            );
+        }
+        return activeEntry.section.render(context);
+    };
+
+    const linkClass = ({ isActive }: { isActive: boolean }) =>
+        clsx(
+            'flex items-center gap-2.5 rounded-lg px-2.5 py-2 text-left text-sm transition-colors',
+            isActive
+                ? 'bg-accent-soft font-medium text-accent'
+                : 'text-text-2 hover:bg-surface-2 hover:text-text-1',
+        );
+
+    return (
+        <div className="flex h-full min-h-0 flex-col">
+            <PageHeader
+                title="My workspace"
+                description="Documents, prompts and automation that belong to you alone"
+            />
+
+            <div className="flex min-h-0 flex-1 gap-4 overflow-hidden p-4">
+                <nav
+                    aria-label="Workspace sections"
+                    className="flex w-52 shrink-0 flex-col gap-3 overflow-y-auto"
+                >
+                    <NavLink to="/workspace" end className={linkClass}>
+                        <LayoutGrid size={15} className="shrink-0" />
+                        <span className="truncate">Overview</span>
+                    </NavLink>
+
+                    {groups.map(({ group, sections }) => (
+                        <div key={group.id} className="space-y-0.5">
+                            <p className="px-2.5 text-[11px] font-semibold tracking-wide text-text-3 uppercase">
+                                {group.label}
+                            </p>
+                            {sections.map(({ section }) => {
+                                const Icon = section.icon;
+                                return (
+                                    <NavLink
+                                        key={section.id}
+                                        to={`/workspace/${section.id}`}
+                                        className={linkClass}
+                                    >
+                                        <Icon size={15} className="shrink-0" />
+                                        <span className="truncate">{section.label}</span>
+                                    </NavLink>
+                                );
+                            })}
+                        </div>
+                    ))}
+                </nav>
+
+                <div className="min-w-0 flex-1 overflow-y-auto">
+                    <div className="mx-auto max-w-4xl pb-8">{renderBody()}</div>
+                </div>
+            </div>
+        </div>
+    );
+}
+
+export { WORKSPACE_SECTIONS, WORKSPACE_SECTIONS_BY_ID };
diff --git a/application/v2_ui/src/pages/workspace/sections.tsx b/application/v2_ui/src/pages/workspace/sections.tsx
new file mode 100644
index 000000000..6c541987f
--- /dev/null
+++ b/application/v2_ui/src/pages/workspace/sections.tsx
@@ -0,0 +1,123 @@
+// sections.tsx
+// The personal workspace section registry.
+//
+// One place that names every section, says which group it belongs to, and explains what it
+// is for. The navigation rail, the overview and the router all read from here, so a section
+// cannot appear in one and be missing from another.
+//
+// `blurb` is written to answer "why would I open this?" rather than to restate the label.
+// It is the text the overview shows, and for a section an administrator has switched off it
+// is the only thing a user has to go on.
+
+import type { LucideIcon } from 'lucide-react';
+import {
+    FileText,
+    FolderSync,
+    KeyRound,
+    MessageSquareQuote,
+    Plug,
+    Server,
+    Sparkles,
+    Workflow,
+} from 'lucide-react';
+import type { ReactNode } from 'react';
+import type { WorkspaceSectionGroup } from '../../lib/types';
+import type { WorkspaceSectionDescriptor } from '../../lib/workspaceSections';
+import { ActionsSection } from './ActionsSection';
+import { AgentsSection } from './AgentsSection';
+import { DocumentsSection } from './DocumentsSection';
+import { EndpointsSection } from './EndpointsSection';
+import { FileSourcesSection } from './FileSourcesSection';
+import { IdentitiesSection } from './IdentitiesSection';
+import { PromptsSection } from './PromptsSection';
+import { WorkflowsSection } from './WorkflowsSection';
+
+export interface WorkspaceSectionContext {
+    /** Whether another section is available, for cross-links that should not dead-end. */
+    isEnabled: (sectionId: string) => boolean;
+}
+
+export interface WorkspaceSectionDefinition extends WorkspaceSectionDescriptor {
+    id: string;
+    label: string;
+    group: WorkspaceSectionGroup;
+    icon: LucideIcon;
+    /** One line on what the section is for. Shown on the overview. */
+    blurb: string;
+    render: (context: WorkspaceSectionContext) => ReactNode;
+}
+
+export const WORKSPACE_SECTIONS: WorkspaceSectionDefinition[] = [
+    {
+        id: 'documents',
+        label: 'Documents',
+        group: 'knowledge',
+        icon: FileText,
+        blurb: 'Files you upload, indexed so the assistant can quote them.',
+        render: (context) => <DocumentsSection syncEnabled={context.isEnabled('sync')} />,
+    },
+    {
+        id: 'sync',
+        label: 'File sources',
+        group: 'knowledge',
+        icon: FolderSync,
+        blurb: 'Bring files in from where they already live, instead of uploading them.',
+        render: () => <FileSourcesSection />,
+    },
+    {
+        id: 'prompts',
+        label: 'Prompts',
+        group: 'knowledge',
+        icon: MessageSquareQuote,
+        blurb: 'Wording you have refined once and want to reuse in chat.',
+        render: () => <PromptsSection />,
+    },
+    {
+        id: 'agents',
+        label: 'Agents',
+        group: 'automation',
+        icon: Sparkles,
+        blurb: 'Assistants you configure once: instructions, knowledge and actions.',
+        render: (context) => <AgentsSection actionsEnabled={context.isEnabled('actions')} />,
+    },
+    {
+        id: 'actions',
+        label: 'Actions',
+        group: 'automation',
+        icon: Plug,
+        blurb: 'Tools an agent may call, such as an API, a database or an MCP server.',
+        render: (context) => <ActionsSection agentsEnabled={context.isEnabled('agents')} />,
+    },
+    {
+        id: 'workflows',
+        label: 'Workflows',
+        group: 'automation',
+        icon: Workflow,
+        blurb: 'Repeatable tasks that run on a schedule or on demand.',
+        render: () => <WorkflowsSection />,
+    },
+    {
+        id: 'identities',
+        label: 'Identities',
+        group: 'connections',
+        icon: KeyRound,
+        blurb: 'Saved sign-ins that file sources and actions use to reach other systems.',
+        render: (context) => (
+            <IdentitiesSection
+                syncEnabled={context.isEnabled('sync')}
+                actionsEnabled={context.isEnabled('actions')}
+            />
+        ),
+    },
+    {
+        id: 'endpoints',
+        label: 'Endpoints',
+        group: 'connections',
+        icon: Server,
+        blurb: 'Model endpoints of your own for agents and workflows to use.',
+        render: () => <EndpointsSection />,
+    },
+];
+
+export const WORKSPACE_SECTIONS_BY_ID: Record<string, WorkspaceSectionDefinition> =
+    Object.fromEntries(WORKSPACE_SECTIONS.map((section) => [section.id, section]));
diff --git a/docs/explanation/features/V2_MY_WORKSPACE.md b/docs/explanation/features/V2_MY_WORKSPACE.md
new file mode 100644
index 000000000..81986f566
--- /dev/null
+++ b/docs/explanation/features/V2_MY_WORKSPACE.md
@@ -0,0 +1,183 @@
+# My Workspace in the V2 Interface
+
+## Overview
+
+The personal workspace in the V2 React interface. It replaces a page that listed documents
+and nothing else, and it reorganises the eight capabilities the classic workspace exposes
+as a flat strip of tabs.
