diff --git a/.github/scripts/build-ci-matrix.js b/.github/scripts/build-ci-matrix.js
index 3331ff6046..fecd477e82 100644
--- a/.github/scripts/build-ci-matrix.js
+++ b/.github/scripts/build-ci-matrix.js
@@ -18,6 +18,8 @@
  *       emitted. With an overlay manifest, a sibling smoke_config.ent.json (same dir as
  *       the overlay) refines selection for ENT shards — folder_paths and path lists
  *       concatenate onto the base smoke config, core_shards/always_run replace it.
+ *   ... --only-shards <a,b>                             # manual run: emit only these testfolders;
+ *       an unknown name dies, an empty list emits the full matrix.
  *
  * The base (OSS tests/ui-testing/ci-matrix/ci_matrix.json) is the ONLY place shared shards are
  * listed. ENT never re-lists shared specs — its overlay (ci_matrix.ent.json) carries
@@ -197,9 +199,18 @@ if (selectIdx !== -1) {
   if (!changedFilesPath) die("--select-for-changes requires a path to a changed-files list");
   args.splice(selectIdx, 2);
 }
+const onlyIdx = args.indexOf("--only-shards");
+let onlyShards = null;
+if (onlyIdx !== -1) {
+  if (args[onlyIdx + 1] === undefined) die("--only-shards requires a comma-separated list of testfolder names");
+  onlyShards = [...new Set(args[onlyIdx + 1].split(",").map((s) => s.trim()).filter(Boolean))];
+  args.splice(onlyIdx, 2);
+  if (onlyShards.length === 0) onlyShards = null;
+}
+if (onlyShards && changedFilesPath) die("--only-shards and --select-for-changes cannot be combined");
 const [basePath, overlayPath] = args;
 if (!basePath) {
-  die("usage: build-ci-matrix.js <base.json> [overlay.json] [--select-for-changes <changed.txt>]");
+  die("usage: build-ci-matrix.js <base.json> [overlay.json] [--select-for-changes <changed.txt> | --only-shards <a,b>]");
 }
 
 const base = readJson(basePath);
@@ -359,6 +370,15 @@ if (changedFilesPath) {
     log(`smoke: falling back to full matrix (${runnable.length} shards)`);
   }
 }
+if (onlyShards) {
+  // A typo must fail the run, never quietly run fewer shards than were asked for.
+  const unknown = onlyShards.filter((f) => !runnable.some((s) => s.testfolder === f));
+  if (unknown.length) {
+    die(`--only-shards names no runnable shard: ${unknown.join(", ")} (known: ${runnable.map((s) => s.testfolder).join(", ")})`);
+  }
+  emitted = runnable.filter((s) => onlyShards.includes(s.testfolder));
+  log(`only-shards: ${emitted.length}/${runnable.length} shards — ${emitted.map((s) => s.testfolder).join(", ")}`);
+}
 
 // Emit ONLY the fields the CI matrix consumes — disabled/_comment/notes are stripped,
 // so turned-off specs never reach `npx playwright test`.
diff --git a/.github/scripts/build-ci-matrix.test.js b/.github/scripts/build-ci-matrix.test.js
index dfd1ad978a..4dd864a83e 100644
--- a/.github/scripts/build-ci-matrix.test.js
+++ b/.github/scripts/build-ci-matrix.test.js
@@ -158,6 +158,23 @@ test("selection refuses to run for non-pull_request events", () => {
   );
 });
 
+test("only-shards emits exactly the named shards and dies on an unknown name", () => {
+  const only = (list, extra = []) =>
+    JSON.parse(
+      execFileSync("node", [SCRIPT, BASE, "--only-shards", list, ...extra], {
+        encoding: "utf8",
+        env: { ...process.env, GITHUB_EVENT_NAME: "workflow_dispatch" },
+        stdio: ["ignore", "pipe", "pipe"],
+      })
+    ).include.map((s) => s.testfolder);
+  assert.deepStrictEqual(only(" RUM-Token, Org ,RUM-Token"), ["Org", "RUM-Token"]);
+  assert.strictEqual(only("").length, FULL_COUNT);
+  assert.throws(() => only("RUM-Token,No-Such-Shard"), /names no runnable shard: No-Such-Shard/);
+  const changed = path.join(TMP, "only-changed.txt");
+  fs.writeFileSync(changed, "web/src/app.ts\n");
+  assert.throws(() => only("Org", ["--select-for-changes", changed]), /cannot be combined/);
+});
+
 test("config errors die eagerly, even when the changed file is global", () => {
   const shard = { testfolder: "X", actual_folder: "X", run_files: ["a.spec.js"] };
   const goodPaths = { folder_paths: { X: ["web/x/**"] }, global_paths: ["web/global/**"] };
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 3bd77dea95..5989ab16a4 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -14,9 +14,18 @@ on:
   merge_group:
   schedule:
     - cron: '30 20 * * *'  # 2:00 AM IST
+  # Manual run on any branch (the "Use workflow from" ref); no PR, label or path filter applies.
+  workflow_dispatch:
+    inputs:
+      shards:
+        description: "Comma-separated testfolder names from tests/ui-testing/ci-matrix/ci_matrix.json (empty = all shards)"
+        required: false
+        default: ""
+        type: string
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || github.ref }}
+  # A manual run gets its own group so it never cancels, or is cancelled by, a PR, queue or nightly run.
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.merge_group.head_ref || (github.event_name == 'workflow_dispatch' && format('dispatch-{0}', github.run_id)) || github.ref }}
   # Only a new commit cancels: a cancelled same-SHA run leaves a failed required summary that a newer run cannot clear.
   cancel-in-progress: ${{ github.event_name != 'pull_request' || github.event.action == 'synchronize' }}
 
@@ -118,6 +127,12 @@ jobs:
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
           fi
+      # Rejects an unknown shard name here, before build_binary spends a runner on it.
+      - name: Validate requested shards
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          SHARDS: ${{ inputs.shards }}
+        run: node .github/scripts/build-ci-matrix.js tests/ui-testing/ci-matrix/ci_matrix.json --only-shards "$SHARDS" > /dev/null
       - id: check
         env:
           EVENT_NAME: ${{ github.event_name }}
@@ -127,6 +142,8 @@ jobs:
         run: |
           if [ "$EVENT_NAME" = "schedule" ]; then
             echo "has_changes=$([ "$MAIN_CHANGED" = "false" ] && echo false || echo true)" >> "$GITHUB_OUTPUT"
+          elif [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
           elif [ "$HAS_CHANGES" = "true" ] || echo " $CHANGED_WORKFLOWS " | grep -q ' playwright.yml '; then
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           else
@@ -315,6 +332,7 @@ jobs:
           HAS_FULL_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'e2e-full') || github.event.pull_request.auto_merge != null }}
           SMOKE_DISABLED: ${{ vars.PW_SMOKE_DISABLED }}
           BASE_REF: ${{ github.base_ref }}
+          SHARDS: ${{ inputs.shards }}
         run: |
           SMOKE_DISABLED=$(echo "$SMOKE_DISABLED" | tr '[:upper:]' '[:lower:]')
           SELECT_ARGS=""
@@ -330,7 +348,7 @@ jobs:
             fi
           fi
           # || true: under bash -e a die() would abort before the log below ever prints.
-          MATRIX=$(node .github/scripts/build-ci-matrix.js tests/ui-testing/ci-matrix/ci_matrix.json $SELECT_ARGS 2> /tmp/pw-select-log.txt) || true
+          MATRIX=$(node .github/scripts/build-ci-matrix.js tests/ui-testing/ci-matrix/ci_matrix.json $SELECT_ARGS --only-shards "$SHARDS" 2> /tmp/pw-select-log.txt) || true
           cat /tmp/pw-select-log.txt >&2
           if [ -z "$MATRIX" ]; then echo "::error::matrix generation failed (see build-ci-matrix log above)"; exit 1; fi
           echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
@@ -339,7 +357,7 @@ jobs:
           # Durable record of what ran and why, visible from the PR checks page.
           {
             echo "### Playwright shard selection"
-            echo "Mode: $([ -n "$SELECT_ARGS" ] && echo "smoke (changed-path selection)" || echo "full matrix")"
+            echo "Mode: $([ -n "$SELECT_ARGS" ] && echo "smoke (changed-path selection)" || { [ -n "$SHARDS" ] && echo "chosen shards (manual run)"; } || echo "full matrix")"
             echo '```'
             echo "$COUNT"
             cat /tmp/pw-select-log.txt
diff --git a/scripts/translations/.translation_state.json b/scripts/translations/.translation_state.json
index 9e528430ed..ca7c686ff2 100644
--- a/scripts/translations/.translation_state.json
+++ b/scripts/translations/.translation_state.json
@@ -252,6 +252,22 @@
     "feature_traces": "998741a58ed2b411",
     "feature_vrl_functions": "4484dd94e9355480",
     "feature_workload_management": "8004f04c30d8bddc",
+    "features": "5697d03daef4de9c",
+    "features_all_unlocked": "0791a3840eb6061a",
+    "features_filter_all": "a52ace420f2175d0",
+    "features_filter_free": "f411a1fb62758b4c",
+    "features_filter_new": "18fdd549b2ed367a",
+    "features_free_heading": "5892004a2a606ee5",
+    "features_group_heading": "98bb11ae86a0c557",
+    "features_missing": "694943b3db420a2e",
+    "features_new": "d9fe8aa562864fe0",
+    "features_no_match": "c7655586749bb9b3",
+    "features_none": "6b474f2c0cba33e7",
+    "features_paid_ratio": "3257b4364ee32149",
+    "features_request_access": "22d6edf4b21d5e25",
+    "features_search": "55e327604647ce88",
+    "features_summary": "5d2957d8f8c9d8e7",
+    "features_unlocked": "531c7b28abf27600",
     "foreverNoLimits": "c4e4f35814b1022b",
     "fullyManaged": "49964f86a467ca7b",
     "gbPerDay": "dd9d1b63afeb0945",
@@ -7768,6 +7784,7 @@
     "dataStreamingInProgress": "033dae5dca78d269",
     "dateRangeCopied": "f6572e6cc0308a61",
     "dateRangePasteBlocked": "fd89888bc86ea6aa",
+    "dateRangePasteEmpty": "76b9d6f9884dc752",
     "dateRangePasteError": "2c748bcb6075304e",
     "dateRangePasted": "3e15b3f669c459e6",
     "datetimeMessage": "dfe7d74839c7b8b0",
@@ -13059,6 +13076,19 @@
     "tabLabel": "cb702378f31507ef",
     "title": "2a932f90172e99ea"
   },
+  "featureLock": {
+    "bannerMessage": "2ad54d7dcf939937",
+    "bannerMessageGeneric": "9e4736ff1b60331d",
+    "contactSales": "604abea32b499a4c",
+    "description": "052f7504abd2c39a",
+    "headerLocked": "ce0f1697c8a3a6d5",
+    "routeTitle": "694943b3db420a2e",
+    "thisFeature": "2598604c06f0d223",
+    "title": "84027eb92891f1fd",
+    "toastMessage": "b17241a153486b9c",
+    "toastMessageGeneric": "4cf1f345d3caeb96",
+    "toastTitle": "feff10da75dad3ed"
+  },
   "fleet": {
     "addCollector": "6d30a69cb01ed55a",
     "audit": {
@@ -13199,6 +13229,7 @@
       "restart": "6b983a81e5e8099e",
       "restartManyTitle": "b48d3498ba6feded",
       "restartMessage": "22ee1481ad969aff",
+      "restartOffline": "35842abc83dff75b",
       "restartQueued": "43da4197b31c94b2",
       "restartUnsupported": "322b4fd3d40b0ff7",
       "search": "773656193742d0b1",
@@ -13534,7 +13565,7 @@
       "confirmFixForward": "6e986df0401cda4a",
       "confirmResume": "323c118fa4613787",
       "confirmRollback": "ad34d76a7f53f6b5",
-      "confirmRollbackNoStable": "76cba5181ffc44a2",
+      "confirmRollbackNoStable": "5b00aa2620aa662d",
       "confirmSkip": "fbf2627372d3e0cc",
       "confirmed": "fe00b67b6dd1143f",
       "emptyFleet": "40e87c8e8e200c76",
@@ -13595,6 +13626,7 @@
       "phaseStopped": "1a4f630ac1b69fd0",
       "phaseTimedOut": "9718cc761cfd5810",
       "phaseTimeoutNote": "f11dc4d3138e81ac",
+      "phaseTimeoutNoteSeconds": "fafc2b0d6a049798",
       "phaseVerifying": "a7d4a9f301edaa61",
       "phases": "b4b0b75a774761b3",
       "pickConfig": "90ea303d63b6e1b9",
@@ -13661,8 +13693,8 @@
       "noAccess": "cb92165578c84ffb",
       "offlineHeartbeats": "b82c0b4fc3ceead6",
       "offlineHeartbeatsHelp": "91687a5a34666ebf",
-      "offlineRatio": "ab13785c48fe3a97",
-      "offlineRatioHelp": "8fa2bcd13b66f2f3",
+      "offlineRatio": "98affbf40cf01c0c",
+      "offlineRatioHelp": "fcf7765ecca25ef0",
       "outOfRange": "f9a9c12c180ebfe6",
       "phaseTimeout": "47d919e06d87345e",
       "phaseTimeoutHelp": "019f8feb0a24eaa2",
@@ -20331,8 +20363,14 @@
     "allClear": "22d352f617758292",
     "allClearDesc": "bfe3044f55b21533",
     "allClearDescScoped": "7c66a0cc083a98ba",
+    "allClearPartial": "f5a637211cc64316",
+    "allClearPartialDesc": "e5ed97f9af61f860",
     "anomalyDetectedDescription": "67a554a9305c968d",
     "anomalyDetectedTitle": "42b3e5f78e8b2967",
+    "areaAlerts": "f62e9267d196c761",
+    "areaAnomalies": "a0a660cc9daa76b9",
+    "areaIncidents": "bfe868931580fb3b",
+    "areaServices": "604dce445e326d95",
     "colErrorRate": "33a224722fc7b1e4",
     "colLatency": "e0e7d293043c8cf6",
     "colReqs": "61985debc6417c53",
diff --git a/src/api/http/src/handler/http/router/mod.rs b/src/api/http/src/handler/http/router/mod.rs
index d13a542c10..ec936b404f 100644
--- a/src/api/http/src/handler/http/router/mod.rs
+++ b/src/api/http/src/handler/http/router/mod.rs
@@ -2398,6 +2398,11 @@ fn oncall_routes(router: Router) -> Router {
             "/{org_id}/oncall/teams",
             get(oncall::list_teams).post(oncall::create_team),
         )
+        // A literal, so axum routes it here rather than to `/teams/{team_id}`.
+        .route(
+            "/{org_id}/oncall/teams/context",
+            get(oncall::list_team_context),
+        )
         .route(
             "/{org_id}/oncall/teams/{team_id}",
             get(oncall::get_team)
@@ -2520,6 +2525,11 @@ fn oncall_routes(router: Router) -> Router {
             "/{org_id}/oncall/responses/{response_id}/escalation",
             get(oncall::get_escalation_progress),
         )
+        // A literal, so axum routes it here rather than to `/responses/{response_id}`.
+        .route(
+            "/{org_id}/oncall/responses/escalation",
+            get(oncall::list_escalation_progress),
+        )
         .route(
             "/{org_id}/oncall/responses/{response_id}/prior-causes",
             get(oncall::get_prior_causes),
@@ -5400,10 +5410,12 @@ mod tests {
             "GET /{org_id}/mcp",
             "GET /{org_id}/oncall/incidents/{incident_id}/responses",
             "GET /{org_id}/oncall/responses",
+            "GET /{org_id}/oncall/responses/escalation",
             "GET /{org_id}/oncall/responses/{response_id}",
             "GET /{org_id}/oncall/responses/{response_id}/escalation",
             "GET /{org_id}/oncall/responses/{response_id}/history",
             "GET /{org_id}/oncall/teams",
+            "GET /{org_id}/oncall/teams/context",
             "GET /{org_id}/oncall/teams/{team_id}",
             "GET /{org_id}/oncall/teams/{team_id}/members",
             "GET /{org_id}/oncall/teams/{team_id}/on-call",
diff --git a/src/api/http/src/handler/http/router/openapi.rs b/src/api/http/src/handler/http/router/openapi.rs
index 7abd326ed4..09f53d7827 100644
--- a/src/api/http/src/handler/http/router/openapi.rs
+++ b/src/api/http/src/handler/http/router/openapi.rs
@@ -1312,6 +1312,7 @@ pub struct ApiDoc;
     openobserve_api_management::request::oncall::handoff_response,
     openobserve_api_management::request::oncall::list_coverage_gaps,
     openobserve_api_management::request::oncall::list_deliveries,
+    openobserve_api_management::request::oncall::list_escalation_progress,
     openobserve_api_management::request::oncall::list_members,
     openobserve_api_management::request::oncall::list_my_deliveries,
     openobserve_api_management::request::oncall::list_my_teams,
@@ -1322,6 +1323,7 @@ pub struct ApiDoc;
     openobserve_api_management::request::oncall::list_responses_for_incident,
     openobserve_api_management::request::oncall::list_schedule_presets,
     openobserve_api_management::request::oncall::list_team_config_risks,
+    openobserve_api_management::request::oncall::list_team_context,
     openobserve_api_management::request::oncall::list_teams,
     openobserve_api_management::request::oncall::list_unavailability,
     openobserve_api_management::request::oncall::list_unrouted_signals,
diff --git a/src/api/management/src/request/alerts/ack.rs b/src/api/management/src/request/alerts/ack.rs
index 040977f0b0..2d2ac2ec80 100644
--- a/src/api/management/src/request/alerts/ack.rs
+++ b/src/api/management/src/request/alerts/ack.rs
@@ -291,7 +291,7 @@ pub(crate) async fn act_on(
     verb: Verb,
     source: AckSource,
 ) -> Response {
-    if let Err(e) = ack::authorize_problem(problem, actor, Act::Ack).await {
+    if let Err(e) = ack::authorize_problem(problem, actor, Act::from(verb)).await {
         return error_response(e);
     }
     match act(problem, actor, verb, source).await {
diff --git a/src/api/management/src/request/fleet/mod.rs b/src/api/management/src/request/fleet/mod.rs
index ee1f88a4bf..874776b79d 100644
--- a/src/api/management/src/request/fleet/mod.rs
+++ b/src/api/management/src/request/fleet/mod.rs
@@ -264,7 +264,7 @@ pub async fn delete_collector(
         (status = 202, description = "Queued", content_type = "application/json", body = config::meta::fleet::RestartQueued),
         (status = 403, description = "Forbidden", content_type = "application/json", body = Object),
         (status = 404, description = "Not found", content_type = "application/json", body = Object),
-        (status = 409, description = "The collector does not accept restart commands", content_type = "application/json", body = Object),
+        (status = 409, description = "The collector is offline or does not accept restart commands", content_type = "application/json", body = Object),
     ),
 )]
 pub async fn restart_collector(
@@ -1536,14 +1536,14 @@ pub async fn skip_rollout(
     context_path = "/api",
     tag = "Fleet",
     operation_id = "RollbackFleetRollout",
-    summary = "Start an immediate rollout back to stable and mark this one rolled back",
+    summary = "Roll back to stable, or to the placeholder without one, and mark this rollout rolled back",
     security(("Authorization" = [])),
     params(
         ("org_id" = String, Path, description = "Organization name"),
         ("id" = String, Path, description = "Rollout id"),
     ),
     responses(
-        (status = 200, description = "The rollout to stable", content_type = "application/json", body = config::meta::fleet::Rollout),
+        (status = 200, description = "The rollout to stable, or this rollout when the fleet has no stable version", content_type = "application/json", body = config::meta::fleet::Rollout),
         (status = 403, description = "Forbidden", content_type = "application/json", body = Object),
         (status = 404, description = "Not found", content_type = "application/json", body = Object),
         (status = 409, description = "Not halted, or the halt does not offer this exit", content_type = "application/json", body = Object),
diff --git a/src/api/management/src/request/oncall/mod.rs b/src/api/management/src/request/oncall/mod.rs
index b8147dd692..ce88883bca 100644
--- a/src/api/management/src/request/oncall/mod.rs
+++ b/src/api/management/src/request/oncall/mod.rs
@@ -49,6 +49,14 @@ const RESPONSES: &str = "oncall_responses";
 #[cfg(feature = "enterprise")]
 const SETTINGS: &str = "settings";
 
+/// Bounds one batch read, as `list_responses` bounds a page at 200 rows.
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+const MAX_BATCH_IDS: usize = 200;
+
+/// Ids a batch route works on at once; a team-context id runs three reads, so 48 at most.
+#[cfg(feature = "enterprise")]
+const BATCH_READ_CONCURRENCY: usize = 16;
+
 #[cfg(feature = "enterprise")]
 const HANDOFF_NEEDS_A_TARGET: &str =
     "a handoff needs either `to` (a person) or `to_team_id` (another team)";
@@ -283,6 +291,21 @@ pub struct OnCallQuery {
     pub at: Option<i64>,
 }
 
+#[derive(Debug, Default, Deserialize)]
+pub struct TeamContextQuery {
+    /// Comma-separated team ids.
+    pub team_ids: Option<String>,
+    /// Also answer for the caller's own teams.
+    #[serde(default)]
+    pub include_mine: bool,
+}
+
+#[derive(Debug, Default, Deserialize)]
+pub struct EscalationBatchQuery {
+    /// Comma-separated response record ids.
+    pub response_ids: Option<String>,
+}
+
 /// Points one identity-dimension path at the team that gets woken for it.
 #[derive(Debug, Deserialize, utoipa::ToSchema)]
 pub struct CreateOwnershipRuleRequest {
@@ -564,9 +587,9 @@ fn internal_error(context: &str, e: &impl std::fmt::Display) -> Response {
 fn to_response(e: anyhow::Error) -> Response {
     use o2_enterprise::enterprise::oncall::service::OncallError;
     let status = match e.downcast_ref::<OncallError>() {
-        Some(OncallError::TeamNotFound(_)) | Some(OncallError::ResponseNotFound(_)) => {
-            StatusCode::NOT_FOUND
-        }
+        Some(OncallError::TeamNotFound(_))
+        | Some(OncallError::MemberNotFound { .. })
+        | Some(OncallError::ResponseNotFound(_)) => StatusCode::NOT_FOUND,
         // Not 404: the record exists, and the honest answer is that working it is not theirs.
         Some(OncallError::NotOnThisTeam { .. }) => StatusCode::FORBIDDEN,
         // A conflict, not a 400: the caller fixes it by changing the org's state, not the request.
@@ -623,10 +646,27 @@ async fn page_problem(
     org_id: &str,
     response_id: &str,
     actor: &str,
+) -> Result<Option<openobserve_core::alerts::ack::Problem>, Response> {
+    page_problem_for(
+        org_id,
+        response_id,
+        actor,
+        openobserve_core::alerts::ack::Act::Ack,
+    )
+    .await
+}
+
+/// [`page_problem`] for an ack verb, so that a refusal names the verb refused.
+#[cfg(feature = "enterprise")]
+async fn page_problem_for(
+    org_id: &str,
+    response_id: &str,
+    actor: &str,
+    act: openobserve_core::alerts::ack::Act,
 ) -> Result<Option<openobserve_core::alerts::ack::Problem>, Response> {
     use openobserve_core::alerts::ack::AckError;
 
-    page_problem_of(org_id, response_id, actor)
+    page_problem_of(org_id, response_id, actor, act)
         .await
         .map_err(|e| match e {
             AckError::NotFound => MetaHttpResponse::not_found("Response not found"),
@@ -640,17 +680,18 @@ async fn page_problem_of(
     org_id: &str,
     response_id: &str,
     actor: &str,
+    act: openobserve_core::alerts::ack::Act,
 ) -> Result<Option<openobserve_core::alerts::ack::Problem>, openobserve_core::alerts::ack::AckError>
 {
-    use openobserve_core::alerts::ack::{self, AckError, Act};
+    use openobserve_core::alerts::ack::{self, AckError};
 
     match ack::problem_of_page(org_id, response_id).await {
-        Ok(problem) => ack::authorize_problem(&problem, actor, Act::Ack)
+        Ok(problem) => ack::authorize_problem(&problem, actor, act)
             .await
             .map(|_| Some(problem)),
         Err(AckError::NotFound) => {
             match infra::table::oncall_responses::get(org_id, response_id).await? {
-                Some(page) => ack::authorize_orphan_page(&page, actor, Act::Ack)
+                Some(page) => ack::authorize_orphan_page(&page, actor, act)
                     .await
                     .map(|_| None)
                     .map_err(AckError::Refused),
@@ -1090,10 +1131,14 @@ pub async fn remove_member(
         )
         .await
         {
-            Ok(true) => MetaHttpResponse::ok("Member removed"),
-            Ok(false) => {
-                MetaHttpResponse::error(StatusCode::NOT_FOUND.as_u16(), "Member not found")
-                    .into_response()
+            Ok(released_pages) => {
+                openobserve_core::alerts::ack::release_leaver_pages(
+                    &org_id,
+                    &released_pages,
+                    &q.user_email,
+                )
+                .await;
+                MetaHttpResponse::ok("Member removed")
             }
             Err(e) => to_response(e),
         }
@@ -2265,7 +2310,7 @@ async fn act_by_phone(
     use o2_enterprise::enterprise::oncall::{notify::PhoneAction, service};
     use openobserve_core::alerts::ack::{self, AckError};
 
-    let problem = match page_problem_of(&org_id, &response_id, &actor).await {
+    let problem = match page_problem_of(&org_id, &response_id, &actor, ack::Act::Ack).await {
         Ok(problem) => problem,
         Err(e) => return phone_answer_to(e),
     };
@@ -2375,6 +2420,28 @@ fn parse_subject_type(s: &str) -> Option<config::meta::oncall::SubjectType> {
     SUBJECT_TYPES.into_iter().find(|t| t.as_str() == s)
 }
 
+/// Listed then `extra` ids, de-duplicated in order; only the listed count to the cap. [pure]
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+fn batch_ids(listed: Option<&str>, extra: Vec<String>) -> Result<Vec<String>, String> {
+    let mut seen = std::collections::HashSet::new();
+    let mut ids: Vec<String> = listed
+        .unwrap_or_default()
+        .split(',')
+        .map(str::trim)
+        .filter(|id| !id.is_empty())
+        .map(str::to_string)
+        .filter(|id| seen.insert(id.clone()))
+        .collect();
+    if ids.len() > MAX_BATCH_IDS {
+        return Err(format!(
+            "at most {MAX_BATCH_IDS} ids per request, got {}",
+            ids.len()
+        ));
+    }
+    ids.extend(extra.into_iter().filter(|id| seen.insert(id.clone())));
+    Ok(ids)
+}
+
 #[utoipa::path(
     get,
     path = "/{org_id}/oncall/responses",
@@ -2489,13 +2556,25 @@ pub async fn list_responses(
     }
 }
 
-/// Two queries for the whole page, never one per row, which is the N+1 this exists to avoid.
+/// Three queries for the whole page, never one per row, which is the N+1 this exists to avoid.
 #[cfg(feature = "enterprise")]
 async fn with_page_details(
     org_id: &str,
     rows: Vec<config::meta::oncall::Response>,
 ) -> Vec<serde_json::Value> {
     let ids: Vec<String> = rows.iter().map(|r| r.id.clone()).collect();
+    let incident_ids: Vec<String> = rows
+        .iter()
+        .filter_map(|r| r.incident_id.clone())
+        .collect::<std::collections::BTreeSet<_>>()
+        .into_iter()
+        .collect();
+    let titles = infra::table::alert_incidents::titles(org_id, &incident_ids)
+        .await
+        .unwrap_or_else(|e| {
+            tracing::error!("[oncall] incident title lookup: {e}");
+            Default::default()
+        });
     let runbooks = infra::table::oncall_responses::runbook_urls(org_id, &ids)
         .await
         .unwrap_or_else(|e| {
@@ -2514,29 +2593,41 @@ async fn with_page_details(
             Default::default()
         });
     rows.into_iter()
-        .map(|r| {
-            let mut value = serde_json::json!(r);
-            if let Some(obj) = value.as_object_mut() {
-                if let Some(url) = runbooks.get(&r.id) {
-                    obj.insert("runbook_url".to_string(), url.clone().into());
-                }
-                // The rung's `after_micros`: an index would not survive a reordered ladder.
-                if let Some(rung) = rungs.get(&r.id) {
-                    obj.insert("reached_rung_micros".to_string(), (*rung).into());
-                }
-                // Only when answered: a null is indistinguishable from "answered instantly".
-                if let Some(acked_at) = r.acked_at {
-                    obj.insert(
-                        "time_to_ack_micros".to_string(),
-                        (acked_at - r.opened_at).max(0).into(),
-                    );
-                }
-            }
-            value
-        })
+        .map(|r| page_row(r, &runbooks, &rungs, &titles))
         .collect()
 }
 
+/// One list row with the page-wide lookups, keyed by record or incident id, folded in. [pure]
+#[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+fn page_row(
+    r: config::meta::oncall::Response,
+    runbooks: &std::collections::HashMap<String, String>,
+    rungs: &std::collections::HashMap<String, i64>,
+    titles: &std::collections::HashMap<String, String>,
+) -> serde_json::Value {
+    let mut value = serde_json::json!(r);
+    if let Some(obj) = value.as_object_mut() {
+        if let Some(url) = runbooks.get(&r.id) {
+            obj.insert("runbook_url".to_string(), url.clone().into());
+        }
+        // The rung's `after_micros`: an index would not survive a reordered ladder.
+        if let Some(rung) = rungs.get(&r.id) {
+            obj.insert("reached_rung_micros".to_string(), (*rung).into());
+        }
+        // Only when answered: a null is indistinguishable from "answered instantly".
+        if let Some(acked_at) = r.acked_at {
+            obj.insert(
+                "time_to_ack_micros".to_string(),
+                (acked_at - r.opened_at).max(0).into(),
+            );
+        }
+        if let Some(title) = r.incident_id.as_ref().and_then(|id| titles.get(id)) {
+            obj.insert("incident_title".to_string(), title.clone().into());
+        }
+    }
+    value
+}
+
 #[utoipa::path(
     get,
     path = "/{org_id}/oncall/responses/{response_id}",
@@ -2628,7 +2719,14 @@ pub async fn resolve_response(
         if !allowed(&org_id, &user_email.user_id, RESPONSES, "POST").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        let problem = match page_problem(&org_id, &response_id, &user_email.user_id).await {
+        let problem = match page_problem_for(
+            &org_id,
+            &response_id,
+            &user_email.user_id,
+            openobserve_core::alerts::ack::Act::Resolve,
+        )
+        .await
+        {
             Ok(p) => p,
             Err(resp) => return resp,
         };
@@ -2796,6 +2894,85 @@ pub async fn get_escalation_progress(
     }
 }
 
+/// One read for a page of open records; the per-id route stays for the screens that show one.
+#[utoipa::path(
+    get,
+    path = "/{org_id}/oncall/responses/escalation",
+    context_path = "/api",
+    tag = "OnCall",
+    operation_id = "OnCallEscalationProgressBatch",
+    summary = "Where the escalation ladder has got to, for many records",
+    security(("Authorization" = [])),
+    params(
+        ("org_id" = String, Path, description = "Organization name"),
+        ("response_ids" = Option<String>, Query, description = "Comma-separated response record IDs (at most 200)"),
+    ),
+    responses(
+        (status = 200, description = "Success", content_type = "application/json", body = Object),
+        (status = 400, description = "More than 200 ids", content_type = "application/json", body = Object),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "OnCall", "operation": "list"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    )
+)]
+pub async fn list_escalation_progress(
+    Path(org_id): Path<String>,
+    Query(q): Query<EscalationBatchQuery>,
+    #[cfg(feature = "enterprise")] Headers(user_email): Headers<UserEmail>,
+) -> Response {
+    #[cfg(feature = "enterprise")]
+    {
+        use futures::StreamExt;
+
+        if !allowed(&org_id, &user_email.user_id, RESPONSES, "GET").await {
+            return MetaHttpResponse::forbidden("Forbidden");
+        }
+        let ids = match batch_ids(q.response_ids.as_deref(), Vec::new()) {
+            Ok(ids) => ids,
+            Err(msg) => return MetaHttpResponse::bad_request(msg),
+        };
+        // Owned per read: a borrowing closure in the stream fails axum's `Handler` lifetime bound.
+        let reads: Vec<_> =
+            ids.iter()
+                .map(|id| {
+                    let (org, id) = (org_id.clone(), id.clone());
+                    async move {
+                        o2_enterprise::enterprise::oncall::escalation::progress(&org, &id).await
+                    }
+                })
+                .collect();
+        // `buffered` keeps the input order, so each answer stays beside its id.
+        let reads: Vec<_> = futures::stream::iter(reads)
+            .buffered(BATCH_READ_CONCURRENCY)
+            .collect()
+            .await;
+        let progress: Vec<serde_json::Value> = ids
+            .into_iter()
+            .zip(reads)
+            .filter_map(|(id, read)| match read {
+                Ok(p) => {
+                    let mut value = serde_json::json!(p);
+                    if let Some(obj) = value.as_object_mut() {
+                        obj.insert("response_id".to_string(), id.into());
+                    }
+                    Some(value)
+                }
+                Err(e) => {
+                    tracing::warn!("[oncall] escalation progress for {id}: {e}");
+                    None
+                }
+            })
+            .collect();
+        MetaHttpResponse::json(serde_json::json!({ "progress": progress }))
+    }
+    #[cfg(not(feature = "enterprise"))]
+    {
+        let _ = (org_id, q);
+        MetaHttpResponse::forbidden("Not Supported")
+    }
+}
+
 #[utoipa::path(
     get,
     path = "/{org_id}/oncall/responses/{response_id}/prior-causes",
@@ -2930,10 +3107,11 @@ pub async fn acknowledge_response(
             Ok(false) => Verb::Acknowledge,
             Err(resp) => return resp,
         };
-        let problem = match page_problem(&org_id, &response_id, &user_email.user_id).await {
-            Ok(p) => p,
-            Err(resp) => return resp,
-        };
+        let problem =
+            match page_problem_for(&org_id, &response_id, &user_email.user_id, verb.into()).await {
+                Ok(p) => p,
+                Err(resp) => return resp,
+            };
         match page_is_closed(&org_id, &response_id).await {
             Ok(true) => return page_with_ack(&org_id, &response_id, unchanged()).await,
             Ok(false) => {}
@@ -3000,7 +3178,14 @@ pub async fn unacknowledge_response(
         if !allowed(&org_id, &user_email.user_id, RESPONSES, "POST").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        let problem = match page_problem(&org_id, &response_id, &user_email.user_id).await {
+        let problem = match page_problem_for(
+            &org_id,
+            &response_id,
+            &user_email.user_id,
+            openobserve_core::alerts::ack::Act::Unack,
+        )
+        .await
+        {
             Ok(p) => p,
             Err(resp) => return resp,
         };
@@ -5241,6 +5426,114 @@ pub async fn list_my_teams(
     }
 }
 
+// ── Team context for the pages list ───────────────────────────────────────────
+
+/// One read for the pages list, answering each team as its three per-team routes would.
+#[utoipa::path(
+    get,
+    path = "/{org_id}/oncall/teams/context",
+    context_path = "/api",
+    tag = "OnCall",
+    operation_id = "ListOnCallTeamContext",
+    summary = "Policy, who is on call and schedule for many teams",
+    security(("Authorization" = [])),
+    params(
+        ("org_id" = String, Path, description = "Organization name"),
+        ("team_ids" = Option<String>, Query, description = "Comma-separated team IDs (at most 200; `include_mine` teams are not counted)"),
+        ("include_mine" = Option<bool>, Query, description = "Also answer for the caller's own teams (default false)"),
+    ),
+    responses(
+        (status = 200, description = "Success", content_type = "application/json", body = Object),
+        (status = 400, description = "More than 200 listed teams", content_type = "application/json", body = Object),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "OnCall", "operation": "list"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    )
+)]
+pub async fn list_team_context(
+    Path(org_id): Path<String>,
+    Query(q): Query<TeamContextQuery>,
+    #[cfg(feature = "enterprise")] Headers(user_email): Headers<UserEmail>,
+) -> Response {
+    #[cfg(feature = "enterprise")]
+    {
+        use futures::StreamExt;
+
+        if !allowed(&org_id, &user_email.user_id, CONFIG, "GET").await {
+            return MetaHttpResponse::forbidden("Forbidden");
+        }
+        let mine = if q.include_mine {
+            match infra::table::oncall_teams::list_for_user(&org_id, &user_email.user_id).await {
+                Ok(teams) => teams.into_iter().map(|t| t.id).collect(),
+                Err(e) => {
+                    // The listed teams still answer; without the caller's, the page shows no shift.
+                    tracing::warn!("[oncall] team context: the caller's teams: {e}");
+                    Vec::new()
+                }
+            }
+        } else {
+            Vec::new()
+        };
+        let ids = match batch_ids(q.team_ids.as_deref(), mine) {
+            Ok(ids) => ids,
+            Err(msg) => return MetaHttpResponse::bad_request(msg),
+        };
+        let known: std::collections::HashSet<String> =
+            match infra::table::oncall_teams::list(&org_id).await {
+                Ok(teams) => teams.into_iter().map(|t| t.id).collect(),
+                Err(e) => return internal_error("list_team_context", &e),
+            };
+        // Owned per read: a borrowing closure in the stream fails axum's `Handler` lifetime bound.
+        let reads: Vec<_> = ids
+            .into_iter()
+            .filter(|id| known.contains(id))
+            .map(|id| {
+                let org = org_id.clone();
+                async move { team_context(&org, &id).await }
+            })
+            .collect();
+        let teams: Vec<serde_json::Value> = futures::stream::iter(reads)
+            .buffered(BATCH_READ_CONCURRENCY)
+            .collect()
+            .await;
+        MetaHttpResponse::json(serde_json::json!({ "teams": teams }))
+    }
+    #[cfg(not(feature = "enterprise"))]
+    {
+        let _ = (org_id, q);
+        MetaHttpResponse::forbidden("Not Supported")
+    }
+}
+
+/// One team's policy, rotation and schedule; a field whose read fails is left out and logged.
+#[cfg(feature = "enterprise")]
+async fn team_context(org_id: &str, team_id: &str) -> serde_json::Value {
+    use o2_enterprise::enterprise::oncall::service;
+
+    let (policy, on_call, schedule) = futures::join!(
+        service::get_policy_view(org_id, team_id),
+        service::who_is_on_call(org_id, team_id, None),
+        service::get_schedule(org_id, team_id),
+    );
+    let mut out = serde_json::Map::new();
+    out.insert("team_id".to_string(), team_id.into());
+    let fields = [
+        ("policy", policy.map(|p| serde_json::json!(p))),
+        ("on_call", on_call.map(|s| serde_json::json!(s))),
+        ("schedule", schedule.map(|s| serde_json::json!(s))),
+    ];
+    for (field, read) in fields {
+        match read {
+            Ok(value) => {
+                out.insert(field.to_string(), value);
+            }
+            Err(e) => tracing::warn!("[oncall] team context {field} for {team_id}: {e}"),
+        }
+    }
+    serde_json::Value::Object(out)
+}
+
 // ── Cause analytics (U26) ─────────────────────────────────────────────────────
 
 /// Counted in the database: the org with most to learn from this has the most rows.
@@ -6867,6 +7160,77 @@ mod tests {
         assert_not_supported(voice_ack(path, form).await).await;
     }
 
+    #[test]
+    fn test_batch_ids_trim_dedupe_in_order_and_cap_only_the_listed() {
+        // `None` as the answer means refused.
+        type Case = (Option<String>, Vec<String>, Option<Vec<String>>);
+        let ids = |n: usize| (0..n).map(|i| format!("t{i}")).collect::<Vec<_>>();
+        let cases: Vec<Case> = vec![
+            (None, vec![], Some(vec![])),
+            (Some(" ,, ".into()), vec![], Some(vec![])),
+            (
+                Some(" a, b,,a ".into()),
+                vec![],
+                Some(vec!["a".into(), "b".into()]),
+            ),
+            (
+                Some("a".into()),
+                vec!["b".into(), "a".into()],
+                Some(vec!["a".into(), "b".into()]),
+            ),
+            (Some(ids(200).join(",")), ids(200), Some(ids(200))),
+            (Some(ids(201).join(",")), vec![], None),
+            (
+                Some(ids(150).join(",")),
+                ids(201)[150..].to_vec(),
+                Some(ids(201)),
+            ),
+            (Some(ids(200).join(",")), ids(230), Some(ids(230))),
+            (
+                Some(format!("{},t0", ids(200).join(","))),
+                vec![],
+                Some(ids(200)),
+            ),
+        ];
+        for (listed, extra, want) in cases {
+            let got = batch_ids(listed.as_deref(), extra.clone()).ok();
+            assert_eq!(got, want, "{listed:?} + {extra:?}");
+        }
+    }
+
+    #[test]
+    fn test_page_row_titles_only_rows_whose_incident_is_known() {
+        let record = |id: &str, incident_id: Option<&str>| {
+            serde_json::from_value::<config::meta::oncall::Response>(serde_json::json!({
+                "id": id,
+                "org_id": "acme",
+                "subject": {"subject_type": "alert", "source_id": "a1", "firing": 1},
+                "priority": 2,
+                "state": "triggered",
+                "opened_at": 1,
+                "incident_id": incident_id,
+            }))
+            .unwrap()
+        };
+        let titles =
+            std::collections::HashMap::from([("inc-1".to_string(), "DB down".to_string())]);
+        let cases = [
+            (record("r1", Some("inc-1")), Some("DB down")),
+            (record("r2", Some("inc-gone")), None),
+            (record("r3", None), None),
+        ];
+        for (r, want) in cases {
+            let id = r.id.clone();
+            let row = page_row(r, &Default::default(), &Default::default(), &titles);
+            assert_eq!(
+                row.get("incident_title").and_then(|t| t.as_str()),
+                want,
+                "{id}"
+            );
+            assert_eq!(row["id"], id.as_str());
+        }
+    }
+
     /// Disconnecting stops the org's own phone pages, so it needs the same write as connecting.
     #[test]
     fn test_telephony_permission_is_get_put_put() {
diff --git a/src/core/src/alerts/ack.rs b/src/core/src/alerts/ack.rs
index ead1c0773a..dbc49314a6 100644
--- a/src/core/src/alerts/ack.rs
+++ b/src/core/src/alerts/ack.rs
@@ -40,13 +40,27 @@ use crate::alerts::lifecycle;
 const CAN_ACT_SHOWN: usize = 2;
 const ON_CALL_SHOWN: usize = 3;
 
-/// What the caller wants to do; Ack and Mute share one rule (Δ2).
+/// What the caller wants to do; every act shares one rule (Δ2) and a refusal names it.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Act {
     Ack,
+    Unack,
+    TakeOver,
+    Resolve,
     Mute,
 }
 
+impl From<Verb> for Act {
+    fn from(verb: Verb) -> Self {
+        match verb {
+            Verb::Acknowledge => Self::Ack,
+            Verb::TakeOver => Self::TakeOver,
+            Verb::Unack | Verb::HandOff => Self::Unack,
+            Verb::Resolve => Self::Resolve,
+        }
+    }
+}
+
 /// Which part of the rule let the actor in.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum Via {
@@ -197,8 +211,16 @@ pub struct PageCover {
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum RecordWrite {
     Claim,
-    Move { from: String },
-    Clear { holder: String },
+    Move {
+        from: String,
+    },
+    Clear {
+        holder: String,
+    },
+    /// A clear that writes only while `holder` still holds the record.
+    Release {
+        holder: String,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -332,6 +354,9 @@ pub fn refusal(
         .collect();
     let (code, verb) = match act {
         Act::Ack => (RefusalCode::AckRefused, "acknowledge"),
+        Act::Unack => (RefusalCode::AckRefused, "unacknowledge"),
+        Act::TakeOver => (RefusalCode::AckRefused, "take over"),
+        Act::Resolve => (RefusalCode::AckRefused, "resolve"),
         Act::Mute => (RefusalCode::MuteRefused, "mute"),
     };
     let message = if facts.fga_enabled {
@@ -399,6 +424,34 @@ pub fn plan(f: &PlanFacts) -> AckPlan {
     }
 }
 
+/// Clears each record `f.actor`, the leaver, holds and leaves every page to its release. [pure]
+pub fn plan_leaver_release(f: &PlanFacts) -> AckPlan {
+    let writes: Vec<(AckRecord, RecordWrite)> = f
+        .records
+        .iter()
+        .filter_map(|r| {
+            r.holder
+                .as_ref()
+                .filter(|h| same(h, &f.actor))
+                .map(|h| (r.record.clone(), RecordWrite::Release { holder: h.clone() }))
+        })
+        .collect();
+    AckPlan {
+        answer: if writes.is_empty() {
+            Answer::NotHeld
+        } else {
+            Answer::Changed
+        },
+        writes,
+        pages: f
+            .pages
+            .iter()
+            .map(|p| (p.response_id.clone(), PageStep::Leave))
+            .collect(),
+        still_paging: vec![],
+    }
+}
+
 /// The alert or incident a page's subject names, without its impacted and group suffixes. [pure]
 pub fn source_of_page(source_id: &str) -> &str {
     let origin = source_id.split(":impacted:").next().unwrap_or(source_id);
@@ -581,6 +634,41 @@ pub fn page_cover(subject: &config::meta::oncall::SubjectRef, closed_at: i64) ->
     }
 }
 
+/// Clears, as the engine, what the leaver holds. [weak: cleared stays cleared; a retry ends it]
+#[cfg(feature = "enterprise")]
+pub async fn release_leaver(p: &Problem, leaver: &str) -> Result<(), AckError> {
+    use o2_enterprise::enterprise::oncall::escalation::ENGINE_ACTOR;
+
+    // A release verb, so a named group is read even when it no longer fires.
+    let g = gather(p, Verb::HandOff, leaver).await?;
+    let plan = plan_leaver_release(&g.facts);
+    carry_out(p, &g, &plan, ENGINE_ACTOR, AckSource::Oncall)
+        .await
+        .map(|_| ())
+}
+
+/// [`release_leaver`] on each released page's problem; a failure is logged. [no-fail]
+#[cfg(feature = "enterprise")]
+pub async fn release_leaver_pages(org_id: &str, response_ids: &[String], leaver: &str) {
+    for response_id in response_ids {
+        let released = match problem_of_page(org_id, response_id).await {
+            Ok(p) => release_leaver(&p, leaver).await,
+            Err(e) => Err(e),
+        };
+        match released {
+            Ok(()) => {}
+            Err(AckError::NotFound) => {
+                log::info!(
+                    "[ALERT_ACK] page {response_id} has no alert or incident left to release"
+                )
+            }
+            Err(e) => log::error!(
+                "[ALERT_ACK] page {response_id}: the acks {leaver} held could not be released: {e:?}"
+            ),
+        }
+    }
+}
+
 /// A firing that joins an acknowledged incident takes the incident's ack, so nobody is re-paged.
 /// [weak: a row that fails to write is logged and the firing reads unacknowledged; the next join
 /// writes it]
@@ -1556,7 +1644,7 @@ fn ordered_views(
 fn status_after(write: &RecordWrite) -> IncidentStatus {
     match write {
         RecordWrite::Claim | RecordWrite::Move { .. } => IncidentStatus::Acknowledged,
-        RecordWrite::Clear { .. } => IncidentStatus::Open,
+        RecordWrite::Clear { .. } | RecordWrite::Release { .. } => IncidentStatus::Open,
     }
 }
 
@@ -1632,6 +1720,18 @@ async fn write_firing(
             reopen_silence(target, group_key, started, now).await;
             (row, AckAction::Unack, None)
         }
+        RecordWrite::Release { holder } => {
+            let held = AlertAck {
+                acked_by: holder.clone(),
+                ..ack(None)
+            };
+            // Someone else's ack landed since the read: theirs stands.
+            let Some(row) = db::alerts::alert_acks::unack_held(&held, actor, now).await? else {
+                return Ok((None, false));
+            };
+            reopen_silence(target, group_key, started, now).await;
+            (row, AckAction::Unack, None)
+        }
     };
     record_event(target, group_key, actor, action, source, from);
     lifecycle::on_view_changed(&target.org_id, &target.alert_id, Some(group_key)).await;
@@ -1663,7 +1763,7 @@ async fn write_incident(
             alert_incidents::take_over_acknowledgement(org_id, incident_id, from, actor).await?,
             IncidentEvent::acknowledged(actor),
         ),
-        RecordWrite::Clear { holder } => (
+        RecordWrite::Clear { holder } | RecordWrite::Release { holder } => (
             alert_incidents::unacknowledge(org_id, incident_id, holder).await?,
             match verb {
                 Verb::Resolve => IncidentEvent::ack_ended_by_page_resolve(actor),
@@ -2469,6 +2569,126 @@ mod tests {
         }
     }
 
+    fn released(r: &HeldRecord) -> (AckRecord, RecordWrite) {
+        let holder = r.holder.clone().unwrap_or_default();
+        (r.record.clone(), RecordWrite::Release { holder })
+    }
+
+    #[test]
+    fn a_leaver_release_clears_only_the_leavers_records_and_leaves_every_page() {
+        let (bo, ana) = (Some("Bo@acme.io"), Some("ana@acme.io"));
+        let pages = || vec![page("p1", bo), page("p2", None), leftover("old", ana)];
+        let cases: Vec<(&str, Vec<HeldRecord>, Vec<HeldRecord>)> = vec![
+            (
+                "the incident only",
+                vec![incident(bo), firing("", None, false)],
+                vec![incident(bo)],
+            ),
+            (
+                "the alerts only",
+                vec![
+                    incident(None),
+                    firing("g1", bo, false),
+                    firing("g2", bo, false),
+                ],
+                vec![firing("g1", bo, false), firing("g2", bo, false)],
+            ),
+            (
+                "both",
+                vec![incident(bo), firing("", bo, false)],
+                vec![incident(bo), firing("", bo, false)],
+            ),
+            (
+                "nothing",
+                vec![incident(None), firing("", None, false)],
+                vec![],
+            ),
+            (
+                "a mix with another holder",
+                vec![
+                    incident(ana),
+                    firing("g1", bo, false),
+                    firing("g2", ana, true),
+                ],
+                vec![firing("g1", bo, false)],
+            ),
+        ];
+        for (name, records, cleared) in cases {
+            let got = plan_leaver_release(&facts_for(Verb::HandOff, records, pages()));
+            assert_eq!(
+                got.writes,
+                cleared.iter().map(released).collect::<Vec<_>>(),
+                "{name}"
+            );
+            assert!(
+                got.pages.iter().all(|(_, step)| *step == PageStep::Leave),
+                "{name}: {:?}",
+                got.pages
+            );
+            assert_eq!(got.pages.len(), 3, "{name}");
+            let answer = if cleared.is_empty() {
+                Answer::NotHeld
+            } else {
+                Answer::Changed
+            };
+            assert_eq!(got.answer, answer, "{name}");
+        }
+    }
+
+    #[test]
+    fn after_a_leaver_release_a_plain_ack_holds_the_page_the_incident_and_the_alert() {
+        let bo = Some("bo@acme.io");
+        let records = vec![incident(bo), firing("", bo, false)];
+        let release = plan_leaver_release(&facts_for(Verb::HandOff, records.clone(), vec![]));
+        let after: Vec<HeldRecord> = records
+            .into_iter()
+            .map(|r| HeldRecord {
+                holder: (!release.writes.iter().any(|(rec, _)| *rec == r.record))
+                    .then(|| r.holder.clone())
+                    .flatten(),
+                ..r
+            })
+            .collect();
+        let ack = plan(&PlanFacts {
+            actor: "cy@acme.io".into(),
+            ..facts_for(Verb::Acknowledge, after, vec![page("p1", None)])
+        });
+        assert_eq!(
+            ack.writes,
+            vec![claim(&incident(None)), claim(&firing("", None, false))]
+        );
+        assert_eq!(
+            ack.pages,
+            vec![(
+                "p1".to_string(),
+                PageStep::Stop {
+                    by: "cy@acme.io".into()
+                }
+            )]
+        );
+        assert_eq!(ack.answer, Answer::Changed);
+    }
+
+    #[test]
+    fn a_refusal_names_the_verb_it_refused() {
+        for (act, verb) in [
+            (Act::Ack, "acknowledge"),
+            (Act::Unack, "unacknowledge"),
+            (Act::TakeOver, "take over"),
+            (Act::from(Verb::TakeOver), "take over"),
+            (Act::from(Verb::Unack), "unacknowledge"),
+            (Act::from(Verb::Resolve), "resolve"),
+        ] {
+            let r = refusal(act, &facts(Some(UserRole::Viewer)), &[]);
+            assert_eq!(r.code, RefusalCode::AckRefused, "{verb}");
+            assert!(
+                r.message.ends_with(&format!("can {verb} it")),
+                "{verb}: {}",
+                r.message
+            );
+        }
+    }
+
     #[test]
     fn a_mute_snoozes_its_pages_for_its_whole_minutes_up_to_a_day() {
         const MINUTE: i64 = 60 * 1_000_000;
diff --git a/src/core/src/self_profiles/mod.rs b/src/core/src/self_profiles/mod.rs
index 73143e141a..090248efed 100644
--- a/src/core/src/self_profiles/mod.rs
+++ b/src/core/src/self_profiles/mod.rs
@@ -27,15 +27,3 @@ pub use sample::{dump_memory_flamegraph, dump_memory_pprof, jemalloc_stats};
 
 pub(crate) const SERVICE_NAME: &str = "openobserve";
 pub(crate) const CPU_FREQUENCY_HZ: i32 = 100;
-
-#[cfg(test)]
-mod tests {
-    use config::{META_ORG_ID, meta::self_reporting::usage::is_system_stream};
-
-    use super::*;
-
-    #[test]
-    fn test_stream_name_is_a_meta_system_stream() {
-        assert!(is_system_stream(META_ORG_ID, STREAM_NAME));
-    }
-}
diff --git a/src/core/src/users.rs b/src/core/src/users.rs
index 236ccf0e97..d66b194251 100644
--- a/src/core/src/users.rs
+++ b/src/core/src/users.rs
@@ -1183,12 +1183,13 @@ pub async fn remove_user_from_org(
         match oncall_service::offboard_member(org_id, email_id, config::utils::time::now_micros())
             .await
         {
-            Ok(report) if report.needs_attention() => {
+            Ok(report) => {
                 for warning in report.warnings() {
                     log::warn!("[ONCALL] {email_id} left {org_id}: {warning}");
                 }
+                crate::alerts::ack::release_leaver_pages(org_id, &report.released_pages, email_id)
+                    .await;
             }
-            Ok(_) => {}
             Err(e) => log::error!(
                 "[ONCALL] {email_id} was removed from {org_id} but their on-call membership could not be cleaned up, so they may still be paged: {e}"
             ),
diff --git a/src/db/src/alerts/alert_acks.rs b/src/db/src/alerts/alert_acks.rs
index 6651d92ffb..e4f9ce8931 100644
--- a/src/db/src/alerts/alert_acks.rs
+++ b/src/db/src/alerts/alert_acks.rs
@@ -68,6 +68,27 @@ pub async fn unack(
     {
         return Ok(None);
     }
+    publish_current(org_id, alert_id, group_key).await
+}
+
+/// [`unack`] only while `held.acked_by` still holds that firing's ack.
+pub async fn unack_held(
+    held: &AlertAck,
+    unacked_by: &str,
+    unacked_at: i64,
+) -> Result<Option<AlertAck>> {
+    if !infra::table::alert_acks::unack_held_with_outbox(held, unacked_by, unacked_at).await? {
+        return Ok(None);
+    }
+    publish_current(&held.org_id, &held.alert_id, &held.group_key).await
+}
+
+/// Replicates the row as it now stands, and returns it.
+async fn publish_current(
+    org_id: &str,
+    alert_id: &str,
+    group_key: &str,
+) -> Result<Option<AlertAck>> {
     let row = infra::table::alert_acks::get(org_id, alert_id, group_key).await?;
     if let Some(row) = row.as_ref() {
         publish(row).await;
diff --git a/src/infra/src/table/alert_acks.rs b/src/infra/src/table/alert_acks.rs
index 97c29f2597..ea685bb1a9 100644
--- a/src/infra/src/table/alert_acks.rs
+++ b/src/infra/src/table/alert_acks.rs
@@ -84,6 +84,15 @@ pub async fn unack_with_outbox(
     .await
 }
 
+/// [`unack_with_outbox`] only while `held.acked_by` still holds that firing's ack.
+pub async fn unack_held_with_outbox(
+    held: &AlertAck,
+    unacked_by: &str,
+    unacked_at: i64,
+) -> Result<bool, Error> {
+    unack_held_with_outbox_with(get_orm_client_rw().await, held, unacked_by, unacked_at).await
+}
+
 /// Applies a row from another region; false when the stored row is as new or newer.
 pub async fn apply_replicated(ack: &AlertAck) -> Result<bool, Error> {
     apply_replicated_with(get_orm_client_rw().await, ack).await
@@ -259,25 +268,45 @@ pub async fn unack_with_outbox_with<C: ConnectionTrait + TransactionTrait>(
     unacked_by: &str,
     unacked_at: i64,
 ) -> Result<bool, Error> {
-    let txn = conn.begin().await?;
-    let result = Entity::update_many()
-        .col_expr(Column::UnackedAt, Expr::value(unacked_at))
-        .col_expr(Column::UnackedBy, Expr::value(unacked_by))
-        .col_expr(Column::UpdatedAt, Expr::value(unacked_at))
-        .filter(Column::OrgId.eq(org_id))
-        .filter(Column::AlertId.eq(alert_id))
-        .filter(Column::GroupKey.eq(group_key))
-        .filter(Column::FiringStartedAt.eq(firing_started_at))
-        .filter(Column::UnackedAt.is_null())
-        .exec(&txn)
-        .await?;
-    let changed = result.rows_affected > 0;
-    if changed {
-        slack_alert_messages::bump_wanted_with(&txn, alert_id, group_key, firing_started_at)
-            .await?;
-    }
-    txn.commit().await?;
-    Ok(changed)
+    let row = Condition::all()
+        .add(Column::OrgId.eq(org_id))
+        .add(Column::AlertId.eq(alert_id))
+        .add(Column::GroupKey.eq(group_key))
+        .add(Column::FiringStartedAt.eq(firing_started_at));
+    unack_matching(
+        conn,
+        row,
+        alert_id,
+        group_key,
+        firing_started_at,
+        unacked_by,
+        unacked_at,
+    )
+    .await
+}
+
+pub async fn unack_held_with_outbox_with<C: ConnectionTrait + TransactionTrait>(
+    conn: &C,
+    held: &AlertAck,
+    unacked_by: &str,
+    unacked_at: i64,
+) -> Result<bool, Error> {
+    let row = Condition::all()
+        .add(Column::OrgId.eq(&held.org_id))
+        .add(Column::AlertId.eq(&held.alert_id))
+        .add(Column::GroupKey.eq(&held.group_key))
+        .add(Column::FiringStartedAt.eq(held.firing_started_at))
+        .add(Column::AckedBy.eq(&held.acked_by));
+    unack_matching(
+        conn,
+        row,
+        &held.alert_id,
+        &held.group_key,
+        held.firing_started_at,
+        unacked_by,
+        unacked_at,
+    )
+    .await
 }
 
 pub async fn apply_replicated_with<C: ConnectionTrait>(
@@ -348,6 +377,34 @@ pub async fn create_table_for_test<C: ConnectionTrait>(conn: &C) -> Result<(), s
     super::migration::create_alert_acks_table(conn).await
 }
 
+/// Unacks the acked rows `row` matches and bumps the firing's Slack messages, in one transaction.
+async fn unack_matching<C: ConnectionTrait + TransactionTrait>(
+    conn: &C,
+    row: Condition,
+    alert_id: &str,
+    group_key: &str,
+    firing_started_at: i64,
+    unacked_by: &str,
+    unacked_at: i64,
+) -> Result<bool, Error> {
+    let txn = conn.begin().await?;
+    let result = Entity::update_many()
+        .col_expr(Column::UnackedAt, Expr::value(unacked_at))
+        .col_expr(Column::UnackedBy, Expr::value(unacked_by))
+        .col_expr(Column::UpdatedAt, Expr::value(unacked_at))
+        .filter(row)
+        .filter(Column::UnackedAt.is_null())
+        .exec(&txn)
+        .await?;
+    let changed = result.rows_affected > 0;
+    if changed {
+        slack_alert_messages::bump_wanted_with(&txn, alert_id, group_key, firing_started_at)
+            .await?;
+    }
+    txn.commit().await?;
+    Ok(changed)
+}
+
 fn upsert() -> OnConflict {
     OnConflict::columns([Column::OrgId, Column::AlertId, Column::GroupKey])
         .update_columns(
@@ -606,6 +663,34 @@ mod tests {
         assert_eq!(wanted(&db, "d1", "", 10).await, 2);
     }
 
+    #[tokio::test]
+    async fn a_held_unack_clears_only_while_the_holder_it_names_still_holds_it() {
+        let db = db().await;
+        put_with_outbox_with(&db, &ack("g", 10, 20)).await.unwrap();
+        let leaver = AlertAck {
+            acked_by: "lee@acme.com".into(),
+            ..ack("g", 10, 20)
+        };
+        assert!(
+            !unack_held_with_outbox_with(&db, &leaver, "o2-engine", 30)
+                .await
+                .unwrap(),
+            "someone else holds it"
+        );
+        let stored = get_with(&db, "acme", "a1", "g").await.unwrap().unwrap();
+        assert_eq!((stored.unacked_at, stored.updated_at), (None, 20));
+        assert!(
+            unack_held_with_outbox_with(&db, &ack("g", 10, 20), "o2-engine", 31)
+                .await
+                .unwrap()
+        );
+        let stored = get_with(&db, "acme", "a1", "g").await.unwrap().unwrap();
+        assert_eq!(
+            (stored.unacked_at, stored.unacked_by.as_deref()),
+            (Some(31), Some("o2-engine"))
+        );
+    }
+
     #[tokio::test]
     async fn apply_replicated_ignores_an_older_or_equal_updated_at() {
         let db = db().await;
diff --git a/src/infra/src/table/alert_incidents.rs b/src/infra/src/table/alert_incidents.rs
index a770b3784c..728e7c1e3a 100644
--- a/src/infra/src/table/alert_incidents.rs
+++ b/src/infra/src/table/alert_incidents.rs
@@ -601,6 +601,39 @@ pub async fn update_severity(
         .map_err(|e| Error::DbError(DbError::SeaORMError(e.to_string())))
 }
 
+/// The titles of the incidents among `ids` in this org; untitled and unknown ids are absent.
+pub async fn titles(
+    org_id: &str,
+    ids: &[String],
+) -> Result<HashMap<String, String>, errors::Error> {
+    titles_with(get_orm_client_ro().await, org_id, ids).await
+}
+
+/// [`titles`] on a given connection.
+pub async fn titles_with<C: ConnectionTrait>(
+    client: &C,
+    org_id: &str,
+    ids: &[String],
+) -> Result<HashMap<String, String>, errors::Error> {
+    if ids.is_empty() {
+        return Ok(HashMap::new());
+    }
+    Ok(alert_incidents::Entity::find()
+        .select_only()
+        .column(alert_incidents::Column::Id)
+        .column(alert_incidents::Column::Title)
+        .filter(alert_incidents::Column::OrgId.eq(org_id))
+        .filter(alert_incidents::Column::Id.is_in(ids.to_vec()))
+        .filter(alert_incidents::Column::Title.is_not_null())
+        .into_tuple::<(String, Option<String>)>()
+        .all(client)
+        .await
+        .map_err(|e| Error::DbError(DbError::SeaORMError(e.to_string())))?
+        .into_iter()
+        .filter_map(|(id, title)| title.map(|t| (id, t)))
+        .collect())
+}
+
 /// List incidents with optional filters
 pub async fn list(
     org_id: &str,
@@ -1818,6 +1851,44 @@ mod tests {
         assert!(result.is_err(), "Should reject malformed JSON");
     }
 
+    #[tokio::test]
+    async fn titles_answer_only_titled_incidents_of_the_org_in_one_read() {
+        let db = incidents_db().await;
+        let titled = |org: &str, title: Option<&str>| {
+            new_incident(
+                org,
+                "P2",
+                serde_json::json!({}),
+                "service",
+                1,
+                title.map(str::to_string),
+                None,
+            )
+        };
+        let paid = titled("acme", Some("Payments down"))
+            .insert(&db)
+            .await
+            .unwrap();
+        let untitled = titled("acme", None).insert(&db).await.unwrap();
+        let foreign = titled("other", Some("Not yours"))
+            .insert(&db)
+            .await
+            .unwrap();
+        let asked = [
+            paid.id.clone(),
+            untitled.id,
+            foreign.id,
+            "missing".to_string(),
+        ];
+
+        let found = titles_with(&db, "acme", &asked).await.unwrap();
+        assert_eq!(
+            found,
+            HashMap::from([(paid.id, "Payments down".to_string())])
+        );
+        assert!(titles_with(&db, "acme", &[]).await.unwrap().is_empty());
+    }
+
     #[tokio::test]
     async fn the_bulk_auto_resolve_clears_the_mute_and_reports_it() {
         let db = incidents_db().await;
diff --git a/src/infra/src/table/fleets.rs b/src/infra/src/table/fleets.rs
index 7178768dc5..5d936db11c 100644
--- a/src/infra/src/table/fleets.rs
+++ b/src/infra/src/table/fleets.rs
@@ -142,6 +142,26 @@ pub async fn set_desired_with<C: ConnectionTrait>(
     Ok(())
 }
 
+/// Leaves the fleet with no desired version, keeping stable and its settings.
+pub async fn clear_desired_with<C: ConnectionTrait>(
+    conn: &C,
+    org_id: &str,
+    fleet_id: &str,
+    actor: &str,
+    now_us: i64,
+) -> Result<(), Error> {
+    Entity::update_many()
+        .col_expr(Column::ConfigId, Expr::value(Option::<String>::None))
+        .col_expr(Column::ConfigVersion, Expr::value(Option::<i64>::None))
+        .col_expr(Column::UpdatedAt, Expr::value(now_us))
+        .col_expr(Column::UpdatedBy, Expr::value(actor))
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::FleetId.eq(fleet_id))
+        .exec(conn)
+        .await?;
+    Ok(())
+}
+
 /// Replaces the fleet's setting overrides, keeping its versions; creates the row when absent.
 pub async fn set_settings_with<C: ConnectionTrait>(
     conn: &C,
@@ -221,6 +241,37 @@ mod tests {
     use super::*;
     use crate::table::migration::create_fleet_collectors_for_test;
 
+    #[tokio::test]
+    async fn clearing_desired_keeps_stable_and_settings() {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        create_fleet_collectors_for_test(&db).await.unwrap();
+        set_settings_with(&db, "o1", "f1", Some("{}".to_string()), "u", 1)
+            .await
+            .unwrap();
+        set_desired_with(&db, "o1", "f1", ("edge", 2), "u", 2)
+            .await
+            .unwrap();
+        set_stable_with(&db, "o1", "f1", ("edge", 1)).await.unwrap();
+        set_desired_with(&db, "o1", "f2", ("edge", 2), "u", 2)
+            .await
+            .unwrap();
+
+        clear_desired_with(&db, "o1", "f1", "system", 3)
+            .await
+            .unwrap();
+
+        let row = get_with(&db, "o1", "f1").await.unwrap().unwrap();
+        assert_eq!((row.config_id, row.config_version), (None, None));
+        assert_eq!(
+            (row.stable_config_id.as_deref(), row.stable_config_version),
+            (Some("edge"), Some(1))
+        );
+        assert_eq!(row.settings.as_deref(), Some("{}"));
+        assert_eq!((row.updated_at, row.updated_by.as_str()), (3, "system"));
+        let other = get_with(&db, "o1", "f2").await.unwrap().unwrap();
+        assert_eq!(other.config_version, Some(2), "only this fleet");
+    }
+
     #[tokio::test]
     async fn settings_and_desired_never_overwrite_each_other() {
         let db = Database::connect("sqlite::memory:").await.unwrap();
diff --git a/src/jobs/src/job/mod.rs b/src/jobs/src/job/mod.rs
index ab42627da2..c8bd52d71f 100644
--- a/src/jobs/src/job/mod.rs
+++ b/src/jobs/src/job/mod.rs
@@ -695,14 +695,15 @@ pub async fn init() -> Result<(), anyhow::Error> {
     #[cfg(feature = "enterprise")]
     openobserve_core::workflows::http_trigger::spawn_node_tasks();
 
+    // Routers profile themselves too; without an ingester role they need ZO_SELF_PROFILES_URL.
+    #[cfg(feature = "cpu-profiling")]
+    tokio::task::spawn(openobserve_core::self_profiles::run());
+
     // Router doesn't need to initialize job
     if LOCAL_NODE.is_router() && LOCAL_NODE.is_single_role() {
         return Ok(());
     }
 
-    #[cfg(feature = "cpu-profiling")]
-    tokio::task::spawn(openobserve_core::self_profiles::run());
-
     // telemetry run
     if cfg.common.telemetry_enabled && LOCAL_NODE.is_querier() {
         spawn_pausable_job!(
@@ -1865,6 +1866,26 @@ mod tests {
         );
     }
 
+    #[test]
+    fn self_profiles_are_spawned_before_the_router_return() {
+        let source = include_str!("mod.rs");
+        let init = source
+            .split("pub async fn init()")
+            .nth(1)
+            .and_then(|rest| rest.split("mod tests {").next())
+            .expect("init() body");
+        let self_profiles = init
+            .find("tokio::task::spawn(openobserve_core::self_profiles::run());")
+            .expect("init() must spawn self_profiles::run()");
+        let router_return = init
+            .find("if LOCAL_NODE.is_router() && LOCAL_NODE.is_single_role()")
+            .expect("router return in init()");
+        assert!(
+            self_profiles < router_return,
+            "single-role routers must run the self-profiles loop"
+        );
+    }
+
     #[test]
     fn steady_states_hold() {
         assert_eq!(
diff --git a/tests/ui-testing/pages/generalPages/dateTimePickerPage.js b/tests/ui-testing/pages/generalPages/dateTimePickerPage.js
index a27f93c638..5b3ca8f745 100644
--- a/tests/ui-testing/pages/generalPages/dateTimePickerPage.js
+++ b/tests/ui-testing/pages/generalPages/dateTimePickerPage.js
@@ -69,11 +69,12 @@ export class DateTimePickerPage {
         this.customPeriodTrigger = this.customRow.locator('[role="combobox"]');
 
         // ==================== Expected toast messages ====================
-        // Values of common.dateRangeCopied / dateRangePasted / dateRangePasteError
+        // Values of common.dateRangeCopied / dateRangePasted / dateRangePasteError / dateRangePasteEmpty
         // in web/src/locales/languages/en-US.json.
         this.copiedToastMessage = 'Date range copied';
         this.pastedToastMessage = 'Date range pasted';
         this.pasteErrorToastMessage = 'Could not parse date range';
+        this.pasteEmptyToastMessage = 'Clipboard is empty. Copy a date range first.';
     }
 
     // ==================== Locator factories ====================
@@ -250,6 +251,11 @@ export class DateTimePickerPage {
         await expect(this.toastByMessage(this.pasteErrorToastMessage)).toBeVisible();
     }
 
+    async expectPasteEmptyToast() {
+        await expect(this.toastByMessage(this.pasteEmptyToastMessage)).toBeVisible();
+        await expect(this.toastByMessage(this.pasteErrorToastMessage)).toHaveCount(0);
+    }
+
     // ==================== Value readers ====================
 
     async getStartTimeValue() {
diff --git a/tests/ui-testing/pages/generalPages/ingestionConfigPage.js b/tests/ui-testing/pages/generalPages/ingestionConfigPage.js
index 978b7dca5d..08b816b1a0 100644
--- a/tests/ui-testing/pages/generalPages/ingestionConfigPage.js
+++ b/tests/ui-testing/pages/generalPages/ingestionConfigPage.js
@@ -1,4 +1,5 @@
 import { expect } from '@playwright/test';
+const testLogger = require('../../playwright-tests/utils/test-logger.js');
 
 export class IngestionConfigPage {
     constructor(page) {
@@ -77,6 +78,7 @@ export class IngestionConfigPage {
         this.rumContentText = this.legacyCodeBlockPre.first();
         // Shared by every link in the test so 429 waits stay well under the test timeout
         this.rateLimitRetryBudgetMs = 60000;
+        this.networkErrorRetryBudgetMs = 60000;
     }
 
     // ==================== Navigation ====================
@@ -460,8 +462,7 @@ export class IngestionConfigPage {
     }
 
     async headWithRateLimitRetry(href, maxRetries = 2) {
-        // 5 second timeout to prevent hanging
-        let response = await this.page.request.head(href, { timeout: 5000 });
+        let response = await this.headWithNetworkErrorRetry(href);
         for (let attempt = 0; attempt < maxRetries && response.status() === 429; attempt++) {
             const retryAfter = Number(response.headers()['retry-after']);
             const waitMs = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter * 1000 : 2000;
@@ -478,4 +479,20 @@ export class IngestionConfigPage {
         }
         return response;
     }
+
+    async headWithNetworkErrorRetry(href, maxRetries = 2) {
+        for (let attempt = 0; ; attempt++) {
+            try {
+                // 5 second timeout to prevent hanging
+                return await this.page.request.head(href, { timeout: 5000 });
+            } catch (error) {
+                const retryCostMs = 1000 * (attempt + 1) + 5000;
+                // A spent budget would push the whole test past its timeout, so the real error is reported instead
+                if (attempt >= maxRetries || retryCostMs > this.networkErrorRetryBudgetMs) throw error;
+                testLogger.warn(`[doc-links] HEAD failed (${error.message}), retry ${attempt + 1}/${maxRetries}: ${href}`);
+                this.networkErrorRetryBudgetMs -= retryCostMs;
+                await this.page.waitForTimeout(1000 * (attempt + 1));
+            }
+        }
+    }
 }
diff --git a/tests/ui-testing/pages/logsPages/jobScheduler.js b/tests/ui-testing/pages/logsPages/jobScheduler.js
index 66e0960c38..9f32e21e7a 100644
--- a/tests/ui-testing/pages/logsPages/jobScheduler.js
+++ b/tests/ui-testing/pages/logsPages/jobScheduler.js
@@ -2,6 +2,10 @@ import { expect } from '@playwright/test';
 import testLogger from '../../playwright-tests/utils/test-logger.js';
 const { getAuthHeaders, getOrgIdentifier } = require('../../playwright-tests/utils/cloud-auth.js');
 
+// The search-job worker starts one queued job per 10 s tick, and parallel tests queue several jobs.
+const SEARCH_JOB_START_TIMEOUT_MS = 120000;
+const JOB_STATUS = { PENDING: 0, RUNNING: 1, FINISHED: 2 };
+
 export class JobSchedulerPage {
     constructor(page) {
         this.page = page;
@@ -96,6 +100,16 @@ export class JobSchedulerPage {
         return jobs.findIndex(job => job.trace_id === trace_id);
     }
 
+    async _getJobStatus(trace_id) {
+        const orgId = getOrgIdentifier();
+        const url = `${process.env["ZO_BASE_URL"]}/api/${orgId}/search_jobs?type=logs&search_type=UI&use_cache=true`;
+        const response = await this.page.request.get(url, { headers: getAuthHeaders() });
+        expect(response.status(), `GET search_jobs failed: ${await response.text()}`).toBe(200);
+        const job = (await response.json()).find(j => j.trace_id === trace_id);
+        expect(job, `Job with trace ID ${trace_id} not found in search_jobs`).toBeTruthy();
+        return job.status;
+    }
+
 
 async deleteJobSearch(trace_id) {
       const rowIndex = await this._getJobRowIndex(trace_id);
@@ -165,33 +179,27 @@ async cancelJobSearch(trace_id) {
 }
 
 async exploreJob(trace_id) {
-    // The explore button is disabled while the job is pending (status=0) or failed (status=3).
-    // Retry: each attempt re-fetches the list and checks whether the button is enabled.
-    const maxRetries = 5;
-    let clicked = false;
+    // Explore is enabled only once the job has left pending (0) and was not cancelled (3).
+    let status;
+    await expect.poll(async () => {
+        status = await this._getJobStatus(trace_id);
+        return status;
+    }, {
+        message: `Search job ${trace_id} never left the pending queue`,
+        timeout: SEARCH_JOB_START_TIMEOUT_MS,
+        intervals: [2000, 5000],
+    }).not.toBe(JOB_STATUS.PENDING);
+    expect([JOB_STATUS.RUNNING, JOB_STATUS.FINISHED], `Search job ${trace_id} ended in status ${status}`).toContain(status);
 
-    for (let attempt = 0; attempt < maxRetries; attempt++) {
-        const rowIndex = await this._getJobRowIndex(trace_id, 15000);
-        if (rowIndex === -1) throw new Error(`Job with trace ID ${trace_id} not found in scheduler list`);
+    const rowIndex = await this._getJobRowIndex(trace_id, 15000);
+    if (rowIndex === -1) throw new Error(`Job with trace ID ${trace_id} not found in scheduler list`);
 
-        const row = this.page.locator(`[data-test="search-scheduler-table"] [data-test="o2-table-row-${rowIndex}"]`);
-        await row.waitFor({ state: 'visible', timeout: 10000 });
+    const row = this.page.locator(`[data-test="search-scheduler-table"] [data-test="o2-table-row-${rowIndex}"]`);
+    await row.waitFor({ state: 'visible', timeout: 10000 });
 
-        const exploreButton = row.locator('[data-test="search-scheduler-explore-btn"]');
-        const isEnabled = await exploreButton.isEnabled();
-        if (isEnabled) {
-            await exploreButton.click();
-            clicked = true;
-            break;
-        }
-
-        testLogger.warn(`Explore button for trace ID ${trace_id} is not enabled (attempt ${attempt + 1}/${maxRetries}).`);
-        if (attempt < maxRetries - 1) await this.page.waitForTimeout(5000);
-    }
-
-    if (!clicked) {
-        throw new Error(`Explore button for trace ID ${trace_id} remained disabled after ${maxRetries} attempts.`);
-    }
+    const exploreButton = row.locator('[data-test="search-scheduler-explore-btn"]');
+    await expect(exploreButton, `Explore button for trace ID ${trace_id} is disabled`).toBeEnabled({ timeout: 10000 });
+    await exploreButton.click();
 
     await expect(
         this.page.locator('[data-test="o-toast-message"]').filter({ hasText: 'Search Job have been applied successfully' }).first()
diff --git a/tests/ui-testing/pages/logsPages/logsPage.js b/tests/ui-testing/pages/logsPages/logsPage.js
index aef687db06..5aff5cec76 100644
--- a/tests/ui-testing/pages/logsPages/logsPage.js
+++ b/tests/ui-testing/pages/logsPages/logsPage.js
@@ -4819,11 +4819,7 @@ export class LogsPage {
         // When the show-query toggle is clicked, it switches to results view
         // Check if we're in results view by looking for the logs table
         const logsTable = this.page.locator('[data-test="logs-search-result-logs-table"]');
-        const isResultsVisible = await logsTable.isVisible();
-
-        if (!isResultsVisible) {
-            throw new Error('Expected results view to be visible after toggling query editor off');
-        }
+        await expect(logsTable, 'Expected results view to be visible after toggling query editor off').toBeVisible({ timeout: 15000 });
 
         testLogger.info('Results view is visible - query editor toggled off successfully');
         return true;
diff --git a/tests/ui-testing/playwright-tests/Alerts/alerts-from-panel.spec.js b/tests/ui-testing/playwright-tests/Alerts/alerts-from-panel.spec.js
index c57b67da8a..8b0498dbd6 100644
--- a/tests/ui-testing/playwright-tests/Alerts/alerts-from-panel.spec.js
+++ b/tests/ui-testing/playwright-tests/Alerts/alerts-from-panel.spec.js
@@ -118,7 +118,8 @@ test.describe("Create Alert from Dashboard Panel testcases", () => {
       // is a span, not an <input>, so read the committed value via the helper.
       const alertNameValue = pm.alertsPage.getAlertNameValueLocator();
       await expect(alertNameValue).toBeVisible({ timeout: 30000 });
-      expect((await alertNameValue.textContent()) ?? "").toContain("Alert_from_");
+      // The temporary auto-name shows first until the prefill resetForm applies the panel name
+      await expect(alertNameValue).toContainText("Alert_from_", { timeout: 30000 });
       testLogger.info("Landed on the alert form pre-filled from the panel");
 
       // Navigate back to the dashboard folder and clean up.
diff --git a/tests/ui-testing/playwright-tests/GeneralTests/datetime-picker-copy-paste.spec.js b/tests/ui-testing/playwright-tests/GeneralTests/datetime-picker-copy-paste.spec.js
index e7417d96ca..c97eeb5b16 100644
--- a/tests/ui-testing/playwright-tests/GeneralTests/datetime-picker-copy-paste.spec.js
+++ b/tests/ui-testing/playwright-tests/GeneralTests/datetime-picker-copy-paste.spec.js
@@ -276,19 +276,21 @@ test.describe("DateTime Picker Copy Paste testcases", () => {
     });
 
     // TC-12
-    test("should show the parse error toast when the clipboard is empty", {
+    test("should say the clipboard is empty when pasting an empty clipboard", {
       tag: ['@datetime-picker', '@all', '@P2']
     }, async () => {
       testLogger.info('Pasting with an empty clipboard');
 
       await pm.dateTimePickerPage.selectRelativePeriod('15-m');
+      const labelBeforePaste = await pm.dateTimePickerPage.getTriggerLabel();
       await pm.dateTimePickerPage.seedClipboard('');
       await pm.dateTimePickerPage.clickPaste();
 
-      await pm.dateTimePickerPage.expectPasteErrorToast();
+      await pm.dateTimePickerPage.expectPasteEmptyToast();
       await pm.dateTimePickerPage.expectRelativePanelActive();
+      expect(await pm.dateTimePickerPage.getTriggerLabel()).toBe(labelBeforePaste);
 
-      testLogger.info('Empty clipboard rejected with the parse error toast');
+      testLogger.info('Empty clipboard rejected with the empty-clipboard toast');
     });
   });
 
diff --git a/tests/ui-testing/playwright-tests/Logs/logs-jk-navigation.spec.js b/tests/ui-testing/playwright-tests/Logs/logs-jk-navigation.spec.js
index c2005dff61..834949a3c2 100644
--- a/tests/ui-testing/playwright-tests/Logs/logs-jk-navigation.spec.js
+++ b/tests/ui-testing/playwright-tests/Logs/logs-jk-navigation.spec.js
@@ -107,6 +107,8 @@ async function openResults(page) {
   ).toHaveCount(0, {
     timeout: 60000,
   });
+  // Stale rows stay on screen during the re-run and the app ignores J/K until the hits settle.
+  expect(await logs.getResultHitsCount()).toBe(50);
   await page.evaluate(
     () =>
       document.activeElement instanceof HTMLElement &&
diff --git a/tests/ui-testing/playwright-tests/Metrics/metrics-aggregations.spec.js b/tests/ui-testing/playwright-tests/Metrics/metrics-aggregations.spec.js
index 37cad4e4af..49ad941c83 100644
--- a/tests/ui-testing/playwright-tests/Metrics/metrics-aggregations.spec.js
+++ b/tests/ui-testing/playwright-tests/Metrics/metrics-aggregations.spec.js
@@ -2,11 +2,16 @@ const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures
 const testLogger = require('../utils/test-logger.js');
 const PageManager = require('../../pages/page-manager.js');
 const { ensureMetricsIngested } = require('../utils/shared-metrics-setup.js');
+const metricsIngestion = require('../utils/metrics-ingestion.js');
 const { verifyDataOnUIWithValues: verifyDataOnUI } = require('../utils/metrics-assertions.js');
 
 test.describe("Metrics Aggregation and Grouping Tests", () => {
   test.beforeAll(async () => {
     await ensureMetricsIngested();
+    // The random seed puts ~1 point per series, and rate() needs 2+ points in one series.
+    const seeded = await metricsIngestion.ingestFixedRequestCountSeries();
+    expect(seeded.success, `fixed request_count seed failed: ${seeded.error}`).toBe(true);
+    expect(await metricsIngestion.waitForMetricQueryable('sum by (service) (rate(request_count[5m]))'), 'rate(request_count[5m]) never became queryable').toBe(true);
   });
 
   /** Create fresh PageManager per test — avoids data races in parallel workers. */
diff --git a/tests/ui-testing/playwright-tests/Streams/ingestion-config.spec.js b/tests/ui-testing/playwright-tests/Streams/ingestion-config.spec.js
index a672f7a7ae..332f9a8fc9 100644
--- a/tests/ui-testing/playwright-tests/Streams/ingestion-config.spec.js
+++ b/tests/ui-testing/playwright-tests/Streams/ingestion-config.spec.js
@@ -328,7 +328,7 @@ test.describe("Ingestion Configuration Tests", () => {
           testLogger.info(`  Path: ${item.path}`);
           for (const link of item.brokenLinks) {
             testLogger.info(`  ✗ ${link.url}`);
-            testLogger.info(`    Status: ${link.status || link.error}`);
+            testLogger.info(`    Status: ${link.error ? `${link.status} (${link.error})` : link.status}`);
           }
         }
         testLogger.info('\n' + '='.repeat(80));
diff --git a/tests/ui-testing/playwright-tests/utils/metrics-ingestion.js b/tests/ui-testing/playwright-tests/utils/metrics-ingestion.js
index 5eab069c5d..376b694847 100644
--- a/tests/ui-testing/playwright-tests/utils/metrics-ingestion.js
+++ b/tests/ui-testing/playwright-tests/utils/metrics-ingestion.js
@@ -585,6 +585,49 @@ class MetricsIngestion {
         };
     }
 
+    /**
+     * Send several request_count points into one fixed series so rate() over it is never empty.
+     */
+    async ingestFixedRequestCountSeries(points = 5, spacingMs = 15000) {
+        const now = Date.now();
+        const dataPoints = [];
+        for (let i = 0; i < points; i++) {
+            dataPoints.push({
+                timeUnixNano: ((now - (points - 1 - i) * spacingMs) * 1000000).toString(),
+                asDouble: 100 + i * 10,
+                attributes: [
+                    { key: "node", value: { stringValue: "server-01" } },
+                    { key: "service", value: { stringValue: "api-gateway" } },
+                    { key: "region", value: { stringValue: "us-east-1" } }
+                ]
+            });
+        }
+        const metricsData = {
+            resourceMetrics: [{
+                resource: {
+                    attributes: [
+                        { key: "service.name", value: { stringValue: "api-gateway" } },
+                        { key: "service.version", value: { stringValue: "1.0.0" } },
+                        { key: "environment", value: { stringValue: "production" } },
+                        { key: "host.name", value: { stringValue: "server-01" } },
+                        { key: "region", value: { stringValue: "us-east-1" } }
+                    ]
+                },
+                scopeMetrics: [{
+                    scope: { name: "opentelemetry-instrumentation", version: "1.0.0" },
+                    metrics: [{ name: "request_count", unit: "count", gauge: { dataPoints } }]
+                }]
+            }]
+        };
+        const result = await this.sendMetrics(metricsData);
+        if (result.success) {
+            testLogger.info('Sent fixed request_count series', { points });
+        } else {
+            testLogger.error('Failed to send fixed request_count series', { error: result.error });
+        }
+        return result;
+    }
+
     /**
      * Continuous metrics ingestion
      * Uses while loop with await to prevent overlapping executions
diff --git a/web/src/components/DateTime.paste.spec.ts b/web/src/components/DateTime.paste.spec.ts
index feeb11acde..a693e729cd 100644
--- a/web/src/components/DateTime.paste.spec.ts
+++ b/web/src/components/DateTime.paste.spec.ts
@@ -156,6 +156,29 @@ describe("DateTime paste", () => {
     expect(lastToast()).toMatchObject({ variant: "success" });
   });
 
+  it.each([
+    ["an empty", ""],
+    ["a whitespace-only", "  \n\t "],
+  ])("says the clipboard is empty when the paste button reads %s clipboard", async (_, text) => {
+    stubReadText(() => Promise.resolve(text));
+    createWrapper();
+    await openMenu();
+    const emitsBefore = (wrapper!.emitted("on:date-change") ?? []).length;
+
+    await wrapper!.vm.pasteRange();
+    await flushPromises();
+
+    expect(toastMock).toHaveBeenCalledTimes(1);
+    expect(lastToast()).toMatchObject({
+      variant: "info",
+      message: "Clipboard is empty. Copy a date range first.",
+    });
+    expect(toastMock).not.toHaveBeenCalledWith(
+      expect.objectContaining({ message: "Could not parse date range" }),
+    );
+    expect((wrapper!.emitted("on:date-change") ?? []).length).toBe(emitsBefore);
+  });
+
   it("keeps the default focus inside the panel when the rail has nothing to focus", async () => {
     localStorage.clear();
     createWrapper({ calendarPresets: false });
diff --git a/web/src/components/DateTime.vue b/web/src/components/DateTime.vue
index 3edd152d1f..4e2dbab606 100644
--- a/web/src/components/DateTime.vue
+++ b/web/src/components/DateTime.vue
@@ -1540,6 +1540,10 @@ export default defineComponent({
         });
         return;
       }
+      if (!text.trim()) {
+        toast({ variant: "info", message: t("common.dateRangePasteEmpty") });
+        return;
+      }
       applyPastedTextWithToast(text);
     };
 
diff --git a/web/src/components/Header.spec.ts b/web/src/components/Header.spec.ts
index 7fec38813a..a279e69cb5 100644
--- a/web/src/components/Header.spec.ts
+++ b/web/src/components/Header.spec.ts
@@ -17,6 +17,7 @@ import { afterEach, describe, expect, it, beforeEach, vi } from "vitest";
 import { mount, shallowMount } from "@vue/test-utils";
 import { computed, nextTick } from "vue";
 import i18n from "@/locales";
+import OLockBadge from "@/lib/core/Badge/OLockBadge.vue";
 import Header from "@/components/Header.vue";
 import * as cookies from "@/utils/cookies";
 import { chartColor } from "@/utils/chartTheme";
@@ -543,6 +544,25 @@ describe("Header Component", () => {
       aiWrapper.unmount();
     });
 
+    it("keeps the AI logo with a lock badge and under a locked license", async () => {
+      const aiWrapper = createWrapper({
+        mountType: "mount",
+        storeOverrides: {
+          state: { zoConfig: { ai_enabled: true, features: { ai_assistant: "locked" } } },
+        },
+        configOverrides: { isEnterprise: "true" },
+        stubsOverrides: {},
+      });
+      await aiWrapper.vm.$nextTick();
+
+      const aiButton = aiWrapper.find('[data-test="menu-link-ai-locked"]');
+      expect(aiButton.exists()).toBe(true);
+      expect(aiButton.find("img").exists()).toBe(true);
+      expect(aiButton.findComponent(OLockBadge).exists()).toBe(true);
+      expect(aiButton.attributes("aria-label")).toContain("Locked: needs");
+      aiWrapper.unmount();
+    });
+
     it("should not display AI button if ai_enabled is false", async () => {
       const aiWrapper = createWrapper({
         mountType: "mount",
diff --git a/web/src/components/Header.vue b/web/src/components/Header.vue
index 021b8a46bd..f520775d55 100644
--- a/web/src/components/Header.vue
+++ b/web/src/components/Header.vue
@@ -234,15 +234,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
            Leads the utility-icon cluster, set off by a separator from the
            org selector so it reads as the primary action in this group.
            Shown locked (not hidden) in builds that don't unlock it. -->
-          <template v-if="aiButtonVisible">
+          <template v-if="aiButtonVisible || aiLicenseLocked">
             <OButton
               variant="ghost"
               size="icon-toolbar"
-              @click="toggleAIChat"
-              data-test="menu-link-ai-item"
-              :aria-label="t('menu.aiAssistant')"
+              @click="aiLicenseLocked ? openLockedAiAssistant() : toggleAIChat()"
+              :data-test="aiLicenseLocked ? 'menu-link-ai-locked' : 'menu-link-ai-item'"
+              :aria-label="
+                aiLicenseLocked
+                  ? t('featureLock.headerLocked', {
+                      feature: featureName('ai_assistant') ?? t('featureLock.thisFeature'),
+                    })
+                  : t('menu.aiAssistant')
+              "
               class="group text-ai-accent! hover:shadow-ai-accent/35 dark:shadow-ai-accent/20 dark:hover:shadow-ai-accent/35 [background:var(--color-gradient-ai-subtle)]! [transition:background_0.3s_ease,box-shadow_0.3s_ease,color_0.3s_ease] hover:text-white! hover:shadow-md hover:[background:var(--color-gradient-ai)]! dark:text-white! dark:shadow-md dark:hover:shadow-md"
-              :class="store.state.isAiChatEnabled ? 'ai-btn-active' : ''"
+              :class="store.state.isAiChatEnabled && !aiLicenseLocked ? 'ai-btn-active' : ''"
               @mouseenter="handleMouseEnter"
               @mouseleave="handleMouseLeave"
             >
@@ -251,19 +257,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :src="getBtnLogo"
                 class="h-5 w-5 shrink-0 [transition:transform_0.6s_ease] group-hover:rotate-180 group-hover:brightness-0 group-hover:invert group-hover:[transition:filter_0.3s_ease]"
               />
-              <span
-                v-if="!aiAccess.allowed"
-                aria-hidden="true"
-                class="bg-surface-overlay border-surface-base absolute -top-1 -right-1 flex h-3.5 w-3.5 items-center justify-center rounded-full border shadow-sm"
-              >
-                <OIcon name="lock" size="xs" class="text-warning-600 size-2.5!" />
-              </span>
+              <OLockBadge v-if="!aiAccess.allowed || aiLicenseLocked" />
               <OTooltip
                 v-if="aiAccess.allowed"
                 side="bottom"
                 align="center"
-                :content="t('menu.aiAssistant')"
-                shortcut-id="aiChatToggle"
+                :content="
+                  aiLicenseLocked
+                    ? t('featureLock.headerLocked', {
+                        feature: featureName('ai_assistant') ?? t('featureLock.thisFeature'),
+                      })
+                    : t('menu.aiAssistant')
+                "
+                :shortcut-id="aiLicenseLocked ? undefined : 'aiChatToggle'"
               />
             </OButton>
           </template>
@@ -509,6 +515,7 @@ import LinkedAccountsDialog from "./settings/LinkedAccountsDialog.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OPageHeaderStatus from "@/lib/core/PageHeader/OPageHeaderStatus.vue";
+import OLockBadge from "@/lib/core/Badge/OLockBadge.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { checkFeatureAccess } from "@/utils/enterpriseFeatures";
 import { readSlackOrgConfig } from "@/utils/slackSettings";
@@ -519,6 +526,8 @@ import ODropdownSeparator from "@/lib/overlay/Dropdown/ODropdownSeparator.vue";
 import ODropdownGroup from "@/lib/overlay/Dropdown/ODropdownGroup.vue";
 
 import { getImageURL } from "@/utils/zincutils";
+import { featureLockedPath, menuState } from "@/utils/featureGate";
+import { useFeatureNames } from "@/composables/useFeatureLock";
 import { chartColor } from "@/utils/chartTheme";
 
 export default defineComponent({
@@ -532,6 +541,7 @@ export default defineComponent({
     LinkedAccountsDialog,
     OButton,
     OIcon,
+    OLockBadge,
     OTooltip,
     ODropdown,
     ODropdownItem,
@@ -623,6 +633,7 @@ export default defineComponent({
   ],
   setup(props, { emit }) {
     const { t } = useI18nTyped();
+    const { featureName } = useFeatureNames();
     const router = useRouter();
     const { isDark } = useTheme();
 
@@ -728,14 +739,23 @@ export default defineComponent({
     );
     // A focus-mode route has no side menu and no AI panel, so their buttons go too.
     const focusMode = computed(() => props.router?.currentRoute?.value?.meta?.focusMode === true);
+    // The license map applies once the edition allows the assistant.
+    const aiAssistantState = computed(() =>
+      menuState(
+        props.store.state.zoConfig?.features,
+        "ai_assistant",
+        Boolean(props.store.state.zoConfig.ai_enabled),
+      ),
+    );
     const aiButtonVisible = computed(
-      () =>
-        !focusMode.value &&
-        (!aiAccess.value.allowed || Boolean(props.store.state.zoConfig.ai_enabled)),
+      () => !focusMode.value && (!aiAccess.value.allowed || aiAssistantState.value === "enabled"),
     );
     const aiSlotPending = computed(
       () => aiAccess.value.allowed && !props.store.state.zoConfig?.version,
     );
+    const aiLicenseLocked = computed(
+      () => !focusMode.value && aiAccess.value.allowed && aiAssistantState.value === "locked",
+    );
 
     // The edition gate and the org's runtime switch both have to pass, as for Settings › Slack.
     const linkedAccountsVisible = computed(
@@ -795,6 +815,13 @@ export default defineComponent({
       emit("toggleAIChat");
     };
 
+    const openLockedAiAssistant = () => {
+      router.push({
+        path: featureLockedPath("ai_assistant"),
+        query: { org_identifier: props.store.state.selectedOrganization?.identifier },
+      });
+    };
+
     const openSlack = () => {
       emit("openSlack");
     };
@@ -842,6 +869,7 @@ export default defineComponent({
       isDark,
       t,
       raw,
+      featureName,
       getImageURL,
       enterpriseButtonText,
       aiSlotPending,
@@ -858,9 +886,12 @@ export default defineComponent({
       homeUrl,
       goToAbout,
       toggleAIChat,
+      aiAssistantState,
+      openLockedAiAssistant,
       aiAccess,
       aiButtonVisible,
       focusMode,
+      aiLicenseLocked,
       linkedAccountsVisible,
       showLinkedAccounts,
       openSlack,
diff --git a/web/src/components/MenuLink.spec.ts b/web/src/components/MenuLink.spec.ts
index 9349ec8df0..dfd52bb2b2 100644
--- a/web/src/components/MenuLink.spec.ts
+++ b/web/src/components/MenuLink.spec.ts
@@ -387,6 +387,38 @@ describe("MenuLink", async () => {
     });
   });
 