+
+The reorganisation is the point of the feature. The classic workspace presents Documents,
+Prompts, Identities, Sync, Endpoints, Actions, Agents and Workflows as eight siblings, each
+shown or hidden by a different combination of settings, app roles and governance policy. A
+user sees somewhere between two and eight tabs with nothing to say why, and nothing anywhere
+to say that agents use actions, that workflows use agents, or that identities exist only to
+serve file sources and actions.
+
+**Implemented in version:** 0.261.042
+
+### Dependencies
+
+| Dependency | Purpose |
+|---|---|
+| React 18 + TypeScript | Application framework |
+| React Router | Section routing under `/workspace` |
+| `/api/v2/bootstrap` | Reports which sections the user may see |
+| `functions_workspace_sections.py` | Computes section availability for both interfaces |
+
+## Information architecture
+
+Sections are grouped by what they are for, rather than listed as peers.
+
+| Group | Meaning | Sections |
+|---|---|---|
+| Knowledge | What your assistant can draw on | Documents, File sources, Prompts |
+| Automation | What your assistant can do | Agents, Actions, Workflows |
+| Connections | Shared setup the other sections reuse | Identities, Endpoints |
+
+Two sections are renamed for clarity. **Sync** becomes **File sources**, because a user
+opening it is trying to point the workspace at files they already have rather than to
+configure a synchronisation mechanism. **Identities** keeps its name but is described as
+saved sign-ins for other systems, since the word otherwise reads as the user's own account.
+
+### The overview page
+
+`/workspace` opens on an overview rather than on a section. It lists every group with its
+sections, a count of what is in each, and one line on what each is for. Below that it states
+the relationships explicitly:
+
+- Identities are used by file sources and actions.
+- File sources feed documents.
+- Documents, actions and endpoints are used by agents.
+- Agents are used by workflows.
+
+Sections an administrator has not enabled appear here, greyed out, with the reason they are
+unavailable. They do not appear in the navigation rail. This is deliberate: hiding a
+capability entirely is indistinguishable from it being broken or from the user failing to
+find it, and the overview is the only place with room to explain.
+
+### Relationship to the Agents page
+
+The **Agents** entry in the main navigation rail is a catalogue: every agent the user may
+select, wherever it came from. **My Workspace → Agents** is where a user builds and manages
+their own. Both are kept, and each says which it is on hover.
+
+## Section availability
+
+Availability is computed server-side by `functions_workspace_sections.py` and returned in
+the `workspace` block of `/api/v2/bootstrap`. The classic workspace route reads the same
+helper, so the two interfaces cannot disagree about what a user may see.
+
+| Section | Requires |
+|---|---|
+| Documents | `enable_user_workspace` (gates the page itself) |
+| Prompts | Always available |
+| File sources | `is_file_sync_enabled_for_user(...)` — settings plus app roles |
+| Identities | File sync available, or `enable_semantic_kernel` |
+| Agents | `per_user_semantic_kernel`, `enable_semantic_kernel`, `allow_user_agents`, and governance `governance_user_agents` |
+| Actions | Everything Agents requires, plus `allow_user_plugins` and governance `governance_user_actions` |
+| Workflows | `is_user_workflows_enabled_for_user(...)` — settings plus app roles |
+| Endpoints | `allow_user_custom_endpoints`, `enable_multi_model_endpoints`, and governance `governance_user_endpoints` |
+
+The `features` map in the bootstrap payload cannot carry these. It forwards only `enable_*`
+booleans, which excludes `per_user_semantic_kernel`, `allow_user_agents`,
+`allow_user_plugins` and `allow_user_custom_endpoints`, and the file sync and governance
+checks are not settings keys at all. The `workspace` block exists for exactly that reason.
+
+A section the server does not report is treated as unavailable. Failing the other way would
+render a section whose every request is refused.
+
+## API changes
+
+Personal agents, actions and model endpoints previously had no per-item write path: saving
+or removing one meant POSTing the entire collection. That is lossy in two ways that never
+surface as an error — a client that omits a row deletes it, and a client holding a stale
+copy silently reverts another tab's edit.
+
+Each now supports full per-item REST.
+
+| Collection | Added |
+|---|---|
+| Agents | `GET`, `PATCH`, `DELETE` on `/api/user/agents/<agent_id>` |
+| Actions | `GET`, `PATCH` on `/api/user/plugins/<action_id>` |
+| Model endpoints | `GET`, `PATCH`, `DELETE` on `/api/user/model-endpoints/<endpoint_id>` |
+
+`POST` to each collection now creates a single record when the body is an object. An array
+body — or, for endpoints, a body carrying an `endpoints` list — still performs the original
+whole-collection replace. That form is **deprecated** and retained only because the classic
+interface saves that way. The V2 client never uses it.
+
+Per-item routes resolve by id first and fall back to name. Ids are what the V2 client sends:
+`GET /api/user/plugins` can merge personal and global actions, which explicitly permits
+duplicate names, and a name is editable in any case.
+
+`PATCH` on a model endpoint merges onto the stored record server-side. The copies the
+browser holds have their secrets stripped, so sending one back wholesale would blank the
+stored credentials.
+
+## File structure
+
+```
+application/single_app/
+    functions_workspace_sections.py     Section availability, shared by both interfaces
+
+application/v2_ui/src/
+    lib/workspaceApi.ts                 Typed client for all eight sections
+    lib/workspaceSections.ts            Grouping and gating, free of React
+    components/workspace/
+        primitives.tsx                  Rows, pills, search, confirm actions
+        useSectionResource.ts           Load, refresh and error state
+    pages/workspace/
+        WorkspacePage.tsx               Shell: header, grouped rail, active section
+        sections.tsx                    Section registry
+        OverviewSection.tsx
+        DocumentsSection.tsx
+        FileSourcesSection.tsx
+        PromptsSection.tsx
+        AgentsSection.tsx
+        ActionsSection.tsx
+        WorkflowsSection.tsx
+        IdentitiesSection.tsx
+        EndpointsSection.tsx
+```
+
+## Using it
+
+Open **My Workspace** in the left rail. The overview lists what is available; selecting a
+group heading's entry opens that section. Sections are real paths — `/workspace/agents`,
+`/workspace/prompts` — so a link to one can be shared or bookmarked.
+
+What each section supports in this release:
+
+| Section | Available now |
+|---|---|
+| Documents | Upload, search, filter by tag, delete |
+| File sources | List, sync now, run history, delete |
+| Prompts | Full create, edit and delete |
+| Agents | List, create, edit name, description and instructions, delete |
+| Actions | List, delete |
+| Workflows | List, run, cancel, run history, delete |
+| Identities | List, delete |
+| Endpoints | List, enable or disable, delete |
+
+## Known limitations
+
+Authoring surfaces that are specific to a connector or a schedule are not rebuilt yet and
+remain in the classic workspace. Each section links to it rather than offering a control
+that does nothing.
+
+- Action configuration, which differs across more than twenty connector types.
+- The workflow designer: tasks, document actions and scheduling.
+- Model endpoint connection details: provider, API versions, authentication, model list.
+- File source configuration, and identity creation with its auth-type-specific fields.
+- Agent model binding, action attachment and assigned knowledge.
+
+## Testing and validation
+
+| Test | Covers |
+|---|---|
+| `functional_tests/test_v2_workspace_sections.py` | Collection key contracts, per-item route registration, bootstrap workspace block, gating parity between the two interfaces, section registry completeness |
+| `functional_tests/test_v2_workspace_sections_logic.mjs` | Section resolution, rail versus overview visibility, grouping order, default selection |
+| `functional_tests/test_personal_resource_per_item_rest.py` | Per-item routes, bulk compatibility, secret cleanup, route decorators |
+| `functional_tests/route_tests/` | Route policy classification for the new routes |
+
+Related fix documentation: `docs/explanation/fixes/PERSONAL_AGENT_DELETE_FIX.md`.
diff --git a/docs/explanation/fixes/PERSONAL_AGENT_DELETE_FIX.md b/docs/explanation/fixes/PERSONAL_AGENT_DELETE_FIX.md
new file mode 100644
index 000000000..c9e761680
--- /dev/null
+++ b/docs/explanation/fixes/PERSONAL_AGENT_DELETE_FIX.md
@@ -0,0 +1,113 @@
+# Personal Agent Delete Returned An Error After Succeeding
+
+## Issue
+
+`DELETE /api/user/agents/<agent_name>` deleted the agent and then answered `400`. The agent
+was gone, but the caller was told the operation had failed.
+
+The classic workspace never hit this, because it does not use the route. `deleteAgent` in
+`workspace_agents.js` fetches the whole agent list, removes one entry and POSTs the
+remainder back — a read-modify-write around a delete endpoint that already existed. That
+workaround is itself lossy: two browser tabs open on the workspace overwrite each other, and
+any agent the client did not know about is deleted.
+
+A second, separate defect: the route performed no governance check. The collection save
+calls `ensure_governance_access('governance_user_agents', ...)`, and so does
+`save_personal_agent`, but neither the delete route nor `delete_personal_agent` did. A user
+governance had denied could still delete their agents.
+
+**Fixed in version:** 0.261.042
+
+## Root cause
+
+The route deleted the agent first and validated afterwards:
+
+```python
+delete_personal_agent(user_id, agent_name)
+log_agent_deletion(...)
+
+remaining_agents = get_personal_agents(user_id)
+if len(remaining_agents) > 0:
+    found = any(a.get('name') == global_selected_name for a in remaining_agents)
+    if not found:
+        return jsonify({'error': 'There must be at least one agent matching the global_selected_agent.'}), 400
+```
+
+`global_selected_name` comes from `settings.get('global_selected_agent', {}).get('name')`.
+When no global agent is configured — the default — it is `None`. Nothing in the remaining
+list equals `None`, so `found` is `False` and the route returns `400`, *after* the delete has
+already been committed.
+
+The condition therefore fired on every delete that left at least one agent behind, in any
+deployment without a global agent configured. It also compared a *personal* agent list
+against a *global* selection, which are not the same set of agents; the equivalent check on
+the collection save is correctly conditioned on `per_user_semantic_kernel` being off.
+
+## Changes
+
+### `application/single_app/route_backend_agents.py`
+
+The guard now runs before anything is deleted, so a refusal means nothing was removed:
+
+```python
+settings = get_settings()
+global_selected_agent = settings.get('global_selected_agent', {}) or {}
+global_selected_name = global_selected_agent.get('name')
+if global_selected_name and agent_name == global_selected_name:
+    return jsonify({'error': 'Cannot delete the agent set as global_selected_agent. ...'}), 400
+
+if not delete_personal_agent(user_id, agent_to_delete.get('id') or agent_name):
+    return jsonify({'error': 'Agent not found.'}), 404
+```
+
+The post-delete block is removed entirely. The pre-delete guard is kept — refusing to delete
+the agent a global selection points at is legitimate — but it is now conditioned on a global
+name actually being configured.
+
+Governance is enforced before the delete:
+
+```python
+try:
+    ensure_governance_access('governance_user_agents', user_id)
+except PermissionError as exc:
+    return jsonify({'error': str(exc)}), 403
+```
+
+The route parameter changed from `<agent_name>` to `<agent_id>` and resolves by id first,
+falling back to name. `delete_personal_agent` already accepted either, so no storage change
+was needed. Name-keyed addressing was fragile: `GET /api/user/agents` can merge personal and
+global agents, which permits duplicate names, and a name is editable.
+
+### Related
+
+`GET` and `PATCH` on `/api/user/agents/<agent_id>` were added alongside the fix, so a client
+no longer has to replace the whole collection to change one agent. The same was done for
+personal actions and personal model endpoints. See
+`docs/explanation/features/V2_MY_WORKSPACE.md`.
+
+## Impact
+
+- Deleting a personal agent through the API now reports success when it succeeds.
+- A user denied by governance can no longer delete personal agents.
+- The V2 interface deletes and edits one agent at a time, so two open tabs no longer
+  overwrite each other.
+- The classic interface is unaffected. Its whole-collection POST still works, and its
+  read-modify-write delete still functions; it is simply no longer necessary.
+
+## Validation
+
+`functional_tests/test_personal_resource_per_item_rest.py` covers both defects
+structurally, rather than by asserting on the text of the fix:
+
+- `test_agent_delete_checks_before_it_deletes` locates the guard and the delete call within
+  the route body and asserts the guard comes first, then asserts no `400` is returned after
+  the delete at all.
+- `test_agent_delete_enforces_governance` asserts `ensure_governance_access` is present and
+  precedes the delete.
+
+Both fail against the previous implementation. Also re-run:
+
+```powershell
+python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py
+python .\functional_tests\test_route_authentication_audit_findings_fix.py
+```
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index ad41289e2..f3a600ab8 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,37 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/features) and [Fixes by Version](https://github.com/microsoft/simplechat/tree/main/docs/explanation/fixes).
 
+### **(v0.261.042)**
+
+#### New Features
+
+*   **My Workspace In The V2 Interface**
+    *   The personal workspace in the new interface previously listed documents and nothing else. It now covers all eight areas the classic workspace does — documents, file sources, prompts, agents, actions, workflows, identities and endpoints.
+    *   **The sections are grouped by what they are for**, rather than presented as eight equal tabs. **Knowledge** is what your assistant can draw on, **Automation** is what it can do, and **Connections** is the shared setup the other two reuse. Identities and endpoints are plumbing that other sections consume, and no longer sit alongside documents as though they were the same kind of thing.
+    *   **An overview page explains how the pieces fit together.** It lists each group with a count of what is in it, one line on what each section is for, and states the relationships plainly: identities are used by file sources and actions, file sources feed documents, documents and actions and endpoints are used by agents, and agents are used by workflows.
+    *   **Sections your administrator has not enabled are named, with the reason.** They appear on the overview greyed out rather than silently vanishing, so a capability that is switched off can no longer be mistaken for one that is broken or missing.