+  describe("license-locked tile", () => {
+    it("keeps a real link to the page and adds a lock badge", () => {
+      const w = mount(MenuLink, {
+        props: { title: "Workflows", link: "/workflows", licenseLocked: true },
+        global: { plugins: [i18n, mockRouter], provide: { store } },
+      });
+      const tile = w.get('[data-test="menu-link-/workflows-item"]');
+      expect(tile.element.tagName).toBe("A");
+      expect(tile.attributes("href")).toContain("/workflows");
+      expect(w.find('[data-test="menu-link-/workflows-license-lock"]').exists()).toBe(true);
+      w.unmount();
+    });
+  });
+
+  describe("license-locked tile screen-reader text", () => {
+    it("names the lock with the supplied label and paints it gold", () => {
+      const w = mount(MenuLink, {
+        props: {
+          title: "Workflows",
+          link: "/workflows",
+          licenseLocked: true,
+          licenseLockedLabel: "Locked: needs Workflows",
+        },
+        global: { plugins: [i18n, mockRouter], provide: { store } },
+      });
+      const badge = w.get('[data-test="menu-link-/workflows-license-lock"]');
+      expect(badge.get(".sr-only").text()).toBe("Locked: needs Workflows");
+      expect(badge.find(".text-icon-locked").exists()).toBe(true);
+      w.unmount();
+    });
+  });
+
   describe("trial-paywalled tile (AC-14)", () => {
     function mountTile(props: Record<string, unknown> = {}) {
       return mount(MenuLink, {
diff --git a/web/src/components/MenuLink.vue b/web/src/components/MenuLink.vue
index aaab24684c..7c2c5706d4 100644
--- a/web/src/components/MenuLink.vue
+++ b/web/src/components/MenuLink.vue
@@ -36,12 +36,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <!-- Rail icons are a hair smaller than the md (24px) default. -->
           <OIcon v-if="icon" :name="icon" size="md" class="size-5.5!" />
           <component v-else-if="hasIconComponent" :is="iconComponent" class="o-icon size-5.5" />
-          <div
-            v-if="locked"
-            class="bg-surface-base absolute -top-1 -right-1 z-1 flex h-3.5 w-3.5 items-center justify-center rounded-full"
-          >
-            <OIcon name="lock" size="xs" class="text-warning-600" />
-          </div>
+          <OLockBadge
+            v-if="locked || licenseLocked"
+            :data-test="licenseLocked ? `menu-link-${link}-license-lock` : undefined"
+            :label="licenseLocked ? licenseLockedLabel : undefined"
+          />
           <div
             v-if="badge && badge > 0"
             class="menu-badge text-3xs text-text-inverse shadow-error-500/50 border-menu-badge-ring bg-gradient-notification absolute -top-1 -right-2 z-1 flex h-4 min-w-4 animate-pulse items-center justify-center rounded-full border-2 px-1 leading-none font-bold shadow-md"
@@ -104,6 +103,7 @@ import { injectTooltipRootContext } from "reka-ui";
 import { useTheme } from "@/composables/useTheme";
 import { raw, type I18nText, useI18nTyped } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OLockBadge from "@/lib/core/Badge/OLockBadge.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useIsTruncated } from "@/lib/overlay/Tooltip/useIsTruncated";
 import { RailIndicatorActiveKey } from "@/lib/core/Navbar/ONavbar.types";
@@ -131,7 +131,7 @@ const TooltipSilencer = defineComponent({
 
 export default defineComponent({
   name: "MenuLink",
-  components: { OIcon, OTooltip, TooltipSilencer },
+  components: { OIcon, OLockBadge, OTooltip, TooltipSilencer },
   // Attrs are re-bound onto the tile element by hand: the tooltip wrapper is a fragment.
   inheritAttrs: false,
   props: {
@@ -218,6 +218,15 @@ export default defineComponent({
       type: String as unknown as PropType<I18nText>,
       default: raw(""),
     },
+    // The license locks the feature: badge only, since the real page renders its own locked state.
+    licenseLocked: {
+      type: Boolean,
+      default: false,
+    },
+    licenseLockedLabel: {
+      type: String as unknown as PropType<I18nText>,
+      default: undefined,
+    },
   },
   emits: ["trigger"],
   setup(props, { emit }) {
diff --git a/web/src/components/O2AIChat.navigation.spec.ts b/web/src/components/O2AIChat.navigation.spec.ts
index 4a41e534c1..0afac5da68 100644
--- a/web/src/components/O2AIChat.navigation.spec.ts
+++ b/web/src/components/O2AIChat.navigation.spec.ts
@@ -18,6 +18,7 @@ import { describe, expect, it, vi } from "vitest";
 import {
   buildNavigationRoute,
   generateNavigationFromToolResult,
+  navigationFeature,
   navigationPageName,
 } from "@/components/O2AIChat.navigation";
 import type { NavigationAction } from "@/ts/interfaces/chat";
@@ -355,3 +356,26 @@ describe("buildNavigationRoute", () => {
     ).toBeNull();
   });
 });
+
+describe("navigationFeature", () => {
+  it.each([
+    ["logs", "logs"],
+    ["metrics", "metrics"],
+    ["traces", "traces"],
+    ["enrichment_tables", null],
+  ])("keys a %s query to %s", (type, key) => {
+    expect(
+      navigationFeature({ action: "load_query", resource_type: type, target: {} } as any),
+    ).toBe(key);
+  });
+
+  it.each([
+    ["alert", "alerts"],
+    ["dashboard", "dashboards"],
+    ["pipeline", null],
+  ])("keys a direct %s navigation to %s", (type, key) => {
+    expect(
+      navigationFeature({ action: "navigate_direct", resource_type: type, target: {} } as any),
+    ).toBe(key);
+  });
+});
diff --git a/web/src/components/O2AIChat.navigation.ts b/web/src/components/O2AIChat.navigation.ts
index 7404d637ab..20fcdb822f 100644
--- a/web/src/components/O2AIChat.navigation.ts
+++ b/web/src/components/O2AIChat.navigation.ts
@@ -15,6 +15,7 @@
 
 import type { NavigationAction } from "@/ts/interfaces/chat";
 import { raw, type TranslateFn } from "@/types/i18n";
+import { streamTypeFeature } from "@/utils/featureGate";
 
 export interface NavigationRoute {
   path: string;
@@ -175,6 +176,15 @@ export function generateNavigationFromToolResult(
   };
 }
 
+const RESOURCE_FEATURES: Record<string, string> = { alert: "alerts", dashboard: "dashboards" };
+
+/** License key of the page a navigation action opens; null when that page has no key. */
+export function navigationFeature(action: NavigationAction): string | null {
+  return action.action === "load_query"
+    ? streamTypeFeature(action.resource_type)
+    : (RESOURCE_FEATURES[action.resource_type] ?? null);
+}
+
 export function navigationPageName(action: NavigationAction): string {
   return (
     action.label ||
diff --git a/web/src/components/QueryEditor.vue b/web/src/components/QueryEditor.vue
index 8c275c3934..e25e12cdaa 100644
--- a/web/src/components/QueryEditor.vue
+++ b/web/src/components/QueryEditor.vue
@@ -135,7 +135,7 @@
           aria-hidden="true"
           class="bg-surface-overlay border-surface-base absolute -top-1 -right-1 flex h-3.5 w-3.5 items-center justify-center rounded-full border shadow-sm"
         >
-          <OIcon name="lock" size="xs" class="text-warning-600 size-2.5!" />
+          <OIcon name="lock" size="xs" class="text-icon-locked size-2.5!" />
         </span>
         <OTooltip
           v-if="aiAccess.allowed"
diff --git a/web/src/components/ai-assistant/chat/O2AIChatMessage.spec.ts b/web/src/components/ai-assistant/chat/O2AIChatMessage.spec.ts
index 2837ec71d2..a3b6fc24dc 100644
--- a/web/src/components/ai-assistant/chat/O2AIChatMessage.spec.ts
+++ b/web/src/components/ai-assistant/chat/O2AIChatMessage.spec.ts
@@ -15,6 +15,7 @@
 
 import { describe, it, expect, vi } from "vitest";
 import { mount } from "@vue/test-utils";
+import { createStore } from "vuex";
 import i18n from "@/locales";
 
 vi.mock("dompurify", () => ({
@@ -93,6 +94,49 @@ describe("O2AIChatMessage", () => {
     ]);
   });
 
+  it("locks View in Logs, in the block and the tool-call icon, while logs is locked", async () => {
+    const action = {
+      action: "load_query",
+      resource_type: "logs",
+      label: "View in Logs",
+      target: {},
+    };
+    const message = assistant({
+      contentBlocks: [
+        {
+          type: "tool_call",
+          tool: "SearchSQL",
+          message: "m",
+          success: true,
+          navigationAction: action,
+        },
+        { type: "navigation", navigationAction: action },
+      ],
+    });
+    const lockedStore = createStore({ state: { zoConfig: { features: { logs: "locked" } } } });
+    const locked = mount(O2AIChatMessage, {
+      global: { plugins: [i18n, lockedStore] },
+      props: {
+        message,
+        index: 0,
+        isLoading: false,
+        currentAnalyzingMessage: "",
+        expandedToolCalls: new Set<string>(),
+        expandedLogEntries: new Set<string>(),
+      },
+    });
+    const btn = locked.find('[data-test="o2-ai-chat-navigate-locked"]');
+    expect(btn.attributes("disabled")).toBeDefined();
+    await btn.trigger("click");
+    await locked.find('[data-test="o2-ai-chat-tool-navigate-locked"]').trigger("click");
+    expect(locked.emitted("navigate")).toBeUndefined();
+
+    const open = mountMessage(message);
+    expect(open.find('[data-test="o2-ai-chat-navigate-locked"]').exists()).toBe(false);
+    await open.find(".navigation-block-btn").trigger("click");
+    expect(open.emitted("navigate")).toEqual([[action]]);
+  });
+
   it("emits retry with the message and like/dislike without arguments", async () => {
     const message = assistant();
     const w = mountMessage(message);
diff --git a/web/src/components/ai-assistant/chat/O2AIChatMessage.vue b/web/src/components/ai-assistant/chat/O2AIChatMessage.vue
index 28a911a034..065c35f4a1 100644
--- a/web/src/components/ai-assistant/chat/O2AIChatMessage.vue
+++ b/web/src/components/ai-assistant/chat/O2AIChatMessage.vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { computed } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import type { ChatMessage, ContentBlock, NavigationAction } from "@/ts/interfaces/chat";
 import {
   formatLogEntryContent,
@@ -16,6 +16,8 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { navigationFeature } from "@/components/O2AIChat.navigation";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 
 // ContentBlock has no log_entry member, but parseLogEntries puts them into user messages.
 type LogEntryBlock = { type: "log_entry"; preview: string; content: string };
@@ -48,6 +50,11 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const { isLocked, lockedReason } = useLicenseLocks();
+const navLock = (action: NavigationAction): I18nText | null => {
+  const key = navigationFeature(action);
+  return key && isLocked(key) ? lockedReason(key) : null;
+};
 
 // Positional key shape must match the shell's toggleLogEntryExpanded.
 const isLogEntryExpanded = (blockIndex: number) =>
@@ -165,8 +172,27 @@ const isStopped = computed(() =>
             >
               {{ t("aiAssistant.errorMayBeTemporary") }}
             </div>
+            <OTooltip
+              v-if="block.navigationAction && navLock(block.navigationAction)"
+              :content="navLock(block.navigationAction) ?? undefined"
+            >
+              <span class="ms-6 mt-2 inline-flex self-start">
+                <OButton
+                  variant="primary"
+                  size="xs"
+                  class="stream-error-action text-compact"
+                  disabled
+                  data-test="o2-ai-chat-error-navigate-locked"
+                >
+                  <template #icon-left
+                    ><OIcon name="lock" class="text-icon-locked" size="sm"
+                  /></template>
+                  {{ block.navigationAction.label }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
-              v-if="block.navigationAction"
+              v-else-if="block.navigationAction"
               variant="primary"
               size="xs"
               class="stream-error-action text-compact ms-6 mt-2 self-start"
@@ -215,7 +241,27 @@ const isStopped = computed(() =>
             v-else-if="block.type === 'navigation' && block.navigationAction && !readonly"
             class="navigation-block my-1 [background:color-mix(in_srgb,var(--color-info)_8%,transparent)] dark:[background:color-mix(in_srgb,var(--color-info)_12%,transparent)]"
           >
+            <OTooltip
+              v-if="navLock(block.navigationAction)"
+              :content="navLock(block.navigationAction) ?? undefined"
+            >
+              <span class="inline-flex">
+                <OButton
+                  variant="primary"
+                  size="xs"
+                  class="navigation-block-btn text-compact"
+                  disabled
+                  data-test="o2-ai-chat-navigate-locked"
+                >
+                  <template #icon-left
+                    ><OIcon name="lock" class="text-icon-locked" size="sm"
+                  /></template>
+                  {{ block.navigationAction.label }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
+              v-else
               variant="primary"
               size="xs"
               class="navigation-block-btn text-compact"
diff --git a/web/src/components/ai-assistant/chat/O2AIChatToolCallBlock.vue b/web/src/components/ai-assistant/chat/O2AIChatToolCallBlock.vue
index 62d8c697d0..9de8a3b66b 100644
--- a/web/src/components/ai-assistant/chat/O2AIChatToolCallBlock.vue
+++ b/web/src/components/ai-assistant/chat/O2AIChatToolCallBlock.vue
@@ -13,6 +13,8 @@ import { copyToClipboard } from "@/utils/clipboard";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { navigationFeature } from "@/components/O2AIChat.navigation";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 
 const props = defineProps<{
   block: ToolCallBlock;
@@ -37,6 +39,12 @@ const isExpanded = computed(() =>
 const formatToolCallMessage = (block: ToolCallBlock) => formatToolCall(block, t);
 
 const formatTimestamp = (timestamp: number) => formatToolCallTimestamp(timestamp, t);
+
+const { isLocked, lockedReason } = useLicenseLocks();
+const navLockReason = computed(() => {
+  const key = props.block.navigationAction ? navigationFeature(props.block.navigationAction) : null;
+  return key && isLocked(key) ? lockedReason(key) : null;
+});
 </script>
 
 <template>
@@ -86,8 +94,23 @@ const formatTimestamp = (timestamp: number) => formatToolCallTimestamp(timestamp
         >{{ formatToolCallMessage(block).suffix }}
       </span>
       <!-- Navigation icon -->
+      <OTooltip
+        v-if="block.navigationAction && !block.pendingConfirmation && !readonly && navLockReason"
+        :content="navLockReason"
+      >
+        <span class="ms-auto inline-flex" @click.stop>
+          <OButton
+            variant="ghost"
+            size="icon-xs"
+            disabled
+            icon-left="lock"
+            :aria-label="block.navigationAction.label"
+            data-test="o2-ai-chat-tool-navigate-locked"
+          />
+        </span>
+      </OTooltip>
       <OIcon
-        v-if="block.navigationAction && !block.pendingConfirmation && !readonly"
+        v-else-if="block.navigationAction && !block.pendingConfirmation && !readonly"
         name="open-in-new"
         size="xs"
         class="navigation-icon ms-auto cursor-pointer opacity-70 transition-opacity duration-200 hover:opacity-100"
diff --git a/web/src/components/alertLibrary/LibraryCard.spec.ts b/web/src/components/alertLibrary/LibraryCard.spec.ts
index ca03fe8419..8df554868b 100644
--- a/web/src/components/alertLibrary/LibraryCard.spec.ts
+++ b/web/src/components/alertLibrary/LibraryCard.spec.ts
@@ -361,6 +361,18 @@ describe("LibraryCard", () => {
       expect(scheduled.find('[data-test="alert-library-card-anomaly"]').exists()).toBe(false);
     });
 
+    it("disables the card, its checkbox and its title button when the license locks it", async () => {
+      const wrapper = mountCard({ entry: anomaly, locked: true, licenseLockedReason: "Locked" });
+      const card = wrapper.find(`[data-test="alert-library-card-${anomaly.id}"]`);
+      expect(card.attributes("aria-disabled")).toBe("true");
+      expect(card.classes()).toContain("cursor-not-allowed");
+      expect(
+        wrapper.find(`[data-test="alert-library-card-title-${anomaly.id}"]`).attributes("disabled"),
+      ).toBeDefined();
+      await card.trigger("click");
+      expect(wrapper.emitted("open")).toBeUndefined();
+    });
+
     it("shows the Enterprise badge only when locked", () => {
       const locked = mountCard({ entry: anomaly, locked: true });
       expect(locked.find('[data-test="alert-library-card-enterprise"]').text()).toBe("Enterprise");
diff --git a/web/src/components/alertLibrary/LibraryCard.vue b/web/src/components/alertLibrary/LibraryCard.vue
index 7bca60dc78..3cd57fff06 100644
--- a/web/src/components/alertLibrary/LibraryCard.vue
+++ b/web/src/components/alertLibrary/LibraryCard.vue
@@ -43,20 +43,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <!-- Not a button any more: a control nested in role="button" is invalid for keyboard and AT. -->
   <article
-    class="rounded-default bg-surface-base flex h-full cursor-pointer flex-col gap-2 border p-3"
-    :class="
+    class="rounded-default bg-surface-base flex h-full flex-col gap-2 border p-3"
+    :class="[
+      licenseLockedReason ? 'cursor-not-allowed' : 'cursor-pointer',
       selected
         ? 'border-accent ring-accent/40 ring-2'
-        : 'border-border-default hover:border-border-strong'
-    "
+        : licenseLockedReason
+          ? 'border-border-default'
+          : 'border-border-default hover:border-border-strong',
+    ]"
+    :aria-disabled="licenseLockedReason ? 'true' : undefined"
     :data-test="`alert-library-card-${entry.id}`"
     :data-selected="selected ? 'true' : 'false'"
-    @click="emit('open')"
+    @click="!licenseLockedReason && emit('open')"
   >
     <div class="flex items-start gap-2">
       <OCheckbox
         size="sm"
         :model-value="selected"
+        :disabled="!!licenseLockedReason"
         :aria-label="t('alert_library.selectAlert', { title: entry.title })"
         class="mt-0.5 shrink-0"
         :data-test="`alert-library-select-${entry.id}`"
@@ -66,7 +71,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <button
           :id="titleId"
           type="button"
-          class="text-text-heading focus-visible:ring-accent/40 rounded-default cursor-pointer text-left outline-none focus-visible:ring-2"
+          :disabled="!!licenseLockedReason"
+          class="text-text-heading focus-visible:ring-accent/40 rounded-default text-left outline-none focus-visible:ring-2 enabled:cursor-pointer disabled:cursor-not-allowed"
           :data-test="`alert-library-card-title-${entry.id}`"
           @click.stop="emit('open')"
         >
@@ -133,8 +139,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :label="t('alert_library.alertTypeAnomaly')"
         data-test="alert-library-card-anomaly"
       />
+      <OTooltip v-if="licenseLockedReason" :content="licenseLockedReason">
+        <span class="inline-flex" data-test="alert-library-card-license-locked">
+          <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
+        </span>
+      </OTooltip>
       <OTag
-        v-if="locked"
+        v-else-if="locked"
         variant="default-soft"
         icon="lock"
         :label="t('alert_library.enterprise')"
@@ -143,7 +154,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       />
 
       <!-- Locked cards open the upsell instead, so they offer nothing to act on here. -->
-      <div v-if="!locked" class="ms-auto flex shrink-0 items-center gap-2">
+      <div v-if="!locked && !licenseLockedReason" class="ms-auto flex shrink-0 items-center gap-2">
         <!-- The editor prefill speaks the scheduled alert shape only. -->
         <OButton
           v-if="!isAnomaly"
@@ -183,7 +194,7 @@ import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import type { AlertLibraryEntry } from "@/types/alertLibrary";
-import { useI18nTyped } from "@/types/i18n";
+import { useI18nTyped, type I18nText } from "@/types/i18n";
 
 import { alertTypeOf, queryTypeLabel, severityBadgeValue, severityLabel } from "./libraryFacets";
 
@@ -195,6 +206,8 @@ const props = defineProps<{
   selected?: boolean;
   /** An anomaly alert this build is not entitled to; the gallery turns its clicks into the upsell. */
   locked?: boolean;
+  /** Set when the license, not the edition, locks this alert; the card shows a lock with this reason. */
+  licenseLockedReason?: I18nText;
 }>();
 
 const emit = defineEmits<{
diff --git a/web/src/components/alertLibrary/LibraryInstallDialog.spec.ts b/web/src/components/alertLibrary/LibraryInstallDialog.spec.ts
index edac864586..9edd31fa6a 100644
--- a/web/src/components/alertLibrary/LibraryInstallDialog.spec.ts
+++ b/web/src/components/alertLibrary/LibraryInstallDialog.spec.ts
@@ -1271,6 +1271,23 @@ describe("LibraryInstallDialog", () => {
       expect(mocks.createAlert).toHaveBeenCalledTimes(1);
     });
 
+    it("keeps anomaly alerts out of the batch while anomaly_detection is license-locked", async () => {
+      store.state.zoConfig = {
+        ...store.state.zoConfig,
+        features: { anomaly_detection: "locked" },
+      } as typeof original.zoConfig;
+      const wrapper = await mountDialog({
+        seed: null,
+        preselect: [seedEntry(), anomalyEntry()],
+      });
+      await advanceToInstall(wrapper);
+      expect(wrapper.find('[data-test="alert-library-install-run"]').text()).toContain("1");
+
+      await click(wrapper, "alert-library-install-run");
+      expect(mocks.createAnomaly).not.toHaveBeenCalled();
+      expect(mocks.createAlert).toHaveBeenCalledTimes(1);
+    });
+
     it("disables Run when the feature turns off under an anomaly-only batch", async () => {
       const wrapper = await mountDialog({
         seed: { entry: anomalyEntry(), file: anomalyFile() },
diff --git a/web/src/components/alert_calibration/AlertCalibrationDigestDetail.spec.ts b/web/src/components/alert_calibration/AlertCalibrationDigestDetail.spec.ts
new file mode 100644
index 0000000000..061dadedac
--- /dev/null
+++ b/web/src/components/alert_calibration/AlertCalibrationDigestDetail.spec.ts
@@ -0,0 +1,112 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import { ref } from "vue";
+import { createMemoryHistory, createRouter } from "vue-router";
+import store from "@/test/unit/helpers/store";
+import AlertCalibrationDigestDetail from "./AlertCalibrationDigestDetail.vue";
+import type { RunRow } from "./digests";
+
+const DAY_MICROS = 86_400_000_000;
+const NOW = Date.now() * 1000;
+
+const RUN: RunRow = {
+  window_start: NOW - 30 * DAY_MICROS,
+  window_end: NOW,
+  emitted_at: NOW,
+  finding_count: 0,
+  skip_count: 0,
+  alerts_in_scope: 8,
+  coverage_gap: false,
+  coverage_unreadable_definitions: 0,
+  coverage_facts_without_definition: 0,
+  coverage_definitions_without_facts: 0,
+  coverage_transitions_truncated: false,
+  coverage_counters_truncated: false,
+  coverage_error_clusters_truncated: false,
+  coverage_error_clusters_unattributed: 0,
+  coverage_stream_substrate_empty: false,
+};
+
+vi.mock("@/composables/alertCalibration/useAlertCalibrationEnabled", () => ({
+  useLeaveIfAlertCalibrationOff: () => {},
+}));
+
+vi.mock("./useDigestSearch", () => ({
+  useDigestSearch: () => ({ search: vi.fn(), orgId: ref("default") }),
+  useLatestRead: () => ({
+    data: ref({ hits: 1, run: RUN, findings: [] }),
+    error: ref(null),
+    loading: ref(false),
+    load: vi.fn(),
+  }),
+}));
+
+const mountPage = async () => {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: "/", component: { template: "<div />" } },
+      { path: "/logs", name: "logs", component: { template: "<div />" } },
+      { path: "/runs", name: "alertCalibrationRuns", component: { template: "<div />" } },
+    ],
+  });
+  await router.push("/");
+  const push = vi.spyOn(router, "push");
+  const wrapper = mount(AlertCalibrationDigestDetail, {
+    props: { windowStart: RUN.window_start, windowEnd: RUN.window_end },
+    global: { plugins: [store, router] },
+  });
+  await flushPromises();
+  return { wrapper, push };
+};
+
+const VIEW_IN_LOGS = '[data-test="alert-calibration-digest-view-in-logs"]';
+
+describe("AlertCalibrationDigestDetail view in logs", () => {
+  afterEach(() => {
+    delete (store.state.zoConfig as Record<string, unknown>).features;
+  });
+
+  it("logs locked: View in logs is disabled with a lock and opens nothing", async () => {
+    (store.state.zoConfig as Record<string, unknown>).features = { logs: "locked" };
+    const { wrapper, push } = await mountPage();
+    const button = wrapper.find(VIEW_IN_LOGS);
+    expect(button.attributes("disabled")).toBeDefined();
+    expect(wrapper.find('[data-test="alert-calibration-digest-view-in-logs-lock"]').exists()).toBe(
+      true,
+    );
+    await button.trigger("click");
+    expect(push).not.toHaveBeenCalled();
+    wrapper.unmount();
+  });
+
+  it("logs enabled: View in logs opens Logs on the digest stream", async () => {
+    const { wrapper, push } = await mountPage();
+    expect(wrapper.find('[data-test="alert-calibration-digest-view-in-logs-lock"]').exists()).toBe(
+      false,
+    );
+    await wrapper.find(VIEW_IN_LOGS).trigger("click");
+    expect(push).toHaveBeenCalledWith(
+      expect.objectContaining({
+        path: "/logs",
+        query: expect.objectContaining({ stream_type: "logs" }),
+      }),
+    );
+    wrapper.unmount();
+  });
+});
diff --git a/web/src/components/alert_calibration/AlertCalibrationDigestDetail.vue b/web/src/components/alert_calibration/AlertCalibrationDigestDetail.vue
index b5890d8119..4f80c1a1d6 100644
--- a/web/src/components/alert_calibration/AlertCalibrationDigestDetail.vue
+++ b/web/src/components/alert_calibration/AlertCalibrationDigestDetail.vue
@@ -37,8 +37,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     data-test="alert-calibration-digest-page"
   >
     <template #actions>
+      <OTooltip v-if="run && logsLock.locked.value" :content="logsLock.lockedReason.value">
+        <span class="inline-flex">
+          <OButton
+            variant="outline"
+            size="sm"
+            disabled
+            data-test="alert-calibration-digest-view-in-logs"
+          >
+            <template #icon-left>
+              <OIcon
+                name="lock"
+                class="text-icon-locked"
+                size="sm"
+                data-test="alert-calibration-digest-view-in-logs-lock"
+              />
+            </template>
+            {{ t("alertCalibration.detail.viewInLogs") }}
+          </OButton>
+        </span>
+      </OTooltip>
       <OButton
-        v-if="run"
+        v-else-if="run"
         variant="outline"
         size="sm"
         icon-left="open-in-new"
@@ -174,6 +194,8 @@ import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
 import OStatStrip from "@/lib/data/StatStrip/OStatStrip.vue";
@@ -202,6 +224,7 @@ const props = defineProps<{ windowStart: string | number; windowEnd: string | nu
 const { t } = useI18nTyped();
 useLeaveIfAlertCalibrationOff("alertList");
 const router = useRouter();
+const logsLock = useLicenseLock("logs");
 const route = useRoute();
 const { search, orgId } = useDigestSearch();
 
diff --git a/web/src/components/alerts/AddAlert.spec.ts b/web/src/components/alerts/AddAlert.spec.ts
index e7e9c863dd..261fdf8065 100644
--- a/web/src/components/alerts/AddAlert.spec.ts
+++ b/web/src/components/alerts/AddAlert.spec.ts
@@ -1358,6 +1358,23 @@ describe("AddAlert (OForm owner)", () => {
       expect(document.querySelector('[data-test="alert-save-mode-dialog"]')).not.toBeNull();
     });
 
+    it("locks the anomaly alert type while anomaly_detection is license-locked", async () => {
+      store.state.zoConfig.features = { anomaly_detection: "locked" };
+      try {
+        wrapper = mountAlert();
+        await flushPromises();
+        const anomaly = wrapper.vm.alertTypeOptions.find((o: any) => o.value === "anomaly");
+        expect(anomaly?.locked).toBe(true);
+        const item = wrapper.find('[data-test="add-alert-type-tab-anomaly"]');
+        expect(item.attributes("disabled")).toBeDefined();
+        wrapper.vm.onAlertTypeChange("anomaly");
+        await flushPromises();
+        expect(wrapper.vm.form.state.values.is_real_time).not.toBe("anomaly");
+      } finally {
+        delete store.state.zoConfig.features;
+      }
+    });
+
     it("falls back to Builder and keeps the SQL when Alert Type switches to Realtime", async () => {
       wrapper = mountAlert();
       await flushPromises();
diff --git a/web/src/components/alerts/AddAlert.vue b/web/src/components/alerts/AddAlert.vue
index b7a3cfb41d..82847246ab 100644
--- a/web/src/components/alerts/AddAlert.vue
+++ b/web/src/components/alerts/AddAlert.vue
@@ -198,10 +198,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :key="option.value"
                   :value="option.value"
                   size="sm"
+                  :disabled="option.locked"
+                  :focusable-unavailable="option.locked"
+                  :tooltip="option.locked ? anomalyLockedReason : undefined"
                   :data-test="`add-alert-type-tab-${option.value}`"
                 >
                   <template #icon-left>
-                    <OIcon :name="option.icon" size="sm" />
+                    <OIcon
+                      :class="option.locked ? 'lock-chip' : undefined"
+                      :name="option.locked ? 'lock' : option.icon"
+                      size="sm"
+                    />
                   </template>
                   {{ option.label }}
                 </OToggleGroupItem>
@@ -668,6 +675,7 @@ import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import CompositeAlertForm from "./composite/CompositeAlertForm.vue";
 import alertsService from "@/services/alerts";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 export default defineComponent({
   name: "ComponentAddUpdateAlert",
@@ -767,6 +775,8 @@ export default defineComponent({
     const isAnomalyDetectionEnabled = computed(
       () => alertForm.store.state.zoConfig.anomaly_detection_enabled === true,
     );
+    const { locked: anomalyLicenseLocked, lockedReason: anomalyLockedReason } =
+      useLicenseLock("anomaly_detection");
 
     // §4.8: keyed off the config API's notice_class field alone.
     const anomalyNoticeBadge = computed(() => {
@@ -872,12 +882,13 @@ export default defineComponent({
     const alertTypeOptions = computed(() => [
       { label: alertForm.t("alerts.scheduled"), value: "false", icon: "schedule" },
       { label: alertForm.t("alerts.realTime"), value: "true", icon: "bolt" },
-      ...(isAnomalyDetectionEnabled.value
+      ...(isAnomalyDetectionEnabled.value || anomalyLicenseLocked.value
         ? [
             {
               label: alertForm.t("alerts.anomalyDetection"),
               value: "anomaly",
               icon: "query-stats",
+              locked: anomalyLicenseLocked.value,
             },
           ]
         : []),
@@ -958,6 +969,7 @@ export default defineComponent({
     // the ONE form directly. The existing watch on is_real_time still drives the
     // anomaly/composite tab switch.
     const onAlertTypeChange = (value: unknown) => {
+      if (value === "anomaly" && anomalyLicenseLocked.value) return;
       alertForm.setF("is_real_time", value);
       // Realtime runs Builder only. The query text and Compare-with-Past windows
       // stay in the form for a switch back; the payload never sends windows here.
@@ -1047,6 +1059,7 @@ export default defineComponent({
       anomalyNoticeBadge,
       anomalyNoticeTooltip,
       alertTypeOptions,
+      anomalyLockedReason,
       alertTabs,
       activeFolderName,
       goBackToAlertsList,
diff --git a/web/src/components/alerts/AlertDestinationsField.vue b/web/src/components/alerts/AlertDestinationsField.vue
index bad9e877b4..4e125ebe94 100644
--- a/web/src/components/alerts/AlertDestinationsField.vue
+++ b/web/src/components/alerts/AlertDestinationsField.vue
@@ -43,7 +43,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :workflow-options="workflowOptions"
         :workflows-enabled="workflowsEnabled"
         :workflows-locked="workflowsLocked"
-        :workflows-lock-message="workflowsAccess.message"
+        :workflows-license-locked="workflowsLicenseLocked"
+        :workflows-lock-message="
+          workflowsLicenseLocked ? workflowsLicenseReason : workflowsAccess.message
+        "
         :placeholder="placeholder"
         :error="!!error"
         @update:destinations="emit('update:destinations', $event)"
@@ -90,6 +93,7 @@ import AlertTargetsSelect from "@/components/alerts/AlertTargetsSelect.vue";
 import { workflowsQuery } from "@/services/workflows.queries";
 import { queryClient } from "@/composables/query/queryClient";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 type RawOption = string | { label: I18nText; value: string };
 
@@ -143,13 +147,24 @@ const tooltipText = computed<I18nText>(() =>
 // it); a deployment that simply hasn't turned the runtime flag on stays
 // HIDDEN (upgrading wouldn't change that).
 const workflowsAccess = useLockedAffordance("workflows");
+const { locked: workflowsLicenseDenied, lockedReason: workflowsLicenseReason } =
+  useLicenseLock("workflows");
 const workflowsRuntimeEnabled = computed(() => store.state.zoConfig?.workflows_enabled === true);
 const workflowsEnabled = computed(
-  () => props.supportsWorkflows && workflowsAccess.value.allowed && workflowsRuntimeEnabled.value,
+  () =>
+    props.supportsWorkflows &&
+    workflowsAccess.value.allowed &&
+    !workflowsLicenseDenied.value &&
+    workflowsRuntimeEnabled.value,
 );
 // Shown (disabled) instead of hidden outright when the family supports
 // workflows but this edition doesn't unlock them.
-const workflowsLocked = computed(() => props.supportsWorkflows && !workflowsAccess.value.allowed);
+const workflowsLicenseLocked = computed(
+  () => props.supportsWorkflows && workflowsLicenseDenied.value,
+);
+const workflowsLocked = computed(
+  () => props.supportsWorkflows && (!workflowsAccess.value.allowed || workflowsLicenseDenied.value),
+);
 
 const workflowOptions = ref<{ label: I18nText; value: string }[]>([]);
 const fetchWorkflows = async (force = false) => {
diff --git a/web/src/components/alerts/AlertInsights.spec.ts b/web/src/components/alerts/AlertInsights.spec.ts
index 32bd769d4e..832abddd8c 100644
--- a/web/src/components/alerts/AlertInsights.spec.ts
+++ b/web/src/components/alerts/AlertInsights.spec.ts
@@ -87,6 +87,7 @@ vi.mock("@/aws-exports", () => ({
 
 import AlertInsights from "@/components/alerts/AlertInsights.vue";
 import alertsService from "@/services/alerts";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 
 async function mountComp(props: Record<string, any> = {}) {
   return mount(AlertInsights, {
@@ -354,6 +355,22 @@ describe("AlertInsights - handleChartContextMenu", () => {
   });
 });
 
+describe("AlertInsights - filter toggle tooltips", () => {
+  it.each([
+    ["failed-only-toggle", "alerts.insights.filters.failedOnlyTooltip"],
+    ["silenced-only-toggle", "alerts.insights.filters.silencedTooltip"],
+  ])("renders the %s tooltip through the OSwitch tooltip slot", async (dataTest, key) => {
+    const w = await mountComp();
+    await flushPromises();
+    const info = w.find(`[data-test="${dataTest}-info"]`);
+    expect(info.exists()).toBe(true);
+    const tooltip = info.findComponent(OTooltip);
+    expect(tooltip.exists()).toBe(true);
+    expect(tooltip.props("content")).toBe(i18n.global.t(key));
+    expect(tooltip.props("content")).not.toBe(key);
+  });
+});
+
 describe("AlertInsights - action buttons row", () => {
   it("action-buttons-row not visible when selectedAlertForAction is null", async () => {
     const w = await mountComp();
diff --git a/web/src/components/alerts/AlertInsights.vue b/web/src/components/alerts/AlertInsights.vue
index 13e23cd2ac..c0c34c8928 100644
--- a/web/src/components/alerts/AlertInsights.vue
+++ b/web/src/components/alerts/AlertInsights.vue
@@ -92,7 +92,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         @update:model-value="onFilterChange"
         data-test="failed-only-toggle"
       >
-        <OTooltip :content="t('alerts.insights.filters.failedOnlyTooltip')"> </OTooltip>
+        <template #tooltip>
+          <OTooltip :content="t('alerts.insights.filters.failedOnlyTooltip')" />
+        </template>
       </OSwitch>
 
       <!-- Silenced Only Toggle -->
@@ -103,7 +105,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         @update:model-value="onFilterChange"
         data-test="silenced-only-toggle"
       >
-        <OTooltip :content="t('alerts.insights.filters.silencedTooltip')"> </OTooltip>
+        <template #tooltip>
+          <OTooltip :content="t('alerts.insights.filters.silencedTooltip')" />
+        </template>
       </OSwitch>
 
       <!-- Range Filter Chips -->
diff --git a/web/src/components/alerts/AlertList.spec.ts b/web/src/components/alerts/AlertList.spec.ts
index b643431e5b..fbb13f9b51 100644
--- a/web/src/components/alerts/AlertList.spec.ts
+++ b/web/src/components/alerts/AlertList.spec.ts
@@ -1468,6 +1468,78 @@ describe("AlertList - isAnomalyDetectionEnabled", () => {
     // The computed initialises activeTab to 'all' when the feature is disabled
     expect(wrapper.vm.activeTab).not.toBe("anomalyDetection");
   });
+
+  describe("anomaly_detection license lock", () => {
+    afterEach(() => {
+      delete (store.state as any).zoConfig.features;
+    });
+
+    const lockedList = async () => {
+      (config as any).isEnterprise = "true";
+      (store.state as any).zoConfig.build_type = "enterprise";
+      (store.state as any).zoConfig.anomaly_detection_enabled = true;
+      (store.state as any).zoConfig.features = { anomaly_detection: "locked" };
+      router.currentRoute.value.query = {} as any;
+      const wrapper: any = await mountAlertList();
+      await waitData(wrapper);
+      return wrapper;
+    };
+
+    it("opens the locked tab on the license empty state without an anomaly list call", async () => {
+      const wrapper = await lockedList();
+      expect(wrapper.vm.alertTabs.find((t: any) => t.value === "anomalyDetection").locked).toBe(
+        true,
+      );
+      (alertsSvc.listByFolderId as any).mockClear();
+      await wrapper.vm.onAlertTabChange("anomalyDetection");
+      await flushPromises();
+
+      expect(wrapper.vm.activeTab).toBe("anomalyDetection");
+      expect(alertsSvc.listByFolderId).not.toHaveBeenCalled();
+      expect(wrapper.vm.displayedAlerts).toEqual([]);
+      expect(wrapper.vm.anomalyTabLicenseLocked).toBe(true);
+      // An earlier spec leaves an edit route behind, which opens the editor instead of the list.
+      wrapper.vm.showAddAlertDialog = false;
+      await flushPromises();
+      const add = wrapper.find('[data-test="alert-list-add-alert-btn"]');
+      expect(add.attributes("disabled")).toBeDefined();
+      expect(wrapper.find('[data-test="alert-list-add-anomaly-lock"]').exists()).toBe(true);
+    });
+
+    it("locks editing anomaly rows but not scheduled ones", async () => {
+      const wrapper = await lockedList();
+      expect(wrapper.vm.rowAnomalyLocked({ type: "anomaly" })).toBe(true);
+      expect(wrapper.vm.rowAnomalyLocked({ type: "alert", is_real_time: false })).toBe(false);
+    });
+
+    it("guards every action on an anomaly row: no dialogs, no state toggle", async () => {
+      const wrapper = await lockedList();
+      const row = { type: "anomaly", alert_id: "an-1", uuid: "u-an-1", name: "an", enabled: true };
+      wrapper.vm.showDeleteDialogFn({ row });
+      wrapper.vm.moveAlertToAnotherFolder(row);
+      await wrapper.vm.duplicateAlert(row);
+      wrapper.vm.toggleAlertState(row);
+      await flushPromises();
+
+      expect(wrapper.vm.confirmDelete).toBe(false);
+      expect(wrapper.vm.showMoveAlertDialog).toBe(false);
+      expect(wrapper.vm.showForm).toBe(false);
+      expect(wrapper.vm.alertStateLoadingMap["u-an-1"]).toBeUndefined();
+      expect(wrapper.vm.anomalyRowLocked(row)).toBe(true);
+      expect(wrapper.vm.anomalyRowLocked({ type: "alert" })).toBe(false);
+    });
+
+    it("leaves the anomaly tab unlocked while anomaly_detection is enabled", async () => {
+      (config as any).isEnterprise = "true";
+      (store.state as any).zoConfig.build_type = "enterprise";
+      (store.state as any).zoConfig.anomaly_detection_enabled = true;
+      (store.state as any).zoConfig.features = { anomaly_detection: "enabled" };
+      const wrapper: any = await mountAlertList();
+      const tab = wrapper.vm.alertTabs.find((t: any) => t.value === "anomalyDetection");
+      expect(tab.locked).toBe(false);
+      expect(wrapper.vm.anomalyTabLicenseLocked).toBe(false);
+    });
+  });
 });
 
 // 12. ODialog / ODrawer migration coverage
@@ -2077,6 +2149,12 @@ describe("AlertList - trigger", () => {
     expect(calls).toEqual([{ variant: "warning", message }]);
   });
 
+  it("warns with the reason when the trigger ran but something was not delivered", async () => {
+    const warning = "not paged: On-Call is not included in your license";
+    const calls = await triggerWith({ message: "Alert triggered", warning });
+    expect(calls).toEqual([{ variant: "warning", message: warning }]);
+  });
+
   it("warns instead of claiming success when a detection run already holds the claim", async () => {
     const calls = await triggerWith({ claim_lost: true, message: "already running" });
     expect(calls).toEqual([
diff --git a/web/src/components/alerts/AlertList.vue b/web/src/components/alerts/AlertList.vue
index a875cdacf8..ae96f9f528 100644
--- a/web/src/components/alerts/AlertList.vue
+++ b/web/src/components/alerts/AlertList.vue
@@ -38,8 +38,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <template #actions>
         <!-- The provider behind the Terraform export tab, which is otherwise
              only discoverable once the export dialog is already open. -->
+        <OTooltip v-if="anomalyTabLicenseLocked" :content="anomalyLockedReason">
+          <span class="inline-flex">
+            <OButton data-test="alert-list-add-alert-btn" variant="primary" size="sm" disabled>
+              <template #icon-left>
+                <OIcon
+                  name="lock"
+                  class="lock-chip"
+                  size="sm"
+                  data-test="alert-list-add-anomaly-lock"
+                />
+              </template>
+              {{ t(`alerts.add`) }}
+            </OButton>
+          </span>
+        </OTooltip>
         <!-- Add button — routes to anomaly creation on anomaly tab, alert creation otherwise -->
         <OButton
+          v-else
           data-test="alert-list-add-alert-btn"
           variant="primary"
           size="sm"
@@ -120,6 +136,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               ref="oTableRef"
               :frame="false"
               v-model:selected-ids="selectedAlertIds"
+              :is-row-selectable="(row: any) => !anomalyRowLocked(row)"
               selection="multiple"
               data-test="alert-list-table"
               :data="displayedAlerts"
@@ -128,7 +145,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               row-key="alert_id"
               :loading="loading"
               :loading-reset-key="`${activeFolderId}:${activeTab}`"
-              :forbidden="forbidden"
+              :forbidden="anomalyTabLicenseLocked ? ['anomaly_detection'] : forbidden"
               forbidden-resource="alert_folders"
               pagination="client"
               :page-size="pageSize"
@@ -188,13 +205,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         :value="tab.value"
                         size="sm"
                         :icon-left="tab.icon"
-                        :title="lgUp && !tab.locked ? undefined : tab.label"
+                        :icon-right="tab.locked ? 'lock' : undefined"
+                        :tooltip="tab.locked ? anomalyLockedReason : undefined"
+                        :title="lgUp || tab.locked ? undefined : tab.label"
                         :data-test="`alert-list-tab-${tab.value}`"
                       >
                         <span class="@max-[42rem]/alert-toolbar:hidden">{{ tab.label }}</span>
-                        <template v-if="tab.locked" #icon-right>
-                          <OIcon name="lock" size="xs" class="text-warning-600 shrink-0" />
-                        </template>
                       </OToggleGroupItem>
                     </template>
                   </OToggleGroup>
@@ -586,6 +602,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   >
                     <OSpinner size="xs" />
                   </div>
+                  <OTooltip
+                    v-else-if="anomalyRowLocked(row)"
+                    side="bottom"
+                    :content="anomalyLockedReason"
+                  >
+                    <span class="ms-1 inline-flex max-md:hidden">
+                      <OButton
+                        :data-row-action="row.enabled ? 'pause' : 'resume'"
+                        :data-test="`alert-list-${row.name}-pause-start-alert`"
+                        :aria-label="row.enabled ? t('alerts.pause') : t('alerts.start')"
+                        variant="ghost"
+                        size="icon-sm"
+                        icon-left="lock"
+                        disabled
+                      />
+                    </span>
+                  </OTooltip>
                   <OButton
                     v-else
                     :data-row-action="row.enabled ? 'pause' : 'resume'"
@@ -602,7 +635,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       :shortcut-id="row.enabled ? 'alertsRowPause' : undefined"
                     />
                   </OButton>
+                  <OTooltip
+                    v-if="rowAnomalyLocked(row)"
+                    side="bottom"
+                    :content="anomalyLockedReason"
+                  >
+                    <span class="inline-flex max-md:hidden">
+                      <OButton
+                        data-row-action="edit"
+                        :data-test="`alert-list-${row.name}-update-alert`"
+                        :aria-label="t('alerts.edit')"
+                        variant="ghost"
+                        size="icon-sm"
+                        icon-left="lock"
+                        disabled
+                      />
+                    </span>
+                  </OTooltip>
                   <OButton
+                    v-else
                     data-row-action="edit"
                     :data-test="`alert-list-${row.name}-update-alert`"
                     variant="ghost"
@@ -624,7 +675,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                        with no way to find out why. -->
                   <span class="inline-flex max-md:hidden">
                     <OTooltip
-                      v-if="isSloRow(row)"
+                      v-if="anomalyRowLocked(row)"
+                      side="bottom"
+                      :content="anomalyLockedReason"
+                    />
+                    <OTooltip
+                      v-else-if="isSloRow(row)"
                       side="bottom"
                       :content="t('alerts.sloCloneDisabled')"
                     />
@@ -632,14 +688,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       data-row-action="duplicate"
                       variant="ghost"
                       size="icon-sm"
-                      icon-left="content-copy"
-                      :disabled="isSloRow(row)"
+                      :icon-left="anomalyRowLocked(row) ? 'lock' : 'content-copy'"
+                      :disabled="isSloRow(row) || anomalyRowLocked(row)"
                       :aria-label="isSloRow(row) ? t('alerts.sloCloneDisabled') : t('alerts.clone')"
                       @click.stop="duplicateAlert(row)"
                       :data-test="`alert-list-${row.name}-clone-alert`"
                     >
                       <OTooltip
-                        v-if="!isSloRow(row)"
+                        v-if="!isSloRow(row) && !anomalyRowLocked(row)"
                         side="bottom"
                         :content="t('alerts.clone')"
                         shortcut-id="alertsRowDuplicate"
@@ -678,43 +734,71 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     </template>
                     <ODropdownItem
                       class="md:hidden"
-                      :disabled="!!alertStateLoadingMap[row.uuid]"
+                      :disabled="!!alertStateLoadingMap[row.uuid] || anomalyRowLocked(row)"
+                      :focusable-unavailable="anomalyRowLocked(row)"
+                      :description="anomalyRowLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-pause-start-alert-menu`"
                       @select="toggleAlertState(row)"
                     >
                       <template #icon-left>
-                        <OIcon :name="row.enabled ? 'pause' : 'play-arrow'" size="sm" />
+                        <OIcon
+                          :class="anomalyRowLocked(row) ? 'lock-chip' : undefined"
+                          :name="
+                            anomalyRowLocked(row) ? 'lock' : row.enabled ? 'pause' : 'play-arrow'
+                          "
+                          size="sm"
+                        />
                       </template>
                       {{ row.enabled ? t("alerts.pause") : t("alerts.start") }}
                     </ODropdownItem>
                     <ODropdownItem
                       class="md:hidden"
+                      :disabled="rowAnomalyLocked(row)"
+                      :focusable-unavailable="rowAnomalyLocked(row)"
+                      :description="rowAnomalyLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-update-alert-menu`"
                       @select="editAlert(row)"
                     >
                       <template #icon-left>
-                        <OIcon name="edit" size="sm" />
+                        <OIcon
+                          :class="rowAnomalyLocked(row) ? 'lock-chip' : undefined"
+                          :name="rowAnomalyLocked(row) ? 'lock' : 'edit'"
+                          size="sm"
+                        />
                       </template>
                       {{ t("alerts.edit") }}
                     </ODropdownItem>
                     <ODropdownItem
                       class="md:hidden"
-                      :disabled="isSloRow(row)"
+                      :disabled="isSloRow(row) || anomalyRowLocked(row)"
+                      :focusable-unavailable="anomalyRowLocked(row)"
+                      :description="anomalyRowLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-clone-alert-menu`"
                       @select="duplicateAlert(row)"
                     >
                       <template #icon-left>
-                        <OIcon name="content-copy" size="sm" />
+                        <OIcon
+                          :class="anomalyRowLocked(row) ? 'lock-chip' : undefined"
+                          :name="anomalyRowLocked(row) ? 'lock' : 'content-copy'"
+                          size="sm"
+                        />
                       </template>
                       {{ t("alerts.clone") }}
                     </ODropdownItem>
                     <ODropdownSeparator class="md:hidden" />
                     <ODropdownItem
+                      :disabled="anomalyRowLocked(row)"
+                      :focusable-unavailable="anomalyRowLocked(row)"
+                      :description="anomalyRowLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-move-alert`"
                       @select="moveAlertToAnotherFolder(row)"
                     >
                       <template #icon-left>
-                        <OIcon name="drive-file-move" size="sm" />
+                        <OIcon
+                          :class="anomalyRowLocked(row) ? 'lock-chip' : undefined"
+                          :name="anomalyRowLocked(row) ? 'lock' : 'drive-file-move'"
+                          size="sm"
+                        />
                       </template>
                       {{ t("common.move") }}
                     </ODropdownItem>
@@ -730,7 +814,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         {{ t("alerts.ack.acknowledge") }}
                       </ODropdownItem>
                     </template>
-                    <template v-if="downtimesEnabled">
+                    <template v-if="downtimesEnabled && !anomalyRowLocked(row)">
                       <ODropdownSeparator />
                       <template v-if="isAlertScopedMute(row) && row.active_downtime">
                         <MuteMenuItems
@@ -763,24 +847,38 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     </template>
                     <ODropdownSeparator />
                     <ODropdownItem
+                      :disabled="anomalyRowLocked(row)"
+                      :focusable-unavailable="anomalyRowLocked(row)"
+                      :description="anomalyRowLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-delete-alert`"
                       variant="destructive"
                       shortcut-id="alertsRowDelete"
                       @select="showDeleteDialogFn({ row })"
                     >
                       <template #icon-left>
-                        <OIcon name="delete" size="sm" />
+                        <OIcon
+                          :class="anomalyRowLocked(row) ? 'lock-chip' : undefined"
+                          :name="anomalyRowLocked(row) ? 'lock' : 'delete'"
+                          size="sm"
+                        />
                       </template>
                       {{ t("alerts.delete") }}
                     </ODropdownItem>
                     <ODropdownSeparator />
                     <ODropdownItem
+                      :disabled="anomalyRowLocked(row)"
+                      :focusable-unavailable="anomalyRowLocked(row)"
+                      :description="anomalyRowLocked(row) ? anomalyLockedReason : undefined"
                       :data-test="`alert-list-${row.name}-export-alert`"
                       shortcut-id="alertsRowExport"
                       @select="exportAlert(row)"
                     >
                       <template #icon-left>
-                        <OIcon size="sm" name="download" />
+                        <OIcon
+                          size="sm"
+                          :class="anomalyRowLocked(row) ? 'lock-chip' : undefined"
+                          :name="anomalyRowLocked(row) ? 'lock' : 'download'"
+                        />
                       </template>
                       {{ t("common.export") }}
                     </ODropdownItem>
@@ -788,20 +886,34 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     <!-- Anomaly Detection: Trigger Detection + Re-train -->
                     <template v-if="row.type === 'anomaly'">
                       <ODropdownItem
+                        :disabled="anomalyLicenseLocked"
+                        :focusable-unavailable="anomalyLicenseLocked"
+                        :description="anomalyLicenseLocked ? anomalyLockedReason : undefined"
                         :data-test="`alert-list-${row.name}-trigger-detection`"
                         @select="triggerAlert(row)"
                       >
                         <template #icon-left>
-                          <OIcon size="sm" name="sound-sampler" />
+                          <OIcon
+                            size="sm"
+                            :class="anomalyLicenseLocked ? 'lock-chip' : undefined"
+                            :name="anomalyLicenseLocked ? 'lock' : 'sound-sampler'"
+                          />
                         </template>
                         {{ t("alerts.triggerDetection") }}
                       </ODropdownItem>
                       <ODropdownItem
+                        :disabled="anomalyLicenseLocked"
+                        :focusable-unavailable="anomalyLicenseLocked"
+                        :description="anomalyLicenseLocked ? anomalyLockedReason : undefined"
                         :data-test="`alert-list-${row.name}-retrain-anomaly`"
                         @select="retrainAnomaly(row)"
                       >
                         <template #icon-left>
-                          <OIcon size="sm" name="replay" />
+                          <OIcon
+                            size="sm"
+                            :class="anomalyLicenseLocked ? 'lock-chip' : undefined"
+                            :name="anomalyLicenseLocked ? 'lock' : 'replay'"
+                          />
                         </template>
                         {{ t("alerts.retrain") }}
                       </ODropdownItem>
@@ -1202,6 +1314,8 @@ import type { StatItem } from "@/lib/data/StatStrip/OStatStrip.types";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import { COL } from "@/lib/core/Table/OTable.types";
@@ -1355,7 +1469,7 @@ export default defineComponent({
     // spinner. `loading` is the skeleton, which only a cold read wants.
     const fetching = ref(false);
     const lastUpdatedAt = ref<number | null>(null);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     const oTableRef: any = ref(null);
     // The first real load lands after mount and races TanStack's own auto-reset-on-data-change, which resolves through its own deferred microtask queue — setTimeout(0) runs strictly after that queue drains, so the restored page reliably wins.
     watch(
@@ -1484,9 +1598,13 @@ export default defineComponent({
     const anomalyDetectionEntitled = computed(
       () => store.state.zoConfig.build_type !== "opensource" && config.isEnterprise === "true",
     );
+    const { locked: anomalyLicenseLocked, lockedReason: anomalyLockedReason } =
+      useLicenseLock("anomaly_detection");
     const anomalyDetectionTabVisible = computed(
       () =>
-        !anomalyDetectionEntitled.value || store.state.zoConfig.anomaly_detection_enabled === true,
+        !anomalyDetectionEntitled.value ||
+        store.state.zoConfig.anomaly_detection_enabled === true ||
+        anomalyLicenseLocked.value,
     );
     const isAnomalyDetectionEnabled = computed(
       () =>
@@ -1498,7 +1616,11 @@ export default defineComponent({
     // Prevent forcing anomalyDetection tab when the feature is not available.
     const rawTab = (router.currentRoute.value.query.tab as string) || "all";
     const activeTab = ref(
-      rawTab === "anomalyDetection" && !isAnomalyDetectionEnabled.value ? "all" : rawTab,
+      rawTab === "anomalyDetection" &&
+        !isAnomalyDetectionEnabled.value &&
+        !anomalyLicenseLocked.value
+        ? "all"
+        : rawTab,
     );
 
     const filteredResults: Ref<any[]> = ref([]);
@@ -1514,6 +1636,9 @@ export default defineComponent({
         ? alertDrafts.savedAtVariant(ANOMALY_DRAFT_VARIANT)
         : alertDrafts.savedAt(null),
     );
+    const anomalyTabLicenseLocked = computed(
+      () => activeTab.value === "anomalyDetection" && anomalyLicenseLocked.value,
+    );
 
     // ── "Calm Signal" table helpers ─────────────────────────────────────────
     // Keyed on firing time, not run time; raw µs keeps it timezone-independent.
@@ -1538,6 +1663,11 @@ export default defineComponent({
     // instead, and links there — which is also where it is edited (D1).
 
     const isSloRow = (row: any): boolean => isSloAlert(row);
+    const rowAnomalyLocked = (row: any): boolean =>
+      anomalyLicenseLocked.value && (row?.type === "anomaly" || isSloRow(row));
+    // Every action on an anomaly row calls the anomaly detection API; SLO alerts only edit through it.
+    const anomalyRowLocked = (row: any): boolean =>
+      anomalyLicenseLocked.value && row?.type === "anomaly";
 
     /** id -> name for every SLO in the org. `list_slos` is unpaginated and
      *  folder-agnostic when asked without a folder, so ONE call resolves every
@@ -1551,7 +1681,7 @@ export default defineComponent({
     let sloNamesLoaded = false;
 
     const ensureSloNames = (rows: any[]): void => {
-      if (sloNamesInFlight || sloNamesLoaded) return;
+      if (sloNamesInFlight || sloNamesLoaded || anomalyLicenseLocked.value) return;
       if (!rows?.some((row: any) => isSloRow(row))) return;
       // The org can legitimately be unset on the very first tick; throwing here
       // would surface as an unhandled error inside a watcher, from a lookup
@@ -1794,6 +1924,7 @@ export default defineComponent({
       "active" | "paused" | "failed" | "firing" | "acknowledged" | "recent" | null
     >(savedAlertListFilters.stateFilter);
     const displayedAlerts = computed(() => {
+      if (anomalyTabLicenseLocked.value) return [];
       const rows = filteredResults.value || [];
       const f = stateFilter.value;
       if (!f) return rows;
@@ -1835,7 +1966,7 @@ export default defineComponent({
           label: t("alerts.anomalyDetection"),
           value: "anomalyDetection",
           icon: "query-stats",
-          locked: !isAnomalyDetectionEnabled.value,
+          locked: anomalyLicenseLocked.value || !isAnomalyDetectionEnabled.value,
         });
       }
       return tabs;
@@ -2429,7 +2560,7 @@ export default defineComponent({
       } catch (error: any) {
         console.error(error);
         dismiss();
-        forbidden.value = error?.response?.status === 403;
+        forbidden.value = forbiddenState(error);
         if (!forbidden.value) {
           toast({
             variant: "error",
@@ -2538,6 +2669,10 @@ export default defineComponent({
       // OToggleGroup is controlled (`:model-value`), so refusing to advance
       // `activeTab` here is what keeps a locked tab from becoming active —
       // clicking it opens the upgrade dialog instead of switching.
+      if (tab === "anomalyDetection" && anomalyLicenseLocked.value) {
+        activeTab.value = tab;
+        return;
+      }
       if (tab === "anomalyDetection" && !isAnomalyDetectionEnabled.value) {
         openUpgradeDialog();
         return;
@@ -2908,6 +3043,7 @@ export default defineComponent({
     };
 
     const duplicateAlert = async (row: any) => {
+      if (anomalyRowLocked(row)) return;
       // SLO alerts are not clonable (D1). The dialog's first act is to demand a
       // stream type and name, which this family has none of — and a clone that
       // did succeed would be a creation path outside the SLO page that silently
@@ -3361,6 +3497,7 @@ export default defineComponent({
       });
     };
     const showDeleteDialogFn = (props: any) => {
+      if (anomalyRowLocked(props?.row)) return;
       selectedDelete.value = props.row;
       confirmDelete.value = true;
     };
@@ -3414,6 +3551,7 @@ export default defineComponent({
     };
 
     const toggleAlertState = (row: any) => {
+      if (anomalyRowLocked(row)) return;
       alertStateLoadingMap.value[row.uuid] = true;
 
       // Two mutations, not one conditional invalidation: an anomaly row is also a config Overview renders.
@@ -3536,7 +3674,7 @@ export default defineComponent({
     };
 
     const exportAlert = async (row: any) => {
-      if (exportLoading.value) return;
+      if (exportLoading.value || anomalyRowLocked(row)) return;
       exportLoading.value = true;
       try {
         const alert = await fetchAlertForExport(row.alert_id);
@@ -3566,6 +3704,7 @@ export default defineComponent({
     };
 
     const triggerAlert = async (row: any) => {
+      if (anomalyLicenseLocked.value && row?.type === "anomaly") return;
       try {
         const res = await alertsService.trigger_alert(
           store.state.selectedOrganization.identifier,
@@ -3581,7 +3720,9 @@ export default defineComponent({
                   variant: "warning",
                   message: res.data.message || t("alerts.messages.triggerAlertFailed"),
                 }
-              : { variant: "success", message: t("alerts.alertTriggeredSuccess") },
+              : res?.data?.warning
+                ? { variant: "warning", message: raw(res.data.warning) }
+                : { variant: "success", message: t("alerts.alertTriggeredSuccess") },
         );
         if (row.type === "anomaly") {
           await getAlertsFn(store, activeFolderId.value, "", true, "", true);
@@ -3596,6 +3737,7 @@ export default defineComponent({
     };
 
     const retrainAnomaly = async (row: any) => {
+      if (anomalyLicenseLocked.value) return;
       try {
         await retrainAnomalyAlert.mutateAsync(row.alert_id);
         row.status = "training";
@@ -3665,6 +3807,7 @@ export default defineComponent({
     };
 
     const editAlert = async (row: any) => {
+      if (rowAnomalyLocked(row)) return;
       // SLO alerts are authored on the SLO page: the generic editor has no way
       // to represent one (no stream, no query, a different condition), and
       // saving from it would either fail forever or strip the SLO wiring.
@@ -3708,6 +3851,7 @@ export default defineComponent({
     };
 
     const moveAlertToAnotherFolder = (row: any) => {
+      if (anomalyRowLocked(row)) return;
       showMoveAlertDialog.value = true;
       if (row.type === "anomaly") {
         selectedAlertToMove.value = [];
@@ -4386,6 +4530,11 @@ export default defineComponent({
       config,
       isCompactToolbar,
       isAnomalyDetectionEnabled,
+      anomalyLicenseLocked,
+      anomalyLockedReason,
+      anomalyTabLicenseLocked,
+      rowAnomalyLocked,
+      anomalyRowLocked,
       refreshAlerts,
       onAlertTabChange,
       referenceDrawerOpen,
diff --git a/web/src/components/alerts/AlertSectionTabs.spec.ts b/web/src/components/alerts/AlertSectionTabs.spec.ts
index ad4999c438..5efa29510a 100644
--- a/web/src/components/alerts/AlertSectionTabs.spec.ts
+++ b/web/src/components/alerts/AlertSectionTabs.spec.ts
@@ -13,8 +13,10 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, expect, it, beforeEach, vi } from "vitest";
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
+import { defineComponent, h, ref } from "vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
 
 import AlertSectionTabs from "./AlertSectionTabs.vue";
 import i18n from "@/locales";
@@ -102,4 +104,56 @@ describe("AlertSectionTabs", () => {
     const wrapper = mountTabs();
     expect(wrapper.findAll('[role="tab"]').map((tab) => tab.text())).toContain("Alert Library");
   });
+
+  describe("license", () => {
+    afterEach(() => {
+      delete store.state.zoConfig.features;
+    });
+
+    const lockOf = (wrapper: ReturnType<typeof mountTabs>, key: string) =>
+      wrapper.find(`[data-test="alert-section-tab-${key}-lock"]`).exists();
+
+    it("puts a lock on every tab when alerts is locked", () => {
+      store.state.zoConfig.features = { alerts: "locked" };
+      const wrapper = mountTabs();
+      expect(lockOf(wrapper, "alertList")).toBe(true);
+      expect(lockOf(wrapper, "alertLibrary")).toBe(true);
+      expect(lockOf(wrapper, "alertDestinations")).toBe(true);
+      expect(lockOf(wrapper, "alertTemplates")).toBe(true);
+    });
+
+    it("shows no lock when alerts is enabled", () => {
+      store.state.zoConfig.features = { alerts: "enabled" };
+      const wrapper = mountTabs();
+      expect(wrapper.find('[data-test$="-lock"]').exists()).toBe(false);
+    });
+
+    it("drops the alert-owned tabs when alerts is hidden, keeping destinations and templates", () => {
+      store.state.zoConfig.features = { alerts: "hidden" };
+      const wrapper = mountTabs();
+      expect(wrapper.findAll('[role="tab"]').map((tab) => tab.text())).toEqual([
+        "Notification Destinations",
+        "Destination Templates",
+      ]);
+    });
+
+    it("still navigates to the free destinations from a license-locked alert page", async () => {
+      store.state.zoConfig.features = { alerts: "locked" };
+      const push = vi.spyOn(router, "push");
+      const LockedPage = defineComponent({
+        setup() {
+          provideFeatureLock(ref("alerts"));
+          return () => h(AlertSectionTabs);
+        },
+      });
+      const wrapper = mount(LockedPage, {
+        global: { provide: { store }, plugins: [i18n, router] },
+      });
+      await wrapper.find('[data-test="alert-section-tab-alertDestinations"]').trigger("mousedown");
+      expect(push).toHaveBeenCalledWith({
+        name: "alertDestinations",
+        query: { org_identifier: store.state.selectedOrganization.identifier },
+      });
+    });
+  });
 });
diff --git a/web/src/components/alerts/AlertSectionTabs.vue b/web/src/components/alerts/AlertSectionTabs.vue
index 2d2f302388..3aec2b83e0 100644
--- a/web/src/components/alerts/AlertSectionTabs.vue
+++ b/web/src/components/alerts/AlertSectionTabs.vue
@@ -25,24 +25,35 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   ships this pattern for Stream Pipelines / Functions.
 -->
 <template>
-  <OTabs
-    :model-value="activeSectionKey"
-    align="left"
-    data-test="alert-section-tabs"
-    @change="navigateToSection"
-  >
-    <OTab
-      v-for="section in sections"
-      :key="section.key"
-      :name="section.key"
-      :data-test="`alert-section-tab-${section.key}`"
+  <!-- The tabs only navigate, so a license-locked alert page still reaches the free destinations and templates. -->
+  <FeatureLockExempt class="contents">
+    <OTabs
+      :model-value="activeSectionKey"
+      align="left"
+      data-test="alert-section-tabs"
+      @change="navigateToSection"
     >
-      <OIcon :name="section.icon" size="sm" class="shrink-0" />
-      <span :class="section.key === activeSectionKey ? '' : 'max-md:hidden'">{{
-        section.label
-      }}</span>
-    </OTab>
-  </OTabs>
+      <OTab
+        v-for="section in sections"
+        :key="section.key"
+        :name="section.key"
+        :data-test="`alert-section-tab-${section.key}`"
+      >
+        <OIcon :name="section.icon" size="sm" class="shrink-0" />
+        <span :class="section.key === activeSectionKey ? '' : 'max-md:hidden'">{{
+          section.label
+        }}</span>
+        <OIcon
+          v-if="section.licenseLocked"
+          name="lock"
+          size="xs"
+          class="lock-chip shrink-0"
+          :data-test="`alert-section-tab-${section.key}-lock`"
+          aria-hidden="true"
+        />
+      </OTab>
+    </OTabs>
+  </FeatureLockExempt>
 </template>
 
 <script setup lang="ts">
@@ -54,7 +65,9 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import { useI18nTyped, type I18nText } from "@/types/i18n";
+import { featureState } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
 const store = useStore();
@@ -68,6 +81,7 @@ interface Section {
   label: I18nText;
   icon: IconName;
   to: RouteLocationRaw;
+  licenseLocked?: boolean;
 }
 
 const sections = computed<Section[]>(() => {
@@ -76,31 +90,41 @@ const sections = computed<Section[]>(() => {
   const hideLibrary = (store.state.zoConfig?.custom_hide_menus ?? "")
     .split(",")
     .includes("alertLibrary");
+  const alerts = featureState(store.state.zoConfig?.features, "alerts");
+  const alertsHidden = alerts === "hidden";
+  const licenseLocked = alerts === "locked";
   return [
     // "All Alerts", not "Alerts": the page title above this strip already says
     // "Alerts", so a tab repeating it names nothing. The rail's Alerts
     // subsection uses the same string for the same reason.
-    {
-      key: "alertList",
-      label: t("alerts.allAlerts"),
-      icon: "shield-alert-outline",
-      to: { name: "alertList", query },
-    },
+    ...(alertsHidden
+      ? []
+      : [
+          {
+            key: "alertList",
+            label: t("alerts.allAlerts"),
+            icon: "shield-alert-outline" as IconName,
+            to: { name: "alertList", query },
+            licenseLocked,
+          },
+        ]),
     {
       key: "alertDestinations",
       label: t("alert_destinations.header"),
       icon: "location-on",
       to: { name: "alertDestinations", query },
+      licenseLocked,
     },
     {
       key: "alertTemplates",
       label: t("alert_templates.header"),
       icon: "description",
       to: { name: "alertTemplates", query },
+      licenseLocked,
     },
     // Last: the catalog is where you go once to fetch an alert, not where you
     // work. The rail's Reliability flyout lists these four in this same order.
-    ...(hideLibrary
+    ...(hideLibrary || alertsHidden
       ? []
       : [
           {
@@ -108,6 +132,7 @@ const sections = computed<Section[]>(() => {
             label: t("alert_library.header"),
             icon: "menu-book" as IconName,
             to: { name: "alertLibrary", query },
+            licenseLocked,
           },
         ]),
   ];
diff --git a/web/src/components/alerts/AlertTargetsSelect.spec.ts b/web/src/components/alerts/AlertTargetsSelect.spec.ts
index d1cd62796b..1a0c320c76 100644
--- a/web/src/components/alerts/AlertTargetsSelect.spec.ts
+++ b/web/src/components/alerts/AlertTargetsSelect.spec.ts
@@ -370,6 +370,23 @@ describe("AlertTargetsSelect", () => {
     });
   });
 
+  it("shows a disabled Create Workflow button for a license lock and never opens the upgrade dialog", async () => {
+    const wrapper = createWrapper({
+      workflowsEnabled: false,
+      workflowsLocked: true,
+      workflowsLicenseLocked: true,
+      workflowsLockMessage: "Locked: needs Workflows",
+    });
+    const btn = wrapper.find('[data-test="create-workflow-btn"]');
+    expect(btn.exists()).toBe(true);
+    expect(btn.attributes("disabled")).toBeDefined();
+
+    const { isOpen, close } = useEnterpriseUpgradeDialog();
+    close();
+    await btn.trigger("click");
+    expect(isOpen.value).toBe(false);
+  });
+
   // ── Malformed / partially-loaded lists ─────────────────────────────────────
   // REGRESSION: with the backend unreachable, `getFormattedDestinations` maps
   // `destination.name` over rows that have no `name`, producing [undefined].
diff --git a/web/src/components/alerts/AlertTargetsSelect.vue b/web/src/components/alerts/AlertTargetsSelect.vue
index 1da0fc0288..4be11e5295 100644
--- a/web/src/components/alerts/AlertTargetsSelect.vue
+++ b/web/src/components/alerts/AlertTargetsSelect.vue
@@ -85,6 +85,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- Locked (not hidden): the family supports workflow routing, but this
          edition doesn't unlock it — kept as the discovery point since the
          dropdown's own "Workflows" header has no icon/tooltip slot to attach. -->
+    <OTooltip v-else-if="workflowsLicenseLocked" :content="workflowsLockMessage">
+      <span class="ms-2 inline-flex">
+        <OButton
+          data-test="create-workflow-btn"
+          variant="outline"
+          size="sm"
+          icon-left="lock"
+          disabled
+        >
+          {{ t("workflow.create") }}
+        </OButton>
+      </span>
+    </OTooltip>
     <template v-else-if="workflowsLocked">
       <OButton
         data-test="create-workflow-btn"
@@ -93,7 +106,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="ms-2"
         @click="openUpgradeDialog"
       >
-        <template #icon-left><OIcon name="lock" size="sm" class="text-warning-600" /></template>
+        <template #icon-left><OIcon name="lock" size="sm" class="lock-chip" /></template>
         {{ t("workflow.create") }}
       </OButton>
     </template>
@@ -106,6 +119,7 @@ import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
 
 const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
@@ -125,6 +139,7 @@ const props = defineProps<{
   workflowsEnabled: boolean;
   /** Family supports workflows but this edition doesn't unlock them — show the group locked instead of hiding it. */
   workflowsLocked?: boolean;
+  workflowsLicenseLocked?: boolean;
   workflowsLockMessage?: I18nText;
   error?: boolean;
   placeholder?: I18nText;
diff --git a/web/src/components/alerts/AlertsDestinationList.vue b/web/src/components/alerts/AlertsDestinationList.vue
index 726caf70b2..68c6ce9d54 100644
--- a/web/src/components/alerts/AlertsDestinationList.vue
+++ b/web/src/components/alerts/AlertsDestinationList.vue
@@ -465,6 +465,7 @@ import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import AlertSectionTabs from "@/components/alerts/AlertSectionTabs.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import { COL } from "@/lib/core/Table/OTable.types";
@@ -752,7 +753,7 @@ export default defineComponent({
     };
 
     const loading = ref(false);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     // The first real load lands after mount and races TanStack's own auto-reset-on-data-change, which resolves through its own deferred microtask queue — setTimeout(0) runs strictly after that queue drains, so the restored page reliably wins.
     watch(
       loading,
@@ -829,7 +830,7 @@ export default defineComponent({
           return true;
         })
         .catch((err: any) => {
-          forbidden.value = err?.response?.status === 403;
+          forbidden.value = forbiddenState(err);
           if (!forbidden.value) {
             toast({
               variant: "error",
diff --git a/web/src/components/alerts/CreateAlertAction.spec.ts b/web/src/components/alerts/CreateAlertAction.spec.ts
index 17aa9a6357..03f5875cfe 100644
--- a/web/src/components/alerts/CreateAlertAction.spec.ts
+++ b/web/src/components/alerts/CreateAlertAction.spec.ts
@@ -16,6 +16,7 @@
 import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
 import { mount } from "@vue/test-utils";
 import i18n from "@/locales";
+import { createStore } from "vuex";
 
 import OButton from "@/lib/core/Button/OButton.vue";
 import CreateAlertAction from "@/components/alerts/CreateAlertAction.vue";
@@ -53,7 +54,11 @@ const ButtonStub = {
 const stubs = {
   ODropdownItem: DropdownItemStub,
   OButton: ButtonStub,
-  OTooltip: { name: "OTooltip", props: ["content"], template: `<span>{{ content }}</span>` },
+  OTooltip: {
+    name: "OTooltip",
+    props: ["content"],
+    template: `<span>{{ content }}<slot /></span>`,
+  },
 };
 
 const prefill = (): AlertPrefill => ({
@@ -327,4 +332,54 @@ describe("CreateAlertAction", () => {
     wrapper = mountAction({ source: "logs" });
     expect(wrapper.text()).toContain("Create Alert");
   });
+
+  describe("license lock", () => {
+    const mountWithFeatures = (features: Record<string, string>, props = {}) =>
+      mount(CreateAlertAction, {
+        props: { source: "logs", build: vi.fn(needsDialog), variant: "button", ...props },
+        global: {
+          plugins: [
+            i18n,
+            createStore({ state: { zoConfig: { features, feature_names: { alerts: "Alerts" } } } }),
+          ],
+          stubs,
+        },
+      });
+
+    it.each(["button", "toolbar", "icon"])(
+      "wraps the disabled %s in a hover tooltip with the license reason",
+      (variant) => {
+        wrapper = mountWithFeatures({ alerts: "locked" }, { variant });
+        const tooltip = wrapper.findComponent({ name: "OTooltip" });
+        expect(tooltip.props("content")).toBe("Locked: needs Alerts");
+        const button = tooltip.find("span.inline-flex").findComponent({ name: "OButton" });
+        expect(button.find("button").attributes("disabled")).toBeDefined();
+        expect(button.props("iconLeft")).toBe("lock");
+      },
+    );
+
+    it("opens nothing while locked", async () => {
+      wrapper = mountWithFeatures({ alerts: "locked" });
+
+      (wrapper.vm as any).$.setupState.onActivate();
+      expect(alertCreationDialog.value).toBeNull();
+      expect(mockOpenAlertCreation).not.toHaveBeenCalled();
+    });
+
+    it("disables the menu item with the license reason", () => {
+      wrapper = mountWithFeatures({ alerts: "locked" }, { variant: "menu-item" });
+      const item = wrapper.findComponent(DropdownItemStub);
+      expect(item.props("disabled")).toBe(true);
+      expect(item.props("description")).toBe("Locked: needs Alerts");
+    });
+
+    it("is unchanged while alerts is enabled", async () => {
+      wrapper = mountWithFeatures({ alerts: "enabled" });
+      const button = wrapper.findComponent({ name: "OButton" });
+      expect(button.props("disabled")).toBe(false);
+      expect(button.props("iconLeft")).not.toBe("lock");
+      await wrapper.find("button").trigger("click");
+      expect(alertCreationDialog.value).not.toBeNull();
+    });
+  });
 });
diff --git a/web/src/components/alerts/CreateAlertAction.vue b/web/src/components/alerts/CreateAlertAction.vue
index d322202a8e..e69dc34c5b 100644
--- a/web/src/components/alerts/CreateAlertAction.vue
+++ b/web/src/components/alerts/CreateAlertAction.vue
@@ -31,9 +31,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <ODropdownItem
     v-if="variant === 'menu-item'"
-    :disabled="!!disabledReason"
+    :disabled="!!blockedReason"
     focusable-unavailable
-    :description="disabledReason || note"
+    :description="blockedReason || note"
     :data-test="dataTest"
     @select="onActivate"
   >
@@ -41,28 +41,46 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          the dashboards panel menu does not — so the presentation is the host's
          call while the icon NAME stays the registry's. -->
     <template #icon-left>
-      <slot name="icon-left" :icon="source_.icon">
-        <OIcon :name="source_.icon" size="sm" />
+      <slot name="icon-left" :icon="icon">
+        <OIcon :name="icon" size="sm" />
       </slot>
     </template>
     <span>{{ label }}</span>
   </ODropdownItem>
 
+  <!-- A disabled button fires no pointer events, so the span is the tooltip's hover target. -->
+  <OTooltip v-else-if="locked" :content="lockedReason">
+    <span class="inline-flex">
+      <OButton
+        :variant="lockedButton.variant"
+        :size="lockedButton.size"
+        disabled
+        icon-left="lock"
+        :aria-label="label"
+        :data-test="dataTest"
+      >
+        <span v-if="variant !== 'icon'" :class="{ 'max-md:hidden': variant === 'toolbar' }">{{
+          label
+        }}</span>
+      </OButton>
+    </span>
+  </OTooltip>
+
   <OButton
     v-else-if="variant === 'button'"
     :variant="buttonVariant"
     size="sm-action"
-    :disabled="!!disabledReason"
+    :disabled="!!blockedReason"
     focusable-unavailable
-    :icon-left="source_.icon"
+    :icon-left="icon"
     :data-test="dataTest"
     @click="onActivate"
   >
-    <template #unavailable-reason>{{ disabledReason }}</template>
+    <template #unavailable-reason>{{ blockedReason }}</template>
     {{ label }}
     <OTooltip
-      v-if="disabledReason || note"
-      :content="disabledReason || note || undefined"
+      v-if="blockedReason || note"
+      :content="blockedReason || note || undefined"
       side="top"
     />
   </OButton>
@@ -71,31 +89,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     v-else-if="variant === 'toolbar'"
     variant="outline"
     size="sm-toolbar"
-    :disabled="!!disabledReason"
+    :disabled="!!blockedReason"
     focusable-unavailable
-    :icon-left="source_.icon"
+    :icon-left="icon"
     :aria-label="label"
     :data-test="dataTest"
     @click="onActivate"
   >
-    <template #unavailable-reason>{{ disabledReason }}</template>
+    <template #unavailable-reason>{{ blockedReason }}</template>
     <span class="max-md:hidden">{{ label }}</span>
-    <OTooltip v-if="disabledReason || isMobile" :content="disabledReason || label" />
+    <OTooltip v-if="blockedReason || isMobile" :content="blockedReason || label" />
   </OButton>
 
   <OButton
     v-else
     variant="ghost"
     size="sm"
-    :disabled="!!disabledReason"
+    :disabled="!!blockedReason"
     focusable-unavailable
-    :icon-left="source_.icon"
+    :icon-left="icon"
     :aria-label="label"
     :data-test="dataTest"
     @click="onActivate"
   >
-    <template #unavailable-reason>{{ disabledReason }}</template>
-    <OTooltip :content="disabledReason || label" side="top" />
+    <template #unavailable-reason>{{ blockedReason }}</template>
+    <OTooltip :content="blockedReason || label" side="top" />
   </OButton>
 </template>
 
@@ -111,6 +129,7 @@ import { getAlertSource } from "@/utils/alerts/alertSourceRegistry";
 import { needsConfirmation, normalizePrefill } from "@/utils/alerts/alertPrefill";
 import { requestAlertCreation, useAlertCreation } from "@/composables/alerts/useAlertCreation";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const props = withDefaults(
   defineProps<{
@@ -147,8 +166,17 @@ const { isMobile } = useBreakpoint();
 const source_ = computed(() => getAlertSource(props.source));
 const label = computed(() => t(source_.value.labelKey));
 
+const { locked, lockedReason } = useLicenseLock("alerts");
+const blockedReason = computed(() => (locked.value ? lockedReason.value : props.disabledReason));
+const icon = computed(() => (locked.value ? "lock" : source_.value.icon));
+const lockedButton = computed(() => {
+  if (props.variant === "toolbar") return { variant: "outline", size: "sm-toolbar" } as const;
+  if (props.variant === "icon") return { variant: "ghost", size: "sm" } as const;
+  return { variant: props.buttonVariant, size: "sm-action" } as const;
+});
+
 const onActivate = () => {
-  if (props.disabledReason) return;
+  if (blockedReason.value) return;
 
   const prefill = normalizePrefill(props.build());
 
diff --git a/web/src/components/alerts/CreateAlertDialogProvider.spec.ts b/web/src/components/alerts/CreateAlertDialogProvider.spec.ts
index a5add9c22d..c9f00c4d23 100644
--- a/web/src/components/alerts/CreateAlertDialogProvider.spec.ts
+++ b/web/src/components/alerts/CreateAlertDialogProvider.spec.ts
@@ -16,6 +16,7 @@
 import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
 import { flushPromises, mount } from "@vue/test-utils";
 import i18n from "@/locales";
+import { createStore } from "vuex";
 
 import CreateAlertDialogProvider from "@/components/alerts/CreateAlertDialogProvider.vue";
 import { ALERT_PREFILL_VERSION, type AlertPrefill } from "@/ts/interfaces/alertPrefill";
@@ -155,4 +156,18 @@ describe("CreateAlertDialogProvider", () => {
 
     expect(alertCreationDialog.value).toBeNull();
   });
+
+  it("shows no dialog and drops the request while alerts is license-locked", async () => {
+    wrapper = mount(CreateAlertDialogProvider, {
+      global: {
+        plugins: [i18n, createStore({ state: { zoConfig: { features: { alerts: "locked" } } } })],
+        stubs: { CreateAlertFromSourceDialog: DialogStub },
+      },
+    });
+    requestAlertCreation(prefill());
+    await wrapper.vm.$nextTick();
+
+    expect(wrapper.findComponent(DialogStub).exists()).toBe(false);
+    expect(alertCreationDialog.value).toBeNull();
+  });
 });
diff --git a/web/src/components/alerts/CreateAlertDialogProvider.vue b/web/src/components/alerts/CreateAlertDialogProvider.vue
index f10794b1ea..bb5910984c 100644
--- a/web/src/components/alerts/CreateAlertDialogProvider.vue
+++ b/web/src/components/alerts/CreateAlertDialogProvider.vue
@@ -27,7 +27,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <template>
   <CreateAlertFromSourceDialog
-    v-if="dialog"
+    v-if="dialog && !locked"
     :open="dialog.open"
     :prefill="dialog.prefill"
     @update:open="onOpenChange"
@@ -38,8 +38,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
-import { defineAsyncComponent } from "vue";
+import { defineAsyncComponent, watch } from "vue";
 import type { AlertPrefill } from "@/ts/interfaces/alertPrefill";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import {
   alertCreationDialog as dialog,
   closeAlertCreationDialog,
@@ -58,6 +59,14 @@ const CreateAlertFromSourceDialog = defineAsyncComponent({
 });
 
 const { openAlertCreation } = useAlertCreation();
+const { locked } = useLicenseLock("alerts");
+
+// Surfaces that request the dialog without CreateAlertAction must not leave a request that pops up after an unlock.
+watch(
+  () => !!dialog.value && locked.value,
+  (blocked) => blocked && closeAlertCreationDialog(),
+  { immediate: true },
+);
 
 const onConfirm = (prefill: AlertPrefill) => {
   openAlertCreation(prefill, dialog.value?.options ?? {});
diff --git a/web/src/components/alerts/DependencyUsageCell.spec.ts b/web/src/components/alerts/DependencyUsageCell.spec.ts
index c6fdeb58f8..6b6d661b51 100644
--- a/web/src/components/alerts/DependencyUsageCell.spec.ts
+++ b/web/src/components/alerts/DependencyUsageCell.spec.ts
@@ -65,6 +65,19 @@ describe("DependencyUsageCell", () => {
     wrapper.unmount();
   });
 
+  it("shows an em dash and no badges or dialog while alerts is license-locked", async () => {
+    store.state.zoConfig.features = { alerts: "locked" };
+    try {
+      const wrapper = mountCell(graph, { kind: "destination", name: "slack" });
+      expect(wrapper.find('[data-test="used-by-slack-locked"]').text()).toBe("—");
+      expect(wrapper.find('[data-test="used-by-slack"]').exists()).toBe(false);
+      expect(wrapper.findComponent({ name: "DependencyImpactDialog" }).exists()).toBe(false);
+      wrapper.unmount();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it("shows the Unused chip for an orphan entity", async () => {
     const wrapper = mountCell(graph, { kind: "destination", name: "lonely" });
     await flushPromises();
diff --git a/web/src/components/alerts/DependencyUsageCell.vue b/web/src/components/alerts/DependencyUsageCell.vue
index 6f0af83fb2..076783c5aa 100644
--- a/web/src/components/alerts/DependencyUsageCell.vue
+++ b/web/src/components/alerts/DependencyUsageCell.vue
@@ -21,7 +21,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   cell opens the impact dialog.
 -->
 <template>
+  <!-- Usage is counted from the alerts list, which a license without alerts cannot read. -->
+  <span v-if="alertsLocked" class="text-text-muted" :data-test="`used-by-${key}-locked`">{{
+    raw("—")
+  }}</span>
   <OButton
+    v-else
     variant="ghost"
     size="sm"
     class="h-auto! gap-1! px-1.5! py-1! font-normal!"
@@ -58,13 +63,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </template>
   </OButton>
 
-  <DependencyImpactDialog v-model:open="open" :focus="focus" @deleted="emit('deleted', $event)" />
+  <DependencyImpactDialog
+    v-if="!alertsLocked"
+    v-model:open="open"
+    :focus="focus"
+    @deleted="emit('deleted', $event)"
+  />
 </template>
 
 <script setup lang="ts">
 import { computed, ref } from "vue";
-import { useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped } from "@/types/i18n";
 import type { I18nText } from "@/types/i18n";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
@@ -82,6 +93,7 @@ const props = defineProps<{ graph: DepGraph; focus: DepFocus }>();
 const emit = defineEmits<{ (e: "deleted", kind: DepNodeKind): void }>();
 
 const { t } = useI18nTyped();
+const { locked: alertsLocked } = useLicenseLock("alerts");
 
 const open = ref(false);
 
diff --git a/web/src/components/alerts/ExternalAlertSourcesList.vue b/web/src/components/alerts/ExternalAlertSourcesList.vue
index 603ea3a9ca..72c14fd308 100644
--- a/web/src/components/alerts/ExternalAlertSourcesList.vue
+++ b/web/src/components/alerts/ExternalAlertSourcesList.vue
@@ -349,6 +349,7 @@ import { getAlertSourceStatus } from "@/utils/alertSourceStatus";
 import { formatTimeAgoUs } from "@/utils/synthetics/format";
 import { copyToClipboard } from "@/utils/clipboard";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { getEndPoint, getIngestionURL } from "@/utils/zincutils";
 import { COL } from "@/lib/core/Table/OTable.types";
 import type { AlertSourceIntegration } from "@/ts/interfaces/alertSources";
@@ -428,7 +429,7 @@ export default defineComponent({
       // Request in flight with rows still on screen — the refresh button's
       // spinner. `loading` is the skeleton, for a cold read only.
       fetching: false,
-      forbidden: false,
+      forbidden: false as ForbiddenState,
       lastUpdatedAt: null as number | null,
       filterQuery: "",
       showAddDrawer: false,
@@ -627,7 +628,7 @@ export default defineComponent({
         this.lastUpdatedAt =
           queryClient.getQueryState(options.queryKey)?.dataUpdatedAt ?? Date.now();
       } catch (e: any) {
-        this.forbidden = e?.response?.status === 403;
+        this.forbidden = forbiddenState(e);
         if (!this.forbidden) {
           toast({ variant: "error", message: this.t("alert_sources.error") });
         }
diff --git a/web/src/components/alerts/IncidentDetailDrawer.spec.ts b/web/src/components/alerts/IncidentDetailDrawer.spec.ts
index 90eac21a0f..dc7e282f40 100644
--- a/web/src/components/alerts/IncidentDetailDrawer.spec.ts
+++ b/web/src/components/alerts/IncidentDetailDrawer.spec.ts
@@ -341,6 +341,17 @@ describe("IncidentDetailDrawer.vue", () => {
       expect(wrapper.vm.incidentDetails.title).toBe("Test Incident");
     });
 
+    it("shows the license empty state when the load is license-denied", async () => {
+      (incidentsService.get as any).mockRejectedValue({
+        response: { status: 403, data: { code: 40001, error_detail: "incidents" } },
+      });
+      wrapper = await createWrapper({}, {}, "test-123");
+      await flushPromises();
+      expect(wrapper.find('[data-test="incident-detail-license-denied"]').text()).toContain(
+        "incidents",
+      );
+    });
+
     it("shows no Alert Triggers count until the incident has loaded", async () => {
       let resolveIncident: (value: any) => void = () => {};
       (incidentsService.get as any).mockReturnValue(
@@ -1030,6 +1041,46 @@ describe("IncidentDetailDrawer.vue", () => {
     });
   });
 
+  describe("correlation license lock", () => {
+    afterEach(() => {
+      delete store.state.zoConfig.features;
+    });
+
+    it("locks the telemetry tabs and never calls the correlation API", async () => {
+      store.state.zoConfig.features = { correlation: "locked" };
+      wrapper = await createWrapper({}, {}, "1");
+      await flushPromises();
+      (incidentsService.getCorrelatedStreams as any).mockClear();
+
+      wrapper.vm.activeTab = "logs";
+      await flushPromises();
+      await wrapper.vm.refreshCorrelation();
+
+      expect(wrapper.find('[data-test="incident-correlation-license-denied"]').exists()).toBe(true);
+      expect(wrapper.findComponent({ name: "CorrelatedLogsTable" }).exists()).toBe(false);
+      expect(incidentsService.getCorrelatedStreams).not.toHaveBeenCalled();
+      const logsTab = wrapper
+        .findAllComponents({ name: "OTab" })
+        .find((tab) => tab.props("name") === "logs");
+      expect(logsTab?.props("suffixIcon")).toBe("lock");
+    });
+
+    it("loads correlated streams when correlation is enabled", async () => {
+      store.state.zoConfig.features = { correlation: "enabled" };
+      (incidentsService.getCorrelatedStreams as any).mockResolvedValue(null);
+      wrapper = await createWrapper({}, {}, "1");
+      await flushPromises();
+
+      wrapper.vm.activeTab = "logs";
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="incident-correlation-license-denied"]').exists()).toBe(
+        false,
+      );
+      expect(incidentsService.getCorrelatedStreams).toHaveBeenCalled();
+    });
+  });
+
   // Note: Loading State Centering tests removed
   // Testing loading state UI presentation is better handled through visual regression tests
   // Component logic tests should focus on loading state management, not CSS/layout
diff --git a/web/src/components/alerts/IncidentDetailDrawer.vue b/web/src/components/alerts/IncidentDetailDrawer.vue
index 1136b2777f..231112f378 100644
--- a/web/src/components/alerts/IncidentDetailDrawer.vue
+++ b/web/src/components/alerts/IncidentDetailDrawer.vue
@@ -147,6 +147,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             :name="tab"
             :label="tab === 'alertTriggers' ? undefined : tabLabels[tab]"
             :data-test="TAB_TEST_IDS[tab]"
+            :suffix-icon="isCorrelationTab(tab) && correlationLocked ? 'lock' : undefined"
+            :tooltip="
+              isCorrelationTab(tab) && correlationLocked ? correlationLockedReason : undefined
+            "
           >
             <template v-if="tab === 'alertTriggers'" #default>
               <div class="flex items-center gap-1.5">
@@ -1203,7 +1207,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </div>
 
               <!-- Logs Tab Content -->
-              <div v-if="activeTab === 'logs'" class="flex h-full flex-1 flex-col overflow-hidden">
+              <LicenseDeniedState
+                v-if="correlationLocked && isCorrelationTab(activeTab)"
+                :features="['correlation']"
+                data-test="incident-correlation-license-denied"
+              />
+              <div
+                v-else-if="activeTab === 'logs'"
+                class="flex h-full flex-1 flex-col overflow-hidden"
+              >
                 <!-- Loading State -->
                 <div
                   v-if="correlationLoading"
@@ -1284,7 +1296,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
               <!-- Metrics Tab Content -->
               <div
-                v-if="activeTab === 'metrics'"
+                v-else-if="activeTab === 'metrics'"
                 class="flex h-full flex-1 flex-col overflow-hidden"
               >
                 <!-- Loading State -->
@@ -1365,7 +1377,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
               <!-- Traces Tab Content -->
               <div
-                v-if="activeTab === 'traces'"
+                v-else-if="activeTab === 'traces'"
                 class="flex h-full flex-1 flex-col overflow-hidden"
               >
                 <!-- Refresh Button (shown when traces data is loaded) -->
@@ -1470,6 +1482,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <div v-if="loading" class="flex flex-1 items-center justify-center">
         <OSpinner size="md" />
       </div>
+      <LicenseDeniedState
+        v-else-if="licenseDenied"
+        :features="licenseDenied"
+        data-test="incident-detail-license-denied"
+      />
     </OPageLayout>
   </div>
 </template>
@@ -1539,6 +1556,9 @@ import { useIncidentRca } from "@/composables/useIncidentRca";
 import type { RcaAskPayload } from "@/utils/incidents/rcaAskAttachment";
 import BillingService, { type AiCreditCounts } from "@/services/billings";
 import config from "@/aws-exports";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const LS_INCIDENT_TAB_ORDER_KEY = "o2_incident_detail_tab_order";
 const DEFAULT_INCIDENT_TAB_ORDER = [
@@ -1563,6 +1583,12 @@ const TAB_TEST_IDS: Record<IncidentTab, string> = {
   traces: "incident-traces-tab",
 };
 
+const CORRELATION_TABS: readonly string[] = ["logs", "metrics", "traces"];
+
+function isCorrelationTab(name: unknown): boolean {
+  return CORRELATION_TABS.includes(name as string);
+}
+
 function isIncidentTab(name: unknown): name is IncidentTab {
   return DEFAULT_INCIDENT_TAB_ORDER.includes(name as IncidentTab);
 }
@@ -1603,6 +1629,7 @@ export default defineComponent({
     OTruncatedText,
     OInlineEdit,
     OBanner,
+    LicenseDeniedState,
   },
   emits: ["close", "status-updated", "sendToAiChat"],
   setup(props, { emit }) {
@@ -1637,6 +1664,7 @@ export default defineComponent({
     };
 
     const loading = ref(false);
+    const licenseDenied = ref<string[] | null>(null);
     const updating = ref(false);
     // Backend also returns a top-level correlation_reason not declared on IncidentWithAlerts.
     const incidentDetails = ref<(IncidentWithAlerts & { correlation_reason?: string }) | null>(
@@ -1810,6 +1838,8 @@ export default defineComponent({
       { label: t("alerts.incidents.severityP4"), value: "P4" },
     ];
 
+    const { locked: correlationLocked, lockedReason: correlationLockedReason } =
+      useLicenseLock("correlation");
     // Telemetry correlation state
     const correlationData = ref<IncidentCorrelatedStreams | null>(null);
     const correlationLoading = ref(false);
@@ -2095,7 +2125,7 @@ export default defineComponent({
 
     // Fetch correlated telemetry streams
     const fetchCorrelatedStreams = async (force: boolean = false) => {
-      if (!incidentDetails.value) return;
+      if (!incidentDetails.value || correlationLocked.value) return;
 
       // Skip if already loaded and not forcing refresh
       if (!force && correlationData.value) return;
@@ -2508,6 +2538,7 @@ export default defineComponent({
 
     const loadDetails = async (incidentId: string) => {
       loading.value = true;
+      licenseDenied.value = null;
 