+    *   **Sync is now called File sources**, which is what people go there to set up, and identities are described as saved sign-ins for other systems rather than as your own account.
+    *   Each section is its own address — `/workspace/agents`, `/workspace/prompts` — so a link to one can be bookmarked or shared.
+    *   Prompts support full create, edit and delete. Agents can be created, edited and deleted. Workflows can be run, cancelled and inspected. File sources can be synced on demand with their run history. Connector configuration, the workflow designer and endpoint connection details are still done in the classic workspace, and each section links to it.
+    *   (Ref: V2 interface, My Workspace, `/api/v2/bootstrap`, `functions_workspace_sections.py`)
+
+*   **Per-Item Editing For Personal Agents, Actions And Endpoints**
+    *   Saving or deleting one of these used to rewrite the entire collection. Two browser tabs open on the workspace could overwrite each other's work, and any item a client did not know about was deleted along the way.
+    *   Each now supports editing and removing a single item. The old whole-collection save still works and the classic interface is unaffected.
+    *   Editing a model endpoint no longer risks blanking its stored credentials: only the fields that changed are sent, and the secrets — which are never given to the browser in the first place — are merged in on the server.
+    *   (Ref: `/api/user/agents`, `/api/user/plugins`, `/api/user/model-endpoints`)
+
+#### Bug Fixes
+
+*   **Deleting A Personal Agent Reported An Error After It Had Worked**
+    *   The delete endpoint removed the agent and then answered with an error, so the caller was told the operation failed when it had already succeeded. This happened on any delete that left at least one agent behind, in any deployment without a global agent configured.
+    *   The check that caused it now runs before the delete, so a refusal means nothing was removed.
+    *   (Ref: personal agents, `/api/user/agents`)
+
+*   **Deleting A Personal Agent Skipped Its Governance Check**
+    *   Saving agents checked whether governance policy allowed it; deleting them did not, so a user who had been denied access to personal agents could still delete them. The check is now applied before the agent is removed.
+    *   (Ref: personal agents, governance policy)
+
 ### **(v0.261.041)**
 
 #### New Features
diff --git a/functional_tests/test_personal_resource_per_item_rest.py b/functional_tests/test_personal_resource_per_item_rest.py
new file mode 100644
index 000000000..6850d3b7a
--- /dev/null
+++ b/functional_tests/test_personal_resource_per_item_rest.py
@@ -0,0 +1,282 @@
+#!/usr/bin/env python3
+"""
+Functional test for per-item REST on personal agents, actions and model endpoints.
+
+Version: 0.261.042
+Implemented in: 0.261.042
+
+Before this, saving or removing one of these meant POSTing the entire collection. That is
+lossy in two ways that never surface as an error: a client which omits a row deletes it, and
+a client holding a stale copy silently reverts another tab's edit. This test pins the
+per-item routes that replaced it, and the compatibility branch that keeps the classic
+interface's whole-collection save working.
+
+It also guards two specific defects in the personal agent delete route.
+
+The first is an ordering bug. The route deleted the agent and *then* checked whether the
+remaining agents matched `global_selected_agent`, returning 400 when none did. With that
+setting unset the comparison was against None, so it matched nothing and reported failure
+for a delete that had already happened -- on every delete where any agent remained. The
+classic interface worked around it by never calling the route. The guard now runs before the
+delete, so a refusal means nothing was removed.
+
+The second is a missing authorization check. The collection save calls
+`ensure_governance_access('governance_user_agents', ...)` but the delete did not, and neither
+does `delete_personal_agent`, so a user governance had denied could still delete agents.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = REPO_ROOT / "application" / "single_app"
+
+sys.path.insert(0, str(REPO_ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+def _read(path):
+    return path.read_text(encoding="utf-8")
+
+
+def _function_body(source, name):
+    """Return the source of one top-level or nested def, up to the next def at its indent."""
+    match = re.search(rf"^(\s*)def {re.escape(name)}\(", source, re.MULTILINE)
+    assert match, f"Could not find def {name}("
+    indent = match.group(1)
+    start = match.start()
+    following = re.compile(rf"^{indent}(?:@|def )", re.MULTILINE)
+    next_match = following.search(source, match.end())
+    return source[start : next_match.start() if next_match else len(source)]
+
+
+def test_agent_delete_checks_before_it_deletes():
+    """The guard must precede the delete, so a refusal leaves the agent in place."""
+    print("Testing agent delete ordering...")
+
+    body = _function_body(_read(APP_DIR / "route_backend_agents.py"), "delete_user_agent")
+
+    guard = body.find("global_selected_agent")
+    delete_call = body.find("delete_personal_agent(")
+    assert guard != -1, "The global_selected_agent guard is gone entirely"
+    assert delete_call != -1, "The route no longer deletes anything"
+    assert guard < delete_call, (
+        "The global_selected_agent guard must run before the delete. Checking afterwards is "
+        "what made the route report 400 for work it had already done."
+    )
+
+    # And nothing may refuse the request after the record has been removed.
+    after_delete = body[delete_call:]
+    assert "400" not in after_delete, (
+        "A 400 after the delete tells the caller the operation failed when it succeeded; "
+        "that is the defect this route had."
+    )
+
+    # The specific message from the old post-delete branch must not come back.
+    assert "There must be at least one agent matching" not in body, (
+        "The post-delete global_selected_agent check has returned"
+    )
+
+    print("Agent delete ordering test passed!")
+    return True
+
+
+def test_agent_delete_enforces_governance():
+    """Deleting is as destructive as saving, and the save path checks governance."""
+    print("Testing agent delete governance...")
+
+    body = _function_body(_read(APP_DIR / "route_backend_agents.py"), "delete_user_agent")
+
+    assert "ensure_governance_access('governance_user_agents'" in body, (
+        "The delete route must check governance; delete_personal_agent does not, so "
+        "without this a denied user can still remove agents"
+    )
+    governance = body.find("ensure_governance_access")
+    delete_call = body.find("delete_personal_agent(")
+    assert governance < delete_call, "Governance must be checked before the delete"
+    assert "403" in body, "A governance refusal should answer 403"
+
+    print("Agent delete governance test passed!")
+    return True
+
+
+def test_per_item_routes_resolve_by_id_or_name():
+    """New clients send ids; the classic interface still sends names."""
+    print("Testing identifier resolution...")
+
+    agents = _read(APP_DIR / "route_backend_agents.py")
+    resolver = _function_body(agents, "_find_personal_agent")
+
+    assert "agent.get('id')" in resolver, "Resolution must try the id"
+    assert "agent.get('name')" in resolver, "Resolution must fall back to the name"
+    assert resolver.find("agent.get('id')") < resolver.find("agent.get('name')"), (
+        "The id must be tried first: GET /api/user/agents can merge personal and global "
+        "agents, and names are neither unique across that set nor immutable"
+    )
+
+    # The actions container helper already accepts either, so the route just passes through.
+    actions_helper = _function_body(
+        _read(APP_DIR / "functions_personal_actions.py"), "delete_personal_action"
+    )
+    assert "OR name" in actions_helper, (
+        "delete_personal_action is documented as accepting an id or a name; the route "
+        "relies on that"
+    )
+
+    print("Identifier resolution test passed!")
+    return True
+
+
+def test_post_still_accepts_the_legacy_collection_body():
+    """The classic interface saves the whole list, and must keep working."""
+    print("Testing bulk compatibility...")
+
+    agents = _function_body(_read(APP_DIR / "route_backend_agents.py"), "set_user_agents")
+    plugins = _function_body(_read(APP_DIR / "route_backend_plugins.py"), "set_user_plugins")
+
+    for name, body, creator in (
+        ("agents", agents, "_create_personal_agent"),
+        ("actions", plugins, "_create_personal_action"),
+    ):
+        assert "isinstance(payload, dict)" in body, (
+            f"The {name} POST must detect an object body and create a single record"
+        )
+        assert creator in body, f"The {name} POST must delegate single creates to {creator}"
+        assert "isinstance(payload, list)" in body, (
+            f"The {name} POST must still accept an array body; workspace_agents.js and "
+            f"workspace_plugins.js both save that way"
+        )
+        assert "deprecated" in body.lower(), (
+            f"The {name} bulk form should be documented as deprecated"
+        )
+
+    endpoints = _function_body(
+        _read(APP_DIR / "route_backend_models.py"), "save_user_model_endpoints"
+    )
+    assert '"endpoints" not in data' in endpoints, (
+        "The endpoints POST must distinguish a single endpoint from the legacy "
+        "{'endpoints': [...]} collection body"
+    )
+    assert "merge_model_endpoints_with_existing" in endpoints, (
+        "The collection path must keep its merge, which preserves endpoints the frontend "
+        "cannot see"
+    )
+
+    print("Bulk compatibility test passed!")
+    return True
+
+
+def test_endpoint_delete_cleans_up_secrets():
+    """An endpoint's Key Vault secrets must not outlive it."""
+    print("Testing endpoint secret cleanup...")
+
+    models = _read(APP_DIR / "route_backend_models.py")
+    persist = _function_body(models, "_persist_personal_endpoints")
+
+    assert "keyvault_model_endpoint_delete_helper" in persist, (
+        "Removing an endpoint must delete its stored secrets, or they are orphaned"
+    )
+    assert "keyvault_model_endpoint_cleanup_helper" in persist, (
+        "A changed endpoint's superseded secret must be cleaned up"
+    )
+
+    delete_route = _function_body(models, "delete_user_model_endpoint")
+    assert "ensure_governance_access" in delete_route, "Delete must check governance"
+    assert "_persist_personal_endpoints" in delete_route, (
+        "Delete must go through the shared persistence path so secrets are handled"
+    )
+    assert "404" in delete_route, "Deleting an unknown endpoint should answer 404"
+
+    # The update path must merge server-side, since the client's copy has no secrets in it.
+    patch_route = _function_body(models, "update_user_model_endpoint")
+    assert "merge_model_endpoint_payload" in patch_route, (
+        "PATCH must merge onto the stored endpoint; the values the client holds are "
+        "sanitized, so replacing wholesale would blank the credentials"
+    )
+
+    print("Endpoint secret cleanup test passed!")
+    return True
+
+
+def test_new_routes_carry_the_required_decorators():
+    """Repo policy: every route declares its swagger security and its auth."""
+    print("Testing route decorators...")
+
+    checks = [
+        ("route_backend_agents.py", "/api/user/agents/<agent_id>"),
+        ("route_backend_plugins.py", "/api/user/plugins/<action_id>"),
+        ("route_backend_models.py", "/api/user/model-endpoints/<endpoint_id>"),
+    ]
+
+    for route_file, path in checks:
+        source = _read(APP_DIR / route_file)
+        for match in re.finditer(re.escape(path) + r"['\"],\s*methods=\[[^\]]*\]\)", source):
+            trailing = source[match.end() : match.end() + 400]
+            assert "@swagger_route(" in trailing, (
+                f"{path} in {route_file} is missing @swagger_route"
+            )
+            assert "@login_required" in trailing, f"{path} in {route_file} is missing auth"
+            assert "@user_required" in trailing, (
+                f"{path} in {route_file} is missing @user_required"
+            )
+
+    print("Route decorator test passed!")
+    return True
+
+
+def test_action_delete_is_not_gated_on_the_creation_flag():
+    """Removing an action must stay possible after the capability is switched off."""
+    print("Testing action delete gating...")
+
+    body = _function_body(_read(APP_DIR / "route_backend_plugins.py"), "delete_user_plugin")
+
+    assert '@enabled_required("allow_user_plugins")' not in body, (
+        "Gating delete on allow_user_plugins strands existing actions with no way to "
+        "remove them once an administrator turns the capability off. Creating and editing "
+        "are gated; removing only reduces what is configured."
+    )
+    assert "PermissionError" in body, (
+        "Governance is enforced inside delete_personal_action and must be surfaced"
+    )
+    assert "403" in body, "A governance refusal should answer 403"
+
+    print("Action delete gating test passed!")
+    return True
+
+
+def test_version_is_at_least_implementation_version():
+    """The application version is at or beyond the version that added this."""
+    print("Testing application version...")
+    assert_app_version_at_least("0.261.042")
+    print("Application version test passed!")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_agent_delete_checks_before_it_deletes,
+        test_agent_delete_enforces_governance,
+        test_per_item_routes_resolve_by_id_or_name,
+        test_post_still_accepts_the_legacy_collection_body,
+        test_endpoint_delete_cleans_up_secrets,
+        test_new_routes_carry_the_required_decorators,
+        test_action_delete_is_not_gated_on_the_creation_flag,
+        test_version_is_at_least_implementation_version,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as exc:  # noqa: BLE001 - surface any failure with a traceback
+            print(f"Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_route_authentication_audit_findings_fix.py b/functional_tests/test_route_authentication_audit_findings_fix.py
index c4d47a3ee..d2c046831 100644
--- a/functional_tests/test_route_authentication_audit_findings_fix.py
+++ b/functional_tests/test_route_authentication_audit_findings_fix.py
@@ -16,7 +16,11 @@
 
 ROOT_DIR = Path(__file__).resolve().parents[1]
 APP_DIR = ROOT_DIR / 'application' / 'single_app'
-EXPECTED_VERSION = '0.242.050'
+IMPLEMENTED_VERSION = '0.242.050'
+
+sys.path.insert(0, str(ROOT_DIR / 'functional_tests'))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
 
 
 def _read_text(relative_path):
@@ -175,8 +179,10 @@ def test_active_scope_reads_use_authorization_helpers():
 
 
 def test_config_version_bumped_for_fix():
-    config_source = (APP_DIR / 'config.py').read_text(encoding='utf-8')
-    assert f'VERSION = "{EXPECTED_VERSION}"' in config_source
+    # Compared as "at least", not for equality. An exact match pins the whole repository to
+    # the version that happened to introduce this fix, so every later bump fails a test that
+    # has nothing to do with the change being made.