       // Reset correlation state when loading new incident
       correlationData.value = null;
@@ -2539,6 +2570,7 @@ export default defineComponent({
         }
       } catch (error) {
         console.error("Failed to load incident details:", error);
+        licenseDenied.value = licenseDeniedFeatures(error);
         toast({
           variant: "error",
           message: t("toastMessages.alerts.failedToLoadIncidentDetails"),
@@ -3099,6 +3131,7 @@ export default defineComponent({
     };
 
     return {
+      licenseDenied,
       mutedBannerText,
       openMutingDowntime,
       raw,
@@ -3181,6 +3214,9 @@ export default defineComponent({
       alertActivityChartData,
       getSemanticGroupDisplayName,
       refreshCorrelation,
+      correlationLocked,
+      correlationLockedReason,
+      isCorrelationTab,
       close,
       handleSendToAiChat,
       acknowledgeIncident,
diff --git a/web/src/components/alerts/IncidentList.spec.ts b/web/src/components/alerts/IncidentList.spec.ts
index 1dd0d196e1..3c6a94b7f3 100644
--- a/web/src/components/alerts/IncidentList.spec.ts
+++ b/web/src/components/alerts/IncidentList.spec.ts
@@ -311,6 +311,18 @@ describe("IncidentList.vue", () => {
       await (wrapper.vm as any).refreshIncidents();
       await flushPromises();
       expect(incidentsService.list).toHaveBeenCalled();
+      expect(toast).toHaveBeenCalledWith(expect.objectContaining({ variant: "success" }));
+    });
+
+    it("does not report success when the refresh fails", async () => {
+      wrapper = createWrapper();
+      await flushPromises();
+      vi.clearAllMocks();
+      (incidentsService.list as any).mockRejectedValue({ response: { status: 403 } });
+      await (wrapper.vm as any).refreshIncidents();
+      await flushPromises();
+      expect(incidentsService.list).toHaveBeenCalled();
+      expect(toast).not.toHaveBeenCalled();
     });
   });
 
diff --git a/web/src/components/alerts/IncidentList.vue b/web/src/components/alerts/IncidentList.vue
index edaa2703b9..60a78ad889 100644
--- a/web/src/components/alerts/IncidentList.vue
+++ b/web/src/components/alerts/IncidentList.vue
@@ -397,6 +397,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import OTable from "@/lib/core/Table/OTable.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import ODimensionChip from "@/lib/core/Badge/ODimensionChip.vue";
@@ -466,7 +467,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = incidentsList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     // The first real load lands after mount: land on the saved page, or page 1 when it no longer exists. setTimeout(0) runs after the table has taken the new rows.
     watch(
@@ -1120,8 +1121,7 @@ export default defineComponent({
     );
 
     const refreshIncidents = async () => {
-      // Explicit refresh: must reach the server.
-      await loadIncidents(true);
+      if ((await incidentsList.refetch()).isError) return;
       toast({
         variant: "success",
         message: t("toastMessages.alerts.incidentsRefreshed"),
diff --git a/web/src/components/alerts/PipelinesDestinationList.vue b/web/src/components/alerts/PipelinesDestinationList.vue
index 52fc2c60e2..bfb5d90155 100644
--- a/web/src/components/alerts/PipelinesDestinationList.vue
+++ b/web/src/components/alerts/PipelinesDestinationList.vue
@@ -241,6 +241,7 @@ import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { COL } from "@/lib/core/Table/OTable.types";
 
 interface ConformDelete {
@@ -414,7 +415,7 @@ export default defineComponent({
     // spinner. `loading` is the skeleton, for a cold read only.
     const fetching = ref(false);
     const lastUpdatedAt = ref<number | null>(null);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     // Bound to refresh / post-write reloads: always reaches the server.
     const refreshDestinations = () => getDestinations(true);
 
@@ -457,7 +458,7 @@ export default defineComponent({
             queryClient.getQueryState(options.queryKey)?.dataUpdatedAt ?? Date.now();
         })
         .catch((err: any) => {
-          forbidden.value = err?.response?.status === 403;
+          forbidden.value = forbiddenState(err);
           if (!forbidden.value) {
             toast({
               variant: "error",
diff --git a/web/src/components/alerts/TemplateList.vue b/web/src/components/alerts/TemplateList.vue
index 6901206594..3b9d36b6df 100644
--- a/web/src/components/alerts/TemplateList.vue
+++ b/web/src/components/alerts/TemplateList.vue
@@ -426,6 +426,7 @@ import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useDraftLabel } from "@/components/common/drafts/useDraftLabel";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { forbiddenState } from "@/utils/featureGate";
 
 const AddTemplate = defineAsyncComponent(() => import("@/components/alerts/AddTemplate.vue"));
 
@@ -565,7 +566,7 @@ const refreshTemplates = () => getTemplates(true);
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = templatesList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 // The first real load lands after mount and races TanStack's own auto-reset-on-data-change, which resolves through its own deferred microtask queue — setTimeout(0) runs strictly after that queue drains, so the restored page reliably wins.
 watch(
diff --git a/web/src/components/alerts/downtimes/AddDowntime.spec.ts b/web/src/components/alerts/downtimes/AddDowntime.spec.ts
index 208be1d379..f317c8fc5a 100644
--- a/web/src/components/alerts/downtimes/AddDowntime.spec.ts
+++ b/web/src/components/alerts/downtimes/AddDowntime.spec.ts
@@ -133,6 +133,58 @@ describe("AddDowntime", () => {
     await flushPromises();
   };
 
+  it("locks the license-locked target modules and reads no synthetics folders", async () => {
+    vi.mocked(common.list_Folders).mockClear();
+    store.state.zoConfig.features = { synthetics: "locked", anomaly_detection: "locked" };
+    try {
+      const { wrapper } = await mountPage();
+      for (const module of ["synthetics", "anomaly_detections", "slos"]) {
+        const item = wrapper.get(`[data-test="add-downtime-module-${module}"]`);
+        expect(item.attributes("disabled")).toBeDefined();
+      }
+      expect(
+        wrapper.get('[data-test="add-downtime-module-alerts"]').attributes("disabled"),
+      ).toBeUndefined();
+      const types = vi.mocked(common.list_Folders).mock.calls.map((call) => call[1]);
+      expect(types).not.toContain("synthetics");
+      wrapper.unmount();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("drops a prefilled module when a late config locks it", async () => {
+    const router = makeRouter();
+    await router.push({
+      name: "addDowntime",
+      query: { org_identifier: "default", module: "synthetics" },
+    });
+    await router.isReady();
+    const wrapper = mount(AddDowntime, {
+      global: { plugins: [store, router] },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    expect(wrapper.find('[data-test="downtime-target-synthetics"]').exists()).toBe(true);
+    try {
+      store.state.zoConfig.features = { synthetics: "locked" };
+      await flushPromises();
+      expect(wrapper.find('[data-test="downtime-target-synthetics"]').exists()).toBe(false);
+    } finally {
+      delete store.state.zoConfig.features;
+      wrapper.unmount();
+    }
+  });
+
+  it("leaves every target module open while the features are enabled", async () => {
+    const { wrapper } = await mountPage();
+    for (const module of ["alerts", "synthetics", "anomaly_detections", "slos"]) {
+      const item = wrapper.get(`[data-test="add-downtime-module-${module}"]`);
+      expect(item.attributes("disabled")).toBeUndefined();
+    }
+    wrapper.unmount();
+  });
+
   it("counts the reason against the server's 1,000-character cap", async () => {
     const { wrapper } = await mountPage();
     const field = wrapper.get('[data-test="add-downtime-reason"]');
diff --git a/web/src/components/alerts/downtimes/AddDowntime.vue b/web/src/components/alerts/downtimes/AddDowntime.vue
index 1b0f1c9ed7..f4979583d8 100644
--- a/web/src/components/alerts/downtimes/AddDowntime.vue
+++ b/web/src/components/alerts/downtimes/AddDowntime.vue
@@ -162,7 +162,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :key="m"
                   :value="m"
                   size="sm"
-                  :icon-left="MODULE_ICONS[m]"
+                  :icon-left="moduleLocks[m].locked.value ? 'lock' : MODULE_ICONS[m]"
+                  :disabled="moduleLocks[m].locked.value"
+                  :focusable-unavailable="moduleLocks[m].locked.value"
+                  :tooltip="
+                    moduleLocks[m].locked.value ? moduleLocks[m].lockedReason.value : undefined
+                  "
                   :data-test="`add-downtime-module-${m}`"
                 >
                   {{ t(MODULE_LABEL_KEYS[m]) }}
@@ -378,7 +383,7 @@ import { useMutation, useQuery } from "@tanstack/vue-query";
 import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
 import { useOrgId } from "@/composables/query";
 import { useAutoName } from "@/composables/useAutoName";
-import { useDowntimeItems } from "@/composables/downtimes/useDowntimeItems";
+import { useDowntimeItems, useTargetModuleLocks } from "@/composables/downtimes/useDowntimeItems";
 import { useDefaultDowntimeFolder } from "@/composables/downtimes/useDefaultDowntimeFolder";
 import { foldersQuery, optionalFoldersQuery } from "@/services/common.queries";
 import {
@@ -465,7 +470,10 @@ const queryList = (value: unknown): string[] =>
     .filter(Boolean);
 
 const browserZone = browserTimezone();
-const prefillModule = MODULE_ORDER.find((m) => m === route.query.module);
+const moduleLocks = useTargetModuleLocks();
+const prefillModule = MODULE_ORDER.find(
+  (m) => m === route.query.module && !moduleLocks[m].locked.value,
+);
 
 // A new downtime without a folder in the URL is filed where the user may create one.
 const folderDefault = useDefaultDowntimeFolder();
@@ -493,7 +501,9 @@ const alertFolders = useQuery(() =>
   Object.assign(optionalFoldersQuery(orgId.value, "alerts"), { enabled: !!orgId.value }),
 );
 const syntheticFolders = useQuery(() =>
-  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), { enabled: !!orgId.value }),
+  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), {
+    enabled: !!orgId.value && !moduleLocks.synthetics.locked.value,
+  }),
 );
 const detailQuery = useQuery(() =>
   Object.assign(downtimeDetailQuery(orgId.value, sourceId.value, sourceFolder), {
@@ -653,6 +663,16 @@ watch(
   () => values.value.modules,
   (modules) => (listedModules.value = [...modules]),
 );
+// The org config can land after mount; a new downtime then drops a module its license locks.
+watch(
+  () => MODULE_ORDER.filter((m) => moduleLocks[m].locked.value),
+  (locked) => {
+    if (isEdit.value || !locked.length) return;
+    const kept = values.value.modules.filter((m) => !locked.includes(m));
+    if (kept.length !== values.value.modules.length) form.setFieldValue("modules", kept);
+  },
+  { immediate: true },
+);
 const folderId = computed(() => values.value.folder_id);
 const setFolder = (value: string) => form.setFieldValue("folder_id", value || "default");
 
diff --git a/web/src/components/alerts/downtimes/DowntimeDetail.spec.ts b/web/src/components/alerts/downtimes/DowntimeDetail.spec.ts
index 7e67d6dbcc..ccfcadbab2 100644
--- a/web/src/components/alerts/downtimes/DowntimeDetail.spec.ts
+++ b/web/src/components/alerts/downtimes/DowntimeDetail.spec.ts
@@ -21,6 +21,7 @@ import DowntimeDetail from "./DowntimeDetail.vue";
 import downtimes from "@/services/downtimes";
 import type { DowntimeDetail as DowntimeDetailData } from "@/services/downtimes";
 import alerts from "@/services/alerts";
+import common from "@/services/common";
 import { queryClient } from "@/composables/query/queryClient";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
 import OTable from "@/lib/core/Table/OTable.vue";
@@ -256,6 +257,22 @@ describe("DowntimeDetail", () => {
     wrapper.unmount();
   });
 
+  it("reads no synthetics folders while synthetics is license-locked", async () => {
+    vi.mocked(downtimes.get).mockResolvedValue({ data: detail } as never);
+    vi.mocked(common.list_Folders).mockClear();
+    store.state.zoConfig.features = { synthetics: "locked" };
+    try {
+      const { wrapper } = await mountDetail();
+      await flushPromises();
+      const types = vi.mocked(common.list_Folders).mock.calls.map((call) => call[1]);
+      expect(types).toContain("alerts");
+      expect(types).not.toContain("synthetics");
+      wrapper.unmount();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it("shows a not-found state on a 404", async () => {
     vi.mocked(downtimes.get).mockRejectedValue({ response: { status: 404 } });
 
diff --git a/web/src/components/alerts/downtimes/DowntimeDetail.vue b/web/src/components/alerts/downtimes/DowntimeDetail.vue
index ac41f32c2b..9107632825 100644
--- a/web/src/components/alerts/downtimes/DowntimeDetail.vue
+++ b/web/src/components/alerts/downtimes/DowntimeDetail.vue
@@ -369,6 +369,7 @@ import { useRoute, useRouter } from "vue-router";
 import { useMutation, useQuery } from "@tanstack/vue-query";
 import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
 import { useOrgId } from "@/composables/query";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { foldersQuery, optionalFoldersQuery } from "@/services/common.queries";
 import { alertHistoryQuery } from "@/services/alerts.queries";
 import {
@@ -478,8 +479,11 @@ const downtimeFolders = useQuery(() =>
 const alertFolders = useQuery(() =>
   Object.assign(optionalFoldersQuery(orgId.value, "alerts"), { enabled: !!orgId.value }),
 );
+const { locked: syntheticsLocked } = useLicenseLock("synthetics");
 const syntheticFolders = useQuery(() =>
-  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), { enabled: !!orgId.value }),
+  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), {
+    enabled: !!orgId.value && !syntheticsLocked.value,
+  }),
 );
 
 const historyQuery = useQuery(() =>
diff --git a/web/src/components/alerts/downtimes/DowntimeList.spec.ts b/web/src/components/alerts/downtimes/DowntimeList.spec.ts
index 32052096c5..c4025cb5e1 100644
--- a/web/src/components/alerts/downtimes/DowntimeList.spec.ts
+++ b/web/src/components/alerts/downtimes/DowntimeList.spec.ts
@@ -208,6 +208,28 @@ describe("DowntimeList", () => {
       },
     } as never);
 
+  it("reads no synthetics folders while synthetics is license-locked", async () => {
+    cutList();
+    store.state.zoConfig.features = { synthetics: "locked" };
+    try {
+      const wrapper = await mountList();
+      const types = vi.mocked(common.list_Folders).mock.calls.map((call) => call[1]);
+      expect(types).toContain("alerts");
+      expect(types).not.toContain("synthetics");
+      wrapper.unmount();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("reads the synthetics folders while synthetics is enabled", async () => {
+    cutList();
+    const wrapper = await mountList();
+    const types = vi.mocked(common.list_Folders).mock.calls.map((call) => call[1]);
+    expect(types).toContain("synthetics");
+    wrapper.unmount();
+  });
+
   it("says when the list is cut and keeps a folder's tiles on the rows it shows", async () => {
     cutList();
     const wrapper = await mountList({ folder: "team-a" });
diff --git a/web/src/components/alerts/downtimes/DowntimeList.vue b/web/src/components/alerts/downtimes/DowntimeList.vue
index 0ca65e9936..cb8519a3d7 100644
--- a/web/src/components/alerts/downtimes/DowntimeList.vue
+++ b/web/src/components/alerts/downtimes/DowntimeList.vue
@@ -616,7 +616,9 @@ import { useStore } from "vuex";
 import { useRoute, useRouter } from "vue-router";
 import { useMutation, useQuery } from "@tanstack/vue-query";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useOrgId } from "@/composables/query";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { queryClient } from "@/composables/query/queryClient";
 import { foldersQuery, optionalFoldersQuery } from "@/services/common.queries";
 import { folderKeys } from "@/services/common.querykeys";
@@ -718,8 +720,11 @@ const listQuery = useQuery(() =>
 const alertFoldersList = useQuery(() =>
   Object.assign(optionalFoldersQuery(orgId.value, "alerts"), { enabled: !!orgId.value }),
 );
+const { locked: syntheticsLocked } = useLicenseLock("synthetics");
 const syntheticFoldersList = useQuery(() =>
-  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), { enabled: !!orgId.value }),
+  Object.assign(optionalFoldersQuery(orgId.value, "synthetics"), {
+    enabled: !!orgId.value && !syntheticsLocked.value,
+  }),
 );
 const downtimeFoldersList = useQuery(() =>
   Object.assign(foldersQuery(orgId.value, "downtimes"), { enabled: !!orgId.value }),
@@ -731,9 +736,10 @@ const truncated = computed(() => listQuery.data.value?.truncated === true);
 const loading = listQuery.isPending;
 const fetching = listQuery.isFetching;
 const lastUpdatedAt = listQuery.dataUpdatedAt;
-const forbidden = computed(() => {
+// A license denial carries its missing keys, so the table shows the license copy instead of the RBAC one.
+const forbidden = computed<ForbiddenState>(() => {
   const e: any = listQuery.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 
 // A failed load must not read as "no downtimes yet" with a Create button.
@@ -1232,7 +1238,7 @@ const refreshAll = async () => {
   void getFoldersListByType(store, "downtimes");
   void listQuery.refetch();
   void alertFoldersList.refetch();
-  void syntheticFoldersList.refetch();
+  if (!syntheticsLocked.value) void syntheticFoldersList.refetch();
 };
 
 useShortcuts([
diff --git a/web/src/components/alerts/downtimes/DowntimeResourcePicker.spec.ts b/web/src/components/alerts/downtimes/DowntimeResourcePicker.spec.ts
index a7298c3006..67dd5a3ed2 100644
--- a/web/src/components/alerts/downtimes/DowntimeResourcePicker.spec.ts
+++ b/web/src/components/alerts/downtimes/DowntimeResourcePicker.spec.ts
@@ -103,6 +103,19 @@ describe("DowntimeResourcePicker", () => {
     expect(keys[keys.length - 1]).toBe("k8s-pod");
   });
 
+  it("asks the correlation analytics nothing while correlation is license-locked", async () => {
+    vi.mocked(serviceStreams.getSemanticGroups).mockResolvedValue({
+      data: [group("aws-ecs-cluster"), group("service"), group("k8s-pod")],
+    } as any);
+    store.state.zoConfig.features = { correlation: "locked" };
+    try {
+      await mountPicker();
+      expect(serviceStreams.getDimensionAnalytics).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it("keeps Load resources for the full list with streams", async () => {
     vi.mocked(serviceStreams.getSemanticGroups).mockResolvedValue({
       data: [group("service"), group("host")],
diff --git a/web/src/components/alerts/downtimes/DowntimeResourcePicker.vue b/web/src/components/alerts/downtimes/DowntimeResourcePicker.vue
index a0b19f8120..a847f2942e 100644
--- a/web/src/components/alerts/downtimes/DowntimeResourcePicker.vue
+++ b/web/src/components/alerts/downtimes/DowntimeResourcePicker.vue
@@ -125,6 +125,7 @@ import { computed, ref, watch } from "vue";
 import { useQuery } from "@tanstack/vue-query";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { useOrgId } from "@/composables/query";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { queryClient } from "@/composables/query/queryClient";
 import { dimensionAnalyticsQuery, semanticGroupsQuery } from "@/services/service_streams.queries";
 import { downtimeResourcesQuery, downtimeValuesQuery } from "@/services/downtimes.queries";
@@ -164,6 +165,7 @@ const emit = defineEmits<{
 const { t } = useI18nTyped();
 const { toast } = useToast();
 const orgId = useOrgId();
+const { locked: correlationLocked } = useLicenseLock("correlation");
 
 const semanticGroups = useQuery(() =>
   Object.assign(semanticGroupsQuery(orgId.value), { enabled: !!orgId.value }),
@@ -178,7 +180,8 @@ const hasHost = computed(() => dimensionOptions.value.some((o) => o.value === DE
 // The registry's ranking is only needed when the org has no `host` group.
 const analytics = useQuery(() =>
   Object.assign(dimensionAnalyticsQuery(orgId.value), {
-    enabled: !!orgId.value && !!semanticGroups.data.value && !hasHost.value,
+    enabled:
+      !!orgId.value && !!semanticGroups.data.value && !hasHost.value && !correlationLocked.value,
   }),
 );
 
diff --git a/web/src/components/alerts/downtimes/DowntimeTargetCard.spec.ts b/web/src/components/alerts/downtimes/DowntimeTargetCard.spec.ts
index d1d01b7eff..25549f51f3 100644
--- a/web/src/components/alerts/downtimes/DowntimeTargetCard.spec.ts
+++ b/web/src/components/alerts/downtimes/DowntimeTargetCard.spec.ts
@@ -8,12 +8,14 @@ import { useOForm } from "@/lib/forms/Form/useOForm";
 import { ALL_FOLDERS, defaultDowntimeValues } from "@/utils/downtimes/downtimeForm";
 import store from "@/test/unit/helpers/store";
 import common from "@/services/common";
+import { queryClient } from "@/composables/query/queryClient";
 import DowntimeTargetCard from "./DowntimeTargetCard.vue";
 
 const toast = vi.fn();
 vi.mock("@/lib/feedback/Toast/useToast", () => ({ useToast: () => ({ toast }) }));
 
-vi.mock("@/composables/downtimes/useDowntimeItems", () => ({
+vi.mock("@/composables/downtimes/useDowntimeItems", async (importOriginal) => ({
+  ...(await importOriginal<object>()),
   useDowntimeItems: () => ({
     items: ref([
       { id: "a1", name: "payments-db-replica-lag", folderId: "payments", tags: [] },
@@ -125,4 +127,31 @@ describe("DowntimeTargetCard", () => {
     });
     wrapper.unmount();
   });
+
+  it("shows the lock and reads no synthetics folders while synthetics is license-locked", async () => {
+    queryClient.clear();
+    vi.mocked(common.list_Folders).mockClear();
+    store.state.zoConfig.features = { synthetics: "locked" };
+    try {
+      const { wrapper } = mountCard("synthetics", false);
+      await flushPromises();
+      expect(wrapper.find('[data-test="downtime-target-synthetics-locked"]').exists()).toBe(true);
+      const picker = wrapper.find('[data-test="downtime-target-synthetics-folders"]');
+      expect(picker.find("[disabled]").exists()).toBe(true);
+      expect(wrapper.find('[data-test="downtime-target-synthetics-add-items"]').exists()).toBe(
+        false,
+      );
+      expect(common.list_Folders).not.toHaveBeenCalled();
+      wrapper.unmount();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("shows no lock while the module's feature is enabled", async () => {
+    const { wrapper } = mountCard("synthetics", false);
+    await flushPromises();
+    expect(wrapper.find('[data-test="downtime-target-synthetics-locked"]').exists()).toBe(false);
+    wrapper.unmount();
+  });
 });
diff --git a/web/src/components/alerts/downtimes/DowntimeTargetCard.vue b/web/src/components/alerts/downtimes/DowntimeTargetCard.vue
index a6f111d996..8210abd341 100644
--- a/web/src/components/alerts/downtimes/DowntimeTargetCard.vue
+++ b/web/src/components/alerts/downtimes/DowntimeTargetCard.vue
@@ -26,6 +26,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <span class="text-text-heading text-sm font-semibold">
         {{ t(MODULE_LABEL_KEYS[module]) }}
       </span>
+      <OTooltip v-if="locked" :content="lockedReason">
+        <span class="inline-flex" :data-test="`downtime-target-${module}-locked`">
+          <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
+        </span>
+      </OTooltip>
       <span
         v-if="matchCount !== null"
         class="text-text-secondary ms-auto text-xs"
@@ -43,7 +48,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           : t('alerts.downtimes.form.alertFolders')
       "
       :options="folderOptions"
-      :disabled="noAccess"
+      :disabled="noAccess || locked"
       :help-text="noAccess ? noAccessHint : undefined"
       multiple
       searchable
@@ -111,7 +116,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </div>
 
     <div
-      v-if="!noAccess && (!idsOpen || (module === 'synthetics' && !tagsOpen))"
+      v-if="!noAccess && !locked && (!idsOpen || (module === 'synthetics' && !tagsOpen))"
       class="flex flex-wrap gap-1"
     >
       <OButton
@@ -213,7 +218,8 @@ import type { IncidentMode, TargetModule } from "@/services/downtimes";
 import { FORM_CONTEXT_KEY } from "@/lib/forms/Form/OForm.types";
 import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
 import { useToast } from "@/lib/feedback/Toast/useToast";
-import { useDowntimeItems } from "@/composables/downtimes/useDowntimeItems";
+import { useDowntimeItems, useTargetModuleLocks } from "@/composables/downtimes/useDowntimeItems";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import {
   ALL_FOLDERS,
   exclusiveAllFolders,
@@ -269,9 +275,15 @@ const tagsOpen = computed(() => !!values.value?.tags_open);
 const idsOpen = computed(() => !!values.value?.ids_open);
 const sloMode = computed(() => values.value?.slo_mode);
 
+const moduleLocks = useTargetModuleLocks();
+const locked = computed(() => moduleLocks[props.module].locked.value);
+const lockedReason = computed(() => moduleLocks[props.module].lockedReason.value);
+
 const folderType = computed(() => (props.module === "synthetics" ? "synthetics" : "alerts"));
 const foldersList = useQuery(() =>
-  Object.assign(optionalFoldersQuery(orgId.value, folderType.value), { enabled: !!orgId.value }),
+  Object.assign(optionalFoldersQuery(orgId.value, folderType.value), {
+    enabled: !!orgId.value && !locked.value,
+  }),
 );
 const folders = computed(() => foldersList.data.value?.folders ?? []);
 const noAccess = computed(() => !!foldersList.data.value?.forbidden);
diff --git a/web/src/components/alerts/rca/RcaBlindSpots.spec.ts b/web/src/components/alerts/rca/RcaBlindSpots.spec.ts
index d2bd434ff8..cbd362c2f4 100644
--- a/web/src/components/alerts/rca/RcaBlindSpots.spec.ts
+++ b/web/src/components/alerts/rca/RcaBlindSpots.spec.ts
@@ -20,6 +20,7 @@ const { push } = vi.hoisted(() => ({ push: vi.fn() }));
 vi.mock("vue-router", () => ({ useRouter: () => ({ push }) }));
 
 import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
 import RcaBlindSpots from "./RcaBlindSpots.vue";
 import type { RcaBlindSpot } from "@/services/incidents";
 import {
@@ -73,6 +74,26 @@ describe("RcaBlindSpots (03 VE8, VE34, VE37)", () => {
     expect(push).toHaveBeenCalledWith({ name, query: { org_identifier: "default" } });
   });
 
+  it.each([
+    ["connect_toolset", "ai_toolsets"],
+    ["open_pipeline", "pipelines"],
+  ] as const)("%s: disabled with a lock while %s is license-locked", async (fix, feature) => {
+    store.state.zoConfig.features = { [feature]: "locked" };
+    try {
+      const wrapper = mount(RcaBlindSpots, {
+        props: { blindSpots: [rcaBlindSpot({ fix })], org: "default", live: false },
+        global: { plugins: [i18n, store] },
+      });
+      const button = wrapper.find('[data-test="rca-blind-spot-action"]');
+      expect(button.attributes("disabled")).toBeDefined();
+      expect(wrapper.find('[data-test="rca-blind-spot-action-lock"]').exists()).toBe(true);
+      await button.trigger("click");
+      expect(push).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it.each(["resume_run", "none"] as const)(
     "%s renders no button without canResume (VE37)",
     (fix) => {
diff --git a/web/src/components/alerts/rca/RcaBlindSpots.vue b/web/src/components/alerts/rca/RcaBlindSpots.vue
index 46619c1d20..65873697a7 100644
--- a/web/src/components/alerts/rca/RcaBlindSpots.vue
+++ b/web/src/components/alerts/rca/RcaBlindSpots.vue
@@ -52,8 +52,29 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <div class="text-text-heading text-sm font-semibold">{{ spot.title }}</div>
           <div class="text-text-secondary text-compact [text-wrap:pretty]">{{ spot.why }}</div>
         </div>
+        <OTooltip v-if="actions[spot.id]?.lockedReason" :content="actions[spot.id]!.lockedReason!">
+          <span class="inline-flex">
+            <OButton
+              data-test="rca-blind-spot-action"
+              :data-fix="spot.fix"
+              variant="outline"
+              size="sm"
+              disabled
+            >
+              <template #icon-left>
+                <OIcon
+                  name="lock"
+                  class="lock-chip"
+                  size="sm"
+                  data-test="rca-blind-spot-action-lock"
+                />
+              </template>
+              {{ actions[spot.id]!.label }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="actions[spot.id]"
+          v-else-if="actions[spot.id]"
           data-test="rca-blind-spot-action"
           :data-fix="spot.fix"
           variant="outline"
@@ -89,7 +110,9 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import { useI18nTyped, type I18nText } from "@/types/i18n";
 import type { RcaBlindSpot, RcaBlindSpotFix } from "@/services/incidents";
-import { rcaBlindSpotRoute } from "@/utils/incidents/rcaEvidenceLinks";
+import { rcaBlindSpotFeature, rcaBlindSpotRoute } from "@/utils/incidents/rcaEvidenceLinks";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 
 const props = withDefaults(
   defineProps<{
@@ -114,6 +137,10 @@ defineEmits<{
 const { t } = useI18nTyped();
 const router = useRouter();
 const headingId = useId();
+const featureLocks = {
+  ai_toolsets: useLicenseLock("ai_toolsets"),
+  pipelines: useLicenseLock("pipelines"),
+};
 
 const actionLabel = (fix: RcaBlindSpotFix): { label: I18nText; icon: IconName } | null => {
   switch (fix) {
@@ -132,11 +159,17 @@ const actionLabel = (fix: RcaBlindSpotFix): { label: I18nText; icon: IconName }
 
 /** Blind spot id → its button, for the spots that have one. */
 const actions = computed(() => {
-  const byId: Record<string, { label: I18nText; icon: IconName; route: RouteLocationRaw }> = {};
+  const byId: Record<
+    string,
+    { label: I18nText; icon: IconName; route: RouteLocationRaw; lockedReason: I18nText | null }
+  > = {};
   for (const spot of props.blindSpots) {
     const route = rcaBlindSpotRoute(spot.fix, props.org);
     const action = actionLabel(spot.fix);
-    if (route && action) byId[spot.id] = { ...action, route };
+    const feature = rcaBlindSpotFeature(spot.fix);
+    const lock = feature ? featureLocks[feature] : null;
+    const lockedReason = lock?.locked.value ? lock.lockedReason.value : null;
+    if (route && action) byId[spot.id] = { ...action, route, lockedReason };
   }
   return byId;
 });
diff --git a/web/src/components/alerts/rca/RcaEvidenceCard.spec.ts b/web/src/components/alerts/rca/RcaEvidenceCard.spec.ts
index c60d689733..98ff16674f 100644
--- a/web/src/components/alerts/rca/RcaEvidenceCard.spec.ts
+++ b/web/src/components/alerts/rca/RcaEvidenceCard.spec.ts
@@ -21,6 +21,7 @@ vi.mock("vue-router", () => ({ useRouter: () => ({ push }) }));
 vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: toastMock }));
 
 import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
 import RcaEvidenceCard from "./RcaEvidenceCard.vue";
 import type { RcaEvidenceEntry, RcaSummaryHypothesis } from "@/services/incidents";
 import { rcaEvidenceLink } from "@/utils/incidents/rcaEvidenceLinks";
@@ -167,6 +168,45 @@ describe("RcaEvidenceCard (03 VE23–VE29)", () => {
     expect(push).toHaveBeenCalledWith(rcaEvidenceLink(entry.link, "default")!.route);
   });
 
+  it.each([
+    ["logs", rcaEvidenceEntry()],
+    ["metrics", rcaEvidenceEntry({ link: { signal: "metrics", streams: [], promql: "up" } })],
+    [
+      "traces",
+      rcaEvidenceEntry({ link: { signal: "traces", streams: ["default"], filter: "a=1" } }),
+    ],
+  ] as const)("%s locked: the open button is disabled with a lock", async (feature, entry) => {
+    store.state.zoConfig.features = { [feature]: "locked" };
+    try {
+      const wrapper = mount(RcaEvidenceCard, {
+        props: { entry, hypotheses: HYPOTHESES, org: "default" },
+        global: { plugins: [i18n, store] },
+      });
+      const open = byTest(wrapper, "rca-evidence-open");
+      expect(open.attributes("disabled")).toBeDefined();
+      expect(byTest(wrapper, "rca-evidence-open-lock").exists()).toBe(true);
+      await open.trigger("click");
+      expect(push).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("another signal locked: the open button stays live", async () => {
+    store.state.zoConfig.features = { traces: "locked" };
+    try {
+      const wrapper = mount(RcaEvidenceCard, {
+        props: { entry: rcaEvidenceEntry(), hypotheses: HYPOTHESES, org: "default" },
+        global: { plugins: [i18n, store] },
+      });
+      expect(byTest(wrapper, "rca-evidence-open-lock").exists()).toBe(false);
+      await byTest(wrapper, "rca-evidence-open").trigger("click");
+      expect(push).toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it.each([
     ["change", { signal: "change", streams: [] }],
     ["infra", { signal: "infra", streams: ["prod"] }],
diff --git a/web/src/components/alerts/rca/RcaEvidenceCard.vue b/web/src/components/alerts/rca/RcaEvidenceCard.vue
index caa712f156..9d462ee7fd 100644
--- a/web/src/components/alerts/rca/RcaEvidenceCard.vue
+++ b/web/src/components/alerts/rca/RcaEvidenceCard.vue
@@ -92,8 +92,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         {{ entry.result_summary }}
         <span v-if="source" class="text-text-secondary">· {{ source }}</span>
       </span>
+      <OTooltip v-if="link && linkLocked" :content="lockedReason(link.page)">
+        <span class="inline-flex">
+          <OButton data-test="rca-evidence-open" variant="ghost-primary" size="sm" disabled>
+            <template #icon-left>
+              <OIcon
+                name="lock"
+                class="text-icon-locked"
+                size="sm"
+                data-test="rca-evidence-open-lock"
+              />
+            </template>
+            {{ openLabel }}
+          </OButton>
+        </span>
+      </OTooltip>
       <OButton
-        v-if="link"
+        v-else-if="link"
         data-test="rca-evidence-open"
         variant="ghost-primary"
         size="sm"
@@ -134,6 +149,9 @@ import { rcaEvidenceLink, rcaEvidenceQuery } from "@/utils/incidents/rcaEvidence
 import { rcaEvidenceKindIcon, rcaEvidenceTitle, rcaUtcRange } from "@/utils/incidents/rcaSummary";
 import RcaInlineText from "./RcaInlineText.vue";
 import RcaPill from "./RcaPill.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 
 const props = withDefaults(
   defineProps<{
@@ -159,6 +177,9 @@ const router = useRouter();
 const link = computed(() => rcaEvidenceLink(props.entry.link, props.org));
 const query = computed(() => rcaEvidenceQuery(props.entry.link));
 
+const { isLocked, lockedReason } = useLicenseLocks();
+const linkLocked = computed(() => !!link.value && isLocked(streamTypeFeature(link.value.page)));
+
 /** "Logs · checkout_api": the target and its streams. */
 const title = computed<I18nText>(() => rcaEvidenceTitle(props.entry));
 
diff --git a/web/src/components/alerts/rca/RcaVerdictCard.spec.ts b/web/src/components/alerts/rca/RcaVerdictCard.spec.ts
index 4509172fb9..bac385cf5e 100644
--- a/web/src/components/alerts/rca/RcaVerdictCard.spec.ts
+++ b/web/src/components/alerts/rca/RcaVerdictCard.spec.ts
@@ -18,16 +18,23 @@ import { mount, type VueWrapper } from "@vue/test-utils";
 import type * as VueRouter from "vue-router";
 import type * as Vuex from "vuex";
 
-const { pushMock } = vi.hoisted(() => ({ pushMock: vi.fn() }));
+const { pushMock, storeState } = vi.hoisted(() => ({
+  pushMock: vi.fn(),
+  storeState: {
+    selectedOrganization: { identifier: "acme" },
+    zoConfig: {} as { features?: Record<string, string> },
+  },
+}));
 vi.mock("vue-router", async (importOriginal) => ({
   ...(await importOriginal<typeof VueRouter>()),
   useRouter: () => ({ push: pushMock }),
 }));
 vi.mock("vuex", async (importOriginal) => ({
   ...(await importOriginal<typeof Vuex>()),
-  useStore: () => ({ state: { selectedOrganization: { identifier: "acme" } } }),
+  useStore: () => ({ state: storeState }),
 }));
 
+import { createStore } from "vuex";
 import i18n from "@/locales";
 import RcaVerdictCard from "./RcaVerdictCard.vue";
 import {
@@ -796,6 +803,28 @@ describe("RcaVerdictCard", () => {
       expect(byTest(without, "rca-paused-connect-btn").exists()).toBe(false);
     });
 
+    it("'Connect AI Toolset' is disabled with a lock while ai_toolsets is license-locked", async () => {
+      storeState.zoConfig.features = { ai_toolsets: "locked" };
+      try {
+        // useFeatureLock is loaded by the test setup before this file's vuex mock, so it injects a real store.
+        const wrapper = mount(RcaVerdictCard, {
+          props: {
+            runId: "run-2",
+            ...PAUSED,
+            summary: rcaRunSummaryLive({ blind_spots: [rcaBlindSpot()] }),
+          },
+          global: { plugins: [i18n, createStore({ state: storeState })], stubs },
+        });
+        const button = byTest(wrapper, "rca-paused-connect-btn");
+        expect(button.attributes("disabled")).toBeDefined();
+        expect(byTest(wrapper, "rca-paused-connect-lock").exists()).toBe(true);
+        await button.trigger("click");
+        expect(pushMock).not.toHaveBeenCalled();
+      } finally {
+        delete storeState.zoConfig.features;
+      }
+    });
+
     it("no paused banner while running", () => {
       const wrapper = mountCard({ ...PAUSED, waitingInput: false });
       expect(byTest(wrapper, "rca-paused-banner").exists()).toBe(false);
diff --git a/web/src/components/alerts/rca/RcaVerdictCard.vue b/web/src/components/alerts/rca/RcaVerdictCard.vue
index bb36a6eea6..ec0fe1bbc5 100644
--- a/web/src/components/alerts/rca/RcaVerdictCard.vue
+++ b/web/src/components/alerts/rca/RcaVerdictCard.vue
@@ -248,8 +248,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >
           {{ t("alerts.incidents.rcaSteer.paused.tellAgent") }}
         </OButton>
+        <OTooltip v-if="connectToolsetRoute && toolsetsLocked" :content="toolsetsLockedReason">
+          <span class="inline-flex">
+            <OButton data-test="rca-paused-connect-btn" variant="outline" size="sm" disabled>
+              <template #icon-left>
+                <OIcon
+                  name="lock"
+                  class="lock-chip"
+                  size="sm"
+                  data-test="rca-paused-connect-lock"
+                />
+              </template>
+              {{ t("alerts.incidents.rcaSummary.fix.connectToolset") }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="connectToolsetRoute"
+          v-else-if="connectToolsetRoute"
           data-test="rca-paused-connect-btn"
           variant="outline"
           size="sm"
@@ -444,6 +459,7 @@ import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import type {
   RcaBand,
@@ -463,6 +479,7 @@ import {
 } from "@/utils/incidents/rcaSummary";
 import { formatTimestampInTimezone } from "@/utils/date";
 import { rcaBlindSpotRoute } from "@/utils/incidents/rcaEvidenceLinks";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { RcaCardState } from "@/utils/incidents/rcaThread";
 import type { RcaUnblockedLine } from "@/utils/incidents/rcaSteering";
 import type { RcaRefusal } from "@/composables/useIncidentRca";
@@ -571,8 +588,11 @@ const connectToolsetRoute = computed(() =>
     ? rcaBlindSpotRoute("connect_toolset", props.org)
     : null,
 );
+const { locked: toolsetsLocked, lockedReason: toolsetsLockedReason } =
+  useLicenseLock("ai_toolsets");
 const openConnectToolset = () => {
-  if (connectToolsetRoute.value) void router.push(connectToolsetRoute.value);
+  if (connectToolsetRoute.value && !toolsetsLocked.value)
+    void router.push(connectToolsetRoute.value);
 };
 
 const unblockedText = computed<I18nText | null>(() => {
diff --git a/web/src/components/autoobserve/CoverageServiceDrawer.spec.ts b/web/src/components/autoobserve/CoverageServiceDrawer.spec.ts
new file mode 100644
index 0000000000..64892b10eb
--- /dev/null
+++ b/web/src/components/autoobserve/CoverageServiceDrawer.spec.ts
@@ -0,0 +1,82 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import store from "@/test/unit/helpers/store";
+import router from "@/test/unit/helpers/router";
+import i18n from "@/locales";
+import { raw, type TranslateFn } from "@/types/i18n";
+import { coverageFor } from "./fixtures";
+import CoverageServiceDrawer from "./CoverageServiceDrawer.vue";
+
+const t = ((key: string) => raw(key)) as unknown as TranslateFn;
+const stubs = {
+  ODrawer: { template: "<div><slot name='header' /><slot /></div>" },
+  CoverageMetricChart: true,
+  CoverageSignalDetail: true,
+};
+const original = { ...store.state.zoConfig };
+
+const mountDrawer = () => {
+  const row = coverageFor("demo", t)[0];
+  return mount(CoverageServiceDrawer, {
+    props: {
+      row,
+      serviceStates: {},
+      scenario: "demo",
+      ledger: [],
+      expanded: null,
+      anchor: "",
+      fix: null,
+      message: "",
+    },
+    global: { plugins: [i18n, store, router], stubs },
+  });
+};
+
+afterEach(() => {
+  store.commit("setConfig", original);
+  vi.restoreAllMocks();
+});
+
+describe("CoverageServiceDrawer — traces links", () => {
+  it("opens Traces and the catalog while traces is enabled", async () => {
+    const push = vi.spyOn(router, "push").mockResolvedValue(undefined);
+    const wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="autoobserve-coverage-drawer-traces"]').trigger("click");
+    await wrapper.find('[data-test="autoobserve-coverage-drawer-catalog"]').trigger("click");
+    expect(push).toHaveBeenCalledTimes(2);
+    expect(push).toHaveBeenLastCalledWith(
+      expect.objectContaining({
+        name: "traces",
+        query: expect.objectContaining({ tab: "services-catalog" }),
+      }),
+    );
+  });
+
+  it("disables both links while traces is locked", async () => {
+    store.commit("setConfig", { ...original, features: { traces: "locked" } });
+    const push = vi.spyOn(router, "push").mockResolvedValue(undefined);
+    const wrapper = mountDrawer();
+    await flushPromises();
+    for (const id of ["traces", "catalog"]) {
+      const btn = wrapper.find(`[data-test="autoobserve-coverage-drawer-${id}"]`);
+      expect(btn.attributes("disabled")).toBeDefined();
+      await btn.trigger("click");
+    }
+    expect(push).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/components/autoobserve/CoverageServiceDrawer.vue b/web/src/components/autoobserve/CoverageServiceDrawer.vue
index 2f22556326..2211e713ab 100644
--- a/web/src/components/autoobserve/CoverageServiceDrawer.vue
+++ b/web/src/components/autoobserve/CoverageServiceDrawer.vue
@@ -39,24 +39,38 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           >
           <span class="text-text-secondary block truncate text-xs">{{ subTitle }}</span>
         </div>
-        <OButton
-          variant="outline"
-          size="sm-action"
-          icon-left="timeline"
-          :aria-label="t('autoobserve.coverage.openTraces')"
-          data-test="autoobserve-coverage-drawer-traces"
-          @click="openTraces()"
-          ><span class="max-md:sr-only">{{ t("autoobserve.coverage.openTraces") }}</span></OButton
-        >
-        <OButton
-          variant="outline"
-          size="sm-action"
-          icon-left="hub"
-          :aria-label="t('autoobserve.coverage.openCatalog')"
-          data-test="autoobserve-coverage-drawer-catalog"
-          @click="openTraces('services-catalog')"
-          ><span class="max-md:sr-only">{{ t("autoobserve.coverage.openCatalog") }}</span></OButton
-        >
+        <OTooltip :content="tracesLock.lockedReason.value" :disabled="!tracesLock.locked.value">
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="sm-action"
+              :icon-left="tracesLock.locked.value ? 'lock' : 'timeline'"
+              :disabled="tracesLock.locked.value"
+              :aria-label="t('autoobserve.coverage.openTraces')"
+              data-test="autoobserve-coverage-drawer-traces"
+              @click="openTraces()"
+              ><span class="max-md:sr-only">{{
+                t("autoobserve.coverage.openTraces")
+              }}</span></OButton
+            >
+          </span>
+        </OTooltip>
+        <OTooltip :content="tracesLock.lockedReason.value" :disabled="!tracesLock.locked.value">
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="sm-action"
+              :icon-left="tracesLock.locked.value ? 'lock' : 'hub'"
+              :disabled="tracesLock.locked.value"
+              :aria-label="t('autoobserve.coverage.openCatalog')"
+              data-test="autoobserve-coverage-drawer-catalog"
+              @click="openTraces('services-catalog')"
+              ><span class="max-md:sr-only">{{
+                t("autoobserve.coverage.openCatalog")
+              }}</span></OButton
+            >
+          </span>
+        </OTooltip>
       </div>
     </template>
 
@@ -243,6 +257,8 @@ import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import type { BadgeVariant } from "@/lib/core/Badge/OBadge.types";
@@ -289,6 +305,7 @@ const emit = defineEmits<{
 
 const { t } = useI18nTyped();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
 const store = useStore();
 
 const HEX_POINTS = "18.23,14.75 10,19.5 1.77,14.75 1.77,5.25 10,0.5 18.23,5.25";
diff --git a/web/src/components/common/FeatureLockBoundary.vue b/web/src/components/common/FeatureLockBoundary.vue
new file mode 100644
index 0000000000..15ecdda228
--- /dev/null
+++ b/web/src/components/common/FeatureLockBoundary.vue
@@ -0,0 +1,77 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Not `inert`: Chromium stops wheel-scrolling inert scroll containers, so a locked page could not be scrolled. -->
+<!-- pointerdown is left alone: Reka closes header and sidebar popovers on an outside pointerdown. -->
+<template>
+  <div
+    class="h-full"
+    :class="locked ? 'feature-locked-content' : ''"
+    data-test="feature-lock-boundary"
+    :data-locked-feature="feature ?? undefined"
+    @click.capture="block"
+    @dblclick.capture="block"
+    @submit.capture="block"
+    @dragstart.capture="block"
+    @dragover.capture="block"
+    @drop.capture="block"
+    @paste.capture="block"
+    @keydown.capture="onKeydown"
+  >
+    <slot />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { toRef } from "vue";
+import { LOCK_EXEMPT_ATTR, provideFeatureLock } from "@/composables/useFeatureLock";
+
+const props = defineProps<{ feature: string | null }>();
+
+const SCROLL_KEYS = new Set([
+  "ArrowUp",
+  "ArrowDown",
+  "ArrowLeft",
+  "ArrowRight",
+  "PageUp",
+  "PageDown",
+  "Home",
+  "End",
+  " ",
+]);
+const CONTROL =
+  'a[href], button, input, select, textarea, [contenteditable="true"], [role="button"], [role="tab"], [role="checkbox"], [role="switch"], [role="radio"], [role="combobox"], [role="menuitem"], [role="option"], [role="slider"], [role="separator"]';
+
+const { locked } = provideFeatureLock(toRef(props, "feature"));
+
+const block = (event: Event) => {
+  if (!locked.value || (event.target as Element | null)?.closest?.(`[${LOCK_EXEMPT_ATTR}]`)) return;
+  event.preventDefault();
+  event.stopPropagation();
+};
+
+// Only read-only shortcuts: a page's own Cmd/Ctrl+S or Cmd/Ctrl+Enter would still act.
+const READ_SHORTCUTS = new Set(["c", "a", "f", "g"]);
+
+// Tab, copy/select-all/find and scroll keys off a control pass; anything else aimed at the page is swallowed.
+const onKeydown = (event: KeyboardEvent) => {
+  if (!locked.value || event.key === "Tab") return;
+  if ((event.metaKey || event.ctrlKey) && READ_SHORTCUTS.has(event.key.toLowerCase())) return;
+  const onControl = (event.target as Element | null)?.closest?.(CONTROL);
+  if (!onControl && SCROLL_KEYS.has(event.key)) return;
+  block(event);
+};
+</script>
diff --git a/web/src/components/common/FeatureLockExempt.vue b/web/src/components/common/FeatureLockExempt.vue
new file mode 100644
index 0000000000..ea380e6ade
--- /dev/null
+++ b/web/src/components/common/FeatureLockExempt.vue
@@ -0,0 +1,30 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Only for controls that navigate: anything inside stays usable on a license-locked page. -->
+<template>
+  <component :is="as" v-bind="{ [LOCK_EXEMPT_ATTR]: '' }">
+    <slot />
+  </component>
+</template>
+
+<script setup lang="ts">
+import { LOCK_EXEMPT_ATTR, provideFeatureLockExempt } from "@/composables/useFeatureLock";
+
+withDefaults(defineProps<{ as?: string }>(), { as: "div" });
+
+provideFeatureLockExempt();
+</script>
diff --git a/web/src/components/common/FeatureLocked.spec.ts b/web/src/components/common/FeatureLocked.spec.ts
new file mode 100644
index 0000000000..16c484f6f1
--- /dev/null
+++ b/web/src/components/common/FeatureLocked.spec.ts
@@ -0,0 +1,48 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import FeatureLocked from "@/components/common/FeatureLocked.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+
+vi.mock("vue-router", () => ({ useRoute: () => ({ params: { feature: "ai_assistant" } }) }));
+vi.mock("vuex", () => ({
+  useStore: () => ({ state: { zoConfig: { feature_names: { ai_assistant: "AI Assistant" } } } }),
+}));
+
+describe("FeatureLocked", () => {
+  it("renders the shared license-denied state for the routed feature", () => {
+    const w = mount(FeatureLocked, {
+      global: {
+        plugins: [i18n],
+        stubs: { OPageLayout: { template: "<div><slot /></div>" } },
+      },
+    });
+    expect(w.findComponent(LicenseDeniedState).props("features")).toEqual(["ai_assistant"]);
+  });
+
+  it("tells the user to ask an administrator and offers no contact-sales action", () => {
+    const w = mount(FeatureLocked, {
+      global: {
+        plugins: [i18n],
+        stubs: { OPageLayout: { template: "<div><slot /></div>" } },
+      },
+    });
+    expect(w.text()).toContain("Ask your administrator to update the license");
+    expect(w.find('[data-test="feature-locked-contact-sales"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/common/FeatureLocked.vue b/web/src/components/common/FeatureLocked.vue
new file mode 100644
index 0000000000..18894e0015
--- /dev/null
+++ b/web/src/components/common/FeatureLocked.vue
@@ -0,0 +1,42 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <FeatureLockExempt class="h-full">
+    <OPageLayout :title="label" :icon="meta?.icon ?? 'lock'" data-test="feature-locked-page">
+      <LicenseDeniedState :features="[key]" />
+    </OPageLayout>
+  </FeatureLockExempt>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useRoute } from "vue-router";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import { useFeatureNames } from "@/composables/useFeatureLock";
+import { LOCKED_FEATURES } from "@/utils/featureGate";
+
+const { t } = useI18nTyped();
+const route = useRoute();
+const { featureName } = useFeatureNames();
+
+const key = computed(() => String(route.params.feature ?? ""));
+const meta = computed(() => LOCKED_FEATURES[key.value]);
+const label = computed(() => raw(featureName(key.value)) || t("featureLock.thisFeature"));
+</script>
diff --git a/web/src/components/common/LicenseDeniedState.vue b/web/src/components/common/LicenseDeniedState.vue
new file mode 100644
index 0000000000..e82818fbac
--- /dev/null
+++ b/web/src/components/common/LicenseDeniedState.vue
@@ -0,0 +1,42 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OEmptyState
+    size="hero"
+    preset="no-access"
+    :title="t('featureLock.toastTitle')"
+    :description="
+      features.length
+        ? t('featureLock.toastMessage', { features: raw(featureNames(features)) })
+        : t('featureLock.toastMessageGeneric')
+    "
+  >
+    <template v-if="$slots.actions" #actions><slot name="actions" /></template>
+  </OEmptyState>
+</template>
+
+<script setup lang="ts">
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import { useFeatureNames } from "@/composables/useFeatureLock";
+
+/** The missing feature keys of a license denial, from `licenseDeniedFeatures()`. */
+defineProps<{ features: readonly string[] }>();
+
+const { t } = useI18nTyped();
+const { featureNames } = useFeatureNames();
+</script>
diff --git a/web/src/components/common/SectionHub.spec.ts b/web/src/components/common/SectionHub.spec.ts
new file mode 100644
index 0000000000..37bb72506e
--- /dev/null
+++ b/web/src/components/common/SectionHub.spec.ts
@@ -0,0 +1,58 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import SectionHub from "./SectionHub.vue";
+
+const push = vi.fn();
+vi.mock("vue-router", () => ({ useRouter: () => ({ push }) }));
+
+const openUpgradeDialog = vi.fn();
+vi.mock("@/composables/useEnterpriseUpgradeDialog", () => ({
+  useEnterpriseUpgradeDialog: () => ({ open: openUpgradeDialog }),
+}));
+
+describe("SectionHub", () => {
+  it("draws the lock on a license-locked card and still opens its page", async () => {
+    const wrapper = mount(SectionHub, {
+      props: {
+        groups: [
+          {
+            label: "Access",
+            items: [
+              { key: "roles", label: "Roles", to: { name: "roles" }, licenseLocked: true },
+              { key: "users", label: "Users", to: { name: "users" } },
+            ],
+          },
+        ] as any,
+      },
+      global: {
+        stubs: {
+          ConstrainedPage: { template: "<div><slot /></div>" },
+          OIcon: { props: ["name"], template: "<i :data-icon='name' />" },
+        },
+      },
+    });
+    const card = wrapper.get('[data-test="section-hub-card-roles"]');
+    expect(card.find('[data-icon="lock"]').exists()).toBe(true);
+    expect(
+      wrapper.get('[data-test="section-hub-card-users"]').find('[data-icon="lock"]').exists(),
+    ).toBe(false);
+    await card.trigger("click");
+    expect(push).toHaveBeenCalledWith({ name: "roles" });
+    expect(openUpgradeDialog).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/components/common/SectionHub.vue b/web/src/components/common/SectionHub.vue
index a617c60670..42906b9b31 100644
--- a/web/src/components/common/SectionHub.vue
+++ b/web/src/components/common/SectionHub.vue
@@ -73,7 +73,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <span
                   class="text-text-heading group-hover:text-accent flex items-center gap-1.5 text-sm font-semibold transition-colors"
                   >{{ item.label }}
-                  <OIcon v-if="item.locked" name="lock" size="xs" class="text-warning-600" />
+                  <OIcon
+                    v-if="item.locked || item.licenseLocked"
+                    name="lock"
+                    size="xs"
+                    class="lock-chip"
+                  />
                 </span>
                 <span
                   v-if="item.description"
@@ -117,6 +122,10 @@ export interface SectionHubItem {
   locked?: boolean;
   lockedMessage?: I18nText;
   lockedShowUpgradeCta?: boolean;
+  /** The license lacks this feature: shows the lock but still opens `to`, whose page shows the license banner. */
+  licenseLocked?: boolean;
+  /** Screen-reader text for the lock, e.g. "Locked: needs X". */
+  lockedLabel?: I18nText;
   dataTest?: string;
 }
 
diff --git a/web/src/components/common/SectionRail.spec.ts b/web/src/components/common/SectionRail.spec.ts
index 1c504da0a1..0adbe527f2 100644
--- a/web/src/components/common/SectionRail.spec.ts
+++ b/web/src/components/common/SectionRail.spec.ts
@@ -3,7 +3,9 @@
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { mount } from "@vue/test-utils";
+import { h } from "vue";
 import SectionRail from "./SectionRail.vue";
+import FeatureLockBoundary from "./FeatureLockBoundary.vue";
 
 const push = vi.fn();
 vi.mock("vue-router", () => ({
@@ -30,8 +32,8 @@ const stubs = {
   OTabs: { template: "<div><slot /></div>" },
   OTab: {
     name: "OTab",
-    props: ["name", "label", "icon", "tooltip"],
-    template: "<button :data-name='name'>{{ label }}</button>",
+    props: ["name", "label", "icon", "tooltip", "suffixIcon"],
+    template: "<button :data-name='name'>{{ label }}<slot name='icon' /></button>",
   },
   OButton: {
     emits: ["click"],
@@ -141,6 +143,58 @@ describe("SectionRail", () => {
     expect(push).toHaveBeenCalledWith({ name: "a" });
   });
 
+  const lockedGroups = (flags: Record<string, boolean>) => [
+    {
+      label: "Permissions",
+      items: [{ key: "roles", label: "Roles", to: { name: "roles" }, ...flags }],
+    },
+  ];
+
+  it("keeps its links enabled inside a license-locked page", async () => {
+    const wrapper = mount(FeatureLockBoundary, {
+      props: { feature: "rbac" },
+      slots: { default: () => h(SectionRail, { groups }) },
+      global: { stubs: { OTooltip: stubs.OTooltip } },
+    });
+    const tab = wrapper.get('[role="tab"]');
+    expect(tab.attributes("disabled")).toBeUndefined();
+    expect(tab.attributes("aria-disabled")).toBeUndefined();
+    await tab.trigger("click");
+    expect(push).toHaveBeenCalledWith({ name: "a" });
+    wrapper.unmount();
+  });
+
+  it("routes an edition-locked item to the upgrade page", async () => {
+    const wrapper = mountRail({ groups: lockedGroups({ locked: true }) });
+    expect(wrapper.findComponent({ name: "OTab" }).props("suffixIcon")).toBe("lock");
+    await wrapper.get('[data-name="roles"]').trigger("click");
+    expect(push).toHaveBeenCalledWith({ name: "enterpriseFeatures" });
+  });
+
+  // The licensed page shows its own banner, so the upgrade page would only hide it.
+  it("shows the lock on a license-locked item but still opens its page", async () => {
+    const wrapper = mountRail({ groups: lockedGroups({ licenseLocked: true }) });
+    expect(wrapper.findComponent({ name: "OTab" }).props("suffixIcon")).toBe("lock");
+    await wrapper.get('[data-name="roles"]').trigger("click");
+    expect(push).toHaveBeenCalledWith({ name: "roles" });
+  });
+
+  it("swaps the lock suffix for a corner badge once collapsed", async () => {
+    const wrapper = mountRail({
+      groups: lockedGroups({
+        licenseLocked: true,
+        lockedLabel: "Locked: needs RBAC",
+        icon: "lock",
+      }),
+      collapsible: true,
+      icon: "auto-awesome",
+    });
+    await wrapper.get('[data-test="section-rail-toggle"]').trigger("click");
+    expect(wrapper.findComponent({ name: "OTab" }).props("suffixIcon")).toBeUndefined();
+    expect(wrapper.get(".sr-only").text()).toBe("Locked: needs RBAC");
+    expect(wrapper.find(".text-icon-locked").exists()).toBe(true);
+  });
+
   const headings = (wrapper: ReturnType<typeof mountRail>) =>
     wrapper.findAll("div.text-text-secondary.font-semibold");
 
diff --git a/web/src/components/common/SectionRail.vue b/web/src/components/common/SectionRail.vue
index 85244e941f..0c3e0fe7a1 100644
--- a/web/src/components/common/SectionRail.vue
+++ b/web/src/components/common/SectionRail.vue
@@ -22,7 +22,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   tinted-active treatment. Sentence-case group headings, soft single-line items.
 -->
 <template>
-  <nav class="bg-surface-panel flex h-full min-h-0 flex-col" data-test="section-rail">
+  <FeatureLockExempt
+    as="nav"
+    class="bg-surface-panel flex h-full min-h-0 flex-col"
+    data-test="section-rail"
+  >
     <!-- Collapsed there is room for one mark, so the module icon doubles as the
          expand control rather than sitting inert beside a second button. It is
          tinted like MenuLink's active module for the same reason the primary nav
@@ -104,17 +108,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :label="collapsed ? undefined : item.label"
               :tooltip="collapsed ? item.label : undefined"
               :icon="item.icon"
-              :suffix-icon="item.locked && !collapsed ? 'lock' : undefined"
+              :suffix-icon="(item.locked || item.licenseLocked) && !collapsed ? 'lock' : undefined"
+              :suffix-label="item.lockedLabel"
               :data-test="item.locked ? `${item.dataTest}-locked` : item.dataTest"
               class="w-full"
               :class="collapsed ? 'justify-center!' : undefined"
               @click="navigate(item.locked ? { name: 'enterpriseFeatures' } : item.to)"
-            />
+            >
+              <template v-if="collapsed && (item.locked || item.licenseLocked)" #icon>
+                <span class="relative inline-flex shrink-0">
+                  <OIcon :name="item.icon as IconName" size="sm" class="o-tab__icon" />
+                  <OLockBadge :label="item.lockedLabel" />
+                </span>
+              </template>
+            </OTab>
           </template>
         </template>
       </OTabs>
     </div>
-  </nav>
+  </FeatureLockExempt>
 </template>
 
 <script setup lang="ts">
@@ -123,12 +135,14 @@ import { computed } from "vue";
 import { useRouter, type RouteLocationRaw } from "vue-router";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OLockBadge from "@/lib/core/Badge/OLockBadge.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import type { SectionHubGroup } from "@/components/common/SectionHub.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 
 const router = useRouter();
 const { t } = useI18nTyped();
diff --git a/web/src/components/common/sidebar/InlineSelectFolderDropdown.vue b/web/src/components/common/sidebar/InlineSelectFolderDropdown.vue
index e46c541a58..df05235e38 100644
--- a/web/src/components/common/sidebar/InlineSelectFolderDropdown.vue
+++ b/web/src/components/common/sidebar/InlineSelectFolderDropdown.vue
@@ -117,6 +117,7 @@ import { useStore } from "vuex";
 import OButton from "@/lib/core/Button/OButton.vue";
 import AddFolder from "./AddFolder.vue";
 import { getFoldersListByType } from "@/utils/commons";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import { useFolderIcons } from "@/composables/useFolderIcons";
@@ -208,7 +209,10 @@ export default defineComponent({
     };
 
     onMounted(async () => {
-      await getFoldersListByType(store, props.type);
+      // The top bar already explains a license denial; anything else still surfaces.
+      await getFoldersListByType(store, props.type).catch((error) => {
+        if (!licenseDeniedFeatures(error)) throw error;
+      });
     });
 
     return {
diff --git a/web/src/components/dashboards/AlertContextMenu.spec.ts b/web/src/components/dashboards/AlertContextMenu.spec.ts
index 913d6f6136..4764f900fe 100644
--- a/web/src/components/dashboards/AlertContextMenu.spec.ts
+++ b/web/src/components/dashboards/AlertContextMenu.spec.ts
@@ -33,6 +33,31 @@ describe("AlertContextMenu Component", () => {
     vi.clearAllMocks();
   });
 
+  describe("locked", () => {
+    it("shows disabled, focusable items with a gold lock and the reason, and emits nothing", async () => {
+      wrapper = createWrapper({ locked: true, lockedReason: "Locked: needs Alerts" });
+      for (const id of ["above", "below"]) {
+        const item = wrapper.find(`[data-test="alert-context-menu-${id}"]`);
+        expect(item.attributes("aria-disabled")).toBe("true");
+        expect(item.attributes("tabindex")).toBe("0");
+        expect(wrapper.find(`[data-test="alert-context-menu-${id}-lock"]`).classes()).toContain(
+          "lock-chip",
+        );
+        expect(wrapper.find(`[data-test="alert-context-menu-${id}-reason"]`).text()).toBe(
+          "Locked: needs Alerts",
+        );
+        await item.trigger("click");
+      }
+      expect(wrapper.emitted("select")).toBeUndefined();
+    });
+
+    it("locks the single forecast item", () => {
+      wrapper = createWrapper({ locked: true, lockedReason: "x", seriesRole: "forecast" });
+      expect(wrapper.find('[data-test="alert-context-menu-forecast-lock"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="alert-context-menu-above"]').exists()).toBe(false);
+    });
+  });
+
   describe("Component Initialization", () => {
     it("should mount successfully", () => {
       wrapper = createWrapper();
diff --git a/web/src/components/dashboards/AlertContextMenu.vue b/web/src/components/dashboards/AlertContextMenu.vue
index bf0620fd79..9a2a284a40 100644
--- a/web/src/components/dashboards/AlertContextMenu.vue
+++ b/web/src/components/dashboards/AlertContextMenu.vue
@@ -24,39 +24,69 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       @click.stop
       data-test="alert-context-menu"
     >
-      <div
-        v-if="seriesRole === 'forecast'"
-        class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
-        @click="handleMenuItemClick('forecast')"
-        data-test="alert-context-menu-forecast"
-      >
-        <OIcon name="trending-up" size="sm" class="me-2" />
-        <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
-          t("dashboard.alertContextMenu.forecastReaches", { value: forecastText })
-        }}</span>
-      </div>
-      <div
-        v-if="seriesRole !== 'forecast'"
-        class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
-        @click="handleMenuItemClick('above')"
-        data-test="alert-context-menu-above"
-      >
-        <OIcon name="arrow-upward" size="sm" class="me-2" />
-        <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
-          t("dashboard.alertContextMenu.thresholdAbove", { value: valueText })
-        }}</span>
-      </div>
-      <div
-        v-if="seriesRole !== 'forecast'"
-        class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
-        @click="handleMenuItemClick('below')"
-        data-test="alert-context-menu-below"
-      >
-        <OIcon name="arrow-downward" size="sm" class="me-2" />
-        <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
-          t("dashboard.alertContextMenu.thresholdBelow", { value: valueText })
-        }}</span>
-      </div>
+      <template v-if="locked">
+        <div
+          v-for="item in lockedItems"
+          :key="item.condition"
+          class="text-dropdown-item-disabled focus-visible:ring-focus-ring-accent flex cursor-not-allowed items-center px-4 py-2 text-sm focus-visible:ring-2 focus-visible:ring-inset"
+          role="menuitem"
+          aria-disabled="true"
+          tabindex="0"
+          :data-test="`alert-context-menu-${item.condition}`"
+        >
+          <OIcon
+            name="lock"
+            size="sm"
+            class="lock-chip me-2"
+            :data-test="`alert-context-menu-${item.condition}-lock`"
+          />
+          <span class="flex min-w-0 flex-col">
+            <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
+              item.label
+            }}</span>
+            <span
+              class="text-text-secondary text-xs select-none"
+              :data-test="`alert-context-menu-${item.condition}-reason`"
+              >{{ lockedReason }}</span
+            >
+          </span>
+        </div>
+      </template>
+      <template v-else>
+        <div
+          v-if="seriesRole === 'forecast'"
+          class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
+          @click="handleMenuItemClick('forecast')"
+          data-test="alert-context-menu-forecast"
+        >
+          <OIcon name="trending-up" size="sm" class="me-2" />
+          <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
+            t("dashboard.alertContextMenu.forecastReaches", { value: forecastText })
+          }}</span>
+        </div>
+        <div
+          v-if="seriesRole !== 'forecast'"
+          class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
+          @click="handleMenuItemClick('above')"
+          data-test="alert-context-menu-above"
+        >
+          <OIcon name="arrow-upward" size="sm" class="me-2" />
+          <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
+            t("dashboard.alertContextMenu.thresholdAbove", { value: valueText })
+          }}</span>
+        </div>
+        <div
+          v-if="seriesRole !== 'forecast'"
+          class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm [transition:background-color_0.2s]"
+          @click="handleMenuItemClick('below')"
+          data-test="alert-context-menu-below"
+        >
+          <OIcon name="arrow-downward" size="sm" class="me-2" />
+          <span class="whitespace-nowrap select-none max-md:whitespace-normal">{{
+            t("dashboard.alertContextMenu.thresholdBelow", { value: valueText })
+          }}</span>
+        </div>
+      </template>
     </div>
   </teleport>
 </template>
@@ -101,6 +131,8 @@ export default defineComponent({
     },
     unit: { type: String, default: null },
     unitCustom: { type: String, default: null },
+    locked: { type: Boolean, default: false },
+    lockedReason: { type: String, default: "" },
   },
   emits: ["select", "close"],
   setup(props, { emit }) {
@@ -153,6 +185,26 @@ export default defineComponent({
       );
     });
 
+    const lockedItems = computed(() =>
+      props.seriesRole === "forecast"
+        ? [
+            {
+              condition: "forecast",
+              label: t("dashboard.alertContextMenu.forecastReaches", { value: forecastText.value }),
+            },
+          ]
+        : [
+            {
+              condition: "above",
+              label: t("dashboard.alertContextMenu.thresholdAbove", { value: valueText.value }),
+            },
+            {
+              condition: "below",
+              label: t("dashboard.alertContextMenu.thresholdBelow", { value: valueText.value }),
+            },
+          ],
+    );
+
     const handleMenuItemClick = (condition: "above" | "below" | "forecast") => {
       emit("select", {
         condition,
@@ -216,6 +268,7 @@ export default defineComponent({
       valueText,
       forecastText,
       menuStyle,
+      lockedItems,
       handleMenuItemClick,
     };
   },
diff --git a/web/src/components/dashboards/DashboardLogDrawer.spec.ts b/web/src/components/dashboards/DashboardLogDrawer.spec.ts
new file mode 100644
index 0000000000..4dced8bccc
--- /dev/null
+++ b/web/src/components/dashboards/DashboardLogDrawer.spec.ts
@@ -0,0 +1,92 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import { flushPromises, shallowMount } from "@vue/test-utils";
+import { ref } from "vue";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+
+const findRelatedTelemetry = vi.fn().mockResolvedValue(null);
+vi.mock("@/composables/useServiceCorrelation", () => ({
+  useServiceCorrelation: () => ({
+    findRelatedTelemetry,
+    semanticGroups: ref([]),
+    noMatch: ref(false),
+    error: ref(null),
+  }),
+}));
+vi.mock("@/services/search", () => ({
+  default: { search: vi.fn().mockResolvedValue({ data: { hits: [], total: 0 } }) },
+}));
+vi.mock("@/services/patterns", () => ({ default: {} }));
+vi.mock("vue-router", () => ({
+  useRoute: () => ({ query: {} }),
+  useRouter: () => ({ replace: vi.fn(), push: vi.fn() }),
+}));
+
+import DashboardLogDrawer from "@/components/dashboards/DashboardLogDrawer.vue";
+
+const mountDrawer = (features: Record<string, string>, streamType?: string) =>
+  shallowMount(DashboardLogDrawer, {
+    props: { stream: "app", field: "level", value: "error", startTime: 1, endTime: 2, streamType },
+    global: {
+      renderStubDefaultSlot: true,
+      stubs: { OButton: false },
+      plugins: [
+        i18n,
+        createStore({
+          state: { selectedOrganization: { identifier: "org" }, zoConfig: { features } },
+        }),
+      ],
+    },
+  });
+
+const openInLogsDisabled = (wrapper: ReturnType<typeof mountDrawer>) =>
+  wrapper.find('[data-test="log-explorer-open-in-logs"]').attributes("aria-disabled") === "true";
+
+describe("DashboardLogDrawer related telemetry", () => {
+  beforeEach(() => findRelatedTelemetry.mockClear());
+
+  it("makes no correlation call while correlation is license-locked", async () => {
+    const wrapper = mountDrawer({ correlation: "locked" });
+    await flushPromises();
+    await (wrapper.vm as any).$.setupState.openCorrelationFromLog({ _timestamp: 1 });
+    expect(findRelatedTelemetry).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    [undefined, "logs"],
+    ["metrics", "metrics"],
+    ["traces", "traces"],
+  ])("stream type %s with %s locked: Open in Logs is disabled with a lock", (streamType, key) => {
+    const wrapper = mountDrawer({ [key]: "locked" }, streamType);
+    expect(openInLogsDisabled(wrapper)).toBe(true);
+    expect(wrapper.find('[data-test="log-explorer-open-in-logs-lock"]').exists()).toBe(true);
+  });
+
+  it("Open in Logs stays live while another signal is locked", () => {
+    const wrapper = mountDrawer({ traces: "locked" });
+    expect(openInLogsDisabled(wrapper)).toBe(false);
+    expect(wrapper.find('[data-test="log-explorer-open-in-logs-lock"]').exists()).toBe(false);
+  });
+
+  it("looks up related telemetry while correlation is enabled", async () => {
+    const wrapper = mountDrawer({ correlation: "enabled" });
+    await flushPromises();
+    await (wrapper.vm as any).$.setupState.openCorrelationFromLog({ _timestamp: 1 });
+    expect(findRelatedTelemetry).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/web/src/components/dashboards/DashboardLogDrawer.vue b/web/src/components/dashboards/DashboardLogDrawer.vue
index d7e5ddbb3e..1f5d7a146f 100644
--- a/web/src/components/dashboards/DashboardLogDrawer.vue
+++ b/web/src/components/dashboards/DashboardLogDrawer.vue
@@ -29,6 +29,8 @@ import { b64EncodeUnicode } from "@/utils/formatters";
 import searchService from "@/services/search";
 import patternsService from "@/services/patterns";
 import { useServiceCorrelation } from "@/composables/useServiceCorrelation";
+import { useLicenseLock, useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import { buildChipDimensionsFromFilters } from "@/services/service_streams";
 import { buildWorkloadChipDimensions } from "@/composables/useMetricSubjectButtons";
 import { extractSeverity } from "@/utils/sourceEventSeverity";
@@ -474,6 +476,13 @@ const {
   noMatch: correlationNoMatch,
   error: serviceCorrelationError,
 } = useServiceCorrelation();
+const { locked: correlationLocked } = useLicenseLock("correlation");
+const licenseLocks = useLicenseLocks();
+const logsFeature = computed(() => streamTypeFeature(props.streamType));
+const openInLogsLocked = computed(() => licenseLocks.isLocked(logsFeature.value));
+const openInLogsLockedReason = computed(() =>
+  logsFeature.value ? licenseLocks.lockedReason(logsFeature.value) : raw(""),
+);
 
 // Fresh correlation per event (mirrors the Logs page reset on row change).
 watch(selectedEvent, () => {
@@ -485,7 +494,7 @@ watch(selectedEvent, () => {
 
 // Lazy correlation fetch — replicated from SearchResult.vue's openCorrelationFromLog.
 async function openCorrelationFromLog(logData: any) {
-  if (correlationFetchInProgress.value) return;
+  if (correlationFetchInProgress.value || correlationLocked.value) return;
   try {
     correlationFetchInProgress.value = true;
     correlationLoading.value = true;
@@ -793,7 +802,23 @@ function openInLogs() {
           >
             {{ t("panel.logExplorer.queryMode") }}
           </OButton>
+          <OTooltip v-if="openInLogsLocked" :content="openInLogsLockedReason">
+            <span class="inline-flex">
+              <OButton size="sm" variant="outline" disabled data-test="log-explorer-open-in-logs">
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    data-test="log-explorer-open-in-logs-lock"
+                  />
+                </template>
+                {{ t("panel.logExplorer.openInLogs") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
+            v-else
             size="sm"
             variant="outline"
             icon-left="open-in-new"
@@ -1141,7 +1166,28 @@ function openInLogs() {
                         >{{ p.template }}</OTruncatedText
                       >
                       <!-- Open in Logs -->
+                      <OTooltip v-if="openInLogsLocked" :content="openInLogsLockedReason">
+                        <span class="inline-flex shrink-0">
+                          <OButton
+                            :aria-label="t('panel.logExplorer.openInLogs')"
+                            size="sm"
+                            variant="ghost"
+                            disabled
+                            data-test="log-explorer-pattern-open"
+                          >
+                            <template #icon-left>
+                              <OIcon
+                                name="lock"
+                                class="text-icon-locked"
+                                size="sm"
+                                data-test="log-explorer-pattern-open-lock"
+                              />
+                            </template>
+                          </OButton>
+                        </span>
+                      </OTooltip>
                       <OButton
+                        v-else
                         :aria-label="t('panel.logExplorer.openInLogs')"
                         size="sm"
                         variant="ghost"
diff --git a/web/src/components/dashboards/PanelContainer.spec.ts b/web/src/components/dashboards/PanelContainer.spec.ts
index 4f41b401ad..26e690a6d7 100644
--- a/web/src/components/dashboards/PanelContainer.spec.ts
+++ b/web/src/components/dashboards/PanelContainer.spec.ts
@@ -1299,6 +1299,70 @@ describe("PanelContainer", () => {
       consoleErrorSpy.mockRestore();
     });
 
+    it.each([
+      ["logs", "logs"],
+      ["metrics", "metrics"],
+      ["traces", "traces"],
+    ])("go to logs locks while the panel's %s stream type is license-locked", (streamType, key) => {
+      (store.state as any).zoConfig.features = { [key]: "locked" };
+      const panel = {
+        ...mockPanelData,
+        queries: [
+          { ...mockPanelData.queries[0], fields: { stream: "s", stream_type: streamType } },
+        ],
+      };
+      wrapper = createWrapper({ data: panel });
+      expect(wrapper.vm.goToLogsLocked).toBe(true);
+      expect(wrapper.vm.goToLogsLockedReason).toBeTruthy();
+    });
+
+    it("go to logs shows as a disabled, focusable menu item with the reason as description", async () => {
+      (store.state as any).zoConfig.features = { logs: "locked" };
+      wrapper = createWrapper(
+        { data: mockPanelData },
+        {
+          ODropdown: {
+            name: "ODropdown",
+            template: '<div><slot name="trigger" /><slot /></div>',
+          },
+          ODropdownItem: {
+            name: "ODropdownItem",
+            props: {
+              disabled: Boolean,
+              focusableUnavailable: Boolean,
+              iconLeft: String,
+              description: String,
+            },
+            template: "<div><slot /></div>",
+          },
+        },
+      );
+      wrapper.vm.metaData = { queries: [{}] };
+      await flushPromises();
+      const item = wrapper
+        .findAllComponents({ name: "ODropdownItem" })
+        .find((c: any) => c.attributes("data-test") === "dashboard-move-to-logs-module");
+      expect(item?.props("disabled")).toBe(true);
+      expect(item?.props("focusableUnavailable")).toBe(true);
+      expect(item?.props("iconLeft")).toBe("lock");
+      expect(item?.props("description")).toBe(wrapper.vm.goToLogsLockedReason);
+    });
+
+    it("go to logs stays live while another signal is locked or the stream type is free", () => {
+      (store.state as any).zoConfig.features = { traces: "locked" };
+      wrapper = createWrapper({ data: mockPanelData });
+      expect(wrapper.vm.goToLogsLocked).toBe(false);
+      wrapper.unmount();
+      (store.state as any).zoConfig.features = { logs: "locked" };
+      wrapper = createWrapper({
+        data: {
+          ...mockPanelData,
+          queries: [{ ...mockPanelData.queries[0], fields: { stream_type: "enrichment_tables" } }],
+        },
+      });
+      expect(wrapper.vm.goToLogsLocked).toBe(false);
+    });
+
     it("should show go to logs option only for SQL queries", () => {
       const sqlPanel = { ...mockPanelData, queryType: "sql" };
       wrapper = createWrapper({ data: sqlPanel });
diff --git a/web/src/components/dashboards/PanelContainer.vue b/web/src/components/dashboards/PanelContainer.vue
index c4ff1b2186..e3d39abf26 100644
--- a/web/src/components/dashboards/PanelContainer.vue
+++ b/web/src/components/dashboards/PanelContainer.vue
@@ -481,7 +481,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               {{ t("panel.downloadAsJSON") }}
             </ODropdownItem>
             <ODropdownItem
-              v-if="!simplifiedPanelView && metaData && metaData.queries?.length > 0"
+              v-if="
+                !simplifiedPanelView && metaData && metaData.queries?.length > 0 && goToLogsLocked
+              "
+              disabled
+              focusable-unavailable
+              icon-left="lock"
+              :description="goToLogsLockedReason"
+              data-test="dashboard-move-to-logs-module"
+            >
+              {{ t("panel.goToLogs") }}
+            </ODropdownItem>
+            <ODropdownItem
+              v-else-if="!simplifiedPanelView && metaData && metaData.queries?.length > 0"
               :disabled="props.data.queryType != 'sql'"
               data-test="dashboard-move-to-logs-module"
               @select="onLogPanel"
@@ -752,6 +764,8 @@ import type { PanelNoticeActionId } from "@/utils/dashboard/panelNotices";
 import { usePanelNotices } from "@/composables/dashboard/usePanelNotices";
 import { ANNOTATION_SOURCE_ROW_LIMIT } from "@/utils/dashboard/annotationSources";
 import { hasPanelDraft } from "@/composables/dashboard/usePanelDraft";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 
 const QueryInspector = defineAsyncComponent(() => {
   return import("@/components/dashboards/QueryInspector.vue");
@@ -1181,6 +1195,15 @@ export default defineComponent({
       return logsUrl;
     };
 
+    const licenseLocks = useLicenseLocks();
+    const goToLogsFeature = computed(() =>
+      streamTypeFeature(props.data?.queries?.[0]?.fields?.stream_type),
+    );
+    const goToLogsLocked = computed(() => licenseLocks.isLocked(goToLogsFeature.value));
+    const goToLogsLockedReason = computed(() =>
+      goToLogsFeature.value ? licenseLocks.lockedReason(goToLogsFeature.value) : raw(""),
+    );
+
     const onLogPanel = async () => {
       const showNotification = showPositiveNotification(
         t("dashboard.panelContainer.redirectingToLogs"),
@@ -1548,6 +1571,8 @@ export default defineComponent({
 
     return {
       props,
+      goToLogsLocked,
+      goToLogsLockedReason,
       exemplarsEligible,
       exemplarOverride,
       exemplarsOn,
diff --git a/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts b/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
index 3603ef851d..7c4ab28777 100644
--- a/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
+++ b/web/src/components/dashboards/PanelEditor/PanelEditor.spec.ts
@@ -31,7 +31,8 @@ const mockStore = {
   getters: {},
 };
 
-vi.mock("vuex", () => ({
+vi.mock("vuex", async (importOriginal) => ({
+  ...((await importOriginal()) as object),
   useStore: () => mockStore,
 }));
 
@@ -582,6 +583,28 @@ describe("PanelEditor.vue", () => {
       expect(wrapper.emitted()).toBeDefined();
     });
 
+    const mountWithFeatures = (features: Record<string, string>) =>
+      shallowMount(PanelEditor, {
+        props: { pageType: "metrics", showAddToDashboardButton: true },
+        global: {
+          ...mountGlobal,
+          provide: {
+            store: { ...mockStore, state: { ...mockStore.state, zoConfig: { features } } },
+          },
+        },
+      });
+
+    it("blocks Add to dashboard with the license reason while dashboards is locked", () => {
+      wrapper = mountWithFeatures({ dashboards: "locked" });
+      expect(wrapper.vm.$.setupState.dashboardsLocked).toBe(true);
+      expect(wrapper.vm.$.setupState.dashboardsLockedReason).toContain("Locked");
+    });
+
+    it("leaves Add to dashboard unblocked while dashboards is enabled", () => {
+      wrapper = mountWithFeatures({ dashboards: "enabled" });
+      expect(wrapper.vm.$.setupState.dashboardsLocked).toBe(false);
+    });
+
     it("should emit customQueryModeChanged on mount (immediate watcher)", () => {
       wrapper = shallowMount(PanelEditor, {
         props: { pageType: "dashboard" },
diff --git a/web/src/components/dashboards/PanelEditor/PanelEditor.vue b/web/src/components/dashboards/PanelEditor/PanelEditor.vue
index 812db39c96..0c721e633c 100644
--- a/web/src/components/dashboards/PanelEditor/PanelEditor.vue
+++ b/web/src/components/dashboards/PanelEditor/PanelEditor.vue
@@ -121,8 +121,32 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     <QueryTypeSelector v-if="pageType === 'build'" :showQueryType="false" />
                     <div v-else />
                     <div class="ms-auto flex items-center gap-2">
+                      <!-- A disabled button fires no pointer events, so the span is the tooltip's hover target. -->
+                      <OTooltip
+                        v-if="resolvedConfig.showAddToDashboardButton && dashboardsLocked"
+                        :content="dashboardsLockedReason"
+                      >
+                        <span class="inline-flex">
+                          <OButton
+                            data-test="panel-editor-add-to-dashboard-btn"
+                            variant="primary"
+                            size="xs"
+                            disabled
+                          >
+                            <template #icon-left>
+                              <OIcon
+                                name="lock"
+                                class="lock-chip"
+                                size="sm"
+                                data-test="panel-editor-add-to-dashboard-lock"
+                              />
+                            </template>
+                            {{ t("search.addToDashboard") }}
+                          </OButton>
+                        </span>
+                      </OTooltip>
                       <OButton
-                        v-if="resolvedConfig.showAddToDashboardButton"
+                        v-else-if="resolvedConfig.showAddToDashboardButton"
                         data-test="panel-editor-add-to-dashboard-btn"
                         variant="primary"
                         size="xs"
@@ -811,6 +835,7 @@ import { resolveConfig } from "./types/panelEditor";
 import { withTimeRangeVariables } from "@/utils/dashboard/variables/variablesUtils";
 import { usePanelEditor } from "./composables/usePanelEditor";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import useDashboardPanelData from "@/composables/dashboard/useDashboardPanel";
 import { SERIES_OVERRIDE_CHART_TYPES } from "@/composables/dashboard/useConfigPanel";
 import { isCustomSqlPanel } from "@/utils/dashboard/chartTypeGroups";
@@ -905,6 +930,9 @@ const emit = defineEmits<PanelEditorEmits>();
 
 const { t } = useI18nTyped();
 
+const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+  useLicenseLock("dashboards");
+
 // Resolve configuration (merge props with presets)
 const resolvedConfig = computed<PanelEditorConfig>(() => resolveConfig(props));
 
diff --git a/web/src/components/dashboards/PanelSchemaRenderer.spec.ts b/web/src/components/dashboards/PanelSchemaRenderer.spec.ts
index 7142ad3899..502583980d 100644
--- a/web/src/components/dashboards/PanelSchemaRenderer.spec.ts
+++ b/web/src/components/dashboards/PanelSchemaRenderer.spec.ts
@@ -150,6 +150,15 @@ vi.mock("@/components/common/LoadingProgress.vue", () => ({
   },
 }));
 
+const exemplarLookup = vi.hoisted(() => vi.fn());
+vi.mock("@/composables/dashboard/useExemplarTraceLookup", () => ({
+  useExemplarTraceLookup: () => ({
+    peek: () => undefined,
+    lookup: exemplarLookup,
+    dispose: () => {},
+  }),
+}));
+
 // Mock console methods
 global.console = {
   ...console,
@@ -1468,6 +1477,105 @@ describe("PanelSchemaRenderer", () => {
       expect(wrapper.vm.contextMenuValue).toBe(75);
     });
 
+    it("opens the alert menu locked while alerts is license-locked", async () => {
+      const zoConfig = store.state.zoConfig as any;
+      const previous = zoConfig.features;
+      zoConfig.features = { alerts: "locked" };
+      try {
+        wrapper = createWrapper({ allowAlertCreation: true });
+        wrapper.vm.onChartDomContextMenu({ x: 150, y: 250, value: 75 });
+        await nextTick();
+        expect(wrapper.vm.contextMenuVisible).toBe(true);
+        expect(wrapper.vm.alertsLocked).toBe(true);
+        expect(wrapper.vm.alertsLockedReason).toContain("Locked: needs");
+      } finally {
+        zoConfig.features = previous;
+      }
+    });
+
+    it.each([
+      ["logs", "logs"],
+      ["metrics", "metrics"],
+      ["traces", "traces"],
+    ])(
+      "a logs drilldown on a %s panel is locked with a lock while %s is license-locked",
+      async (streamType, key) => {
+        const zoConfig = store.state.zoConfig as any;
+        const previous = zoConfig.features;
+        zoConfig.features = { [key]: "locked" };
+        try {
+          const drilldown = [
+            { name: "ToLogs", type: "logs", data: { logsMode: "auto" } },
+            { name: "ToUrl", type: "byUrl", data: { url: "https://example.com" } },
+          ];
+          wrapper = createWrapper({
+            panelSchema: {
+              ...defaultProps.panelSchema,
+              queries: [
+                { ...defaultProps.panelSchema.queries[0], fields: { stream_type: streamType } },
+              ],
+              config: { drilldown },
+            },
+          });
+          wrapper.vm.drilldownArray = drilldown;
+          await nextTick();
+          expect(wrapper.find('[data-test="drilldown-menu-item-ToLogs-lock"]').exists()).toBe(true);
+          expect(wrapper.find('[data-test="drilldown-menu-item-ToUrl-lock"]').exists()).toBe(false);
+        } finally {
+          zoConfig.features = previous;
+        }
+      },
+    );
+
+    it("a logs drilldown stays live while another signal is locked", async () => {
+      const zoConfig = store.state.zoConfig as any;
+      const previous = zoConfig.features;
+      zoConfig.features = { traces: "locked" };
+      try {
+        const drilldown = [{ name: "ToLogs", type: "logs", data: { logsMode: "auto" } }];
+        wrapper = createWrapper({
+          panelSchema: { ...defaultProps.panelSchema, config: { drilldown } },
+        });
+        wrapper.vm.drilldownArray = drilldown;
+        await nextTick();
+        expect(wrapper.find('[data-test="drilldown-menu-item-ToLogs"]').exists()).toBe(true);
+        expect(wrapper.find('[data-test="drilldown-menu-item-ToLogs-lock"]').exists()).toBe(false);
+      } finally {
+        zoConfig.features = previous;
+      }
+    });
+
+    it.each([
+      ["locked", 0],
+      ["enabled", 1],
+    ] as const)("following an exemplar with traces %s navigates %i times", async (state, calls) => {
+      const zoConfig = store.state.zoConfig as any;
+      const previous = zoConfig.features;
+      zoConfig.features = { traces: state };
+      try {
+        const router = createRouter({
+          history: createMemoryHistory(),
+          routes: [
+            { path: "/", component: { template: "<div />" } },
+            { path: "/trace", name: "traceDetails", component: { template: "<div />" } },
+          ],
+        });
+        await router.push("/");
+        const push = vi.spyOn(router, "push");
+        exemplarLookup.mockResolvedValue({
+          state: "found",
+          stream: "default",
+          startUs: 1,
+          endUs: 2,
+        });
+        wrapper = createWrapper({}, { plugins: [router] });
+        await wrapper.vm.exemplarInteraction.follow({ id: "m1", traceId: "abc", tsMs: 1 });
+        expect(push).toHaveBeenCalledTimes(calls);
+      } finally {
+        zoConfig.features = previous;
+      }
+    });
+
     it("hides the chart tooltip when the alert menu opens, from a series or from empty chart area", () => {
       wrapper = createWrapper({ allowAlertCreation: true });
       const dispatchAction = vi.fn();
diff --git a/web/src/components/dashboards/PanelSchemaRenderer.vue b/web/src/components/dashboards/PanelSchemaRenderer.vue
index 91098a8719..c7353822c6 100644
--- a/web/src/components/dashboards/PanelSchemaRenderer.vue
+++ b/web/src/components/dashboards/PanelSchemaRenderer.vue
@@ -159,6 +159,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :verdict="exemplarVerdict"
           :anchor="exemplarCardAnchor"
           :clamped="exemplarActiveClamp"
+          :locked-reason="tracesLocked ? tracesLockedReason : undefined"
           @enter="exemplarInteraction.onCardEnter"
           @leave="exemplarInteraction.onCardLeave"
           @open-trace="exemplarInteraction.openTrace"
@@ -267,6 +268,29 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             "
           />
           <div
+            v-if="drilldownLockedReason(drilldown)"
+            class="text-dropdown-item-disabled flex cursor-not-allowed items-center px-4 py-2 text-sm"
+            aria-disabled="true"
+            tabindex="0"
+            :data-test="`drilldown-menu-item-${drilldown.name}`"
+          >
+            <OIcon
+              size="xs"
+              class="text-icon-locked me-2"
+              name="lock"
+              :data-test="`drilldown-menu-item-${drilldown.name}-lock`"
+            />
+            <span class="flex min-w-0 flex-col">
+              <span class="select-none">{{ drilldown.name }}</span>
+              <span
+                class="text-text-secondary text-xs select-none"
+                :data-test="`drilldown-menu-item-${drilldown.name}-reason`"
+                >{{ drilldownLockedReason(drilldown) }}</span
+              >
+            </span>
+          </div>
+          <div
+            v-else
             class="text-dropdown-item-text hover:bg-dropdown-item-hover-bg active:bg-dropdown-item-active-bg flex cursor-pointer items-center px-4 py-2 text-sm transition-colors duration-200"
             :data-test="`drilldown-menu-item-${drilldown.name}`"
             @click="openDrilldown(index)"
@@ -303,6 +327,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :series-role="contextMenuData?.seriesRole"
         :unit="panelSchema?.config?.unit"
         :unit-custom="panelSchema?.config?.unit_custom"
+        :locked="alertsLocked"
+        :locked-reason="alertsLockedReason"
         @select="handleCreateAlert"
         @close="hideContextMenu"
       />
@@ -350,6 +376,7 @@ import {
 } from "vue";
 import { useStore } from "vuex";
 import { useTheme } from "@/composables/useTheme";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { chartColor } from "@/utils/chartTheme";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { usePanelTitle } from "@/composables/dashboard/usePanelTitle";
@@ -1116,7 +1143,9 @@ export default defineComponent({
       if (!Number.isFinite(start) || !Number.isFinite(end)) return [NaN, NaN];
       return [toExemplarChartX(start), toExemplarChartX(end)];
     });
+    const { locked: tracesLocked, lockedReason: tracesLockedReason } = useLicenseLock("traces");
     const navigateToExemplarTrace = (marker: ExemplarMarker, verdict: TraceVerdict) => {
+      if (tracesLocked.value) return;
       const target = buildExemplarTraceRoute(
         marker,
         verdict,
@@ -1328,6 +1357,7 @@ export default defineComponent({
 
     // Context menu state for alert creation (shared with usePanelAlertCreation)
     const contextMenuData = ref<any>(null);
+    const { locked: alertsLocked, lockedReason: alertsLockedReason } = useLicenseLock("alerts");
 
     const {
       contextMenuVisible,
@@ -2298,6 +2328,7 @@ export default defineComponent({
       drilldownArray,
       onChartClick,
       openDrilldown,
+      drilldownLockedReason,
       hidePopupsAndOverlays,
       drilldownColumnAliases,
       drilldownAllColumns,
@@ -2655,6 +2686,11 @@ export default defineComponent({
       drilldownArray,
       selectedAnnotationData,
       openDrilldown,
+      alertsLocked,
+      alertsLockedReason,
+      drilldownLockedReason,
+      tracesLocked,
+      tracesLockedReason,
       drilldownPopUpRef,
       annotationPopupRef,
       hidePopupsAndOverlays,
diff --git a/web/src/components/dashboards/SelectFolderDropdown.spec.ts b/web/src/components/dashboards/SelectFolderDropdown.spec.ts
index 3717026c9b..a5eb995f49 100644
--- a/web/src/components/dashboards/SelectFolderDropdown.spec.ts
+++ b/web/src/components/dashboards/SelectFolderDropdown.spec.ts
@@ -16,6 +16,7 @@
 import { describe, it, expect, beforeEach, vi } from "vitest";
 import { mount } from "@vue/test-utils";
 import SelectFolderDropdown from "./SelectFolderDropdown.vue";
+import OSelect from "@/lib/forms/Select/OSelect.vue";
 import i18n from "@/locales";
 import { createStore } from "vuex";
 import { createRouter, createWebHistory } from "vue-router";
@@ -341,6 +342,26 @@ describe("SelectFolderDropdown", () => {
     });
   });
 
+  describe("disabled prop", () => {
+    it("locks the folder select and the new-folder button when disabled", () => {
+      const wrapper = createWrapper({ disabled: true }, store, router);
+
+      expect(wrapper.findComponent(OSelect).props("disabled")).toBe(true);
+      expect(
+        wrapper.find('[data-test="dashboard-folder-move-new-add"]').attributes("disabled"),
+      ).toBeDefined();
+    });
+
+    it("leaves both controls enabled by default", () => {
+      const wrapper = createWrapper({}, store, router);
+
+      expect(wrapper.findComponent(OSelect).props("disabled")).toBe(false);
+      expect(
+        wrapper.find('[data-test="dashboard-folder-move-new-add"]').attributes("disabled"),
+      ).toBeUndefined();
+    });
+  });
+
   describe("Reactive folder list", () => {
     it("should refresh selectedFolder when the store folders list changes and current id no longer exists", async () => {
       const wrapper = createWrapper({ activeFolderId: "folder1" }, store, router);
diff --git a/web/src/components/dashboards/SelectFolderDropdown.vue b/web/src/components/dashboards/SelectFolderDropdown.vue
index 3bd442a7a0..99059a241a 100644
--- a/web/src/components/dashboards/SelectFolderDropdown.vue
+++ b/web/src/components/dashboards/SelectFolderDropdown.vue
@@ -24,6 +24,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :options="folderOptions"
       data-test="index-dropdown-stream_type"
       labelKey="label"
+      :disabled="disabled"
       class="flex-1"
     >
       <template v-if="selectedFolder" #icon-left>
@@ -37,6 +38,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       variant="outline"
       size="icon-xs-sq"
       class="h-8! w-8!"
+      :disabled="disabled"
       @mousedown.prevent
       @click="
         () => {
@@ -90,6 +92,10 @@ export default defineComponent({
       type: String as PropType<"inside" | "outside">,
       default: "outside",
     },
+    disabled: {
+      type: Boolean,
+      default: false,
+    },
   },
   setup(props, { emit }) {
     const store: any = useStore();
diff --git a/web/src/components/dashboards/exemplars/ExemplarCard.spec.ts b/web/src/components/dashboards/exemplars/ExemplarCard.spec.ts
index ef5e1b0470..dfeff9cd67 100644
--- a/web/src/components/dashboards/exemplars/ExemplarCard.spec.ts
+++ b/web/src/components/dashboards/exemplars/ExemplarCard.spec.ts
@@ -16,6 +16,7 @@
 import { describe, expect, it } from "vitest";
 import { mount } from "@vue/test-utils";
 import i18n from "@/locales";
+import { raw } from "@/types/i18n";
 import ExemplarCard from "./ExemplarCard.vue";
 import type { ExemplarMarker, TraceVerdict } from "@/ts/interfaces/exemplars";
 
@@ -173,6 +174,39 @@ describe("ExemplarCard", () => {
     expect(wrapper.emitted("open-trace")).toHaveLength(1);
   });
 