+    assert_app_version_at_least(IMPLEMENTED_VERSION)
 
 
 def main():
diff --git a/functional_tests/test_v2_api_payload_shapes.py b/functional_tests/test_v2_api_payload_shapes.py
index 05f39feb5..df19101da 100644
--- a/functional_tests/test_v2_api_payload_shapes.py
+++ b/functional_tests/test_v2_api_payload_shapes.py
@@ -42,11 +42,13 @@ def test_workspace_tags_are_treated_as_objects():
         "if the contract changed, update the V2 client to match"
     )
 
-    workspace_page = _read(V2_SRC / "pages" / "WorkspacePage.tsx")
+    # The tag handling moved with the documents list when the workspace page became a
+    # grouped set of sections; the guarantee it encodes is unchanged.
+    workspace_page = _read(V2_SRC / "pages" / "workspace" / "DocumentsSection.tsx")
 
     assert "function tagName(" in workspace_page, (
-        "WorkspacePage must funnel tags through tagName() so an object tag is never "
-        "rendered directly (this caused React error #31)"
+        "The documents section must funnel tags through tagName() so an object tag is "
+        "never rendered directly (this caused React error #31)"
     )
     assert "'name' in tag" in workspace_page, (
         "tagName() must handle the object tag shape returned by /api/documents/tags"
@@ -54,7 +56,8 @@ def test_workspace_tags_are_treated_as_objects():
 
     # The crash was rendering the raw tag as a JSX child. Guard against its return.
     assert re.search(r"\{tag\}", workspace_page) is None, (
-        "WorkspacePage renders a raw tag value as a JSX child; render tagName(tag) instead"
+        "The documents section renders a raw tag value as a JSX child; render "
+        "tagName(tag) instead"
     )
 
     endpoints = _read(V2_SRC / "lib" / "endpoints.ts")
diff --git a/functional_tests/test_v2_workspace_sections.py b/functional_tests/test_v2_workspace_sections.py
new file mode 100644
index 000000000..8ea0ec15b
--- /dev/null
+++ b/functional_tests/test_v2_workspace_sections.py
@@ -0,0 +1,294 @@
+#!/usr/bin/env python3
+"""
+Functional test for the V2 personal workspace sections and the routes behind them.
+
+Version: 0.261.042
+Implemented in: 0.261.042
+
+The V2 workspace is assembled from eight independent capabilities, and two kinds of mistake
+here are invisible at runtime.
+
+The first is a field name. Every one of these routes wraps its collection in a differently
+named key -- `prompts`, `identities`, `sources`, `runs`, `workflows`, `endpoints` -- and two
+of them return a bare array instead. A client reading the wrong key still gets a successful
+response; the section simply renders empty, which is indistinguishable from having nothing
+in it.
+
+The second is gating. Whether a section is available combines plain settings, app-role
+checks and governance policy, and the classic interface computes that in Jinja where the SPA
+cannot see it. If the two ever disagree, one interface shows a section whose endpoints
+refuse every request. That is why both now read the same helper, and why this test pins the
+gates the helper is required to cover.
+"""
+
+import re
+import sys
+from pathlib import Path
+
+REPO_ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = REPO_ROOT / "application" / "single_app"
+V2_SRC = REPO_ROOT / "application" / "v2_ui" / "src"
+
+sys.path.insert(0, str(REPO_ROOT / "functional_tests"))
+
+from test_support.versioning import assert_app_version_at_least  # noqa: E402
+
+
+def _read(path):
+    return path.read_text(encoding="utf-8")
+
+
+def test_collection_keys_match_between_routes_and_client():
+    """Each route's collection key, and the client reading that exact key."""
+    print("Testing workspace collection key contracts...")
+
+    client = _read(V2_SRC / "lib" / "workspaceApi.ts")
+
+    # (route file, the literal the route returns, the key the client must ask for)
+    contracts = [
+        ("route_backend_prompts.py", '"prompts"', "'prompts'"),
+        ("route_backend_workspace_identities.py", '"identities"', "'identities'"),
+        ("route_backend_file_sync.py", '"sources"', "'sources'"),
+        ("route_backend_file_sync.py", '"runs"', "'runs'"),
+        ("route_backend_workflows.py", "'workflows'", "'workflows'"),
+        ("route_backend_models.py", '"endpoints"', "'endpoints'"),
+    ]
+
+    for route_file, server_key, client_key in contracts:
+        source = _read(APP_DIR / route_file)
+        assert server_key in source, f"{route_file} no longer returns {server_key}"
+        assert client_key in client, (
+            f"workspaceApi.ts must read {client_key}; without it the section renders "
+            f"empty even though the request succeeded"
+        )
+
+    print("Collection key contract test passed!")
+    return True
+
+
+def test_per_item_routes_exist_for_agents_actions_and_endpoints():
+    """The three collections that previously had no per-item write path."""
+    print("Testing per-item route registration...")
+
+    expectations = [
+        ("route_backend_agents.py", "/api/user/agents/<agent_id>", ["GET", "PATCH", "DELETE"]),
+        ("route_backend_plugins.py", "/api/user/plugins/<action_id>", ["GET", "PATCH", "DELETE"]),
+        (
+            "route_backend_models.py",
+            "/api/user/model-endpoints/<endpoint_id>",
+            ["GET", "PATCH", "DELETE"],
+        ),
+    ]
+
+    for route_file, path, methods in expectations:
+        source = _read(APP_DIR / route_file)
+        for method in methods:
+            pattern = re.escape(path) + r"['\"],\s*methods=\[['\"]" + method + r"['\"]\]"
+            assert re.search(pattern, source), (
+                f"{route_file} is missing {method} {path}. Without it the client has to "
+                f"round-trip the whole collection to change one row."
+            )
+
+    print("Per-item route registration test passed!")
+    return True
+
+
+def test_client_never_posts_a_whole_collection():
+    """The deprecated bulk form must not creep back into the V2 client."""
+    print("Testing that the client uses per-item writes...")
+
+    client = _read(V2_SRC / "lib" / "workspaceApi.ts")
+
+    # A bare array body to either of these is the whole-collection replace: any row the
+    # client did not know about is deleted, and a stale copy reverts another tab's edit.
+    for collection in ("/api/user/agents", "/api/user/plugins"):
+        bulk = re.search(
+            re.escape(f"api.post<") + r"[^>]*>\(\s*'" + re.escape(collection) + r"',\s*\[",
+            client,
+        )
+        assert not bulk, f"workspaceApi.ts posts an array to {collection}"
+
+    assert "endpoints: [" not in client, (
+        "workspaceApi.ts must not send the whole endpoints list; the copies it holds have "
+        "their secrets stripped, so posting them back blanks the stored credentials"
+    )
+
+    # And the per-item calls it should be making instead.
+    for expected in (
+        "api.patch<WorkspaceAgent>(`/api/user/agents/",
+        "api.delete<{ success?: boolean }>(`/api/user/agents/",
+        "api.delete<{ success?: boolean }>(`/api/user/plugins/",
+        "/api/user/model-endpoints/",
+    ):
+        assert expected in client, f"workspaceApi.ts should call {expected}"
+
+    print("Per-item write test passed!")
+    return True
+
+
+def test_bootstrap_reports_workspace_sections():
+    """The SPA cannot derive these from `features`, so bootstrap must send them."""
+    print("Testing bootstrap workspace block...")