+  it.each([
+    { state: "found", stream: "default", startUs: 1, endUs: 2 },
+    { state: "unverified", reason: "timeout" },
+  ] as TraceVerdict[])(
+    "traces locked ($state): Open trace is disabled with a lock and emits nothing",
+    async (verdict) => {
+      const wrapper = mountCard({ verdict, lockedReason: raw("Locked: needs Traces") });
+      const locked = byTest(wrapper, "dashboard-panel-exemplar-open-trace-locked");
+      expect(locked.attributes("disabled")).toBeDefined();
+      expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace-lock").exists()).toBe(true);
+      expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace").exists()).toBe(false);
+      expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace-unverified").exists()).toBe(
+        false,
+      );
+      await locked.trigger("click");
+      expect(wrapper.emitted("open-trace")).toBeUndefined();
+    },
+  );
+
+  it("traces locked: shows the locked action, never Checking trace", () => {
+    const wrapper = mountCard({ lockedReason: raw("Locked: needs Traces") });
+    expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace-locked").exists()).toBe(true);
+    expect(byTest(wrapper, "dashboard-panel-exemplar-trace-checking").exists()).toBe(false);
+  });
+
+  it("traces enabled: no locked Open trace", () => {
+    const wrapper = mountCard({
+      verdict: { state: "found", stream: "default", startUs: 1, endUs: 2 },
+    });
+    expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace-locked").exists()).toBe(false);
+    expect(byTest(wrapper, "dashboard-panel-exemplar-open-trace").exists()).toBe(true);
+  });
+
   it("shows a not-available trace as a muted line that wraps inside the card", () => {
     const wrapper = mountCard({ verdict: { state: "not_available" } });
     const line = byTest(wrapper, "dashboard-panel-exemplar-trace-unavailable");
diff --git a/web/src/components/dashboards/exemplars/ExemplarCard.vue b/web/src/components/dashboards/exemplars/ExemplarCard.vue
index 0c21390abe..6477e087ba 100644
--- a/web/src/components/dashboards/exemplars/ExemplarCard.vue
+++ b/web/src/components/dashboards/exemplars/ExemplarCard.vue
@@ -16,7 +16,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script setup lang="ts">
 import { computed } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { formatUnitValue, getUnitValue } from "@/utils/dashboard/convertDataIntoUnitValue";
 import { formatTimestampInTimezone } from "@/utils/date";
 import OButton from "@/lib/core/Button/OButton.vue";
@@ -48,8 +49,11 @@ const props = withDefaults(
     verdict: TraceVerdict;
     anchor?: DOMRect | null;
     clamped?: "top" | "bottom" | false;
+    /** Set while the traces license is locked: Open trace shows locked and does nothing. */
+    lockedReason?: I18nText;
   }>(),
   {
+    lockedReason: undefined,
     unit: undefined,
     unitCustom: undefined,
     decimals: undefined,
@@ -197,8 +201,28 @@ const position = computed(() => {
           <span class="min-w-0">{{ t("dashboard.exemplars.traceNotAvailable") }}</span>
         </div>
         <div v-else class="flex min-w-0 flex-wrap items-center gap-2">
+          <OTooltip v-if="lockedReason" :content="lockedReason">
+            <span class="inline-flex">
+              <OButton
+                variant="outline"
+                size="sm"
+                disabled
+                data-test="dashboard-panel-exemplar-open-trace-locked"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    data-test="dashboard-panel-exemplar-open-trace-lock"
+                  />
+                </template>
+                {{ t("dashboard.exemplars.openTrace") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
-            v-if="verdict.state === 'checking'"
+            v-else-if="verdict.state === 'checking'"
             variant="outline"
             size="sm"
             disabled
@@ -237,7 +261,7 @@ const position = computed(() => {
         >
           {{ marker.traceId }}
         </div>
-        <div v-if="verdict.state === 'found'" class="text-text-secondary text-2xs">
+        <div v-if="verdict.state === 'found' && !lockedReason" class="text-text-secondary text-2xs">
           {{ t("dashboard.exemplars.openTraceHint") }}
         </div>
         <div
diff --git a/web/src/components/dbm/DbmMetricPanel.spec.ts b/web/src/components/dbm/DbmMetricPanel.spec.ts
new file mode 100644
index 0000000000..01566b170a
--- /dev/null
+++ b/web/src/components/dbm/DbmMetricPanel.spec.ts
@@ -0,0 +1,67 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { mount } from "@vue/test-utils";
+import { describe, expect, it, vi } from "vitest";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import { raw } from "@/types/i18n";
+
+import DbmMetricPanel from "./DbmMetricPanel.vue";
+
+vi.mock("@/components/dashboards/PanelSchemaRenderer.vue", () => ({
+  default: { name: "PanelSchemaRenderer", template: "<div />" },
+}));
+
+const EXPLORE = "http://localhost/web/metrics?org_identifier=org1";
+
+const mountPanel = (features: Record<string, string>) =>
+  mount(DbmMetricPanel, {
+    props: {
+      panelKey: "load-cpu",
+      title: raw("CPU"),
+      schema: { queries: [] },
+      startTime: 0,
+      endTime: 1,
+      exploreUrl: EXPLORE,
+    },
+    global: {
+      plugins: [i18n, createStore({ state: { zoConfig: { features } } })],
+      stubs: { PanelSchemaRenderer: true, OSkeleton: true },
+    },
+  });
+
+describe("DbmMetricPanel explore link", () => {
+  it("is a disabled lock with no href when the metrics license is locked", () => {
+    const wrapper = mountPanel({ metrics: "locked" });
+    const explore = wrapper.find('[data-test="dbm-metric-panel-explore-load-cpu"]');
+    expect(explore.element.tagName).toBe("SPAN");
+    expect(explore.attributes("aria-disabled")).toBe("true");
+    expect(explore.attributes("href")).toBeUndefined();
+    expect(wrapper.find('[data-test="dbm-metric-panel-explore-lock-load-cpu"]').exists()).toBe(
+      true,
+    );
+  });
+
+  it("links into the Metrics explorer when the license enables metrics", () => {
+    const wrapper = mountPanel({ metrics: "enabled" });
+    const explore = wrapper.find('[data-test="dbm-metric-panel-explore-load-cpu"]');
+    expect(explore.element.tagName).toBe("A");
+    expect(explore.attributes("href")).toBe(EXPLORE);
+    expect(wrapper.find('[data-test="dbm-metric-panel-explore-lock-load-cpu"]').exists()).toBe(
+      false,
+    );
+  });
+});
diff --git a/web/src/components/dbm/DbmMetricPanel.vue b/web/src/components/dbm/DbmMetricPanel.vue
index 3695bb2167..8d6f53b27c 100644
--- a/web/src/components/dbm/DbmMetricPanel.vue
+++ b/web/src/components/dbm/DbmMetricPanel.vue
@@ -53,8 +53,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :data-test="`dbm-metric-panel-by-${panelKey}`"
         @update:model-value="emit('update:by', $event as string)"
       />
+      <OTooltip
+        v-if="exploreUrl && metricsLock.locked.value"
+        side="bottom"
+        :content="metricsLock.lockedReason.value"
+      >
+        <span
+          class="ms-auto inline-flex shrink-0"
+          role="link"
+          aria-disabled="true"
+          :aria-label="t('dbm.metrics.explore')"
+          :data-test="`dbm-metric-panel-explore-${panelKey}`"
+        >
+          <OIcon
+            name="lock"
+            size="xs"
+            class="text-icon-locked"
+            :data-test="`dbm-metric-panel-explore-lock-${panelKey}`"
+          />
+        </span>
+      </OTooltip>
       <a
-        v-if="exploreUrl"
+        v-else-if="exploreUrl"
         :href="exploreUrl"
         target="_blank"
         rel="noopener"
@@ -121,6 +141,7 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { panelErrorIsForbidden, panelErrorIsStreamMissing } from "@/utils/dbm/metricsPanels";
 
 // Async: the dashboards engine is heavy and must not ride the DBM shell's
@@ -162,6 +183,7 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const metricsLock = useLicenseLock("metrics");
 
 const helpText = computed<I18nText | null>(() => (props.help ? raw(props.help) : null));
 
diff --git a/web/src/components/dbm/DbmRowActions.spec.ts b/web/src/components/dbm/DbmRowActions.spec.ts
new file mode 100644
index 0000000000..64f0ece234
--- /dev/null
+++ b/web/src/components/dbm/DbmRowActions.spec.ts
@@ -0,0 +1,54 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import { raw } from "@/types/i18n";
+import DbmRowActions from "./DbmRowActions.vue";
+
+const mountActions = () =>
+  mount(DbmRowActions, {
+    props: {
+      dataTest: "t",
+      actions: [
+        { id: "copy", icon: "content-copy", label: raw("Copy") },
+        {
+          id: "ai",
+          icon: "brain-circuit",
+          label: raw("Suggest fix"),
+          lockedReason: raw("Locked: needs AI assistant"),
+        },
+      ],
+    },
+    global: { plugins: [i18n] },
+  });
+
+describe("DbmRowActions", () => {
+  it("emits an unlocked action on click", async () => {
+    const wrapper = mountActions();
+    await wrapper.find('[data-test="t-copy"]').trigger("click");
+    expect(wrapper.emitted("action")?.[0]).toEqual(["copy"]);
+  });
+
+  it("renders a license-locked action as a disabled button that emits nothing", async () => {
+    const wrapper = mountActions();
+    const locked = wrapper.find('[data-test="t-ai"]');
+    expect(locked.attributes("disabled")).toBeDefined();
+    expect(locked.attributes("aria-label")).toBe("Suggest fix");
+    await locked.trigger("click");
+    expect(wrapper.emitted("action")).toBeUndefined();
+  });
+});
diff --git a/web/src/components/dbm/DbmRowActions.vue b/web/src/components/dbm/DbmRowActions.vue
index bce6ee4a33..98cac4bbf8 100644
--- a/web/src/components/dbm/DbmRowActions.vue
+++ b/web/src/components/dbm/DbmRowActions.vue
@@ -29,19 +29,32 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 <template>
   <div class="flex items-center justify-end gap-0.5" :data-test="dataTest">
-    <OButton
-      v-for="action in actions"
-      :key="action.id"
-      variant="ghost"
-      size="icon-xs-sq"
-      :icon-left="action.icon"
-      class="max-md:hidden"
-      :data-test="`${dataTest}-${action.id}`"
-      @click.stop="emit('action', action.id)"
-    >
-      <!-- Icon-only actions carry no label, so the tooltip names them; `left` opens it into the row, not over the row above. -->
-      <OTooltip side="left" :content="action.label" />
-    </OButton>
+    <template v-for="action in actions" :key="action.id">
+      <OTooltip v-if="action.lockedReason" side="left" :content="action.lockedReason">
+        <span class="inline-flex max-md:hidden">
+          <OButton
+            variant="ghost"
+            size="icon-xs-sq"
+            icon-left="lock"
+            disabled
+            :aria-label="action.label"
+            :data-test="`${dataTest}-${action.id}`"
+          />
+        </span>
+      </OTooltip>
+      <OButton
+        v-else
+        variant="ghost"
+        size="icon-xs-sq"
+        :icon-left="action.icon"
+        class="max-md:hidden"
+        :data-test="`${dataTest}-${action.id}`"
+        @click.stop="emit('action', action.id)"
+      >
+        <!-- Icon-only actions carry no label, so the tooltip names them; `left` opens it into the row, not over the row above. -->
+        <OTooltip side="left" :content="action.label" />
+      </OButton>
+    </template>
     <ODropdown side="bottom" align="end">
       <template #trigger>
         <OButton
@@ -57,7 +70,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <ODropdownItem
         v-for="action in actions"
         :key="action.id"
-        :icon-left="action.icon"
+        :icon-left="action.lockedReason ? 'lock' : action.icon"
+        :disabled="!!action.lockedReason"
+        :focusable-unavailable="!!action.lockedReason"
+        :description="action.lockedReason"
         class="md:hidden"
         :data-test="`${dataTest}-${action.id}-menu`"
         @select="emit('action', action.id)"
@@ -83,6 +99,8 @@ export interface DbmRowAction {
   id: string;
   icon: IconName;
   label: I18nText;
+  /** License-lock reason; the action then renders disabled with a lock. */
+  lockedReason?: I18nText;
 }
 
 const props = withDefaults(
diff --git a/web/src/components/dbm/DbmSectionTabs.spec.ts b/web/src/components/dbm/DbmSectionTabs.spec.ts
index 8e654e772d..3f4e982b4e 100644
--- a/web/src/components/dbm/DbmSectionTabs.spec.ts
+++ b/web/src/components/dbm/DbmSectionTabs.spec.ts
@@ -16,7 +16,12 @@
 import { mount } from "@vue/test-utils";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+import { defineComponent, h, ref } from "vue";
+
 import i18n from "@/locales";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
+import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 
 import { DBM_ORIGIN_QUERY_KEY } from "@/utils/dbm/queryDetailOrigin";
 
@@ -541,4 +546,44 @@ describe("DbmSectionTabs", () => {
       expect(push).not.toHaveBeenCalled();
     });
   });
+
+  describe("on a license-locked page", () => {
+    const mountLocked = (child: () => ReturnType<typeof h>) => {
+      currentRoute = { name: "dbmDatabases", query: {} };
+      const LockedPage = defineComponent({
+        setup() {
+          provideFeatureLock(ref("db_monitoring"));
+          return child;
+        },
+      });
+      return mount(LockedPage, { global: { plugins: [i18n] } });
+    };
+    const disabledTabs = (wrapper: ReturnType<typeof mount>) =>
+      wrapper
+        .findAll('[role="tab"]')
+        .filter((tab) => tab.attributes("aria-disabled") === "true")
+        .map((tab) => tab.attributes("data-test"));
+
+    it("disables a plain tab strip, which is why the section tabs opt out", () => {
+      const wrapper = mountLocked(() =>
+        h(OTabs, { modelValue: "a" }, () => [h(OTab, { name: "a", "data-test": "plain-a" })]),
+      );
+      expect(disabledTabs(wrapper)).toEqual(["plain-a"]);
+    });
+
+    it("keeps every section tab live so the reader can still move between sections", () => {
+      const wrapper = mountLocked(() => h(DbmSectionTabs, { databaseCount: 2, queryCount: 34 }));
+      expect(disabledTabs(wrapper)).toEqual([]);
+    });
+
+    it("keeps the edition gate on its own tabs", () => {
+      mockConfig.isEnterprise = "false";
+      const wrapper = mountLocked(() => h(DbmSectionTabs, { databaseCount: 2, queryCount: 34 }));
+      expect(disabledTabs(wrapper)).toEqual([
+        "dbm-section-tab-deadlocks",
+        "dbm-section-tab-blocked",
+        "dbm-section-tab-tableHealth",
+      ]);
+    });
+  });
 });
diff --git a/web/src/components/dbm/DbmSectionTabs.vue b/web/src/components/dbm/DbmSectionTabs.vue
index 354349626d..a3c1843414 100644
--- a/web/src/components/dbm/DbmSectionTabs.vue
+++ b/web/src/components/dbm/DbmSectionTabs.vue
@@ -41,27 +41,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   so drilling into a query does not unlight the tab it was opened from.
 -->
 <template>
-  <OTabs :model-value="activeTab" align="left" data-test="dbm-section-tabs" @change="navigate">
-    <OTab
-      v-for="section in sections"
-      :key="section.key"
-      :name="section.key"
-      :disable="section.disabled"
-      :data-test="`dbm-section-tab-${section.key}`"
-    >
-      <span>{{ section.label }}</span>
-      <!-- The lock is what makes a disabled tab READ as gated rather than
+  <!-- Section navigation stays live on a license-locked page; edition-gated tabs keep their own `disable`. -->
+  <FeatureLockExempt class="contents">
+    <OTabs :model-value="activeTab" align="left" data-test="dbm-section-tabs" @change="navigate">
+      <OTab
+        v-for="section in sections"
+        :key="section.key"
+        :name="section.key"
+        :disable="section.disabled"
+        :data-test="`dbm-section-tab-${section.key}`"
+      >
+        <span>{{ section.label }}</span>
+        <!-- The lock is what makes a disabled tab READ as gated rather than
            broken: dimmed text alone says "unavailable", not "available on
            another plan". It is decorative for AT — the tooltip carries the
            sentence, and TabsTrigger already exposes aria-disabled. -->
-      <OIcon
-        v-if="section.disabled"
-        name="lock"
-        size="xs"
-        aria-hidden="true"
-        :data-test="`dbm-section-tab-lock-${section.key}`"
-      />
-      <!-- The count is what the tab is about, so the reader can see the shape
+        <OIcon
+          v-if="section.disabled"
+          name="lock"
+          class="lock-chip"
+          size="xs"
+          aria-hidden="true"
+          :data-test="`dbm-section-tab-lock-${section.key}`"
+        />
+        <!-- The count is what the tab is about, so the reader can see the shape
            of the other views without opening them.
 
            An OVERLAP count (calls) carries its vantage as a suffix on the
@@ -71,26 +74,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
            absent for the counts that exist in one vantage only: qualifying a
            deadlock count would imply a choice between feeds that was never
            available. -->
-      <span
-        v-if="section.count != null"
-        class="text-2xs inline-flex items-baseline gap-1 rounded-full px-1.5 py-1 leading-none font-bold"
-        :class="
-          section.key === activeTab
-            ? 'bg-badge-primary-soft-bg text-badge-primary-soft-text'
-            : 'bg-surface-subtle text-text-secondary'
-        "
-        :data-test="`dbm-section-tab-badge-${section.key}`"
-        ><span>{{ section.count }}</span
-        ><span
-          v-if="section.vantageLabel"
-          class="text-3xs font-normal opacity-80"
-          :data-test="`dbm-section-tab-vantage-${section.key}`"
-          >{{ section.vantageLabel }}</span
-        ></span
-      >
-      <OTooltip v-if="section.hint" side="bottom" :content="section.hint" />
-    </OTab>
-  </OTabs>
+        <span
+          v-if="section.count != null"
+          class="text-2xs inline-flex items-baseline gap-1 rounded-full px-1.5 py-1 leading-none font-bold"
+          :class="
+            section.key === activeTab
+              ? 'bg-badge-primary-soft-bg text-badge-primary-soft-text'
+              : 'bg-surface-subtle text-text-secondary'
+          "
+          :data-test="`dbm-section-tab-badge-${section.key}`"
+          ><span>{{ section.count }}</span
+          ><span
+            v-if="section.vantageLabel"
+            class="text-3xs font-normal opacity-80"
+            :data-test="`dbm-section-tab-vantage-${section.key}`"
+            >{{ section.vantageLabel }}</span
+          ></span
+        >
+        <OTooltip v-if="section.hint" side="bottom" :content="section.hint" />
+      </OTab>
+    </OTabs>
+  </FeatureLockExempt>
 </template>
 
 <script setup lang="ts">
@@ -102,6 +106,7 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import { useI18nTyped, type I18nText } from "@/types/i18n";
 import { badgeCount, countVantage, type DbmCountClaim } from "@/utils/dbm/format";
 import {
diff --git a/web/src/components/dbm/DbmSuggestFixButton.vue b/web/src/components/dbm/DbmSuggestFixButton.vue
index d3b6ae537c..01387371dd 100644
--- a/web/src/components/dbm/DbmSuggestFixButton.vue
+++ b/web/src/components/dbm/DbmSuggestFixButton.vue
@@ -28,8 +28,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   QueryErrorState, so every AI entry point in the app reads as the same control.
 -->
 <template>
+  <OTooltip v-if="aiLock.locked.value" :content="aiLock.lockedReason.value">
+    <span class="inline-flex shrink-0">
+      <OButton
+        variant="ghost"
+        :size="size"
+        disabled
+        icon-left="lock"
+        :data-test="`${dataTest}-locked`"
+      >
+        {{ label }}
+      </OButton>
+    </span>
+  </OTooltip>
   <OButton
-    v-if="aiEnabled"
+    v-else-if="aiEnabled"
     variant="ghost"
     :size="size"
     class="group text-ai-accent! hover:shadow-glow-md hover:shadow-ai-accent/35 dark:shadow-glow-md dark:shadow-ai-accent/20 dark:hover:shadow-glow-md dark:hover:shadow-ai-accent/35 shrink-0 [background:var(--color-gradient-ai-subtle)]! [transition:background_0.3s_ease,box-shadow_0.3s_ease,color_0.3s_ease] hover:text-white! hover:[background:var(--color-gradient-ai)]! dark:text-white!"
@@ -57,6 +70,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import type { ButtonSize } from "@/lib/core/Button/OButton.types";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useAiIcon } from "@/composables/useAiIcon";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { I18nText } from "@/types/i18n";
 
 withDefaults(
@@ -74,6 +88,7 @@ const emit = defineEmits<{ (e: "click"): void }>();
 
 const store = useStore();
 const { aiIconSrc } = useAiIcon();
+const aiLock = useLicenseLock("ai_assistant");
 
 const aiEnabled = computed(
   () => config.isEnterprise == "true" && Boolean(store.state.zoConfig?.ai_enabled),
diff --git a/web/src/components/fleet/FleetCollectorDrawer.spec.ts b/web/src/components/fleet/FleetCollectorDrawer.spec.ts
index 33e1221865..adcc19dce8 100644
--- a/web/src/components/fleet/FleetCollectorDrawer.spec.ts
+++ b/web/src/components/fleet/FleetCollectorDrawer.spec.ts
@@ -319,6 +319,15 @@ describe("FleetCollectorDrawer", () => {
     expect(wrapper.find(sel("restart")).attributes("disabled")).toBeDefined();
   });
 
+  it("disables restart for an offline collector", async () => {
+    vi.mocked(fleet.getCollector).mockResolvedValue({
+      data: detail({ status: "offline" }),
+    } as any);
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find(sel("restart")).attributes("disabled")).toBeDefined();
+  });
+
   it("removes after the remove dialog confirms an online host, and closes", async () => {
     vi.mocked(fleet.deleteCollector).mockResolvedValue({ status: 204 } as any);
     wrapper = mountDrawer();
diff --git a/web/src/components/fleet/FleetCollectorDrawer.vue b/web/src/components/fleet/FleetCollectorDrawer.vue
index cf72a3fd77..24be138d0d 100644
--- a/web/src/components/fleet/FleetCollectorDrawer.vue
+++ b/web/src/components/fleet/FleetCollectorDrawer.vue
@@ -57,7 +57,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               variant="outline"
               size="sm"
               icon-left="restart-alt"
-              :disabled="!canRestart"
+              :disabled="!!restartBlocked"
               :loading="actions.restarting.value"
               data-test="fleet-collector-drawer-restart"
               @click="actions.restart([collector])"
@@ -65,7 +65,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               {{ t("fleet.collectors.restart") }}
             </OButton>
             <!-- A disabled button gets no pointer events, so the reason hangs on its wrapper. -->
-            <OTooltip v-if="!canRestart" :content="t('fleet.collectors.restartUnsupported')" />
+            <OTooltip v-if="restartBlocked" :content="restartBlocked" />
           </span>
           <OButton
             v-if="collector.config"
@@ -447,11 +447,13 @@ const forbidden = computed(() => isForbidden(error.value));
 const refetch = () => query.refetch();
 const tokens = useFleetTokens(() => props.open);
 
-const canRestart = computed(
-  () =>
-    !collector.value?.capabilities.length ||
-    collector.value.capabilities.includes("AcceptsRestartCommand"),
-);
+const restartBlocked = computed<I18nText | null>(() => {
+  if (collector.value?.status === "offline") return t("fleet.collectors.restartOffline");
+  const capabilities = collector.value?.capabilities;
+  return !capabilities?.length || capabilities.includes("AcceptsRestartCommand")
+    ? null
+    : t("fleet.collectors.restartUnsupported");
+});
 
 const tokenName = computed<I18nText | null>(() => {
   const id = collector.value?.tokenId;
diff --git a/web/src/components/fleet/FleetCollectors.spec.ts b/web/src/components/fleet/FleetCollectors.spec.ts
index a68e56ffb7..b800d9d860 100644
--- a/web/src/components/fleet/FleetCollectors.spec.ts
+++ b/web/src/components/fleet/FleetCollectors.spec.ts
@@ -595,6 +595,9 @@ describe("FleetCollectors", () => {
 
     it("restarts the selection after a confirm, once per collector", async () => {
       vi.mocked(fleet.restartCollector).mockResolvedValue({ data: { queued: true } } as any);
+      vi.mocked(fleet.listCollectors).mockResolvedValue({
+        data: { total: 2, items: [collector({ id: "c1" }), collector({ id: "c2" })] },
+      } as any);
       wrapper = await mountList();
       (wrapper.vm as any).selectedIds = ["c1", "c2"];
       await settle();
@@ -603,6 +606,48 @@ describe("FleetCollectors", () => {
       expect(fleet.restartCollector).toHaveBeenCalledTimes(2);
     });
 
+    it("restarts only the online part of a selection", async () => {
+      vi.mocked(fleet.restartCollector).mockResolvedValue({ data: { queued: true } } as any);
+      vi.mocked(fleet.listCollectors).mockResolvedValue({
+        data: {
+          total: 2,
+          items: [
+            collector({ id: "on", status: "online" }),
+            collector({ id: "off", status: "offline" }),
+          ],
+        },
+      } as any);
+      wrapper = await mountList();
+      (wrapper.vm as any).selectedIds = ["on", "off"];
+      await settle();
+      await wrapper.find('[data-test="fleet-collectors-bulk-restart"]').trigger("click");
+      await settle();
+      expect(fleet.restartCollector).toHaveBeenCalledTimes(1);
+      expect(fleet.restartCollector).toHaveBeenCalledWith(
+        store.state.selectedOrganization.identifier,
+        "on",
+      );
+    });
+
+    it("offers no restart when the whole selection is offline", async () => {
+      vi.mocked(fleet.listCollectors).mockResolvedValue({
+        data: { total: 1, items: [collector({ id: "off", status: "offline" })] },
+      } as any);
+      wrapper = await mountList();
+      (wrapper.vm as any).selectedIds = ["off"];
+      await settle();
+      expect(wrapper.find('[data-test="fleet-collectors-bulk-restart"]').exists()).toBe(false);
+    });
+
+    it("disables a row's restart while the collector is offline", async () => {
+      vi.mocked(fleet.listCollectors).mockResolvedValue({
+        data: { total: 1, items: [collector({ id: "off", status: "offline" })] },
+      } as any);
+      wrapper = await mountList("/", menu);
+      const item = wrapper.find('[data-test="fleet-collectors-row-restart-off"]');
+      expect(item.attributes("disabled")).toBeDefined();
+    });
+
     it("redelivers a row without asking", async () => {
       vi.mocked(fleet.listCollectors).mockResolvedValue({
         data: { total: 1, items: [collector({ config: "edge", config_version: 2 })] },
diff --git a/web/src/components/fleet/FleetCollectors.vue b/web/src/components/fleet/FleetCollectors.vue
index 0d29706f69..6199f72f78 100644
--- a/web/src/components/fleet/FleetCollectors.vue
+++ b/web/src/components/fleet/FleetCollectors.vue
@@ -241,6 +241,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           </template>
           <ODropdownItem
             icon-left="restart-alt"
+            :disabled="row.status === 'offline'"
+            :description="row.status === 'offline' ? t('fleet.collectors.restartOffline') : null"
             :data-test="`fleet-collectors-row-restart-${row.id}`"
             @select="actions.restart([row])"
           >
@@ -274,12 +276,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
       <template #selection-actions>
         <OButton
+          v-if="restartableRows.length"
           variant="outline"
           size="sm"
           icon-left="restart-alt"
           :loading="actions.restarting.value"
           data-test="fleet-collectors-bulk-restart"
-          @click="actions.restart(selectedRows)"
+          @click="actions.restart(restartableRows)"
         >
           {{ t("fleet.collectors.restart") }}
         </OButton>
@@ -678,6 +681,7 @@ const selectedRows = computed(() => {
   const ids = new Set(selectedIds.value);
   return tableRows.value.filter((c) => ids.has(c.id));
 });
+const restartableRows = computed(() => selectedRows.value.filter((c) => c.status !== "offline"));
 
 function openRename(row: CollectorRow) {
   renameTarget.value = row;
diff --git a/web/src/components/fleet/FleetNewRolloutDialog.spec.ts b/web/src/components/fleet/FleetNewRolloutDialog.spec.ts
index 527579032f..c3b6d0e65d 100644
--- a/web/src/components/fleet/FleetNewRolloutDialog.spec.ts
+++ b/web/src/components/fleet/FleetNewRolloutDialog.spec.ts
@@ -237,6 +237,21 @@ describe("FleetNewRolloutDialog", () => {
     );
   });
 
+  it("shows a phase timeout of 90 s without rounding it up", async () => {
+    vi.mocked(fleet.getSettings).mockResolvedValue({
+      data: {
+        restricted_components: [],
+        target_collector_version: null,
+        fleet_defaults: { ...NO_OVERRIDES, phase_timeout_secs: 90 },
+      },
+    } as any);
+    wrapper = mountDialog({ fleetId: "default", config: "edge", toVersion: 2 });
+    await settlePreview();
+    expect(wrapper.find('[data-test="fleet-new-rollout-dialog-timeout"]').text()).toContain(
+      "1 min 30 s",
+    );
+  });
+
   it("sends start, batching, verify and auto-rollback as the contract body", async () => {
     wrapper = mountDialog({ fleetId: "default", config: "edge", toVersion: 2 });
     await settlePreview();
diff --git a/web/src/components/fleet/FleetNewRolloutDialog.vue b/web/src/components/fleet/FleetNewRolloutDialog.vue
index 374932f041..0b24d56674 100644
--- a/web/src/components/fleet/FleetNewRolloutDialog.vue
+++ b/web/src/components/fleet/FleetNewRolloutDialog.vue
@@ -159,7 +159,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             >{{ t("fleet.rollouts.collapsed") }}</OText
           >
           <OText variant="meta" data-test="fleet-new-rollout-dialog-timeout">{{
-            t("fleet.rollouts.phaseTimeoutNote", { minutes: phaseTimeoutMin })
+            phaseTimeoutNote
           }}</OText>
         </div>
       </div>
@@ -288,12 +288,16 @@ const fleetOptions = computed(() =>
 );
 const fleetRow = computed(() => readableFleets.value.find((f) => f.id === chosenFleet.value));
 
-const phaseTimeoutMin = computed(() => {
+const phaseTimeoutNote = computed(() => {
   const secs =
     fleetRow.value?.settings.phase_timeout_secs ??
     orgSettings.settings.value?.fleet_defaults?.phase_timeout_secs ??
     DEFAULT_PHASE_TIMEOUT_SECS;
-  return Math.round(secs / 60);
+  const minutes = Math.floor(secs / 60);
+  const seconds = secs % 60;
+  return seconds
+    ? t("fleet.rollouts.phaseTimeoutNoteSeconds", { minutes, seconds })
+    : t("fleet.rollouts.phaseTimeoutNote", { minutes });
 });
 
 const published = computed(() => configs.rows.value.filter((c) => c.version > 0));
diff --git a/web/src/components/fleet/FleetRollouts.spec.ts b/web/src/components/fleet/FleetRollouts.spec.ts
index 272adaba33..a826f88b7e 100644
--- a/web/src/components/fleet/FleetRollouts.spec.ts
+++ b/web/src/components/fleet/FleetRollouts.spec.ts
@@ -241,6 +241,15 @@ describe("FleetRollouts", () => {
     expect(fleet.rollbackRollout).toHaveBeenCalledWith(org(), "r3");
   });
 
+  it("says a fleet with no stable version stops collecting when it rolls back", async () => {
+    vi.mocked(fleet.rollbackRollout).mockResolvedValue({ data: halted } as any);
+    vi.mocked(fleet.listFleets).mockResolvedValue({ data: { total: 0, items: [] } } as any);
+    wrapper = await mountDrawer("r3");
+    await wrapper.find('[data-test="fleet-rollout-outcome-rollback"]').trigger("click");
+    await settle();
+    expect(confirmMock.mock.calls[0][0].message).toContain("no stable version");
+  });
+
   it("skips exactly the failing members after a confirmation", async () => {
     vi.mocked(fleet.skipRollout).mockResolvedValue({ data: halted } as any);
     wrapper = await mountDrawer("r3");
diff --git a/web/src/components/fleet/FleetTokenForm.schema.ts b/web/src/components/fleet/FleetTokenForm.schema.ts
index 8e7d1c1534..82098daede 100644
--- a/web/src/components/fleet/FleetTokenForm.schema.ts
+++ b/web/src/components/fleet/FleetTokenForm.schema.ts
@@ -31,4 +31,4 @@ export const makeTokenSchema = (t: TranslateFn) =>
 
 export type TokenForm = z.infer<ReturnType<typeof makeTokenSchema>>;
 
-export const tokenDefaults = (): TokenForm => ({ name: "", expiry: "never", maxUses: "100" });
+export const tokenDefaults = (): TokenForm => ({ name: "", expiry: "never", maxUses: "" });
diff --git a/web/src/components/fleet/FleetTokens.spec.ts b/web/src/components/fleet/FleetTokens.spec.ts
index c94f79f585..dfe802ef39 100644
--- a/web/src/components/fleet/FleetTokens.spec.ts
+++ b/web/src/components/fleet/FleetTokens.spec.ts
@@ -409,7 +409,7 @@ describe("FleetTokens", () => {
     expect(fleet.listTokens).toHaveBeenCalledTimes(2);
   });
 
-  it("defaults to a token that never expires", async () => {
+  it("defaults to a token that never expires and has no use limit", async () => {
     vi.mocked(fleet.createToken).mockResolvedValue({
       data: { ...token({ id: "t7" }), token: "o2ft_y" },
     } as any);
@@ -418,7 +418,7 @@ describe("FleetTokens", () => {
     expect(fleet.createToken).toHaveBeenCalledWith(expect.any(String), {
       name: "n",
       expires_in_days: null,
-      max_uses: 100,
+      max_uses: null,
       fleet: "f1",
     });
   });
diff --git a/web/src/components/flow/NodePalette.vue b/web/src/components/flow/NodePalette.vue
index 92878386a4..739d57104e 100644
--- a/web/src/components/flow/NodePalette.vue
+++ b/web/src/components/flow/NodePalette.vue
@@ -139,7 +139,7 @@ export default {
               >
                 {{ node.label }}
               </div>
-              <OIcon v-if="node.locked" name="lock" size="sm" class="text-warning-600 shrink-0" />
+              <OIcon v-if="node.locked" name="lock" size="sm" class="lock-chip shrink-0" />
               <div v-else class="drag-dots grid h-2 w-2 grid-cols-2 gap-0.5">
                 <span class="dot h-0.5 w-0.5 rounded-full transition-all"></span>
                 <span class="dot h-0.5 w-0.5 rounded-full transition-all"></span>
diff --git a/web/src/components/functions/FunctionList.vue b/web/src/components/functions/FunctionList.vue
index f35a32ed17..9e0f1753d8 100644
--- a/web/src/components/functions/FunctionList.vue
+++ b/web/src/components/functions/FunctionList.vue
@@ -304,11 +304,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <li
             v-for="(pipeline, index) in transformedPipelineList"
             :key="pipeline.value"
-            @click="onPipelineSelect(pipeline)"
-            class="hover:bg-muted/50 flex cursor-pointer items-center px-3 py-2"
+            :class="
+              pipelinesLocked
+                ? 'flex items-center gap-1.5 px-3 py-2'
+                : 'hover:bg-muted/50 flex cursor-pointer items-center px-3 py-2'
+            "
             :data-test="`function-list-pipeline-item-${pipeline.value}`"
+            @click="!pipelinesLocked && onPipelineSelect(pipeline)"
           >
             <span class="text-sm">{{ index + 1 }}. {{ pipeline.label }}</span>
+            <OTooltip v-if="pipelinesLocked" :content="pipelinesLockedReason">
+              <span
+                class="inline-flex"
+                :data-test="`function-list-pipeline-lock-${pipeline.value}`"
+              >
+                <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
+              </span>
+            </OTooltip>
           </li>
         </ul>
       </div>
@@ -339,6 +351,8 @@ import { useReo } from "@/services/reodotdev_analytics";
 import searchState from "@/composables/useLogs/searchState";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
@@ -350,6 +364,7 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import { downloadFile } from "@/utils/dom";
+import { forbiddenState } from "@/utils/featureGate";
 import { useMutation, useQuery } from "@tanstack/vue-query";
 import {
   bulkDeleteFunctionsMutation,
@@ -360,6 +375,7 @@ import { useOrgId } from "@/composables/query/useOrgId";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
 import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 export default defineComponent({
   name: "functionList",
@@ -372,6 +388,8 @@ export default defineComponent({
     ConfirmDialog,
     OButton,
     OBadge,
+    OIcon,
+    OTooltip,
     ODialog,
     ODropdown,
     ODropdownItem,
@@ -389,6 +407,8 @@ export default defineComponent({
     const store = useStore();
     const { t } = useI18nTyped();
     const router = useRouter();
+    const { locked: pipelinesLocked, lockedReason: pipelinesLockedReason } =
+      useLicenseLock("pipelines");
     const formData: any = ref({});
     const showAddJSTransformDialog: any = ref(false);
     const selectedDelete: any = ref(null);
@@ -483,7 +503,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = functions.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     const fetching = functions.isFetching;
     // Epoch ms of the last successful read — drives the button's "1m ago" label.
@@ -1013,6 +1033,8 @@ export default defineComponent({
       selectedPipeline,
       closeDialog,
       onPipelineSelect,
+      pipelinesLocked,
+      pipelinesLockedReason,
       transformedPipelineList,
       getAssociatedPipelines,
       filterQuery,
diff --git a/web/src/components/functions/FunctionsToolbar.vue b/web/src/components/functions/FunctionsToolbar.vue
index ba8ccf49af..6916f0b4bc 100644
--- a/web/src/components/functions/FunctionsToolbar.vue
+++ b/web/src/components/functions/FunctionsToolbar.vue
@@ -115,7 +115,7 @@
                   <OIcon
                     name="lock"
                     size="sm"
-                    class="text-warning-600"
+                    class="lock-chip"
                     data-test="function-transform-type-js-lock"
                   />
                 </template>
diff --git a/web/src/components/iam/IngestionTokens.vue b/web/src/components/iam/IngestionTokens.vue
index d8efc47079..0351210b1c 100644
--- a/web/src/components/iam/IngestionTokens.vue
+++ b/web/src/components/iam/IngestionTokens.vue
@@ -312,6 +312,7 @@ import { copyToClipboard } from "@/utils/clipboard";
 import { getBasicAuth } from "@/utils/auth";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 
@@ -374,7 +375,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = tokensList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     const filterQuery = ref("");
     const showCreateForm = ref(false);
diff --git a/web/src/components/iam/groups/AppGroups.vue b/web/src/components/iam/groups/AppGroups.vue
index 215cd044d9..0902fd2a7d 100644
--- a/web/src/components/iam/groups/AppGroups.vue
+++ b/web/src/components/iam/groups/AppGroups.vue
@@ -257,6 +257,7 @@ import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 
 const showAddGroup = ref(false);
@@ -492,7 +493,7 @@ const lastUpdatedAt = groupsList.dataUpdatedAt;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = groupsList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 // `force` for every reload that follows a write or an explicit refresh —
 // an "added" event means the server has something new to show.
diff --git a/web/src/components/iam/groups/EditGroup.spec.ts b/web/src/components/iam/groups/EditGroup.spec.ts
index 546cf41dbb..cf066904b7 100644
--- a/web/src/components/iam/groups/EditGroup.spec.ts
+++ b/web/src/components/iam/groups/EditGroup.spec.ts
@@ -271,6 +271,27 @@ describe("EditGroup Component", () => {
       consoleSpy.mockRestore();
     });
 
+    it("stays on the page for a license denial and leaves the list redirect to other failures", async () => {
+      const { getGroup } = await import("@/services/iam");
+      const consoleSpy = vi.spyOn(console, "log").mockImplementation(() => {});
+      const pushSpy = vi.spyOn(router, "push").mockResolvedValue(undefined as any);
+
+      vi.mocked(getGroup).mockRejectedValueOnce({
+        response: { status: 403, data: { code: 40001, error_detail: "rbac" } },
+      });
+      await wrapper.vm.getGroupDetails();
+      await flushPromises();
+      expect(pushSpy).not.toHaveBeenCalled();
+
+      vi.mocked(getGroup).mockRejectedValueOnce(new Error("Network error"));
+      await wrapper.vm.getGroupDetails();
+      await flushPromises();
+      expect(pushSpy).toHaveBeenCalledWith(expect.objectContaining({ name: "groups" }));
+
+      pushSpy.mockRestore();
+      consoleSpy.mockRestore();
+    });
+
     it("stores group details in groupsState", async () => {
       const { getGroup } = await import("@/services/iam");
       const mockGroupData = {
diff --git a/web/src/components/iam/groups/EditGroup.vue b/web/src/components/iam/groups/EditGroup.vue
index 7d30947670..cb138e22ed 100644
--- a/web/src/components/iam/groups/EditGroup.vue
+++ b/web/src/components/iam/groups/EditGroup.vue
@@ -110,6 +110,7 @@ import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import { confirmForcedSignOutDiscard, draftSignOutForced } from "@/utils/drafts/draftSession";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 
 onBeforeMount(() => {
   getGroupDetails();
@@ -222,6 +223,8 @@ const getGroupDetails = () => {
     })
     .catch((err) => {
       console.log(err);
+      // The page stays and renders locked; the license bar explains the denial.
+      if (licenseDeniedFeatures(err)) return;
       toast({
         message: err?.message || t("iam.editGroup.groupNotFound"),
         variant: "error",
diff --git a/web/src/components/iam/quota/Quota.spec.js b/web/src/components/iam/quota/Quota.spec.js
new file mode 100644
index 0000000000..18d8453342
--- /dev/null
+++ b/web/src/components/iam/quota/Quota.spec.js
@@ -0,0 +1,144 @@
+import { describe, it, expect, vi } from "vitest";
+import { mount, flushPromises } from "@vue/test-utils";
+import i18n from "@/locales";
+
+// Stub route guard and utils before router/component are imported
+vi.mock("@/utils/zincutils", async (importOriginal) => {
+  const actual = await importOriginal();
+  return {
+    ...actual,
+    // minimal overrides used in Quota.vue and router guards
+    getImageURL: vi.fn(() => "#"),
+    getUUID: vi.fn(() => "uuid-1"),
+    routeGuard: vi.fn((_to, _from, next) => next()),
+  };
+});
+
+// Basic DOM/URL mocks similar to reference style
+// @ts-expect-error - Partial URL mock for testing
+global.URL = global.URL || {};
+// @ts-expect-error - Attach functions if missing
+if (typeof global.URL.createObjectURL !== "function") {
+  // @ts-expect-error
+  global.URL.createObjectURL = vi.fn(() => "blob://test");
+}
+// @ts-expect-error
+if (typeof global.URL.revokeObjectURL !== "function") {
+  // @ts-expect-error
+  global.URL.revokeObjectURL = vi.fn();
+}
+
+import router from "@/test/unit/helpers/router";
+import store from "@/test/unit/helpers/store";
+
+// Avoid waiting for router.isReady() in tests
+// @ts-ignore
+router.isReady = () => Promise.resolve();
+import Quota from "@/components/iam/quota/Quota.vue";
+
+// Mocks
+vi.mock("@/services/organizations", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      os_list: vi.fn(async () => ({
+        data: {
+          data: [
+            { name: "Org A", identifier: "org_a" },
+            { name: "Org B", identifier: "org_b" },
+          ],
+        },
+      })),
+    },
+  });
+});
+vi.mock("@/services/iam", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    getRoles: vi.fn(async () => ({ data: ["admin", "member"] })),
+  });
+});
+
+// Mock toast — Quota.vue notifies via toast(), not a legacy notify plugin
+const mockToast = vi.hoisted(() => vi.fn(() => vi.fn())); // toast returns a dismiss fn
+vi.mock("@/lib/feedback/Toast/useToast", () => ({
+  toast: mockToast,
+}));
+vi.mock("@/services/rate_limit", () => ({
+  default: {
+    update_batch: vi.fn(async () => ({ status: 200, data: { message: "Saved" } })),
+    download_template: vi.fn(async () => ({ status: 200, data: { some: "json" } })),
+    upload_template: vi.fn(async () => ({ status: 200, data: { message: "Uploaded" } })),
+  },
+}));
+vi.mock("@/composables/useRateLimiter", () => {
+  const getApiLimitsByOrganization = vi.fn(async () => [
+    { module_name: "module_1", list: 10, get: 20, create: 30, update: 40, delete: 50 },
+    { module_name: "module_2", list: 10, get: "-", create: "-", update: 5, delete: 1 },
+  ]);
+  const getRoleLimitsByOrganization = vi.fn(async () => [
+    { module_name: "module_1", list: 11, get: 21, create: 31, update: 41, delete: 51 },
+  ]);
+  const getModulesToDisplay = vi.fn(async () => [
+    { label: "module_1", value: "module_1" },
+    { label: "module_2", value: "module_2" },
+  ]);
+  return {
+    default: () => ({
+      getApiLimitsByOrganization,
+      getRoleLimitsByOrganization,
+      getModulesToDisplay,
+    }),
+  };
+});
+
+const iamSvc = await import("@/services/iam");
+
+const mountQuota = async (routeQuery = {}) => {
+  // ensure required store shape
+  store.state.modulesToDisplay = store.state.modulesToDisplay || {};
+  store.state.allApiLimitsByOrgId = store.state.allApiLimitsByOrgId || {};
+  store.state.allRoleLimitsByOrgIdByRole = store.state.allRoleLimitsByOrgIdByRole || {};
+  store.state.organizations = store.state.organizations || [];
+  store.state.theme = store.state.theme || "light";
+
+  await router.push({ name: "quota", query: routeQuery });
+  await router.isReady();
+  await flushPromises();
+
+  return mount(Quota, {
+    global: {
+      plugins: [i18n, router, store],
+      stubs: {
+        QueryEditor: { template: '<div data-test="query-editor-stub" />' },
+        ConfirmDialog: {
+          props: ["modelValue", "title", "message"],
+          template: '<div class="confirm-dialog-stub" />',
+        },
+        NoOrganizationSelected: { template: '<div data-test="no-org-selected" />' },
+        NoData: { template: '<div data-test="no-data" />' },
+        AppTabs: { template: '<div data-test="app-tabs-stub" />' },
+        Pagination: { template: '<div data-test="pagination-stub" />' },
+      },
+    },
+  });
+};
+
+describe("Quota role limits tab under a locked rbac license", () => {
+  it("keeps the tab, shows the denied state and skips the roles fetch", async () => {
+    const saved = store.state.zoConfig;
+    store.state.zoConfig = { ...saved, features: { rbac: "locked" } };
+    const wrapper = await mountQuota();
+    const tab = wrapper.vm.tabs.find((t) => t.value === "role-limits");
+    expect(tab).toBeDefined();
+    expect(tab.tooltipLabel).toContain("Locked");
+
+    iamSvc.getRoles.mockClear();
+    await wrapper.vm.updateActiveTab("role-limits");
+    await flushPromises();
+    expect(iamSvc.getRoles).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-test="quota-role-limits-license-denied"]').exists()).toBe(true);
+    wrapper.unmount();
+    store.state.zoConfig = saved;
+  });
+});
diff --git a/web/src/components/iam/quota/Quota.vue b/web/src/components/iam/quota/Quota.vue
index f3be861143..84ccce801a 100644
--- a/web/src/components/iam/quota/Quota.vue
+++ b/web/src/components/iam/quota/Quota.vue
@@ -59,7 +59,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 data-test="edit-table-btn"
                 variant="outline"
                 size="sm"
-                :disabled="activeTab == 'role-limits' && !expandedRow"
+                :disabled="activeTab == 'role-limits' && (rolesDenied || !expandedRow)"
                 @click="editTableWithInput"
               >
                 {{ t("iam.quotaPage.editQuota") }}
@@ -73,7 +73,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             class="mb-2 flex w-full items-center justify-between max-md:flex-wrap max-md:gap-y-1.5"
           >
             <div
-              v-if="selectedOrganization && activeType == 'table'"
+              v-if="selectedOrganization && activeType == 'table' && !rolesDenied"
               class="flex items-center max-md:min-w-0 max-md:flex-wrap max-md:gap-y-1.5"
             >
               <OSearchInput
@@ -102,7 +102,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               />
             </div>
             <div
-              v-if="selectedOrganization"
+              v-if="selectedOrganization && !rolesDenied"
               class="float-right ms-auto flex items-center max-md:flex-wrap max-md:justify-end max-md:gap-y-1.5"
             >
               <div class="app-tabs-container me-3 h-9 w-fit">
@@ -212,9 +212,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :read-only="!editTable"
         />
       </div>
+      <LicenseDeniedState
+        v-if="rolesDenied"
+        :features="['rbac']"
+        data-test="quota-role-limits-license-denied"
+      />
       <!-- this table for role limits -->
       <div
-        v-if="activeTab == 'role-limits' && activeType == 'table'"
+        v-if="activeTab == 'role-limits' && activeType == 'table' && !rolesDenied"
         class="bg-card-glass-bg min-h-0 flex-1 overflow-hidden"
       >
         <OTable
@@ -310,7 +315,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </div>
       <div
         class="bg-card-glass-bg min-h-0 flex-1"
-        v-if="activeTab == 'role-limits' && activeType == 'json'"
+        v-if="activeTab == 'role-limits' && activeType == 'json' && !rolesDenied"
       >
         <QueryEditor
           data-test="json-view-roles-editor"
@@ -415,6 +420,7 @@ import {
   ref,
   watch,
   defineAsyncComponent,
+  h,
 } from "vue";
 import NoOrganizationSelected from "@/components/shared/grid/NoOrganizationSelected.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
@@ -438,10 +444,16 @@ import useRateLimiter from "@/composables/useRateLimiter";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { featureState } from "@/utils/featureGate";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+const LockedTabIcon = () => h(OIcon, { name: "lock", size: "sm", class: "text-icon-locked" });
+
 export default defineComponent({
   name: "Quota",
   components: {
     NoOrganizationSelected,
+    LicenseDeniedState,
     OButton,
     OSelect,
     OSearchInput,
@@ -475,17 +487,27 @@ export default defineComponent({
     const activeType = ref<any>("table");
     const activeTimeUnit = ref<string>("second");
 
-    const tabs = ref<any[]>([
+    const { lockedReason } = useLicenseLocks();
+    const rbacState = computed(() => featureState(store.state.zoConfig?.features, "rbac"));
+    const rbacLocked = computed(() => rbacState.value === "locked");
+
+    const tabs = computed(() => [
       {
         label: t("iam.quotaPage.apiLimits"),
         value: "api-limits",
         icon: "speed",
       },
-      {
-        label: t("iam.quotaPage.roleLimits"),
-        value: "role-limits",
-        icon: "shield",
-      },
+      // Role limits list custom roles, an API the rbac license gates.
+      ...(rbacState.value === "hidden"
+        ? []
+        : [
+            {
+              label: t("iam.quotaPage.roleLimits"),
+              value: "role-limits",
+              icon: rbacLocked.value ? LockedTabIcon : "shield",
+              tooltipLabel: rbacLocked.value ? lockedReason("rbac") : undefined,
+            },
+          ]),
     ]);
 
     const timeUnitTabs = ref<any[]>([
@@ -678,6 +700,7 @@ export default defineComponent({
       ];
     });
     const activeTab = ref<string>("api-limits");
+    const rolesDenied = computed(() => activeTab.value === "role-limits" && rbacLocked.value);
     const searchQuery = ref<string>("");
     const apiLimitsRows = ref<any[]>([]);
     const editTable = ref<boolean>(false);
@@ -910,6 +933,7 @@ export default defineComponent({
       editTable.value = true;
     };
     const getRolesByOrganization = async () => {
+      if (rbacLocked.value) return;
       //here we are getting the roles from the api
       //as we are not storing the roles in the store
       //so we need to get the roles from the api
@@ -1506,6 +1530,7 @@ export default defineComponent({
       activeTab,
       updateActiveTab,
       tabs,
+      rolesDenied,
       typeTabs,
       editTable,
       searchQuery,
diff --git a/web/src/components/iam/roles/AppRoles.vue b/web/src/components/iam/roles/AppRoles.vue
index dafcd4ab9e..fe89c2d064 100644
--- a/web/src/components/iam/roles/AppRoles.vue
+++ b/web/src/components/iam/roles/AppRoles.vue
@@ -139,6 +139,7 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 
 const { t } = useI18nTyped();
@@ -327,7 +328,7 @@ const lastUpdatedAt = rolesList.dataUpdatedAt;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = rolesList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 
 // `GET /roles` returns role NAMES only, so a role row has nothing to show beyond
diff --git a/web/src/components/iam/roles/EditRole.spec.js b/web/src/components/iam/roles/EditRole.spec.js
index 17d31cb3f9..96ea29ccc6 100644
--- a/web/src/components/iam/roles/EditRole.spec.js
+++ b/web/src/components/iam/roles/EditRole.spec.js
@@ -2925,6 +2925,21 @@ describe("EditRole savedGrants - getRoleDetails orchestration", () => {
     );
     push.mockRestore();
   });
+
+  it("stays on the page, without a toast, for a license denial", async () => {
+    ctl.resourcesError = Object.assign(new Error("denied"), {
+      response: { status: 403, data: { code: 40001, error_detail: "rbac" } },
+    });
+    const push = vi.spyOn(router, "push");
+    const wrapper = await mountEditRole();
+    await flushPromises();
+
+    expect(push).not.toHaveBeenCalled();
+    expect(mockToast).not.toHaveBeenCalled();
+    expect(wrapper.vm.isFetchingInitialRoles).toBe(false);
+    expect(wrapper.vm.licenseDenied).toEqual(["rbac"]);
+    push.mockRestore();
+  });
 });
 
 describe("EditRole savedGrants - savePermissionHash / seedSaved", () => {
diff --git a/web/src/components/iam/roles/EditRole.vue b/web/src/components/iam/roles/EditRole.vue
index 20e82d20ff..5ead1fdaf6 100644
--- a/web/src/components/iam/roles/EditRole.vue
+++ b/web/src/components/iam/roles/EditRole.vue
@@ -139,6 +139,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :module-label="moduleLabel"
                   :entity-label="entityLabel"
                   :summary-actions="summaryActions"
+                  :license-denied="licenseDenied"
                   @open="(moduleKey) => (activeModule = moduleKey)"
                   @preset="(presetId) => applyPreset(presetId, { announce: true })"
                   @load-streams="loadPresetStreams()"
@@ -166,6 +167,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         language="json"
                         ref="permissionJsonEditorRef"
                         v-model:query="permissionsJsonValue"
+                        :read-only="pageLocked"
                         style="height: calc(100vh - var(--navbar-height) - 295px)"
                       />
                       <!-- eslint-enable local/no-hardcoded-px -->
@@ -355,7 +357,9 @@ import AppTabs from "@/components/common/AppTabs.vue";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import GroupServiceAccounts from "../groups/GroupServiceAccounts.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 
 interface RoleDraftData {
   added: string[];
@@ -369,6 +373,9 @@ interface RoleDraftData {
 
 const QueryEditor = defineAsyncComponent(() => import("@/components/CodeQueryEditor.vue"));
 
+// Monaco is not an O2 primitive, so the page lock cannot disable it on its own.
+const { locked: pageLocked } = useFeatureLock();
+
 onBeforeMount(() => {
   permissionsState.permissions = [];
   editingRole.value = router.currentRoute.value.params.role_name as string;
@@ -428,6 +435,8 @@ const removedServiceAccounts = ref(new Set());
 
 const roleUsers: Ref<string[]> = ref([]);
 
+const licenseDenied = ref<string[] | null>(null);
+
 const permissionsUiType = ref("table");
 
 // Held here, not in RoleSummary, so a closed Presets panel stays closed when a module is opened and left.
@@ -610,6 +619,9 @@ const getRoleDetails = () => {
     })
     .catch((error) => {
       isFetchingInitialRoles.value = false;
+      // The page stays and renders locked; the license bar explains the denial.
+      licenseDenied.value = licenseDeniedFeatures(error);
+      if (licenseDenied.value) return;
       if (error?.response?.status === 404) {
         roleGone = true;
         deleteEditorDraftsFor({
diff --git a/web/src/components/iam/roles/RoleSummary.spec.ts b/web/src/components/iam/roles/RoleSummary.spec.ts
index eaf3c7f8c6..162178085a 100644
--- a/web/src/components/iam/roles/RoleSummary.spec.ts
+++ b/web/src/components/iam/roles/RoleSummary.spec.ts
@@ -5,6 +5,8 @@ import store from "@/test/unit/helpers/store";
 import router from "@/test/unit/helpers/router";
 import { raw } from "@/types/i18n";
 import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
+import { defineComponent, h, ref } from "vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
 
 vi.mock("@/aws-exports", () => ({
   default: { isCloud: "false", isEnterprise: "true" },
@@ -47,6 +49,7 @@ async function mountSummary(
     modules: SummaryModule[];
     loading: boolean;
     previewPreset: (id: string) => PresetPreview;
+    licenseDenied: string[];
   }> = {},
   attachTo?: HTMLElement,
 ) {
@@ -91,6 +94,31 @@ describe("RoleSummary - empty role", () => {
     expect(wrapper.emitted("preset")).toEqual([["readonly"]]);
   });
 
+  it("offers no preset on a license-locked page", async () => {
+    const LockedPage = defineComponent({
+      setup() {
+        provideFeatureLock(ref("rbac"));
+        return () => h(RoleSummary, { modules: [], loading: false });
+      },
+    });
+    const wrapper = mount(LockedPage, { global: { plugins: [i18n, store, router] } });
+    await flushPromises();
+
+    expect(wrapper.find('[data-test="edit-role-summary-empty"]').exists()).toBe(true);
+    expect(wrapper.findAll('[data-test="edit-role-summary-empty"] button')).toHaveLength(0);
+    expect(wrapper.find('[data-test="edit-role-presets-panel"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="edit-role-presets-open"]').exists()).toBe(false);
+  });
+
+  it("says the license lacks the feature instead of offering presets when the load was denied", async () => {
+    const wrapper = await mountSummary({ licenseDenied: ["rbac"] });
+
+    expect(wrapper.find('[data-test="edit-role-summary-license-denied"]').text()).toContain(
+      "Your license does not include",
+    );
+    expect(wrapper.find('[data-test="edit-role-summary-empty"]').exists()).toBe(false);
+  });
+
   // Presets must not show counts while the saved grants are still loading.
   it("shows a spinner and no preset counts while loading", async () => {
     const wrapper = await mountSummary({ loading: true });
diff --git a/web/src/components/iam/roles/RoleSummary.vue b/web/src/components/iam/roles/RoleSummary.vue
index 6697148d6e..13a34f1d3a 100644
--- a/web/src/components/iam/roles/RoleSummary.vue
+++ b/web/src/components/iam/roles/RoleSummary.vue
@@ -37,6 +37,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <OSpinner size="md" data-test="edit-role-summary-loading" />
         </div>
 
+        <div v-else-if="licenseDenied" class="flex flex-1 items-center justify-center p-6">
+          <LicenseDeniedState
+            :features="licenseDenied"
+            data-test="edit-role-summary-license-denied"
+          />
+        </div>
+
         <div v-else-if="!modules.length" class="flex flex-1 items-center justify-center p-6">
           <OEmptyState
             size="hero"
@@ -128,7 +135,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </div>
 
       <OButton
-        v-if="!presetsOpen"
+        v-if="!locked && !presetsOpen"
         variant="outline"
         size="icon-sm"
         class="absolute end-3 top-3 z-10"
@@ -141,7 +148,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </OButton>
 
       <RolePresetsPanel
-        v-else
+        v-else-if="!locked"
         class="border-border-default w-85 shrink-0 border-s @max-[38rem]/role-overview:max-h-[55%] @max-[38rem]/role-overview:w-auto @max-[38rem]/role-overview:border-s-0 @max-[38rem]/role-overview:border-t"
         :presets="presets"
         :preview-preset="previewPreset"
@@ -174,6 +181,8 @@ import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import RolePresetsPanel from "@/components/iam/roles/RolePresetsPanel.vue";
 import { groupTone } from "@/components/iam/roles/roleGroupTone";
 import type { PresetInfo, PresetPreview } from "@/composables/iam/useRolePresets";
+import { useFeatureLock } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 
 export type SummaryAction = { action: string; label: I18nText };
 
@@ -202,6 +211,8 @@ defineProps<{
   moduleLabel: (key: string) => I18nText;
   entityLabel: (resource: string, entity: string) => I18nText;
   summaryActions: (actions: string[]) => SummaryAction[];
+  /** Missing license features when the role's permissions load was license-denied. */
+  licenseDenied?: readonly string[] | null;
 }>();
 
 const emit = defineEmits<{
@@ -211,6 +222,8 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+// The preset cards are a library button the page lock does not reach.
+const { locked } = useFeatureLock();
 
 const grouped = (count: number) => raw(count.toLocaleString());
 
diff --git a/web/src/components/iam/roles/RoleTable.vue b/web/src/components/iam/roles/RoleTable.vue
index 5e4b2d11ac..36f87766e5 100644
--- a/web/src/components/iam/roles/RoleTable.vue
+++ b/web/src/components/iam/roles/RoleTable.vue
@@ -14,6 +14,7 @@ import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import { useI18nTyped } from "@/types/i18n";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
 
@@ -22,7 +23,7 @@ const roleDrafts = useEditorDraftIds("iam_role");
 const props = defineProps<{
   data: any[];
   loading?: boolean;
-  forbidden?: boolean;
+  forbidden?: ForbiddenState;
   actionLoading?: boolean;
   selectedIds?: string[];
   globalFilter?: string;
diff --git a/web/src/components/iam/serviceAccounts/AddServiceAccount.spec.ts b/web/src/components/iam/serviceAccounts/AddServiceAccount.spec.ts
index 77cc725173..327fb661ca 100644
--- a/web/src/components/iam/serviceAccounts/AddServiceAccount.spec.ts
+++ b/web/src/components/iam/serviceAccounts/AddServiceAccount.spec.ts
@@ -230,6 +230,34 @@ describe("AddServiceAccount", () => {
       });
       w.unmount();
     });
+
+    it("keeps the role and group pickers disabled, and skips their gated lists, while rbac is locked", async () => {
+      expect(wrapper.find('[data-test="iam-add-service-account-roles-select"]').exists()).toBe(
+        true,
+      );
+      const { getRoles, getGroups } = await import("@/services/iam");
+      const saved = store.state.zoConfig;
+      store.state.zoConfig = { ...saved, features: { rbac: "locked" } };
+      queryClient.clear();
+      vi.mocked(getRoles).mockClear();
+      vi.mocked(getGroups).mockClear();
+      const w = mountComp();
+      await flushPromises();
+
+      const roles = w.find('[data-test="iam-add-service-account-roles-select"]');
+      const groups = w.find('[data-test="iam-add-service-account-groups-select"]');
+      expect(roles.exists()).toBe(true);
+      expect(groups.exists()).toBe(true);
+      expect(roles.find("button[role=combobox]").attributes("disabled")).toBeDefined();
+      expect(groups.find("button[role=combobox]").attributes("disabled")).toBeDefined();
+      expect(
+        w.find('[data-test="iam-add-service-account-create-role-btn"]').attributes("disabled"),
+      ).toBeDefined();
+      expect(getRoles).not.toHaveBeenCalled();
+      expect(getGroups).not.toHaveBeenCalled();
+      w.unmount();
+      store.state.zoConfig = saved;
+    });
   });
 
   describe("schema validation (real OForm, create mode)", () => {
diff --git a/web/src/components/iam/serviceAccounts/AddServiceAccount.vue b/web/src/components/iam/serviceAccounts/AddServiceAccount.vue
index 1aa5734fd3..08a1d9e84e 100644
--- a/web/src/components/iam/serviceAccounts/AddServiceAccount.vue
+++ b/web/src/components/iam/serviceAccounts/AddServiceAccount.vue
@@ -71,47 +71,61 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
              Both pickers are optional; assignments are applied after the
              account is created, and failures surface in the token-reveal
              screen without blocking it. -->
-        <template v-if="!beingUpdated">
+        <template v-if="!beingUpdated && rbacState !== 'hidden'">
           <!-- RBAC not allowed: the select would write to form state and the
                button would open AddRole on click, so a locked click is caught
                on this wrapper BEFORE it reaches either — removing `disabled`
                there would let the "real" action fire alongside the dialog. -->
-          <span
-            class="contents"
-            @click.capture="!rbacAccess.allowed ? onLockedRbacClick($event) : undefined"
-          >
-            <OFormSelect
-              name="roles"
-              multiple
-              :options="roleOptions"
-              :label="t('serviceAccounts.form.roles.label')"
-              data-test="iam-add-service-account-roles-select"
-              class="showLabelOnTop mt-2"
-            />
-            <div class="mt-1 flex justify-end">
-              <OButton
-                variant="ghost"
-                size="sm"
-                type="button"
-                data-test="iam-add-service-account-create-role-btn"
-                @click="!rbacAccess.allowed ? undefined : (showAddRoleDialog = true)"
+          <OTooltip :content="rbacLockedReason" :disabled="!rbacLocked">
+            <div
+              @click.capture="
+                !rbacAccess.allowed || rbacLocked ? onLockedRbacClick($event) : undefined
+              "
+            >
+              <OFormSelect
+                name="roles"
+                :disabled="rbacLocked"
+                multiple
+                :options="roleOptions"
+                :label="t('serviceAccounts.form.roles.label')"
+                data-test="iam-add-service-account-roles-select"
+                class="showLabelOnTop mt-2"
               >
-                <template v-if="!rbacAccess.allowed" #icon-left>
-                  <OIcon name="lock" size="sm" class="text-warning-600" />
+                <template v-if="rbacLocked" #icon-left>
+                  <OIcon name="lock" size="sm" class="lock-chip" />
                 </template>
-                <template v-else #icon-left><OIcon name="add" size="sm" /></template>
-                {{ t("serviceAccounts.form.roles.create") }}
-              </OButton>
+              </OFormSelect>
+              <div class="mt-1 flex justify-end">
+                <OButton
+                  variant="ghost"
+                  size="sm"
+                  type="button"
+                  :disabled="rbacLocked"
+                  data-test="iam-add-service-account-create-role-btn"
+                  @click="!rbacAccess.allowed ? undefined : (showAddRoleDialog = true)"
+                >
+                  <template v-if="!rbacAccess.allowed || rbacLocked" #icon-left>
+                    <OIcon name="lock" size="sm" class="lock-chip" />
+                  </template>
+                  <template v-else #icon-left><OIcon name="add" size="sm" /></template>
+                  {{ t("serviceAccounts.form.roles.create") }}
+                </OButton>
+              </div>
+              <OFormSelect
+                name="groups"
+                :disabled="rbacLocked"
+                multiple
+                :options="groupOptions"
+                :label="t('serviceAccounts.form.groups.label')"
+                data-test="iam-add-service-account-groups-select"
+                class="showLabelOnTop mt-2"
+              >
+                <template v-if="rbacLocked" #icon-left>
+                  <OIcon name="lock" size="sm" class="lock-chip" />
+                </template>
+              </OFormSelect>
             </div>
-            <OFormSelect
-              name="groups"
-              multiple
-              :options="groupOptions"
-              :label="t('serviceAccounts.form.groups.label')"
-              data-test="iam-add-service-account-groups-select"
-              class="showLabelOnTop mt-2"
-            />
-          </span>
+          </OTooltip>
         </template>
       </OForm>
     </div>
@@ -148,6 +162,9 @@ import service_accounts from "@/services/service_accounts";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
 import { updateRole, updateGroup } from "@/services/iam";
+import { featureState } from "@/utils/featureGate";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { seedReadonlyRolePermissions } from "@/components/iam/roles/readonlyPreset";
 import { useReo } from "@/services/reodotdev_analytics";
 import { toast } from "@/lib/feedback/Toast/useToast";
@@ -170,7 +187,7 @@ const defaultValue: any = () => {
 
 export default defineComponent({
   name: "ComponentAddUpdateUser",
-  components: { ODialog, OForm, OFormInput, OFormSelect, OButton, OIcon, AddRole },
+  components: { ODialog, OForm, OFormInput, OFormSelect, OButton, OIcon, OTooltip, AddRole },
   props: {
     open: {
       type: Boolean,
@@ -227,11 +244,16 @@ export default defineComponent({
     // rail items — reused here so the pickers lock instead of vanish in OSS.
     const rbacAccess = useLockedAffordance("rbac");
     const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+    // Every role/group list and assignment API needs the rbac license; without it the pickers go.
+    const rbacState = computed(() => featureState(store.state.zoConfig?.features, "rbac"));
+    const rbacLicensed = computed(() => rbacState.value === "enabled");
+    const rbacLocked = computed(() => rbacState.value === "locked");
+    const { lockedReason: rbacLockedReason } = useLicenseLock("rbac");
 
     function onLockedRbacClick(event: MouseEvent) {
       event.preventDefault();
       event.stopPropagation();
-      openUpgradeDialog();
+      if (!rbacLocked.value) openUpgradeDialog();
     }
 
     const roleOptions = ref<SelectOption[]>([]);
@@ -241,7 +263,7 @@ export default defineComponent({
     // Both list APIs return plain string arrays. A load failure leaves the
     // pickers empty but never blocks account creation.
     const loadAccessOptions = async () => {
-      if (!rbacAccess.value.allowed) return;
+      if (!rbacAccess.value.allowed || !rbacLicensed.value) return;
       try {
         const [rolesRes, groupsRes] = await Promise.all([
           queryClient.fetchQuery(rolesQuery(orgId.value)),
@@ -278,6 +300,9 @@ export default defineComponent({
       addServiceAccountSchema,
       addServiceAccountDefaults,
       rbacAccess,
+      rbacState,
+      rbacLocked,
+      rbacLockedReason,
       onLockedRbacClick,
       roleOptions,
       groupOptions,
diff --git a/web/src/components/iam/serviceAccounts/ServiceAccountsList.vue b/web/src/components/iam/serviceAccounts/ServiceAccountsList.vue
index 3b0b7576f7..b30814a9cc 100644
--- a/web/src/components/iam/serviceAccounts/ServiceAccountsList.vue
+++ b/web/src/components/iam/serviceAccounts/ServiceAccountsList.vue
@@ -132,12 +132,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :title="rbacAccess.allowed ? serviceAccountRolesText(row.email) : rbacAccess.message"
               @click="!rbacAccess.allowed && openUpgradeDialog()"
               >{{ serviceAccountRolesText(row.email) }}
-              <OIcon
-                v-if="!rbacAccess.allowed"
-                name="lock"
-                size="xs"
-                class="text-warning-600 shrink-0"
-              />
+              <OIcon v-if="!rbacAccess.allowed" name="lock" size="xs" class="lock-chip shrink-0" />
             </span>
           </template>
 
@@ -489,7 +484,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :class="
                     rbacAccess.allowed
                       ? 'text-text-secondary group-hover:translate-x-0.5'
-                      : 'text-warning-600'
+                      : 'lock-chip'
                   "
                   class="shrink-0 transition-transform"
                 />
@@ -508,7 +503,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :class="
                     rbacAccess.allowed
                       ? 'text-text-secondary group-hover:translate-x-0.5'
-                      : 'text-warning-600'
+                      : 'lock-chip'
                   "
                   class="shrink-0 transition-transform"
                 />
@@ -587,6 +582,7 @@ import { useReo } from "@/services/reodotdev_analytics";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 export default defineComponent({
   name: "ServiceAccountsList",
   components: {
@@ -916,7 +912,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = serviceAccountsList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     // Bound to refresh / post-write reloads: always hits the server.
     const refreshServiceAccounts = () => {
diff --git a/web/src/components/iam/users/AddUser.spec.ts b/web/src/components/iam/users/AddUser.spec.ts
index e5ff0bebeb..d9f5cf2e6f 100644
--- a/web/src/components/iam/users/AddUser.spec.ts
+++ b/web/src/components/iam/users/AddUser.spec.ts
@@ -773,6 +773,20 @@ describe("AddUser", () => {
       expect(wrapper.find('[data-test="user-custom-role-field"]').exists()).toBe(true);
     });
 
+    it("keeps the custom_role field visible but disabled under a locked rbac license", async () => {
+      const saved = store.state.zoConfig;
+      store.state.zoConfig = { ...saved, features: { rbac: "locked" } };
+      wrapper = mountComp({
+        modelValue: { email: "other@example.com", first_name: "Other", org_member_id: "2" },
+      });
+      await flushPromises();
+
+      const field = wrapper.find('[data-test="user-custom-role-field"]');
+      expect(field.exists()).toBe(true);
+      expect(field.find("button[role=combobox]").attributes("disabled")).toBeDefined();
+      store.state.zoConfig = saved;
+    });
+
     it("stages an unlock and sends it on save, after confirming", async () => {
       vi.mocked(userServiece.get).mockResolvedValue({
         data: { lockout: { locked: true, retry_after_secs: 240 } },
diff --git a/web/src/components/iam/users/AddUser.vue b/web/src/components/iam/users/AddUser.vue
index efa656a697..89d9ebc88e 100644
--- a/web/src/components/iam/users/AddUser.vue
+++ b/web/src/components/iam/users/AddUser.vue
@@ -111,34 +111,47 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           class="showLabelOnTop mt-2"
           data-test="user-role-field"
         />
-        <OFormSelect
+        <OTooltip
           v-if="
             (existingUser || beingUpdated) &&
             userRole !== 'member' &&
             store.state.userInfo.email !== formEmail &&
-            (config.isEnterprise == 'true' || config.isCloud == 'true')
+            (config.isEnterprise == 'true' || config.isCloud == 'true') &&
+            rbacState !== 'hidden'
           "
-          name="custom_role"
-          :label="t('user.customRole')"
-          :options="filterdOption"
-          class="showLabelOnTop mt-2"
-          multiple
-          data-test="user-custom-role-field"
-          :disable="
-            isCloud ? filterdOption.length === 0 : filterdOption.length === 0 || !!isExternalUser
-          "
-          :hint="
-            isCloud
-              ? filterdOption.length === 0
-                ? t('user.noCustomRolesHint')
-                : ''
-              : isExternalUser
-                ? t('user.externalUserCustomRoleHint')
-                : filterdOption.length === 0
-                  ? t('user.noCustomRolesHint')
-                  : ''
-          "
-        />
+          :content="rbacLockedReason"
+          :disabled="!rbacLocked"
+        >
+          <OFormSelect
+            name="custom_role"
+            :disabled="rbacLocked"
+            :label="t('user.customRole')"
+            :options="filterdOption"
+            class="showLabelOnTop mt-2"
+            multiple
+            data-test="user-custom-role-field"
+            :disable="
+              isCloud ? filterdOption.length === 0 : filterdOption.length === 0 || !!isExternalUser
+            "
+            :hint="
+              rbacLocked
+                ? ''
+                : isCloud
+                  ? filterdOption.length === 0
+                    ? t('user.noCustomRolesHint')
+                    : ''
+                  : isExternalUser
+                    ? t('user.externalUserCustomRoleHint')
+                    : filterdOption.length === 0
+                      ? t('user.noCustomRolesHint')
+                      : ''
+            "
+          >
+            <template v-if="rbacLocked" #icon-left>
+              <OIcon name="lock" size="sm" class="lock-chip" />
+            </template>
+          </OFormSelect>
+        </OTooltip>
         <div v-if="beingUpdated && !isCloud" class="mt-2">
           <OFormSwitch
             name="change_password"
@@ -256,7 +269,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script lang="ts">
-import { defineComponent, ref, onActivated, onBeforeMount, watch, type PropType } from "vue";
+import {
+  computed,
+  defineComponent,
+  ref,
+  onActivated,
+  onBeforeMount,
+  watch,
+  type PropType,
+} from "vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
@@ -286,6 +307,9 @@ import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import PasswordRequirementList from "@/components/common/PasswordRequirementList.vue";
 import { durationFormatter } from "@/utils/formatters";
 import { reuseRejection } from "@/utils/passwordComplexity";
+import { featureState } from "@/utils/featureGate";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 const defaultValue: any = () => {
   return {
     org_member_id: "",
@@ -314,6 +338,7 @@ export default defineComponent({
     OFormSelect,
     OFormSwitch,
     OTruncatedText,
+    OTooltip,
     PasswordRequirementList,
   },
   props: {
@@ -407,6 +432,10 @@ export default defineComponent({
     // `custom_role` is an Enterprise/Cloud-only concept — the field is rendered
     // and hydrated (getUserRoles) ONLY under this flag.
     const supportsCustomRole = config.isEnterprise == "true" || config.isCloud == "true";
+    // Custom roles cannot be listed without the rbac license, so the picker would stay empty.
+    const rbacState = computed(() => featureState(store.state.zoConfig?.features, "rbac"));
+    const rbacLocked = computed(() => rbacState.value === "locked");
+    const { lockedReason: rbacLockedReason } = useLicenseLock("rbac");
 
     // Decide whether to send `custom_role`:
     //   • OSS → never (the field is Enterprise/Cloud-only).
@@ -729,6 +758,9 @@ export default defineComponent({
       existingUser,
       organization,
       isExternalUser,
+      rbacState,
+      rbacLocked,
+      rbacLockedReason,
       changePassword,
       formEmail,
       formRole,
diff --git a/web/src/components/iam/users/InvitationList.vue b/web/src/components/iam/users/InvitationList.vue
index a9132f8ebc..778ed3c3b5 100644
--- a/web/src/components/iam/users/InvitationList.vue
+++ b/web/src/components/iam/users/InvitationList.vue
@@ -203,6 +203,7 @@ import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import usersService from "@/services/users";
 import organizationsService from "@/services/organizations";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
@@ -306,7 +307,7 @@ export default defineComponent({
       },
     ];
     const loading = ref(false);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
 
     onMounted(() => {
       fetchPendingInvitations();
@@ -332,7 +333,7 @@ export default defineComponent({
       } catch (error) {
         const e = error as { response?: { status?: number; data?: { message?: string } } };
         dismiss();
-        forbidden.value = e.response?.status === 403;
+        forbidden.value = forbiddenState(e);
         if (!forbidden.value) {
           toast({
             message: raw(e.response?.data?.message || t("iam.invitationList.failedLoadPending")),
diff --git a/web/src/components/iam/users/User.spec.ts b/web/src/components/iam/users/User.spec.ts
index e344fb9714..25fadc06e7 100644
--- a/web/src/components/iam/users/User.spec.ts
+++ b/web/src/components/iam/users/User.spec.ts
@@ -496,6 +496,40 @@ describe("User Component", () => {
     });
   });
 
+  describe("rbac license", () => {
+    const savedZoConfig = store.state.zoConfig;
+
+    const mountEnterprise = async (rbac: string) => {
+      const config = (await import("@/aws-exports")).default as any;
+      config.isEnterprise = "true";
+      store.state.zoConfig = { ...savedZoConfig, rbac_enabled: true, features: { rbac } };
+      wrapper.unmount();
+      queryClient.clear();
+      mockGetRoles.mockClear();
+      wrapper = mountUser();
+      await flushPromises();
+    };
+
+    afterEach(async () => {
+      const config = (await import("@/aws-exports")).default as any;
+      config.isEnterprise = "false";
+      store.state.zoConfig = savedZoConfig;
+    });
+
+    it("never requests the gated custom roles list while rbac is locked", async () => {
+      await mountEnterprise("locked");
+      expect(mockGetRoles).not.toHaveBeenCalled();
+      expect(wrapper.vm.customRoles).toEqual([]);
+    });
+
+    it("loads custom roles once rbac is enabled", async () => {
+      mockGetRoles.mockResolvedValue({ data: ["custom_role"] } as any);
+      await mountEnterprise("enabled");
+      expect(mockGetRoles).toHaveBeenCalledWith(store.state.selectedOrganization.identifier);
+      expect(wrapper.vm.customRoles).toEqual(["custom_role"]);
+    });
+  });
+
   describe("getInvitedMembers", () => {
     it("should fetch invited members successfully", async () => {
       const mockInvitedMembers = [{ email: "invited@example.com", status: "pending" }];
diff --git a/web/src/components/iam/users/User.vue b/web/src/components/iam/users/User.vue
index cefdf2b64a..ca5c5e9470 100644
--- a/web/src/components/iam/users/User.vue
+++ b/web/src/components/iam/users/User.vue
@@ -442,6 +442,7 @@ import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 // @ts-ignore
 import usePermissions from "@/composables/iam/usePermissions";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { featureState, forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import { COL } from "@/lib/core/Table/OTable.types";
@@ -849,7 +850,8 @@ export default defineComponent({
     const getCustomRoles = async (options: { silent?: boolean } = {}) => {
       if (
         (config.isEnterprise !== "true" && config.isCloud !== "true") ||
-        !store.state.zoConfig.rbac_enabled
+        !store.state.zoConfig.rbac_enabled ||
+        featureState(store.state.zoConfig.features, "rbac") !== "enabled"
       )
         return;
       try {
@@ -899,7 +901,7 @@ export default defineComponent({
     // spinner. `loading` is the skeleton, which only a cold read wants.
     const fetching = ref(false);
     const lastUpdatedAt = ref<number | null>(null);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     // The ?email= deep link opens the edit dialog, so it is latched — the
     // cached paint and the fresh one must not open it twice.
     let deepLinkOpened = false;
@@ -1054,7 +1056,7 @@ export default defineComponent({
           .catch((err: any) => {
             console.error("Failed to fetch org members:", err);
             dismiss();
-            forbidden.value = err?.response?.status === 403;
+            forbidden.value = forbiddenState(err);
             if (!forbidden.value) {
               toast({
                 variant: "error",
diff --git a/web/src/components/ingestion/Custom.spec.ts b/web/src/components/ingestion/Custom.spec.ts
index 1be313609a..06aa3aef72 100644
--- a/web/src/components/ingestion/Custom.spec.ts
+++ b/web/src/components/ingestion/Custom.spec.ts
@@ -80,6 +80,46 @@ describe("Custom Component", () => {
     }
   });
 
+  describe("continuous profiling license lock", () => {
+    const mountWith = (features: Record<string, string>) => {
+      store.state.zoConfig = { ...store.state.zoConfig, profiling_enabled: true, features };
+      return mount(Custom, {
+        props: { currOrgIdentifier: "test-org" },
+        global: {
+          plugins: [i18n],
+          provide: { store },
+          stubs: { ORouteTab: true, "router-view": true },
+        },
+      });
+    };
+    const profilesTab = (w: any) => w.find('[data-test="ingestion-custom-tab-ingestProfiles"]');
+
+    afterEach(() => {
+      store.state.zoConfig = { ...store.state.zoConfig, profiling_enabled: false, features: {} };
+    });
+
+    it("marks the Profiles tab with a lock when profiling is locked", () => {
+      const w = mountWith({ continuous_profiling: "locked" });
+      expect(profilesTab(w).attributes("suffix-icon")).toBe("lock");
+      w.unmount();
+    });
+
+    it("keeps the guide rail live on a locked page", () => {
+      const w = mountWith({ continuous_profiling: "locked" });
+      expect(
+        w.find('[data-feature-lock-exempt] [data-test="ingestion-custom-tab-ingestLogs"]').exists(),
+      ).toBe(true);
+      w.unmount();
+    });
+
+    it("shows the Profiles tab without a lock when profiling is enabled", () => {
+      const w = mountWith({ continuous_profiling: "enabled" });
+      expect(profilesTab(w).exists()).toBe(true);
+      expect(profilesTab(w).attributes("suffix-icon")).toBeUndefined();
+      w.unmount();
+    });
+  });
+
   describe("Component Initialization", () => {
     it("should mount successfully", () => {
       expect(wrapper.exists()).toBe(true);
diff --git a/web/src/components/ingestion/Custom.vue b/web/src/components/ingestion/Custom.vue
index 5636183ae8..acbfe6ba82 100644
--- a/web/src/components/ingestion/Custom.vue
+++ b/web/src/components/ingestion/Custom.vue
@@ -18,51 +18,55 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <DataSourceSidebarLayout v-model="tabs" :splitter-width="250" compact-mode="strip">
     <template #tabs>
-      <ORouteTab
-        name="ingestLogs"
-        data-test="ingestion-custom-tab-ingestLogs"
-        :to="{
-          name: 'ingestLogs',
-          query: {
-            org_identifier: store.state.selectedOrganization.identifier,
-          },
-        }"
-        :label="t('ingestion.logsLabel')"
-      />
-      <ORouteTab
-        name="ingestMetrics"
-        data-test="ingestion-custom-tab-ingestMetrics"
-        :to="{
-          name: 'ingestMetrics',
-          query: {
-            org_identifier: store.state.selectedOrganization.identifier,
-          },
-        }"
-        :label="t('ingestion.metricsLabel')"
-      />
-      <ORouteTab
-        v-if="store.state.zoConfig?.profiling_enabled"
-        name="ingestProfiles"
-        data-test="ingestion-custom-tab-ingestProfiles"
-        :to="{
-          name: 'ingestProfiles',
-          query: {
-            org_identifier: store.state.selectedOrganization.identifier,
-          },
-        }"
-        :label="t('ingestion.profilesLabel')"
-      />
-      <ORouteTab
-        name="ingestTraces"
-        data-test="ingestion-custom-tab-ingestTraces"
-        :to="{
-          name: 'ingestTraces',
-          query: {
-            org_identifier: store.state.selectedOrganization.identifier,
-          },
-        }"
-        :label="t('ingestion.tracesLabel')"
-      />
+      <!-- The rail only navigates, so a license-locked guide still lets the reader move to a free one. -->
+      <FeatureLockExempt class="contents">
+        <ORouteTab
+          name="ingestLogs"
+          data-test="ingestion-custom-tab-ingestLogs"
+          :to="{
+            name: 'ingestLogs',
+            query: {
+              org_identifier: store.state.selectedOrganization.identifier,
+            },
+          }"
+          :label="t('ingestion.logsLabel')"
+        />
+        <ORouteTab
+          name="ingestMetrics"
+          data-test="ingestion-custom-tab-ingestMetrics"
+          :to="{
+            name: 'ingestMetrics',
+            query: {
+              org_identifier: store.state.selectedOrganization.identifier,
+            },
+          }"
+          :label="t('ingestion.metricsLabel')"
+        />
+        <ORouteTab
+          v-if="store.state.zoConfig?.profiling_enabled"
+          name="ingestProfiles"
+          data-test="ingestion-custom-tab-ingestProfiles"
+          :to="{
+            name: 'ingestProfiles',
+            query: {
+              org_identifier: store.state.selectedOrganization.identifier,
+            },
+          }"
+          :label="t('ingestion.profilesLabel')"
+          :suffix-icon="profilesLocked ? 'lock' : undefined"
+        />
+        <ORouteTab
+          name="ingestTraces"
+          data-test="ingestion-custom-tab-ingestTraces"
+          :to="{
+            name: 'ingestTraces',
+            query: {
+              org_identifier: store.state.selectedOrganization.identifier,
+            },
+          }"
+          :label="t('ingestion.tracesLabel')"
+        />
+      </FeatureLockExempt>
     </template>
 
     <div class="h-full overflow-hidden">
@@ -88,10 +92,12 @@ import { copyToClipboard } from "@/utils/clipboard";
 import config from "@/aws-exports";
 import analytics from "@/services/product_analytics";
 import { getImageURL } from "@/utils/zincutils";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 
 export default defineComponent({
   name: "CustomPage",
-  components: { ORouteTab, DataSourceSidebarLayout },
+  components: { ORouteTab, DataSourceSidebarLayout, FeatureLockExempt },
   props: {
     currOrgIdentifier: {
       type: String,
@@ -102,6 +108,7 @@ export default defineComponent({
     const { t } = useI18nTyped();
     const store = useStore();
     const router: any = useRouter();
+    const { locked: profilesLocked } = useLicenseLock("continuous_profiling");
     const currentOrgIdentifier: any = ref(store.state.selectedOrganization.identifier);
     const metricRoutes = [
       "prometheus",
@@ -228,6 +235,7 @@ export default defineComponent({
       traceRoutes,
       metricRoutes,
       profileRoutes,
+      profilesLocked,
     };
   },
 });
diff --git a/web/src/components/ingestion/FirstDataNotice.spec.ts b/web/src/components/ingestion/FirstDataNotice.spec.ts
new file mode 100644
index 0000000000..1ddab8f421
--- /dev/null
+++ b/web/src/components/ingestion/FirstDataNotice.spec.ts
@@ -0,0 +1,46 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import FirstDataNotice from "./FirstDataNotice.vue";
+
+const mountNotice = (streamType: string, features: Record<string, string> = {}) =>
+  mount(FirstDataNotice, {
+    props: { stream: { name: "default", streamType } as never },
+    global: { plugins: [i18n, createStore({ state: { zoConfig: { features } } })] },
+  });
+
+describe("FirstDataNotice — open in the signal page", () => {
+  it("opens the signal page when its license is enabled", async () => {
+    const wrapper = mountNotice("metrics", { traces: "locked" });
+    const open = wrapper.find('[data-test="first-data-notice-open-btn"]');
+    expect(open.text()).toBe("Open in Metrics");
+    expect(open.attributes("disabled")).toBeUndefined();
+    await open.trigger("click");
+    expect(wrapper.emitted("open")).toHaveLength(1);
+  });
+
+  it("disables the open control with a lock when the signal is locked", async () => {
+    const wrapper = mountNotice("traces", { traces: "locked" });
+    const open = wrapper.find('[data-test="first-data-notice-open-btn"]');
+    expect(open.attributes("disabled")).toBeDefined();
+    expect(open.findAllComponents(OIcon).map((i) => i.props("name"))).toContain("lock");
+    await open.trigger("click");
+    expect(wrapper.emitted("open")).toBeUndefined();
+  });
+});
diff --git a/web/src/components/ingestion/FirstDataNotice.vue b/web/src/components/ingestion/FirstDataNotice.vue
index 2bd50f6453..229e1d32f5 100644
--- a/web/src/components/ingestion/FirstDataNotice.vue
+++ b/web/src/components/ingestion/FirstDataNotice.vue
@@ -20,6 +20,9 @@ import { formatDistanceToNowStrict } from "date-fns";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import { raw, useI18nTyped } from "@/types/i18n";
 import type { FirstDataStream } from "@/composables/firstEvent/useFirstDataNotice";
 
@@ -58,6 +61,9 @@ const openLabel = computed(() => {
       return t("ingestion.firstEvent.openInLogs");
   }
 });
+const { isLocked, lockedReason } = useLicenseLocks();
+const openFeature = computed(() => streamTypeFeature(props.stream?.streamType));
+const openLocked = computed(() => isLocked(openFeature.value));
 </script>
 
 <template>
@@ -93,15 +99,20 @@ const openLabel = computed(() => {
         >
           {{ t("ingestion.firstDataNotice.dismiss") }}
         </OButton>
-        <OButton
-          variant="primary"
-          size="sm-action"
-          icon-left="open-in-new"
-          data-test="first-data-notice-open-btn"
-          @click="emit('open')"
-        >
-          {{ openLabel }}
-        </OButton>
+        <OTooltip :content="lockedReason(openFeature ?? '')" :disabled="!openLocked">
+          <span class="inline-flex">
+            <OButton
+              variant="primary"
+              size="sm-action"
+              :icon-left="openLocked ? 'lock' : 'open-in-new'"
+              :disabled="openLocked"
+              data-test="first-data-notice-open-btn"
+              @click="emit('open')"
+            >
+              {{ openLabel }}
+            </OButton>
+          </span>
+        </OTooltip>
       </div>
     </template>
   </OBanner>
diff --git a/web/src/components/ingestion/FirstDataPanel.spec.ts b/web/src/components/ingestion/FirstDataPanel.spec.ts
index f51dc0399c..94cc5e07eb 100644
--- a/web/src/components/ingestion/FirstDataPanel.spec.ts
+++ b/web/src/components/ingestion/FirstDataPanel.spec.ts
@@ -19,6 +19,7 @@ import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
 import { createStore } from "vuex";
 import { createMemoryHistory, createRouter } from "vue-router";
 import i18n from "@/locales";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { queryClient } from "@/composables/query/queryClient";
 import { streamKeys } from "@/services/stream.querykeys";
 import { copyToClipboard } from "@/utils/clipboard";
@@ -752,6 +753,21 @@ describe("FirstDataPanel — first data arrived strip (e5)", () => {
     expect(wrapper.emitted("open")).toHaveLength(1);
   });
 
+  it("disables Open in Logs with a lock while the logs license is locked", async () => {
+    await mountPanel({
+      signal: "any",
+      variant: "compact",
+      arrived: { streamName: "default", streamType: "logs", count: 1, rangeStart: 0, rangeEnd: 1 },
+    });
+    store.state.zoConfig.features = { logs: "locked" };
+    await nextTick();
+    const open = q("first-data-panel-arrived-open-btn");
+    expect(open.attributes("disabled")).toBeDefined();
+    expect(open.findAllComponents(OIcon).map((i) => i.props("name"))).toContain("lock");
+    await open.trigger("click");
+    expect(wrapper.emitted("open")).toBeUndefined();
+  });
+
   it("states the records and stream, and closes", async () => {
     await mountPanel({
       signal: "logs",
diff --git a/web/src/components/ingestion/FirstDataPanel.vue b/web/src/components/ingestion/FirstDataPanel.vue
index 2def445b70..4ea4cdc92f 100644
--- a/web/src/components/ingestion/FirstDataPanel.vue
+++ b/web/src/components/ingestion/FirstDataPanel.vue
@@ -25,6 +25,9 @@ import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import config from "@/aws-exports";
 import analytics from "@/services/product_analytics";
 import { streamNameListQuery } from "@/services/stream.queries";
@@ -304,6 +307,9 @@ const arrivedOpenLabel = computed((): I18nText => {
   if (type === "traces") return t("ingestion.firstEvent.openInTraces");
   return t("ingestion.firstEvent.openInLogs");
 });
+const { isLocked, lockedReason } = useLicenseLocks();
+const arrivedFeature = computed(() => streamTypeFeature(props.arrived?.streamType));
+const arrivedLocked = computed(() => isLocked(arrivedFeature.value));
 
 const status = ref<InstanceType<typeof FirstEventStatus> | null>(null);
 
@@ -409,16 +415,24 @@ const StatusLine = defineComponent({
       >
         {{ t("common.close") }}
       </OButton>
-      <OButton
+      <OTooltip
         v-if="variant === 'compact'"
-        variant="primary"
-        size="sm-action"
-        icon-left="open-in-new"
-        data-test="first-data-panel-arrived-open-btn"
-        @click="emit('open')"
+        :content="lockedReason(arrivedFeature ?? '')"
+        :disabled="!arrivedLocked"
       >
-        {{ arrivedOpenLabel }}
-      </OButton>
+        <span class="inline-flex">
+          <OButton
+            variant="primary"
+            size="sm-action"
+            :icon-left="arrivedLocked ? 'lock' : 'open-in-new'"
+            :disabled="arrivedLocked"
+            data-test="first-data-panel-arrived-open-btn"
+            @click="emit('open')"
+          >
+            {{ arrivedOpenLabel }}
+          </OButton>
+        </span>
+      </OTooltip>
     </template>
   </OBanner>
 
diff --git a/web/src/components/ingestion/FirstEventStatus.spec.ts b/web/src/components/ingestion/FirstEventStatus.spec.ts
index 2427714131..245b6491f2 100644
--- a/web/src/components/ingestion/FirstEventStatus.spec.ts
+++ b/web/src/components/ingestion/FirstEventStatus.spec.ts
@@ -18,6 +18,7 @@ import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
 import { createStore } from "vuex";
 import { createMemoryHistory, createRouter } from "vue-router";
 import i18n from "@/locales";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import type {
   FirstEventDiagnosis,
   FirstEventResult,
@@ -357,6 +358,30 @@ describe("FirstEventStatus — received", () => {
     localStorage.clear();
   });
 
+  it("disables Open in Traces with a lock while the traces license is locked", async () => {
+    mountBar({}, { zoConfig: { features: { traces: "locked" } } });
+    fake.result.value = { ...result, streamType: "traces" };
+    fake.state.value = "received";
+    await nextTick();
+    const btn = q("first-event-status-open-btn");
+    expect(btn.attributes("disabled")).toBeDefined();
+    expect(btn.findAllComponents(OIcon).map((i) => i.props("name"))).toContain("lock");
+    await btn.trigger("click");
+    await flushPromises();
+    expect(router.currentRoute.value.name).not.toBe("traces");
+  });
+
+  it("keeps Open in Logs live when only traces is locked", async () => {
+    mountBar({}, { zoConfig: { features: { traces: "locked" } } });
+    fake.result.value = result;
+    fake.state.value = "received";
+    await nextTick();
+    expect(q("first-event-status-open-btn").attributes("disabled")).toBeUndefined();
+    await q("first-event-status-open-btn").trigger("click");
+    await flushPromises();
+    expect(router.currentRoute.value.name).toBe("logs");
+  });
+
   it("reads Test event received with Connect your real source primary on a test guide", async () => {
     mountBar({ kind: "test", guideRoute: "recommended" });
     fake.result.value = { ...result, count: 1 };
diff --git a/web/src/components/ingestion/FirstEventStatus.vue b/web/src/components/ingestion/FirstEventStatus.vue
index 37fbe260d8..2e3de3718b 100644
--- a/web/src/components/ingestion/FirstEventStatus.vue
+++ b/web/src/components/ingestion/FirstEventStatus.vue
@@ -23,6 +23,9 @@ import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OText from "@/lib/core/Typography/OText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import config from "@/aws-exports";
 import analytics from "@/services/product_analytics";
 import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
@@ -305,6 +308,9 @@ const openLabel = computed(() => {
   if (type === "profiles") return t("ingestion.firstEvent.openInProfiles");
   return t("ingestion.firstEvent.openInLogs");
 });
+const { isLocked, lockedReason } = useLicenseLocks();
+const openFeature = computed(() => streamTypeFeature(result.value?.streamType));
+const openLocked = computed(() => isLocked(openFeature.value));
 
 const firstRecordJson = computed(() => {
   const record = result.value?.firstRecord;
@@ -676,15 +682,20 @@ defineExpose({ start: watcher.start, probeNow: watcher.probeNow });
             {{ t("ingestion.firstEvent.checkNow") }}
           </OButton>
           <template v-if="state === 'received' && kind === 'test'">
-            <OButton
-              variant="outline"
-              size="sm-action"
-              icon-left="open-in-new"
-              data-test="first-event-status-open-btn"
-              @click="openData"
-            >
-              {{ openLabel }}
-            </OButton>
+            <OTooltip :content="lockedReason(openFeature ?? '')" :disabled="!openLocked">
+              <span class="inline-flex">
+                <OButton
+                  variant="outline"
+                  size="sm-action"
+                  :icon-left="openLocked ? 'lock' : 'open-in-new'"
+                  :disabled="openLocked"
+                  data-test="first-event-status-open-btn"
+                  @click="openData"
+                >
+                  {{ openLabel }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
               variant="primary"
               size="sm-action"
@@ -703,15 +714,20 @@ defineExpose({ start: watcher.start, probeNow: watcher.probeNow });
             >
               {{ t("ingestion.firstEvent.setupAnother") }}
             </OButton>
-            <OButton
-              variant="primary"
-              size="sm-action"
-              icon-left="open-in-new"
-              data-test="first-event-status-open-btn"
-              @click="openData"
-            >
-              {{ openLabel }}
-            </OButton>
+            <OTooltip :content="lockedReason(openFeature ?? '')" :disabled="!openLocked">
+              <span class="inline-flex">
+                <OButton
+                  variant="primary"
+                  size="sm-action"
+                  :icon-left="openLocked ? 'lock' : 'open-in-new'"
+                  :disabled="openLocked"
+                  data-test="first-event-status-open-btn"
+                  @click="openData"
+                >
+                  {{ openLabel }}
+                </OButton>
+              </span>
+            </OTooltip>
           </template>
         </div>
       </template>
diff --git a/web/src/components/ingestion/FirstSourcePickGroup.vue b/web/src/components/ingestion/FirstSourcePickGroup.vue
index 0e821e11ba..74e9dee3b8 100644
--- a/web/src/components/ingestion/FirstSourcePickGroup.vue
+++ b/web/src/components/ingestion/FirstSourcePickGroup.vue
@@ -33,6 +33,7 @@ defineProps<{
   tab: FirstSourcePickTab;
   /** Heading over the rest of the rail. */
   restLabel: I18nText;
+  locked?: boolean;
 }>();
 
 const { t } = useI18nTyped();
@@ -51,6 +52,7 @@ const { t } = useI18nTyped();
     :to="tab.to"
     :icon="tab.icon"
     :label="tab.label"
+    :suffix-icon="locked ? 'lock' : undefined"
     :data-test="`ingestion-${rail}-pick-tab-${tab.name}`"
   />
   <div
diff --git a/web/src/components/ingestion/McpCrossLink.vue b/web/src/components/ingestion/McpCrossLink.vue
index d0a4d36442..90894a19ce 100644
--- a/web/src/components/ingestion/McpCrossLink.vue
+++ b/web/src/components/ingestion/McpCrossLink.vue
@@ -29,8 +29,11 @@ import { useStore } from "vuex";
 import { useRouter } from "vue-router";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
+const { locked: mcpLocked, lockedReason: mcpLockedReason } = useLicenseLock("mcp");
 const store = useStore();
 const router = useRouter();
 