+
+    bootstrap = _read(APP_DIR / "route_backend_v2.py")
+
+    assert '"workspace": workspace' in bootstrap, (
+        "The bootstrap payload no longer carries a workspace block"
+    )
+    assert "build_workspace_section_availability" in bootstrap, (
+        "Bootstrap must use the shared helper rather than recomputing the gates"
+    )
+
+    # _build_feature_flags forwards only `enable_*` booleans, so these four never reach the
+    # SPA through `features` and the workspace block is the only route they have.
+    flags = _read(APP_DIR / "functions_workspace_sections.py")
+    for key in (
+        "per_user_semantic_kernel",
+        "allow_user_agents",
+        "allow_user_plugins",
+        "allow_user_custom_endpoints",
+    ):
+        assert key in flags, f"The section helper no longer consults {key}"
+        assert not key.startswith("enable_"), (
+            f"{key} would reach the SPA through features if it were an enable_ key; this "
+            f"assertion exists to catch a rename that makes the workspace block redundant"
+        )
+
+    client = _read(V2_SRC / "lib" / "workspaceSections.ts")
+    assert "availability?.sections" in client, (
+        "The client must read the server's per-section verdicts"
+    )
+
+    print("Bootstrap workspace block test passed!")
+    return True
+
+
+def test_gating_is_shared_between_the_two_interfaces():
+    """One helper, used by both, so a capability cannot be gated differently in each."""
+    print("Testing gating parity...")
+
+    helper = _read(APP_DIR / "functions_workspace_sections.py")
+    classic = _read(APP_DIR / "route_frontend_workspace.py")
+
+    assert "build_workspace_section_availability" in classic, (
+        "The classic workspace route must read the shared helper"
+    )
+    assert "is_file_sync_enabled_for_user" not in classic, (
+        "The classic route recomputes file sync availability; that is the drift the shared "
+        "helper exists to prevent"
+    )
+
+    # Every gate the classic template branches on has to be represented in the helper.
+    for gate in (
+        "enable_semantic_kernel",
+        "per_user_semantic_kernel",
+        "allow_user_agents",
+        "allow_user_plugins",
+        "allow_user_custom_endpoints",
+        "enable_multi_model_endpoints",
+        "is_file_sync_enabled_for_user",
+        "is_user_workflows_enabled_for_user",
+        "governance_user_agents",
+        "governance_user_actions",
+        "governance_user_endpoints",
+    ):
+        assert gate in helper, f"The section helper no longer accounts for {gate}"
+
+    # Identities are available when either of the two things that consume them is.
+    assert "file_sync_enabled or semantic_kernel_enabled" in helper, (
+        "Identities exist to serve file sync and actions, and the classic template gates "
+        "them on `file_sync_enabled or settings.enable_semantic_kernel`"
+    )
+
+    print("Gating parity test passed!")
+    return True
+
+
+def test_section_ids_agree_between_server_and_client():
+    """A section the client renders but the server never reports is permanently hidden."""
+    print("Testing section id agreement...")
+
+    helper = _read(APP_DIR / "functions_workspace_sections.py")
+    server_ids = set(
+        re.findall(r'"(\w+)": "(?:knowledge|automation|connections)"', helper)
+    )
+    assert server_ids, "Could not read the server's section groups"
+
+    registry = _read(V2_SRC / "pages" / "workspace" / "sections.tsx")
+    client_ids = set(re.findall(r"^\s{8}id: '([a-z_]+)',", registry, re.MULTILINE))
+    assert client_ids, "Could not read the client's section registry"
+
+    assert client_ids == server_ids, (
+        f"The section registries disagree. Only on the client: "
+        f"{sorted(client_ids - server_ids)}. Only on the server: "
+        f"{sorted(server_ids - client_ids)}. A client-only section can never be enabled, "
+        f"and a server-only one is never rendered."
+    )
+
+    print("Section id agreement test passed!")
+    return True
+
+
+def test_every_registered_section_has_a_component():
+    """A section in the registry with no component would crash the page on selection."""
+    print("Testing section registry...")
+
+    workspace_dir = V2_SRC / "pages" / "workspace"
+    registry = _read(workspace_dir / "sections.tsx")
+
+    components = re.findall(r"<(\w+Section)\b", registry)
+    assert len(set(components)) == 8, (
+        f"Expected eight section components, found {sorted(set(components))}"
+    )
+
+    sources = list(workspace_dir.glob("*.tsx"))
+    for component in set(components):
+        assert f"import {{ {component} }}" in registry, f"{component} is not imported"
+        assert any(f"export function {component}" in _read(path) for path in sources), (
+            f"No component named {component} exists"
+        )
+
+    # Each section needs the sentence the overview shows for it, which is the only
+    # explanation a user gets for a section their administrator has switched off.
+    blurbs = re.findall(r"blurb: '([^']+)'", registry)
+    assert len(blurbs) == 8, f"Every section needs a blurb; found {len(blurbs)}"
+    assert len(set(blurbs)) == 8, "Section blurbs must be distinct, not boilerplate"
+
+    print("Section registry test passed!")
+    return True
+
+
+def test_version_is_at_least_implementation_version():
+    """The application version is at or beyond the version that added this."""
+    print("Testing application version...")
+    assert_app_version_at_least("0.261.042")
+    print("Application version test passed!")
+    return True
+
+
+if __name__ == "__main__":
+    tests = [
+        test_collection_keys_match_between_routes_and_client,
+        test_per_item_routes_exist_for_agents_actions_and_endpoints,
+        test_client_never_posts_a_whole_collection,
+        test_bootstrap_reports_workspace_sections,
+        test_gating_is_shared_between_the_two_interfaces,
+        test_section_ids_agree_between_server_and_client,
+        test_every_registered_section_has_a_component,
+        test_version_is_at_least_implementation_version,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        try:
+            results.append(bool(test()))
+        except Exception as exc:  # noqa: BLE001 - surface any failure with a traceback
+            print(f"Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    print(f"\nResults: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if all(results) else 1)
diff --git a/functional_tests/test_v2_workspace_sections_logic.mjs b/functional_tests/test_v2_workspace_sections_logic.mjs
new file mode 100644
index 000000000..3778d2e5f
--- /dev/null
+++ b/functional_tests/test_v2_workspace_sections_logic.mjs
@@ -0,0 +1,214 @@
+// test_v2_workspace_sections_logic.mjs
+//
+// Runtime test for the V2 personal workspace section resolution.
+// Version: 0.261.042
+// Implemented in: 0.261.042
+//
+// The companion test, test_v2_workspace_sections.py, asserts that the client reads the field
+// names the routes actually return. That is a source assertion: it proves the wiring, not the
+// behaviour.
+//
+// This file executes the gating itself, because getting it wrong fails quietly in both
+// directions. Showing a section the server did not authorise produces a page whose every
+// request is refused, and hiding one it did authorise looks identical to the capability not
+// existing -- which is the confusion this whole redesign is meant to remove. The default
+// selection matters for the same reason: a bookmark to a section that has since been turned
+// off must land somewhere sensible rather than on a blank pane.
+//
+// Run directly with `node functional_tests/test_v2_workspace_sections_logic.mjs`. Requires
+// Node 22.6 or newer, which strips the TypeScript types so the real module is imported.