@@ -64,7 +67,26 @@ const goToMcp = () => {
           })
         }}
       </p>
-      <OButton variant="primary" size="sm-action" data-test="mcp-cross-link-btn" @click="goToMcp">
+      <OTooltip v-if="mcpLocked" :content="mcpLockedReason">
+        <span class="inline-flex">
+          <OButton
+            variant="primary"
+            size="sm-action"
+            icon-left="lock"
+            disabled
+            data-test="mcp-cross-link-btn"
+          >
+            {{ t("ingestion.mcp.crossLinkCta") }}
+          </OButton>
+        </span>
+      </OTooltip>
+      <OButton
+        v-else
+        variant="primary"
+        size="sm-action"
+        data-test="mcp-cross-link-btn"
+        @click="goToMcp"
+      >
         {{ t("ingestion.mcp.crossLinkCta") }}
         <OIcon name="arrow-forward" size="sm" />
       </OButton>
diff --git a/web/src/components/ingestion/Recommended.spec.ts b/web/src/components/ingestion/Recommended.spec.ts
index 288736cdda..faa6b9709e 100644
--- a/web/src/components/ingestion/Recommended.spec.ts
+++ b/web/src/components/ingestion/Recommended.spec.ts
@@ -364,6 +364,80 @@ describe("Recommended: Get started pick", () => {
     wrapper.unmount();
   });
 
+  describe("license-gated guides", () => {
+    const mountLicensed = async (features: Record<string, string>) => {
+      const store = createStore({
+        state: {
+          selectedOrganization: { identifier: ORG },
+          userInfo: { email: "test@example.com" },
+          zoConfig: { ai_enabled: false, features },
+        },
+      });
+      const router = createRouter({
+        history: createWebHistory(),
+        routes: guides.map((name) => ({
+          path: `/${name}`,
+          name,
+          component: { template: "<div />" },
+        })),
+      });
+      await router.push("/ingestFromLinux");
+      await router.isReady();
+      const wrapper = mount(Recommended, {
+        global: { plugins: [i18n, store, router], stubs: { "router-view": true } },
+      });
+      await flushPromises();
+      return wrapper;
+    };
+    const tab = (wrapper: ReturnType<typeof mount>, name: string) =>
+      wrapper.find(`[data-test="ingestion-recommended-tab-${name}"]`);
+
+    it.each([
+      ["frontendMonitoring", "rum"],
+      ["recommendedMcp", "mcp"],
+    ])("keeps the %s tab with a lock when %s is locked", async (name, feature) => {
+      localStorage.clear();
+      const wrapper = await mountLicensed({ [feature]: "locked" });
+      expect(tab(wrapper, name).exists()).toBe(true);
+      expect(tab(wrapper, name).find(".lock-chip").exists()).toBe(true);
+      expect(tab(wrapper, "ingestFromLinux").find(".lock-chip").exists()).toBe(false);
+      wrapper.unmount();
+    });
+
+    it.each([
+      ["rum", "frontendMonitoring"],
+      ["agent", "recommendedMcp"],
+    ])("keeps the lock on a pinned %s pick", async (pick, name) => {
+      localStorage.setItem(`o2.onboarding.firstSource.${ORG}`, pick);
+      const wrapper = await mountLicensed({ [pick === "rum" ? "rum" : "mcp"]: "locked" });
+      const pinned = wrapper.find(`[data-test="ingestion-recommended-pick-tab-${name}"]`);
+      expect(pinned.find(".lock-chip").exists()).toBe(true);
+      wrapper.unmount();
+    });
+
+    it.each([
+      ["frontendMonitoring", "rum"],
+      ["recommendedMcp", "mcp"],
+    ])("drops the %s tab when %s is hidden", async (name, feature) => {
+      localStorage.clear();
+      const wrapper = await mountLicensed({ [feature]: "hidden" });
+      expect(tab(wrapper, name).exists()).toBe(false);
+      wrapper.unmount();
+    });
+
+    it("shows both guides without a lock when the license enables them", async () => {
+      localStorage.clear();
+      const wrapper = await mountLicensed({});
+      for (const name of ["frontendMonitoring", "recommendedMcp"]) {
+        expect(tab(wrapper, name).exists()).toBe(true);
+        expect(tab(wrapper, name).find(".lock-chip").exists()).toBe(false);
+      }
+      // No pick: no route name leaks as a native tooltip.
+      expect(wrapper.findAll('[data-test^="ingestion-recommended-tab-"][title]')).toHaveLength(0);
+      wrapper.unmount();
+    });
+  });
+
   it("pins nothing for Not sure yet or a pick stored for another org", async () => {
     localStorage.setItem(`o2.onboarding.firstSource.${ORG}`, "unsure");
     localStorage.setItem("o2.onboarding.firstSource.other", "kubernetes");
diff --git a/web/src/components/ingestion/Recommended.vue b/web/src/components/ingestion/Recommended.vue
index a7095849a3..8561ed1e7c 100644
--- a/web/src/components/ingestion/Recommended.vue
+++ b/web/src/components/ingestion/Recommended.vue
@@ -25,23 +25,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     panel-data-test="data-sources-recommended-tabs"
     tab-data-test-prefix="ingestion-recommended-tab-"
   >
-    <template v-if="pickTab" #tabs="{ tabs, filter }">
-      <FirstSourcePickGroup
-        v-if="pickMatches(filter)"
-        rail="recommended"
-        :tab="pickTab"
-        :rest-label="t('ingestion.firstSource.recommended')"
-      />
-      <ORouteTab
-        v-for="tab in tabs.filter((tab) => tab.name !== pickTab?.name)"
-        :key="tab.name"
-        :title="tab.title || tab.name"
-        :name="tab.name"
-        :to="tab.to"
-        :icon="tab.icon"
-        :label="tab.label"
-        :data-test="`ingestion-recommended-tab-${tab.name}`"
-      />
+    <template #tabs="{ tabs, filter }">
+      <!-- The rail only navigates, so a license-locked guide still lets the reader move to a free one. -->
+      <FeatureLockExempt class="contents">
+        <FirstSourcePickGroup
+          v-if="pickTab && pickMatches(filter)"
+          rail="recommended"
+          :tab="pickTab"
+          :rest-label="t('ingestion.firstSource.recommended')"
+          :locked="lockedTabs.has(pickTab.name)"
+        />
+        <ORouteTab
+          v-for="tab in tabs.filter((tab) => tab.name !== pickTab?.name)"
+          :key="tab.name"
+          :title="pickTab ? tab.title || tab.name : undefined"
+          :name="tab.name"
+          :to="tab.to"
+          :icon="tab.icon"
+          :label="tab.label"
+          :suffix-icon="lockedTabs.has(tab.name) ? 'lock' : undefined"
+          :data-test="`ingestion-recommended-tab-${tab.name}`"
+        />
+      </FeatureLockExempt>
     </template>
     <div class="h-full w-full">
       <div class="bg-card-glass-bg h-full">
@@ -67,10 +72,12 @@ import config from "@/aws-exports";
 import { getImageURL, verifyOrganizationStatus } from "@/utils/zincutils";
 import { resolveTab } from "@/utils/routeTabMaps";
 import { firstSourceOption, readFirstSource } from "@/components/login/firstSourceOptions";
+import { featureState } from "@/utils/featureGate";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 
 export default defineComponent({
   name: "RecommendedPage",
-  components: { DataSourceSidebarLayout, ORouteTab, FirstSourcePickGroup },
+  components: { DataSourceSidebarLayout, ORouteTab, FirstSourcePickGroup, FeatureLockExempt },
   props: {
     currOrgIdentifier: {
       type: String,
@@ -250,13 +257,29 @@ export default defineComponent({
       contentClass: "tab_content",
     });
 
+    // Guides owned by a license feature: locked keeps the tab with a lock, hidden drops it.
+    const LICENSED_TABS: Record<string, string> = {
+      frontendMonitoring: "rum",
+      recommendedMcp: "mcp",
+    };
+    const tabState = (name: string) =>
+      LICENSED_TABS[name]
+        ? featureState(store.state.zoConfig?.features, LICENSED_TABS[name])
+        : "enabled";
+    const licensedTabs = computed(() =>
+      recommendedTabs.filter((tab) => tabState(tab.name) !== "hidden"),
+    );
+    const lockedTabs = computed(
+      () => new Set(recommendedTabs.map((tab) => tab.name).filter((n) => tabState(n) === "locked")),
+    );
+
     // A pick from another category links across to its guide.
     const pickTab = computed(() => {
       const option = firstSourceOption(
         readFirstSource(store.state.selectedOrganization.identifier),
       );
       if (!option?.route) return undefined;
-      const listed = recommendedTabs.find((tab) => tab.name === option.route);
+      const listed = licensedTabs.value.find((tab) => tab.name === option.route);
       if (listed) return listed;
       return {
         name: option.route,
@@ -284,7 +307,8 @@ export default defineComponent({
       verifyOrganizationStatus,
       tabs,
       ingestTabType,
-      recommendedTabs,
+      recommendedTabs: licensedTabs,
+      lockedTabs,
       pickTab,
       pickMatches,
     };
diff --git a/web/src/components/ingestion/ai/McpServerCard.spec.ts b/web/src/components/ingestion/ai/McpServerCard.spec.ts
index 471856dcf2..744d76a734 100644
--- a/web/src/components/ingestion/ai/McpServerCard.spec.ts
+++ b/web/src/components/ingestion/ai/McpServerCard.spec.ts
@@ -178,6 +178,39 @@ describe("McpServerCard", () => {
       expect(wrapper.find('[data-test="ai-integrations-mcp-generate-btn"]').exists()).toBe(false);
     });
 
+    it("disables Generate with a lock and mints nothing when mcp is license-locked", async () => {
+      const wrapper = mountCard({ features: { mcp: "locked" } });
+
+      const btn = wrapper
+        .findAllComponents({ name: "OButton" })
+        .find((b) => b.attributes("data-test") === "ai-integrations-mcp-generate-btn")!;
+      expect(btn.props("disabled")).toBe(true);
+      expect(btn.props("iconLeft")).toBe("lock");
+      await btn.trigger("click");
+      expect(mcp.generate).not.toHaveBeenCalled();
+    });
+
+    it("disables Manage with a lock when mcp is license-locked", () => {
+      mcp.credential = CREDENTIAL;
+      const wrapper = mountCard({ features: { mcp: "locked" } });
+
+      const btn = wrapper
+        .findAllComponents({ name: "OButton" })
+        .find((b) => b.attributes("data-test") === "ai-integrations-mcp-manage-btn")!;
+      expect(btn.props("disabled")).toBe(true);
+      expect(btn.props("iconLeft")).toBe("lock");
+    });
+
+    it("keeps Generate live when mcp is enabled", () => {
+      const wrapper = mountCard({ features: { mcp: "enabled" } });
+
+      const btn = wrapper
+        .findAllComponents({ name: "OButton" })
+        .find((b) => b.attributes("data-test") === "ai-integrations-mcp-generate-btn")!;
+      expect(btn.props("disabled")).toBeFalsy();
+      expect(btn.props("iconLeft")).toBeUndefined();
+    });
+
     it("mints once per click", async () => {
       const wrapper = mountCard();
 
diff --git a/web/src/components/ingestion/ai/McpServerCard.vue b/web/src/components/ingestion/ai/McpServerCard.vue
index 35ef6ccecd..cac6efbdbc 100644
--- a/web/src/components/ingestion/ai/McpServerCard.vue
+++ b/web/src/components/ingestion/ai/McpServerCard.vue
@@ -51,6 +51,8 @@ import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
 import OText from "@/lib/core/Typography/OText.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import SetupCardRenderer from "@/components/ingestion/setupCard/SetupCardRenderer.vue";
 import type { RichCardContent } from "@/components/ingestion/setupCard/types";
 
@@ -63,6 +65,7 @@ const { t } = useI18nTyped();
 const store = useStore();
 const router = useRouter();
 const { generate, generating, error: genError, credential } = useMcpCredential();
+const { locked: mcpLocked, lockedReason: mcpLockedReason } = useLicenseLock("mcp");
 
 const endpoint = computed(() => `${props.subs.url}/api/${props.subs.org}/mcp`);
 
@@ -508,7 +511,21 @@ const openSkillsRepo = () => {
                 </OText>
               </div>
               <template #actions>
+                <OTooltip v-if="mcpLocked" :content="mcpLockedReason">
+                  <span class="inline-flex">
+                    <OButton
+                      variant="primary"
+                      size="sm-action"
+                      icon-left="lock"
+                      disabled
+                      data-test="ai-integrations-mcp-generate-btn"
+                    >
+                      {{ t("ingestion.mcp.credential.generate") }}
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
+                  v-else
                   variant="primary"
                   size="sm-action"
                   :loading="generating"
@@ -568,7 +585,21 @@ const openSkillsRepo = () => {
               >
                 {{ t("ingestion.mcp.credential.download") }}
               </OButton>
+              <OTooltip v-if="mcpLocked" :content="mcpLockedReason">
+                <span class="inline-flex">
+                  <OButton
+                    variant="ghost"
+                    size="sm-action"
+                    icon-left="lock"
+                    disabled
+                    data-test="ai-integrations-mcp-manage-btn"
+                  >
+                    {{ t("ingestion.mcp.credential.manage") }}
+                  </OButton>
+                </span>
+              </OTooltip>
               <OButton
+                v-else
                 variant="ghost"
                 size="sm-action"
                 icon-left="open-in-new"
diff --git a/web/src/components/ingestion/recommended/AWSIntegrationTile.spec.ts b/web/src/components/ingestion/recommended/AWSIntegrationTile.spec.ts
index 7c78a0bc7b..34ebf566b6 100644
--- a/web/src/components/ingestion/recommended/AWSIntegrationTile.spec.ts
+++ b/web/src/components/ingestion/recommended/AWSIntegrationTile.spec.ts
@@ -215,6 +215,22 @@ describe("AWSIntegrationTile.vue", () => {
       expect(dashboardBtn.exists()).toBe(true);
     });
 
+    it("locks Add Dashboard and fetches nothing when dashboards are license-locked", async () => {
+      (mockStore.state as any).zoConfig = { features: { dashboards: "locked" } };
+      try {
+        wrapper = createWrapper();
+        const btn = wrapper
+          .findAllComponents({ name: "OButton" })
+          .find((b) => b.attributes("data-test") === "aws-cloudwatch-logs-add-dashboard-btn")!;
+        expect(btn.props("disabled")).toBe(true);
+        expect(btn.props("iconLeft")).toBe("lock");
+        await (wrapper.vm as any).handleAddDashboard();
+        expect(fetch).not.toHaveBeenCalled();
+      } finally {
+        delete (mockStore.state as any).zoConfig;
+      }
+    });
+
     it("should render documentation button when documentationUrl present", () => {
       wrapper = createWrapper();
       const docsBtn = wrapper.find('[data-test="aws-cloudwatch-logs-docs-btn"]');
diff --git a/web/src/components/ingestion/recommended/AWSIntegrationTile.vue b/web/src/components/ingestion/recommended/AWSIntegrationTile.vue
index eefce36e44..f7e4f475b8 100644
--- a/web/src/components/ingestion/recommended/AWSIntegrationTile.vue
+++ b/web/src/components/ingestion/recommended/AWSIntegrationTile.vue
@@ -62,7 +62,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >{{ t("ingestion.awsSetup.documentation") }}</OButton
       >
       <!-- Add Dashboard Button -->
+      <OTooltip v-if="dashboardsLocked" :content="dashboardsLockedReason">
+        <span class="inline-flex flex-1">
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="lock"
+            disabled
+            class="flex-1"
+            :data-test="`aws-${integration.id}-add-dashboard-btn`"
+            >{{ t("ingestion.awsSetup.addDashboard") }}</OButton
+          >
+        </span>
+      </OTooltip>
       <OButton
+        v-else
         variant="outline"
         size="sm"
         @click="handleAddDashboard"
@@ -177,6 +191,7 @@ import WindowsConfig from "./WindowsConfig.vue";
 import LinuxConfig from "./LinuxConfig.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 export default defineComponent({
   name: "AWSIntegrationTile",
@@ -194,6 +209,8 @@ export default defineComponent({
     const router = useRouter();
     const dashboardOrgId = useOrgId();
     const createDashboard = useMutation(() => createDashboardMutation(dashboardOrgId.value));
+    const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+      useLicenseLock("dashboards");
     const showTemplateDialog = ref(false);
     const showComponentContent = ref(false);
     const selectedComponent = shallowRef<any>(null);
@@ -423,7 +440,11 @@ export default defineComponent({
     };
 
     const handleAddDashboard = async () => {
-      if (!props.integration.hasDashboard || !props.integration.dashboardGithubUrl) {
+      if (
+        dashboardsLocked.value ||
+        !props.integration.hasDashboard ||
+        !props.integration.dashboardGithubUrl
+      ) {
         return;
       }
 
@@ -581,6 +602,8 @@ export default defineComponent({
       store,
       handleAddSource,
       handleAddDashboard,
+      dashboardsLocked,
+      dashboardsLockedReason,
       handleDocumentation,
       handleTemplateSelection,
       handleComponentSelection,
diff --git a/web/src/components/ingestion/setupCard/DataSourceSetupCard.spec.ts b/web/src/components/ingestion/setupCard/DataSourceSetupCard.spec.ts
index dfa252aad2..ff398efdcf 100644
--- a/web/src/components/ingestion/setupCard/DataSourceSetupCard.spec.ts
+++ b/web/src/components/ingestion/setupCard/DataSourceSetupCard.spec.ts
@@ -81,9 +81,10 @@ describe("DataSourceSetupCard — host metrics auto-import wiring", () => {
   let store: any;
   let router: any;
 
-  const mountCard = (slug: string, passcode = "pc") => {
+  const mountCard = (slug: string, passcode = "pc", features: Record<string, string> = {}) => {
     store = createStore({
       state: {
+        zoConfig: { features },
         selectedOrganization: { identifier: "test-org" },
         userInfo: { email: "t@e.com" },
         organizationData: { organizationPasscode: passcode },
@@ -148,6 +149,51 @@ describe("DataSourceSetupCard — host metrics auto-import wiring", () => {
     expect(unavailableBanner().exists()).toBe(true);
   });
 
+  describe("license locks", () => {
+    const stepAction = (id: string) =>
+      renderer()
+        .props("content")
+        .steps.find((s: any) => s.action?.id === id)?.action;
+
+    it("skips the auto-import and locks the dashboard action when dashboards are locked", async () => {
+      wrapper = mountCard("linux", "pc", { dashboards: "locked" });
+      renderer().vm.$emit("detected", 4);
+      renderer().vm.$emit("step-action", "view-host-dashboard");
+      await flushPromises();
+
+      expect(importHostMetricsDashboard).not.toHaveBeenCalled();
+      expect(toastMock).not.toHaveBeenCalled();
+      expect(stepAction("view-host-dashboard")).toMatchObject({ disabled: true, icon: "lock" });
+      expect(stepAction("view-host-dashboard").disabledReason).toBeTruthy();
+    });
+
+    it("skips the companion dashboard import when dashboards are locked", async () => {
+      wrapper = mountCard("nvidiaDcgm", "pc", { dashboards: "locked" });
+      renderer().vm.$emit("detected", 1);
+      renderer().vm.$emit("step-action", "open-setup-dashboard");
+      await flushPromises();
+
+      expect(importSetupDashboard).not.toHaveBeenCalled();
+      expect(stepAction("open-setup-dashboard")).toMatchObject({ disabled: true, icon: "lock" });
+    });
+
+    it("drops the View hosts toast action when host monitoring is locked", async () => {
+      wrapper = mountCard("linux", "pc", { host_monitoring: "locked" });
+      renderer().vm.$emit("detected", 4);
+      await flushPromises();
+
+      expect(importHostMetricsDashboard).toHaveBeenCalledTimes(1);
+      expect(toastMock.mock.calls[0][0].action).toBeUndefined();
+    });
+
+    it("leaves the dashboard action untouched when dashboards are enabled", () => {
+      wrapper = mountCard("linux", "pc", { dashboards: "enabled" });
+
+      expect(stepAction("view-host-dashboard").disabled).toBeFalsy();
+      expect(stepAction("view-host-dashboard").disabledReason).toBeUndefined();
+    });
+  });
+
   it.each(["linux", "windows", "macos"])(
     "imports the host dashboard when detection connects on the %s card",
     async (slug) => {
diff --git a/web/src/components/ingestion/setupCard/DataSourceSetupCard.vue b/web/src/components/ingestion/setupCard/DataSourceSetupCard.vue
index affe4d7db8..517dbd09a2 100644
--- a/web/src/components/ingestion/setupCard/DataSourceSetupCard.vue
+++ b/web/src/components/ingestion/setupCard/DataSourceSetupCard.vue
@@ -39,6 +39,7 @@ import {
   importSetupDashboard,
 } from "@/composables/useSetupDashboardImport";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import CredentialCodeBlock from "@/components/ingestion/CredentialCodeBlock.vue";
 import IngestionDocLink from "@/components/ingestion/IngestionDocLink.vue";
 import SetupCardRenderer from "./SetupCardRenderer.vue";
@@ -90,7 +91,31 @@ const tokenState = computed<IngestTokenState>(() => {
 
 // Inside onboarding, its tracing answer shapes the card (the Kubernetes tracing step).
 const onboarding = inject(SETUP_CARD_ONBOARDING, null);
-const content = computed(() => getDataSourceCard(props.slug, subs.value, t, onboarding?.value));
+const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+  useLicenseLock("dashboards");
+const { locked: hostsLocked } = useLicenseLock("host_monitoring");
+const DASHBOARD_ACTIONS = new Set(["view-host-dashboard", "open-setup-dashboard"]);
+
+const content = computed(() => {
+  const card = getDataSourceCard(props.slug, subs.value, t, onboarding?.value);
+  if (!card || !dashboardsLocked.value) return card;
+  return {
+    ...card,
+    steps: card.steps.map((step) =>
+      step.action && DASHBOARD_ACTIONS.has(step.action.id)
+        ? {
+            ...step,
+            action: {
+              ...step.action,
+              icon: "lock" as const,
+              disabled: true,
+              disabledReason: dashboardsLockedReason.value,
+            },
+          }
+        : step,
+    ),
+  };
+});
 
 const passcodeForbidden = computed(
   () => !!store.state.organizationData?.organizationPasscodeForbidden,
@@ -172,6 +197,7 @@ const onOpenSetupDashboard = async () => {
 
 const onDetected = async (count: number) => {
   emit("detected", count);
+  if (dashboardsLocked.value) return;
   if (setupDashboard.value) return onSetupDashboardDetected();
   if (!isHostAgentSlug.value) return;
   // Captured at detect time — an org switch before the toast click must not retarget.
@@ -188,14 +214,17 @@ const onDetected = async (count: number) => {
         : "ingestion.setupCard.hostDashboardExists",
     ),
     timeout: 5000,
-    action: {
-      label: t("ingestion.setupCard.viewHosts"),
-      handler: () => router.push({ path: "/infra/hosts", query: { org_identifier: org } }),
-    },
+    action: hostsLocked.value
+      ? undefined
+      : {
+          label: t("ingestion.setupCard.viewHosts"),
+          handler: () => router.push({ path: "/infra/hosts", query: { org_identifier: org } }),
+        },
   });
 };
 
 const onStepAction = async (actionId: string) => {
+  if (dashboardsLocked.value && DASHBOARD_ACTIONS.has(actionId)) return;
   if (actionId === "open-setup-dashboard") return onOpenSetupDashboard();
   if (actionId !== "view-host-dashboard" || !isHostAgentSlug.value) return;
   const org = store.state.selectedOrganization?.identifier ?? "";
diff --git a/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts b/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
index c7a53abfff..b2aa1fd2eb 100644
--- a/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
+++ b/web/src/components/ingestion/setupCard/SetupCardRenderer.spec.ts
@@ -481,6 +481,32 @@ describe("SetupCardRenderer — first-event bar, detected emit & showOnDetect ac
     expect(wrapper.find('[data-test="ai-step-action-launch-console"]').exists()).toBe(true);
   });
 
+  it("renders an action with a disabledReason disabled and emits nothing on click", async () => {
+    const content: RichCardContent = {
+      ...CONTENT,
+      steps: [
+        {
+          ...CONTENT.steps[0],
+          action: {
+            id: "launch-console",
+            label: "Launch",
+            icon: "lock",
+            disabled: true,
+            disabledReason: "Locked" as never,
+          },
+        },
+        CONTENT.steps[1],
+      ],
+    };
+    wrapper = mountCard(content);
+    const btn = wrapper
+      .findAllComponents({ name: "OButton" })
+      .find((b) => b.attributes("data-test") === "ai-step-action-launch-console")!;
+    expect(btn.props("disabled")).toBe(true);
+    await btn.trigger("click");
+    expect(wrapper.emitted("step-action")).toBeUndefined();
+  });
+
   it("shows the most-likely-fix box only once the bar has a diagnosis, and rechecks through the bar", async () => {
     const content: RichCardContent = {
       ...CONTENT,
diff --git a/web/src/components/ingestion/setupCard/SetupCardRenderer.vue b/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
index 8a639c1789..8a0b14f1e9 100644
--- a/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
+++ b/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
@@ -912,7 +912,21 @@ function fireConfetti() {
                 v-if="step.action && (!step.action.showOnDetect || detected)"
                 class="step-action"
               >
+                <OTooltip v-if="step.action.disabledReason" :content="step.action.disabledReason">
+                  <span class="inline-flex">
+                    <OButton
+                      :variant="step.action.variant || 'primary'"
+                      size="sm-action"
+                      :icon-left="step.action.icon"
+                      disabled
+                      :data-test="`ai-step-action-${step.action.id}`"
+                    >
+                      {{ step.action.label }}
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
+                  v-else
                   :variant="step.action.variant || 'primary'"
                   size="sm-action"
                   :icon-left="step.action.icon"
diff --git a/web/src/components/ingestion/setupCard/types.ts b/web/src/components/ingestion/setupCard/types.ts
index a3a53bac34..16f828dee7 100644
--- a/web/src/components/ingestion/setupCard/types.ts
+++ b/web/src/components/ingestion/setupCard/types.ts
@@ -171,6 +171,8 @@ export interface RichCardStepAction {
   variant?: "primary" | "secondary";
   /** Greys the button out — e.g. nothing selected yet. */
   disabled?: boolean;
+  /** Also disables the button: the renderer wraps it so the reason still shows on hover. */
+  disabledReason?: I18nText;
   /** Render the button only once detection connects (default: always visible). */
   showOnDetect?: boolean;
 }
diff --git a/web/src/components/login/WelcomeChoices.vue b/web/src/components/login/WelcomeChoices.vue
index d391bb6a19..f5630c7617 100644
--- a/web/src/components/login/WelcomeChoices.vue
+++ b/web/src/components/login/WelcomeChoices.vue
@@ -43,31 +43,40 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           class="grid h-[10.25rem] grid-cols-3 content-between gap-2"
           data-test="onboarding-get-started-chips"
         >
-          <button
+          <OTooltip
             v-for="option in chipOptions"
             :key="option.id"
-            type="button"
-            class="border-border-default bg-surface-base text-text-body hover:border-accent rounded-default flex h-10 min-w-0 cursor-pointer items-center gap-2 border px-2 text-left text-xs font-medium transition hover:-translate-y-px"
-            :title="t(option.labelKey)"
-            :data-test="`onboarding-get-started-source-${option.id}`"
-            @click="emit('pick', option.id)"
+            :content="option.lockedReason"
+            :disabled="!option.lockedReason"
           >
-            <span
-              class="bg-surface-subtle rounded-default flex size-6 shrink-0 items-center justify-center"
-            >
-              <img
-                v-if="option.logo"
-                :src="getImageURL(option.logo)"
-                alt=""
-                class="size-4"
-                :class="{ 'dark:invert': option.logoInvertDark }"
-              />
-              <OIcon v-else-if="option.icon" :name="option.icon" size="xs" />
+            <span class="flex min-w-0">
+              <button
+                type="button"
+                class="border-border-default bg-surface-base text-text-body hover:border-accent rounded-default flex h-10 w-full min-w-0 cursor-pointer items-center gap-2 border px-2 text-left text-xs font-medium transition hover:-translate-y-px disabled:cursor-not-allowed disabled:opacity-60 disabled:hover:translate-y-0"
+                :title="option.lockedReason ? undefined : t(option.labelKey)"
+                :disabled="!!option.lockedReason"
+                :data-test="`onboarding-get-started-source-${option.id}`"
+                @click="emit('pick', option.id)"
+              >
+                <span
+                  class="bg-surface-subtle rounded-default flex size-6 shrink-0 items-center justify-center"
+                >
+                  <OIcon v-if="option.lockedReason" name="lock" size="xs" class="lock-chip" />
+                  <img
+                    v-else-if="option.logo"
+                    :src="getImageURL(option.logo)"
+                    alt=""
+                    class="size-4"
+                    :class="{ 'dark:invert': option.logoInvertDark }"
+                  />
+                  <OIcon v-else-if="option.icon" :name="option.icon" size="xs" />
+                </span>
+                <span class="line-clamp-2 leading-tight">{{
+                  t(`login.getStarted.chips.${option.id}`)
+                }}</span>
+              </button>
             </span>
-            <span class="line-clamp-2 leading-tight">{{
-              t(`login.getStarted.chips.${option.id}`)
-            }}</span>
-          </button>
+          </OTooltip>
         </div>
         <OButton
           variant="primary"
@@ -129,6 +138,8 @@ import { computed } from "vue";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 import { FIRST_SOURCE_OPTIONS, type FirstSourceId } from "./firstSourceOptions";
 import { useI18nTyped, type I18nText } from "@/types/i18n";
 import { getImageURL } from "@/utils/zincutils";
@@ -141,7 +152,16 @@ const HIDDEN_CHIPS: readonly FirstSourceId[] = ["sample", "unsure", "http"];
 
 const { t } = useI18nTyped();
 
-const chipOptions = FIRST_SOURCE_OPTIONS.filter((option) => !HIDDEN_CHIPS.includes(option.id));
+const { isLocked, lockedReason } = useLicenseLocks();
+
+// a source whose guide the license locks stays visible but cannot be picked
+const chipOptions = computed(() =>
+  FIRST_SOURCE_OPTIONS.filter((option) => !HIDDEN_CHIPS.includes(option.id)).map((option) => ({
+    ...option,
+    lockedReason:
+      option.feature && isLocked(option.feature) ? lockedReason(option.feature) : undefined,
+  })),
+);
 
 const connectPoints = computed<I18nText[]>(() => [
   t("login.getStarted.connect.point1"),
diff --git a/web/src/components/login/firstSourceOptions.spec.ts b/web/src/components/login/firstSourceOptions.spec.ts
index 4e62a19428..659564ec5e 100644
--- a/web/src/components/login/firstSourceOptions.spec.ts
+++ b/web/src/components/login/firstSourceOptions.spec.ts
@@ -24,6 +24,7 @@ import {
   docsReferrerSource,
   firstSourceOption,
   firstSourcePickRoute,
+  isFirstSourceLocked,
   prefillFirstSource,
   readFirstSource,
   readPrefill,
@@ -279,4 +280,17 @@ describe("firstSourceOptions", () => {
     expect(firstSourceOption("missing")).toBeUndefined();
     expect(firstSourceOption(null)).toBeUndefined();
   });
+
+  it("locks the agent and RUM options only while their feature is license-locked", () => {
+    const agent = firstSourceOption("agent")!;
+    const rum = firstSourceOption("rum")!;
+    const linux = firstSourceOption("linux")!;
+    const locked = { mcp: "locked", rum: "locked" } as const;
+
+    expect(isFirstSourceLocked(agent, locked)).toBe(true);
+    expect(isFirstSourceLocked(rum, locked)).toBe(true);
+    expect(isFirstSourceLocked(linux, locked)).toBe(false);
+    expect(isFirstSourceLocked(agent, { mcp: "enabled" })).toBe(false);
+    expect(isFirstSourceLocked(agent, undefined)).toBe(false);
+  });
 });
diff --git a/web/src/components/login/firstSourceOptions.ts b/web/src/components/login/firstSourceOptions.ts
index 7e4413eb80..990e35e3a6 100644
--- a/web/src/components/login/firstSourceOptions.ts
+++ b/web/src/components/login/firstSourceOptions.ts
@@ -16,6 +16,7 @@
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import type { I18nKey } from "@/types/i18n";
 import type { UserDataStreamType } from "@/utils/internalStreams";
+import { featureState, type FeatureStates } from "@/utils/featureGate";
 
 export type FirstSourceId =
   | "kubernetes"
@@ -44,6 +45,8 @@ export interface FirstSourceOption {
   icon?: IconName;
   /** Signals the picked guide sends. */
   signals: UserDataStreamType[];
+  /** License feature whose locked guide this option opens. */
+  feature?: string;
 }
 
 export interface FirstSourcePrefill {
@@ -109,6 +112,7 @@ export const FIRST_SOURCE_OPTIONS: readonly FirstSourceOption[] = Object.freeze(
     route: "frontendMonitoring",
     icon: "public",
     signals: ["logs"],
+    feature: "rum",
   },
   {
     id: "llm",
@@ -124,6 +128,7 @@ export const FIRST_SOURCE_OPTIONS: readonly FirstSourceOption[] = Object.freeze(
     route: "recommendedMcp",
     icon: "auto-awesome",
     signals: [],
+    feature: "mcp",
   },
   {
     id: "sample",
@@ -169,6 +174,13 @@ export function firstSourceOption(id: string | null | undefined): FirstSourceOpt
   return FIRST_SOURCE_OPTIONS.find((option) => option.id === id);
 }
 
+export function isFirstSourceLocked(
+  option: FirstSourceOption,
+  features: FeatureStates | undefined,
+): boolean {
+  return !!option.feature && featureState(features, option.feature) === "locked";
+}
+
 /** Maps an openobserve.ai docs URL to the option its guide belongs to. */
 export function docsReferrerSource(referrer: string | null | undefined): FirstSourceId | undefined {
   if (!referrer) return undefined;
diff --git a/web/src/components/logstream/schema.vue b/web/src/components/logstream/schema.vue
index 3ebe98a1d8..0067af8394 100644
--- a/web/src/components/logstream/schema.vue
+++ b/web/src/components/logstream/schema.vue
@@ -454,7 +454,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                               <OIcon
                                 :name="sdrAccess.allowed ? 'arrow-forward' : 'lock'"
                                 size="xs"
-                                :class="sdrAccess.allowed ? '' : 'text-warning-600'"
+                                :class="sdrAccess.allowed ? '' : 'lock-chip'"
                               />
                             </span>
                           </template>
diff --git a/web/src/components/oncall/OnCallOwnership.spec.ts b/web/src/components/oncall/OnCallOwnership.spec.ts
index 98fff90f69..4c3f4f760d 100644
--- a/web/src/components/oncall/OnCallOwnership.spec.ts
+++ b/web/src/components/oncall/OnCallOwnership.spec.ts
@@ -420,6 +420,51 @@ describe("OnCallOwnership", () => {
     expect(correlation.getDimensionAnalytics).toHaveBeenCalledTimes(1);
   });
 
+  it("skips the correlation reads while correlation is license-locked", async () => {
+    store.state.zoConfig.features = { correlation: "locked" };
+    try {
+      render();
+      await flushPromises();
+      expect(service.ownershipStats).toHaveBeenCalled();
+      expect(correlation.getServicesList).not.toHaveBeenCalled();
+      expect(correlation.getIdentityConfig).not.toHaveBeenCalled();
+      expect(correlation.getDimensionAnalytics).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("waits for a late config and makes no correlation read when it says locked", async () => {
+    const saved = store.state.zoConfig;
+    store.state.zoConfig = {} as any;
+    try {
+      render();
+      await flushPromises();
+      expect(correlation.getServicesList).not.toHaveBeenCalled();
+      store.state.zoConfig = { ...saved, features: { correlation: "locked" } } as any;
+      await flushPromises();
+      expect(correlation.getServicesList).not.toHaveBeenCalled();
+      expect(correlation.getIdentityConfig).not.toHaveBeenCalled();
+      expect(correlation.getDimensionAnalytics).not.toHaveBeenCalled();
+    } finally {
+      store.state.zoConfig = saved;
+    }
+  });
+
+  it("reads correlation once the late config lands unlocked", async () => {
+    const saved = store.state.zoConfig;
+    store.state.zoConfig = {} as any;
+    try {
+      render();
+      await flushPromises();
+      store.state.zoConfig = { ...saved } as any;
+      await flushPromises();
+      expect(correlation.getServicesList).toHaveBeenCalledTimes(1);
+    } finally {
+      store.state.zoConfig = saved;
+    }
+  });
+
   /// A team with no unrouted traffic and a server without the endpoint look
   /// identical from here, and neither deserves an error.
   it("survives an unrouted endpoint that is not there", async () => {
diff --git a/web/src/components/oncall/OnCallOwnership.vue b/web/src/components/oncall/OnCallOwnership.vue
index df731499f2..c115449489 100644
--- a/web/src/components/oncall/OnCallOwnership.vue
+++ b/web/src/components/oncall/OnCallOwnership.vue
@@ -73,7 +73,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted, ref } from "vue";
+import { computed, onMounted, ref, watch } from "vue";
 import { useStore } from "vuex";
 
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
@@ -111,6 +111,7 @@ import type {
 } from "@/ts/interfaces/oncall";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { identityDimensions, SERVICE_DIMENSION } from "@/utils/oncall";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const props = withDefaults(
   defineProps<{
@@ -124,6 +125,7 @@ const props = withDefaults(
 
 const { t } = useI18nTyped();
 const store = useStore();
+const { locked: correlationLocked } = useLicenseLock("correlation");
 
 const rules = ref<OwnershipRuleStats[]>([]);
 const signals = ref<UnroutedSignal[]>([]);
@@ -413,13 +415,25 @@ async function dismissSignal(signal: UnroutedSignal) {
   }
 }
 
+// Correlation reads wait for the org config: on a cold load it lands after mount, and empty reads as unlocked.
+let correlationRead = false;
+const configLoaded = computed(() => Object.keys(store.state.zoConfig ?? {}).length > 0);
+watch(
+  [configLoaded, correlationLocked],
+  ([loaded, locked]) => {
+    if (!loaded || locked || correlationRead) return;
+    correlationRead = true;
+    fetchCatalogue();
+    fetchServices();
+    fetchSets();
+  },
+  { immediate: true },
+);
+
 onMounted(() => {
   fetchRules();
   fetchSignals();
   fetchAliases();
-  fetchCatalogue();
-  fetchServices();
-  fetchSets();
   fetchRoutingConfig();
 });
 </script>
diff --git a/web/src/components/oncall/OnCallPhoneCard.spec.ts b/web/src/components/oncall/OnCallPhoneCard.spec.ts
index 614c4db795..505dfa9afa 100644
--- a/web/src/components/oncall/OnCallPhoneCard.spec.ts
+++ b/web/src/components/oncall/OnCallPhoneCard.spec.ts
@@ -18,6 +18,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import OnCallPhoneCard from "@/components/oncall/OnCallPhoneCard.vue";
 import i18n from "@/locales";
+import { queryClient } from "@/composables/query/queryClient";
 import oncallService from "@/services/oncall";
 import store from "@/test/unit/helpers/store";
 import type { Contact, RefusalReason, VerificationRefusalBody } from "@/ts/interfaces/oncall";
@@ -228,6 +229,23 @@ describe("OnCallPhoneCard", () => {
     expect(service.getContact).toHaveBeenCalledWith({ org_identifier: ORG, user_email: EMAIL });
   });
 
+  it("says nothing about a read the license refused, and still reports any other failure", async () => {
+    service.getContact.mockRejectedValue({
+      response: { status: 403, data: { code: 40001, error_detail: "oncall" } },
+    });
+    const denied = mount(OnCallPhoneCard, { global: { plugins: [i18n, store], stubs } });
+    await flushPromises();
+    expect(find(denied, "load-failed").exists()).toBe(false);
+    denied.unmount();
+
+    queryClient.clear();
+    service.getContact.mockRejectedValue({ response: { status: 403, data: {} } });
+    const failed = mount(OnCallPhoneCard, { global: { plugins: [i18n, store], stubs } });
+    await flushPromises();
+    expect(find(failed, "load-failed").exists()).toBe(true);
+    failed.unmount();
+  });
+
   it("empty: offers a number box and Send code", async () => {
     const w = await render(contact());
     expect(find(w, "input").exists()).toBe(true);
diff --git a/web/src/components/oncall/OnCallPhoneCard.vue b/web/src/components/oncall/OnCallPhoneCard.vue
index 625ebcc776..8ef753a642 100644
--- a/web/src/components/oncall/OnCallPhoneCard.vue
+++ b/web/src/components/oncall/OnCallPhoneCard.vue
@@ -246,6 +246,7 @@ import {
   refusalOf,
   samePhone,
 } from "@/utils/oncall";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 
 // The server's minimum gap between two codes for one number (R17).
 const RESEND_SECS = 60;
@@ -270,7 +271,10 @@ const contactRead = useQuery(() =>
   }),
 );
 const contact = computed(() => contactRead.data.value ?? null);
-const loadFailed = computed(() => contactRead.isError.value);
+// A license denial is not a failed read: the license bar already says why.
+const loadFailed = computed(
+  () => contactRead.isError.value && !licenseDeniedFeatures(contactRead.error.value),
+);
 
 const saveContact = useMutation(() => setContactMutation(orgId.value, email.value));
 const sendCodeWrite = useMutation(() => sendCodeMutation(orgId.value, email.value));
diff --git a/web/src/components/oncall/OnCallRuleEditor.vue b/web/src/components/oncall/OnCallRuleEditor.vue
index 2ff6560138..5b14b4e812 100644
--- a/web/src/components/oncall/OnCallRuleEditor.vue
+++ b/web/src/components/oncall/OnCallRuleEditor.vue
@@ -63,6 +63,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <OIcon name="info-outline" size="sm" class="cursor-help">
                 <OTooltip side="right" :content="t('oncall.ruleEditorConditionsHint')" />
               </OIcon>
+              <OIcon
+                v-if="correlationLocked"
+                name="lock"
+                size="sm"
+                class="lock-chip"
+                data-test="oncall-rule-editor-correlation-lock"
+              >
+                <OTooltip side="right" :content="correlationLockedReason" />
+              </OIcon>
             </span>
 
             <!-- The queue is where most rules come from, so its rows are one
@@ -428,6 +437,7 @@ import type {
 } from "@/ts/interfaces/oncall";
 import type { I18nText } from "@/types/i18n";
 import { raw, useI18nTyped } from "@/types/i18n";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import {
   SERVICE_DIMENSION,
   dimensionsSentence,
@@ -450,6 +460,10 @@ const SHOWN_MATCHES = 4;
 /// How much of the unrouted queue the "start from a signal" menu offers.
 const STARTABLE_SHOWN = 6;
 
+// Discovered services and dimension values come from the correlation API; manual entry still works when it is locked.
+const { locked: correlationLocked, lockedReason: correlationLockedReason } =
+  useLicenseLock("correlation");
+
 const props = withDefaults(
   defineProps<{
     open?: boolean;
@@ -537,12 +551,13 @@ const title = computed<I18nText>(() =>
 /// deployment starts.
 const scopeAvailable = computed(
   () =>
-    props.services.length > 0 ||
-    props.sets.some((set) =>
-      set.distinguish_by.some(
-        (dimension) => Object.keys(props.catalogue.values[dimension] ?? {}).length > 0,
-      ),
-    ),
+    !correlationLocked &&
+    (props.services.length > 0 ||
+      props.sets.some((set) =>
+        set.distinguish_by.some(
+          (dimension) => Object.keys(props.catalogue.values[dimension] ?? {}).length > 0,
+        ),
+      )),
 );
 
 /// Which of the two builders is on screen. Scope by default, because it is what
diff --git a/web/src/components/pipeline/PipelineEditor.vue b/web/src/components/pipeline/PipelineEditor.vue
index 413ac450ba..11d77b7337 100644
--- a/web/src/components/pipeline/PipelineEditor.vue
+++ b/web/src/components/pipeline/PipelineEditor.vue
@@ -173,7 +173,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           aria-hidden="true"
           class="bg-surface-overlay border-surface-base absolute -top-1 -right-1 flex h-3.5 w-3.5 items-center justify-center rounded-full border shadow-sm"
         >
-          <OIcon name="lock" size="xs" class="text-warning-600 size-2.5!" />
+          <OIcon name="lock" size="xs" class="text-icon-locked size-2.5!" />
         </span>
       </OButton>
     </template>
diff --git a/web/src/components/pipeline/PipelineSectionTabs.spec.ts b/web/src/components/pipeline/PipelineSectionTabs.spec.ts
new file mode 100644
index 0000000000..188bd934c4
--- /dev/null
+++ b/web/src/components/pipeline/PipelineSectionTabs.spec.ts
@@ -0,0 +1,95 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { mount } from "@vue/test-utils";
+import { defineComponent, h, ref } from "vue";
+import { createMemoryHistory, createRouter } from "vue-router";
+
+import PipelineSectionTabs from "./PipelineSectionTabs.vue";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
+
+const Empty = { template: "<div />" };
+const router = createRouter({
+  history: createMemoryHistory(),
+  routes: [
+    { path: "/", name: "home", component: Empty },
+    { path: "/pipelines", name: "pipelines", component: Empty },
+    { path: "/functions", name: "functionList", component: Empty },
+    { path: "/enrichment", name: "enrichmentTables", component: Empty },
+  ],
+});
+
+const mountTabs = (component: unknown = PipelineSectionTabs) =>
+  mount(component as typeof PipelineSectionTabs, {
+    global: { provide: { store }, plugins: [i18n, router] },
+  });
+
+const lock = (wrapper: ReturnType<typeof mountTabs>, key: string) =>
+  wrapper.find(`[data-test="pipeline-section-tab-${key}-lock"]`).exists();
+
+describe("PipelineSectionTabs license", () => {
+  beforeEach(async () => {
+    vi.restoreAllMocks();
+    store.state.zoConfig.custom_hide_menus = "";
+    await router.push({ name: "pipelines" });
+    await router.isReady();
+  });
+
+  afterEach(() => {
+    delete store.state.zoConfig.features;
+  });
+
+  it("locks only the stream pipelines tab when pipelines is locked", () => {
+    store.state.zoConfig.features = { pipelines: "locked" };
+    const wrapper = mountTabs();
+    expect(lock(wrapper, "streamPipelines")).toBe(true);
+    expect(lock(wrapper, "functions")).toBe(false);
+    expect(lock(wrapper, "enrichmentTables")).toBe(false);
+  });
+
+  it("shows every tab without a lock when pipelines is enabled", () => {
+    store.state.zoConfig.features = { pipelines: "enabled" };
+    const wrapper = mountTabs();
+    expect(wrapper.findAll('[role="tab"]')).toHaveLength(3);
+    expect(wrapper.find('[data-test$="-lock"]').exists()).toBe(false);
+  });
+
+  it("drops the stream pipelines tab when pipelines is hidden", () => {
+    store.state.zoConfig.features = { pipelines: "hidden" };
+    const wrapper = mountTabs();
+    expect(wrapper.find('[data-test="pipeline-section-tab-streamPipelines"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="pipeline-section-tab-functions"]').exists()).toBe(true);
+  });
+
+  it("still navigates to the free functions from a license-locked pipelines page", async () => {
+    store.state.zoConfig.features = { pipelines: "locked" };
+    const push = vi.spyOn(router, "push");
+    const LockedPage = defineComponent({
+      setup() {
+        provideFeatureLock(ref("pipelines"));
+        return () => h(PipelineSectionTabs);
+      },
+    });
+    const wrapper = mountTabs(LockedPage);
+    await wrapper.find('[data-test="pipeline-section-tab-functions"]').trigger("mousedown");
+    expect(push).toHaveBeenCalledWith({
+      name: "functionList",
+      query: { org_identifier: store.state.selectedOrganization.identifier },
+    });
+  });
+});
diff --git a/web/src/components/pipeline/PipelineSectionTabs.vue b/web/src/components/pipeline/PipelineSectionTabs.vue
index 1bf02838ba..fa5cf5dab5 100644
--- a/web/src/components/pipeline/PipelineSectionTabs.vue
+++ b/web/src/components/pipeline/PipelineSectionTabs.vue
@@ -25,32 +25,43 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   <!-- Section tabs — standard non-dense OTabs. The active underline sits on the
        header's bottom divider automatically (OTabs draws its indicator flush at
        the bottom). The active tab is derived from the route; clicking navigates. -->
-  <OTabs
-    :model-value="activeSectionKey"
-    align="left"
-    data-test="pipeline-section-tabs"
-    @change="navigateToSection"
-  >
-    <OTab
-      v-for="s in visibleSections"
-      :key="s.key"
-      :name="s.key"
-      :data-test="`pipeline-section-tab-${s.key}`"
+  <!-- The tabs only navigate, so a license-locked pipelines page still reaches the free functions and enrichment tables. -->
+  <FeatureLockExempt class="contents">
+    <OTabs
+      :model-value="activeSectionKey"
+      align="left"
+      data-test="pipeline-section-tabs"
+      @change="navigateToSection"
     >
-      <OIcon :name="s.icon" size="sm" class="shrink-0" />
-      <span :class="s.key === activeSectionKey ? '' : 'max-md:hidden'">{{ s.label }}</span>
-      <span
-        v-if="s.count != null"
-        class="text-2xs rounded-full px-1.5 py-1 leading-none font-bold"
-        :class="
-          s.key === activeSectionKey
-            ? 'bg-badge-primary-soft-bg text-badge-primary-soft-text'
-            : 'bg-surface-subtle text-text-secondary'
-        "
-        >{{ s.count }}</span
+      <OTab
+        v-for="s in visibleSections"
+        :key="s.key"
+        :name="s.key"
+        :data-test="`pipeline-section-tab-${s.key}`"
       >
-    </OTab>
-  </OTabs>
+        <OIcon :name="s.icon" size="sm" class="shrink-0" />
+        <span :class="s.key === activeSectionKey ? '' : 'max-md:hidden'">{{ s.label }}</span>
+        <span
+          v-if="s.count != null"
+          class="text-2xs rounded-full px-1.5 py-1 leading-none font-bold"
+          :class="
+            s.key === activeSectionKey
+              ? 'bg-badge-primary-soft-bg text-badge-primary-soft-text'
+              : 'bg-surface-subtle text-text-secondary'
+          "
+          >{{ s.count }}</span
+        >
+        <OIcon
+          v-if="s.licenseLocked"
+          name="lock"
+          size="xs"
+          class="lock-chip shrink-0"
+          :data-test="`pipeline-section-tab-${s.key}-lock`"
+          aria-hidden="true"
+        />
+      </OTab>
+    </OTabs>
+  </FeatureLockExempt>
 </template>
 
 <script setup lang="ts">
@@ -61,6 +72,8 @@ import { useRouter, type RouteLocationRaw } from "vue-router";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import { featureState } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
 const store = useStore();
@@ -95,6 +108,7 @@ interface Section {
   visible: boolean;
   /** Optional count pill shown after the label (omitted = no badge). */
   count?: number;
+  licenseLocked?: boolean;
 }
 
 const sections = computed<Section[]>(() => {
@@ -102,13 +116,15 @@ const sections = computed<Section[]>(() => {
   const hideStreamPipelines = store.state.zoConfig?.custom_hide_menus
     ?.split(",")
     .includes("pipelines");
+  const pipelines = featureState(store.state.zoConfig?.features, "pipelines");
   return [
     {
       key: "streamPipelines",
       label: t("function.streamPipeline"),
       icon: "lan",
       to: { name: "pipelines", query: q },
-      visible: !hideStreamPipelines,
+      visible: !hideStreamPipelines && pipelines !== "hidden",
+      licenseLocked: pipelines === "locked",
     },
     {
       key: "functions",
diff --git a/web/src/components/pipeline/PipelinesList.vue b/web/src/components/pipeline/PipelinesList.vue
index aaaa824721..6887e3c903 100644
--- a/web/src/components/pipeline/PipelinesList.vue
+++ b/web/src/components/pipeline/PipelinesList.vue
@@ -575,6 +575,7 @@ import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { COL } from "@/lib/core/Table/OTable.types";
 
 const { t } = useI18nTyped();
@@ -1123,7 +1124,7 @@ const fetching = pipelinesList.isFetching;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = pipelinesList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 // Epoch ms of the last successful read — drives the button's "1m ago" label.
 const lastUpdatedAt = pipelinesList.dataUpdatedAt;
diff --git a/web/src/components/pipelines/BackfillJobsList.vue b/web/src/components/pipelines/BackfillJobsList.vue
index a400d3b246..412c7fd627 100644
--- a/web/src/components/pipelines/BackfillJobsList.vue
+++ b/web/src/components/pipelines/BackfillJobsList.vue
@@ -407,6 +407,7 @@ import ConfirmDialog from "../ConfirmDialog.vue";
 import { timestampToTimezoneDate } from "../../utils/zincutils";
 import OProgressBar from "@/lib/data/ProgressBar/OProgressBar.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
 import type { ButtonVariant } from "@/lib/core/Button/OButton.types";
 
@@ -418,7 +419,7 @@ const { isMobile } = useBreakpoint();
 const qTableRef = ref();
 
 const loading = ref(false);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const jobs = ref<BackfillJob[]>([]);
 const showDetailsDialog = ref(false);
 const selectedJobId = ref("");
@@ -536,7 +537,7 @@ const loadJobs = async () => {
     loadPipelineOptions();
   } catch (error: any) {
     console.error("Error loading backfill jobs:", error);
-    forbidden.value = error?.response?.status === 403;
+    forbidden.value = forbiddenState(error);
     if (!forbidden.value) {
       toast({
         variant: "error",
diff --git a/web/src/components/pipelines/PipelineHistory.vue b/web/src/components/pipelines/PipelineHistory.vue
index da22219dd0..c53d1d0b4c 100644
--- a/web/src/components/pipelines/PipelineHistory.vue
+++ b/web/src/components/pipelines/PipelineHistory.vue
@@ -479,6 +479,7 @@ import { pipelineHistoryQuery } from "@/services/pipelines.queries";
 import { queryClient } from "@/composables/query/queryClient";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { COL } from "@/lib/core/Table/OTable.types";
 import type { OTableColumnDef, OTableExposed } from "@/lib/core/Table/OTable.types";
 
@@ -489,7 +490,7 @@ const { isMobile } = useBreakpoint();
 // Data
 const loading = ref(false);
 const lastUpdatedAt = ref<number | null>(null);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const rows = ref<any[]>([]);
 const searchQuery = ref("");
 const selectedPipeline = ref<any>();
@@ -766,7 +767,7 @@ const fetchPipelineHistory = async (force = false) => {
   } catch (error: any) {
     console.error("Error fetching pipeline history:", error);
     console.error("Error response:", error.response);
-    forbidden.value = error?.response?.status === 403;
+    forbidden.value = forbiddenState(error);
     if (!forbidden.value) {
       toast({
         variant: "error",
diff --git a/web/src/components/queries/RunningQueries.vue b/web/src/components/queries/RunningQueries.vue
index 1e1c8c2db6..5ba8e0ea2d 100644
--- a/web/src/components/queries/RunningQueries.vue
+++ b/web/src/components/queries/RunningQueries.vue
@@ -159,6 +159,7 @@ import { durationFormatter, getDuration } from "@/utils/zincutils";
 import RunningQueriesList from "./RunningQueriesList.vue";
 import SummaryList from "./SummaryList.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
@@ -305,7 +306,7 @@ export default defineComponent({
     };
 
     const loadingState = ref(false);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     const queries = ref([]);
 
     const deleteDialog = ref({
@@ -608,7 +609,7 @@ export default defineComponent({
           runningQueriesSummary.value = getRunningQueriesSummary();
         })
         .catch((error: any) => {
-          forbidden.value = error?.response?.status === 403;
+          forbidden.value = forbiddenState(error);
           if (!forbidden.value) {
             toast({
               message: error.response?.data?.message || t("queries.fetchRunningQueriesFailed"),
diff --git a/web/src/components/queries/RunningQueriesList.vue b/web/src/components/queries/RunningQueriesList.vue
index 25f85cdc30..505ffd09ac 100644
--- a/web/src/components/queries/RunningQueriesList.vue
+++ b/web/src/components/queries/RunningQueriesList.vue
@@ -167,7 +167,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script lang="ts">
 import useIsMetaOrg from "@/composables/useIsMetaOrg";
-import { ref, defineComponent, computed } from "vue";
+import { ref, defineComponent, computed, type PropType } from "vue";
 import { useI18nTyped } from "@/types/i18n";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import { useStore } from "vuex";
@@ -185,6 +185,7 @@ import OUserCell from "@/lib/core/Table/cells/OUserCell.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { COL } from "@/lib/core/Table/OTable.types";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 export default defineComponent({
   name: "RunningQueriesList",
@@ -216,7 +217,7 @@ export default defineComponent({
       default: false,
     },
     forbidden: {
-      type: Boolean,
+      type: [Boolean, Array] as PropType<ForbiddenState>,
       default: false,
     },
     lastRefreshed: {
diff --git a/web/src/components/queries/SummaryList.vue b/web/src/components/queries/SummaryList.vue
index aa4cff8eca..1c82e0edff 100644
--- a/web/src/components/queries/SummaryList.vue
+++ b/web/src/components/queries/SummaryList.vue
@@ -102,7 +102,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script lang="ts">
 import useIsMetaOrg from "@/composables/useIsMetaOrg";
-import { ref, defineComponent, computed } from "vue";
+import { ref, defineComponent, computed, type PropType } from "vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OTable from "@/lib/core/Table/OTable.vue";
@@ -112,6 +112,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { durationFormatter } from "@/utils/zincutils";
 import { COL } from "@/lib/core/Table/OTable.types";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 export default defineComponent({
   name: "RunningQueriesList",
@@ -126,7 +127,7 @@ export default defineComponent({
       required: true,
     },
     forbidden: {
-      type: Boolean,
+      type: [Boolean, Array] as PropType<ForbiddenState>,
       default: false,
     },
     filtered: {
diff --git a/web/src/components/reports/CreateReport.vue b/web/src/components/reports/CreateReport.vue
index eebe9e9925..8dabdfc1bf 100644
--- a/web/src/components/reports/CreateReport.vue
+++ b/web/src/components/reports/CreateReport.vue
@@ -109,6 +109,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                      change, wiping each field's TanStack error meta. -->
                 <template v-for="(dashboard, index) in dashboardRows" :key="index">
                   <div :data-test="`add-report-dashboard-${index}`" class="my-2 flex flex-col px-2">
+                    <div
+                      v-if="dashboardsLocked"
+                      class="text-text-secondary mb-2 flex items-center gap-1 text-xs"
+                      data-test="add-report-dashboards-locked"
+                    >
+                      <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
+                      {{ dashboardsLockedReason }}
+                    </div>
                     <!-- items-start (not items-center): keeps all selects
                          top-aligned when a validation error appears under one and
                          grows its cell taller. -->
@@ -120,6 +128,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       >
                         <OFormSelect
                           data-test="add-report-dashboard-folder-select"
+                          :disabled="dashboardsLocked"
                           :name="`dashboards[${index}].folder`"
                           :options="folderOptions"
                           :label="t('reports.dashboardFolder')"
@@ -137,6 +146,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       >
                         <OFormSelect
                           data-test="add-report-dashboard-name-select"
+                          :disabled="dashboardsLocked"
                           :name="`dashboards[${index}].dashboard`"
                           :options="dashboardOptions"
                           :label="t('reports.dashboard')"
@@ -154,6 +164,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       >
                         <OFormSelect
                           data-test="add-report-dashboard-tab-select"
+                          :disabled="dashboardsLocked"
                           :name="`dashboards[${index}].tabs`"
                           :options="dashboardTabOptions"
                           :label="t('reports.dashboardTab')"
@@ -665,6 +676,7 @@ import OFormDate from "@/lib/forms/Date/OFormDate.vue";
 import OFormTime from "@/lib/forms/Time/OFormTime.vue";
 import OFormDateTimeRange from "@/lib/forms/DateTime/OFormDateTimeRange.vue";
 import { getFoldersListByType } from "@/utils/commons";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import {
   makeCreateReportSchema,
@@ -794,6 +806,8 @@ const dashboardRows = form.useStore((s: any): any[] => s.values?.dashboards ?? [
 // `variables` are now form-owned (VariablesInput renders in form mode,
 // name-prefix="variables"); read from the form value at save.
 
+const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+  useLicenseLock("dashboards");
 const folderOptions: Ref<{ label: I18nText; value: string }[]> = ref([]);
 
 const dashboardOptions: Ref<{ label: I18nText; value: string; tabs: any[]; version: number }[]> =
@@ -1094,6 +1108,7 @@ const onFolderSelection = async (id: string, index = 0) => {
 let dashboardOptionsRequest = 0;
 
 const setDashboardOptions = (id: string) => {
+  if (dashboardsLocked.value) return Promise.resolve(true);
   const request = ++dashboardOptionsRequest;
   dashboardOptions.value = [];
   isFetchingDashboard.value = true;
@@ -1247,6 +1262,7 @@ const { timezoneOptions: timezoneSelectOptions } = useTimezoneOptions({
 });
 
 const getDashboaordFolders = () => {
+  if (dashboardsLocked.value) return Promise.resolve(true);
   return new Promise((resolve, reject) => {
     isFetchingFolders.value = true;
     dashboardService
@@ -1538,14 +1554,20 @@ const setupEditingReport = async (report: any) => {
   // Resolve folder/dashboard/tab against the loaded options (drop + warn if the
   // saved selection has since been deleted).
   let folder = "";
-  if (folderOptions.value.some((f) => f.value === report.dashboards[0].folder)) {
+  if (
+    dashboardsLocked.value ||
+    folderOptions.value.some((f) => f.value === report.dashboards[0].folder)
+  ) {
     folder = report.dashboards[0].folder;
   } else {
     toast({ variant: "error", message: t("toastMessages.reports.selectedFolderHasBeenDeleted") });
   }
 
   let dashboard = "";
-  if (dashboardOptions.value.some((d) => d.value === report.dashboards[0].dashboard)) {
+  if (
+    dashboardsLocked.value ||
+    dashboardOptions.value.some((d) => d.value === report.dashboards[0].dashboard)
+  ) {
     dashboard = report.dashboards[0].dashboard;
   } else {
     toast({
@@ -1558,7 +1580,9 @@ const setupEditingReport = async (report: any) => {
 
   let tabs = "";
   const tab = dashboardTabOptions.value.find((t) => t.value === report.dashboards[0].tabs[0]);
-  if (tab) {
+  if (dashboardsLocked.value) {
+    tabs = report.dashboards[0].tabs[0] ?? "";
+  } else if (tab) {
     tabs = tab.value;
   } else {
     toast({
diff --git a/web/src/components/reports/ReportList.vue b/web/src/components/reports/ReportList.vue
index 2b529c3933..94942ba9f6 100644
--- a/web/src/components/reports/ReportList.vue
+++ b/web/src/components/reports/ReportList.vue
@@ -517,6 +517,7 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 
 const MoveAcrossFolders = defineAsyncComponent(
   () => import("@/components/common/sidebar/MoveAcrossFolders.vue"),
@@ -572,7 +573,7 @@ const reportsList = useQuery(() =>
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = reportsList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 
 const isLoadingReports = ref(true);
diff --git a/web/src/components/rum/EventDetailDrawerContent.spec.ts b/web/src/components/rum/EventDetailDrawerContent.spec.ts
index ab430b3f4e..9025e4c058 100644
--- a/web/src/components/rum/EventDetailDrawerContent.spec.ts
+++ b/web/src/components/rum/EventDetailDrawerContent.spec.ts
@@ -15,6 +15,7 @@
 
 import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
+import { nextTick } from "vue";
 import EventDetailDrawerContent from "@/components/rum/EventDetailDrawerContent.vue";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
@@ -972,6 +973,40 @@ describe("EventDetailDrawerContent", () => {
 
       windowOpenSpy.mockRestore();
     });
+
+    it("traces locked: view-trace-btn is disabled with a lock and opens nothing", async () => {
+      await waitForRelatedResources(wrapper);
+      const zoConfig = store.state.zoConfig as any;
+      zoConfig.features = { traces: "locked" };
+      const windowOpenSpy = vi.spyOn(window, "open").mockImplementation(() => null);
+      try {
+        await nextTick();
+        const traceButtons = wrapper.findAll('[data-test="view-trace-btn"]');
+        expect(traceButtons.length).toBeGreaterThan(0);
+        expect(traceButtons[0].attributes("disabled")).toBeDefined();
+        expect(wrapper.find('[data-test="view-trace-btn-lock"]').exists()).toBe(true);
+        await traceButtons[0].trigger("click");
+        await flushPromises();
+        expect(windowOpenSpy).not.toHaveBeenCalled();
+      } finally {
+        delete zoConfig.features;
+        windowOpenSpy.mockRestore();
+      }
+    });
+
+    it("another signal locked: view-trace-btn stays live", async () => {
+      await waitForRelatedResources(wrapper);
+      const zoConfig = store.state.zoConfig as any;
+      zoConfig.features = { logs: "locked" };
+      try {
+        await nextTick();
+        expect(wrapper.find('[data-test="view-trace-btn-lock"]').exists()).toBe(false);
+        const traceButtons = wrapper.findAll('[data-test="view-trace-btn"]');
+        expect(traceButtons[0].attributes("disabled")).toBeUndefined();
+      } finally {
+        delete zoConfig.features;
+      }
+    });
   });
 
   // ==========================================================================
diff --git a/web/src/components/rum/EventDetailDrawerContent.vue b/web/src/components/rum/EventDetailDrawerContent.vue
index 9067374540..b37e8ef8e2 100644
--- a/web/src/components/rum/EventDetailDrawerContent.vue
+++ b/web/src/components/rum/EventDetailDrawerContent.vue
@@ -317,8 +317,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     </template>
 
                     <!-- Clickable Trace Button -->
+                    <OTooltip
+                      v-if="rumField(item, 'trace_id') && tracesLock.locked.value"
+                      :content="tracesLock.lockedReason.value"
+                    >
+                      <span class="ms-2 inline-flex">
+                        <OButton
+                          variant="outline"
+                          size="xs"
+                          data-test="view-trace-btn"
+                          class="h-5! px-1.5"
+                          disabled
+                        >
+                          <OIcon
+                            name="lock"
+                            class="text-icon-locked"
+                            size="xs"
+                            data-test="view-trace-btn-lock"
+                          />
+                          <span>{{ t("common.viewTrace") }}</span>
+                        </OButton>
+                      </span>
+                    </OTooltip>
                     <OButton
-                      v-if="rumField(item, 'trace_id')"
+                      v-else-if="rumField(item, 'trace_id')"
                       variant="outline"
                       size="xs"
                       :title="t('common.viewTraceDetails')"
@@ -465,6 +487,8 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 
 const props = defineProps({
@@ -616,6 +640,7 @@ const viewResourceDetails = (resource: any) => {
  * Opens in a new tab
  */
 const isResolvingTraceNav = ref(false);
+const tracesLock = useLicenseLock("traces");
 const navigateToSpecificTrace = async (traceId: string) => {
   // Canonicalize: SDK 0.4.x stored ids zero-stripped, but the traces stream
   // (and therefore the trace-details page) uses the padded 32-char form.
diff --git a/web/src/components/rum/productAnalytics/AnalyticsFunnels.spec.ts b/web/src/components/rum/productAnalytics/AnalyticsFunnels.spec.ts
index 5acfff4a5c..2dea546408 100644
--- a/web/src/components/rum/productAnalytics/AnalyticsFunnels.spec.ts
+++ b/web/src/components/rum/productAnalytics/AnalyticsFunnels.spec.ts
@@ -761,6 +761,28 @@ describe("AnalyticsFunnels", () => {
     expect(wrapper!.findComponent({ name: "AddToDashboard" }).exists()).toBe(false);
   });
 
+  it("locks Add to dashboard and opens no dialog when dashboards are license-locked", async () => {
+    const prev = store.state.zoConfig;
+    store.state.zoConfig = { ...prev, features: { dashboards: "locked" } };
+    try {
+      await mountFunnels();
+      await setSteps([
+        ["p", "/a"],
+        ["c", "b"],
+      ]);
+      const btn = wrapper!
+        .findAllComponents({ name: "OButton" })
+        .find((b) => b.attributes("data-test") === "rum-analytics-funnel-add-dashboard-btn")!;
+      expect(btn.props("disabled")).toBe(true);
+      expect(btn.props("iconLeft")).toBe("lock");
+      await btn.trigger("click");
+      await flushPromises();
+      expect(wrapper!.findComponent({ name: "AddToDashboard" }).exists()).toBe(false);
+    } finally {
+      store.state.zoConfig = prev;
+    }
+  });
+
   it("adds a Sessions funnel without breakdown to a dashboard as a bar panel (AC-53)", async () => {
     await mountFunnels();
     await setSteps([
@@ -805,6 +827,28 @@ describe("AnalyticsFunnels", () => {
     alertCreationDialog.value = null;
   });
 
+  it("locks Alert me and opens no alert form when alerts are license-locked", async () => {
+    alertCreationDialog.value = null;
+    const prev = store.state.zoConfig;
+    store.state.zoConfig = { ...prev, features: { alerts: "locked" } };
+    try {
+      await mountFunnels();
+      await setSteps([
+        ["p", "/a"],
+        ["c", "b"],
+      ]);
+      const btn = wrapper!
+        .findAllComponents({ name: "OButton" })
+        .find((b) => b.attributes("data-test") === "rum-analytics-funnel-alert-btn")!;
+      expect(btn.props("disabled")).toBe(true);
+      expect(btn.props("iconLeft")).toBe("lock");
+      await btn.trigger("click");
+      expect(alertCreationDialog.value).toBeNull();
+    } finally {
+      store.state.zoConfig = prev;
+    }
+  });
+
   const EVT = "EvtDashboards00000000000001";
   const EVENT_FUNNEL = encodeDef({
     s: [
diff --git a/web/src/components/rum/productAnalytics/AnalyticsFunnels.vue b/web/src/components/rum/productAnalytics/AnalyticsFunnels.vue
index 56e0ecd48b..26d2d8d4e0 100644
--- a/web/src/components/rum/productAnalytics/AnalyticsFunnels.vue
+++ b/web/src/components/rum/productAnalytics/AnalyticsFunnels.vue
@@ -51,25 +51,26 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <OButton
             variant="outline"
             size="sm"
-            icon-left="shield-alert-outline"
-            :disabled="!alertReady"
+            :icon-left="alertsLocked ? 'lock' : 'shield-alert-outline'"
+            :disabled="alertsLocked || !alertReady"
             data-test="rum-analytics-funnel-alert-btn"
             @click="openAlert"
             >{{ t("rum.analytics.funnel.alert") }}</OButton
           >
-          <OTooltip :content="alertTip" />
+          <OTooltip :content="alertsLocked ? alertsLockedReason : alertTip" />
         </span>
         <span>
           <OButton
             variant="outline"
             size="sm"
-            icon-left="dashboard-customize"
-            :disabled="!dashboardReady"
+            :icon-left="dashboardsLocked ? 'lock' : 'dashboard-customize'"
+            :disabled="dashboardsLocked || !dashboardReady"
             data-test="rum-analytics-funnel-add-dashboard-btn"
             @click="dashboardOpen = true"
             >{{ t("rum.analytics.dashboard.add") }}</OButton
           >
-          <OTooltip v-if="!dashboardReady" :content="dashboardTip" />
+          <OTooltip v-if="dashboardsLocked" :content="dashboardsLockedReason" />
+          <OTooltip v-else-if="!dashboardReady" :content="dashboardTip" />
         </span>
       </template>
       <template v-if="def.steps.length" #menu>
@@ -710,6 +711,7 @@ import OBadge from "@/lib/core/Badge/OBadge.vue";
 import type { BadgeVariant } from "@/lib/core/Badge/OBadge.types";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OPopover from "@/lib/overlay/Popover/OPopover.vue";
@@ -847,6 +849,9 @@ const dropoffCohort = ref<FunnelCohort | null>(null);
 const valuesField = ref<string | null>(null);
 const whyOpen = ref(false);
 const dashboardOpen = ref(false);
+const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+  useLicenseLock("dashboards");
+const { locked: alertsLocked, lockedReason: alertsLockedReason } = useLicenseLock("alerts");
 const linkProblem = pa.savedLinkProblem;
 let timer: ReturnType<typeof setTimeout> | null = null;
 let whyTimer: ReturnType<typeof setTimeout> | null = null;
@@ -1260,6 +1265,7 @@ const snapshotScope = () => ({ ...pa.scope.value, xall: undefined });
 
 // The alert starts at today's conversion, so it fires on any drop below what the user sees now.
 const openAlert = () => {
+  if (alertsLocked.value) return;
   const dt = pa.state.datetime;
   requestAlertCreation(
     buildPrefillFromRumFunnel({
diff --git a/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.spec.ts b/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.spec.ts
new file mode 100644
index 0000000000..d8abd59d6a
--- /dev/null
+++ b/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.spec.ts
@@ -0,0 +1,86 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import AnalyticsSessionsTable from "./AnalyticsSessionsTable.vue";
+
+const ROW = {
+  sid: "s1",
+  step_t: 1790000000000,
+  errors: 0,
+  frustrations: 0,
+  has_replay: 1,
+  started: 1789999990000,
+  ended: 1790000372000,
+  user_label: "a@x.com",
+  total: 1,
+};
+
+describe("AnalyticsSessionsTable", () => {
+  let wrapper: VueWrapper | null = null;
+
+  const mountTable = async (features: Record<string, string>) => {
+    wrapper = mount(AnalyticsSessionsTable, {
+      props: {
+        rows: [ROW],
+        total: 1,
+        stepLabel: "/home",
+        stepIndex: null,
+        loadingMore: false,
+        dataTestPrefix: "t",
+      },
+      global: {
+        plugins: [
+          i18n,
+          createStore({ state: { zoConfig: { features }, timezone: "UTC", theme: "light" } }),
+        ],
+      },
+      attachTo: document.body,
+    });
+    await flushPromises();
+  };
+
+  const clickRow = async () => {
+    const row = wrapper!.find('[data-test="t-row-0"]').element.closest("tr");
+    row?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    await flushPromises();
+  };
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    document.body.innerHTML = "";
+  });
+
+  it("shows a lock instead of the open chevron and opens no session when rum is locked", async () => {
+    await mountTable({ rum: "locked" });
+
+    expect(wrapper!.find('[data-test="t-row-0-locked"]').exists()).toBe(true);
+    expect(wrapper!.find('[data-test="t-row-0-open"]').exists()).toBe(false);
+    await clickRow();
+    expect(wrapper!.emitted("open")).toBeUndefined();
+  });
+
+  it("opens the session on row click when rum is enabled", async () => {
+    await mountTable({ rum: "enabled" });
+
+    expect(wrapper!.find('[data-test="t-row-0-open"]').exists()).toBe(true);
+    await clickRow();
+    expect(wrapper!.emitted("open")?.[0]).toEqual([ROW]);
+  });
+});
diff --git a/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.vue b/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.vue
index de1e99f873..d6f1bbd754 100644
--- a/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.vue
+++ b/web/src/components/rum/productAnalytics/AnalyticsSessionsTable.vue
@@ -33,7 +33,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       sorting="none"
       :show-global-filter="false"
       :frame="false"
-      @row-click="(row: SessionRow) => emit('open', row)"
+      v-on="rowClickListeners"
     >
       <template #cell-replay="{ row, index }">
         <OTag
@@ -102,7 +102,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         }}</span>
       </template>
       <template #cell-open="{ index }">
+        <OTooltip v-if="rumLocked" :content="rumLockedReason">
+          <span class="inline-flex">
+            <OIcon
+              name="lock"
+              size="sm"
+              class="lock-chip"
+              :data-test="`${dataTestPrefix}-row-${index}-locked`"
+            />
+          </span>
+        </OTooltip>
         <OIcon
+          v-else
           name="chevron-right"
           size="sm"
           class="text-text-secondary"
@@ -137,6 +148,8 @@ import OTable from "@/lib/core/Table/OTable.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { durationFormatter } from "@/utils/formatters";
@@ -171,7 +184,11 @@ withDefaults(
 const emit = defineEmits<{ open: [SessionRow]; "load-more": [] }>();
 const { t } = useI18nTyped();
 const store = useStore();
+const { locked: rumLocked, lockedReason: rumLockedReason } = useLicenseLock("rum");
 const dash = raw("—");
+const rowClickListeners = computed(() =>
+  rumLocked.value ? {} : { rowClick: (row: SessionRow) => emit("open", row) },
+);
 
 const tz = () => store.state.timezone || "UTC";
 const fmt = (ms: number) =>
diff --git a/web/src/components/rum/productAnalytics/RetentionCellDrawer.spec.ts b/web/src/components/rum/productAnalytics/RetentionCellDrawer.spec.ts
new file mode 100644
index 0000000000..fe7a2288d6
--- /dev/null
+++ b/web/src/components/rum/productAnalytics/RetentionCellDrawer.spec.ts
@@ -0,0 +1,99 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { createStore } from "vuex";
+import { createRouter, createWebHistory } from "vue-router";
+import { ref } from "vue";
+import i18n from "@/locales";
+
+vi.mock("@/composables/rum/useAnalyticsSearch", () => ({
+  default: () => ({
+    panel: () =>
+      ref({
+        status: "ok",
+        rows: [{ u: "a@x.com", retained: 1, sessions: 3, last_seen: 1790000000000000 }],
+      }),
+    run: vi.fn(),
+    abortAll: vi.fn(),
+  }),
+}));
+
+vi.mock("@/composables/rum/useProductAnalytics", () => ({
+  default: () => ({
+    usersUnit: ref({ partial: false, label: "", noun: "users", one: "User" }),
+    sampleRatio: ref(1),
+    identitySql: ref(null),
+  }),
+}));
+
+import RetentionCellDrawer from "./RetentionCellDrawer.vue";
+
+describe("RetentionCellDrawer", () => {
+  let wrapper: VueWrapper | null = null;
+
+  const mountDrawer = async (features: Record<string, string>) => {
+    const router = createRouter({
+      history: createWebHistory(),
+      routes: [{ path: "/", component: { template: "<div />" } }],
+    });
+    wrapper = mount(RetentionCellDrawer, {
+      props: {
+        open: true,
+        cohort: 0,
+        k: 1,
+        def: { mode: "on" } as never,
+        periods: { boundariesUs: [] } as never,
+        cohortLabel: "Week 1",
+        periodLabel: "Week 1" as never,
+      },
+      global: {
+        plugins: [
+          i18n,
+          router,
+          createStore({ state: { zoConfig: { features }, timezone: "UTC", theme: "light" } }),
+        ],
+      },
+      attachTo: document.body,
+    });
+    await flushPromises();
+  };
+
+  const sessionsBtn = () =>
+    wrapper!
+      .findAllComponents({ name: "OButton" })
+      .find((b) => b.attributes("data-test") === "rum-analytics-retention-user-0-sessions-btn");
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    document.body.innerHTML = "";
+  });
+
+  it("disables View in sessions with a lock when rum is locked", async () => {
+    await mountDrawer({ rum: "locked" });
+
+    expect(sessionsBtn()?.props("disabled")).toBe(true);
+    expect(sessionsBtn()?.props("iconLeft")).toBe("lock");
+  });
+
+  it("keeps View in sessions live when rum is enabled", async () => {
+    await mountDrawer({ rum: "enabled" });
+
+    expect(sessionsBtn()?.props("disabled")).toBeFalsy();
+    expect(sessionsBtn()?.props("iconRight")).toBe("arrow-forward");
+  });
+});
diff --git a/web/src/components/rum/productAnalytics/RetentionCellDrawer.vue b/web/src/components/rum/productAnalytics/RetentionCellDrawer.vue
index a911050257..9b20b4df88 100644
--- a/web/src/components/rum/productAnalytics/RetentionCellDrawer.vue
+++ b/web/src/components/rum/productAnalytics/RetentionCellDrawer.vue
@@ -77,7 +77,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             <span class="text-text-secondary text-xs">{{ fmt(row.last_seen) }}</span>
           </template>
           <template #cell-actions="{ row, index }">
+            <OTooltip v-if="rumLocked" :content="rumLockedReason">
+              <span class="inline-flex">
+                <OButton
+                  variant="ghost"
+                  size="sm"
+                  icon-left="lock"
+                  disabled
+                  :data-test="`rum-analytics-retention-user-${index}-sessions-btn`"
+                  >{{ t("rum.analytics.retention.viewInSessions") }}</OButton
+                >
+              </span>
+            </OTooltip>
             <OButton
+              v-else
               variant="ghost"
               size="sm"
               icon-right="arrow-forward"
@@ -103,6 +116,8 @@ import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTable from "@/lib/core/Table/OTable.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import AnalyticsPanelState from "@/components/rum/productAnalytics/AnalyticsPanelState.vue";
 import useProductAnalytics from "@/composables/rum/useProductAnalytics";
@@ -145,6 +160,7 @@ const props = withDefaults(
 );
 const emit = defineEmits<{ "update:open": [boolean] }>();
 const { t } = useI18nTyped();
+const { locked: rumLocked, lockedReason: rumLockedReason } = useLicenseLock("rum");
 const router = useRouter();
 const store = useStore();
 const pa = useProductAnalytics();
diff --git a/web/src/components/rum/productAnalytics/TrendsPanel.spec.ts b/web/src/components/rum/productAnalytics/TrendsPanel.spec.ts
index 9f25c44ec7..ae71a6a726 100644
--- a/web/src/components/rum/productAnalytics/TrendsPanel.spec.ts
+++ b/web/src/components/rum/productAnalytics/TrendsPanel.spec.ts
@@ -133,6 +133,23 @@ describe("TrendsPanel (AC-48)", () => {
     ).toBe("Add to dashboard");
   });
 
+  it("locks Add to dashboard when dashboards are license-locked", async () => {
+    (store.state as any).zoConfig = { features: { dashboards: "locked" } };
+    const w = mountPanel({});
+    const btn = w
+      .findAllComponents({ name: "OButton" })
+      .find((b) => b.attributes("data-test") === "rum-analytics-trends-add-dashboard-btn")!;
+    expect(btn.props("disabled")).toBe(true);
+    expect(btn.props("iconLeft")).toBe("lock");
+    await btn.trigger("click");
+    expect(w.find("[data-test='add-to-dashboard-stub']").exists()).toBe(false);
+    (store.state as any).zoConfig = { features: { dashboards: "enabled" } };
+    await flushPromises();
+    expect(btn.props("iconLeft")).toBe("dashboard-customize");
+    expect(btn.props("disabled")).toBe(false);
+    delete (store.state as any).zoConfig;
+  });
+
   it("replaces the chart with one series per selected key, each removable as a chip", async () => {
     const series = [
       { kind: "p", key: "/web" },
diff --git a/web/src/components/rum/productAnalytics/TrendsPanel.vue b/web/src/components/rum/productAnalytics/TrendsPanel.vue
index d72cb04809..4091bd3e46 100644
--- a/web/src/components/rum/productAnalytics/TrendsPanel.vue
+++ b/web/src/components/rum/productAnalytics/TrendsPanel.vue
@@ -59,13 +59,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <OButton
           variant="outline"
           size="icon-toolbar"
-          icon-left="dashboard-customize"
-          :disabled="chartHeld || eventsGate !== 'ready'"
+          :icon-left="dashboardsLocked ? 'lock' : 'dashboard-customize'"
+          :disabled="dashboardsLocked || chartHeld || eventsGate !== 'ready'"
           :aria-label="t('rum.analytics.dashboard.add')"
           data-test="rum-analytics-trends-add-dashboard-btn"
           @click="dashboardOpen = true"
         />
-        <OTooltip :content="t('rum.analytics.dashboard.add')" />
+        <OTooltip
+          :content="dashboardsLocked ? dashboardsLockedReason : t('rum.analytics.dashboard.add')"
+        />
       </span>
     </div>
     <div v-if="series.length" class="flex flex-wrap items-center gap-1.5 px-4 pt-2">
@@ -152,6 +154,7 @@ import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import PanelSchemaRenderer from "@/components/dashboards/PanelSchemaRenderer.vue";
 import NamedEventsNotice from "@/components/rum/productAnalytics/NamedEventsNotice.vue";
 import type { NamedEventsStatus } from "@/composables/rum/useNamedEvents";
@@ -178,6 +181,8 @@ const props = defineProps<{
 }>();
 const emit = defineEmits<{ "update:series": [StepRef[]]; "retry-events": [] }>();
 const { t } = useI18nTyped();
+const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+  useLicenseLock("dashboards");
 const metric = ref<"sessions" | "users">("sessions");
 // Users needs an identity, so losing it must not leave the toggle with nothing selected.
 watch(
diff --git a/web/src/components/sampleData/SampleDataWelcome.spec.ts b/web/src/components/sampleData/SampleDataWelcome.spec.ts
index 3e9a40d632..d964507e49 100644
--- a/web/src/components/sampleData/SampleDataWelcome.spec.ts
+++ b/web/src/components/sampleData/SampleDataWelcome.spec.ts
@@ -316,6 +316,16 @@ describe("SampleDataWelcome finish", () => {
     expect(byTest("onboarding-get-started-more-chip").exists()).toBe(false);
   });
 
+  it("locks a chip whose guide the license locks, and a click picks nothing", async () => {
+    await mountAtHome({ sample_data_onboarding_enabled: true, features: { rum: "locked" } });
+    const push = pushSpy();
+    expect(byTest("onboarding-get-started-source-rum").attributes("disabled")).toBeDefined();
+    expect(byTest("onboarding-get-started-source-otel").attributes("disabled")).toBeUndefined();
+    await click("onboarding-get-started-source-rum");
+    expect(push).not.toHaveBeenCalled();
+    expect(submitNewUserInfo).not.toHaveBeenCalled();
+  });
+
   it("Explore Other Data Sources opens the Data Sources page as a skip", async () => {
     await mountAtHome();
     const push = pushSpy();
diff --git a/web/src/components/settings/AiToolsets.spec.ts b/web/src/components/settings/AiToolsets.spec.ts
index 54d3d6741a..ffe85cc85d 100644
--- a/web/src/components/settings/AiToolsets.spec.ts
+++ b/web/src/components/settings/AiToolsets.spec.ts
@@ -13,9 +13,11 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { flushPromises, mount } from "@vue/test-utils";
 import AiToolsets from "./AiToolsets.vue";
+import aiToolsetsService from "@/services/ai_toolsets";
+import { queryClient } from "@/composables/query/queryClient";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 import router from "@/test/unit/helpers/router";
@@ -71,6 +73,54 @@ describe("AiToolsets list view state", () => {
   });
 });
 
+describe("AiToolsets license lock", () => {
+  const mountWithEmpty = () =>
+    mount(AiToolsets, {
+      global: {
+        plugins: [i18n, store, router],
+        provide: { store },
+        stubs: {
+          AddAiToolset: true,
+          ConfirmDialog: true,
+          OTable: { template: "<div><slot name='empty' /></div>" },
+          OEmptyState: { name: "OEmptyState", template: "<div data-test='empty-stub' />" },
+        },
+      },
+    });
+
+  beforeEach(() => {
+    queryClient.clear();
+    vi.mocked(aiToolsetsService.list).mockClear();
+  });
+
+  afterEach(() => {
+    store.state.zoConfig.features = {};
+  });
+
+  it.each(["ai_toolsets", "ai_assistant"])(
+    "requests no toolsets while %s is locked and leaves the dimmed page's table empty",
+    async (feature) => {
+      store.state.zoConfig.features = { [feature]: "locked" };
+      const w = mountWithEmpty();
+      await flushPromises();
+      expect(aiToolsetsService.list).not.toHaveBeenCalled();
+      expect(w.find("[data-test='empty-stub']").exists()).toBe(true);
+      await (w.vm as any).refreshData();
+      expect(aiToolsetsService.list).not.toHaveBeenCalled();
+      w.unmount();
+    },
+  );
+
+  it("loads the toolsets and keeps the regular empty state when ai_toolsets is enabled", async () => {
+    store.state.zoConfig.features = { ai_toolsets: "enabled" };
+    const w = mountWithEmpty();
+    await flushPromises();
+    expect(aiToolsetsService.list).toHaveBeenCalled();
+    expect(w.find("[data-test='empty-stub']").exists()).toBe(true);
+    w.unmount();
+  });
+});
+
 describe("AiToolsets delete confirm", () => {
   it("names the toolset and uses a destructive OK button", async () => {
     const w: any = mountPage();
diff --git a/web/src/components/settings/AiToolsets.vue b/web/src/components/settings/AiToolsets.vue
index c210d5eb0c..855b0b3913 100644
--- a/web/src/components/settings/AiToolsets.vue
+++ b/web/src/components/settings/AiToolsets.vue
@@ -213,12 +213,14 @@ import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import AddAiToolset from "@/components/ai_toolsets/AddAiToolset.vue";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 import aiToolsetsService from "@/services/ai_toolsets";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
 import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 export default defineComponent({
   name: "PageAiToolsets",
@@ -244,8 +246,14 @@ export default defineComponent({
     const toolsetDrafts = useEditorDraftIds("ai_toolset");
 
     const orgIdForList = useOrgId();
+    const { locked: toolsetsFeatureLocked } = useLicenseLock("ai_toolsets");
+    const { locked: assistantLocked } = useLicenseLock("ai_assistant");
+    // The list endpoint is licensed under ai_assistant, so either lock would 403 it.
+    const toolsetsLocked = computed(() => toolsetsFeatureLocked.value || assistantLocked.value);
     const toolsetsList = useQuery(() =>
-      Object.assign(aiToolsetsQuery(orgIdForList.value), { enabled: !!orgIdForList.value }),
+      Object.assign(aiToolsetsQuery(orgIdForList.value), {
+        enabled: !!orgIdForList.value && !toolsetsLocked.value,
+      }),
     );
 
     // The list is the query, not a copy: only an observer applies `staleTime` and revalidates on mount.
@@ -258,7 +266,8 @@ export default defineComponent({
       })),
     );
     const showAddDialog = ref(false);
-    const loading = toolsetsList.isPending;
+    // a disabled query stays pending forever
+    const loading = computed(() => !toolsetsLocked.value && toolsetsList.isPending.value);
     // A request is in flight while rows stay on screen — the refresh button's
     // spinner. `loading` is the skeleton, which only a cold read wants.
     const fetching = toolsetsList.isFetching;
@@ -267,7 +276,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = toolsetsList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     const viewState = useListViewState("ai-toolsets", {
       filterQuery: "",
@@ -377,7 +386,7 @@ export default defineComponent({
     const refreshData = () => getData(true);
 
     const getData = async (force = false) => {
-      if (force) await toolsetsList.refetch();
+      if (force && !toolsetsLocked.value) await toolsetsList.refetch();
     };
 
     let dismissLoading: (() => void) | null = null;
@@ -536,6 +545,7 @@ export default defineComponent({
       fetching,
       lastUpdatedAt,
       forbidden,
+      toolsetsLocked,
       tabledata,
       columns,
       showAddDialog,
diff --git a/web/src/components/settings/CipherKeys.vue b/web/src/components/settings/CipherKeys.vue
index 6c1a9e8abf..16ededf764 100644
--- a/web/src/components/settings/CipherKeys.vue
+++ b/web/src/components/settings/CipherKeys.vue
@@ -234,6 +234,7 @@ import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 
 export default defineComponent({
@@ -277,7 +278,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = cipherKeysList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     const viewState = useListViewState("cipher-keys", {
       filterQuery: "",
diff --git a/web/src/components/settings/CorrelationSettings.spec.ts b/web/src/components/settings/CorrelationSettings.spec.ts
index fb34f25297..df442945b7 100644
--- a/web/src/components/settings/CorrelationSettings.spec.ts
+++ b/web/src/components/settings/CorrelationSettings.spec.ts
@@ -95,11 +95,11 @@ const mockI18n = createI18n({
   },
 });
 
-function mountComponent() {
+function mountComponent(store = mockStore) {
   return mount(CorrelationSettings, {
     global: {
       plugins: [mockI18n],
-      provide: { store: mockStore },
+      provide: { store },
       stubs: {
         OTabs: {
           template: '<div class="o-tabs"><slot /></div>',
@@ -108,8 +108,13 @@ function mountComponent() {
         },
         OTab: {
           template:
-            '<div class="o-tab" :data-test="`tab-${name}`" :data-name="name"><slot /></div>',
-          props: ["name", "label", "noCaps", "icon"],
+            '<div class="o-tab" :data-test="`tab-${name}`" :data-name="name" :data-suffix="suffixIcon"><slot /></div>',
+          props: ["name", "label", "noCaps", "icon", "suffixIcon"],
+        },
+        LicenseDeniedState: {
+          name: "LicenseDeniedState",
+          props: ["features"],
+          template: '<div class="license-denied" :data-features="features.join(\',\')" />',
         },
       },
     },
@@ -124,6 +129,45 @@ describe("CorrelationSettings", () => {
     vi.clearAllMocks();
   });
 
+  describe("license locks", () => {
+    const storeWith = (features: Record<string, string>) =>
+      createStore({ state: { ...mockStore.state, zoConfig: { features } } });
+    const deniedFeatures = () =>
+      wrapper.findAll(".license-denied").map((d) => d.attributes("data-features"));
+
+    it("locks only the services and discovery tabs when correlation is locked", async () => {
+      wrapper = mountComponent(storeWith({ correlation: "locked" }));
+      await flushPromises();
+
+      expect(deniedFeatures()).toEqual(["correlation", "correlation"]);
+      expect(wrapper.find('[data-test="discovered-services"]').exists()).toBe(false);
+      expect(wrapper.find('[data-test="service-identity-setup"]').exists()).toBe(false);
+      expect(wrapper.find('[data-name="services"]').attributes("data-suffix")).toBe("lock");
+      expect(wrapper.find('[data-name="discovery"]').attributes("data-suffix")).toBe("lock");
+      expect(wrapper.find('[data-name="field-aliases"]').attributes("data-suffix")).toBeUndefined();
+      expect(serviceStreamsService.getSemanticGroups).toHaveBeenCalled();
+    });
+
+    it("locks field aliases and skips semantic groups when alerts is locked", async () => {
+      wrapper = mountComponent(storeWith({ alerts: "locked" }));
+      await flushPromises();
+
+      expect(deniedFeatures()).toEqual(["alerts"]);
+      expect(wrapper.find('[data-test="semantic-field-groups-config"]').exists()).toBe(false);
+      expect(wrapper.find('[data-test="discovered-services"]').exists()).toBe(true);
+      expect(wrapper.find('[data-name="field-aliases"]').attributes("data-suffix")).toBe("lock");
+      expect(serviceStreamsService.getSemanticGroups).not.toHaveBeenCalled();
+    });
+
+    it("renders every tab unlocked when both features are enabled", async () => {
+      wrapper = mountComponent(storeWith({ correlation: "enabled", alerts: "enabled" }));
+      await flushPromises();
+
+      expect(deniedFeatures()).toEqual([]);
+      expect(wrapper.findAll("[data-suffix]")).toHaveLength(0);
+    });
+  });
+
   describe("initial render", () => {
     it("should render without errors", () => {
       wrapper = mountComponent();
diff --git a/web/src/components/settings/CorrelationSettings.vue b/web/src/components/settings/CorrelationSettings.vue
index d305521d16..ccbc719236 100644
--- a/web/src/components/settings/CorrelationSettings.vue
+++ b/web/src/components/settings/CorrelationSettings.vue
@@ -37,12 +37,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         data-test="correlation-settings-tabs"
         @update:model-value="onTabChange"
       >
-        <OTab name="services" :label="t('settings.correlation.discoveredServicesTab')" />
-        <OTab name="discovery" :label="t('settings.correlation.serviceDiscoveryTab')" />
+        <OTab
+          name="services"
+          data-test="correlation-settings-services-tab"
+          :label="t('settings.correlation.discoveredServicesTab')"
+          :suffix-icon="correlationLocked ? 'lock' : undefined"
+        />
+        <OTab
+          name="discovery"
+          data-test="correlation-settings-discovery-tab"
+          :label="t('settings.correlation.serviceDiscoveryTab')"
+          :suffix-icon="correlationLocked ? 'lock' : undefined"
+        />
         <OTab
           name="field-aliases"
           data-test="correlation-settings-field-aliases-tab"
           :label="t('settings.correlation.fieldAliasesTab')"
+          :suffix-icon="alertsLocked ? 'lock' : undefined"
         />
       </OTabs>
     </template>
@@ -50,11 +61,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- Tab content -->
     <div class="min-h-0 flex-1 overflow-hidden">
       <div v-show="activeTab === 'services'" class="h-full">
-        <DiscoveredServices @navigate-to-configuration="onTabChange('discovery')" />
+        <LicenseDeniedState
+          v-if="correlationLocked"
+          :features="['correlation']"
+          data-test="correlation-services-license-denied"
+        />
+        <DiscoveredServices v-else @navigate-to-configuration="onTabChange('discovery')" />
       </div>
 
       <div v-show="activeTab === 'discovery'" class="px-page-edge h-full overflow-y-auto py-4">
+        <LicenseDeniedState
+          v-if="correlationLocked"
+          :features="['correlation']"
+          data-test="correlation-discovery-license-denied"
+        />
         <ServiceIdentitySetup
+          v-else
           :org-identifier="store.state.selectedOrganization.identifier"
           :semantic-groups="semanticGroups"
           @navigate-to-aliases="onNavigateToAliases"
@@ -63,7 +85,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </div>
 
       <div v-show="activeTab === 'field-aliases'" class="px-page-edge h-full overflow-y-auto py-4">
+        <LicenseDeniedState
+          v-if="alertsLocked"
+          :features="['alerts']"
+          data-test="correlation-field-aliases-license-denied"
+        />
         <SemanticFieldGroupsConfig
+          v-else
           :key="`field-aliases-${fieldAliasesEditorKey}`"
           :semantic-field-groups="draftSemanticGroups"
           :scroll-to-group-id="aliasScrollToGroup"
@@ -104,6 +132,8 @@ import { queryClient } from "@/composables/query/queryClient";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import { confirmForcedSignOutDiscard, draftSignOutForced } from "@/utils/drafts/draftSession";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 
 export default defineComponent({
   name: "CorrelationSettings",
@@ -111,6 +141,7 @@ export default defineComponent({
     DiscoveredServices,
     ServiceIdentitySetup,
     SemanticFieldGroupsConfig,
+    LicenseDeniedState,
     OTabs,
     OTab,
     OButton,
@@ -122,6 +153,8 @@ export default defineComponent({
     const { t } = useI18nTyped();
     const router = useRouter();
     const route = useRoute();
+    const { locked: correlationLocked } = useLicenseLock("correlation");
+    const { locked: alertsLocked } = useLicenseLock("alerts");
 
     // URL slug ↔ internal tab name
     const slugToTab: Record<string, string> = {
@@ -173,6 +206,8 @@ export default defineComponent({
       groups.map((g) => ({ ...g, fields: [...(g.fields ?? [])] }));
 
     const loadSemanticGroups = async () => {
+      // the semantic-groups endpoint is licensed under alerts
+      if (alertsLocked.value) return;
       try {
         const orgId = store.state.selectedOrganization.identifier;
         const res = await serviceStreamsService.getSemanticGroups(orgId);
@@ -315,6 +350,8 @@ export default defineComponent({
       isFieldAliasesDirty,
       savingFieldAliases,
       fieldAliasesEditorKey,
+      correlationLocked,
+      alertsLocked,
       t,
     };
   },
diff --git a/web/src/components/settings/DiscoveredServices.vue b/web/src/components/settings/DiscoveredServices.vue
index e804e8a096..501e86402b 100644
--- a/web/src/components/settings/DiscoveredServices.vue
+++ b/web/src/components/settings/DiscoveredServices.vue
@@ -41,7 +41,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </div>
 
     <div v-else-if="forbidden" class="flex flex-1 items-center justify-center">
-      <OEmptyState size="hero" preset="no-access" data-test="discovered-services-forbidden" />
+      <LicenseDeniedState
+        v-if="Array.isArray(forbidden)"
+        :features="forbidden"
+        data-test="discovered-services-license-denied"
+      />
+      <OEmptyState
+        v-else
+        size="hero"
+        preset="no-access"
+        data-test="discovered-services-forbidden"
+      />
     </div>
 
     <!-- Empty State -->
@@ -502,6 +512,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
@@ -512,6 +523,7 @@ import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 
 defineEmits<{
   (e: "navigate-to-configuration"): void;
@@ -542,7 +554,7 @@ interface ServiceGroup {
 const store = useStore();
 
 const loading = ref(true);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const refreshing = ref(false);
 const resetting = ref(false);
 const error = ref<string | null>(null);
@@ -824,7 +836,7 @@ const loadServices = async (isRefresh = false) => {
     }));
   } catch (err: any) {
     console.error("Failed to load services:", err);
-    forbidden.value = err?.response?.status === 403;
+    forbidden.value = forbiddenState(err);
     if (!forbidden.value) {
       error.value = err?.message || t("settings.discoveredServices.failedToLoadServices");
     }
diff --git a/web/src/components/settings/DomainManagement.spec.ts b/web/src/components/settings/DomainManagement.spec.ts
index 087aa17133..c3499a70e5 100644
--- a/web/src/components/settings/DomainManagement.spec.ts
+++ b/web/src/components/settings/DomainManagement.spec.ts
@@ -729,6 +729,45 @@ describe("DomainManagement Component", () => {
     });
   });
 
+  describe("Show more errors under a logs license lock", () => {
+    const openErrors = async () => {
+      // the lock composable was loaded before this file mocked vuex, so it injects the store
+      wrapper = mount(DomainManagement, {
+        attachTo: `#${uniqueNodeId}`,
+        global: { plugins: [i18n], provide: { store: mockStore } },
+      });
+      await flushPromises();
+      wrapper.vm.claimParserFunction = "parse";
+      wrapper.vm.showVrlInfo = true;
+      await flushPromises();
+      wrapper.vm.loadingErrors = false;
+      wrapper.vm.recentErrors = [{ error: "boom", _timestamp: 1 }];
+      await flushPromises();
+      return document.querySelector<HTMLButtonElement>(
+        '[data-test="domain-management-view-all-errors"]',
+      );
+    };
+
+    afterEach(() => {
+      delete (mockStore.state.zoConfig as Record<string, unknown>).features;
+    });
+
+    it("disables Show more while logs is locked", async () => {
+      (mockStore.state.zoConfig as Record<string, unknown>).features = { logs: "locked" };
+      const btn = await openErrors();
+      expect(btn?.disabled).toBe(true);
+    });
+
+    it("opens Logs from Show more when logs is enabled", async () => {
+      const push = vi.fn();
+      (mockRouter as Record<string, unknown>).push = push;
+      const btn = await openErrors();
+      expect(btn?.disabled).toBe(false);
+      btn?.click();
+      expect(push).toHaveBeenCalledWith(expect.objectContaining({ path: "/logs" }));
+    });
+  });
+
   describe("Component Cleanup", () => {
     it("should emit cancel event", async () => {
       wrapper = createWrapper();
diff --git a/web/src/components/settings/DomainManagement.vue b/web/src/components/settings/DomainManagement.vue
index 70beef3ced..17d6331fd8 100644
--- a/web/src/components/settings/DomainManagement.vue
+++ b/web/src/components/settings/DomainManagement.vue
@@ -145,14 +145,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
                 <!-- Show More Button -->
                 <div class="mt-2 text-center">
-                  <OButton
-                    icon-right="open-in-new"
-                    variant="ghost-primary"
-                    size="sm"
-                    @click="viewAllErrors"
+                  <OTooltip
+                    :content="logsLock.lockedReason.value"
+                    :disabled="!logsLock.locked.value"
                   >
-                    {{ t("common.showMore") }}
-                  </OButton>
+                    <span class="inline-flex">
+                      <OButton
+                        :icon-left="logsLock.locked.value ? 'lock' : undefined"
+                        :icon-right="logsLock.locked.value ? undefined : 'open-in-new'"
+                        variant="ghost-primary"
+                        size="sm"
+                        :disabled="logsLock.locked.value"
+                        data-test="domain-management-view-all-errors"
+                        @click="viewAllErrors"
+                      >
+                        {{ t("common.showMore") }}
+                      </OButton>
+                    </span>
+                  </OTooltip>
                 </div>
               </div>
             </div>
@@ -512,6 +522,7 @@ import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
@@ -564,6 +575,7 @@ const pendingRemoveEmail = ref<{
 const shownRemoveEmail = ref({ email: "", blocked: false });
 const store = useStore();
 const router = useRouter();
+const logsLock = useLicenseLock("logs");
 
 // Domain settings live on the meta org, not the selected one.
 const updateMetaOrgSettings = useMutation(() =>
diff --git a/web/src/components/settings/General.vue b/web/src/components/settings/General.vue
index 163d5d603b..66ddb23574 100644
--- a/web/src/components/settings/General.vue
+++ b/web/src/components/settings/General.vue
@@ -201,7 +201,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 data-test="settings_ent_logo_custom_text_locked"
               >
                 <template v-slot:icon-right>
-                  <OIcon name="lock" size="sm" class="text-warning-600" />
+                  <OIcon name="lock" size="sm" class="lock-chip" />
                 </template>
               </OInput>
             </div>
@@ -276,7 +276,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 class="o2-file-input mx-0"
               >
                 <template v-slot:prepend>
-                  <OIcon name="lock" size="sm" class="text-warning-600" />
+                  <OIcon name="lock" size="sm" class="lock-chip" />
                 </template>
               </OFile>
             </div>
@@ -365,7 +365,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 class="o2-file-input mx-0"
               >
                 <template v-slot:prepend>
-                  <OIcon name="lock" size="sm" class="text-warning-600" />
+                  <OIcon name="lock" size="sm" class="lock-chip" />
                 </template>
               </OFile>
             </div>
diff --git a/web/src/components/settings/License.spec.ts b/web/src/components/settings/License.spec.ts
index 40419f4338..7a6da7155c 100644
--- a/web/src/components/settings/License.spec.ts
+++ b/web/src/components/settings/License.spec.ts
@@ -1275,6 +1275,306 @@ describe("License.vue", () => {
     });
   });
 
+  describe("License features row", () => {
+    const configFeatures = {
+      alerts: "enabled",
+      dashboards: "enabled",
+      sso: "enabled",
+      rbac: "locked",
+      ai: "locked",
+      pipelines: "hidden",
+    };
+    const featureDefinition = {
+      features: {
+        alerts: {},
+        dashboards: { gate: false },
+        sso: { gate: true },
+        rbac: { gate: true },
+        ai: { gate: true },
+        pipelines: { gate: false },
+        metering: { gate: true, plumbing: true },
+      },
+    };
+
+    const mountWith = async (
+      license: Record<string, unknown>,
+      features: object = configFeatures,
+    ) => {
+      vi.mocked(licenseServer.get_license).mockResolvedValue(
+        createAxiosResponse({
+          ...mockLicenseData,
+          license: { ...mockLicenseData.license, ...license },
+        }),
+      );
+      store = createStore({
+        state: { zoConfig: { license_server_url: "https://license.example.com", features } },
+      });
+      wrapper = mount(License, {
+        global: { plugins: [store, i18n], stubs: { LicensePeriod: true, ODialog: ODialogStub } },
+      });
+      await flushPromises();
+    };
+
+    const find = (name: string) => wrapper.find(`[data-test=settings-license-features${name}]`);
+    const items = (name: string) =>
+      find(`-${name}`)
+        .findAll("li")
+        .map((li: any) => li.text());
+    const selectTab = async (id: string) => {
+      wrapper.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", id);
+      await flushPromises();
+    };
+    const licenseUrl =
+      "https://license.example.com/user/request-license?base_url=http%3A%2F%2Flocalhost%3A3000&license_id=test-installation-123";
+
+    it("summarises unlocked of paid features and the free count", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+
+      expect(find("").text()).toContain("Features");
+      expect(find("-summary").text()).toBe(
+        "Your license unlocks 1 of 3 paid features. 3 free features are always included.",
+      );
+    });
+
+    it("splits a feature definition into unlocked, missing and free", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+
+      expect(items("unlocked")).toEqual(["sso"]);
+      expect(items("missing")).toEqual(["ai", "rbac"]);
+      expect(items("free")).toEqual(["alerts", "dashboards", "metering"]);
+    });
+
+    it("falls back to the license list and the org config without a feature definition", async () => {
+      await mountWith({ features: ["sso", "alerts"] });
+
+      expect(items("unlocked")).toEqual(["alerts", "sso"]);
+      expect(items("missing")).toEqual(["ai", "rbac"]);
+      expect(items("free")).toEqual(["dashboards"]);
+    });
+
+    it("keeps a listed key unlocked even when the config hides it", async () => {
+      await mountWith({ features: ["sso", "pipelines"], feature_definition: featureDefinition });
+
+      expect(items("unlocked")).toEqual(["pipelines", "sso"]);
+      expect(find("-summary").text()).toContain("2 of 4 paid features");
+    });
+
+    it("hides the missing group and request access when nothing is missing", async () => {
+      await mountWith({ features: ["sso"] }, { alerts: "enabled", sso: "enabled" });
+
+      expect(find("-missing").exists()).toBe(false);
+      expect(find("-request-access").exists()).toBe(false);
+    });
+
+    it("reads 0 of N for an empty features list", async () => {
+      await mountWith({ features: [], feature_definition: featureDefinition });
+
+      expect(find("-summary").text()).toContain("0 of 3 paid features");
+      expect(find("-unlocked").exists()).toBe(false);
+    });
+
+    it("shows only the all-features summary for a license without a features list", async () => {
+      await mountWith({ feature_definition: featureDefinition });
+
+      expect(find("-summary").text()).toBe("Your license unlocks all features.");
+      expect(find("-list").exists()).toBe(false);
+      expect(find("-search").exists()).toBe(false);
+    });
+
+    it("always shows search, tabs and the fixed list box without expand or collapse", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+
+      expect(find("-search").exists()).toBe(true);
+      expect(find("-filter").exists()).toBe(true);
+      expect(find("-list").classes()).toEqual(expect.arrayContaining(["h-44", "overflow-auto"]));
+      expect(find("-expand").exists()).toBe(false);
+      expect(find("-collapse").exists()).toBe(false);
+    });
+
+    it("shows only the selected group for a filter tab", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+
+      expect(find("-filter").text()).toContain("All 6");
+      expect(find("-filter").text()).toContain("Not in your license 2");
+      await selectTab("missing");
+      expect(items("missing")).toEqual(["ai", "rbac"]);
+      expect(find("-unlocked").exists()).toBe(false);
+      expect(find("-free").exists()).toBe(false);
+    });
+
+    it("searches across groups and shows the no-match state when nothing matches", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+      const search = wrapper.findComponent({ name: "OSearchInput" });
+
+      search.vm.$emit("update:modelValue", "AL");
+      await flushPromises();
+      expect(items("free")).toEqual(["alerts"]);
+      expect(find("-unlocked").exists()).toBe(false);
+      expect(find("-missing").exists()).toBe(false);
+
+      search.vm.$emit("update:modelValue", "zzz");
+      await flushPromises();
+      expect(find("-empty").text()).toBe("No features match your search");
+      search.vm.$emit("update:modelValue", "");
+      await flushPromises();
+      expect(find("-empty").exists()).toBe(false);
+      expect(items("free")).toEqual(["alerts", "dashboards", "metering"]);
+    });
+
+    it("request access opens the same license-server page as Request new License", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+      const open = vi.spyOn(window, "open").mockReturnValue(null);
+
+      await find("-request-access").trigger("click");
+      await wrapper.find("[data-test=request-new-license-btn]").trigger("click");
+
+      expect(open).toHaveBeenCalledTimes(2);
+      for (const call of open.mock.calls) expect(call).toEqual([licenseUrl, "_blank"]);
+      open.mockRestore();
+    });
+
+    it("lets the masked license key wrap while the reveal button keeps its size", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+      const button = wrapper.find("[data-test=show-license-key-btn]");
+
+      expect(button.classes()).toContain("shrink-0");
+      expect(button.element.parentElement?.classList).toContain("flex-wrap");
+      expect(button.element.previousElementSibling?.classList).toContain("break-all");
+    });
+
+    it("strips trailing slashes from the license server url", async () => {
+      await mountWith({ features: ["sso"], feature_definition: featureDefinition });
+      store.state.zoConfig.license_server_url = "https://license.example.com//";
+      const open = vi.spyOn(window, "open").mockReturnValue(null);
+
+      await find("-request-access").trigger("click");
+
+      expect(open).toHaveBeenCalledWith(licenseUrl, "_blank");
+      open.mockRestore();
+    });
+
+    describe("new after your license", () => {
+      const withNew = {
+        ...configFeatures,
+        workflows: "locked",
+        traces_v2: "enabled",
+        legacy_beta: "hidden",
+      };
+      const licensed = { features: ["sso"], feature_definition: featureDefinition };
+
+      it("lists config keys missing from the license definition, ignoring hidden ones", async () => {
+        await mountWith(licensed, withNew);
+
+        expect(items("new")).toEqual(["traces_v2", "workflows"]);
+        expect(find("-new").text()).not.toContain("legacy_beta");
+        expect(find("-new").text()).toContain("New after your license · 2");
+        expect(find("-summary").text()).toBe(
+          "Your license unlocks 1 of 3 paid features. 3 free features are always included.",
+        );
+      });
+
+      it("hides the group when New is empty", async () => {
+        await mountWith(licensed, { ...configFeatures, legacy_beta: "hidden" });
+
+        expect(find("-new").exists()).toBe(false);
+      });
+
+      it("hides the group without a feature definition", async () => {
+        await mountWith({ features: ["sso"] }, withNew);
+
+        expect(find("-new").exists()).toBe(false);
+      });
+
+      it("hides the group without a features list", async () => {
+        await mountWith({ feature_definition: featureDefinition }, withNew);
+
+        expect(find("-new").exists()).toBe(false);
+      });
+
+      it("shows enabled keys with the free dot and locked keys with a lock", async () => {
+        await mountWith(licensed, withNew);
+        const icons = find("-new")
+          .findAll("li")
+          .map((li: any) => li.findComponent({ name: "OIcon" }).exists());
+
+        expect(icons).toEqual([false, true]);
+        expect(find("-new").find("li .lock-chip").exists()).toBe(true);
+      });
+
+      it("shows request access when only a New key is locked and opens the license page", async () => {
+        const allPaid = { features: ["sso", "ai", "rbac"], feature_definition: featureDefinition };
+        await mountWith(allPaid, { ...configFeatures, traces_v2: "enabled" });
+        expect(find("-request-access").exists()).toBe(false);
+
+        wrapper.unmount();
+        await mountWith(allPaid, withNew);
+        const open = vi.spyOn(window, "open").mockReturnValue(null);
+        await find("-request-access").trigger("click");
+
+        expect(open).toHaveBeenCalledWith(licenseUrl, "_blank");
+        open.mockRestore();
+      });
+
+      it("filters to the New group with its tab and covers it in search", async () => {
+        await mountWith(licensed, withNew);
+
+        expect(find("-filter").text()).toContain("All 8");
+        expect(find("-filter").text()).toContain("New 2");
+        await selectTab("new");
+        expect(items("new")).toEqual(["traces_v2", "workflows"]);
+        expect(find("-unlocked").exists()).toBe(false);
+        expect(find("-missing").exists()).toBe(false);
+        expect(find("-free").exists()).toBe(false);
+
+        await selectTab("all");
+        wrapper.findComponent({ name: "OSearchInput" }).vm.$emit("update:modelValue", "WORK");
+        await flushPromises();
+        expect(items("new")).toEqual(["workflows"]);
+        expect(find("-free").exists()).toBe(false);
+      });
+
+      it("orders groups and filter tabs unlocked, missing, new, free", async () => {
+        await mountWith(licensed, withNew);
+        const order = (prefix: string, ids: string[]) =>
+          wrapper
+            .findAll(`[data-test^=${prefix}]`)
+            .map((el: any) => el.attributes("data-test").slice(prefix.length))
+            .filter((id: string) => ids.includes(id));
+
+        expect(order("settings-license-features-", ["unlocked", "missing", "new", "free"])).toEqual(
+          ["unlocked", "missing", "new", "free"],
+        );
+        expect(
+          order("settings-license-features-filter-", ["all", "unlocked", "missing", "new", "free"]),
+        ).toEqual(["all", "unlocked", "missing", "new", "free"]);
+      });
+
+      it("cuts list keys with an overflow-only tooltip instead of a title or breaking them", async () => {
+        await mountWith(licensed, withNew);
+        const label = find("-new").find("li [data-test=o-truncated-text]");
+
+        expect(label.text()).toBe("traces_v2");
+        expect(label.attributes("title")).toBeUndefined();
+        expect(label.classes()).not.toContain("break-all");
+      });
+
+      it("has no New tab when New is empty", async () => {
+        await mountWith(licensed);
+
+        expect(find("-filter-new").exists()).toBe(false);
+      });
+
+      it("never puts a key in two groups", async () => {
+        await mountWith({ ...licensed, features: ["sso", "workflows"] }, withNew);
+        const all = ["unlocked", "missing", "free", "new"].flatMap((group) => items(group));
+
+        expect(new Set(all).size).toBe(all.length);
+        expect(items("unlocked")).toEqual(["sso", "workflows"]);
+        expect(items("new")).toEqual(["traces_v2"]);
+      });
+    });
+  });
+
   describe("Component Cleanup", () => {
     it("should cleanup properly on unmount", async () => {
       vi.mocked(licenseServer.get_license).mockResolvedValue(createAxiosResponse(mockLicenseData));
diff --git a/web/src/components/settings/License.vue b/web/src/components/settings/License.vue
index 985931801d..194a20bc55 100644
--- a/web/src/components/settings/License.vue
+++ b/web/src/components/settings/License.vue
@@ -87,27 +87,34 @@
           <OCard class="border-card-glass-border border border-solid">
             <OCardSection role="body">
               <div class="mb-3 text-xl font-semibold">{{ t("about.license_info") }}</div>
-              <table class="border-table-header-border w-full border-collapse border border-solid">
+              <!-- fixed layout so the label column keeps its width when the features cell grows or shrinks -->
+              <table
+                class="border-table-header-border w-full table-fixed border-collapse border border-solid wrap-break-word"
+              >
                 <tbody>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.installation_id") }}
                     </td>
-                    <td class="px-3 py-2 leading-[1.2]">{{ licenseData.installation_id }}</td>
+                    <td class="px-3 py-2 leading-[1.2] break-all">
+                      {{ licenseData.installation_id }}
+                    </td>
                   </tr>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.license_id") }}
                     </td>
-                    <td class="px-3 py-2 leading-[1.2]">{{ licenseData.license.license_id }}</td>
+                    <td class="px-3 py-2 leading-[1.2] break-all">
+                      {{ licenseData.license.license_id }}
+                    </td>
                   </tr>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.status_lbl") }}
                     </td>
@@ -117,9 +124,25 @@
                       </OBadge>
                     </td>
                   </tr>
+                  <tr
+                    class="border-table-row-divider border-b border-solid"
+                    data-test="settings-license-features"
+                  >
+                    <td
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 align-top leading-[1.2] font-bold"
+                    >
+                      {{ t("about.features") }}
+                    </td>
+                    <td class="px-3 py-2 text-sm">
+                      <LicenseFeatures
+                        :license="licenseData.license"
+                        @request-access="redirectToGetLicense"
+                      />
+                    </td>
+                  </tr>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.create_at_lbl") }}
                     </td>
@@ -129,7 +152,7 @@
                   </tr>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.expires_at_lbl") }}
                     </td>
@@ -139,7 +162,7 @@
                   </tr>
                   <tr class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.company") }}
                     </td>
@@ -147,18 +170,18 @@
                   </tr>
                   <tr v-if="licenseData.key" class="border-table-row-divider border-b border-solid">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.license_key") }}
                     </td>
                     <td class="px-3 py-2 leading-[1.2]">
-                      <div class="flex items-center gap-2">
-                        <span>{{ getMaskedLicenseKey() }}</span>
+                      <div class="flex flex-wrap items-center gap-2">
+                        <span class="min-w-0 break-all">{{ getMaskedLicenseKey() }}</span>
                         <OButton
                           :aria-label="t('common.reveal')"
                           variant="ghost"
                           size="icon"
-                          class="ms-2"
+                          class="shrink-0"
                           data-test="show-license-key-btn"
                           @click="showLicenseKeyModal = true"
                         >
@@ -172,7 +195,7 @@
                     class="border-table-row-divider border-b border-solid"
                   >
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.contact_name") }}
                     </td>
@@ -183,15 +206,17 @@
                     class="border-table-row-divider border-b border-solid"
                   >
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.contact_email") }}
                     </td>
-                    <td class="px-3 py-2 leading-[1.2]">{{ licenseData.license.contact_email }}</td>
+                    <td class="px-3 py-2 leading-[1.2] break-all">
+                      {{ licenseData.license.contact_email }}
+                    </td>
                   </tr>
                   <tr v-if="licenseData.license.environment_type">
                     <td
-                      class="border-table-row-divider border-e border-solid px-3 py-2 leading-[1.2] font-bold"
+                      class="border-table-row-divider w-2/5 border-e border-solid px-3 py-2 leading-[1.2] font-bold"
                     >
                       {{ t("about.environment_type") }}
                     </td>
@@ -495,6 +520,7 @@ import DOMPurify from "dompurify";
 import LicensePeriod from "@/enterprise/components/billings/LicensePeriod.vue";
 import LicenseStatusCard from "./LicenseStatusCard.vue";
 import LicenseWaiversCard from "./LicenseWaiversCard.vue";
+import LicenseFeatures from "./LicenseFeatures.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
@@ -521,6 +547,7 @@ export default defineComponent({
     LicensePeriod,
     LicenseStatusCard,
     LicenseWaiversCard,
+    LicenseFeatures,
     RenderDashboardCharts,
     OButton,
     ODialog,
@@ -686,7 +713,8 @@ export default defineComponent({
     const redirectToGetLicense = () => {
       const baseUrl = window.location.origin;
       const installationId = licenseData.value.installation_id || "";
-      const licenseUrl = `${store.state.zoConfig.license_server_url}/user/request-license?base_url=${encodeURIComponent(baseUrl)}&license_id=${encodeURIComponent(installationId)}`;
+      const serverUrl = String(store.state.zoConfig.license_server_url ?? "").replace(/\/+$/, "");
+      const licenseUrl = `${serverUrl}/user/request-license?base_url=${encodeURIComponent(baseUrl)}&license_id=${encodeURIComponent(installationId)}`;
       window.open(licenseUrl, "_blank");
     };
 
diff --git a/web/src/components/settings/LicenseFeatures.spec.ts b/web/src/components/settings/LicenseFeatures.spec.ts
new file mode 100644
index 0000000000..cd0dc15e93
--- /dev/null
+++ b/web/src/components/settings/LicenseFeatures.spec.ts
@@ -0,0 +1,103 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { mount, enableAutoUnmount, flushPromises } from "@vue/test-utils";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import LicenseFeatures from "./LicenseFeatures.vue";
+
+enableAutoUnmount(afterEach);
+
+const definition = {
+  features: {
+    workflows: { display_name: "Workflows", gate: true },
+    rbac: { display_name: "Role-Based Access Control", gate: true },
+    logs: { display_name: "Logs", gate: false },
+  },
+};
+
+const mountFeatures = (features: string[]) =>
+  mount(LicenseFeatures, {
+    props: { license: { features, feature_definition: definition } },
+    global: {
+      plugins: [i18n, createStore({ state: { zoConfig: { features: {} } } })],
+    },
+  });
+
+const find = (wrapper: ReturnType<typeof mountFeatures>, name: string) =>
+  wrapper.find(`[data-test="settings-license-features-${name}"]`);
+
+const items = (wrapper: ReturnType<typeof mountFeatures>, name: string) =>
+  find(wrapper, name)
+    .findAll("li")
+    .map((li) => li.text());
+
+describe("LicenseFeatures", () => {
+  it("shows every gated feature as unlocked when the license lists only all", () => {
+    const wrapper = mountFeatures(["all"]);
+
+    expect(items(wrapper, "unlocked")).toEqual(["Role-Based Access Control", "Workflows"]);
+    expect(find(wrapper, "unlocked").text()).not.toMatch(/\ball\b/);
+    expect(find(wrapper, "missing").exists()).toBe(false);
+    expect(find(wrapper, "request-access").exists()).toBe(false);
+  });
+
+  it("lists the features that are not in a license with named features", () => {
+    const wrapper = mountFeatures(["workflows"]);
+
+    expect(items(wrapper, "unlocked")).toEqual(["Workflows"]);
+    expect(items(wrapper, "missing")).toEqual(["Role-Based Access Control"]);
+  });
+
+  it("shows search, tabs and the list box without any expand step", () => {
+    const wrapper = mountFeatures(["workflows"]);
+
+    expect(find(wrapper, "search").exists()).toBe(true);
+    expect(find(wrapper, "filter").exists()).toBe(true);
+    expect(find(wrapper, "expand").exists()).toBe(false);
+    expect(find(wrapper, "collapse").exists()).toBe(false);
+    expect(items(wrapper, "free")).toEqual(["Logs"]);
+  });
+
+  it("keeps the list in a fixed-height scroll box", () => {
+    const box = find(mountFeatures(["workflows"]), "list");
+
+    expect(box.exists()).toBe(true);
+    expect(box.classes()).toEqual(expect.arrayContaining(["h-44", "overflow-auto"]));
+  });
+
+  it("shows only the selected tab's group, without group headings", async () => {
+    const wrapper = mountFeatures(["workflows"]);
+    expect(find(wrapper, "list").text()).toContain("Unlocked · 1");
+
+    wrapper.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", "missing");
+    await flushPromises();
+
+    expect(items(wrapper, "missing")).toEqual(["Role-Based Access Control"]);
+    expect(find(wrapper, "unlocked").exists()).toBe(false);
+    expect(find(wrapper, "free").exists()).toBe(false);
+    expect(find(wrapper, "list").text()).not.toContain("Not in your license ·");
+  });
+
+  it("filters by search and shows the no-match state inside the box", async () => {
+    const wrapper = mountFeatures(["workflows"]);
+    const search = wrapper.findComponent({ name: "OSearchInput" });
+
+    search.vm.$emit("update:modelValue", "role");
+    await flushPromises();
+    expect(items(wrapper, "missing")).toEqual(["Role-Based Access Control"]);
+    expect(find(wrapper, "unlocked").exists()).toBe(false);
+
+    search.vm.$emit("update:modelValue", "zzz");
+    await flushPromises();
+    expect(find(wrapper, "list").find('[data-test="settings-license-features-empty"]').text()).toBe(
+      "No features match your search",
+    );
+  });
+
+  it("emits request-access from the lead sentence button", async () => {
+    const wrapper = mountFeatures(["workflows"]);
+
+    await find(wrapper, "request-access").trigger("click");
+
+    expect(wrapper.emitted("request-access")).toHaveLength(1);
+  });
+});
diff --git a/web/src/components/settings/LicenseFeatures.vue b/web/src/components/settings/LicenseFeatures.vue
new file mode 100644
index 0000000000..cddbe4f968
--- /dev/null
+++ b/web/src/components/settings/LicenseFeatures.vue
@@ -0,0 +1,229 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <!-- absent list is a pre-entitlement license, which unlocks every feature -->
+  <p v-if="!split" data-test="settings-license-features-summary">
+    {{ t("about.features_all_unlocked") }}
+  </p>
+  <div v-else class="flex flex-col gap-2">
+    <div class="flex items-start justify-between gap-3">
+      <i18n-t
+        keypath="about.features_summary"
+        tag="p"
+        class="min-w-0 flex-1"
+        :plural="split.free.length"
+        data-test="settings-license-features-summary"
+      >
+        <template #ratio>
+          <span class="text-text-heading font-semibold">{{
+            t(
+              "about.features_paid_ratio",
+              { unlocked: split.unlocked.length, paid: split.paid },
+              split.paid,
+            )
+          }}</span>
+        </template>
+        <template #free>{{ split.free.length }}</template>
+      </i18n-t>
+      <OButton
+        v-if="split.missing.length || split.addedLocked.length"
+        variant="ghost-primary"
+        size="xs"
+        icon-right="arrow-forward"
+        class="shrink-0"
+        data-test="settings-license-features-request-access"
+        @click="emit('request-access')"
+      >
+        {{ t("about.features_request_access") }}
+      </OButton>
+    </div>
+
+    <div class="flex flex-wrap items-center gap-2">
+      <OSearchInput
+        v-model="search"
+        class="min-w-0 flex-1 max-md:min-w-40 md:min-w-60"
+        :placeholder="t('about.features_search', { count: total }, total)"
+        data-test="settings-license-features-search"
+      />
+      <OToggleGroup
+        :model-value="filter"
+        type="single"
+        mobile-dropdown
+        data-test="settings-license-features-filter"
+        @update:model-value="(value) => (filter = value as FilterId)"
+      >
+        <OToggleGroupItem
+          v-for="option in filterOptions"
+          :key="option.id"
+          :value="option.id"
+          size="sm"
+          :data-test="`settings-license-features-filter-${option.id}`"
+        >
+          {{ option.label }}
+          <span class="text-text-secondary ms-1">{{ option.count }}</span>
+        </OToggleGroupItem>
+      </OToggleGroup>
+    </div>
+
+    <!-- fixed height so switching tabs or searching never moves what sits below -->
+    <div
+      class="border-border-default bg-surface-subtle rounded-default h-44 [scrollbar-gutter:stable] overflow-auto border px-3 pb-2"
+      data-test="settings-license-features-list"
+    >
+      <div
+        v-for="group in visibleGroups"
+        :key="group.id"
+        :data-test="`settings-license-features-${group.id}`"
+      >
+        <div
+          v-if="filter === 'all'"
+          class="bg-surface-subtle text-text-secondary sticky top-0 z-10 pt-2 pb-1 text-xs font-semibold"
+        >
+          {{
+            group.id === "free"
+              ? group.heading
+              : t("about.features_group_heading", {
+                  heading: group.heading,
+                  count: group.items.length,
+                })
+          }}
+        </div>
+        <ul
+          class="grid grid-cols-2 gap-x-4 max-md:grid-cols-1"
+          :class="{ 'pt-2': filter !== 'all' }"
+        >
+          <li
+            v-for="key in group.items"
+            :key="key"
+            class="flex min-w-0 items-center gap-1.5 py-0.5"
+          >
+            <OIcon
+              v-if="group.id === 'unlocked'"
+              name="check"
+              size="xs"
+              class="text-status-positive shrink-0"
+            />
+            <OIcon
+              v-else-if="group.id === 'missing' || split.addedLocked.includes(key)"
+              name="lock"
+              size="xs"
+              class="lock-chip shrink-0"
+            />
+            <span v-else class="bg-border-strong size-1.5 shrink-0 rounded-full" />
+            <OTruncatedText class="min-w-0">{{ raw(name(key)) }}</OTruncatedText>
+          </li>
+        </ul>
+      </div>
+      <OEmptyState
+        v-if="!visibleGroups.length"
+        size="inline"
+        icon="search"
+        :title="search.trim() ? t('about.features_no_match') : t('about.features_none')"
+        :backdrop="false"
+        data-test="settings-license-features-empty"
+      />
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import { splitLicenseFeatures, type LicenseFeatureSource } from "@/utils/featureGate";
+
+type GroupId = "unlocked" | "missing" | "free" | "new";
+type FilterId = "all" | GroupId;
+
+const props = defineProps<{ license: LicenseFeatureSource | null | undefined }>();
+
+const emit = defineEmits<{ (e: "request-access"): void }>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+const search = ref("");
+const filter = ref<FilterId>("all");
+
+// A key this build has no name for may still be named in the definition the license was issued with.
+const name = (key: string): string =>
+  store.state.zoConfig?.feature_names?.[key] ??
+  props.license?.feature_definition?.features?.[key]?.display_name ??
+  key;
+
+const split = computed(() =>
+  splitLicenseFeatures(props.license, store.state.zoConfig?.features ?? {}),
+);
+
+const total = computed(() =>
+  split.value
+    ? split.value.unlocked.length +
+      split.value.missing.length +
+      split.value.free.length +
+      split.value.added.length
+    : 0,
+);
+
+const groups = computed(() => {
+  const s = split.value;
+  if (!s) return [];
+  return [
+    { id: "unlocked" as const, heading: t("about.features_unlocked"), items: s.unlocked },
+    { id: "missing" as const, heading: t("about.features_missing"), items: s.missing },
+    { id: "new" as const, heading: t("about.features_new"), items: s.added },
+    { id: "free" as const, heading: t("about.features_free_heading"), items: s.free },
+  ];
+});
+
+const filterOptions = computed(() => {
+  const s = split.value;
+  return [
+    { id: "all" as const, label: t("about.features_filter_all"), count: total.value },
+    {
+      id: "unlocked" as const,
+      label: t("about.features_unlocked"),
+      count: s?.unlocked.length ?? 0,
+    },
+    {
+      id: "missing" as const,
+      label: t("about.features_missing"),
+      count: s?.missing.length ?? 0,
+    },
+    { id: "new" as const, label: t("about.features_filter_new"), count: s?.added.length ?? 0 },
+    { id: "free" as const, label: t("about.features_filter_free"), count: s?.free.length ?? 0 },
+  ].filter((option) => option.id !== "new" || option.count);
+});
+
+const visibleGroups = computed(() => {
+  const query = search.value.trim().toLowerCase();
+  return groups.value
+    .filter((group) => filter.value === "all" || filter.value === group.id)
+    .map((group) => ({
+      ...group,
+      items: group.items.filter(
+        (key) => key.toLowerCase().includes(query) || name(key).toLowerCase().includes(query),
+      ),
+    }))
+    .filter((group) => group.items.length);
+});
+</script>
diff --git a/web/src/components/settings/LlmProvidersSettings.vue b/web/src/components/settings/LlmProvidersSettings.vue
index 2e70cca695..93b61a2205 100644
--- a/web/src/components/settings/LlmProvidersSettings.vue
+++ b/web/src/components/settings/LlmProvidersSettings.vue
@@ -30,7 +30,12 @@
       </div>
 
       <div v-else-if="forbidden" class="flex flex-1 items-center justify-center">
-        <OEmptyState size="hero" preset="no-access" data-test="llm-providers-forbidden" />
+        <LicenseDeniedState
+          v-if="Array.isArray(forbidden)"
+          :features="forbidden"
+          data-test="llm-providers-license-denied"
+        />
+        <OEmptyState v-else size="hero" preset="no-access" data-test="llm-providers-forbidden" />
       </div>
 
       <div v-else-if="!providers.length" class="flex flex-1 items-center justify-center">
@@ -212,11 +217,13 @@ import {
 import { showError } from "@/enterprise/components/onlineEvals/utils/evalFormat";
 import ProviderFormPage from "@/enterprise/components/onlineEvals/forms/ProviderFormPage.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 
 const { t } = useI18nTyped();
@@ -273,7 +280,7 @@ const isFetching = providersList.isFetching;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = providersList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 const lastUpdatedAt = providersList.dataUpdatedAt;
 watch(providersList.error, (err: any) => {
diff --git a/web/src/components/settings/ModelPricingList.vue b/web/src/components/settings/ModelPricingList.vue
index 0b92a02406..b4711c0a8c 100644
--- a/web/src/components/settings/ModelPricingList.vue
+++ b/web/src/components/settings/ModelPricingList.vue
@@ -752,6 +752,7 @@ import {
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 
 const { t } = useI18nTyped();
@@ -842,7 +843,7 @@ const lastUpdatedAt = modelsQuery.dataUpdatedAt;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = modelsQuery.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 const refreshing = ref(false);
 
diff --git a/web/src/components/settings/Nodes.spec.ts b/web/src/components/settings/Nodes.spec.ts
index 9612a6cbd2..649acaeba5 100644
--- a/web/src/components/settings/Nodes.spec.ts
+++ b/web/src/components/settings/Nodes.spec.ts
@@ -397,6 +397,42 @@ describe("Nodes", () => {
       const ids = wrapper.vm.computedOTableColumns.map((c: any) => c.id);
       expect(ids).not.toContain("region");
     });
+
+    it("drops the region column and shows locked region/cluster filters under a super_cluster lock", async () => {
+      const lockedStore = createStore({
+        state: {
+          selectedOrganization: { identifier: "test-org" },
+          zoConfig: { super_cluster_enabled: true, features: { super_cluster: "locked" } },
+          theme: "light",
+        },
+      });
+      wrapper = mount(Nodes, {
+        global: {
+          plugins: [mockI18n],
+          provide: { store: lockedStore },
+          stubs: {
+            Pagination: { template: "<div />" },
+            NoData: { template: "<div />" },
+            OTooltip: { template: "<div><slot /></div>" },
+          },
+        },
+      });
+      await flushPromises();
+      const ids = wrapper.vm.computedOTableColumns.map((c: any) => c.id);
+      expect(ids).not.toContain("region");
+      for (const key of ["region", "cluster"]) {
+        const btn = wrapper.find(`[data-test="nodes-${key}-filter-locked"]`);
+        expect(btn.exists()).toBe(true);
+        expect(btn.attributes("disabled")).toBeDefined();
+      }
+      expect(wrapper.find('[data-test="nodes-region-table"]').exists()).toBe(false);
+    });
+
+    it("shows no locked filters when the license leaves super_cluster enabled", async () => {
+      wrapper = mountComponent();
+      await flushPromises();
+      expect(wrapper.find('[data-test="nodes-region-filter-locked"]').exists()).toBe(false);
+    });
   });
 
   describe("error handling", () => {
diff --git a/web/src/components/settings/Nodes.vue b/web/src/components/settings/Nodes.vue
index cb3a84f7cd..3ebb869c63 100644
--- a/web/src/components/settings/Nodes.vue
+++ b/web/src/components/settings/Nodes.vue
@@ -52,8 +52,29 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
           <div class="min-h-0 overflow-y-auto">
             <div class="flex flex-col px-2 pb-2">
+              <OTooltip
+                v-if="store.state.zoConfig.super_cluster_enabled && superClusterLocked"
+                :content="superClusterLockedReason"
+              >
+                <span class="mb-2 flex flex-col gap-1">
+                  <OButton
+                    v-for="key in ['region', 'cluster'] as const"
+                    :key="key"
+                    variant="ghost"
+                    size="sm"
+                    class="justify-start"
+                    disabled
+                    :data-test="`nodes-${key}-filter-locked`"
+                  >
+                    <template #icon-left>
+                      <OIcon name="lock" size="sm" class="lock-chip" />
+                    </template>
+                    {{ t(`nodes.${key}`) }}
+                  </OButton>
+                </span>
+              </OTooltip>
               <OCollapsible
-                v-if="regionRows.length > 0 && store.state.zoConfig.super_cluster_enabled"
+                v-if="regionRows.length > 0 && superClusterOn"
                 variant="sidebar"
                 :model-value="sectionOpen.region"
                 @update:model-value="(v) => (sectionOpen.region = v)"
@@ -87,16 +108,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 </div>
               </OCollapsible>
               <OSeparator
-                v-if="
-                  regionRows.length > 0 &&
-                  store.state.zoConfig.super_cluster_enabled &&
-                  sectionOpen.region
-                "
+                v-if="regionRows.length > 0 && superClusterOn && sectionOpen.region"
                 class="my-2"
               />
 
               <OCollapsible
-                v-if="clusterRows.length > 0 && store.state.zoConfig.super_cluster_enabled"
+                v-if="clusterRows.length > 0 && superClusterOn"
                 variant="sidebar"
                 :model-value="sectionOpen.cluster"
                 @update:model-value="(v) => (sectionOpen.cluster = v)"
@@ -130,11 +147,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 </div>
               </OCollapsible>
               <OSeparator
-                v-if="
-                  clusterRows.length > 0 &&
-                  store.state.zoConfig.super_cluster_enabled &&
-                  sectionOpen.cluster
-                "
+                v-if="clusterRows.length > 0 && superClusterOn && sectionOpen.cluster"
                 class="my-2"
               />
 
@@ -501,7 +514,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </span>
             </template>
 
-            <template v-if="store.state.zoConfig.super_cluster_enabled" #cell-region="{ row }">
+            <template v-if="superClusterOn" #cell-region="{ row }">
               <OTag type="fieldTag" class="badge-region me-1"
                 >{{ row.region }}
                 <OTooltip :content="t('nodes.region')" />
@@ -577,6 +590,7 @@ import OStatStrip from "@/lib/data/StatStrip/OStatStrip.vue";
 import type { StatItem } from "@/lib/data/StatStrip/OStatStrip.types";
 import type { ProgressBarVariant } from "@/lib/data/ProgressBar/OProgressBar.types";
 import useIsMetaOrg from "@/composables/useIsMetaOrg";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OCollapsible from "@/lib/core/Collapsible/OCollapsible.vue";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
@@ -611,6 +625,11 @@ export default defineComponent({
     const store = useStore();
     const router = useRouter();
     const { t } = useI18nTyped();
+    const { locked: superClusterLocked, lockedReason: superClusterLockedReason } =
+      useLicenseLock("super_cluster");
+    const superClusterOn = computed(
+      () => !!store.state.zoConfig.super_cluster_enabled && !superClusterLocked.value,
+    );
 
     const sectionOpen = reactive({
       region: false,
@@ -755,7 +774,7 @@ export default defineComponent({
       ];
       // Region/cluster only mean something in a super-cluster. Filter by id rather
       // than by position so adding a column can't silently drop the wrong one.
-      if (!store.state.zoConfig.super_cluster_enabled) {
+      if (!superClusterOn.value) {
         return columns.filter((col) => col.id !== "region");
       }
       return columns;
@@ -1305,6 +1324,9 @@ export default defineComponent({
       cpuUsage,
       memoryUsage,
       regionRows,
+      superClusterOn,
+      superClusterLocked,
+      superClusterLockedReason,
       clusterRows,
       nodetypeRows,
       statusesRows,
diff --git a/web/src/components/settings/OrganizationManagement.spec.ts b/web/src/components/settings/OrganizationManagement.spec.ts
index 410e817ec7..6300099445 100644
--- a/web/src/components/settings/OrganizationManagement.spec.ts
+++ b/web/src/components/settings/OrganizationManagement.spec.ts
@@ -260,7 +260,7 @@ describe("OrganizationManagement.vue", () => {
           ODialog: ODialogStub,
           OTable: OTableStub,
           // Stub heavy sub-components that are not under test
-          OTooltip: { template: "<span />" },
+          OTooltip: { template: "<span><slot /></span>" },
           OIcon: { template: "<span />" },
           // Keep OInput functional but lightweight — tests use data-test to find it
           OInput: {
@@ -865,6 +865,44 @@ describe("OrganizationManagement.vue", () => {
       const storageEnableBtn = wrapper.find('[data-test="org-management-storage-enable-btn"]');
       expect(storageEnableBtn.exists()).toBe(false);
     });
+
+    it.each([
+      ["locked", "lock", true],
+      ["enabled", "cloud-upload", false],
+    ])(
+      "renders Enable BYOB with the %s license as icon %s, disabled=%s",
+      async (state, icon, disabled) => {
+        store.state.zoConfig.meta_org = "default";
+        store.state.zoConfig.features = { byob: state };
+        mockGetAdminOrg.mockResolvedValue({
+          data: {
+            data: [
+              {
+                id: 1,
+                name: "Test Org",
+                identifier: "test-org",
+                plan: "0",
+                created_at: 123456789,
+                trial_expires_at: 987654321,
+                billing_provider: "-",
+                org_storage_enabled: false,
+              },
+            ],
+          },
+        });
+
+        wrapper = createWrapper();
+        await flushPromises();
+        await nextTick();
+
+        const btn = wrapper
+          .findAllComponents({ name: "OButton" })
+          .find((b) => b.attributes("data-test") === "org-management-storage-enable-btn")!;
+        expect(btn.props("iconLeft")).toBe(icon);
+        expect(Boolean(btn.props("disabled"))).toBe(disabled);
+        store.state.zoConfig.features = {};
+      },
+    );
   });
 
   describe("Organization Deletion Status", () => {
diff --git a/web/src/components/settings/OrganizationManagement.vue b/web/src/components/settings/OrganizationManagement.vue
index 81d6e1348b..9c6c55e4ae 100644
--- a/web/src/components/settings/OrganizationManagement.vue
+++ b/web/src/components/settings/OrganizationManagement.vue
@@ -168,8 +168,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               >
                 <OTooltip :content="t('settings.organizationManagementPage.revoke')" />
               </OButton>
+              <OTooltip v-if="!row.org_storage_enabled && byobLocked" :content="byobLockedReason">
+                <span class="inline-flex max-md:hidden">
+                  <OButton
+                    variant="ghost"
+                    size="icon-xs-circle"
+                    icon-left="lock"
+                    disabled
+                    :aria-label="t('settings.organizationManagementPage.enableStorage')"
+                    data-test="org-management-storage-enable-btn"
+                  />
+                </span>
+              </OTooltip>
               <OButton
-                v-if="!row.org_storage_enabled"
+                v-else-if="!row.org_storage_enabled"
                 variant="ghost"
                 size="icon-xs-circle"
                 icon-left="cloud-upload"
@@ -270,7 +282,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 </ODropdownItem>
                 <ODropdownItem
                   v-if="!row.org_storage_enabled"
-                  icon-left="cloud-upload"
+                  :icon-left="byobLocked ? 'lock' : 'cloud-upload'"
+                  :disabled="byobLocked"
+                  :focusable-unavailable="byobLocked"
+                  :description="byobLocked ? byobLockedReason : null"
                   class="md:hidden"
                   data-test="org-management-storage-enable-btn-menu"
                   @select="toggleOrgStorage(row)"
@@ -508,6 +523,7 @@ import { timestampToTimezoneDate, getImageURL } from "@/utils/zincutils";
 import { useStore } from "vuex";
 import { useRouter } from "vue-router";
 import OrganizationServices from "@/services/organizations";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
@@ -572,6 +588,7 @@ export default defineComponent({
     const { t } = useI18nTyped();
     const router = useRouter();
     const { confirm } = useConfirmDialog();
+    const { locked: byobLocked, lockedReason: byobLockedReason } = useLicenseLock("byob");
 
     const extendTrialDataRow = ref();
     const extendedTrial = ref(1);
@@ -1191,6 +1208,7 @@ export default defineComponent({
     };
 
     const toggleOrgStorage = async (row: any) => {
+      if (byobLocked.value) return;
       const ok = await confirm({
         title: t("settings.organizationManagementPage.enableByobTitle"),
         message: t("settings.organizationManagementPage.enableByobMessage", { name: row.name }),
@@ -1347,6 +1365,8 @@ export default defineComponent({
       submitContract,
       confirmRevokeContract,
       toggleOrgStorage,
+      byobLocked,
+      byobLockedReason,
       formatMicrosToDate,
       formatCredits,
       filterQuery,
diff --git a/web/src/components/settings/RegexPatternList.vue b/web/src/components/settings/RegexPatternList.vue
index 2078cc619c..46d68901b7 100644
--- a/web/src/components/settings/RegexPatternList.vue
+++ b/web/src/components/settings/RegexPatternList.vue
@@ -290,6 +290,7 @@ import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { forbiddenState } from "@/utils/featureGate";
 import { useListViewState } from "@/composables/useListViewState";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
@@ -430,7 +431,7 @@ export default defineComponent({
     // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
     const forbidden = computed(() => {
       const e: any = regexPatternsList.error.value;
-      return e?.status === 403 || e?.response?.status === 403;
+      return forbiddenState(e) || e?.status === 403;
     });
     // Request in flight, with rows still on screen — the refresh button's
     // spinner. `listLoading` stays for the skeleton, which only a cold read wants.
diff --git a/web/src/components/settings/index.spec.ts b/web/src/components/settings/index.spec.ts
index 78f37d0512..c28807c331 100644
--- a/web/src/components/settings/index.spec.ts
+++ b/web/src/components/settings/index.spec.ts
@@ -250,6 +250,84 @@ describe("SettingsIndex", () => {
       expect(orgManagementItem?.visible).toBe(true);
       expect(syntheticsItem?.visible).toBe(true);
     });
+
+    describe("license-gated items", () => {
+      const byKeyUnder = (zoConfig: Record<string, unknown>) => {
+        mockStore.state.zoConfig = { service_streams_enabled: true, ...zoConfig } as any;
+        const items = getAllItems(createWrapper());
+        return (key: string) => items.find((i: any) => i.key === key);
+      };
+
+      it.each([
+        ["synthetics_locations", "synthetics"],
+        ["queryManagement", "query_management"],
+        ["storageSettings", "byob"],
+      ])("marks %s license-locked under a locked %s license", (key, feature) => {
+        const byKey = byKeyUnder({ features: { [feature]: "locked" } });
+        expect(byKey(key)?.licenseLocked).toBe(true);
+      });
+
+      it("locks Correlation only when the alerts feature it also runs on is locked", () => {
+        const only = byKeyUnder({ features: { correlation: "locked" } });
+        expect(only("correlation_settings")?.licenseLocked).toBe(false);
+        const both = byKeyUnder({ features: { correlation: "locked", alerts: "locked" } });
+        expect(both("correlation_settings")?.licenseLocked).toBe(true);
+      });
+
+      it.each(["model_pricing", "llm_providers", "gen_ai_agent_mapping"])(
+        "locks %s and keeps it visible under a locked ai_observability license",
+        (key) => {
+          const byKey = byKeyUnder({
+            online_evals_enabled: false,
+            features: { ai_observability: "locked" },
+          });
+          expect(byKey(key)?.licenseLocked).toBe(true);
+          if (key !== "model_pricing") expect(byKey(key)?.visible).toBe(true);
+        },
+      );
+
+      it("keeps Telephony visible and locked under a locked oncall license", () => {
+        const byKey = byKeyUnder({ oncall_enabled: false, features: { oncall: "locked" } });
+        expect(byKey("telephony")).toMatchObject({ visible: true, licenseLocked: true });
+      });
+
+      it.each([
+        ["synthetics_locations", "synthetics"],
+        ["queryManagement", "query_management"],
+        ["storageSettings", "byob"],
+        ["correlation_settings", "correlation"],
+      ])("hides %s under a hidden %s license", (key, feature) => {
+        const byKey = byKeyUnder({ features: { [feature]: "hidden" } });
+        expect(byKey(key)?.visible).toBe(false);
+      });
+
+      it("keeps locked synthetics locations and correlation visible though their flags are off", () => {
+        const byKey = byKeyUnder({
+          synthetics_enabled: false,
+          service_streams_enabled: false,
+          features: { synthetics: "locked", correlation: "locked", alerts: "locked" },
+        });
+        expect(byKey("synthetics_locations")).toMatchObject({ visible: true, licenseLocked: true });
+        expect(byKey("correlation_settings")).toMatchObject({ visible: true, licenseLocked: true });
+      });
+
+      it("leaves every item unlocked when the license enables it", () => {
+        const byKey = byKeyUnder({});
+        for (const key of [
+          "synthetics_locations",
+          "queryManagement",
+          "storageSettings",
+          "correlation_settings",
+          "telephony",
+          "llm_providers",
+        ]) {
+          expect(byKey(key)?.licenseLocked).toBe(false);
+        }
+        expect(byKey("synthetics_locations")?.visible).toBe(true);
+        expect(byKey("queryManagement")?.visible).toBe(true);
+        expect(byKey("correlation_settings")?.visible).toBe(true);
+      });
+    });
   });
 
   describe("Router integration", () => {
diff --git a/web/src/components/settings/index.vue b/web/src/components/settings/index.vue
index 1a098cae17..fa9838ede8 100644
--- a/web/src/components/settings/index.vue
+++ b/web/src/components/settings/index.vue
@@ -39,7 +39,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="border-border-default shrink-0 border-b"
       />
       <ConstrainedPage
-        :size="activeSection === 'password_policy' ? 'full' : 'lg'"
+        :size="['password_policy', 'license'].includes(activeSection) ? 'full' : 'lg'"
         align="left"
         :padded="false"
         class="min-h-0 flex-1 px-4 py-3"
@@ -72,6 +72,7 @@ import config from "@/aws-exports";
 import useIsMetaOrg from "@/composables/useIsMetaOrg";
 import { getImageURL } from "@/utils/zincutils";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
+import { featureState, menuState } from "@/utils/featureGate";
 import { isSlackSettingsVisible, readSlackOrgConfig } from "@/utils/slackSettings";
 import { useOnlineEvalsRouteOff } from "@/composables/shared/useOnlineEvalsGate";
 import OnlineEvalsDisabled from "@/components/OnlineEvalsDisabled.vue";
@@ -182,7 +183,11 @@ export default defineComponent({
       // the same backend flag the rest of synthetics does.
       const syntheticsBlocked =
         (store.state.zoConfig.meta_org && !isMetaOrg.value) ||
-        store.state.zoConfig?.synthetics_enabled === false;
+        menuState(
+          store.state.zoConfig?.features,
+          "synthetics",
+          store.state.zoConfig?.synthetics_enabled !== false,
+        ) === "hidden";
       if (name === "syntheticsLocations" && syntheticsBlocked) {
         toGeneral();
         return;
@@ -252,6 +257,22 @@ export default defineComponent({
       const queryManagementAccess = checkFeatureAccess("queryManagement", featureGateCtx);
       const nodesAccess = checkFeatureAccess("nodes", featureGateCtx);
       const licenseAccess = checkFeatureAccess("license", featureGateCtx);
+      // A locked license keeps the entry even where its runtime flag is off, so the lock stays discoverable.
+      const syntheticsLicense = menuState(
+        z?.features,
+        "synthetics",
+        z?.synthetics_enabled !== false,
+      );
+      const correlationLicense = menuState(
+        z?.features,
+        "correlation",
+        z?.service_streams_enabled !== false,
+      );
+      const queryManagementLicense = featureState(z?.features, "query_management");
+      const byobLicense = featureState(z?.features, "byob");
+      const oncallLicense = menuState(z?.features, "oncall", z?.oncall_enabled !== false);
+      const aiObsLicense = menuState(z?.features, "ai_observability", !!z?.online_evals_enabled);
+      const alertsLocked = featureState(z?.features, "alerts") === "locked";
 
       const items: (SectionHubItem & { group: string })[] = [
         {
@@ -365,9 +386,10 @@ export default defineComponent({
           icon: "call",
           to: { name: "telephonySettings", query: { org_identifier: org } },
           // The route guard's rule: only an explicit `oncall_enabled: false` closes it.
-          visible: z.oncall_enabled !== false && oncallAccess.visible,
+          visible: oncallLicense !== "hidden" && oncallAccess.visible,
           locked: !oncallAccess.allowed,
           lockedMessage: oncallAccess.message,
+          licenseLocked: oncallLicense === "locked",
           dataTest: "telephony-settings-tab",
           group: "Destinations",
         },
@@ -392,10 +414,12 @@ export default defineComponent({
           // this on a pure-Cloud build) for the enterprise+Cloud hybrid case.
           visible:
             storageSettingsAccess.visible &&
+            byobLicense !== "hidden" &&
             (!isCloud ||
               store.state.organizationData.organizationSettings.org_storage_enabled === true),
           locked: !storageSettingsAccess.allowed,
           lockedMessage: storageSettingsAccess.message,
+          licenseLocked: byobLicense === "locked",
           dataTest: "storage-settings-tab",
           group: "Data & AI",
         },
@@ -408,6 +432,7 @@ export default defineComponent({
           visible: !!z.model_pricing_enabled && modelPricingAccess.visible,
           locked: !modelPricingAccess.allowed,
           lockedMessage: modelPricingAccess.message,
+          licenseLocked: featureState(z?.features, "ai_observability") === "locked",
           dataTest: "model-pricing-tab",
           group: "Data & AI",
         },
@@ -417,9 +442,10 @@ export default defineComponent({
           description: t("settings.correlationSettingsDesc"),
           icon: "group-work",
           to: { name: "correlationSettings", query: { org_identifier: org } },
-          visible: z.service_streams_enabled !== false && correlationSettingsAccess.visible,
+          visible: correlationLicense !== "hidden" && correlationSettingsAccess.visible,
           locked: !correlationSettingsAccess.allowed,
           lockedMessage: correlationSettingsAccess.message,
+          licenseLocked: correlationLicense === "locked" && alertsLocked,
           dataTest: "correlation-settings-tab",
           group: "Data & AI",
         },
@@ -429,9 +455,10 @@ export default defineComponent({
           description: t("settings.llmProvidersDesc"),
           icon: "smart-toy",
           to: { name: "llmProviders", query: { org_identifier: org } },
-          visible: !!z.online_evals_enabled && llmProvidersAccess.visible,
+          visible: aiObsLicense !== "hidden" && llmProvidersAccess.visible,
           locked: !llmProvidersAccess.allowed,
           lockedMessage: llmProvidersAccess.message,
+          licenseLocked: aiObsLicense === "locked",
           dataTest: "llm-providers-tab",
           group: "Data & AI",
         },
@@ -441,9 +468,10 @@ export default defineComponent({
           description: t("settings.index.genAiAgentMappingDesc"),
           icon: "smart-toy",
           to: { name: "genAiAgentMapping", query: { org_identifier: org } },
-          visible: !!z.online_evals_enabled && genAiAgentMappingAccess.visible,
+          visible: aiObsLicense !== "hidden" && genAiAgentMappingAccess.visible,
           locked: !genAiAgentMappingAccess.allowed,
           lockedMessage: genAiAgentMappingAccess.message,
+          licenseLocked: aiObsLicense === "locked",
           dataTest: "gen-ai-agent-mapping-tab",
           group: "Data & AI",
         },
@@ -453,9 +481,10 @@ export default defineComponent({
           description: t("settings.queryManagementDesc"),
           icon: "query-stats",
           to: `/settings/query_management?org_identifier=${org}`,
-          visible: meta && queryManagementAccess.visible,
+          visible: meta && queryManagementAccess.visible && queryManagementLicense !== "hidden",
           locked: !queryManagementAccess.allowed,
           lockedMessage: queryManagementAccess.message,
+          licenseLocked: queryManagementLicense === "locked",
           dataTest: "query-management-tab",
           group: "Operations",
         },
@@ -479,7 +508,8 @@ export default defineComponent({
           to: { name: "syntheticsLocations", query: { org_identifier: org } },
           // Not `isEnt`: synthetics ships in OSS. Meta-org only (public rows are
           // cluster-wide) and driven by the same `/config` flag as the feature.
-          visible: meta && z?.synthetics_enabled !== false,
+          visible: meta && syntheticsLicense !== "hidden",
+          licenseLocked: syntheticsLicense === "locked",
           dataTest: "synthetics-locations-tab",
           group: "Synthetics",
         },
diff --git a/web/src/components/slos/SloAlertCondition.spec.ts b/web/src/components/slos/SloAlertCondition.spec.ts
index 52a6e92069..4fa82870b0 100644
--- a/web/src/components/slos/SloAlertCondition.spec.ts
+++ b/web/src/components/slos/SloAlertCondition.spec.ts
@@ -72,6 +72,21 @@ describe("SloAlertCondition", () => {
     expect(listSpy).not.toHaveBeenCalled();
   });
 
+  it("fetches the SLO list without a supplied SLO", async () => {
+    await mountWith(emptyCondition(), { slo: null });
+    expect(listSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("skips the SLO list while anomaly_detection is license-locked", async () => {
+    store.state.zoConfig.features = { anomaly_detection: "locked" };
+    try {
+      await mountWith(emptyCondition(), { slo: null });
+      expect(listSpy).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it("does not render an SLO selector when the SLO is supplied", async () => {
     const wrapper = await mountWith(emptyCondition());
     expect(wrapper.find('[data-test="slos-sloalertcondition-slo-trigger"]').exists()).toBe(false);
diff --git a/web/src/components/slos/SloAlertCondition.vue b/web/src/components/slos/SloAlertCondition.vue
index 9ba976538d..261588e2c2 100644
--- a/web/src/components/slos/SloAlertCondition.vue
+++ b/web/src/components/slos/SloAlertCondition.vue
@@ -235,6 +235,7 @@ import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import sloService from "@/services/slos";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import type { Slo } from "@/ts/interfaces/slo";
 import { formatTimeToExhaust, formatWindow } from "@/composables/useSloFormat";
@@ -253,6 +254,7 @@ const props = defineProps<{
 
 const { t } = useI18nTyped();
 const store = useStore();
+const { locked: anomalyLocked } = useLicenseLock("anomaly_detection");
 const slos = ref<Slo[]>([]);
 
 const org = computed(() => store.state.selectedOrganization?.identifier);
@@ -454,7 +456,7 @@ onMounted(async () => {
     model.value.slo_id = props.slo.id;
     return;
   }
-  if (!org.value) return;
+  if (!org.value || anomalyLocked.value) return;
   const res = await sloService.list(org.value);
   slos.value = res.data?.list ?? [];
 });
diff --git a/web/src/components/slos/SloAlertPreview.spec.ts b/web/src/components/slos/SloAlertPreview.spec.ts
index e4183309bd..771e8079a2 100644
--- a/web/src/components/slos/SloAlertPreview.spec.ts
+++ b/web/src/components/slos/SloAlertPreview.spec.ts
@@ -61,6 +61,16 @@ describe("SloAlertPreview", () => {
     alertPreviewSpy.mockResolvedValue({ data: preview() });
   });
 
+  it("makes no preview call while anomaly_detection is license-locked", async () => {
+    store.state.zoConfig.features = { anomaly_detection: "locked" };
+    try {
+      await mountPreview();
+      expect(alertPreviewSpy).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
   it("asks the API for this alert over the SLO's window and slice", async () => {
     await mountPreview({ windowSecs: 30 * 86400, sliceIntervalSecs: 60 });
     expect(alertPreviewSpy).toHaveBeenCalledTimes(1);
diff --git a/web/src/components/slos/SloAlertPreview.vue b/web/src/components/slos/SloAlertPreview.vue
index ec0333cb64..3096bfea60 100644
--- a/web/src/components/slos/SloAlertPreview.vue
+++ b/web/src/components/slos/SloAlertPreview.vue
@@ -109,6 +109,7 @@ import { useStore } from "vuex";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import PanelBar from "@/components/common/PanelBar.vue";
 import sloService from "@/services/slos";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { formatCoverage } from "@/composables/useSloFormat";
 import { type UptimeBandState, uptimeBands } from "@/utils/slos/alertSource";
 import type { AlertSliPreview } from "@/ts/interfaces/slo";
@@ -122,6 +123,7 @@ const props = defineProps<{
 
 const { t } = useI18nTyped();
 const store = useStore();
+const { locked: anomalyLocked } = useLicenseLock("anomaly_detection");
 
 const preview = ref<AlertSliPreview | null>(null);
 const loading = ref(false);
@@ -172,7 +174,7 @@ let latestRequest = 0;
 async function load() {
   const mine = ++latestRequest;
   const org = store.state.selectedOrganization?.identifier;
-  if (!org || !props.alertId) {
+  if (!org || !props.alertId || anomalyLocked.value) {
     preview.value = null;
     loading.value = false;
     return;
diff --git a/web/src/components/synthetic-monitoring/MonitorTable.vue b/web/src/components/synthetic-monitoring/MonitorTable.vue
index 661377d5dd..2709a1fbd6 100644
--- a/web/src/components/synthetic-monitoring/MonitorTable.vue
+++ b/web/src/components/synthetic-monitoring/MonitorTable.vue
@@ -611,6 +611,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import { resolveBadge, resolveBadgeLabel } from "@/lib/core/Badge/badgeGroups";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import type { ForbiddenState } from "@/utils/featureGate";
 import MutedChip from "@/components/alerts/downtimes/MutedChip.vue";
 import MuteMenuItems from "@/components/alerts/downtimes/MuteMenuItems.vue";
 import QuickMuteDialog from "@/components/alerts/downtimes/QuickMuteDialog.vue";
@@ -655,7 +656,7 @@ const props = withDefaults(
     mode: Mode;
     data: any[];
     loading?: boolean;
-    forbidden?: boolean;
+    forbidden?: ForbiddenState;
     /** IANA zone for the Last Check tooltip. Passed in: this table is a leaf
      *  component and must not reach into the store for it. */
     timezone?: string;
diff --git a/web/src/components/synthetics/variables/SyntheticsVariablesList.vue b/web/src/components/synthetics/variables/SyntheticsVariablesList.vue
index 174883263c..77e1762eed 100644
--- a/web/src/components/synthetics/variables/SyntheticsVariablesList.vue
+++ b/web/src/components/synthetics/variables/SyntheticsVariablesList.vue
@@ -34,6 +34,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       table-id="synthetics-variables"
       :show-global-filter="false"
       :loading="loading"
+      :forbidden="forbidden"
     >
       <template #toolbar>
         <OTooltip side="bottom" :content="raw(`${scopeLabel} — ${scopeSummary}`)">
@@ -270,6 +271,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
+import type { ForbiddenState } from "@/utils/featureGate";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { COL } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
@@ -303,6 +305,7 @@ export default defineComponent({
   props: {
     variables: { type: Array as PropType<SyntheticsVariable[]>, default: () => [] },
     loading: { type: Boolean, default: false },
+    forbidden: { type: [Boolean, Array] as PropType<ForbiddenState>, default: false },
     /** Environment NAME, or null for the unscoped tier. */
     environment: { type: String as PropType<string | null>, default: null },
     /** Split destinations. Empty on the global tab means there is nowhere to split to. */
diff --git a/web/src/components/synthetics/variables/SyntheticsVariablesTab.spec.ts b/web/src/components/synthetics/variables/SyntheticsVariablesTab.spec.ts
index 5bb277e908..ee5e29ee94 100644
--- a/web/src/components/synthetics/variables/SyntheticsVariablesTab.spec.ts
+++ b/web/src/components/synthetics/variables/SyntheticsVariablesTab.spec.ts
@@ -82,6 +82,17 @@ describe("SyntheticsVariablesTab — landing on a new environment", () => {
     vi.clearAllMocks();
   });
 
+  it("passes a license denial to the list as the forbidden state", async () => {
+    listEnvironments.mockRejectedValue({
+      response: { status: 403, data: { code: 40001, error_detail: "synthetics" } },
+    });
+    wrapper = await mountTab();
+
+    expect(wrapper.findComponent(SyntheticsVariablesList).props("forbidden")).toEqual([
+      "synthetics",
+    ]);
+  });
+
   it("starts on Global", async () => {
     wrapper = await mountTab();
 
diff --git a/web/src/components/synthetics/variables/SyntheticsVariablesTab.vue b/web/src/components/synthetics/variables/SyntheticsVariablesTab.vue
index 70fd5b9abd..0c66504f42 100644
--- a/web/src/components/synthetics/variables/SyntheticsVariablesTab.vue
+++ b/web/src/components/synthetics/variables/SyntheticsVariablesTab.vue
@@ -36,6 +36,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           ref="listRef"
           :variables="scope.variables"
           :loading="loading"
+          :forbidden="forbidden"
           :environment="scope.isGlobal ? null : (scope.environment?.name ?? null)"
           :environments="overridingEnvironments"
           :globals="globals"
@@ -108,6 +109,7 @@ import SyntheticsEnvironmentForm from "./SyntheticsEnvironmentForm.vue";
 import SyntheticsDuplicateEnvironmentDialog from "./SyntheticsDuplicateEnvironmentDialog.vue";
 import { namedEnvironments, resolveScope } from "./scope";
 import { environmentDeleteBlock } from "./usage";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { serverMessage } from "./serverMessage";
 
 const { t } = useI18nTyped();
@@ -119,6 +121,7 @@ const deleteShown = ref({ name: "", variables: 0 });
 const environments = ref<SyntheticsEnvironment[]>([]);
 const globals = ref<SyntheticsVariable[]>([]);
 const loading = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const selectedScope = ref<string>("");
 const environmentDrawer = ref({
   show: false,
@@ -144,6 +147,7 @@ const scopeSummary = computed(() => {
 
 async function refresh() {
   loading.value = true;
+  forbidden.value = false;
   try {
     const org = store.state.selectedOrganization.identifier;
     const [envRes, globalRes] = await Promise.all([
@@ -153,6 +157,7 @@ async function refresh() {
     environments.value = envRes.data ?? [];
     globals.value = globalRes.data ?? [];
   } catch (error) {
+    forbidden.value = forbiddenState(error);
     toast({
       variant: "error",
       message: serverMessage(error) ?? t("synthetics.variables.loadFailed"),
diff --git a/web/src/components/workflows/WorkflowEditor.vue b/web/src/components/workflows/WorkflowEditor.vue
index d77d8e078c..4202223e2f 100644
--- a/web/src/components/workflows/WorkflowEditor.vue
+++ b/web/src/components/workflows/WorkflowEditor.vue
@@ -230,28 +230,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- workspace: docked palette + canvas (+ drawer region for node forms). The
          history drawer portals in here (below the toolbar) so it can sit
          side-by-side with the canvas. -->
-    <div id="workflow-workspace" class="relative flex min-h-0 flex-1">
-      <!-- Docked node palette — same shared component as Pipelines, so the two
+    <OPageLockedBody>
+      <div id="workflow-workspace" class="relative flex min-h-0 flex-1">
+        <!-- Docked node palette — same shared component as Pipelines, so the two
            palettes can never drift apart. Workflows add click-to-append. -->
-      <NodePalette
-        v-if="workflowObj.showNodePalette"
-        :items="paletteItems"
-        test-prefix="workflow-palette"
-        :on-drag-start="paletteDragStart"
-        :on-item-click="paletteClick"
-      />
-      <!-- Canvas drop area — flush gray pane running to the viewport edges,
+        <NodePalette
+          v-if="workflowObj.showNodePalette"
+          :items="paletteItems"
+          test-prefix="workflow-palette"
+          :on-drag-start="paletteDragStart"
+          :on-item-click="paletteClick"
+        />
+        <!-- Canvas drop area — flush gray pane running to the viewport edges,
            matching the pipeline editor's `#pipelineChartContainer` so both look
            identical. `dark:bg-transparent` is part of that match: in dark mode
            the canvas falls through to the page background rather than sitting
            on the lighter `surface-subtle` slab, which is what made the two
            editors read as different shades. -->
-      <div class="bg-surface-subtle relative min-w-0 flex-1 overflow-hidden dark:bg-transparent">
-        <!-- Test results are inspected in the node's NDV (click a node's ✓/✗ badge),
+        <div class="bg-surface-subtle relative min-w-0 flex-1 overflow-hidden dark:bg-transparent">
+          <!-- Test results are inspected in the node's NDV (click a node's ✓/✗ badge),
              so the canvas fills the space — no docked results panel. -->
-        <WorkflowCanvas />
+          <WorkflowCanvas />
+        </div>
       </div>
-    </div>
+    </OPageLockedBody>
 
     <!-- "add next step" picker (opened by the hover-+ on a node) — shared with
          pipelines. -->
@@ -337,6 +339,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
+import OPageLockedBody from "@/lib/core/PageLayout/OPageLockedBody.vue";
 import { computed, onMounted, onBeforeUnmount, ref, watch } from "vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import { useRouter, onBeforeRouteLeave, type RouteLocationRaw } from "vue-router";
@@ -391,6 +394,7 @@ import useWorkflowCanvas, {
   clearTestData,
 } from "@/plugins/workflows/useWorkflowCanvas";
 import workflowService from "@/services/workflows";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 import analytics from "@/services/product_analytics";
 
 // Emitted after a successful save so the parent WorkflowsList refreshes its rows.
@@ -629,8 +633,11 @@ const goBack = () => {
 const unsavedDialog = ref(false);
 const pendingRoute = ref<RouteLocationRaw | null>(null);
 
+// A locked page cannot be edited, and its locked Discard button would trap the user.
+const { locked: pageLocked } = useFeatureLock();
+
 onBeforeRouteLeave((to) => {
-  if (!workflowObj.dirtyFlag) return true;
+  if (pageLocked.value || !workflowObj.dirtyFlag) return true;
   pendingRoute.value = to.fullPath;
   unsavedDialog.value = true;
   return false;
@@ -651,7 +658,7 @@ const onKeepEditing = () => {
 
 // Native browser prompt for tab close / reload while there are unsaved edits.
 const beforeUnloadHandler = (e: BeforeUnloadEvent) => {
-  if (!workflowObj.dirtyFlag) return;
+  if (pageLocked.value || !workflowObj.dirtyFlag) return;
   e.preventDefault();
   e.returnValue = "";
 };
diff --git a/web/src/components/workflows/WorkflowRuns.vue b/web/src/components/workflows/WorkflowRuns.vue
index 05ab236f65..d3cd9f3b4e 100644
--- a/web/src/components/workflows/WorkflowRuns.vue
+++ b/web/src/components/workflows/WorkflowRuns.vue
@@ -95,52 +95,54 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
     </OPageHeader>
 
-    <div
-      class="relative flex min-h-0 flex-1 gap-2 px-2 pt-3 max-lg:flex-col max-lg:overflow-y-auto"
-    >
-      <!-- Read-only canvas (per-node run status overlay). Clicking a node's ✓/✗ badge
+    <OPageLockedBody>
+      <div
+        class="relative flex min-h-0 flex-1 gap-2 px-2 pt-3 max-lg:flex-col max-lg:overflow-y-auto"
+      >
+        <!-- Read-only canvas (per-node run status overlay). Clicking a node's ✓/✗ badge
            opens its NDV (read-only here) with the step's Input · Config · Output — the
            SAME panel the editor uses, so results read identically in both places. -->
-      <div
-        class="rounded-surface bg-surface-subtle relative mb-3 min-w-0 flex-1 overflow-hidden max-lg:h-64 max-lg:flex-none dark:bg-transparent"
-      >
-        <WorkflowCanvas />
-      </div>
+        <div
+          class="rounded-surface bg-surface-subtle relative mb-3 min-w-0 flex-1 overflow-hidden max-lg:h-64 max-lg:flex-none dark:bg-transparent"
+        >
+          <WorkflowCanvas />
+        </div>
 
-      <OButton
-        variant="outline"
-        size="icon-sm"
-        class="absolute top-2 right-2 z-10"
-        data-test="workflow-runs-panel-collapse"
-        :aria-label="t(panelCollapsed ? 'workflow.runs.showList' : 'workflow.runs.hideList')"
-        @click="togglePanel"
-      >
-        <OIcon
-          :name="panelCollapsed ? 'keyboard-double-arrow-left' : 'keyboard-double-arrow-right'"
-          size="sm"
-        />
-        <OTooltip
-          :content="t(panelCollapsed ? 'workflow.runs.showList' : 'workflow.runs.hideList')"
-          side="left"
-        />
-      </OButton>
+        <OButton
+          variant="outline"
+          size="icon-sm"
+          class="absolute top-2 right-2 z-10"
+          data-test="workflow-runs-panel-collapse"
+          :aria-label="t(panelCollapsed ? 'workflow.runs.showList' : 'workflow.runs.hideList')"
+          @click="togglePanel"
+        >
+          <OIcon
+            :name="panelCollapsed ? 'keyboard-double-arrow-left' : 'keyboard-double-arrow-right'"
+            size="sm"
+          />
+          <OTooltip
+            :content="t(panelCollapsed ? 'workflow.runs.showList' : 'workflow.runs.hideList')"
+            side="left"
+          />
+        </OButton>
 
-      <!-- Persistent runs list (master-detail). -->
-      <div
-        v-if="!panelCollapsed"
-        data-test="workflow-runs-panel"
-        class="rounded-surface border-border-default bg-surface-base mb-3 flex min-h-0 w-[50rem] max-w-[60%] shrink-0 flex-col overflow-hidden border max-lg:h-96 max-lg:w-full max-lg:max-w-full"
-      >
-        <WorkflowRunsPanel
-          ref="runsPanelRef"
-          :org-id="orgId"
-          :workflow-id="workflowId"
-          :workflow-name="workflowName"
-          :selected-run-id="selectedRunId"
-          @select-run="onSelectRun"
-        />
+        <!-- Persistent runs list (master-detail). -->
+        <div
+          v-if="!panelCollapsed"
+          data-test="workflow-runs-panel"
+          class="rounded-surface border-border-default bg-surface-base mb-3 flex min-h-0 w-[50rem] max-w-[60%] shrink-0 flex-col overflow-hidden border max-lg:h-96 max-lg:w-full max-lg:max-w-full"
+        >
+          <WorkflowRunsPanel
+            ref="runsPanelRef"
+            :org-id="orgId"
+            :workflow-id="workflowId"
+            :workflow-name="workflowName"
+            :selected-run-id="selectedRunId"
+            @select-run="onSelectRun"
+          />
+        </div>
       </div>
-    </div>
+    </OPageLockedBody>
 
     <!-- Node NDV (read-only here) — opened by a node's ✓/✗ badge to inspect that
          step's Input · Config · Output for the loaded run. -->
@@ -174,6 +176,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
+import OPageLockedBody from "@/lib/core/PageLayout/OPageLockedBody.vue";
 import { computed, onBeforeUnmount, onMounted, ref, watch } from "vue";
 import { useI18nTyped, raw } from "@/types/i18n";
 import { useRouter } from "vue-router";
diff --git a/web/src/components/workflows/WorkflowsList.vue b/web/src/components/workflows/WorkflowsList.vue
index 54618f3f7d..05b3e9ddfa 100644
--- a/web/src/components/workflows/WorkflowsList.vue
+++ b/web/src/components/workflows/WorkflowsList.vue
@@ -415,6 +415,7 @@ import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import WorkflowView from "@/components/workflows/WorkflowView.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { TABLE_INDEX_COL_SIZE, COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
 
 import workflowService from "@/services/workflows";
@@ -483,7 +484,7 @@ const loading = ref(true);
 // Separate from `loading`, the cold-read skeleton: this spins the refresh button on every read.
 const fetching = ref(false);
 const lastUpdatedAt = ref<number | null>(null);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const filterQuery = ref(viewState.filterQuery);
 const pageSize = ref(viewState.pageSize);
 const sortBy = ref(viewState.sortBy);
@@ -763,7 +764,7 @@ const getWorkflows = async (folderId?: string, force = false) => {
   } catch (error: any) {
     if (read !== latestRead) return;
     console.error(error);
-    forbidden.value = error?.response?.status === 403;
+    forbidden.value = forbiddenState(error);
   } finally {
     if (read === latestRead) {
       loading.value = false;
diff --git a/web/src/composables/alertCalibration/useAlertCalibrationEnabled.spec.ts b/web/src/composables/alertCalibration/useAlertCalibrationEnabled.spec.ts
index ee329e0d65..43c519b2bf 100644
--- a/web/src/composables/alertCalibration/useAlertCalibrationEnabled.spec.ts
+++ b/web/src/composables/alertCalibration/useAlertCalibrationEnabled.spec.ts
@@ -31,4 +31,10 @@ describe("whether a page leaves because alert calibration is off", () => {
     expect(isAlertCalibrationOff({ version: "", alert_calibration_enabled: false })).toBe(true);
     expect(isAlertCalibrationOff({ version: "", alert_calibration_enabled: true })).toBe(false);
   });
+
+  it("stays on a license-locked page, which renders locked, but leaves a hidden one", () => {
+    const off = { version: "v1", alert_calibration_enabled: false };
+    expect(isAlertCalibrationOff({ ...off, features: { alerts: "locked" } })).toBe(false);
+    expect(isAlertCalibrationOff({ ...off, features: { alerts: "hidden" } })).toBe(true);
+  });
 });
diff --git a/web/src/composables/alertCalibration/useAlertCalibrationEnabled.ts b/web/src/composables/alertCalibration/useAlertCalibrationEnabled.ts
index 1272420fc5..51d324ee12 100644
--- a/web/src/composables/alertCalibration/useAlertCalibrationEnabled.ts
+++ b/web/src/composables/alertCalibration/useAlertCalibrationEnabled.ts
@@ -18,6 +18,7 @@ import { useRouter } from "vue-router";
 import { useStore } from "vuex";
 import config from "@/aws-exports";
 import { isFullConfigLoaded } from "@/services/config.queries";
+import { featureState, type FeatureStates } from "@/utils/featureGate";
 
 /** Enterprise or cloud plus `alert_calibration_enabled`, the rule of the route guards, the nav gate and the settings item. */
 export function useAlertCalibrationEnabled() {
@@ -40,9 +41,11 @@ export function useLeaveIfAlertCalibrationOff(routeName: "general" | "alertList"
   );
 }
 
-/** Off only once `/config` has loaded, so a load still in flight never bounces the page. */
+/** Off only once `/config` has loaded, so a load still in flight never bounces the page; a license lock renders the page locked instead. */
 export const isAlertCalibrationOff = (zoConfig: Record<string, unknown> | undefined): boolean =>
-  isFullConfigLoaded(zoConfig) && !isAlertCalibrationEnabled(zoConfig);
+  isFullConfigLoaded(zoConfig) &&
+  !isAlertCalibrationEnabled(zoConfig) &&
+  featureState(zoConfig?.features as FeatureStates | undefined, "alerts") !== "locked";
 
 export function isAlertCalibrationEnabled(zoConfig: Record<string, unknown> | undefined): boolean {
   return (
diff --git a/web/src/composables/alerts/useAlertCreation.spec.ts b/web/src/composables/alerts/useAlertCreation.spec.ts
index 978dcb058f..95d877d4d2 100644
--- a/web/src/composables/alerts/useAlertCreation.spec.ts
+++ b/web/src/composables/alerts/useAlertCreation.spec.ts
@@ -75,4 +75,22 @@ describe("useAlertCreation", () => {
     expect(mockRouterPush).not.toHaveBeenCalled();
     expect(sessionStorage.getItem(ALERT_PREFILL_KEY)).toBeNull();
   });
+
+  const withAlerts = (state: string) => ({
+    router: { push: mockRouterPush },
+    store: { state: { ...mockStore.state, zoConfig: { features: { alerts: state } } } },
+  });
+
+  it("does nothing while alerts is license-locked", () => {
+    const { openAlertCreation } = useAlertCreation(withAlerts("locked"));
+    expect(openAlertCreation(prefill())).toBe(false);
+    expect(mockRouterPush).not.toHaveBeenCalled();
+    expect(sessionStorage.getItem(ALERT_PREFILL_KEY)).toBeNull();
+  });
+
+  it("routes to the alert form while alerts is enabled", () => {
+    const { openAlertCreation } = useAlertCreation(withAlerts("enabled"));
+    expect(openAlertCreation(prefill())).toBe(true);
+    expect(mockRouterPush).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/web/src/composables/alerts/useAlertCreation.ts b/web/src/composables/alerts/useAlertCreation.ts
index a35f6af8df..42abf62903 100644
--- a/web/src/composables/alerts/useAlertCreation.ts
+++ b/web/src/composables/alerts/useAlertCreation.ts
@@ -28,6 +28,7 @@ import { useStore } from "vuex";
 import type { AlertBuildOptions, AlertPrefill } from "@/ts/interfaces/alertPrefill";
 import { isPrefillBlocked, normalizePrefill } from "@/utils/alerts/alertPrefill";
 import { writeAlertPrefill } from "@/utils/alerts/alertPrefillStorage";
+import { featureState } from "@/utils/featureGate";
 
 export interface OpenAlertCreationOptions {
   /** Folder the alert lands in. Defaults to the org's default folder. */
@@ -111,6 +112,9 @@ export const useAlertCreation = (deps: UseAlertCreationDeps = {}) => {
     prefill: AlertPrefill,
     opts: OpenAlertCreationOptions = {},
   ): boolean => {
+    // Reads the store directly: deps callers run outside setup, where useLicenseLock cannot.
+    if (featureState(store?.state.zoConfig?.features, "alerts") === "locked") return false;
+
     const normalized = normalizePrefill(prefill);
 
     if (isPrefillBlocked(normalized)) return false;
diff --git a/web/src/composables/alerts/useAlertLibrary.spec.ts b/web/src/composables/alerts/useAlertLibrary.spec.ts
index 65cc5f28bf..0349ff92ea 100644
--- a/web/src/composables/alerts/useAlertLibrary.spec.ts
+++ b/web/src/composables/alerts/useAlertLibrary.spec.ts
@@ -473,6 +473,26 @@ describe("useAnomalyLibraryAccess", () => {
     );
   });
 
+  it("is license-locked when anomaly_detection is license-locked, even with the feature on", () => {
+    expect(
+      access("true", {
+        build_type: "enterprise",
+        anomaly_detection_enabled: true,
+        features: { anomaly_detection: "locked" },
+      }),
+    ).toBe("licenseLocked");
+  });
+
+  it("is enabled when anomaly_detection is licensed and turned on", () => {
+    expect(
+      access("true", {
+        build_type: "enterprise",
+        anomaly_detection_enabled: true,
+        features: { anomaly_detection: "enabled" },
+      }),
+    ).toBe("enabled");
+  });
+
   it("is hidden when entitled but the feature is turned off", () => {
     expect(access("true", { build_type: "enterprise", anomaly_detection_enabled: false })).toBe(
       "hidden",
diff --git a/web/src/composables/alerts/useAlertLibrary.ts b/web/src/composables/alerts/useAlertLibrary.ts
index 6bb4834675..b458846cfc 100644
--- a/web/src/composables/alerts/useAlertLibrary.ts
+++ b/web/src/composables/alerts/useAlertLibrary.ts
@@ -17,6 +17,7 @@ import { computed, readonly, ref } from "vue";
 import { useStore } from "vuex";
 
 import config from "@/aws-exports";
+import { featureState } from "@/utils/featureGate";
 import {
   ALERT_LIBRARY_MANIFEST_URL,
   SUPPORTED_MANIFEST_MAJOR,
@@ -44,7 +45,8 @@ import type {
 // `id` / `stream_type` values end up as object keys, so every lookup here goes
 // through hasOwn rather than a bare index.
 