+
+import assert from 'node:assert/strict';
+import {
+    WORKSPACE_GROUPS,
+    defaultSectionId,
+    groupWorkspaceSections,
+    hasAnyWorkspaceSection,
+    navigableSections,
+    resolveWorkspaceSections,
+} from '../application/v2_ui/src/lib/workspaceSections.ts';
+
+const checks = [];
+function check(name, fn) {
+    checks.push([name, fn]);
+}
+
+const DESCRIPTORS = [
+    { id: 'documents', group: 'knowledge' },
+    { id: 'sync', group: 'knowledge' },
+    { id: 'prompts', group: 'knowledge' },
+    { id: 'agents', group: 'automation' },
+    { id: 'actions', group: 'automation' },
+    { id: 'workflows', group: 'automation' },
+    { id: 'identities', group: 'connections' },
+    { id: 'endpoints', group: 'connections' },
+];
+
+/** Build an availability payload of the shape /api/v2/bootstrap returns. */
+function availability(overrides = {}) {
+    const sections = {};
+    for (const descriptor of DESCRIPTORS) {
+        sections[descriptor.id] = {
+            enabled: true,
+            reason: null,
+            group: descriptor.group,
+        };
+    }
+    for (const [id, value] of Object.entries(overrides)) {
+        sections[id] = { ...sections[id], ...value };
+    }
+    return { enabled: true, sections };
+}
+
+/* ------------------------------- resolution -------------------------------- */
+
+check('a section the server enabled is available and carries no reason', () => {
+    const resolved = resolveWorkspaceSections(DESCRIPTORS, availability());
+    assert.equal(resolved.length, DESCRIPTORS.length);
+    for (const entry of resolved) {
+        assert.equal(entry.enabled, true);
+        assert.equal(entry.reason, null);
+    }
+});
+
+check('a disabled section keeps the server reason', () => {
+    const resolved = resolveWorkspaceSections(
+        DESCRIPTORS,
+        availability({
+            agents: { enabled: false, reason: 'Personal agents are not enabled for your account.' },
+        }),
+    );
+    const agents = resolved.find((entry) => entry.section.id === 'agents');
+    assert.equal(agents.enabled, false);
+    assert.equal(agents.reason, 'Personal agents are not enabled for your account.');
+});
+
+check('a section the server never mentioned fails closed', () => {
+    // Failing open would render a section whose every endpoint refuses the request, which
+    // reads as the feature being broken rather than as it being unavailable.
+    const partial = { enabled: true, sections: { documents: { enabled: true, reason: null } } };
+    const resolved = resolveWorkspaceSections(DESCRIPTORS, partial);
+    const agents = resolved.find((entry) => entry.section.id === 'agents');
+    assert.equal(agents.enabled, false);
+    assert.ok(agents.reason, 'an unmentioned section must still explain itself');
+});
+
+check('a missing payload disables everything rather than throwing', () => {
+    for (const payload of [null, undefined, {}]) {
+        const resolved = resolveWorkspaceSections(DESCRIPTORS, payload);
+        assert.equal(resolved.length, DESCRIPTORS.length);
+        assert.equal(hasAnyWorkspaceSection(resolved), false);
+    }
+});
+
+/* --------------------------------- the rail --------------------------------- */
+
+check('the rail carries only enabled sections', () => {
+    const resolved = resolveWorkspaceSections(
+        DESCRIPTORS,
+        availability({
+            sync: { enabled: false, reason: 'File sync is not enabled for your account.' },
+            endpoints: { enabled: false, reason: 'Not enabled.' },
+        }),
+    );
+    const ids = navigableSections(resolved).map((entry) => entry.section.id);
+    assert.ok(!ids.includes('sync'));
+    assert.ok(!ids.includes('endpoints'));
+    assert.ok(ids.includes('documents'));
+    assert.equal(ids.length, DESCRIPTORS.length - 2);
+});
+
+check('every disabled section still reaches the overview', () => {
+    // The overview is the only place a switched-off section is accounted for, so it has to
+    // receive all of them -- that is what the rail deliberately drops.
+    const resolved = resolveWorkspaceSections(
+        DESCRIPTORS,
+        availability({ agents: { enabled: false, reason: 'Not enabled.' } }),
+    );
+    const overviewIds = groupWorkspaceSections(resolved).flatMap((view) =>
+        view.sections.map((entry) => entry.section.id),
+    );
+    assert.equal(overviewIds.length, DESCRIPTORS.length);
+    assert.ok(overviewIds.includes('agents'));
+});
+
+/* -------------------------------- grouping ---------------------------------- */
+
+check('sections are grouped in the declared order', () => {
+    const resolved = resolveWorkspaceSections(DESCRIPTORS, availability());
+    const groups = groupWorkspaceSections(resolved);
+    assert.deepEqual(
+        groups.map((view) => view.group.id),
+        ['knowledge', 'automation', 'connections'],
+    );
+    assert.deepEqual(
+        groups[0].sections.map((entry) => entry.section.id),
+        ['documents', 'sync', 'prompts'],
+    );
+});
+
+check('an empty group is dropped rather than rendered as a bare heading', () => {
+    const resolved = resolveWorkspaceSections(
+        [
+            { id: 'documents', group: 'knowledge' },
+            { id: 'agents', group: 'automation' },
+        ],
+        availability(),
+    );
+    const groups = groupWorkspaceSections(navigableSections(resolved));
+    assert.deepEqual(
+        groups.map((view) => view.group.id),
+        ['knowledge', 'automation'],
+    );
+});
+
+check('every group has a label and a blurb', () => {
+    for (const group of WORKSPACE_GROUPS) {
+        assert.ok(group.label, `${group.id} needs a label`);
+        assert.ok(group.blurb, `${group.id} needs a blurb`);
+    }
+});
+
+/* ---------------------------- default selection ----------------------------- */
+
+check('a requested section is honoured when it is enabled', () => {
+    const resolved = resolveWorkspaceSections(DESCRIPTORS, availability());
+    assert.equal(defaultSectionId(resolved, 'workflows'), 'workflows');
+});
+
+check('a requested section that is off falls back to the first available one', () => {
+    const resolved = resolveWorkspaceSections(
+        DESCRIPTORS,
+        availability({
+            documents: { enabled: false, reason: 'Not enabled.' },
+            sync: { enabled: false, reason: 'Not enabled.' },
+            agents: { enabled: false, reason: 'Not enabled.' },
+        }),
+    );
+    assert.equal(defaultSectionId(resolved, 'agents'), 'prompts');
+});
+
+check('nothing enabled yields no default rather than an arbitrary one', () => {
+    const resolved = resolveWorkspaceSections(DESCRIPTORS, { enabled: true, sections: {} });
+    assert.equal(defaultSectionId(resolved, 'documents'), null);
+});
+
+/* ----------------------------------- runner ---------------------------------- */
+
+let passed = 0;
+let failed = 0;
+
+for (const [name, fn] of checks) {
+    try {
+        await fn();
+        console.log(`ok   ${name}`);
+        passed += 1;
+    } catch (error) {
+        console.log(`FAIL ${name}`);
+        console.log(`     ${error.message}`);
+        failed += 1;
+    }
+}
+
+console.log(`\n${passed}/${passed + failed} runtime checks passed`);
+process.exit(failed > 0 ? 1 : 0);