-export type AnomalyLibraryAccess = "enabled" | "locked" | "hidden";
+// "locked" is the edition upsell; "licenseLocked" is a license without anomaly detection, which never upsells.
+export type AnomalyLibraryAccess = "enabled" | "locked" | "licenseLocked" | "hidden";
 
 /**
  * Machine-readable failure kinds, so callers can map to i18n copy.
@@ -333,6 +335,9 @@ export function useAnomalyLibraryAccess() {
     const entitled =
       store.state.zoConfig?.build_type !== "opensource" && config.isEnterprise === "true";
     if (!entitled) return "locked";
+    if (featureState(store.state.zoConfig?.features, "anomaly_detection") === "locked") {
+      return "licenseLocked";
+    }
     return store.state.zoConfig?.anomaly_detection_enabled === true ? "enabled" : "hidden";
   });
 }
diff --git a/web/src/composables/alerts/useDependencyGraph.spec.ts b/web/src/composables/alerts/useDependencyGraph.spec.ts
index a8be0b7d0f..104aacbcbb 100644
--- a/web/src/composables/alerts/useDependencyGraph.spec.ts
+++ b/web/src/composables/alerts/useDependencyGraph.spec.ts
@@ -14,6 +14,9 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
+import { defineComponent } from "vue";
+import { mount } from "@vue/test-utils";
+import { createStore } from "vuex";
 import {
   useDependencyGraph,
   buildFocusChain,
@@ -499,4 +502,38 @@ describe("useDependencyGraph.loadGraph", () => {
 
     expect(calls()).toEqual([2, 1, 2]);
   });
+
+  const inSetup = (features: Record<string, string>) => {
+    let api!: ReturnType<typeof useDependencyGraph>;
+    const store = createStore({ state: { zoConfig: { features } } });
+    mount(
+      defineComponent({
+        setup() {
+          api = useDependencyGraph();
+          return {};
+        },
+        template: "<div />",
+      }),
+      { global: { plugins: [store] } },
+    );
+    return api;
+  };
+
+  it("skips the alerts list while alerts is license-locked", async () => {
+    const { loadGraph } = inSetup({ alerts: "locked" });
+    await loadGraph("org-b");
+    expect(calls()).toEqual([0, 1, 1]);
+  });
+
+  it("does not cache a graph built while alerts is license-locked", async () => {
+    await inSetup({ alerts: "locked" }).loadGraph("org-d");
+    await inSetup({ alerts: "enabled" }).loadGraph("org-d");
+    expect(graphInputs.alerts).toHaveBeenCalledTimes(1);
+  });
+
+  it("reads the alerts list while alerts is enabled", async () => {
+    const { loadGraph } = inSetup({ alerts: "enabled" });
+    await loadGraph("org-c");
+    expect(calls()).toEqual([1, 1, 1]);
+  });
 });
diff --git a/web/src/composables/alerts/useDependencyGraph.ts b/web/src/composables/alerts/useDependencyGraph.ts
index 52fb636cc5..fc90f521b9 100644
--- a/web/src/composables/alerts/useDependencyGraph.ts
+++ b/web/src/composables/alerts/useDependencyGraph.ts
@@ -32,6 +32,7 @@ import { alertDependenciesQuery } from "@/services/alerts.queries";
 import { destinationsQuery } from "@/services/alert_destination.queries";
 import { templatesQuery } from "@/services/alert_templates.queries";
 import { queryClient } from "@/composables/query/queryClient";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { I18nKey } from "@/types/i18n";
 
 /** `template`/`destination` are graph-native; the rest are consumers the P0 delete guard checks. */
@@ -456,6 +457,7 @@ export function useDependencyGraph() {
   const graph = ref<DepGraph>(emptyGraph());
   const loading = ref(false);
   const error = ref<string | null>(null);
+  const { locked: alertsLocked } = useLicenseLock("alerts");
 
   // Pure builder — separated from the fetch so it can be unit-tested with fixtures.
   const buildGraph = (
@@ -625,13 +627,15 @@ export function useDependencyGraph() {
         });
       }
       const [alerts, destinations, templates] = await Promise.all([
-        queryClient.fetchQuery(inputs.alerts),
+        // Destinations and templates stay free when alerts is license-locked; their alerts list would 403.
+        alertsLocked.value ? [] : queryClient.fetchQuery(inputs.alerts),
         queryClient.fetchQuery(inputs.destinations),
         queryClient.fetchQuery(inputs.templates),
       ]);
 
       graph.value = buildGraph(alerts, destinations, templates);
-      graphCache = { org, graph: graph.value, at: Date.now() };
+      // A graph without alerts must not outlive the lock that emptied it.
+      if (!alertsLocked.value) graphCache = { org, graph: graph.value, at: Date.now() };
     } catch (err: any) {
       error.value = err?.response?.data?.message || err?.message || "unknown";
       graph.value = emptyGraph();
diff --git a/web/src/composables/dashboard/usePanelDrilldown.spec.ts b/web/src/composables/dashboard/usePanelDrilldown.spec.ts
index c52a09f944..d45f9468a7 100644
--- a/web/src/composables/dashboard/usePanelDrilldown.spec.ts
+++ b/web/src/composables/dashboard/usePanelDrilldown.spec.ts
@@ -15,11 +15,28 @@
 
 import { describe, expect, it, beforeEach, vi } from "vitest";
 import { gt } from "@/types/i18n";
-import { nextTick } from "vue";
+import { defineComponent, nextTick } from "vue";
+import { mount } from "@vue/test-utils";
+import { createStore } from "vuex";
 import { usePanelDrilldown } from "./usePanelDrilldown";
 
 const resultSchemaMock = vi.fn();
 
+// The license lock reads the injected store, so the composable runs inside a mounted component.
+const withLicense = <T>(features: Record<string, string>, run: () => T): T => {
+  let result!: T;
+  mount(
+    defineComponent({
+      setup() {
+        result = run();
+        return () => null;
+      },
+    }),
+    { global: { plugins: [createStore({ state: { zoConfig: { features } } })] } },
+  );
+  return result;
+};
+
 vi.mock("@/services/search", async (importOriginal) => {
   const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
   return overlayServiceMock(await importOriginal(), {
@@ -344,6 +361,113 @@ describe("usePanelDrilldown", () => {
     );
   });
 
+  describe("license lock of the logs drilldown target", () => {
+    const logsDrilldownDeps = (streamType: string) => {
+      const deps = makeDeps();
+      deps.panelSchema.value.queries[0].fields.stream_type = streamType;
+      deps.panelSchema.value.config.drilldown = [
+        { name: "Logs", type: "logs", targetBlank: false, data: { logsMode: "auto" } } as any,
+        { name: "Url", type: "byUrl", data: { url: "https://example.com" } } as any,
+      ];
+      return deps;
+    };
+
+    it.each(["logs", "metrics", "traces"])(
+      "%s locked: that panel's logs drilldown is locked and opens nothing",
+      async (streamType) => {
+        const deps = logsDrilldownDeps(streamType);
+        const api = withLicense({ [streamType]: "locked" }, () => usePanelDrilldown(deps as any));
+        const [logsItem, urlItem] = deps.panelSchema.value.config.drilldown;
+
+        expect(api.drilldownLockedReason(logsItem)).toBeTruthy();
+        expect(api.drilldownLockedReason(urlItem)).toBeNull();
+        api.drilldownArray.value = deps.panelSchema.value.config.drilldown;
+        await api.openDrilldown(0);
+        await nextTick();
+        expect(deps.router.push).not.toHaveBeenCalled();
+        expect(deps.store.dispatch).not.toHaveBeenCalled();
+      },
+    );
+
+    it("another signal locked or a free stream type: the logs drilldown stays live", () => {
+      const logsItem = logsDrilldownDeps("logs").panelSchema.value.config.drilldown[0];
+      const live = (features: Record<string, string>, streamType: string) =>
+        withLicense(features, () =>
+          usePanelDrilldown(logsDrilldownDeps(streamType) as any),
+        ).drilldownLockedReason(logsItem);
+      expect(live({ traces: "locked" }, "logs")).toBeNull();
+      expect(live({ logs: "locked" }, "enrichment_tables")).toBeNull();
+    });
+
+    const byUrl = (url: string) => ({ name: "Go", type: "byUrl", data: { url } });
+    const urlReason = (features: Record<string, string>, url: string) =>
+      withLicense(features, () => usePanelDrilldown(makeDeps() as any)).drilldownLockedReason(
+        byUrl(url),
+      );
+
+    it.each([
+      ["metrics", "/metrics?query_type=promql&stream_name=cpu"],
+      ["traces", "/web/traces?stream=default"],
+      ["logs", "/logs?stream=app"],
+      ["logs", `${window.location.origin}/web/logs?stream_type=logs`],
+      ["metrics", "/logs?stream_type=metrics"],
+    ])("%s locked: a by-URL drilldown to %s is locked and opens nothing", async (key, url) => {
+      expect(urlReason({ [key]: "locked" }, url)).toBeTruthy();
+      const deps = makeDeps();
+      deps.panelSchema.value.config.drilldown = [byUrl(url) as any];
+      const api = withLicense({ [key]: "locked" }, () => usePanelDrilldown(deps as any));
+      api.drilldownArray.value = deps.panelSchema.value.config.drilldown;
+      const open = vi.spyOn(window, "open").mockImplementation(() => null);
+      try {
+        await api.openDrilldown(0);
+        expect(open).not.toHaveBeenCalled();
+      } finally {
+        open.mockRestore();
+      }
+    });
+
+    it("a same-origin cross-link to a locked signal page is locked; external and other cross-links stay live", async () => {
+      const crossLink = (url: string) => ({
+        name: "X",
+        type: "byUrl",
+        _isCrossLink: true,
+        data: { url, _rawUrl: url, _fields: [] },
+      });
+      const reason = (features: Record<string, string>, url: string) =>
+        withLicense(features, () => usePanelDrilldown(makeDeps() as any)).drilldownLockedReason(
+          crossLink(url),
+        );
+      expect(
+        reason({ traces: "locked" }, "/web/traces/trace-details?trace_id=${field.__value}"),
+      ).toBeTruthy();
+      expect(reason({ logs: "locked" }, "/logs?stream=app")).toBeTruthy();
+      expect(reason({}, "/web/traces?trace_id=1")).toBeNull();
+      expect(
+        reason({ traces: "locked" }, "https://traces.example.com/${field.__value}"),
+      ).toBeNull();
+      expect(reason({ traces: "locked" }, "/dashboards/view")).toBeNull();
+
+      const deps = makeDeps();
+      const api = withLicense({ traces: "locked" }, () => usePanelDrilldown(deps as any));
+      api.drilldownArray.value = [crossLink("/web/traces?trace_id=1")];
+      const open = vi.spyOn(window, "open").mockImplementation(() => null);
+      try {
+        await api.openDrilldown(0);
+        expect(open).not.toHaveBeenCalled();
+      } finally {
+        open.mockRestore();
+      }
+    });
+
+    it("by-URL drilldowns stay live when enabled, for a free logs type, or to an external URL", () => {
+      expect(urlReason({}, "/metrics?q=1")).toBeNull();
+      expect(urlReason({ traces: "locked" }, "/metrics?q=1")).toBeNull();
+      expect(urlReason({ logs: "locked" }, "/logs?stream_type=enrichment_tables")).toBeNull();
+      expect(urlReason({ metrics: "locked" }, "https://example.com/metrics")).toBeNull();
+      expect(urlReason({ logs: "locked" }, "/dashboards/view?dashboard=1")).toBeNull();
+    });
+  });
+
   it("resolves variables sharing a name prefix in a custom Logs drilldown query", async () => {
     const deps = makeDeps();
     deps.panelSchema.value.config.drilldown = [
diff --git a/web/src/composables/dashboard/usePanelDrilldown.ts b/web/src/composables/dashboard/usePanelDrilldown.ts
index 2dc7a80b05..79a04b65e8 100644
--- a/web/src/composables/dashboard/usePanelDrilldown.ts
+++ b/web/src/composables/dashboard/usePanelDrilldown.ts
@@ -15,7 +15,9 @@
 
 import { ref, computed, watch, nextTick, onBeforeMount, onUnmounted } from "vue";
 import { toZonedTime } from "date-fns-tz";
-import type { TranslateFn } from "@/types/i18n";
+import type { I18nText, TranslateFn } from "@/types/i18n";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import { getAllDashboardsByFolderId, getDashboard, getFoldersList } from "@/utils/commons";
 import { b64EncodeUnicode, escapeSingleQuotes } from "@/utils/zincutils";
 import { getUTCTimestampFromZonedTimestamp } from "@/utils/dashboard/dateTimeUtils";
@@ -113,6 +115,21 @@ export function usePanelDrilldown({
 
   const drilldownArray: any = ref([]);
 
+  const licenseLocks = useLicenseLocks();
+
+  /** Why a drilldown item cannot open: its in-app logs, metrics or traces target is not licensed. */
+  const drilldownLockedReason = (item: any): I18nText | null => {
+    let feature: string | null = null;
+    if (item?._isCrossLink) {
+      feature = inAppSignalFeature(item?.data?._rawUrl);
+    } else if (item?.type === "logs") {
+      feature = streamTypeFeature(panelSchema.value?.queries?.[0]?.fields?.stream_type);
+    } else if (item?.type === "byUrl") {
+      feature = inAppSignalFeature(item?.data?.url);
+    }
+    return feature && licenseLocks.isLocked(feature) ? licenseLocks.lockedReason(feature) : null;
+  };
+
   // need to save click event params, to open drilldown
   let drilldownParams: any = [];
 
@@ -743,6 +760,7 @@ export function usePanelDrilldown({
 
     // Handle cross-link items (they exist in drilldownArray but not in panelSchema.config.drilldown)
     const drilldownItem = drilldownArray.value[index];
+    if (drilldownLockedReason(drilldownItem)) return;
     if (drilldownItem?._isCrossLink) {
       try {
         const rawUrl = drilldownItem.data._rawUrl;
@@ -1367,6 +1385,7 @@ export function usePanelDrilldown({
     crossLinksData,
     onChartClick,
     openDrilldown,
+    drilldownLockedReason,
     hidePopupsAndOverlays,
     parser,
     interval,
@@ -1382,3 +1401,20 @@ export function usePanelDrilldown({
     ensureDrilldownSchema,
   };
 }
+
+const SIGNAL_PAGES = new Set(["logs", "metrics", "traces"]);
+
+/** License key of a drilldown URL that opens this app's logs, metrics or traces page; null for any other URL. */
+function inAppSignalFeature(url: unknown): string | null {
+  if (typeof url !== "string" || !url) return null;
+  let target: URL;
+  try {
+    target = new URL(url, window.location.origin);
+  } catch {
+    return null;
+  }
+  if (target.origin !== window.location.origin) return null;
+  const page = target.pathname.split("/").find((segment) => SIGNAL_PAGES.has(segment));
+  if (!page) return null;
+  return streamTypeFeature(page === "logs" ? target.searchParams.get("stream_type") : page);
+}
diff --git a/web/src/composables/dbm/useDbmListPage.spec.ts b/web/src/composables/dbm/useDbmListPage.spec.ts
index e41a3df1f2..923fa9a06a 100644
--- a/web/src/composables/dbm/useDbmListPage.spec.ts
+++ b/web/src/composables/dbm/useDbmListPage.spec.ts
@@ -263,6 +263,17 @@ describe("useDbmListPage", () => {
     expect(page.forbidden.value).toBe(false);
   });
 
+  it("run reports a license denial as forbidden even when the page has a 403 handler", async () => {
+    const { page } = mountPage({ load: vi.fn() });
+    const onForbidden = vi.fn();
+    const denial = {
+      response: { status: 403, data: { code: 40001, error_detail: "db_monitoring" } },
+    };
+    await page.run(() => Promise.reject(denial), { onForbidden });
+    expect(onForbidden).not.toHaveBeenCalled();
+    expect(page.forbidden.value).toEqual(["db_monitoring"]);
+  });
+
   it("run flags a 403 as forbidden, not an error, for a page with no handler", async () => {
     const { page } = mountPage({ load: vi.fn() });
     await page.run(() => Promise.reject(axiosErr(403, "Unauthorized Access")));
diff --git a/web/src/composables/dbm/useDbmListPage.ts b/web/src/composables/dbm/useDbmListPage.ts
index 8373bddca7..c1de8f757a 100644
--- a/web/src/composables/dbm/useDbmListPage.ts
+++ b/web/src/composables/dbm/useDbmListPage.ts
@@ -46,6 +46,7 @@ import { useDbmScopeSyncScope } from "@/composables/dbm/useDbmScopeSync";
 import { useDbmTabCountsContext, type DbmTabCountsContext } from "@/composables/dbm/dbmTabCounts";
 import type { BadgeCount, DbmTabCountKey } from "@/composables/dbm/useDbmTabCounts";
 import { claimedCount, dbmHttpError } from "@/utils/dbm/format";
+import { forbiddenState, licenseDeniedFeatures, type ForbiddenState } from "@/utils/featureGate";
 
 export interface DbmListPageOptions {
   /**
@@ -147,7 +148,7 @@ export function useDbmListPage(options: DbmListPageOptions) {
   const loading = ref(false);
   const error = ref<string | null>(null);
   // A 403 on a page without its own permission diagnosis: the table shows "no access", not the raw error.
-  const forbidden = ref(false);
+  const forbidden = ref<ForbiddenState>(false);
   const search = ref("");
 
   /**
@@ -204,10 +205,10 @@ export function useDbmListPage(options: DbmListPageOptions) {
       const { status, serverMessage, message } = dbmHttpError(err);
       if ((status === 404 || status === 501) && runOptions.onNotCollecting) {
         runOptions.onNotCollecting();
-      } else if (status === 403 && runOptions.onForbidden) {
+      } else if (status === 403 && runOptions.onForbidden && !licenseDeniedFeatures(err)) {
         runOptions.onForbidden();
       } else if (status === 403) {
-        forbidden.value = true;
+        forbidden.value = forbiddenState(err) || true;
       } else if (runOptions.onError) {
         runOptions.onError(serverMessage, err);
       } else {
diff --git a/web/src/composables/downtimes/useDowntimeItems.spec.ts b/web/src/composables/downtimes/useDowntimeItems.spec.ts
new file mode 100644
index 0000000000..5f3f1ad77e
--- /dev/null
+++ b/web/src/composables/downtimes/useDowntimeItems.spec.ts
@@ -0,0 +1,75 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import { defineComponent } from "vue";
+import { createStore } from "vuex";
+import { queryClient } from "@/composables/query/queryClient";
+import type { TargetModule } from "@/services/downtimes";
+import { useDowntimeItems } from "./useDowntimeItems";
+
+const { listFn } = vi.hoisted(() => ({ listFn: vi.fn() }));
+vi.mock("@/services/synthetics.queries", () => ({
+  syntheticsMonitorsQuery: (org: string) => ({ queryKey: ["synthetics", org], queryFn: listFn }),
+}));
+vi.mock("@/services/slos.queries", () => ({
+  slosQuery: (org: string) => ({ queryKey: ["slos", org], queryFn: listFn }),
+}));
+vi.mock("@/services/anomaly_detection.queries", () => ({
+  anomalyConfigsQuery: (org: string) => ({ queryKey: ["anomaly", org], queryFn: listFn }),
+}));
+
+const run = async (module: TargetModule, features: Record<string, string> = {}) => {
+  const store = createStore({
+    state: { selectedOrganization: { identifier: "acme" }, zoConfig: { features } },
+  });
+  mount(
+    defineComponent({
+      setup() {
+        useDowntimeItems(module);
+        return {};
+      },
+      template: "<div />",
+    }),
+    { global: { plugins: [store] } },
+  );
+  await flushPromises();
+};
+
+describe("useDowntimeItems", () => {
+  beforeEach(() => {
+    queryClient.clear();
+    listFn.mockReset();
+    listFn.mockResolvedValue([]);
+  });
+
+  it.each([
+    ["synthetics", "synthetics"],
+    ["anomaly_detections", "anomaly_detection"],
+    ["slos", "anomaly_detection"],
+  ] as const)("reads no %s list while %s is license-locked", async (module, feature) => {
+    await run(module, { [feature]: "locked" });
+    expect(listFn).not.toHaveBeenCalled();
+  });
+
+  it.each(["synthetics", "anomaly_detections", "slos"] as const)(
+    "reads the %s list while its feature is enabled",
+    async (module) => {
+      await run(module);
+      expect(listFn).toHaveBeenCalledTimes(1);
+    },
+  );
+});
diff --git a/web/src/composables/downtimes/useDowntimeItems.ts b/web/src/composables/downtimes/useDowntimeItems.ts
index 3ae7a37327..f81193b70d 100644
--- a/web/src/composables/downtimes/useDowntimeItems.ts
+++ b/web/src/composables/downtimes/useDowntimeItems.ts
@@ -21,6 +21,26 @@ import { anomalyConfigsQuery } from "@/services/anomaly_detection.queries";
 import { syntheticsMonitorsQuery } from "@/services/synthetics.queries";
 import { slosQuery } from "@/services/slos.queries";
 import type { TargetModule } from "@/services/downtimes";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+
+// SLOs are licensed under anomaly detection on the backend.
+export const TARGET_MODULE_FEATURES: Record<TargetModule, string> = {
+  alerts: "alerts",
+  anomaly_detections: "anomaly_detection",
+  synthetics: "synthetics",
+  slos: "anomaly_detection",
+};
+
+type ModuleLock = ReturnType<typeof useLicenseLock>;
+
+export function useTargetModuleLocks(): Record<TargetModule, ModuleLock> {
+  return {
+    alerts: useLicenseLock(TARGET_MODULE_FEATURES.alerts),
+    anomaly_detections: useLicenseLock(TARGET_MODULE_FEATURES.anomaly_detections),
+    synthetics: useLicenseLock(TARGET_MODULE_FEATURES.synthetics),
+    slos: useLicenseLock(TARGET_MODULE_FEATURES.slos),
+  };
+}
 
 export interface DowntimeItem {
   id: string;
@@ -76,9 +96,10 @@ export function useDowntimeItems(
   enabled: MaybeRefOrGetter<boolean> = true,
 ) {
   const orgId = useOrgId();
+  const locks = useTargetModuleLocks();
   const query = useQuery(() =>
     Object.assign(itemsQuery(toValue(module), orgId.value), {
-      enabled: !!orgId.value && toValue(enabled),
+      enabled: !!orgId.value && toValue(enabled) && !locks[toValue(module)].locked.value,
     }),
   );
   const items = computed(() => normalizeItems(toValue(module), query.data.value ?? []));
diff --git a/web/src/composables/iam/useRoleEntityLoaders.spec.ts b/web/src/composables/iam/useRoleEntityLoaders.spec.ts
index dbfc06c4a5..05b87d9ae8 100644
--- a/web/src/composables/iam/useRoleEntityLoaders.spec.ts
+++ b/web/src/composables/iam/useRoleEntityLoaders.spec.ts
@@ -208,7 +208,7 @@ const ORG = "default";
 
 // The row builders live in EditRole.vue; here they are stubs that record what
 // each loader hands them and keep the entity count observable.
-function setup() {
+function setup(features?: Record<string, string>) {
   const updateResourceEntities = vi.fn();
   const updateEntityEntities = vi.fn((entity: any, _keys: string[], entities: any[]) => {
     entity?.entities?.push(...entities);
@@ -216,7 +216,7 @@ function setup() {
   const updateResourceResource = vi.fn();
 
   const loaders = useRoleEntityLoaders({
-    store: { state: { selectedOrganization: { identifier: ORG } } },
+    store: { state: { selectedOrganization: { identifier: ORG }, zoConfig: { features } } },
     getStreams: getStreamsMock,
     t: (key: string) => key,
     updateResourceEntities,
@@ -242,6 +242,58 @@ afterEach(() => {
   vi.clearAllMocks();
 });
 
+describe("useRoleEntityLoaders - license-locked features", () => {
+  const LOCKED = {
+    dashboards: "locked",
+    pipelines: "locked",
+    alerts: "locked",
+    reports: "locked",
+    synthetics: "locked",
+  };
+
+  it("lists nothing for the rows of locked features", async () => {
+    const { getResourceEntities } = setup(LOCKED);
+    const rows = [
+      row({ resourceName: "dfolder" }),
+      row({ name: "f1", resourceName: "dfolder", childName: "dashboard" }),
+      row({ resourceName: "pipeline" }),
+      row({ name: "f1", resourceName: "afolder", childName: "alert" }),
+      row({ name: "f1", resourceName: "report", childName: "report" }),
+      row({ resourceName: "synthetic_folder" }),
+      row({ name: "f1", resourceName: "synthetic_folder", childName: "synthetics" }),
+      row({ resourceName: "synthetic_environment" }),
+      row({ resourceName: "downtime_folder" }),
+      row({ name: "f1", resourceName: "downtime_folder", childName: "downtime" }),
+    ];
+
+    for (const r of rows) await expect(getResourceEntities(r as any)).resolves.toBe(true);
+
+    expect(downtimesService.list).not.toHaveBeenCalled();
+    expect(commonService.list_Folders).not.toHaveBeenCalled();
+    expect(dashboardService.list).not.toHaveBeenCalled();
+    expect(dashboardService.list_Folders).not.toHaveBeenCalled();
+    expect(pipelineService.getPipelines).not.toHaveBeenCalled();
+    expect(alertService.listByFolderId).not.toHaveBeenCalled();
+    expect(reportService.listByFolderId).not.toHaveBeenCalled();
+    expect(syntheticsService.listByFolderId).not.toHaveBeenCalled();
+    expect(rows.every((r) => !r.is_loading)).toBe(true);
+  });
+
+  it("still lists the same rows when the features are enabled", async () => {
+    const { getResourceEntities } = setup({ dashboards: "enabled", reports: "enabled" });
+
+    await getResourceEntities(
+      row({ name: "f1", resourceName: "dfolder", childName: "dashboard" }) as any,
+    );
+    await getResourceEntities(
+      row({ name: "f9", resourceName: "report", childName: "report" }) as any,
+    );
+
+    expect(dashboardService.list).toHaveBeenCalledTimes(1);
+    expect(reportService.listByFolderId).toHaveBeenCalledTimes(1);
+  });
+});
+
 describe("useRoleEntityLoaders - getResourceEntities dispatch", () => {
   it("resolves without touching a service when the resource is missing", async () => {
     const { getResourceEntities } = setup();
diff --git a/web/src/composables/iam/useRoleEntityLoaders.ts b/web/src/composables/iam/useRoleEntityLoaders.ts
index 6848b1cede..633c189a2e 100644
--- a/web/src/composables/iam/useRoleEntityLoaders.ts
+++ b/web/src/composables/iam/useRoleEntityLoaders.ts
@@ -38,6 +38,21 @@ import onlineEvalsService from "@/services/online-evals.service";
 import llmQueuesService from "@/services/llm-queues.service";
 import llmDatasetsService from "@/services/llm-datasets.service";
 import llmPromptsService from "@/services/llm-prompts.service";
+import { featureState } from "@/utils/featureGate";
+
+// A locked feature's list API answers 403, so its rows stay empty instead of raising the license bar.
+const LOADER_LICENSE_FEATURE: Record<string, string> = {
+  dashboard: "dashboards",
+  dfolder: "dashboards",
+  pipeline: "pipelines",
+  alert: "alerts",
+  downtime_folder: "alerts",
+  downtime: "alerts",
+  report: "reports",
+  synthetic_folder: "synthetics",
+  synthetics: "synthetics",
+  synthetic_environment: "synthetics",
+};
 
 type RowBuilders = {
   updateResourceEntities: (
@@ -85,6 +100,11 @@ export const useRoleEntityLoaders = (deps: LoaderDeps) => {
   // Keyed by the row itself: two rows can share a name (every folder list has a `default`).
   const entityLoads = new WeakMap<object, Promise<unknown>>();
 
+  const isLicenseLocked = (loaderKey: string): boolean => {
+    const feature = LOADER_LICENSE_FEATURE[loaderKey];
+    return !!feature && featureState(store.state.zoConfig?.features, feature) === "locked";
+  };
+
   const getResourceEntities = (resource: Resource | Entity) => {
     if (!resource) return Promise.resolve(true);
 
@@ -148,11 +168,10 @@ export const useRoleEntityLoaders = (deps: LoaderDeps) => {
           if (!resource.entities?.length) {
             resource.is_loading = true;
             try {
-              const listEntities = resource.childName
-                ? listEntitiesFnMap[resource.childName]
-                : listEntitiesFnMap[resource.resourceName];
+              const key = resource.childName || resource.resourceName;
+              const listEntities = listEntitiesFnMap[key];
 
-              if (listEntities) {
+              if (listEntities && !isLicenseLocked(key)) {
                 await listEntities(resource);
               }
             } finally {
diff --git a/web/src/composables/metrics/useMetricDrilldown.spec.ts b/web/src/composables/metrics/useMetricDrilldown.spec.ts
index 20ad2dc5d3..ed4f24df76 100644
--- a/web/src/composables/metrics/useMetricDrilldown.spec.ts
+++ b/web/src/composables/metrics/useMetricDrilldown.spec.ts
@@ -71,6 +71,7 @@ const setup = (
     enabled?: boolean;
     metricLabels?: string[] | undefined;
     org?: Ref<string>;
+    licenseLocked?: Ref<boolean>;
   } = {},
 ) => {
   const router = { push: vi.fn() };
@@ -85,6 +86,7 @@ const setup = (
     inapplicableFilters: () => over.inapplicable ?? [],
     timeRange: () => WINDOW,
     serviceStreamsEnabled: () => over.enabled ?? true,
+    licenseLocked: () => over.licenseLocked?.value ?? false,
     router,
     store,
     onDropped,
@@ -123,6 +125,36 @@ describe("useMetricDrilldown", () => {
       expect(api.correlate).not.toHaveBeenCalled();
     });
 
+    it("is license-locked without any identity, groups or correlate call", async () => {
+      const { drilldown } = setup({
+        licenseLocked: ref(true),
+        filters: [{ label: "service_name", value: "checkout" }],
+      });
+      await flushPromises();
+      expect(drilldown.availability.value).toBe("licenseLocked");
+      await drilldown.open();
+      expect(api.getIdentityConfig).not.toHaveBeenCalled();
+      expect(api.getSemanticGroups).not.toHaveBeenCalled();
+      expect(api.correlate).not.toHaveBeenCalled();
+    });
+
+    it("reads once the license unlocks correlation", async () => {
+      const licenseLocked = ref(true);
+      const { drilldown } = setup({ licenseLocked });
+      await flushPromises();
+      licenseLocked.value = false;
+      await flushPromises();
+      expect(api.getIdentityConfig).toHaveBeenCalledTimes(1);
+      expect(drilldown.availability.value).toBe("available");
+    });
+
+    it("keeps the OSS state over a license lock", async () => {
+      (config as any).isEnterprise = "false";
+      const { drilldown } = setup({ licenseLocked: ref(true) });
+      await flushPromises();
+      expect(drilldown.availability.value).toBe("oss");
+    });
+
     it("is off when service discovery is off", async () => {
       const { drilldown } = setup({ enabled: false });
       await flushPromises();
diff --git a/web/src/composables/metrics/useMetricDrilldown.ts b/web/src/composables/metrics/useMetricDrilldown.ts
index e55ec8fb98..f0e994a341 100644
--- a/web/src/composables/metrics/useMetricDrilldown.ts
+++ b/web/src/composables/metrics/useMetricDrilldown.ts
@@ -76,6 +76,8 @@ export interface UseMetricDrilldownDeps {
   inapplicableFilters: () => LabelFilterLike[];
   timeRange: () => { start_time: number; end_time: number };
   serviceStreamsEnabled: () => boolean;
+  /** The license locks correlation: no identity, groups or correlate call is made. */
+  licenseLocked?: () => boolean;
   router: { push: (route: any) => unknown };
   store: { dispatch: (type: string, payload?: unknown) => unknown };
   /** Told the user's names of the identity labels a stream could not apply. */
@@ -93,14 +95,16 @@ export function useMetricDrilldown(deps: UseMetricDrilldownDeps) {
   let identityConfig: ServiceIdentityConfig = { sets: [], tracked_alias_ids: [] };
   let semanticGroups: FieldAlias[] = [];
 
-  const availability = computed(() =>
-    availabilityOf({
+  const isLicenseLocked = () => deps.licenseLocked?.() ?? false;
+  const availability = computed(() => {
+    const state = availabilityOf({
       isEnterprise: config.isEnterprise,
       serviceStreamsEnabled: deps.serviceStreamsEnabled(),
       identityStatus: identityStatus.value,
       groupsStatus: groupsStatus.value,
-    }),
-  );
+    });
+    return state !== "oss" && isLicenseLocked() ? ("licenseLocked" as const) : state;
+  });
 
   const menu = ref<DrilldownMenu>({ kind: "idle" });
   let pickedService: LabelFilterLike | null = null;
@@ -139,7 +143,7 @@ export function useMetricDrilldown(deps: UseMetricDrilldownDeps) {
   let readsReady: Promise<void> = Promise.resolve();
   // The detail view stays mounted across an org switch, so the reads follow the org and the discovery flag.
   watch(
-    () => [deps.org(), deps.serviceStreamsEnabled()],
+    () => [deps.org(), deps.serviceStreamsEnabled(), isLicenseLocked()],
     () => {
       ++generation;
       menu.value = { kind: "idle" };
@@ -148,7 +152,7 @@ export function useMetricDrilldown(deps: UseMetricDrilldownDeps) {
       identityConfig = { sets: [], tracked_alias_ids: [] };
       semanticGroups = [];
       readsReady =
-        config.isEnterprise === "true" && deps.serviceStreamsEnabled()
+        config.isEnterprise === "true" && deps.serviceStreamsEnabled() && !isLicenseLocked()
           ? loadReads()
           : Promise.resolve();
     },
diff --git a/web/src/composables/rum/useRumSpanBuilder.spec.ts b/web/src/composables/rum/useRumSpanBuilder.spec.ts
index 29f0f2ab79..1e24f75cd5 100644
--- a/web/src/composables/rum/useRumSpanBuilder.spec.ts
+++ b/web/src/composables/rum/useRumSpanBuilder.spec.ts
@@ -327,6 +327,20 @@ describe("useRumSpanBuilder", () => {
       expect(searchService.search).not.toHaveBeenCalled();
     });
 
+    it("should not read _rumdata when the rum license is locked", async () => {
+      mockSearchRoutes({ tracedResources: [] });
+      (mockStore.state.zoConfig as Record<string, unknown>).features = { rum: "locked" };
+      try {
+        const { fetchRumEventsForTrace } = buildComposable(["_rumdata"]);
+        const result = await fetchRumEventsForTrace("trace-abc", makeDanglingTrace());
+        expect(result.tracedResources).toEqual([]);
+        expect(mockGetStream).not.toHaveBeenCalled();
+        expect(searchService.search).not.toHaveBeenCalled();
+      } finally {
+        delete (mockStore.state.zoConfig as Record<string, unknown>).features;
+      }
+    });
+
     it("should return empty result when RUM stream schema lacks a trace-id field", async () => {
       mockGetStream.mockResolvedValue(makeRumStream([]));
       const { fetchRumEventsForTrace } = buildComposable(["_rumdata"]);
diff --git a/web/src/composables/rum/useRumSpanBuilder.ts b/web/src/composables/rum/useRumSpanBuilder.ts
index 1c8ab66a9f..d8d13e8ecd 100644
--- a/web/src/composables/rum/useRumSpanBuilder.ts
+++ b/web/src/composables/rum/useRumSpanBuilder.ts
@@ -30,6 +30,7 @@ import { SPAN_KIND_CLIENT, SPAN_KIND_UNSPECIFIED } from "@/utils/traces/constant
 import { spanWindowUs } from "@/utils/rum/traceWindow";
 import { collapseViewDocuments } from "@/utils/rum/viewDocuments";
 import { sqlIn } from "@/utils/query/sqlFilterBuilder";
+import { featureState } from "@/utils/featureGate";
 
 const ACTION_PROXIMITY_MS = 10_000; // ±10s — actions beyond this are collapsed
 // A browser request starts before the trace but is stamped on completion, so the tail is longer.
@@ -191,7 +192,11 @@ export default function useRumSpanBuilder(
     };
 
     try {
-      if (!logStreams.value.includes("_rumdata") || !traceId) {
+      if (
+        !logStreams.value.includes("_rumdata") ||
+        !traceId ||
+        featureState(store.state.zoConfig?.features, "rum") === "locked"
+      ) {
         return empty;
       }
       if (!hasDanglingParent(spans)) return empty;
diff --git a/web/src/composables/shared/oncallRouteGuard.ts b/web/src/composables/shared/oncallRouteGuard.ts
index aab76f7c32..99a3544e8c 100644
--- a/web/src/composables/shared/oncallRouteGuard.ts
+++ b/web/src/composables/shared/oncallRouteGuard.ts
@@ -15,10 +15,13 @@
 
 import store from "@/stores";
 import { routeGuard } from "@/utils/zincutils";
+import { featureState } from "@/utils/featureGate";
 
 /** Redirects home only on an explicit `oncall_enabled: false`, since a cold load has not read /config yet. */
 export const oncallRouteGuard = (to: any, from: any, next: any) => {
-  if (store.state.zoConfig?.oncall_enabled === false) {
+  // A locked license also reports `oncall_enabled` false, yet its page still renders, locked.
+  const locked = featureState(store.state.zoConfig?.features, "oncall") === "locked";
+  if (!locked && store.state.zoConfig?.oncall_enabled === false) {
     next("/");
     return;
   }
diff --git a/web/src/composables/shared/router.spec.ts b/web/src/composables/shared/router.spec.ts
index 0c66b8e86b..88e0ac8f08 100644
--- a/web/src/composables/shared/router.spec.ts
+++ b/web/src/composables/shared/router.spec.ts
@@ -2659,6 +2659,210 @@ describe("useRoutes (router.ts)", () => {
     });
   });
 
+  describe("license-locked downtimes and alert insights", () => {
+    const enter = (name: string, zoConfig: Record<string, unknown>) => {
+      const previous = store.state.zoConfig;
+      store.state.zoConfig = zoConfig;
+      try {
+        const route = findRoute(useRoutes().homeChildRoutes, name);
+        const next = vi.fn();
+        route.beforeEnter({ query: { org_identifier: "acme" } }, {}, next);
+        return { route, next };
+      } finally {
+        store.state.zoConfig = previous;
+      }
+    };
+
+    beforeEach(() => {
+      config.isEnterprise = "true";
+    });
+
+    it.each([
+      ["downtimes", "alerts", { downtimes_enabled: false }],
+      ["editDowntime", "alerts", { downtimes_enabled: false }],
+      ["alertCalibration", "alerts", { alert_calibration_enabled: false }],
+      ["alertCalibrationRuns", "alerts", { alert_calibration_enabled: false }],
+    ])("opens a locked %s page, tagged %s, though its flag is off", (name, feature, flags) => {
+      const { route, next } = enter(name, { ...flags, features: { [feature]: "locked" } });
+      expect(route.meta.licenseFeature).toBe(feature);
+      expect(next).toHaveBeenCalledWith();
+    });
+
+    it("still sends a hidden downtimes page with its flag off to Alerts", () => {
+      const { next } = enter("downtimes", {
+        downtimes_enabled: false,
+        features: { alerts: "hidden" },
+      });
+      expect(next).toHaveBeenCalledWith({ name: "alertList", query: { org_identifier: "acme" } });
+    });
+
+    it("tags Alert Sources with the incidents feature", () => {
+      expect(findRoute(useRoutes().homeChildRoutes, "alertSources").meta.licenseFeature).toBe(
+        "incidents",
+      );
+    });
+  });
+
+  describe("license feature tags", () => {
+    const shell = (path: string): any =>
+      useRoutes().homeChildRoutes.find((r: any) => r.path === path);
+
+    const enterShell = (path: string, zoConfig: Record<string, unknown>) => {
+      const previous = store.state.zoConfig;
+      store.state.zoConfig = zoConfig;
+      try {
+        const next = vi.fn();
+        shell(path).beforeEnter({ query: { org_identifier: "acme" } }, {}, next);
+        return next;
+      } finally {
+        store.state.zoConfig = previous;
+      }
+    };
+
+    it.each([
+      ["dashboards", "dashboards"],
+      ["viewDashboard", "dashboards"],
+      ["dashboardTvPlaylist", "dashboards"],
+      ["importDashboard", "dashboards"],
+      ["publicDashboardLinks", "dashboards"],
+      ["addPanel", "dashboards"],
+      ["reports", "reports"],
+      ["reportDetail", "reports"],
+      ["createReport", "reports"],
+      ["alertList", "alerts"],
+      ["alertDetail", "alerts"],
+      ["addAlert", "alerts"],
+      ["editAlert", "alerts"],
+      ["alertHistory", "alerts"],
+      ["alertInsights", "alerts"],
+      ["alertLibrary", "alerts"],
+      ["importSemanticGroups", "alerts"],
+      ["addAnomalyDetection", "anomaly_detection"],
+      ["editAnomalyDetection", "anomaly_detection"],
+      ["sloList", "anomaly_detection"],
+      ["addSlo", "anomaly_detection"],
+      ["editSlo", "anomaly_detection"],
+      ["sloDetail", "anomaly_detection"],
+      ["pipelines", "pipelines"],
+      ["pipelineEditor", "pipelines"],
+      ["createPipeline", "pipelines"],
+      ["importPipeline", "pipelines"],
+      ["pipelineHistory", "pipelines"],
+      ["pipelineBackfill", "pipelines"],
+      ["RUM", "rum"],
+      ["Sessions", "rum"],
+      ["SessionViewer", "rum"],
+      ["ErrorTracking", "rum"],
+      ["SourceMaps", "rum"],
+      ["UploadSourceMaps", "rum"],
+      ["RumPerformance", "rum"],
+      ["rumPerformanceWebVitals", "rum"],
+      [PA_ROUTES.shell, "product_analytics"],
+      [PA_ROUTES.funnels, "product_analytics"],
+      [PA_ROUTES.eventNew, "product_analytics"],
+      [PA_ROUTES.eventEdit, "product_analytics"],
+      ["dbmDatabases", "db_monitoring"],
+      ["dbmDeadlocks", "db_monitoring"],
+      ["dbmQueryDetail", "db_monitoring"],
+      ["profiles", "continuous_profiling"],
+      ["infraKubernetes", "kubernetes_monitoring"],
+      ["infraKubernetes2", "kubernetes_monitoring"],
+      ["infraHosts", "host_monitoring"],
+      ["alertDestinations", "alerts"],
+      ["alertTemplates", "alerts"],
+      ["traces", "traces"],
+      ["traceDetails", "traces"],
+      ["sessionDetails", "traces"],
+      ["metrics", "metrics"],
+    ])("tags %s with meta.licenseFeature %s", (name, feature) => {
+      expect(findRoute(useRoutes().homeChildRoutes, name).meta.licenseFeature).toBe(feature);
+    });
+
+    it("tags the Database Monitoring shell itself", () => {
+      expect(shell("infra/databases").meta.licenseFeature).toBe("db_monitoring");
+    });
+
+    it.each([
+      "pipeline",
+      "functionList",
+      "importFunction",
+      "enrichmentTables",
+      "logs",
+      "logstreams",
+    ])("leaves %s untagged", (name) => {
+      expect(findRoute(useRoutes().homeChildRoutes, name).meta?.licenseFeature).toBeUndefined();
+    });
+
+    it.each(["logs", "searchJobInspector", "searchHistory", "searchScheduler", "streamExplorer"])(
+      "locks %s by its stream_type query instead of a static key",
+      (name) => {
+        const { meta } = findRoute(useRoutes().homeChildRoutes, name);
+        expect(meta.licenseFeatureFromStreamType).toBe(true);
+        expect(meta.licenseFeature).toBeUndefined();
+      },
+    );
+
+    it("leaves the logged-out public dashboard untagged", () => {
+      const route = useRoutes().parentRoutes.find((r: any) => r.name === "publicDashboard");
+      expect(route.meta.licenseFeature).toBeUndefined();
+    });
+
+    it("opens a locked Database Monitoring section though its flag is off", () => {
+      const next = enterShell("infra/databases", {
+        database_monitoring_enabled: false,
+        features: { db_monitoring: "locked" },
+      });
+      expect(next).toHaveBeenCalledWith();
+    });
+
+    it("still sends a hidden Database Monitoring section to traces", () => {
+      const next = enterShell("infra/databases", {
+        database_monitoring_enabled: false,
+        features: { db_monitoring: "hidden" },
+      });
+      expect(next).toHaveBeenCalledWith({ name: "traces", query: { org_identifier: "acme" } });
+    });
+
+    it("opens locked profiles though profiling is off, and still bounces hidden ones", () => {
+      expect(
+        enterShell("profiles", {
+          profiling_enabled: false,
+          features: { continuous_profiling: "locked" },
+        }),
+      ).toHaveBeenCalledWith();
+      expect(
+        enterShell("profiles", {
+          profiling_enabled: false,
+          features: { continuous_profiling: "hidden" },
+        }),
+      ).toHaveBeenCalledWith({ name: "home", query: { org_identifier: "acme" } });
+    });
+
+    it("opens locked public-dashboard links though public dashboards are off", () => {
+      const previous = store.state.zoConfig;
+      const run = (zoConfig: Record<string, unknown>) => {
+        store.state.zoConfig = zoConfig;
+        const next = vi.fn();
+        findRoute(useRoutes().homeChildRoutes, "publicDashboardLinks").beforeEnter(
+          { query: { org_identifier: "acme" } },
+          {},
+          next,
+        );
+        return next;
+      };
+      try {
+        expect(
+          run({ public_dashboards_enabled: false, features: { dashboards: "locked" } }),
+        ).toHaveBeenCalledWith();
+        expect(
+          run({ public_dashboards_enabled: false, features: { dashboards: "hidden" } }),
+        ).toHaveBeenCalledWith({ name: "dashboards", query: { org_identifier: "acme" } });
+      } finally {
+        store.state.zoConfig = previous;
+      }
+    });
+  });
+
   // the paywall predicate treats a matched beforeEnter as proof that routeGuard runs there.
   describe("paywall guard proxy (A-27)", () => {
     const EXPIRED_MICROS = (Date.now() - 30 * 24 * 60 * 60 * 1000) * 1000;
diff --git a/web/src/composables/shared/router.ts b/web/src/composables/shared/router.ts
index 6e1713d934..76fa014572 100644
--- a/web/src/composables/shared/router.ts
+++ b/web/src/composables/shared/router.ts
@@ -18,6 +18,7 @@ import type { LocationQuery, LocationQueryRaw, RouteLocationRaw } from "vue-rout
 import config from "@/aws-exports";
 import { resolveTraceSearchMode, type TraceSearchMode } from "@/ts/interfaces/traces/trace.types";
 import store from "@/stores";
+import { featureState, withLicenseFeature } from "@/utils/featureGate";
 import {
   hasMetricsEditorParams,
   hasMetricsOverrideParams,
@@ -134,6 +135,10 @@ const dbmEnterpriseGuard = (to: any, from: any, next: any) => {
   routeGuard(to, from, next);
 };
 
+// A locked license also turns the feature's runtime flag off, yet its page still renders, locked.
+const isLicenseLocked = (key: string): boolean =>
+  featureState(store.state.zoConfig?.features, key) === "locked";
+
 // `=== false`, not falsy: a cold load with `/config` still in flight must not bounce.
 const downtimesRouteGuard = (to: any, from: any, next: any) => {
   const zoConfig = store.state.zoConfig;
@@ -141,7 +146,7 @@ const downtimesRouteGuard = (to: any, from: any, next: any) => {
   if (
     isOss ||
     (config.isEnterprise !== "true" && config.isCloud !== "true") ||
-    zoConfig?.downtimes_enabled === false
+    (zoConfig?.downtimes_enabled === false && !isLicenseLocked("alerts"))
   ) {
     next({ name: "alertList", query: { org_identifier: to.query.org_identifier } });
     return;
@@ -155,7 +160,7 @@ const alertCalibrationRouteGuard = (to: any, from: any, next: any) => {
   if (
     zoConfig?.build_type === "opensource" ||
     (config.isEnterprise !== "true" && config.isCloud !== "true") ||
-    zoConfig?.alert_calibration_enabled === false
+    (zoConfig?.alert_calibration_enabled === false && !isLicenseLocked("alerts"))
   ) {
     next({ name: "alertList", query: { org_identifier: to.query.org_identifier } });
     return;
@@ -165,7 +170,10 @@ const alertCalibrationRouteGuard = (to: any, from: any, next: any) => {
 
 // `=== false`, as for Downtimes: a cold load with `/config` still in flight must not bounce.
 const profilesRouteGuard = (to: any, from: any, next: any) => {
-  if (store.state.zoConfig?.profiling_enabled === false) {
+  if (
+    store.state.zoConfig?.profiling_enabled === false &&
+    !isLicenseLocked("continuous_profiling")
+  ) {
     next({ name: "home", query: { org_identifier: to.query.org_identifier } });
     return;
   }
@@ -346,6 +354,7 @@ const useRoutes = () => {
         keepAlive: true,
         titleKey: "menu.search",
         allowOnEmptyData: true,
+        licenseFeatureFromStreamType: true,
       },
       beforeEnter(to: any, from: any, next: any) {
         // Back-compat: Search History / Scheduler used to be `?action=…` overlays
@@ -369,6 +378,7 @@ const useRoutes = () => {
       meta: {
         keepAlive: false,
         titleKey: "logs.searchJobInspector.title",
+        licenseFeatureFromStreamType: true,
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -384,6 +394,7 @@ const useRoutes = () => {
       meta: {
         keepAlive: false,
         titleKey: "search_history.title",
+        licenseFeatureFromStreamType: true,
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -399,6 +410,7 @@ const useRoutes = () => {
       meta: {
         keepAlive: false,
         titleKey: "routeTitles.searchScheduler",
+        licenseFeatureFromStreamType: true,
       },
       beforeEnter(to: any, from: any, next: any) {
         if (config.isEnterprise !== "true") {
@@ -417,6 +429,7 @@ const useRoutes = () => {
         keepAlive: false,
         titleKey: "menu.metrics",
         allowOnEmptyData: true,
+        licenseFeature: "metrics",
       },
       beforeEnter(to: any, from: any, next: any) {
         const overrides = hasMetricsOverrideParams(to.query);
@@ -456,6 +469,7 @@ const useRoutes = () => {
         keepAlive: true,
         titleKey: "menu.traces",
         allowOnEmptyData: true,
+        licenseFeature: "traces",
       },
       beforeEnter(to: any, from: any, next: any) {
         const tab = supportedTraceTab(to.query?.tab);
@@ -478,6 +492,7 @@ const useRoutes = () => {
       meta: {
         keepAlive: true,
         titleKey: "menu.profiles",
+        licenseFeature: "continuous_profiling",
       },
       beforeEnter: profilesRouteGuard,
     },
@@ -489,11 +504,11 @@ const useRoutes = () => {
       path: "traces/services",
       redirect: redirectToTraceTab("services-catalog"),
     },
-    {
+    withLicenseFeature("db_monitoring", {
       path: "infra/databases",
       component: DbmShell,
       beforeEnter(to: any, from: any, next: any) {
-        if (!dbMonitoringEnabled()) {
+        if (!dbMonitoringEnabled() && !isLicenseLocked("db_monitoring")) {
           next({ name: "traces", query: to.query });
           return;
         }
@@ -592,7 +607,7 @@ const useRoutes = () => {
           },
         },
       ],
-    },
+    }),
     {
       // Database Monitoring moved from `traces/databases` to `infra/databases`.
       // Every old link keeps working: the wildcard carries the tab segment
@@ -610,14 +625,14 @@ const useRoutes = () => {
       path: "infra/hosts",
       name: "infraHosts",
       component: () => import("@/views/Infrastructure/HostsPage.vue"),
-      meta: { titleKey: "menu.hosts" },
+      meta: { titleKey: "menu.hosts", licenseFeature: "host_monitoring" },
       beforeEnter: routeGuard,
     },
     {
       path: "infra/kubernetes",
       name: "infraKubernetes",
       component: () => import("@/views/Infrastructure/kubernetes2/KubernetesPage.vue"),
-      meta: { titleKey: "menu.kubernetes" },
+      meta: { titleKey: "menu.kubernetes", licenseFeature: "kubernetes_monitoring" },
       beforeEnter: routeGuard,
     },
     {
@@ -626,7 +641,7 @@ const useRoutes = () => {
       name: "infraKubernetes2",
       component: () => import("@/views/Infrastructure/curated/CuratedPageView.vue"),
       props: { workload: "kubernetes" },
-      meta: { titleKey: "menu.kubernetes2" },
+      meta: { titleKey: "menu.kubernetes2", licenseFeature: "kubernetes_monitoring" },
       beforeEnter: routeGuard,
     },
     {
@@ -636,6 +651,7 @@ const useRoutes = () => {
       props: { showAskAi: true },
       meta: {
         titleKey: "routeTitles.traceDetails",
+        licenseFeature: "traces",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -647,6 +663,7 @@ const useRoutes = () => {
       component: SessionDetails,
       meta: {
         titleKey: "routeTitles.sessionDetails",
+        licenseFeature: "traces",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -664,6 +681,7 @@ const useRoutes = () => {
       props: true,
       meta: {
         titleKey: "routeTitles.streamExplorer",
+        licenseFeatureFromStreamType: true,
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -689,6 +707,19 @@ const useRoutes = () => {
         titleKey: "menu.about",
       },
     },
+    {
+      // Every build: locked nav entries land here, including on OSS where the feature has no route.
+      path: "feature-locked/:feature",
+      name: "featureLocked",
+      component: () => import("@/components/common/FeatureLocked.vue"),
+      meta: {
+        titleKey: "featureLock.routeTitle",
+        allowOnEmptyData: true,
+      },
+      beforeEnter(to: any, from: any, next: any) {
+        routeGuard(to, from, next);
+      },
+    },
     {
       path: "dashboards",
       name: "dashboards",
@@ -697,6 +728,7 @@ const useRoutes = () => {
         keepAlive: false,
         titleKey: "menu.dashboard",
         allowOnEmptyData: true,
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -710,6 +742,7 @@ const useRoutes = () => {
       meta: {
         titleKey: "routeTitles.viewDashboard",
         accessScopeQuery: ["dashboard"],
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
         // A playlist link to the dashboard view is played by the TV player, except its own page fallback.
@@ -728,6 +761,7 @@ const useRoutes = () => {
       component: TvPlaylist,
       meta: {
         titleKey: "routeTitles.dashboardTvPlaylist",
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -740,6 +774,7 @@ const useRoutes = () => {
       props: true,
       meta: {
         titleKey: "dashboard.importDashboard",
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -751,9 +786,10 @@ const useRoutes = () => {
       component: PublicDashboardLinks,
       meta: {
         titleKey: "dashboard.publicLinks.pageTitle",
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
-        if (!publicDashboardsEnabled()) {
+        if (!publicDashboardsEnabled() && !isLicenseLocked("dashboards")) {
           next({ name: "dashboards", query: { org_identifier: to.query.org_identifier } });
           return;
         }
@@ -768,6 +804,7 @@ const useRoutes = () => {
       meta: {
         titleKey: "panel.addPanel",
         accessScopeQuery: ["dashboard"],
+        licenseFeature: "dashboards",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -824,7 +861,7 @@ const useRoutes = () => {
             routeGuard(to, from, next);
           },
         },
-        {
+        withLicenseFeature("pipelines", {
           path: "pipelines",
           name: "pipelines",
           component: PipelinesList,
@@ -883,7 +920,7 @@ const useRoutes = () => {
               },
             },
           ],
-        },
+        }),
       ],
     },
     {
@@ -892,6 +929,7 @@ const useRoutes = () => {
       component: () => import("@/views/slos/SloList.vue"),
       meta: {
         titleKey: "menu.slos",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -905,6 +943,7 @@ const useRoutes = () => {
       component: () => import("@/views/slos/AddSlo.vue"),
       meta: {
         titleKey: "slos.newTitle",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -916,6 +955,7 @@ const useRoutes = () => {
       component: () => import("@/views/slos/AddSlo.vue"),
       meta: {
         titleKey: "slos.editTitle",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -927,6 +967,7 @@ const useRoutes = () => {
       component: () => import("@/views/slos/SloDetail.vue"),
       meta: {
         titleKey: "routeTitles.sloDetail",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -938,6 +979,7 @@ const useRoutes = () => {
       component: AlertList,
       meta: {
         titleKey: "menu.alerts",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -961,6 +1003,7 @@ const useRoutes = () => {
       component: AlertsDestinationList,
       meta: {
         titleKey: "alert_destinations.header",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -972,6 +1015,7 @@ const useRoutes = () => {
       component: TemplateList,
       meta: {
         titleKey: "alert_templates.header",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -987,6 +1031,7 @@ const useRoutes = () => {
       component: AlertLibrary,
       meta: {
         titleKey: "alert_library.header",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1006,6 +1051,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/ExternalAlertSourcesList.vue"),
       meta: {
         titleKey: "alert_sources.header",
+        licenseFeature: "incidents",
       },
       beforeEnter(to: any, from: any, next: any) {
         const store = (window as any).store;
@@ -1021,21 +1067,21 @@ const useRoutes = () => {
       path: "alert-calibration",
       name: "alertCalibration",
       component: () => import("@/components/alert_calibration/AlertCalibrationDashboard.vue"),
-      meta: { titleKey: "menu.alertCalibration" },
+      meta: { titleKey: "menu.alertCalibration", licenseFeature: "alerts" },
       beforeEnter: alertCalibrationRouteGuard,
     },
     {
       path: "alert-calibration/runs",
       name: "alertCalibrationRuns",
       component: () => import("@/components/alert_calibration/AlertCalibrationDigests.vue"),
-      meta: { titleKey: "menu.alertCalibration" },
+      meta: { titleKey: "menu.alertCalibration", licenseFeature: "alerts" },
       beforeEnter: alertCalibrationRouteGuard,
     },
     {
       path: "alert-calibration/settings",
       name: "alertCalibrationSettings",
       component: () => import("@/components/alert_calibration/AlertCalibrationSettings.vue"),
-      meta: { titleKey: "menu.alertCalibration" },
+      meta: { titleKey: "menu.alertCalibration", licenseFeature: "alerts" },
       beforeEnter: alertCalibrationRouteGuard,
     },
     {
@@ -1043,7 +1089,7 @@ const useRoutes = () => {
       name: "alertCalibrationDigest",
       component: () => import("@/components/alert_calibration/AlertCalibrationDigestDetail.vue"),
       props: true,
-      meta: { titleKey: "menu.alertCalibration" },
+      meta: { titleKey: "menu.alertCalibration", licenseFeature: "alerts" },
       beforeEnter: alertCalibrationRouteGuard,
     },
     {
@@ -1052,6 +1098,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/downtimes/DowntimeList.vue"),
       meta: {
         titleKey: "menu.downtimes",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         downtimesRouteGuard(to, from, next);
@@ -1064,6 +1111,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/downtimes/AddDowntime.vue"),
       meta: {
         titleKey: "alerts.downtimes.newTitle",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         downtimesRouteGuard(to, from, next);
@@ -1075,6 +1123,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/downtimes/AddDowntime.vue"),
       meta: {
         titleKey: "alerts.downtimes.editTitle",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         downtimesRouteGuard(to, from, next);
@@ -1086,6 +1135,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/downtimes/DowntimeDetail.vue"),
       meta: {
         titleKey: "alerts.downtimes.detailTitle",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         downtimesRouteGuard(to, from, next);
@@ -1099,6 +1149,7 @@ const useRoutes = () => {
       component: () => import("@/views/alerts/AlertDetail.vue"),
       meta: {
         titleKey: "routeTitles.alertDetail",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1110,6 +1161,7 @@ const useRoutes = () => {
       component: () => import("@/views/AddAlertView.vue"),
       meta: {
         titleKey: "alerts.addAlertMode",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1126,6 +1178,7 @@ const useRoutes = () => {
       component: () => import("@/views/AddAlertView.vue"),
       meta: {
         titleKey: "routeTitles.editAlert",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1137,6 +1190,7 @@ const useRoutes = () => {
       component: () => import("@/views/AddAlertView.vue"),
       meta: {
         titleKey: "alerts.addAnomalyMode",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         const store = (window as any).store;
@@ -1154,6 +1208,7 @@ const useRoutes = () => {
       component: () => import("@/views/AddAlertView.vue"),
       meta: {
         titleKey: "alerts.editAnomalyMode",
+        licenseFeature: "anomaly_detection",
       },
       beforeEnter(to: any, from: any, next: any) {
         const store = (window as any).store;
@@ -1171,6 +1226,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/AlertHistory.vue"),
       meta: {
         titleKey: "alerts.history",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1182,6 +1238,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/AlertInsights.vue"),
       meta: {
         titleKey: "alerts.insights.title",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1194,6 +1251,7 @@ const useRoutes = () => {
       component: () => import("@/components/alerts/ImportSemanticGroups.vue"),
       meta: {
         titleKey: "correlation.importSemanticGroups.title",
+        licenseFeature: "alerts",
       },
       beforeEnter(to: any, from: any, next: any) {
         const store = (window as any).store;
@@ -1223,7 +1281,7 @@ const useRoutes = () => {
       },
       props: true,
     },
-    {
+    withLicenseFeature("rum", {
       path: "rum",
       name: "RUM",
       component: RealUserMonitoring,
@@ -1353,8 +1411,8 @@ const useRoutes = () => {
           ],
         },
       ],
-    },
-    {
+    }),
+    withLicenseFeature("product_analytics", {
       path: "product-analytics",
       name: PA_ROUTES.shell,
       component: AppAnalytics,
@@ -1422,7 +1480,7 @@ const useRoutes = () => {
           },
         },
       ],
-    },
+    }),
     // Siblings of the shell, not children, so the editor renders without its sub-tab strip.
     {
       path: "product-analytics/events/new",
@@ -1430,6 +1488,7 @@ const useRoutes = () => {
       component: NamedEventEditor,
       meta: {
         titleKey: "rum.analytics.events.createTitle",
+        licenseFeature: "product_analytics",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1442,6 +1501,7 @@ const useRoutes = () => {
       props: true,
       meta: {
         titleKey: "rum.analytics.events.editTitle",
+        licenseFeature: "product_analytics",
       },
       beforeEnter(to: any, from: any, next: any) {
         routeGuard(to, from, next);
@@ -1470,6 +1530,7 @@ const useRoutes = () => {
         props: true,
         meta: {
           titleKey: "menu.report",
+          licenseFeature: "reports",
         },
         beforeEnter(to: any, from: any, next: any) {
           routeGuard(to, from, next);
@@ -1482,6 +1543,7 @@ const useRoutes = () => {
         props: true,
         meta: {
           titleKey: "routeTitles.reportDetail",
+          licenseFeature: "reports",
         },
         beforeEnter(to: any, from: any, next: any) {
           routeGuard(to, from, next);
@@ -1494,6 +1556,7 @@ const useRoutes = () => {
         props: true,
         meta: {
           titleKey: "routeTitles.createReport",
+          licenseFeature: "reports",
         },
         beforeEnter(to: any, from: any, next: any) {
           routeGuard(to, from, next);
diff --git a/web/src/composables/shared/useEnterpriseRoutes.spec.ts b/web/src/composables/shared/useEnterpriseRoutes.spec.ts
index 8fec85f565..1ab3eeb427 100644
--- a/web/src/composables/shared/useEnterpriseRoutes.spec.ts
+++ b/web/src/composables/shared/useEnterpriseRoutes.spec.ts
@@ -676,6 +676,83 @@ describe("useEnterpriseRoutes.ts", () => {
     });
   });
 
+  describe("license-locked features", () => {
+    const find = (routes: any[], name: string): any =>
+      routes.flatMap((r) => [r, ...(r.children ?? [])]).find((r) => r.name === name);
+
+    beforeEach(async () => {
+      const config = await import("@/aws-exports");
+      config.default.isEnterprise = "true";
+    });
+
+    it.each([
+      ["workflows", "workflows"],
+      ["workflowRuns", "workflows"],
+      ["onCallTeams", "oncall"],
+      ["onCallTeamDetail", "oncall"],
+      ["incidentList", "incidents"],
+      ["incidentDetail", "incidents"],
+      ["groups", "rbac"],
+      ["editGroup", "rbac"],
+      ["roles", "rbac"],
+      ["editRole", "rbac"],
+      ["quota", "ratelimit"],
+      ["mcpServer", "mcp"],
+      ["syntheticsTokens", "synthetics"],
+      ["synthetics", "synthetics"],
+      ["synthetics-add", "synthetics"],
+      ["synthetics-edit", "synthetics"],
+      ["synthetics-status-page-edit", "synthetics"],
+      ["synthetic-private-location", "synthetics"],
+      ["synthetic-monitor-results", "synthetics"],
+      ["synthetics-run-detail", "synthetics"],
+    ])("tags %s, child routes included, with meta.licenseFeature %s", (name, feature) => {
+      expect(find(useEnterpriseRoutes(), name).meta.licenseFeature).toBe(feature);
+    });
+
+    it.each(["users", "serviceAccounts", "organizations", "ingestionTokens"])(
+      "leaves %s, which the rbac license does not gate, untagged",
+      (name) => {
+        expect(find(useEnterpriseRoutes(), name).meta?.licenseFeature).toBeUndefined();
+      },
+    );
+
+    it.each([
+      ["workflows", { workflows_enabled: false }],
+      ["onCallTeams", { oncall_enabled: false }],
+      ["incidentList", {}],
+      ["roles", { rbac_enabled: true }],
+      ["synthetics", { synthetics_enabled: false }],
+      ["syntheticsTokens", { synthetics_enabled: false }],
+      [
+        "synthetic-private-location",
+        { synthetics_enabled: false, synthetics_private_locations_enabled: false },
+      ],
+    ])("lets a locked %s through to its own page", async (name, flags) => {
+      const { routeGuard } = await import("@/utils/zincutils");
+      const feature = find(useEnterpriseRoutes(), name).meta.licenseFeature;
+      store.state.zoConfig = { ...flags, features: { [feature]: "locked" } };
+      const next = vi.fn();
+      find(useEnterpriseRoutes(), name).beforeEnter({ query: {} }, {}, next);
+      expect(routeGuard).toHaveBeenCalled();
+      expect(next).toHaveBeenCalledWith();
+    });
+
+    it("still sends a hidden feature whose legacy flag is off home", () => {
+      store.state.zoConfig = { workflows_enabled: false, features: { workflows: "hidden" } };
+      const next = vi.fn();
+      find(useEnterpriseRoutes(), "workflows").beforeEnter({ query: {} }, {}, next);
+      expect(next).toHaveBeenCalledWith("/");
+    });
+
+    it("still sends hidden synthetics whose flag is off home", () => {
+      store.state.zoConfig = { synthetics_enabled: false, features: { synthetics: "hidden" } };
+      const next = vi.fn();
+      find(useEnterpriseRoutes(), "synthetics").beforeEnter({ query: {} }, {}, next);
+      expect(next).toHaveBeenCalledWith("/");
+    });
+  });
+
   describe("Route Structure Validation", () => {
     // Test 50: Should have valid route structure for all basic routes
     it("should have valid route structure for all basic routes", () => {
diff --git a/web/src/composables/shared/useEnterpriseRoutes.ts b/web/src/composables/shared/useEnterpriseRoutes.ts
index bc34fd5329..96cf86f87c 100644
--- a/web/src/composables/shared/useEnterpriseRoutes.ts
+++ b/web/src/composables/shared/useEnterpriseRoutes.ts
@@ -15,6 +15,7 @@
 
 import config from "@/aws-exports";
 import { routeGuard } from "@/utils/zincutils";
+import { featureState, withLicenseFeature } from "@/utils/featureGate";
 import store from "@/stores";
 import {
   withFeatureGate as withFeatureGateBase,
@@ -31,11 +32,15 @@ const withFeatureGate: typeof withFeatureGateBase = (key, guard, getContext) =>
     getContext ?? (() => buildFeatureGateContext(store.state.zoConfig)),
   );
 
+// A locked license also turns the feature's legacy flag off, yet its page still renders, locked.
+const isLicenseLocked = (feature: string): boolean =>
+  featureState(store.state.zoConfig?.features, feature) === "locked";
+
 // Synthetics routes are gated on the backend /config flag `synthetics_enabled`
 // (`ZO_SYNTHETICS_ENABLED`), not on the build: synthetics ships in OSS. Direct URL
 // access redirects home when off.
 const syntheticsRouteGuard = (to: any, from: any, next: any) => {
-  if (store.state.zoConfig?.synthetics_enabled === false) {
+  if (store.state.zoConfig?.synthetics_enabled === false && !isLicenseLocked("synthetics")) {
     next("/");
     return;
   }
@@ -48,7 +53,10 @@ const syntheticsRouteGuard = (to: any, from: any, next: any) => {
 // without await, so redirecting on "not yet known" would bounce a bookmarked
 // link on a cold load.
 const privateLocationRouteGuard = (to: any, from: any, next: any) => {
-  if (store.state.zoConfig?.synthetics_private_locations_enabled === false) {
+  if (
+    store.state.zoConfig?.synthetics_private_locations_enabled === false &&
+    !isLicenseLocked("synthetics")
+  ) {
     next("/");
     return;
   }
@@ -66,7 +74,7 @@ const privateLocationRouteGuard = (to: any, from: any, next: any) => {
 // never flashes in) — the two are not meant to match. Same split as
 // syntheticsRouteGuard above.
 const workflowsRouteGuard = (to: any, from: any, next: any) => {
-  if (store.state.zoConfig?.workflows_enabled === false) {
+  if (!isLicenseLocked("workflows") && store.state.zoConfig?.workflows_enabled === false) {
     next("/");
     return;
   }
@@ -148,6 +156,7 @@ const useEnterpriseRoutes = () => {
           name: "syntheticsTokens",
           meta: {
             titleKey: "iam.syntheticsTokens",
+            licenseFeature: "synthetics",
           },
           component: () => import("@/components/iam/SyntheticsTokens.vue"),
           beforeEnter(to: any, from: any, next: any) {
@@ -196,7 +205,7 @@ const useEnterpriseRoutes = () => {
         {
           path: "mcpServer",
           name: "mcpServer",
-          meta: { titleKey: "iam.mcpServerLabel" },
+          meta: { titleKey: "iam.mcpServerLabel", licenseFeature: "mcp" },
           component: () => import("@/components/iam/McpServer.vue"),
           beforeEnter(to: any, from: any, next: any) {
             routeGuard(to, from, next);
@@ -216,17 +225,16 @@ const useEnterpriseRoutes = () => {
   // `?section=status-pages`), so it needs no route of its own — it ships
   // with synthetics, no separate toggle. Notices/Custom Domains within it
   // are Enterprise-only, gated in-view on `build_type` instead.
-  routes.push({
-    path: "synthetics",
-    name: "synthetics",
-    component: () => import("@/views/SyntheticMonitoring.vue"),
-    meta: { titleKey: "menu.synthetic", allowOnEmptyData: true },
-    beforeEnter(to: any, from: any, next: any) {
-      syntheticsRouteGuard(to, from, next);
+  const syntheticsRoutes = [
+    {
+      path: "synthetics",
+      name: "synthetics",
+      component: () => import("@/views/SyntheticMonitoring.vue"),
+      meta: { titleKey: "menu.synthetic", allowOnEmptyData: true },
+      beforeEnter(to: any, from: any, next: any) {
+        syntheticsRouteGuard(to, from, next);
+      },
     },
-  });
-
-  routes.push(
     {
       path: "synthetics/add",
       name: "synthetics-add",
@@ -281,7 +289,8 @@ const useEnterpriseRoutes = () => {
         syntheticsRouteGuard(to, from, next);
       },
     },
-  );
+  ];
+  routes.push(...syntheticsRoutes.map((route) => withLicenseFeature("synthetics", route)));
 
   //the below are the routes that we support for enterprise and cloud
   //the above are the routes that we support for oss including both enterprise and cloud
@@ -291,7 +300,7 @@ const useEnterpriseRoutes = () => {
   // `withFeatureGate`) when the edition doesn't unlock them, instead of
   // landing on the real page or a 404.
   // On-call is configured before any data flows, so every route here stays open on an empty org.
-  routes.push(
+  const oncallRoutes = [
     {
       path: "oncall/responses",
       name: "onCallResponses",
@@ -359,10 +368,11 @@ const useEnterpriseRoutes = () => {
       meta: { titleKey: "oncall.routingTitle", allowOnEmptyData: true },
       beforeEnter: withFeatureGate("oncall", oncallRouteGuard),
     },
-  );
+  ];
+  routes.push(...oncallRoutes.map((route) => withLicenseFeature("oncall", route)));
 
   routes.push(
-    {
+    withLicenseFeature("incidents", {
       path: "incidents",
       name: "incidentList",
       component: IncidentList,
@@ -370,8 +380,8 @@ const useEnterpriseRoutes = () => {
         titleKey: "menu.incidents",
       },
       beforeEnter: withFeatureGate("incidents", routeGuard),
-    },
-    {
+    }),
+    withLicenseFeature("incidents", {
       path: "incidents/:id",
       name: "incidentDetail",
       component: () => import("@/components/alerts/IncidentDetailDrawer.vue"),
@@ -379,7 +389,7 @@ const useEnterpriseRoutes = () => {
         titleKey: "routeTitles.incidentDetail",
       },
       beforeEnter: withFeatureGate("incidents", routeGuard),
-    },
+    }),
   );
 
   if (config.isEnterprise == "true") {
@@ -421,41 +431,43 @@ const useEnterpriseRoutes = () => {
 
   // Workflows — enterprise/cloud only (FD3). List is the parent; the editor
   // renders in its <router-view> for add/edit.
-  routes.push({
-    path: "workflows",
-    name: "workflows",
-    component: WorkflowsList,
-    meta: {
-      titleKey: "menu.workflows",
-    },
-    beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
-    children: [
-      {
-        path: "add",
-        name: "createWorkflow",
-        component: WorkflowEditor,
-        meta: { titleKey: "workflow.create" },
-        beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
+  routes.push(
+    withLicenseFeature("workflows", {
+      path: "workflows",
+      name: "workflows",
+      component: WorkflowsList,
+      meta: {
+        titleKey: "menu.workflows",
       },
-      {
-        path: "edit",
-        name: "workflowEditor",
-        component: WorkflowEditor,
-        meta: { titleKey: "workflow.editMode", accessScopeQuery: ["id"] },
-        beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
-      },
-      {
-        // Dedicated READ-ONLY run-inspection surface (master-detail). Separate
-        // from the editor so viewing a past run never drops the user into the
-        // builder; deep-linkable by ?run_id.
-        path: "runs",
-        name: "workflowRuns",
-        component: WorkflowRuns,
-        meta: { titleKey: "workflow.runs.title", accessScopeQuery: ["id"] },
-        beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
-      },
-    ],
-  });
+      beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
+      children: [
+        {
+          path: "add",
+          name: "createWorkflow",
+          component: WorkflowEditor,
+          meta: { titleKey: "workflow.create" },
+          beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
+        },
+        {
+          path: "edit",
+          name: "workflowEditor",
+          component: WorkflowEditor,
+          meta: { titleKey: "workflow.editMode", accessScopeQuery: ["id"] },
+          beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
+        },
+        {
+          // Dedicated READ-ONLY run-inspection surface (master-detail). Separate
+          // from the editor so viewing a past run never drops the user into the
+          // builder; deep-linkable by ?run_id.
+          path: "runs",
+          name: "workflowRuns",
+          component: WorkflowRuns,
+          meta: { titleKey: "workflow.runs.title", accessScopeQuery: ["id"] },
+          beforeEnter: withFeatureGate("workflows", workflowsRouteGuard),
+        },
+      ],
+    }),
+  );
   routes[0].children.push(
     ...[
       {
@@ -494,13 +506,13 @@ const useEnterpriseRoutes = () => {
         component: EditRole,
         beforeEnter: withFeatureGate("rbac", routeGuard),
       },
-      {
-        path: "quota",
-        name: "quota",
-        component: Quota,
-        beforeEnter: withFeatureGate("rbac", routeGuard),
-      },
-    ],
+    ].map((route) => withLicenseFeature("rbac", route)),
+    withLicenseFeature("ratelimit", {
+      path: "quota",
+      name: "quota",
+      component: Quota,
+      beforeEnter: withFeatureGate("rbac", routeGuard),
+    }),
   );
 
   if (config.isCloud == "true") {
diff --git a/web/src/composables/shared/useIngestionRoutes.spec.ts b/web/src/composables/shared/useIngestionRoutes.spec.ts
index 07b3bccf2c..5f576d40db 100644
--- a/web/src/composables/shared/useIngestionRoutes.spec.ts
+++ b/web/src/composables/shared/useIngestionRoutes.spec.ts
@@ -169,6 +169,33 @@ describe("useIngestionRoutes", () => {
     });
   });
 
+  describe("license feature tags", () => {
+    const find = (routes: any[], name: string): any => {
+      for (const route of routes) {
+        if (route.name === name) return route;
+        const found = route.children && find(route.children, name);
+        if (found) return found;
+      }
+      return undefined;
+    };
+
+    it.each([
+      ["ingestProfiles", "continuous_profiling"],
+      ["profilesOtelCollector", "continuous_profiling"],
+      ["frontendMonitoring", "rum"],
+      ["recommendedMcp", "mcp"],
+    ])("tags %s with meta.licenseFeature %s", (name, feature) => {
+      expect(find(useIngestionRoutes(), name).meta.licenseFeature).toBe(feature);
+    });
+
+    it.each(["ingestFromKubernetes", "ingestFromLinux", "ingestTraces", "recommended"])(
+      "leaves %s untagged",
+      (name) => {
+        expect(find(useIngestionRoutes(), name).meta?.licenseFeature).toBeUndefined();
+      },
+    );
+  });
+
   describe("custom routes configuration", () => {
     it("should have proper custom route configuration", () => {
       const routes = useIngestionRoutes();
diff --git a/web/src/composables/shared/useIngestionRoutes.ts b/web/src/composables/shared/useIngestionRoutes.ts
index e9851da295..29068b7224 100644
--- a/web/src/composables/shared/useIngestionRoutes.ts
+++ b/web/src/composables/shared/useIngestionRoutes.ts
@@ -15,6 +15,7 @@
 
 import config from "@/aws-exports";
 import { routeGuard } from "@/utils/zincutils";
+import { withLicenseFeature } from "@/utils/featureGate";
 
 import { aiCategories } from "@/components/ingestion/ai/data";
 
@@ -325,7 +326,7 @@ const useIngestionRoutes = () => {
                 },
               ],
             },
-            {
+            withLicenseFeature("continuous_profiling", {
               path: "profiles",
               name: "ingestProfiles",
               component: IngestProfiles,
@@ -342,7 +343,7 @@ const useIngestionRoutes = () => {
                   },
                 },
               ],
-            },
+            }),
             {
               path: "traces",
               name: "ingestTraces",
@@ -451,25 +452,25 @@ const useIngestionRoutes = () => {
                 routeGuard(to, from, next);
               },
             },
-            {
+            withLicenseFeature("rum", {
               path: "frontend-monitoring",
               name: "frontendMonitoring",
               component: RUMWeb,
               beforeEnter(to: any, from: any, next: any) {
                 routeGuard(to, from, next);
               },
-            },
+            }),
             // Discoverability pointer → the MCP setup home in IAM. Registered on
             // every edition, matching both the tab in Recommended.vue and the
             // target "mcpServer" route, which are no longer build-gated.
-            {
+            withLicenseFeature("mcp", {
               path: "mcp",
               name: "recommendedMcp",
               component: McpCrossLink,
               beforeEnter(to: any, from: any, next: any) {
                 routeGuard(to, from, next);
               },
-            },
+            }),
           ],
         },
         {
diff --git a/web/src/composables/shared/useManagementRoutes.spec.ts b/web/src/composables/shared/useManagementRoutes.spec.ts
index b2e5babcef..61de617a5e 100644
--- a/web/src/composables/shared/useManagementRoutes.spec.ts
+++ b/web/src/composables/shared/useManagementRoutes.spec.ts
@@ -229,6 +229,28 @@ describe("useManagementRoutes", () => {
       });
     });
 
+    it.each([
+      ["modelPricing", "ai_observability"],
+      ["modelPricingEditor", "ai_observability"],
+      ["llmProviders", "ai_observability"],
+      ["genAiAgentMapping", "ai_observability"],
+      ["aiToolsets", "ai_toolsets"],
+      ["query_management", "query_management"],
+      ["storageSettings", "byob"],
+      ["syntheticsLocations", "synthetics"],
+    ])("tags %s with license feature %s", (name, key) => {
+      const route = routes[0].children.find((child: any) => child.name === name);
+      expect(route.meta.licenseFeature).toBe(key);
+    });
+
+    it.each(["pipelineDestinations", "correlationSettings", "nodes"])(
+      "leaves %s untagged",
+      (name) => {
+        const route = routes[0].children.find((child: any) => child.name === name);
+        expect(route.meta?.licenseFeature).toBeUndefined();
+      },
+    );
+
     it("AC-1.10 registers slack in OSS builds and sends it to General, never the locked page", () => {
       const slackRoute = routes[0].children.find((child: any) => child.name === "slack");
       expect(slackRoute).toBeDefined();
@@ -425,6 +447,7 @@ describe("useManagementRoutes", () => {
       expect(queryMgmtRoute.meta).toEqual({
         keepAlive: true,
         titleKey: "settings.queryManagement",
+        licenseFeature: "query_management",
       });
     });
 
@@ -487,6 +510,7 @@ describe("useManagementRoutes", () => {
         keepAlive: true,
         titleKey: "routeTitles.syntheticsLocations",
         allowOnEmptyData: true,
+        licenseFeature: "synthetics",
       });
     });
 
@@ -841,7 +865,7 @@ describe("useManagementRoutes", () => {
       const names = children().map((child: any) => child.name);
       expect(names.indexOf("telephonySettings")).toBe(names.indexOf("pipelineDestinations") + 1);
       expect(findRoute().path).toBe("telephony");
-      expect(findRoute().meta).toEqual({ titleKey: "telephony.title" });
+      expect(findRoute().meta).toEqual({ titleKey: "telephony.title", licenseFeature: "oncall" });
       expect(typeof findRoute().component).toBe("function");
     });
 
diff --git a/web/src/composables/shared/useManagementRoutes.ts b/web/src/composables/shared/useManagementRoutes.ts
index f09d8b92b7..ac86d893d9 100644
--- a/web/src/composables/shared/useManagementRoutes.ts
+++ b/web/src/composables/shared/useManagementRoutes.ts
@@ -1,6 +1,7 @@
 import config from "@/aws-exports";
 import { routeGuard } from "@/utils/zincutils";
 import { withFeatureGate } from "@/utils/enterpriseFeatures";
+import { withLicenseFeature } from "@/utils/featureGate";
 import { oncallRouteGuard } from "./oncallRouteGuard";
 import { slackRouteGuard } from "./slackRouteGuard";
 
@@ -108,6 +109,7 @@ const useManagementRoutes = () => {
       keepAlive: true,
       titleKey: "routeTitles.syntheticsLocations",
       allowOnEmptyData: true,
+      licenseFeature: "synthetics",
     },
     beforeEnter(to: any, from: any, next: any) {
       routeGuard(to, from, next);
@@ -119,57 +121,67 @@ const useManagementRoutes = () => {
   // security pages below are all always registered; a direct URL redirects
   // to the shared locked page (see `withFeatureGate`) when the edition
   // doesn't unlock them, instead of landing on the real page or a 404.
-  routes[0].children.push({
-    path: "model_pricing",
-    name: "modelPricing",
-    meta: {
-      keepAlive: true,
-      titleKey: "settings.llmModelPricing",
-    },
-    component: () => import("@/components/settings/ModelPricingList.vue"),
-    beforeEnter: withFeatureGate("modelPricing", routeGuard),
-  });
-  routes[0].children.push({
-    path: "model_pricing/gaps",
-    name: "modelPricingGaps",
-    meta: {
-      keepAlive: true,
-      titleKey: "modelPricing.unpriced.title",
-    },
-    component: () => import("@/components/settings/ModelPricingGaps.vue"),
-    beforeEnter: withFeatureGate("modelPricing", routeGuard),
-  });
-  routes[0].children.push({
-    path: "model_pricing/edit",
-    name: "modelPricingEditor",
-    meta: {
-      titleKey: "routeTitles.modelPricingEditor",
-      accessScopeQuery: ["id"],
-    },
-    component: () => import("@/components/settings/ModelPricingEditor.vue"),
-    beforeEnter: withFeatureGate("modelPricing", routeGuard),
-  });
-  routes[0].children.push({
-    path: "llm_providers",
-    name: "llmProviders",
-    component: () => import("@/components/settings/LlmProvidersSettings.vue"),
-    // `/providers` is unregistered when the server reports `online_evals_enabled: false`.
-    meta: {
-      titleKey: "llmProviders.title",
-      requiresOnlineEvals: true,
-    },
-    beforeEnter: withFeatureGate("llmProviders", routeGuard),
-  });
-  routes[0].children.push({
-    path: "gen_ai_agent_mapping",
-    name: "genAiAgentMapping",
-    component: () => import("@/components/settings/GenAiAgentMappingSettings.vue"),
-    meta: {
-      keepAlive: true,
-      titleKey: "settings.genAiAgentMapping.title",
-    },
-    beforeEnter: withFeatureGate("genAiAgentMapping", routeGuard),
-  });
+  routes[0].children.push(
+    withLicenseFeature("ai_observability", {
+      path: "model_pricing",
+      name: "modelPricing",
+      meta: {
+        keepAlive: true,
+        titleKey: "settings.llmModelPricing",
+      },
+      component: () => import("@/components/settings/ModelPricingList.vue"),
+      beforeEnter: withFeatureGate("modelPricing", routeGuard),
+    }),
+  );
+  routes[0].children.push(
+    withLicenseFeature("ai_observability", {
+      path: "model_pricing/gaps",
+      name: "modelPricingGaps",
+      meta: {
+        keepAlive: true,
+        titleKey: "modelPricing.unpriced.title",
+      },
+      component: () => import("@/components/settings/ModelPricingGaps.vue"),
+      beforeEnter: withFeatureGate("modelPricing", routeGuard),
+    }),
+  );
+  routes[0].children.push(
+    withLicenseFeature("ai_observability", {
+      path: "model_pricing/edit",
+      name: "modelPricingEditor",
+      meta: {
+        titleKey: "routeTitles.modelPricingEditor",
+        accessScopeQuery: ["id"],
+      },
+      component: () => import("@/components/settings/ModelPricingEditor.vue"),
+      beforeEnter: withFeatureGate("modelPricing", routeGuard),
+    }),
+  );
+  routes[0].children.push(
+    withLicenseFeature("ai_observability", {
+      path: "llm_providers",
+      name: "llmProviders",
+      component: () => import("@/components/settings/LlmProvidersSettings.vue"),
+      // `/providers` is unregistered when the server reports `online_evals_enabled: false`.
+      meta: {
+        titleKey: "llmProviders.title",
+        requiresOnlineEvals: true,
+      },
+      beforeEnter: withFeatureGate("llmProviders", routeGuard),
+    }),
+  );
+  routes[0].children.push(
+    withLicenseFeature("ai_observability", {
+      path: "gen_ai_agent_mapping",
+      name: "genAiAgentMapping",
+      component: () => import("@/components/settings/GenAiAgentMappingSettings.vue"),
+      meta: {
+        keepAlive: true,
+        titleKey: "settings.genAiAgentMapping.title",
+      },
+      beforeEnter: withFeatureGate("genAiAgentMapping", routeGuard),
+    }),
+  );
   // Registered in every build; slackRouteGuard and the rail both hide it unless the org config turns Slack on.
   routes[0].children.push({
     path: "slack",
@@ -201,6 +213,7 @@ const useManagementRoutes = () => {
           meta: {
             keepAlive: true,
             titleKey: "settings.queryManagement",
+            licenseFeature: "query_management",
           },
           beforeEnter: withFeatureGate("queryManagement", routeGuard),
         },
@@ -214,7 +227,7 @@ const useManagementRoutes = () => {
           },
           beforeEnter: withFeatureGate("cipherKeys", routeGuard),
         },
-        {
+        withLicenseFeature("ai_toolsets", {
           path: "ai_toolsets",
           name: "aiToolsets",
           component: () => import("@/components/settings/AiToolsets.vue"),
@@ -223,7 +236,7 @@ const useManagementRoutes = () => {
             titleKey: "aiToolset.header",
           },
           beforeEnter: withFeatureGate("aiToolsets", routeGuard),
-        },
+        }),
         {
           path: "pipeline_destinations",
           name: "pipelineDestinations",
@@ -234,7 +247,7 @@ const useManagementRoutes = () => {
           beforeEnter: withFeatureGate("pipelineDestinations", routeGuard),
         },
         // Its API is mounted with on-call's, so the page exists only where on-call is on.
-        {
+        withLicenseFeature("oncall", {
           path: "telephony",
           name: "telephonySettings",
           meta: {
@@ -242,13 +255,14 @@ const useManagementRoutes = () => {
           },
           component: () => import("@/components/settings/TelephonySettings.vue"),
           beforeEnter: withFeatureGate("oncall", oncallRouteGuard),
-        },
+        }),
         {
           path: "storage_settings",
           name: "storageSettings",
           component: () => import("@/components/settings/OrgStorageSettings.vue"),
           meta: {
             titleKey: "routeTitles.storageSettings",
+            licenseFeature: "byob",
           },
           beforeEnter: withFeatureGate("storageSettings", routeGuard),
         },
diff --git a/web/src/composables/useCorrelationDefaultSlug.spec.ts b/web/src/composables/useCorrelationDefaultSlug.spec.ts
index cec843530f..d85b528818 100644
--- a/web/src/composables/useCorrelationDefaultSlug.spec.ts
+++ b/web/src/composables/useCorrelationDefaultSlug.spec.ts
@@ -40,6 +40,9 @@ vi.mock("@/aws-exports", () => ({
   default: { isEnterprise: "true", isCloud: "false" },
 }));
 
+const mockStoreState = vi.hoisted(() => ({ zoConfig: {} as Record<string, unknown> }));
+vi.mock("vuex", () => ({ useStore: () => ({ state: mockStoreState }) }));
+
 import { loadIdentityConfig } from "@/utils/identityConfig";
 import {
   clearSemanticGroupsCache,
@@ -540,6 +543,18 @@ describe("useCorrelationFilters", () => {
       expect(loadCorrelationFilters("org1", "logs", "mystream")).toEqual([]);
     });
 
+    it("skips the identity config when correlation is license-locked", async () => {
+      mockStoreState.zoConfig = { features: { correlation: "locked" } };
+      try {
+        const opts = makeOpts({ getQuery: () => "host = 'web-01'" });
+        await useCorrelationFilters(opts).save();
+        expect(loadIdentityConfig).not.toHaveBeenCalled();
+        expect(serviceStreamsApi.getSemanticGroups).not.toHaveBeenCalled();
+      } finally {
+        mockStoreState.zoConfig = {};
+      }
+    });
+
     it("saves matched filters from query", async () => {
       vi.mocked(loadIdentityConfig).mockResolvedValueOnce({ tracked_alias_ids: ["host"] });
       vi.mocked(serviceStreamsApi.getSemanticGroups).mockResolvedValueOnce({ data: [] });
diff --git a/web/src/composables/useCorrelationDefaultSlug.ts b/web/src/composables/useCorrelationDefaultSlug.ts
index 271b59993c..e5007165ff 100644
--- a/web/src/composables/useCorrelationDefaultSlug.ts
+++ b/web/src/composables/useCorrelationDefaultSlug.ts
@@ -244,6 +244,8 @@ export function clearCorrelationCache(): void {
 // ── Generic composable ────────────────────────────────────────────────────────
 
 import { watch, type WatchSource } from "vue";
+import { useStore } from "vuex";
+import { featureState } from "@/utils/featureGate";
 
 export interface CorrelationFiltersOptions {
   orgId: () => string;
@@ -257,6 +259,7 @@ export interface CorrelationFiltersOptions {
 }
 
 export function useCorrelationFilters(opts: CorrelationFiltersOptions) {
+  const store = useStore();
   // Tracks which (org, streamType, streamName) keys we've already attempted to
   // restore for in this session. Without this, every extractFields() call
   // (which happens after every query) would re-apply saved filters whenever
@@ -276,6 +279,8 @@ export function useCorrelationFilters(opts: CorrelationFiltersOptions) {
         return;
       }
 
+      // The identity config endpoint is tagged correlation; a locked license would 403 it.
+      if (featureState(store?.state.zoConfig?.features, "correlation") === "locked") return;
       const trackedFields = await getCorrelationFieldNames(
         orgId,
         streamType,
diff --git a/web/src/composables/useFeatureLock.spec.ts b/web/src/composables/useFeatureLock.spec.ts
new file mode 100644
index 0000000000..d84854ed76
--- /dev/null
+++ b/web/src/composables/useFeatureLock.spec.ts
@@ -0,0 +1,318 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { mount, type VueWrapper } from "@vue/test-utils";
+import { defineComponent, h, nextTick, ref, type Ref } from "vue";
+import { createMemoryHistory, createRouter } from "vue-router";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import {
+  isPageLocked,
+  markLicenseDenial,
+  provideFeatureLock,
+  useFeatureLock,
+  useLicenseLock,
+  useLicenseLocks,
+  useLockedDisabled,
+  type FeatureLock,
+} from "./useFeatureLock";
+import FeatureLockBoundary from "@/components/common/FeatureLockBoundary.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
+import { toast, toastRecords, dismissAll } from "@/lib/feedback/Toast/useToast";
+import { addLicenseDeniedError, clearLicenseDenials } from "@/composables/useLicenseDenials";
+
+let wrapper: VueWrapper | undefined;
+
+const mountWithLock = (feature: Ref<string | null> | null) => {
+  let seen: FeatureLock | undefined;
+  let disabled: Ref<boolean> | undefined;
+  const Child = defineComponent({
+    setup() {
+      seen = useFeatureLock();
+      disabled = useLockedDisabled(() => false);
+      return () => null;
+    },
+  });
+  const Parent = defineComponent({
+    setup() {
+      if (feature) provideFeatureLock(feature);
+      return () => h(Child);
+    },
+  });
+  wrapper = mount(Parent);
+  return { lock: () => seen!, disabled: () => disabled!.value };
+};
+
+afterEach(() => {
+  wrapper?.unmount();
+  wrapper = undefined;
+  dismissAll();
+  clearLicenseDenials();
+});
+
+describe("useFeatureLock", () => {
+  it("is unlocked with no provider above", () => {
+    const { lock, disabled } = mountWithLock(null);
+    expect(lock().locked.value).toBe(false);
+    expect(lock().feature.value).toBeNull();
+    expect(disabled()).toBe(false);
+    expect(isPageLocked()).toBe(false);
+  });
+
+  it("locks descendants while the provider names a feature, and follows it", async () => {
+    const feature = ref<string | null>("workflows");
+    const { lock, disabled } = mountWithLock(feature);
+    expect(lock().locked.value).toBe(true);
+    expect(lock().feature.value).toBe("workflows");
+    expect(disabled()).toBe(true);
+    expect(isPageLocked()).toBe(true);
+
+    feature.value = null;
+    await nextTick();
+    expect(lock().locked.value).toBe(false);
+    expect(disabled()).toBe(false);
+    expect(isPageLocked()).toBe(false);
+  });
+
+  it("releases the page lock when the provider unmounts", () => {
+    mountWithLock(ref("oncall"));
+    expect(isPageLocked()).toBe(true);
+    wrapper!.unmount();
+    wrapper = undefined;
+    expect(isPageLocked()).toBe(false);
+  });
+
+  it("ignores every denial while the page is locked, and warns once it is free", () => {
+    const feature = ref<string | null>("workflows");
+    mountWithLock(feature);
+    addLicenseDeniedError(["workflows"]);
+    addLicenseDeniedError(["alerts"]);
+    addLicenseDeniedError([]);
+    expect(toastRecords).toHaveLength(0);
+
+    feature.value = null;
+    addLicenseDeniedError(["workflows"]);
+    expect(toastRecords.map((r) => r.variant)).toEqual(["warning"]);
+
+    // One notice per distinct feature set per page.
+    addLicenseDeniedError(["workflows"]);
+    expect(toastRecords).toHaveLength(1);
+  });
+
+  it("drops error toasts just after a denial, then only those repeating its message", () => {
+    // Fake time far in the past, so the marked denial cannot reach later tests run on real time.
+    vi.useFakeTimers({ now: 0 });
+    markLicenseDenial({ response: { data: { message: "Workflows is not licensed" } } });
+    toast({ variant: "error", message: "Request failed with status code 403" as never });
+    toast({ variant: "success", message: "Saved" as never });
+    toast({ variant: "info", message: "Heads up" as never });
+    expect(toastRecords.map((r) => r.message)).toEqual(["Saved", "Heads up"]);
+
+    vi.advanceTimersByTime(2000);
+    toast({ variant: "error", message: "Workflows is not licensed" as never });
+    toast({ variant: "error", message: "Something else failed" as never });
+    expect(toastRecords.map((r) => r.message)).toEqual([
+      "Saved",
+      "Heads up",
+      "Something else failed",
+    ]);
+    vi.useRealTimers();
+  });
+
+  it("shows an error toast on a locked page when no denial preceded it", () => {
+    mountWithLock(ref("workflows"));
+    toast({ variant: "error", message: "A new version is available, refresh" as never });
+    expect(toastRecords.map((r) => r.message)).toEqual(["A new version is available, refresh"]);
+  });
+});
+
+describe("OPageHeader on a locked page", () => {
+  it("puts a labelled lock right after the title text", async () => {
+    const router = createRouter({
+      history: createMemoryHistory(),
+      routes: [{ path: "/", component: { template: "<div />" } }],
+    });
+    await router.push("/");
+    const Locked = defineComponent({
+      setup() {
+        provideFeatureLock(ref("alerts"));
+        return () => h(OPageHeader, { title: "Downtimes", subtitle: "Muted alerts" } as never);
+      },
+    });
+    wrapper = mount(Locked, { global: { plugins: [i18n, router] } });
+    const lock = wrapper.get('[data-test="app-page-header-locked"]');
+    expect(lock.attributes("aria-label")).toBe("Locked: needs alerts");
+    expect(lock.element.previousElementSibling?.tagName).toBe("H1");
+  });
+});
+
+describe("FeatureLockBoundary", () => {
+  const mountBoundary = (feature: string | null, onClick: () => void) => {
+    wrapper = mount(FeatureLockBoundary, {
+      props: { feature },
+      slots: { default: () => h("button", { "data-test": "raw", onClick }, "Go") },
+    });
+    return wrapper;
+  };
+
+  it("swallows clicks on controls that are not O2 primitives while locked", async () => {
+    let clicks = 0;
+    const boundary = mountBoundary("workflows", () => clicks++);
+    expect(boundary.classes()).toContain("feature-locked-content");
+    await boundary.get('[data-test="raw"]').trigger("click");
+    expect(clicks).toBe(0);
+  });
+
+  it("blocks drops but lets pointerdown, right-click and read-only keys through", () => {
+    const boundary = mountBoundary("workflows", () => {});
+    const raw = boundary.get('[data-test="raw"]').element;
+    const fire = (event: Event) => {
+      raw.dispatchEvent(event);
+      return event.defaultPrevented;
+    };
+    const key = (init: KeyboardEventInit, target: Element = raw) => {
+      const event = new KeyboardEvent("keydown", { bubbles: true, cancelable: true, ...init });
+      target.dispatchEvent(event);
+      return event.defaultPrevented;
+    };
+    expect(fire(new Event("drop", { bubbles: true, cancelable: true }))).toBe(true);
+    expect(fire(new Event("dragover", { bubbles: true, cancelable: true }))).toBe(true);
+    expect(fire(new MouseEvent("contextmenu", { bubbles: true, cancelable: true }))).toBe(false);
+    let reached = false;
+    raw.addEventListener("pointerdown", () => (reached = true));
+    raw.dispatchEvent(new Event("pointerdown", { bubbles: true }));
+    expect(reached).toBe(true);
+    expect(key({ key: "Enter" })).toBe(true);
+    expect(key({ key: "c", ctrlKey: true })).toBe(false);
+    expect(key({ key: "s", metaKey: true })).toBe(true);
+    expect(key({ key: " " }, boundary.element)).toBe(false);
+    expect(key({ key: " " })).toBe(true);
+  });
+
+  it("leaves navigation inside FeatureLockExempt live while the page stays locked", async () => {
+    let clicks = 0;
+    let seen: FeatureLock | undefined;
+    const Probe = defineComponent({
+      setup() {
+        seen = useFeatureLock();
+        return () => h("button", { "data-test": "nav", onClick: () => clicks++ }, "Users");
+      },
+    });
+    wrapper = mount(FeatureLockBoundary, {
+      props: { feature: "rbac" },
+      slots: { default: () => h(FeatureLockExempt, () => h(Probe)) },
+    });
+    expect(seen!.locked.value).toBe(false);
+    await wrapper.get('[data-test="nav"]').trigger("click");
+    const enter = new KeyboardEvent("keydown", { key: "Enter", bubbles: true, cancelable: true });
+    wrapper.get('[data-test="nav"]').element.dispatchEvent(enter);
+    expect(clicks).toBe(1);
+    expect(enter.defaultPrevented).toBe(false);
+    expect(isPageLocked()).toBe(true);
+  });
+
+  it("is a plain wrapper when nothing is locked", async () => {
+    let clicks = 0;
+    const boundary = mountBoundary(null, () => clicks++);
+    expect(boundary.classes()).not.toContain("feature-locked-content");
+    await boundary.get('[data-test="raw"]').trigger("click");
+    expect(clicks).toBe(1);
+  });
+});
+
+describe("useLicenseLock", () => {
+  const licenseLockOf = (key: string, zoConfig: Record<string, unknown>) => {
+    let result: ReturnType<typeof useLicenseLock> | undefined;
+    const Probe = defineComponent({
+      setup() {
+        result = useLicenseLock(key);
+        return () => null;
+      },
+    });
+    const store = createStore({ state: () => ({ zoConfig }) });
+    wrapper = mount(Probe, { global: { plugins: [i18n, store] } });
+    return result!;
+  };
+
+  it("is locked when the license marks the feature locked, with the display name in the reason", () => {
+    const { locked, lockedReason } = licenseLockOf("dashboards", {
+      features: { dashboards: "locked" },
+      feature_names: { dashboards: "Dashboards Pro" },
+    });
+    expect(locked.value).toBe(true);
+    expect(lockedReason.value).toContain("Dashboards Pro");
+  });
+
+  it("falls back to the key in the reason when the display name is missing", () => {
+    const { lockedReason } = licenseLockOf("reports", { features: { reports: "locked" } });
+    expect(lockedReason.value).toContain("reports");
+  });
+
+  it("is not locked when the feature is enabled", () => {
+    const { locked } = licenseLockOf("dashboards", { features: { dashboards: "enabled" } });
+    expect(locked.value).toBe(false);
+  });
+
+  it("is not locked when the feature is hidden: hiding is the caller's own state", () => {
+    const { locked } = licenseLockOf("dashboards", { features: { dashboards: "hidden" } });
+    expect(locked.value).toBe(false);
+  });
+
+  it("is not locked when the backend sends no key for the feature", () => {
+    expect(licenseLockOf("dashboards", { features: {} }).locked.value).toBe(false);
+    wrapper?.unmount();
+    expect(licenseLockOf("dashboards", {}).locked.value).toBe(false);
+  });
+});
+
+describe("useLicenseLocks", () => {
+  const licenseLocksOf = (zoConfig: Record<string, unknown>) => {
+    let result: ReturnType<typeof useLicenseLocks> | undefined;
+    const Probe = defineComponent({
+      setup() {
+        result = useLicenseLocks();
+        return () => null;
+      },
+    });
+    const store = createStore({ state: () => ({ zoConfig }) });
+    wrapper = mount(Probe, { global: { plugins: [i18n, store] } });
+    return result!;
+  };
+
+  it("locks only the runtime keys the license marks locked", () => {
+    const { isLocked } = licenseLocksOf({
+      features: { logs: "locked", metrics: "enabled", traces: "hidden" },
+    });
+    expect(isLocked("logs")).toBe(true);
+    expect(isLocked("metrics")).toBe(false);
+    expect(isLocked("traces")).toBe(false);
+  });
+
+  it("never locks a null key, the key of a stream type the license does not cover", () => {
+    const { isLocked } = licenseLocksOf({ features: { logs: "locked" } });
+    expect(isLocked(null)).toBe(false);
+    expect(isLocked(undefined)).toBe(false);
+  });
+
+  it("names the feature in the reason", () => {
+    const { lockedReason } = licenseLocksOf({
+      features: { traces: "locked" },
+      feature_names: { traces: "Traces" },
+    });
+    expect(lockedReason("traces")).toContain("Traces");
+  });
+});
diff --git a/web/src/composables/useFeatureLock.ts b/web/src/composables/useFeatureLock.ts
new file mode 100644
index 0000000000..952c012db3
--- /dev/null
+++ b/web/src/composables/useFeatureLock.ts
@@ -0,0 +1,123 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import {
+  computed,
+  getCurrentInstance,
+  inject,
+  onScopeDispose,
+  provide,
+  ref,
+  shallowRef,
+  type ComputedRef,
+  type InjectionKey,
+  type Ref,
+} from "vue";
+import { useStore } from "vuex";
+import { featureState } from "@/utils/featureGate";
+import type { I18nText } from "@/types/i18n";
+
+export interface FeatureLock {
+  locked: Readonly<Ref<boolean>>;
+  feature: Readonly<Ref<string | null>>;
+}
+
+const FEATURE_LOCK: InjectionKey<FeatureLock> = Symbol("featureLock");
+
+const UNLOCKED: FeatureLock = { locked: computed(() => false), feature: ref(null) };
+
+// Module-level so the license-denial receiver, outside the component tree, can see the page lock.
+const activeLock = shallowRef<FeatureLock | null>(null);
+
+/** Locks every O2 primitive below the caller while `lockedFeature` names a feature. */
+export const provideFeatureLock = (lockedFeature: Readonly<Ref<string | null>>): FeatureLock => {
+  const lock: FeatureLock = {
+    feature: lockedFeature,
+    locked: computed(() => lockedFeature.value !== null),
+  };
+  provide(FEATURE_LOCK, lock);
+  activeLock.value = lock;
+  onScopeDispose(() => {
+    if (activeLock.value === lock) activeLock.value = null;
+  });
+  return lock;
+};
+
+export const useFeatureLock = (): FeatureLock => inject(FEATURE_LOCK, UNLOCKED);
+
+/** Marks a container whose controls only navigate, so the page lock leaves them live. */
+export const LOCK_EXEMPT_ATTR = "data-feature-lock-exempt";
+
+/** Unlocks the O2 primitives below the caller without releasing the page lock itself. */
+export const provideFeatureLockExempt = (): void => provide(FEATURE_LOCK, UNLOCKED);
+
+/** A primitive's effective `disabled`: its own prop, or the page lock. */
+export const useLockedDisabled = (disabled: () => boolean | undefined): ComputedRef<boolean> => {
+  const { locked } = useFeatureLock();
+  return computed(() => Boolean(disabled()) || locked.value);
+};
+
+export const isPageLocked = (): boolean => !!activeLock.value?.feature.value;
+
+// Server messages of license denials: catch sites toast `response.data.message`, never the error itself.
+const licenseDenialMessages = new Set<string>();
+
+// ponytail: time window, so an unrelated error toast inside it is dropped too; per-error tagging at catch sites lifts that.
+const DENIAL_TOAST_WINDOW_MS = 2000;
+let lastDenialAt = -Infinity;
+
+/** Remembers a license denial so the catch site's error toast that follows it is dropped. */
+export const markLicenseDenial = (error: unknown): void => {
+  lastDenialAt = Date.now();
+  const message = (error as { response?: { data?: { message?: unknown } } })?.response?.data
+    ?.message;
+  if (typeof message === "string" && message) licenseDenialMessages.add(message);
+};
+
+/** True for an error toast the top bar already explains: one repeating a denial, or any fired just after one. */
+export const isLicenseDenialToast = (message: unknown): boolean =>
+  Date.now() - lastDenialAt < DENIAL_TOAST_WINDOW_MS ||
+  (typeof message === "string" && licenseDenialMessages.has(message));
+
+/** Display names from the build's feature definition (`feature_names` in the org config). */
+export const useFeatureNames = () => {
+  const store = useStore();
+  const featureName = (key: string): string | undefined =>
+    store?.state.zoConfig?.feature_names?.[key];
+  const featureNames = (keys: readonly string[]): string =>
+    keys.map((key) => featureName(key) ?? key).join(", ");
+  return { featureName, featureNames };
+};
+
+/** License locks of keys known only at runtime, such as a panel's stream type; a null key is never locked. */
+export const useLicenseLocks = () => {
+  const store = useStore();
+  const { featureName } = useFeatureNames();
+  // Global `$t`, not a vue-i18n import: toast and http load this module, which would defeat specs' vue-i18n mocks.
+  const translate = getCurrentInstance()?.proxy?.$t;
+  const isLocked = (key: string | null | undefined): boolean =>
+    !!key && featureState(store?.state.zoConfig?.features, key) === "locked";
+  const lockedReason = (key: string): I18nText => {
+    const feature = featureName(key) ?? key;
+    return (translate ? translate("featureLock.headerLocked", { feature }) : feature) as I18nText;
+  };
+  return { isLocked, lockedReason };
+};
+
+/** License lock of one feature, for its controls on a page the license leaves open. */
+export const useLicenseLock = (key: string) => {
+  const { isLocked, lockedReason } = useLicenseLocks();
+  return { locked: computed(() => isLocked(key)), lockedReason: computed(() => lockedReason(key)) };
+};
diff --git a/web/src/composables/useLicenseDenials.spec.ts b/web/src/composables/useLicenseDenials.spec.ts
new file mode 100644
index 0000000000..d54dc1def8
--- /dev/null
+++ b/web/src/composables/useLicenseDenials.spec.ts
@@ -0,0 +1,68 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { addLicenseDeniedError, clearLicenseDenials } from "./useLicenseDenials";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { isPageLocked } from "@/composables/useFeatureLock";
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: vi.fn() }));
+vi.mock("@/composables/useFeatureLock", () => ({ isPageLocked: vi.fn(() => false) }));
+
+describe("license denials", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.mocked(isPageLocked).mockReturnValue(false);
+  });
+  afterEach(() => {
+    // Clear on the fake clock so pageChangedAt does not jump to real time.
+    clearLicenseDenials();
+    vi.useRealTimers();
+    vi.mocked(toast).mockClear();
+  });
+
+  it("warns once per feature set, regardless of order, and again for a different set", () => {
+    addLicenseDeniedError(["dashboards", "functions"]);
+    expect(toast).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(toast).mock.calls[0][0]).toMatchObject({ variant: "warning" });
+
+    addLicenseDeniedError(["functions", "dashboards"]);
+    expect(toast).toHaveBeenCalledTimes(1);
+
+    addLicenseDeniedError(["dashboards"]);
+    expect(toast).toHaveBeenCalledTimes(2);
+  });
+
+  it("warns for an empty feature set too", () => {
+    addLicenseDeniedError([]);
+    expect(toast).toHaveBeenCalledTimes(1);
+  });
+
+  it("warns again after navigation and ignores requests the old page started", () => {
+    addLicenseDeniedError(["workflows"]);
+    vi.setSystemTime(Date.now() + 1);
+    clearLicenseDenials();
+    addLicenseDeniedError(["oncall"], Date.now() - 1);
+    expect(toast).toHaveBeenCalledTimes(1);
+    addLicenseDeniedError(["workflows"]);
+    expect(toast).toHaveBeenCalledTimes(2);
+  });
+
+  it("stays silent on a locked page", () => {
+    vi.mocked(isPageLocked).mockReturnValue(true);
+    addLicenseDeniedError(["workflows"]);
+    expect(toast).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/composables/useLicenseDenials.ts b/web/src/composables/useLicenseDenials.ts
new file mode 100644
index 0000000000..d4c3c6bda5
--- /dev/null
+++ b/web/src/composables/useLicenseDenials.ts
@@ -0,0 +1,46 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import store from "@/stores";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { gt, raw } from "@/types/i18n";
+import { isPageLocked } from "@/composables/useFeatureLock";
+
+// One notice per denied feature set until the page changes, so a page firing many requests does not stack toasts.
+const shown = new Set<string>();
+let pageChangedAt = 0;
+
+/** Tell the user a request was refused by the license (403 + 40001) on a page the license leaves open. */
+export function addLicenseDeniedError(features: string[], requestStartedAt = Date.now()): void {
+  // A locked page shows its own message in place of the page, so only the background loads of other pages land here.
+  if (requestStartedAt < pageChangedAt || isPageLocked()) return;
+  const key = [...features].sort().join(",");
+  if (shown.has(key)) return;
+  shown.add(key);
+  const names = features.map((k) => store.state.zoConfig?.feature_names?.[k] ?? k).join(", ");
+  toast({
+    variant: "warning",
+    title: gt("featureLock.toastTitle"),
+    message: features.length
+      ? gt("featureLock.toastMessage", { features: raw(names) })
+      : gt("featureLock.toastMessageGeneric"),
+  });
+}
+
+/** Forget the notices already shown and ignore those of requests the previous page started. */
+export function clearLicenseDenials(): void {
+  pageChangedAt = Date.now();
+  shown.clear();
+}
diff --git a/web/src/composables/useLogs.ts b/web/src/composables/useLogs.ts
index ac8d9fe0be..f9311f793a 100644
--- a/web/src/composables/useLogs.ts
+++ b/web/src/composables/useLogs.ts
@@ -47,6 +47,7 @@ import type { RunReason } from "@/composables/useLogs/useAutoRun";
 import { resetTransient } from "@/utils/logs/transientSearchKeys";
 import { refreshFreeTextSchemas } from "@/composables/useLogs/freeTextSearch";
 import { decodeFtScan } from "@/utils/logs/freeTextScan";
+import { featureState } from "@/utils/featureGate";
 import {
   decodeColumns,
   endLogsArrival,
@@ -528,11 +529,14 @@ const useLogs = (t: TranslateFn) => {
       delete queryParams.type;
     }
 
-    if (store.state.zoConfig?.super_cluster_enabled && queryParams.regions) {
+    const superCluster =
+      store.state.zoConfig?.super_cluster_enabled &&
+      featureState(store.state.zoConfig?.features, "super_cluster") !== "locked";
+    if (superCluster && queryParams.regions) {
       searchObj.meta.regions = queryParams.regions.split(",");
     }
 
-    if (store.state.zoConfig?.super_cluster_enabled && queryParams.clusters) {
+    if (superCluster && queryParams.clusters) {
       searchObj.meta.clusters = queryParams.clusters.split(",");
     }
 
diff --git a/web/src/composables/useLogs/logsAutoRun.spec.ts b/web/src/composables/useLogs/logsAutoRun.spec.ts
index 9bdee3ac2b..58d05af9ab 100644
--- a/web/src/composables/useLogs/logsAutoRun.spec.ts
+++ b/web/src/composables/useLogs/logsAutoRun.spec.ts
@@ -294,6 +294,21 @@ describe("unknown windows and the super-cluster check (H1, M5)", () => {
       (config as any).isEnterprise = enterprise;
     }
   });
+
+  it("is no super cluster while the license locks super_cluster", () => {
+    const enterprise = (config as any).isEnterprise;
+    (config as any).isEnterprise = "true";
+    fakeStore.state.zoConfig.super_cluster_enabled = true;
+    fakeStore.state.zoConfig.features = { super_cluster: "locked" };
+    try {
+      expect(isSuperCluster()).toBe(false);
+      fakeStore.state.zoConfig.features = { super_cluster: "enabled" };
+      expect(isSuperCluster()).toBe(true);
+    } finally {
+      delete fakeStore.state.zoConfig.features;
+      (config as any).isEnterprise = enterprise;
+    }
+  });
 });
 
 describe("transport binding (AC4.1, P2 records)", () => {
diff --git a/web/src/composables/useLogs/logsAutoRun.ts b/web/src/composables/useLogs/logsAutoRun.ts
index de70953476..203db54f69 100644
--- a/web/src/composables/useLogs/logsAutoRun.ts
+++ b/web/src/composables/useLogs/logsAutoRun.ts
@@ -47,6 +47,7 @@ import {
   type WindowUs,
 } from "@/utils/logs/estimateScanMb";
 import { sqlSources } from "@/utils/logs/sqlSources";
+import { featureState, type FeatureStates } from "@/utils/featureGate";
 import { freeTextGateFlags } from "@/utils/logs/freeTextScan";
 import { notePageCancelled } from "@/composables/useLogs/logsRowNav";
 import { noteUserScopeChange } from "@/composables/useLogs/useLogPermalink";
@@ -137,7 +138,11 @@ export function zoConfig(): AutoRunConfig & Record<string, unknown> {
 }
 
 export function isSuperCluster(): boolean {
-  return config.isEnterprise === "true" && !!zoConfig().super_cluster_enabled;
+  return (
+    config.isEnterprise === "true" &&
+    !!zoConfig().super_cluster_enabled &&
+    featureState(zoConfig().features as FeatureStates | undefined, "super_cluster") !== "locked"
+  );
 }
 
 export function setAutoRunTransport(next: AutoRunTransport): void {
diff --git a/web/src/composables/useLogs/logsUtils.ts b/web/src/composables/useLogs/logsUtils.ts
index 428c9ae517..f946b13511 100644
--- a/web/src/composables/useLogs/logsUtils.ts
+++ b/web/src/composables/useLogs/logsUtils.ts
@@ -17,6 +17,7 @@ import { useStore } from "vuex";
 import { useRouter } from "vue-router";
 import { b64EncodeUnicode, useLocalLogFilterField } from "@/utils/zincutils";
 import { canvasFont } from "@/utils/fonts";
+import { featureState } from "@/utils/featureGate";
 
 import {
   encodeVisualizationConfig,
@@ -531,11 +532,14 @@ export const logsUtils = () => {
     query["quick_mode"] = inputs.quickMode;
     query["show_histogram"] = searchObj.meta.showHistogram;
 
-    if (store.state.zoConfig?.super_cluster_enabled && inputs.regions.length) {
+    const superCluster =
+      store.state.zoConfig?.super_cluster_enabled &&
+      featureState(store.state.zoConfig?.features, "super_cluster") !== "locked";
+    if (superCluster && inputs.regions.length) {
       query["regions"] = inputs.regions.join(",");
     }
 
-    if (store.state.zoConfig?.super_cluster_enabled && inputs.clusters.length) {
+    if (superCluster && inputs.clusters.length) {
       query["clusters"] = inputs.clusters.join(",");
     }
 
diff --git a/web/src/composables/useLogs/useSearchBar.spec.ts b/web/src/composables/useLogs/useSearchBar.spec.ts
index 5022253468..b23672abb8 100644
--- a/web/src/composables/useLogs/useSearchBar.spec.ts
+++ b/web/src/composables/useLogs/useSearchBar.spec.ts
@@ -184,6 +184,20 @@ describe("useSearchBar Composable", () => {
       expect(typeof wrapper.vm.getRegionInfo).toBe("function");
     });
 
+    it("fetches no clusters while the license locks super_cluster", async () => {
+      const { default: searchService } = await import("@/services/search");
+      store.state.zoConfig = { ...store.state.zoConfig, features: { super_cluster: "locked" } };
+      try {
+        wrapper.vm.getRegionInfo();
+        expect(searchService.get_regions).not.toHaveBeenCalled();
+        store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+        wrapper.vm.getRegionInfo();
+        expect(searchService.get_regions).toHaveBeenCalledTimes(1);
+      } finally {
+        store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+      }
+    });
+
     it("should expose setSelectedStreams", () => {
       expect(typeof wrapper.vm.setSelectedStreams).toBe("function");
     });
@@ -209,6 +223,42 @@ describe("useSearchBar Composable", () => {
     });
   });
 
+  describe("getQueryData — license-locked signal", () => {
+    const lock = (features: Record<string, string>, streamType: string) => {
+      const { searchObj } = searchState();
+      searchObj.data.stream.streamLists = [{ label: "app", value: "app" }];
+      searchObj.data.stream.selectedStream = ["app"];
+      searchObj.data.stream.streamType = streamType;
+      searchObj.loading = true;
+      store.state.zoConfig = { ...store.state.zoConfig, features };
+      return searchObj;
+    };
+
+    afterEach(() => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+      searchState().searchObj.data.stream.streamType = "logs";
+    });
+
+    it("sends no search for a locked stream type and clears the loading state", async () => {
+      const searchObj = lock({ traces: "locked" }, "traces");
+      await (wrapper.vm as any).getQueryData(false);
+      expect(mockGetDataThroughStream).not.toHaveBeenCalled();
+      expect(searchObj.loading).toBe(false);
+    });
+
+    it("sends no search for logs while logs is locked", async () => {
+      lock({ logs: "locked" }, "logs");
+      await (wrapper.vm as any).getQueryData(false);
+      expect(mockGetDataThroughStream).not.toHaveBeenCalled();
+    });
+
+    it("still searches a stream type that is not locked", async () => {
+      lock({ traces: "locked" }, "logs");
+      await (wrapper.vm as any).getQueryData(false);
+      expect(mockGetDataThroughStream).toHaveBeenCalled();
+    });
+  });
+
   describe("getQueryData — drawer-close rule and selection reset (4a §3.2.5, §3.2.7)", () => {
     const prime = (pending: boolean) => {
       const { searchObj } = searchState();
diff --git a/web/src/composables/useLogs/useSearchBar.ts b/web/src/composables/useLogs/useSearchBar.ts
index 68f72799d9..46f5da7a2d 100644
--- a/web/src/composables/useLogs/useSearchBar.ts
+++ b/web/src/composables/useLogs/useSearchBar.ts
@@ -49,6 +49,7 @@ import {
 import { noteGridQuery } from "@/composables/useLogs/useLogPermalink";
 import { getCachedSemanticGroups, loadSemanticGroups } from "@/utils/semanticGroupsCache";
 import config from "@/aws-exports";
+import { featureState, streamTypeFeature } from "@/utils/featureGate";
 
 let selectionToken = 0;
 
@@ -152,6 +153,7 @@ export const useSearchBar = (t: TranslateFn) => {
   };
 
   const getRegionInfo = () => {
+    if (featureState(store.state.zoConfig?.features, "super_cluster") === "locked") return;
     searchService.get_regions().then((res) => {
       const clusterData = [];
       let regionObj: any = {};
@@ -456,6 +458,12 @@ export const useSearchBar = (t: TranslateFn) => {
   };
 
   const getQueryData = (isPagination = false, options: QueryDataOptions = {}) => {
+    // Every run funnels here, so a locked signal never loads data whichever trigger started it.
+    const signal = streamTypeFeature(searchObj.data.stream.streamType);
+    if (signal && featureState(store.state.zoConfig?.features, signal) === "locked") {
+      searchObj.loading = false;
+      return undefined;
+    }
     noteGridQuery(options.origin, options.generationId);
     const run = () => withQueryOrigin(options.origin, () => runQueryData(isPagination, options));
     const groupsLoad = isPagination ? null : pendingFilterSemanticGroups();
diff --git a/web/src/composables/useLogs/useSearchQuery.spec.ts b/web/src/composables/useLogs/useSearchQuery.spec.ts
index c5a86e458b..1f5b4dbbf0 100644
--- a/web/src/composables/useLogs/useSearchQuery.spec.ts
+++ b/web/src/composables/useLogs/useSearchQuery.spec.ts
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { ref } from "vue";
 
 // ---------------------------------------------------------------------------
@@ -109,11 +109,16 @@ vi.mock("vue-router", () => ({
   })),
 }));
 
+const superCluster = vi.hoisted(() => ({
+  enabled: false,
+  features: undefined as Record<string, string> | undefined,
+}));
 vi.mock("vuex", () => ({
   useStore: vi.fn(() => ({
     state: {
       zoConfig: {
-        super_cluster_enabled: false,
+        super_cluster_enabled: superCluster.enabled,
+        features: superCluster.features,
         sql_base64_enabled: false,
         timestamp_column: "_timestamp",
       },
@@ -225,6 +230,7 @@ import { buildLogsSignature } from "./useAutoRun";
 import { Parser as SqlParser } from "@openobserve/node-sql-parser/build/datafusionsql";
 import { gt } from "@/types/i18n";
 import { REFRESH_QUERY_ORIGIN, withQueryOrigin } from "./logsRowNav";
+import config from "@/aws-exports";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -263,6 +269,29 @@ function makeWhereASTWithField(fieldName: string) {
 // Tests
 // ---------------------------------------------------------------------------
 
+describe("useSearchQuery › buildSearch › super_cluster license lock", () => {
+  afterEach(() => {
+    superCluster.enabled = false;
+    superCluster.features = undefined;
+    (config as any).isEnterprise = "false";
+  });
+
+  it("sends regions/clusters only while the license leaves super_cluster enabled", () => {
+    mockState = createMockState();
+    (config as any).isEnterprise = "true";
+    superCluster.enabled = true;
+    superCluster.features = { super_cluster: "locked" };
+    const locked = useSearchQuery(gt).buildSearch(false, false);
+    expect(locked).not.toHaveProperty("regions");
+    expect(locked).not.toHaveProperty("clusters");
+
+    superCluster.features = undefined;
+    const open = useSearchQuery(gt).buildSearch(false, false);
+    expect(open).toHaveProperty("regions");
+    expect(open).toHaveProperty("clusters");
+  });
+});
+
 describe("useSearchQuery › buildSearch › ignoreQuickMode parameter", () => {
   let buildSearch: ReturnType<typeof useSearchQuery>["buildSearch"];
 
diff --git a/web/src/composables/useLogs/useSearchQuery.ts b/web/src/composables/useLogs/useSearchQuery.ts
index 10707973ca..b885f506ec 100644
--- a/web/src/composables/useLogs/useSearchQuery.ts
+++ b/web/src/composables/useLogs/useSearchQuery.ts
@@ -26,6 +26,7 @@ import { cloneDeep } from "lodash-es";
 import { SearchRequestPayload } from "@/ts/interfaces/query";
 import { getConsumableRelativeTime } from "@/utils/date";
 import config from "@/aws-exports";
+import { featureState } from "@/utils/featureGate";
 import { b64EncodeUnicode } from "@/utils/zincutils";
 import { quoteSqlIdentifierIfNeeded } from "@/utils/query/sqlIdentifiers";
 import { hasLimitClause } from "@/utils/query/nonSqlLimit";
@@ -603,7 +604,11 @@ export const useSearchQuery = (t: TranslateFn) => {
         },
       };
 
-      if (config.isEnterprise == "true" && store.state.zoConfig.super_cluster_enabled) {
+      if (
+        config.isEnterprise == "true" &&
+        store.state.zoConfig.super_cluster_enabled &&
+        featureState(store.state.zoConfig.features, "super_cluster") !== "locked"
+      ) {
         req["regions"] = searchObj.meta.regions;
         req["clusters"] = searchObj.meta.clusters;
       }
diff --git a/web/src/composables/useLogs/useViewTraceAction.spec.ts b/web/src/composables/useLogs/useViewTraceAction.spec.ts
index 908ed95216..0d20d6ed16 100644
--- a/web/src/composables/useLogs/useViewTraceAction.spec.ts
+++ b/web/src/composables/useLogs/useViewTraceAction.spec.ts
@@ -14,7 +14,8 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
-import { flushPromises } from "@vue/test-utils";
+import { flushPromises, mount } from "@vue/test-utils";
+import { defineComponent } from "vue";
 import { gt } from "@/types/i18n";
 
 const { mockGetStreams } = vi.hoisted(() => ({
@@ -92,6 +93,30 @@ describe("useViewTraceAction", () => {
       expect(mockGetStreams).not.toHaveBeenCalled();
     });
 
+    // The license lock resolves the real store by injection (its module is preloaded before vi.mock).
+    const inSetup = () => {
+      let action!: ReturnType<typeof useViewTraceAction>;
+      mount(
+        defineComponent({
+          setup() {
+            action = useViewTraceAction(gt, searchObj);
+            return () => null;
+          },
+        }),
+        { global: { provide: { store: mockStore } } },
+      );
+      return action;
+    };
+
+    it("reports traces as unlocked when the license leaves it enabled", () => {
+      expect(inSetup().tracesLocked.value).toBe(false);
+    });
+
+    it("reports the traces license lock while traces is locked", () => {
+      mockStore.state.zoConfig.features = { traces: "locked" };
+      expect(inSetup().tracesLocked.value).toBe(true);
+    });
+
     it("gives each caller its own refs so JsonPreview and DetailTable do not share state", () => {
       const first = useViewTraceAction(gt, searchObj);
       const second = useViewTraceAction(gt, searchObj);
diff --git a/web/src/composables/useLogs/useViewTraceAction.ts b/web/src/composables/useLogs/useViewTraceAction.ts
index 104ac2ceeb..0c31e8ef88 100644
--- a/web/src/composables/useLogs/useViewTraceAction.ts
+++ b/web/src/composables/useLogs/useViewTraceAction.ts
@@ -18,6 +18,7 @@ import { useStore } from "vuex";
 import type { TranslateFn } from "@/types/i18n";
 import useStreams from "@/composables/useStreams";
 import type { SearchObject } from "@/composables/useLogs/searchState";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 /**
  * State behind the "View Trace" action — the traces-stream picker and the
@@ -37,6 +38,7 @@ import type { SearchObject } from "@/composables/useLogs/searchState";
 export default function useViewTraceAction(t: TranslateFn, searchObj: SearchObject) {
   const store = useStore();
   const { getStreams } = useStreams(t);
+  const { locked: tracesLocked, lockedReason: tracesLockedReason } = useLicenseLock("traces");
 
   const tracesStreams = ref<string[]>([]);
   const filteredTracesStreamOptions = ref<string[]>([]);
@@ -109,6 +111,8 @@ export default function useViewTraceAction(t: TranslateFn, searchObj: SearchObje
     filteredTracesStreamOptions,
     isTracesStreamsLoading,
     showViewTraceBtn,
+    tracesLocked,
+    tracesLockedReason,
     getTracesStreams,
     setViewTraceBtn,
     filterStreamFn,
diff --git a/web/src/composables/useMcpCredential.spec.ts b/web/src/composables/useMcpCredential.spec.ts
index d753632da3..4e2c862bca 100644
--- a/web/src/composables/useMcpCredential.spec.ts
+++ b/web/src/composables/useMcpCredential.spec.ts
@@ -106,6 +106,52 @@ describe("useMcpCredential", () => {
     });
   });
 
+  describe("with mcp license-locked", () => {
+    it("mints nothing and calls no service-account or role API", async () => {
+      const { generate, credential } = useOrg("org-mcp-locked", { features: { mcp: "locked" } });
+
+      expect(await generate()).toBeNull();
+      expect(service_accounts.create).not.toHaveBeenCalled();
+      expect(createRole).not.toHaveBeenCalled();
+      expect(updateRole).not.toHaveBeenCalled();
+      expect(credential.value).toBeNull();
+    });
+
+    it("mints as usual when mcp is enabled", async () => {
+      const { generate } = useOrg("org-mcp-enabled", { features: { mcp: "enabled" } });
+
+      expect(await generate()).toMatchObject({ token: "tok_123" });
+      expect(service_accounts.create).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("with rbac enforced but not licensed", () => {
+    it.each(["locked", "hidden"])(
+      "keeps the token and calls no gated role API under a %s license",
+      async (state) => {
+        const { generate, error } = useOrg(`org-license-${state}`, { features: { rbac: state } });
+
+        const cred = await generate();
+
+        expect(service_accounts.create).toHaveBeenCalledTimes(1);
+        expect(createRole).not.toHaveBeenCalled();
+        expect(getAllRolePermissions).not.toHaveBeenCalled();
+        expect(updateRole).not.toHaveBeenCalled();
+        expect(cred).toMatchObject({ role: null, scope: "unscoped", token: "tok_123" });
+        expect(error.value).toBe("");
+      },
+    );
+
+    it("joins the role when the license grants rbac", async () => {
+      const { generate } = useOrg("org-license-enabled", { features: { rbac: "enabled" } });
+
+      const cred = await generate();
+
+      expect(updateRole).toHaveBeenCalledTimes(1);
+      expect(cred).toMatchObject({ role: "mcp_readonly", scope: "readonly" });
+    });
+  });
+
   describe("with rbac", () => {
     it("grants a fresh role the read-only set plus MCP write, and joins the account", async () => {
       const { generate } = useOrg("org-fresh");
diff --git a/web/src/composables/useMcpCredential.ts b/web/src/composables/useMcpCredential.ts
index 52589b1199..80d0b3b48a 100644
--- a/web/src/composables/useMcpCredential.ts
+++ b/web/src/composables/useMcpCredential.ts
@@ -29,6 +29,7 @@ import { serviceAccountKeys } from "@/services/service_accounts.querykeys";
 import { iamKeys } from "@/services/iam.querykeys";
 import { userKeys } from "@/services/users.querykeys";
 import { buildServiceAccountEmail } from "@/components/iam/serviceAccounts/AddServiceAccount.schema";
+import { featureState } from "@/utils/featureGate";
 
 // Underscore, not hyphen: create_role normalizes the name (non-[A-Za-z0-9_] → "_"), update_role does not.
 export const MCP_READONLY_ROLE = "mcp_readonly";
@@ -110,6 +111,10 @@ export function useMcpCredential() {
     org: string,
   ): Promise<Pick<McpCredential, "role" | "scope">> => {
     if (!store.state.zoConfig?.rbac_enabled) return { role: null, scope: "rbacDisabled" };
+    // The license gates only the role APIs while RBAC stays enforced, so the account is left unscoped.
+    if (featureState(store.state.zoConfig?.features, "rbac") !== "enabled") {
+      return { role: null, scope: "unscoped" };
+    }
 
     const isMetaOrg = org === store.state.zoConfig?.meta_org;
     try {
@@ -128,6 +133,7 @@ export function useMcpCredential() {
   };
 
   const generate = async (): Promise<McpCredential | null> => {
+    if (featureState(store.state.zoConfig?.features, "mcp") === "locked") return null;
     const org = currentOrg();
     const cached = sessionCredentials.get(org);
     if (cached) {
diff --git a/web/src/composables/useRateLimiter.ts b/web/src/composables/useRateLimiter.ts
index b8c5fe949c..92b955bd83 100644
--- a/web/src/composables/useRateLimiter.ts
+++ b/web/src/composables/useRateLimiter.ts
@@ -16,12 +16,13 @@
 import { useStore } from "vuex";
 import { ref } from "vue";
 import rateLimiterService from "@/services/rate_limit";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 const useRateLimiter = () => {
   const store = useStore();
   let isApiLimitsLoading = ref<boolean>(false);
   let isRoleLimitsLoading = ref<boolean>(false);
-  const apiLimitsForbidden = ref<boolean>(false);
-  const roleLimitsForbidden = ref<boolean>(false);
+  const apiLimitsForbidden = ref<ForbiddenState>(false);
+  const roleLimitsForbidden = ref<ForbiddenState>(false);
 
   const getApiLimitsByOrganization = async (orgId: string, interval: string = "second") => {
     try {
@@ -69,7 +70,7 @@ const useRateLimiter = () => {
       return transformedData;
     } catch (error: any) {
       isApiLimitsLoading.value = false;
-      apiLimitsForbidden.value = error?.response?.status === 403;
+      apiLimitsForbidden.value = forbiddenState(error);
       console.log(error);
     }
   };
@@ -120,7 +121,7 @@ const useRateLimiter = () => {
       return transformedData;
     } catch (error: any) {
       console.log(error);
-      roleLimitsForbidden.value = error?.response?.status === 403;
+      roleLimitsForbidden.value = forbiddenState(error);
       isRoleLimitsLoading.value = false;
     }
   };
diff --git a/web/src/composables/useServiceCorrelation.spec.ts b/web/src/composables/useServiceCorrelation.spec.ts
index 1c5d783dfd..4dd8637d2e 100644
--- a/web/src/composables/useServiceCorrelation.spec.ts
+++ b/web/src/composables/useServiceCorrelation.spec.ts
@@ -39,10 +39,12 @@ const {
   mockFilterDimensionsForCorrelation: vi.fn(),
 }));
 
+const mockZoConfig = vi.hoisted(() => ({ features: {} as Record<string, string> }));
 vi.mock("vuex", () => ({
   useStore: vi.fn(() => ({
     state: {
       selectedOrganization: { identifier: "test-org" },
+      zoConfig: mockZoConfig,
     },
   })),
 }));
@@ -307,6 +309,19 @@ describe("useServiceCorrelation", () => {
       expect(result!.service.service_name).toBe("api-service");
     });
 
+    it("makes no identity-config or correlate call when correlation is license-locked", async () => {
+      mockZoConfig.features = { correlation: "locked" };
+      try {
+        mockGetSemanticGroups.mockResolvedValue({ data: MOCK_GROUPS });
+        const { findRelatedTelemetry } = useServiceCorrelation();
+        expect(await findRelatedTelemetry(mockContext as any, "logs", 5, "default")).toBeNull();
+        expect(mockGetIdentityConfig).not.toHaveBeenCalled();
+        expect(mockCorrelate).not.toHaveBeenCalled();
+      } finally {
+        mockZoConfig.features = {};
+      }
+    });
+
     it("flags noMatch (not error) when correlate API returns null", async () => {
       mockGetSemanticGroups.mockResolvedValue({ data: MOCK_GROUPS });
       mockExtractSemanticDimensions.mockReturnValue({ service_name: "api-service" });
diff --git a/web/src/composables/useServiceCorrelation.ts b/web/src/composables/useServiceCorrelation.ts
index d65d64c30b..c44880b17c 100644
--- a/web/src/composables/useServiceCorrelation.ts
+++ b/web/src/composables/useServiceCorrelation.ts
@@ -16,6 +16,7 @@
 import { ref, computed } from "vue";
 import { gt } from "@/types/i18n";
 import { useStore } from "vuex";
+import { featureState } from "@/utils/featureGate";
 import serviceStreamsApi from "@/services/service_streams";
 import settingsApi from "@/services/settings";
 import type {
@@ -127,6 +128,8 @@ export function useServiceCorrelation() {
   ): Promise<CorrelationResult | null> {
     error.value = null;
     noMatch.value = false;
+    // Identity config and _correlate are correlation APIs; a locked license would 403 both.
+    if (featureState(store.state.zoConfig?.features, "correlation") === "locked") return null;
 
     try {
       // Validate inputs
diff --git a/web/src/enterprise/components/AIObservability/AiScopeBar.vue b/web/src/enterprise/components/AIObservability/AiScopeBar.vue
index 7908d2df05..c97887df0d 100644
--- a/web/src/enterprise/components/AIObservability/AiScopeBar.vue
+++ b/web/src/enterprise/components/AIObservability/AiScopeBar.vue
@@ -56,7 +56,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <OToggleGroupItem
           value="agent"
           size="sm"
-          :icon-right="!showAgentToggle ? 'lock' : undefined"
+          :icon-right="!showAgentToggle || aiObsLock.locked.value ? 'lock' : undefined"
+          :disabled="aiObsLock.locked.value"
+          :focusable-unavailable="aiObsLock.locked.value"
+          :tooltip="aiObsLock.locked.value ? aiObsLock.lockedReason.value : undefined"
         >
           {{ labels.agent }}
         </OToggleGroupItem>
@@ -137,6 +140,7 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
 import StreamAgentCountBadge from "@/components/shared/StreamAgentCountBadge.vue";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import AgentScopeCascade from "./AgentScopeCascade.vue";
 
 type FilterMode = "stream" | "agent";
@@ -256,6 +260,7 @@ const activeStreamModel = computed({
 });
 
 const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+const aiObsLock = useLicenseLock("ai_observability");
 
 // OToggleGroup is controlled (`:model-value`), so refusing to emit the mode
 // change here is what keeps the locked Agent toggle from actually switching —
diff --git a/web/src/enterprise/components/AIObservability/ExperimentForm.vue b/web/src/enterprise/components/AIObservability/ExperimentForm.vue
index 22154674c6..a99dbacc3f 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentForm.vue
+++ b/web/src/enterprise/components/AIObservability/ExperimentForm.vue
@@ -677,6 +677,7 @@ import {
   type ProviderCheckFailure,
 } from "../../views/AIObservability/experimentProviderCheck";
 import ExperimentPreviewPanel from "./ExperimentPreviewPanel.vue";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 import {
   EXPERIMENT_ROW_SOURCES,
   experimentFormDefaults,
@@ -1336,6 +1337,9 @@ onBeforeUnmount(() => runPreviewAfterTyping.cancel());
 watch(datasetId, loadDatasetRows, { immediate: true });
 watch([promptId, promptSelectionMode, promptLabel, promptVersion], resolvePromptSelection);
 
+// A locked page cannot be edited, and its locked save button would trap the user.
+const { locked: pageLocked } = useFeatureLock();
+
 const experimentDraft = useEditorDraft<ExperimentForm>({
   kind: "experiment",
   entityLabel: () => t("common.editorDraft.entities.experiment"),
@@ -1352,7 +1356,7 @@ const experimentDraft = useEditorDraft<ExperimentForm>({
     if (!resolvingPrompt.value) draftOverrides = null;
   },
   base: () => (cloning.value ? cloneDefinition(cloneSource.value) : undefined),
-  hasChanges: () => isDirty.value,
+  hasChanges: () => !pageLocked.value && isDirty.value,
   save: async () => {
     const run = { saved: false };
     leaveSave = run;
diff --git a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
index a2503d08b3..1eabbe4a3e 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
+++ b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
@@ -17,6 +17,7 @@
 
 import { describe, expect, it } from "vitest";
 import { mount } from "@vue/test-utils";
+import { createStore } from "vuex";
 import type { ExperimentRowDetail } from "@/services/llm-experiments.service";
 import ExperimentRowDetailDrawer from "./ExperimentRowDetailDrawer.vue";
 
@@ -93,16 +94,22 @@ const detail: ExperimentRowDetail = {
   ],
 };
 
-function mountDrawer(rowDetail: ExperimentRowDetail = detail) {
+function mountDrawer(
+  rowDetail: ExperimentRowDetail = detail,
+  features: Record<string, string> = {},
+) {
   return mount(ExperimentRowDetailDrawer, {
     props: { open: true, detail: rowDetail },
     global: {
+      plugins: [createStore({ state: { zoConfig: { features } } })],
       stubs: {
         ODrawer: {
           props: ["open", "title", "subTitle"],
           template: '<section v-if="open"><slot /><slot name="footer" /></section>',
         },
-        OButton: { template: "<button @click=\"$emit('click')\"><slot /></button>" },
+        OButton: {
+          template: '<button @click="$emit(\'click\')"><slot name="icon-left" /><slot /></button>',
+        },
         OTag: { template: "<span><slot /></span>" },
       },
     },
@@ -184,6 +191,31 @@ describe("ExperimentRowDetailDrawer", () => {
     ]);
   });
 
+  it("locks both trace buttons and emits nothing while the traces license is locked", async () => {
+    const wrapper = mountDrawer(detail, { traces: "locked" });
+
+    for (const id of ["ai-experiment-row-trace", "ai-experiment-row-score-trace-quality:3"]) {
+      const button = wrapper.get(`[data-test="${id}"]`);
+      expect(button.attributes("disabled")).toBeDefined();
+      await button.trigger("click");
+    }
+    expect(wrapper.find('[data-test="ai-experiment-row-trace-lock"]').exists()).toBe(true);
+    expect(
+      wrapper.find('[data-test="ai-experiment-row-score-trace-lock-quality:3"]').exists(),
+    ).toBe(true);
+    expect(wrapper.emitted("trace")).toBeUndefined();
+    expect(wrapper.emitted("score-trace")).toBeUndefined();
+  });
+
+  it("keeps both trace buttons live when the license enables traces", () => {
+    const wrapper = mountDrawer(detail, { traces: "enabled" });
+
+    expect(wrapper.find('[data-test$="-lock"]').exists()).toBe(false);
+    expect(
+      wrapper.get('[data-test="ai-experiment-row-trace"]').attributes("disabled"),
+    ).toBeUndefined();
+  });
+
   it("renders a structured SDK output and the client-reported scores", () => {
     const sdkRow: ExperimentRowDetail = {
       ...detail,
diff --git a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
index 90ee015ea7..fe2a7696e6 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
+++ b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
@@ -123,8 +123,31 @@
                 {{ statusVariant(activeTrial.taskStatus, "eval").label }}
               </OTag>
               <div class="flex items-center gap-2">
+                <OTooltip
+                  v-if="activeTrial.execution?.traceId && tracesLock.locked.value"
+                  :content="tracesLock.lockedReason.value"
+                >
+                  <span class="inline-flex">
+                    <OButton
+                      size="sm"
+                      variant="outline"
+                      disabled
+                      data-test="ai-experiment-row-trace"
+                    >
+                      <template #icon-left>
+                        <OIcon
+                          name="lock"
+                          class="text-icon-locked"
+                          size="sm"
+                          data-test="ai-experiment-row-trace-lock"
+                        />
+                      </template>
+                      {{ t("aiObservability.experiments.rowDetail.viewTrace") }}
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
-                  v-if="activeTrial.execution?.traceId"
+                  v-else-if="activeTrial.execution?.traceId"
                   size="sm"
                   variant="outline"
                   data-test="ai-experiment-row-trace"
@@ -251,8 +274,31 @@
                   >
                     {{ raw(score.value) }}
                   </span>
+                  <OTooltip
+                    v-if="score.trace && tracesLock.locked.value"
+                    :content="tracesLock.lockedReason.value"
+                  >
+                    <span class="inline-flex">
+                      <OButton
+                        size="sm"
+                        variant="outline"
+                        disabled
+                        :data-test="`ai-experiment-row-score-trace-${score.key}`"
+                      >
+                        <template #icon-left>
+                          <OIcon
+                            name="lock"
+                            class="text-icon-locked"
+                            size="sm"
+                            :data-test="`ai-experiment-row-score-trace-lock-${score.key}`"
+                          />
+                        </template>
+                        {{ t("aiObservability.experiments.rowDetail.viewTrace") }}
+                      </OButton>
+                    </span>
+                  </OTooltip>
                   <OButton
-                    v-if="score.trace"
+                    v-else-if="score.trace"
                     size="sm"
                     variant="outline"
                     :data-test="`ai-experiment-row-score-trace-${score.key}`"
@@ -319,6 +365,8 @@ import LLMContentRenderer from "@/plugins/traces/LLMContentRenderer.vue";
 import ExperimentRowNav from "./ExperimentRowNav.vue";
 import { durationLabel } from "./experimentRowContent";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import {
   experimentScoreSummaryValue,
   experimentScoreValue,
@@ -346,6 +394,7 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const tracesLock = useLicenseLock("traces");
 
 const activeTrialIndex = ref(0);
 watch(
diff --git a/web/src/enterprise/components/billings/plans.spec.ts b/web/src/enterprise/components/billings/plans.spec.ts
index f58352b300..6033c351f7 100644
--- a/web/src/enterprise/components/billings/plans.spec.ts
+++ b/web/src/enterprise/components/billings/plans.spec.ts
@@ -218,6 +218,19 @@ describe("Plans Component", () => {
     vi.unstubAllGlobals();
   });
 
+  it("skips the AI usage read while the assistant is not licensed", async () => {
+    vi.mocked(BillingService.get_ai_usage).mockClear();
+    store.state.zoConfig.features = { ai_assistant: "locked" };
+    const locked = mount(Plans, {
+      global: { plugins: [i18n], provide: { store }, mocks: { $router: mockRouter } },
+    });
+    await flushPromises();
+
+    expect(BillingService.get_ai_usage).not.toHaveBeenCalled();
+    locked.unmount();
+    delete store.state.zoConfig.features;
+  });
+
   it("fires billing_checkout_returned once with the plan when Stripe sends the user back", async () => {
     vi.mocked(analytics.track).mockClear();
     Object.defineProperty(document, "referrer", {
diff --git a/web/src/enterprise/components/billings/plans.vue b/web/src/enterprise/components/billings/plans.vue
index 9b7125bde2..db4faad552 100644
--- a/web/src/enterprise/components/billings/plans.vue
+++ b/web/src/enterprise/components/billings/plans.vue
@@ -199,6 +199,7 @@ import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OProgressBar from "@/lib/data/ProgressBar/OProgressBar.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { featureState } from "@/utils/featureGate";
 
 function isStripeCheckoutReferrer(referrer: string): boolean {
   try {
@@ -255,6 +256,8 @@ export default defineComponent({
         });
     },
     async fetchAiUsage() {
+      // A locked assistant answers with a license 403, which would raise the license popup here.
+      if (featureState(this.store.state.zoConfig?.features, "ai_assistant") !== "enabled") return;
       try {
         const orgId = this.store.state.selectedOrganization.identifier;
         this.aiUsage = (await BillingService.get_ai_usage(orgId)).data;
diff --git a/web/src/enterprise/components/billings/usage/UsageView.spec.ts b/web/src/enterprise/components/billings/usage/UsageView.spec.ts
index 93a56fbc16..3bebedcb06 100644
--- a/web/src/enterprise/components/billings/usage/UsageView.spec.ts
+++ b/web/src/enterprise/components/billings/usage/UsageView.spec.ts
@@ -387,6 +387,14 @@ describe("UsageView AI credits warning", () => {
       false,
     );
   });
+
+  it("skips the AI usage read while the assistant is not licensed", async () => {
+    aiUsage.mockClear();
+    store.state.zoConfig.features = { ai_assistant: "locked" };
+    await mountView();
+    expect(aiUsage).not.toHaveBeenCalled();
+    delete store.state.zoConfig.features;
+  });
 });
 
 describe("UsageView load failures", () => {
diff --git a/web/src/enterprise/components/billings/usage/UsageView.vue b/web/src/enterprise/components/billings/usage/UsageView.vue
index 55e60d927c..c584113ef3 100644
--- a/web/src/enterprise/components/billings/usage/UsageView.vue
+++ b/web/src/enterprise/components/billings/usage/UsageView.vue
@@ -178,6 +178,7 @@ import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import config from "@/aws-exports";
 import { siteURL } from "@/constants/config";
 import BillingService, { type AiUsage } from "@/services/billings";
+import { featureState } from "@/utils/featureGate";
 import UsageOverview from "./UsageOverview.vue";
 import UsageOverviewSkeleton from "./UsageOverviewSkeleton.vue";
 import { mockMeteringResponse, USE_METERING_MOCK } from "./meteringMock";
@@ -330,6 +331,7 @@ let latestLoad = 0;
 
 const loadAiUsage = async (loadId: number) => {
   if (config.isCloud !== "true") return;
+  if (featureState(store.state.zoConfig?.features, "ai_assistant") !== "enabled") return;
   try {
     const usage = (await BillingService.get_ai_usage(store.state.selectedOrganization.identifier))
       .data;
diff --git a/web/src/enterprise/components/onlineEvals/EvalJobList.vue b/web/src/enterprise/components/onlineEvals/EvalJobList.vue
index 870227beef..02fb640a08 100644
--- a/web/src/enterprise/components/onlineEvals/EvalJobList.vue
+++ b/web/src/enterprise/components/onlineEvals/EvalJobList.vue
@@ -271,6 +271,7 @@ import type {
 import { statusOf, targetScopeOf, valueOf } from "./utils/evalEntity";
 import { relativeTime } from "./utils/evalFormat";
 import { formatDate } from "@/utils/date";
+import type { ForbiddenState } from "@/utils/featureGate";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import EvalListShell from "./EvalListShell.vue";
 import { useNumberedRows } from "./composables/useNumberedRows";
@@ -282,7 +283,7 @@ const props = defineProps<{
   rows: EvalJob[];
   search: string;
   loading?: boolean;
-  forbidden?: boolean;
+  forbidden?: ForbiddenState;
   /** A bulk action (e.g. delete-selected) is in flight — shows the table overlay. */
   actionLoading?: boolean;
   /** ID of the job whose activate/pause request is currently in flight. */
diff --git a/web/src/enterprise/components/onlineEvals/QualityPage.vue b/web/src/enterprise/components/onlineEvals/QualityPage.vue
index 699350195e..c6461c523f 100644
--- a/web/src/enterprise/components/onlineEvals/QualityPage.vue
+++ b/web/src/enterprise/components/onlineEvals/QualityPage.vue
@@ -57,73 +57,76 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
     </OPageHeader>
 
-    <section
-      class="bg-card-glass-bg flex min-h-0 flex-1 flex-col overflow-hidden"
-      data-test="quality-body"
-    >
-      <!-- Env, Agent and Version scope the list and the detail alike; the detail adds its scope toggle. -->
-      <div
-        class="px-page-edge flex shrink-0 flex-wrap items-center gap-2 py-2"
-        data-test="quality-scope-bar"
+    <OPageLockedBody>
+      <section
+        class="bg-card-glass-bg flex min-h-0 flex-1 flex-col overflow-hidden"
+        data-test="quality-body"
       >
-        <slot name="filters" />
-        <OToggleGroup
-          v-if="configId && scopeOptions.length > 2"
-          :model-value="scope"
-          mobile-dropdown
-          class="ms-auto"
-          data-test="quality-detail-scope"
-          @update:model-value="
-            (value) => updateQuery({ scope: value === 'all' ? undefined : (value as string) })
-          "
+        <!-- Env, Agent and Version scope the list and the detail alike; the detail adds its scope toggle. -->
+        <div
+          class="px-page-edge flex shrink-0 flex-wrap items-center gap-2 py-2"
+          data-test="quality-scope-bar"
         >
-          <OToggleGroupItem
-            v-for="option in scopeOptions"
-            :key="option.value"
-            :value="option.value"
-            size="sm"
-            :data-test="`quality-detail-scope-${option.value}`"
+          <slot name="filters" />
+          <OToggleGroup
+            v-if="configId && scopeOptions.length > 2"
+            :model-value="scope"
+            mobile-dropdown
+            class="ms-auto"
+            data-test="quality-detail-scope"
+            @update:model-value="
+              (value) => updateQuery({ scope: value === 'all' ? undefined : (value as string) })
+            "
           >
-            {{ option.label }}
-            <span class="font-semibold tabular-nums">{{ formatCount(option.count) }}</span>
-          </OToggleGroupItem>
-        </OToggleGroup>
-      </div>
-      <QualityConfigDetail
-        v-if="configId"
-        :config-id="configId"
-        :row="selectedRow"
-        :config="selectedConfig"
-        :scope="scope"
-        :only="only"
-        :date-window="dateWindow"
-        :agent-params="agentParams"
-        :enabled="enabled"
-        :initial-page="restoredPage"
-        :initial-score-id="restoredScoreId"
-        :initial-filter="restoredFilter"
-        @back="closeConfig"
-        @update:only="(value) => updateQuery({ only: value === 'all' ? undefined : value })"
-        @status="(status) => (detailStatus = status)"
-        @position="updatePosition"
-      />
-      <QualityConfigsTable
-        v-else
-        v-model:tile-filter="tileFilter"
-        v-model:search="search"
-        :rows="visibleRows"
-        :tiles="tiles"
-        :loading="listQuery.isPending.value || configsLoading"
-        :forbidden="listStatus === 403"
-        :load-error="!!listQuery.error.value && listStatus !== 403"
-        @open="openConfig"
-        @retry="retryList"
-      />
-    </section>
+            <OToggleGroupItem
+              v-for="option in scopeOptions"
+              :key="option.value"
+              :value="option.value"
+              size="sm"
+              :data-test="`quality-detail-scope-${option.value}`"
+            >
+              {{ option.label }}
+              <span class="font-semibold tabular-nums">{{ formatCount(option.count) }}</span>
+            </OToggleGroupItem>
+          </OToggleGroup>
+        </div>
+        <QualityConfigDetail
+          v-if="configId"
+          :config-id="configId"
+          :row="selectedRow"
+          :config="selectedConfig"
+          :scope="scope"
+          :only="only"
+          :date-window="dateWindow"
+          :agent-params="agentParams"
+          :enabled="enabled"
+          :initial-page="restoredPage"
+          :initial-score-id="restoredScoreId"
+          :initial-filter="restoredFilter"
+          @back="closeConfig"
+          @update:only="(value) => updateQuery({ only: value === 'all' ? undefined : value })"
+          @status="(status) => (detailStatus = status)"
+          @position="updatePosition"
+        />
+        <QualityConfigsTable
+          v-else
+          v-model:tile-filter="tileFilter"
+          v-model:search="search"
+          :rows="visibleRows"
+          :tiles="tiles"
+          :loading="listQuery.isPending.value || configsLoading"
+          :forbidden="listStatus === 403"
+          :load-error="!!listQuery.error.value && listStatus !== 403"
+          @open="openConfig"
+          @retry="retryList"
+        />
+      </section>
+    </OPageLockedBody>
   </div>
 </template>
 
 <script setup lang="ts">
+import OPageLockedBody from "@/lib/core/PageLayout/OPageLockedBody.vue";
 import { computed, ref, toRef, watch } from "vue";
 import { useRoute, useRouter } from "vue-router";
 import { raw, useI18nTyped } from "@/types/i18n";
diff --git a/web/src/enterprise/components/onlineEvals/ScoreConfigList.vue b/web/src/enterprise/components/onlineEvals/ScoreConfigList.vue
index cd987a8239..f9cd1981f0 100644
--- a/web/src/enterprise/components/onlineEvals/ScoreConfigList.vue
+++ b/web/src/enterprise/components/onlineEvals/ScoreConfigList.vue
@@ -222,6 +222,7 @@ import type { ScoreConfig, Scorer } from "@/services/online-evals.service";
 import { dataTypeOf, entityId, valueOf } from "./utils/evalEntity";
 import EvalListShell from "./EvalListShell.vue";
 import { useNumberedRows } from "./composables/useNumberedRows";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 type DataType = "numeric" | "categorical" | "boolean";
 
@@ -231,7 +232,7 @@ const props = defineProps<{
   scorers: Scorer[];
   search: string;
   loading?: boolean;
-  forbidden?: boolean;
+  forbidden?: ForbiddenState;
   /** Epoch-ms of the last list read, for the refresh button's age label. */
   lastRunAt?: number | null;
   /** A reload is in flight — spins the refresh button and blocks a second click. */
diff --git a/web/src/enterprise/components/onlineEvals/ScorerList.vue b/web/src/enterprise/components/onlineEvals/ScorerList.vue
index 7e3ea5ea07..6255588ef9 100644
--- a/web/src/enterprise/components/onlineEvals/ScorerList.vue
+++ b/web/src/enterprise/components/onlineEvals/ScorerList.vue
@@ -251,6 +251,7 @@ import { useNumberedRows } from "./composables/useNumberedRows";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 const props = defineProps<{
   rows: Scorer[];
@@ -260,7 +261,7 @@ const props = defineProps<{
   providers: Provider[];
   search: string;
   loading?: boolean;
-  forbidden?: boolean;
+  forbidden?: ForbiddenState;
   /** Epoch-ms of the last list read, for the refresh button's age label. */
   lastRunAt?: number | null;
   /** A reload is in flight — spins the refresh button and blocks a second click. */
diff --git a/web/src/enterprise/components/onlineEvals/composables/useOnlineEvalsData.ts b/web/src/enterprise/components/onlineEvals/composables/useOnlineEvalsData.ts
index 8e777b8b96..08d18d9bcd 100644
--- a/web/src/enterprise/components/onlineEvals/composables/useOnlineEvalsData.ts
+++ b/web/src/enterprise/components/onlineEvals/composables/useOnlineEvalsData.ts
@@ -15,6 +15,7 @@ import onlineEvalsService, {
 } from "@/services/online-evals.service";
 import { entityId } from "../utils/evalEntity";
 import { showError } from "../utils/evalFormat";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 
 export function useOnlineEvalsData() {
   const { t } = useI18nTyped();
@@ -24,9 +25,9 @@ export function useOnlineEvalsData() {
   const scoreConfigVersions = ref<Record<string, ScoreConfig[]>>({});
   const providers = ref<Provider[]>([]);
   const isLoading = ref(false);
-  const jobsForbidden = ref(false);
-  const scorersForbidden = ref(false);
-  const scoreConfigsForbidden = ref(false);
+  const jobsForbidden = ref<ForbiddenState>(false);
+  const scorersForbidden = ref<ForbiddenState>(false);
+  const scoreConfigsForbidden = ref<ForbiddenState>(false);
 
   const applyScoreConfigs = (rows: ScoreConfig[]) => {
     scoreConfigs.value = rows;
@@ -64,15 +65,15 @@ export function useOnlineEvalsData() {
         showError(providerResult.reason, t("onlineEvals.loadError"));
       }
       if (scoreConfigResult.status === "rejected") {
-        scoreConfigsForbidden.value = scoreConfigResult.reason?.response?.status === 403;
+        scoreConfigsForbidden.value = forbiddenState(scoreConfigResult.reason);
         showError(scoreConfigResult.reason, t("onlineEvals.loadError"));
       }
       if (scorerResult.status === "rejected") {
-        scorersForbidden.value = scorerResult.reason?.response?.status === 403;
+        scorersForbidden.value = forbiddenState(scorerResult.reason);
         showError(scorerResult.reason, t("onlineEvals.loadError"));
       }
       if (jobResult.status === "rejected") {
-        jobsForbidden.value = jobResult.reason?.response?.status === 403;
+        jobsForbidden.value = forbiddenState(jobResult.reason);
         showError(jobResult.reason, t("onlineEvals.loadError"));
       }
     } finally {
diff --git a/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.licenseLock.spec.ts b/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.licenseLock.spec.ts
new file mode 100644
index 0000000000..936ef4b942
--- /dev/null
+++ b/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.licenseLock.spec.ts
@@ -0,0 +1,100 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { ref } from "vue";
+import { flushPromises, mount } from "@vue/test-utils";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { createStore } from "vuex";
+import i18n from "@/locales";
+import { withQueryClient } from "@/test/unit/helpers/queryClient";
+import EvalJobDetail from "./EvalJobDetail.vue";
+
+const { push } = vi.hoisted(() => ({ push: vi.fn(() => Promise.resolve()) }));
+
+vi.mock("vue-router", () => ({ useRouter: () => ({ push }) }));
+
+const run = { id: "span-1", evaluatorTraceId: "eval-1", timestampMs: 1000, status: "ok" };
+
+vi.mock("../composables/useEvalJobRuns", () => ({
+  useEvalJobRuns: () => ({
+    kpis: ref({ totalRuns: 0, successRate: null, avgLatencyMs: null, failureCount: null }),
+    runs: ref([run]),
+    failures: ref([]),
+    isLoadingKpis: ref(false),
+    isLoading: ref(false),
+    refresh: vi.fn(),
+  }),
+}));
+
+const OTableStub = {
+  name: "OTable",
+  props: ["data"],
+  emits: ["rowClick"],
+  template: `<div><div v-for="row in data" :key="row.id" class="o-row" @click="$emit('rowClick', row)"><slot name="cell-timestampMs" :row="row" /></div></div>`,
+};
+
+const mountRuns = async (features: Record<string, string>) => {
+  const store = createStore({
+    state: { selectedOrganization: { identifier: "org1" }, zoConfig: { features } },
+  });
+  const wrapper = mount(EvalJobDetail, {
+    props: { row: { id: "job-1", scorers: [] } as any, scorers: [], scoreConfigs: [] },
+    global: {
+      plugins: [i18n, withQueryClient(), store],
+      stubs: {
+        ODrawer: { template: "<div><slot /></div>" },
+        OTable: OTableStub,
+        DateTimePickerDashboard: true,
+        KpiCardsSkeleton: true,
+        OTabs: true,
+        OSelect: true,
+      },
+    },
+  });
+  (wrapper.vm as any).$.setupState.activeTab = "runs";
+  await flushPromises();
+  return wrapper;
+};
+
+// OTable keys the row pointer cursor on whether a row-click listener is bound.
+const rowListener = (wrapper: Awaited<ReturnType<typeof mountRuns>>) =>
+  wrapper.findComponent({ name: "OTable" }).vm.$.vnode.props?.onRowClick;
+
+describe("EvalJobDetail run rows and the traces license", () => {
+  beforeEach(() => push.mockClear());
+
+  it("drops the row affordance, shows the lock and opens nothing while traces are locked", async () => {
+    const wrapper = await mountRuns({ traces: "locked" });
+
+    expect(rowListener(wrapper)).toBeUndefined();
+    expect(wrapper.find('[data-test="eval-job-detail-run-lock"]').exists()).toBe(true);
+    await wrapper.find(".o-row").trigger("click");
+    expect(push).not.toHaveBeenCalled();
+  });
+
+  it("keeps rows clickable and opens the evaluator trace when traces are enabled", async () => {
+    const wrapper = await mountRuns({ traces: "enabled" });
+
+    expect(rowListener(wrapper)).toBeTypeOf("function");
+    expect(wrapper.find('[data-test="eval-job-detail-run-lock"]').exists()).toBe(false);
+    await wrapper.find(".o-row").trigger("click");
+    expect(push).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "traceDetails",
+        query: expect.objectContaining({ trace_id: "eval-1" }),
+      }),
+    );
+  });
+});
diff --git a/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.vue b/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.vue
index 05415bc65a..1f15034107 100644
--- a/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.vue
+++ b/web/src/enterprise/components/onlineEvals/forms/EvalJobDetail.vue
@@ -376,10 +376,22 @@
             show-index
             width="100%"
             class="w-full"
-            @row-click="openEvaluationRun"
+            v-on="rowClickListeners"
           >
             <template #cell-timestampMs="{ row }">
-              <span class="text-text-secondary">{{ relativeTime(row.timestampMs, t) }}</span>
+              <span class="inline-flex items-center">
+                <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+                  <span class="me-1.5 inline-flex">
+                    <OIcon
+                      name="lock"
+                      class="text-icon-locked"
+                      size="sm"
+                      data-test="eval-job-detail-run-lock"
+                    />
+                  </span>
+                </OTooltip>
+                <span class="text-text-secondary">{{ relativeTime(row.timestampMs, t) }}</span>
+              </span>
             </template>
             <template #cell-scorerId="{ row }">
               <span>{{ scorerNameFor(row.scorerId) }}</span>
@@ -425,10 +437,22 @@
             show-index
             width="100%"
             class="w-full"
-            @row-click="openEvaluationRun"
+            v-on="rowClickListeners"
           >
             <template #cell-timestampMs="{ row }">
-              <span class="text-text-secondary">{{ relativeTime(row.timestampMs, t) }}</span>
+              <span class="inline-flex items-center">
+                <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+                  <span class="me-1.5 inline-flex">
+                    <OIcon
+                      name="lock"
+                      class="text-icon-locked"
+                      size="sm"
+                      data-test="eval-job-detail-run-lock"
+                    />
+                  </span>
+                </OTooltip>
+                <span class="text-text-secondary">{{ relativeTime(row.timestampMs, t) }}</span>
+              </span>
             </template>
             <template #cell-scorerId="{ row }">
               <span>{{ scorerNameFor(row.scorerId) }}</span>
@@ -477,6 +501,7 @@ import KpiCardsSkeleton from "./KpiCardsSkeleton.vue";
 import { copyToClipboard } from "@/utils/clipboard";
 import { genAiAgentsQuery } from "@/services/gen-ai-agent-mapping.queries";
 import { queryClient } from "@/composables/query/queryClient";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type {
   EvalJob,
   EvalTargetScope,
@@ -519,6 +544,11 @@ function handleOpenChange(value: boolean) {
 
 const { t } = useI18nTyped();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
+// Without a row-click listener OTable drops the pointer cursor, so locked rows stop looking clickable.
+const rowClickListeners = computed(() =>
+  tracesLock.locked.value ? {} : { rowClick: openEvaluationRun },
+);
 const store = useStore();
 const orgId = computed(() => store.state.selectedOrganization?.identifier ?? "default");
 
@@ -816,7 +846,7 @@ const {
 } = useEvalJobRuns(jobIdRef, dateWindow, tableEnabled, selectedAgent);
 
 function openEvaluationRun(run: JobRunRow) {
-  if (!run.evaluatorTraceId) return;
+  if (!run.evaluatorTraceId || tracesLock.locked.value) return;
   const timestampUs = run.timestampMs > 0 ? run.timestampMs * 1000 : 0;
   router
     .push({
diff --git a/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.spec.ts b/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.spec.ts
index d7808d4c82..d4c3d0100b 100644
--- a/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.spec.ts
+++ b/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.spec.ts
@@ -235,6 +235,31 @@ describe("QualityScorePane", () => {
     );
   });
 
+  it("locks both trace actions and navigates nowhere while the traces license is locked", async () => {
+    const saved = store.state.zoConfig;
+    store.state.zoConfig = { ...saved, features: { traces: "locked" } };
+    try {
+      const wrapper = mountPane();
+      for (const id of ["quality-score-pane-open-target", "quality-score-pane-open-evaluator"]) {
+        const button = wrapper.find(`[data-test="${id}"]`);
+        expect(button.attributes("disabled")).toBeDefined();
+        expect(wrapper.find(`[data-test="${id}-lock"]`).exists()).toBe(true);
+        await button.trigger("click");
+      }
+      expect(push).not.toHaveBeenCalled();
+    } finally {
+      store.state.zoConfig = saved;
+    }
+  });
+
+  it("keeps both trace actions live when the license enables traces", () => {
+    const wrapper = mountPane();
+    expect(wrapper.find('[data-test="quality-score-pane-open-target-lock"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="quality-score-pane-open-evaluator-lock"]').exists()).toBe(
+      false,
+    );
+  });
+
   it("hides an action whose link cannot be built", () => {
     const wrapper = mountPane({ score: score({ evaluatorTraceId: null }) });
     expect(wrapper.find('[data-test="quality-score-pane-open-evaluator"]').exists()).toBe(false);
diff --git a/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.vue b/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.vue
index 91830710fa..f82d24471b 100644
--- a/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.vue
+++ b/web/src/enterprise/components/onlineEvals/quality/QualityScorePane.vue
@@ -167,8 +167,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <OSkeleton type="text" class="h-6 w-24" />
           <OSkeleton type="text" class="h-6 w-28" />
         </template>
+        <OTooltip
+          v-if="targetLocation && tracesLock.locked.value"
+          :content="tracesLock.lockedReason.value"
+        >
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="xs"
+              disabled
+              data-test="quality-score-pane-open-target"
+            >
+              <template #icon-left>
+                <OIcon
+                  name="lock"
+                  class="text-icon-locked"
+                  size="sm"
+                  data-test="quality-score-pane-open-target-lock"
+                />
+              </template>
+              {{ t(`onlineEvals.quality.pane.open.${score?.targetScope}`) }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="targetLocation"
+          v-else-if="targetLocation"
           variant="outline"
           size="xs"
           data-test="quality-score-pane-open-target"
@@ -176,8 +199,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >
           {{ t(`onlineEvals.quality.pane.open.${score?.targetScope}`) }}
         </OButton>
+        <OTooltip
+          v-if="evaluatorLocation && tracesLock.locked.value"
+          :content="tracesLock.lockedReason.value"
+        >
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="xs"
+              disabled
+              data-test="quality-score-pane-open-evaluator"
+            >
+              <template #icon-left>
+                <OIcon
+                  name="lock"
+                  class="text-icon-locked"
+                  size="sm"
+                  data-test="quality-score-pane-open-evaluator-lock"
+                />
+              </template>
+              {{ t("onlineEvals.quality.pane.evaluatorTrace") }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="evaluatorLocation"
+          v-else-if="evaluatorLocation"
           variant="outline"
           size="xs"
           data-test="quality-score-pane-open-evaluator"
@@ -231,6 +277,7 @@ import AddToDatasetDrawer from "@/enterprise/components/AIObservability/AddToDat
 import type { QualityScore } from "@/services/online-evals.service";
 import { evaluatorTraceLink, targetLink } from "../utils/qualityFormat";
 import { useScoreFullText } from "../composables/useScoreFullText";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const props = defineProps<{
   score: QualityScore | null;
@@ -249,6 +296,7 @@ const emit = defineEmits<{
 const { t } = useI18nTyped();
 const router = useRouter();
 const orgId = useOrgId();
+const tracesLock = useLicenseLock("traces");
 // Survives score changes, so a folded reasoning stays folded while reading on.
 const reasoningOpen = ref(true);
 
diff --git a/web/src/enterprise/composables/router.spec.ts b/web/src/enterprise/composables/router.spec.ts
index 80cd52a256..c7624dd20a 100644
--- a/web/src/enterprise/composables/router.spec.ts
+++ b/web/src/enterprise/composables/router.spec.ts
@@ -20,6 +20,7 @@ import useEnvRoutes from "./router";
 vi.mock("@/utils/zincutils", () => ({
   routeGuard: vi.fn((_to: unknown, _from: unknown, next: () => void) => next()),
 }));
+vi.mock("@/stores", () => ({ default: { state: { zoConfig: {} } } }));
 vi.mock("@/enterprise/components/billings/Billing.vue", () => ({ default: { name: "Billing" } }));
 vi.mock("@/enterprise/components/billings/plans.vue", () => ({ default: { name: "Plans" } }));
 vi.mock("@/enterprise/components/billings/invoiceHistory.vue", () => ({
@@ -54,6 +55,15 @@ describe("enterprise routes: allowOnEmptyData", () => {
   );
 });
 
+describe("enterprise routes: ai_observability license", () => {
+  it.each(["/ai/llm-insights", "/ai/sessions", "/ai/session-details"])(
+    "tags %s with meta.licenseFeature so a locked license renders it locked",
+    (path) => {
+      expect(resolveMeta(path).licenseFeature).toBe("ai_observability");
+    },
+  );
+});
+
 describe("enterprise routes: removed Paid Usage page", () => {
   it("sends old /billings/paid_usage links to Plans with their query", async () => {
     const { homeChildRoutes } = useEnvRoutes();
diff --git a/web/src/enterprise/composables/router.ts b/web/src/enterprise/composables/router.ts
index 3e4f1414b1..1bfb3dd75e 100644
--- a/web/src/enterprise/composables/router.ts
+++ b/web/src/enterprise/composables/router.ts
@@ -18,6 +18,7 @@ import {
   useAIObservabilityShellRoute,
   useAIObservabilityExtraRoutes,
 } from "@/composables/shared/useAIObservabilityRoutes";
+import { withLicenseFeature } from "@/utils/featureGate";
 
 const Billing = () => import("@/enterprise/components/billings/Billing.vue");
 const Plans = () => import("@/enterprise/components/billings/plans.vue");
@@ -27,6 +28,10 @@ const BillingGroup = () => import("@/enterprise/components/billings/BillingGroup
 const AzureMarketplaceSetup = () => import("@/views/AzureMarketplaceSetup.vue");
 const AwsMarketplaceSetup = () => import("@/views/AwsMarketplaceSetup.vue");
 
+// Only this router tags the license feature: OSS's Monitor half works without a license.
+const licensedAIObservabilityShellRoute = () =>
+  withLicenseFeature("ai_observability", useAIObservabilityShellRoute());
+
 const useEnvRoutes = () => {
   // Note: AWS Marketplace registration is handled by backend at POST /api/aws-marketplace/register
   // The backend sets a cookie and redirects to Dex login
@@ -58,8 +63,10 @@ const useEnvRoutes = () => {
   ];
 
   const homeChildRoutes = [
-    useAIObservabilityShellRoute(),
-    ...useAIObservabilityExtraRoutes(),
+    licensedAIObservabilityShellRoute(),
+    ...useAIObservabilityExtraRoutes().map((route) =>
+      withLicenseFeature("ai_observability", route),
+    ),
     {
       path: "billings",
       name: "billings",
diff --git a/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.spec.ts b/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.spec.ts
index e2a07216a2..4e2db7f7c6 100644
--- a/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.spec.ts
+++ b/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.spec.ts
@@ -1,8 +1,68 @@
-import { describe, it, expect } from "vitest";
+import { afterEach, describe, it, expect, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import { createStore } from "vuex";
+import { createMemoryHistory, createRouter } from "vue-router";
+import i18n from "@/locales";
 import { buildAgentClimbFilter } from "./agentClimbFilter";
+import AgentSignalDetailPanel from "./AgentSignalDetailPanel.vue";
 
 const CALLER_EXPR = "COALESCE(c.gen_ai_agent_name, c.service_name)";
 
+describe("AgentSignalDetailPanel trace links", () => {
+  const OTableStub = {
+    props: ["data"],
+    emits: ["row-click"],
+    template: `<div><div v-for="row in data" :key="row.trace_id" data-test="row" @click="$emit('row-click', row)"><slot name="cell-trace_id" :row="row" /></div></div>`,
+  };
+
+  const mountPanel = async (features: Record<string, string>) => {
+    const router = createRouter({
+      history: createMemoryHistory(),
+      routes: [
+        { path: "/traces/details", name: "traceDetails", component: { template: "<div />" } },
+      ],
+    });
+    const wrapper = mount(AgentSignalDetailPanel, {
+      props: { open: false, row: null, sourceStream: "default", startTime: 1, endTime: 2 },
+      global: {
+        plugins: [i18n, router, createStore({ state: { zoConfig: { features } } })],
+        stubs: {
+          ODrawer: { template: "<div><slot /></div>" },
+          OTable: OTableStub,
+          OAgentBadges: true,
+        },
+      },
+    });
+    (wrapper.vm as any).$.setupState.traceRows = [{ trace_id: "t-1" }];
+    await flushPromises();
+    return wrapper;
+  };
+
+  afterEach(() => vi.restoreAllMocks());
+
+  it("shows a lock and opens nothing while the traces license is locked", async () => {
+    const open = vi.spyOn(window, "open").mockReturnValue(null);
+    const wrapper = await mountPanel({ traces: "locked" });
+
+    expect(wrapper.find('[data-test="agent-signal-detail-trace-lock"]').exists()).toBe(true);
+    await wrapper.find('[data-test="row"]').trigger("click");
+    expect(open).not.toHaveBeenCalled();
+  });
+
+  it("opens the trace in a new tab when the license enables traces", async () => {
+    const open = vi.spyOn(window, "open").mockReturnValue(null);
+    const wrapper = await mountPanel({ traces: "enabled" });
+
+    expect(wrapper.find('[data-test="agent-signal-detail-trace-lock"]').exists()).toBe(false);
+    await wrapper.find('[data-test="row"]').trigger("click");
+    expect(open).toHaveBeenCalledWith(
+      expect.stringContaining("trace_id=t-1"),
+      "_blank",
+      expect.any(String),
+    );
+  });
+});
+
 describe("buildAgentClimbFilter", () => {
   it("adds env and version clauses when both are provided", () => {
     const sql = buildAgentClimbFilter(CALLER_EXPR, "my-agent", {
diff --git a/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.vue b/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.vue
index b3449c0a22..76c716e3a5 100644
--- a/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.vue
+++ b/web/src/enterprise/views/AIObservability/AgentSignalDetailPanel.vue
@@ -128,12 +128,32 @@
           :frame="false"
           pagination="client"
           :page-size="10"
-          @row-click="openTrace"
+          v-on="rowClickListeners"
         >
           <!-- Trace id renders with an "open in new tab" icon so it's clear the
                row opens the trace in a new browser tab, not in place. -->
           <template #cell-trace_id="{ row }">
-            <span class="text-text-link inline-flex max-w-full items-center gap-1 hover:underline">
+            <span
+              v-if="tracesLock.locked.value"
+              class="text-text-secondary inline-flex max-w-full items-center gap-1"
+              aria-disabled="true"
+            >
+              <OTooltip :content="tracesLock.lockedReason.value">
+                <span class="inline-flex">
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    data-test="agent-signal-detail-trace-lock"
+                  />
+                </span>
+              </OTooltip>
+              <OTruncatedText class="font-mono">{{ row.trace_id }}</OTruncatedText>
+            </span>
+            <span
+              v-else
+              class="text-text-link inline-flex max-w-full items-center gap-1 hover:underline"
+            >
               <OIcon
                 name="open-in-new"
                 size="xs"
@@ -164,6 +184,8 @@ import searchService from "@/services/search";
 import { escapeSingleQuotes } from "@/utils/queryUtils";
 import { buildAgentClimbFilter } from "./agentClimbFilter";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 interface SignalRow {
   signalType: "loop" | "failure" | "cost";
@@ -197,6 +219,7 @@ const emit = defineEmits<{ (e: "update:open", v: boolean): void }>();
 const { t } = useI18nTyped();
 const store = useStore();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
 
 const errorRows = ref<
   Array<{
@@ -556,6 +579,7 @@ const openTrace = (row: Record<string, any>) => {
   });
   window.open(resolved.href, "_blank", "noopener,noreferrer");
 };
+const rowClickListeners = computed(() => (tracesLock.locked.value ? {} : { rowClick: openTrace }));
 
 watch(
   () => [props.open, props.row],
diff --git a/web/src/enterprise/views/AIObservability/DatasetsPage.vue b/web/src/enterprise/views/AIObservability/DatasetsPage.vue
index 4bc1861798..87ffbae2d2 100644
--- a/web/src/enterprise/views/AIObservability/DatasetsPage.vue
+++ b/web/src/enterprise/views/AIObservability/DatasetsPage.vue
@@ -294,6 +294,7 @@ import OTag from "@/lib/core/Badge/OTag.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState } from "@/utils/featureGate";
 import { useNumberedRows } from "@/enterprise/components/onlineEvals/composables/useNumberedRows";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import llmDatasetsService, { type LlmDataset } from "@/services/llm-datasets.service";
@@ -348,7 +349,7 @@ const lastUpdatedAt = datasetsList.dataUpdatedAt;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = datasetsList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 const search = ref("");
 
diff --git a/web/src/enterprise/views/AIObservability/DiscoveryPage.spec.ts b/web/src/enterprise/views/AIObservability/DiscoveryPage.spec.ts
index c6db7f922b..fd016fba76 100644
--- a/web/src/enterprise/views/AIObservability/DiscoveryPage.spec.ts
+++ b/web/src/enterprise/views/AIObservability/DiscoveryPage.spec.ts
@@ -91,7 +91,9 @@ vi.mock("@/lib/core/Table/OTable.vue", () => ({
     template: `<div class="o-table" :data-table-id="tableId" :data-total="totalCount"
       :data-page="currentPage" :data-pagination="pagination"
       :data-columns="(columns || []).map(c => c.id).join(',')">
-      <slot name="toolbar" /><slot name="selection-actions" /><slot name="footer-note" /></div>`,
+      <slot name="toolbar" /><slot name="selection-actions" /><slot name="footer-note" />
+      <div v-for="row in data || []" class="o-row" @click="$emit('rowClick', row)">
+        <slot name="cell-trace" :row="row" /></div></div>`,
   },
 }));
 
@@ -151,9 +153,13 @@ function searchResult(overrides: Record<string, unknown> = {}) {
   };
 }
 
-async function mountPage() {
+// The lock composable loads before this file's vuex mock, so it reads the real injected store.
+async function mountPage(features: Record<string, string> = {}) {
   const wrapper = mount(DiscoveryPage, {
-    global: { stubs: { OTabs: true, OTab: true, OEmptyState: true, OTag: true, OTimeCell: true } },
+    global: {
+      stubs: { OTabs: true, OTab: true, OEmptyState: true, OTag: true, OTimeCell: true },
+      provide: { store: { state: { zoConfig: { features } } } },
+    },
   });
   await flushPromises();
   return wrapper;
@@ -504,4 +510,26 @@ describe("DiscoveryPage row drill-down", () => {
       },
     });
   });
+
+  // OTable keys the row pointer cursor on whether a row-click listener is bound.
+  const rowListener = (wrapper: Awaited<ReturnType<typeof mountPage>>) =>
+    wrapper.findComponent({ name: "OTable" }).vm.$.vnode.props?.onRowClick;
+
+  it("drops the row affordance, shows the lock and opens nothing while traces are locked", async () => {
+    const wrapper = await mountPage({ traces: "locked" });
+
+    expect(rowListener(wrapper)).toBeUndefined();
+    expect(wrapper.find('[data-test="ai-discovery-row-lock"]').exists()).toBe(true);
+    await wrapper.find(".o-row").trigger("click");
+    expect(mockPush).not.toHaveBeenCalled();
+  });
+
+  it("keeps rows clickable with no lock when the license enables traces", async () => {
+    const wrapper = await mountPage({ traces: "enabled" });
+
+    expect(rowListener(wrapper)).toBeTypeOf("function");
+    expect(wrapper.find('[data-test="ai-discovery-row-lock"]').exists()).toBe(false);
+    await wrapper.find(".o-row").trigger("click");
+    expect(mockPush).toHaveBeenCalledWith(expect.objectContaining({ name: "traceDetails" }));
+  });
 });
diff --git a/web/src/enterprise/views/AIObservability/DiscoveryPage.vue b/web/src/enterprise/views/AIObservability/DiscoveryPage.vue
index 4513c4d3d6..d16c71b31a 100644
--- a/web/src/enterprise/views/AIObservability/DiscoveryPage.vue
+++ b/web/src/enterprise/views/AIObservability/DiscoveryPage.vue
@@ -75,7 +75,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         @update:selected-ids="selectedIds = $event"
         @update:current-page="onPageChange"
         @update:page-size="onPageSizeChange"
-        @row-click="openTarget"
+        v-on="rowClickListeners"
       >
         <!-- Search stretches so the queue filter and the column toggle OTable
              injects after this slot both sit at the right edge. -->
@@ -123,39 +123,75 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </template>
 
         <template #cell-span="{ row }">
-          <div class="flex min-w-0 flex-col">
-            <OTruncatedText class="font-mono text-xs">{{
-              textOrDash(row.operationName)
-            }}</OTruncatedText>
-            <OTruncatedText v-if="row.traceId" class="text-text-secondary text-2xs">
-              {{ t("aiObservability.discovery.spanParent", { trace: row.traceId }) }}
-            </OTruncatedText>
+          <div class="flex min-w-0 items-center">
+            <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+              <span class="me-1.5 inline-flex shrink-0">
+                <OIcon
+                  name="lock"
+                  class="text-icon-locked"
+                  size="sm"
+                  data-test="ai-discovery-row-lock"
+                />
+              </span>
+            </OTooltip>
+            <div class="flex min-w-0 flex-col">
+              <OTruncatedText class="font-mono text-xs">{{
+                textOrDash(row.operationName)
+              }}</OTruncatedText>
+              <OTruncatedText v-if="row.traceId" class="text-text-secondary text-2xs">
+                {{ t("aiObservability.discovery.spanParent", { trace: row.traceId }) }}
+              </OTruncatedText>
+            </div>
           </div>
         </template>
 
         <template #cell-trace="{ row }">
-          <div class="flex min-w-0 flex-col">
-            <OTruncatedText class="font-mono text-xs">{{
-              textOrDash(row.operationName)
-            }}</OTruncatedText>
-            <!-- Annotation-only traces have no trace_id on their scores; a trace row's targetId is the trace id. -->
-            <OTruncatedText
-              v-if="row.traceId || row.targetId"
-              class="text-text-secondary text-2xs font-mono"
-            >
-              {{ raw(row.traceId || row.targetId) }}
-            </OTruncatedText>
+          <div class="flex min-w-0 items-center">
+            <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+              <span class="me-1.5 inline-flex shrink-0">
+                <OIcon
+                  name="lock"
+                  class="text-icon-locked"
+                  size="sm"
+                  data-test="ai-discovery-row-lock"
+                />
+              </span>
+            </OTooltip>
+            <div class="flex min-w-0 flex-col">
+              <OTruncatedText class="font-mono text-xs">{{
+                textOrDash(row.operationName)
+              }}</OTruncatedText>
+              <!-- Annotation-only traces have no trace_id on their scores; a trace row's targetId is the trace id. -->
+              <OTruncatedText
+                v-if="row.traceId || row.targetId"
+                class="text-text-secondary text-2xs font-mono"
+              >
+                {{ raw(row.traceId || row.targetId) }}
+              </OTruncatedText>
+            </div>
           </div>
         </template>
 
         <template #cell-session="{ row }">
-          <div class="flex min-w-0 flex-col">
-            <OTruncatedText class="font-mono text-xs">{{
-              textOrDash(row.sessionId)
-            }}</OTruncatedText>
-            <OTruncatedText v-if="row.userEmail" class="text-text-secondary text-2xs">
-              {{ raw(row.userEmail) }}
-            </OTruncatedText>
+          <div class="flex min-w-0 items-center">
+            <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+              <span class="me-1.5 inline-flex shrink-0">
+                <OIcon
+                  name="lock"
+                  class="text-icon-locked"
+                  size="sm"
+                  data-test="ai-discovery-row-lock"
+                />
+              </span>
+            </OTooltip>
+            <div class="flex min-w-0 flex-col">
+              <OTruncatedText class="font-mono text-xs">{{
+                textOrDash(row.sessionId)
+              }}</OTruncatedText>
+              <OTruncatedText v-if="row.userEmail" class="text-text-secondary text-2xs">
+                {{ raw(row.userEmail) }}
+              </OTruncatedText>
+            </div>
           </div>
         </template>
 
@@ -276,12 +312,18 @@ import llmDiscoveryService, {
 import llmQueuesService, { type LlmQueue } from "@/services/llm-queues.service";
 import { formatTimeWithSuffix } from "@/utils/formatters";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 
 defineOptions({ name: "AIDiscoveryPage" });
 
 const { t } = useI18nTyped();
 const store = useStore();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
+// Without a row-click listener OTable drops the pointer cursor, so locked rows stop looking clickable.
+const rowClickListeners = computed(() => (tracesLock.locked.value ? {} : { rowClick: openTarget }));
 
 const orgId = computed<string>(() => store.state.selectedOrganization?.identifier ?? "");
 const orgQuery = computed(() => ({ org_identifier: orgId.value }));
@@ -639,6 +681,7 @@ function onDateChange(value: any) {
 const TRACE_WINDOW_US = 3_600_000_000;
 
 function openTarget(row: LlmDiscoveryItem) {
+  if (tracesLock.locked.value) return;
   // The detail views read stream + from/to straight off the URL — without them
   // the search has no stream and a NaN window, which renders as "trace not
   // found". `sourceStream` is the stream the row was discovered in.
diff --git a/web/src/enterprise/views/AIObservability/Index.vue b/web/src/enterprise/views/AIObservability/Index.vue
index b60d157de8..aa84b63c56 100644
--- a/web/src/enterprise/views/AIObservability/Index.vue
+++ b/web/src/enterprise/views/AIObservability/Index.vue
@@ -152,6 +152,7 @@ const sectionItems = computed<(SectionHubItem & { group: string })[]>(() => {
       group: section.group,
       locked,
       lockedMessage,
+      lockedLabel: locked ? lockedMessage : undefined,
     };
   });
 });
diff --git a/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.nav.spec.ts b/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.nav.spec.ts
index 74defe99fd..b05a23baf5 100644
--- a/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.nav.spec.ts
+++ b/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.nav.spec.ts
@@ -45,8 +45,10 @@ vi.mock("vuex", () => ({
   useStore: vi.fn(() => ({ state: { selectedOrganization: { identifier: "test-org" } } })),
 }));
 
+const mockPush = vi.hoisted(() => vi.fn());
+
 vi.mock("vue-router", () => ({
-  useRouter: vi.fn(() => ({ push: vi.fn() })),
+  useRouter: vi.fn(() => ({ push: mockPush })),
   useRoute: vi.fn(() => ({ params: { id: "q1" }, query: {} })),
 }));
 
@@ -84,9 +86,11 @@ function item(overrides: Record<string, unknown>) {
   };
 }
 
-async function mountPage() {
+// The lock composable loads before this file's vuex mock, so it reads the real injected store.
+async function mountPage(features: Record<string, string> = {}) {
   const wrapper = mount(QueueWorkbenchPage, {
     global: {
+      provide: { store: { state: { zoConfig: { features } } } },
       stubs: {
         OTabs: { template: `<div><slot /></div>` },
         OTab: { template: `<div class="o-tab"><slot /></div>` },
@@ -168,3 +172,43 @@ describe("QueueWorkbenchPage item navigator", () => {
     );
   });
 });
+
+describe("QueueWorkbenchPage open trace", () => {
+  const withDetail = () => {
+    const current = item({ id: "a", refId: "trace-a" });
+    mockListItems.mockResolvedValue([current]);
+    mockGetItemDetail.mockResolvedValue({
+      item: current,
+      sourceStream: "traces",
+      content: { input: null, output: null, trace: [] },
+      machineScores: [],
+      reviews: [],
+    });
+  };
+
+  beforeEach(() => mockPush.mockReset());
+
+  it("is a disabled lock that opens nothing while the traces license is locked", async () => {
+    withDetail();
+    const wrapper = await mountPage({ traces: "locked" });
+
+    // OTooltip is stubbed bare here, so the live button vanishing is what proves the locked branch rendered.
+    expect(wrapper.find('[data-test="ai-queue-workbench-open-trace"]').exists()).toBe(false);
+    (wrapper.vm as any).$.setupState.openTrace();
+    expect(mockPush).not.toHaveBeenCalled();
+  });
+
+  it("opens the trace when the license enables traces", async () => {
+    withDetail();
+    const wrapper = await mountPage({ traces: "enabled" });
+
+    expect(wrapper.find('[data-test="ai-queue-workbench-open-trace"]').exists()).toBe(true);
+    (wrapper.vm as any).$.setupState.openTrace();
+    expect(mockPush).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "traceDetails",
+        query: expect.objectContaining({ trace_id: "trace-a" }),
+      }),
+    );
+  });
+});
diff --git a/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.vue b/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.vue
index 874178c2b5..38c93481e0 100644
--- a/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.vue
+++ b/web/src/enterprise/views/AIObservability/QueueWorkbenchPage.vue
@@ -205,7 +205,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   >
                     {{ itemTitle }}
                   </OTruncatedText>
+                  <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+                    <span class="inline-flex shrink-0">
+                      <OButton
+                        variant="outline"
+                        size="sm"
+                        disabled
+                        data-test="ai-queue-workbench-open-trace"
+                      >
+                        <template #icon-left>
+                          <OIcon
+                            name="lock"
+                            class="text-icon-locked"
+                            size="sm"
+                            data-test="ai-queue-workbench-open-trace-lock"
+                          />
+                        </template>
+                        {{ t("aiObservability.queues.workbench.openTrace") }}
+                      </OButton>
+                    </span>
+                  </OTooltip>
                   <OButton
+                    v-else
                     variant="outline"
                     size="sm"
                     icon-left="open-in-new"
@@ -726,6 +747,7 @@ import {
 import { useMutation } from "@tanstack/vue-query";
 import { toggleFullscreen as domToggleFullscreen } from "@/utils/dom";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 defineOptions({ name: "AIQueueWorkbenchPage" });
 
@@ -737,6 +759,7 @@ const quoted = (comment: string) => raw(`“${comment}”`);
 const store = useStore();
 const route = useRoute();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
 
 const orgId = computed<string>(() => store.state.selectedOrganization?.identifier ?? "");
 const queueId = computed<string>(() => String(route.params.id ?? ""));
@@ -1245,7 +1268,7 @@ async function refresh() {
 function openTrace() {
   const item = currentItem.value;
   const detail = currentDetail.value;
-  if (!item || !detail) return;
+  if (!item || !detail || tracesLock.locked.value) return;
   const query = {
     stream: detail.sourceStream,
     from: item.refTraceStartTime,
diff --git a/web/src/enterprise/views/AIObservability/QueuesPage.vue b/web/src/enterprise/views/AIObservability/QueuesPage.vue
index 70aa0ef0be..3c5a344b76 100644
--- a/web/src/enterprise/views/AIObservability/QueuesPage.vue
+++ b/web/src/enterprise/views/AIObservability/QueuesPage.vue
@@ -371,6 +371,7 @@ import OFormInput from "@/lib/forms/Input/OFormInput.vue";
 import OFormTextarea from "@/lib/forms/Input/OFormTextarea.vue";
 import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState } from "@/utils/featureGate";
 import { useNumberedRows } from "@/enterprise/components/onlineEvals/composables/useNumberedRows";
 import llmQueuesService, {
   type LlmQueue,
@@ -408,7 +409,7 @@ const lastUpdatedAt = queuesList.dataUpdatedAt;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = queuesList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 const search = ref("");
 
diff --git a/web/src/enterprise/views/AIObservability/RemoteTasksPage.vue b/web/src/enterprise/views/AIObservability/RemoteTasksPage.vue
index d6a409ba0a..da70d44852 100644
--- a/web/src/enterprise/views/AIObservability/RemoteTasksPage.vue
+++ b/web/src/enterprise/views/AIObservability/RemoteTasksPage.vue
@@ -259,6 +259,7 @@ import { useEditorDraftIds } from "@/composables/useEditorDraft";
 import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
 import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import { useNumberedRows } from "@/enterprise/components/onlineEvals/composables/useNumberedRows";
 import remoteTasksService, { type RemoteTask } from "@/services/remote-tasks.service";
@@ -294,7 +295,7 @@ const orgId = computed<string>(() => store.state.selectedOrganization?.identifie
 const tasks = ref<RemoteTask[]>([]);
 const lastUpdatedAt = ref<number | null>(null);
 const loading = ref(false);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const search = ref("");
 const taskDrafts = useEditorDraftIds("remote_task");
 
@@ -487,7 +488,7 @@ async function refresh(force = false) {
     tasks.value = await queryClient.fetchQuery(opts);
     lastUpdatedAt.value = queryClient.getQueryState(opts.queryKey)?.dataUpdatedAt ?? Date.now();
   } catch (error: any) {
-    forbidden.value = error?.response?.status === 403;
+    forbidden.value = forbiddenState(error);
     if (!forbidden.value) {
       toast({
         variant: "error",
diff --git a/web/src/layouts/MainLayout.nav.spec.ts b/web/src/layouts/MainLayout.nav.spec.ts
index c4c5991ba4..191c2cf2f7 100644
--- a/web/src/layouts/MainLayout.nav.spec.ts
+++ b/web/src/layouts/MainLayout.nav.spec.ts
@@ -13,7 +13,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import config from "@/aws-exports";
 import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
 import { defineComponent, h } from "vue";
 import store from "@/test/unit/helpers/store";
@@ -22,6 +23,8 @@ import router from "@/test/unit/helpers/router";
 import { iconRegistry } from "@/lib/core/Icon/OIcon.icons";
 import { groupNavLinks, NAV_GROUPS } from "@/lib/core/Navbar/navGroups";
 import type { NavItem, RailEntry } from "@/lib/core/Navbar/ONavbar.types";
+import { toastRecords, dismissAll } from "@/lib/feedback/Toast/useToast";
+import { addLicenseDeniedError, clearLicenseDenials } from "@/composables/useLicenseDenials";
 
 vi.mock("@/services/config", () => ({
   default: { get_config_full: vi.fn(() => new Promise(() => {})) },
@@ -34,6 +37,7 @@ vi.mock("@openobserve/browser-rum", () => ({
 import MainLayout from "./MainLayout.vue";
 
 const StubDiv = defineComponent({ setup: () => () => h("div") });
+const RoutedPage = defineComponent({ setup: () => () => h("div", { "data-test": "routed-page" }) });
 const NavbarStub = defineComponent({
   name: "ONavbar",
   props: { linksList: { type: Array, default: () => [] }, loading: Boolean },
@@ -43,7 +47,7 @@ const NavbarStub = defineComponent({
 describe("MainLayout — Product Analytics menu entry", () => {
   let wrapper: VueWrapper | undefined;
 
-  const railItems = async (): Promise<NavItem[]> => {
+  const railItems = async (realRouterView = false): Promise<NavItem[]> => {
     wrapper = mount(MainLayout, {
       global: {
         plugins: [store, i18n, router],
@@ -60,7 +64,7 @@ describe("MainLayout — Product Analytics menu entry", () => {
           SlackIcon: StubDiv,
           ManagementIcon: StubDiv,
           ODialog: StubDiv,
-          "router-view": StubDiv,
+          ...(realRouterView ? {} : { "router-view": StubDiv }),
         },
       },
     });
@@ -150,6 +154,211 @@ describe("MainLayout — Product Analytics menu entry", () => {
     expect(tileNames(entries)).not.toContain("productAnalytics");
   });
 
+  describe("license-gated entries", () => {
+    // The license map only applies on an enterprise or cloud build, and CI runs with neither set.
+    const edition = config.isEnterprise;
+    beforeEach(() => {
+      config.isEnterprise = "true";
+    });
+    afterEach(() => {
+      config.isEnterprise = edition;
+      delete store.state.zoConfig.features;
+      dismissAll();
+      clearLicenseDenials();
+    });
+
+    it("keeps a locked feature on the rail with a lock, pointing at its own page", async () => {
+      store.state.zoConfig.features = { incidents: "locked" };
+      const incidents = (await railItems()).find((l) => l.name === "incidentList");
+      expect(incidents).toMatchObject({
+        link: "/incidents",
+        locked: false,
+        licenseLocked: true,
+      });
+    });
+
+    it("locks the page whose route needs a locked feature, and only while it is locked", async () => {
+      router.addRoute({
+        path: "/locked-probe",
+        name: "lockedProbe",
+        component: StubDiv,
+        meta: { licenseFeature: "workflows" },
+      });
+      await router.push("/locked-probe");
+      store.state.zoConfig.features = { workflows: "locked" };
+      await railItems();
+      (wrapper!.vm as any).isLoading = true;
+      await flushPromises();
+      expect((wrapper!.vm as any).lockedFeature).toBe("workflows");
+      addLicenseDeniedError(["alerts"]);
+      await flushPromises();
+      // A locked page shows its own message, so a background denial raises no toast.
+      expect(toastRecords).toHaveLength(0);
+      store.state.zoConfig.features = { workflows: "enabled" };
+      await flushPromises();
+      expect((wrapper!.vm as any).lockedFeature).toBeNull();
+      await router.push("/");
+      router.removeRoute("lockedProbe");
+    });
+
+    it("locks a stream-typed page by its stream_type query, and re-evaluates on a query-only change", async () => {
+      router.addRoute({
+        path: "/stream-probe",
+        name: "streamProbe",
+        component: StubDiv,
+        meta: { licenseFeatureFromStreamType: true },
+      });
+      store.state.zoConfig.features = { logs: "locked", metrics: "enabled" };
+      await router.push("/stream-probe");
+      await railItems();
+      (wrapper!.vm as any).isLoading = true;
+      await flushPromises();
+      const lockedFeature = () => (wrapper!.vm as any).lockedFeature;
+      expect(lockedFeature()).toBe("logs");
+      await router.push({ path: "/stream-probe", query: { stream_type: "enrichment_tables" } });
+      expect(lockedFeature()).toBeNull();
+      await router.push({ path: "/stream-probe", query: { stream_type: "metrics" } });
+      expect(lockedFeature()).toBeNull();
+      await router.push({ path: "/stream-probe", query: { stream_type: "logs" } });
+      expect(lockedFeature()).toBe("logs");
+      await router.push("/");
+      router.removeRoute("streamProbe");
+    });
+
+    it("leaves a stream-typed page free while its stream type is enabled", async () => {
+      router.addRoute({
+        path: "/stream-free",
+        name: "streamFree",
+        component: StubDiv,
+        meta: { licenseFeatureFromStreamType: true },
+      });
+      store.state.zoConfig.features = { logs: "enabled" };
+      await router.push("/stream-free");
+      await railItems();
+      expect((wrapper!.vm as any).lockedFeature).toBeNull();
+      await router.push("/");
+      router.removeRoute("streamFree");
+    });
+
+    it("clears license denials on a path change, ignores the old page's late ones", async () => {
+      router.addRoute({ path: "/denial-a", name: "denialA", component: StubDiv });
+      router.addRoute({ path: "/denial-b", name: "denialB", component: StubDiv });
+      await router.push("/denial-a");
+      await railItems();
+      (wrapper!.vm as any).isLoading = true;
+      addLicenseDeniedError(["oncall"]);
+      await flushPromises();
+      expect(toastRecords.map((r) => r.variant)).toEqual(["warning"]);
+      await router.push({ path: "/denial-a", query: { period: "15m" } });
+      await flushPromises();
+      addLicenseDeniedError(["oncall"]);
+      expect(toastRecords).toHaveLength(1);
+      const startedOnA = Date.now() - 1;
+      await router.push("/denial-b");
+      await flushPromises();
+      addLicenseDeniedError(["oncall"], startedOnA);
+      expect(toastRecords).toHaveLength(1);
+      dismissAll();
+      addLicenseDeniedError(["oncall"]);
+      expect(toastRecords).toHaveLength(1);
+      await router.push("/");
+      router.removeRoute("denialA");
+      router.removeRoute("denialB");
+    });
+
+    it("keeps a license-locked Downtimes entry, though its flag is off, pointing at its page", async () => {
+      store.state.zoConfig.downtimes_enabled = false;
+      store.state.zoConfig.features = { alerts: "locked" };
+      const downtimes = (await railItems()).find((l) => l.name === "downtimes");
+      expect(downtimes).toMatchObject({ link: "/downtimes", licenseLocked: true });
+      delete store.state.zoConfig.downtimes_enabled;
+    });
+
+    it("keeps the AI entry with online evals off, since Monitor needs no flag", async () => {
+      store.state.zoConfig.online_evals_enabled = false;
+      const ai = (await railItems()).find((l) => l.name === "aiObservability");
+      expect(ai).toMatchObject({ link: "/ai", licenseLocked: false });
+      delete store.state.zoConfig.online_evals_enabled;
+    });
+
+    it("locks the AI entry when ai_observability is locked, and drops it when hidden", async () => {
+      store.state.zoConfig.features = { ai_observability: "locked" };
+      const ai = (await railItems()).find((l) => l.name === "aiObservability");
+      expect(ai).toMatchObject({ link: "/ai", licenseLocked: true });
+      wrapper?.unmount();
+      store.state.zoConfig.features = { ai_observability: "hidden" };
+      expect((await railItems()).map((l) => l.name)).not.toContain("aiObservability");
+    });
+
+    it.each([
+      ["logs", "logs", "/logs"],
+      ["metrics", "metrics", "/metrics"],
+      ["traces", "traces", "/traces"],
+      ["rum", "rum", "/rum"],
+      ["productAnalytics", "product_analytics", "/product-analytics"],
+      ["dashboards", "dashboards", "/dashboards"],
+      ["reports", "reports", "/reports"],
+      ["alertList", "alerts", "/alerts"],
+      ["sloList", "anomaly_detection", "/slos"],
+    ])(
+      "locks the %s entry when %s is locked, and drops it when hidden",
+      async (name, key, link) => {
+        store.state.zoConfig.features = { [key]: "locked" };
+        const entry = (await railItems()).find((l) => l.name === name);
+        expect(entry).toMatchObject({ link, licenseLocked: true });
+        wrapper?.unmount();
+        store.state.zoConfig.features = { [key]: "hidden" };
+        expect((await railItems()).map((l) => l.name)).not.toContain(name);
+      },
+    );
+
+    it("adds no lock to a static entry whose feature is enabled", async () => {
+      store.state.zoConfig.features = { dashboards: "enabled" };
+      const entry = (await railItems()).find((l) => l.name === "dashboards");
+      expect(entry).not.toHaveProperty("licenseLocked");
+    });
+
+    it("re-applies the lock when the license arrives after mount", async () => {
+      const before = (await railItems()).find((l) => l.name === "dashboards");
+      expect(before).not.toHaveProperty("licenseLocked");
+      store.state.zoConfig.features = { dashboards: "locked" };
+      await flushPromises();
+      const links = wrapper!.findAllComponents(NavbarStub)[0].props("linksList") as NavItem[];
+      expect(links.find((l) => l.name === "dashboards")).toMatchObject({ licenseLocked: true });
+    });
+
+    it("keeps a license-locked Synthetics entry, though its flag is off", async () => {
+      store.state.zoConfig.synthetics_enabled = false;
+      store.state.zoConfig.features = { synthetics: "locked" };
+      const synthetics = (await railItems()).find((l) => l.name === "synthetics");
+      expect(synthetics).toMatchObject({ link: "/synthetics", licenseLocked: true });
+    });
+
+    it("keeps Synthetics unlocked with its flag on, and drops it when hidden", async () => {
+      store.state.zoConfig.synthetics_enabled = true;
+      const synthetics = (await railItems()).find((l) => l.name === "synthetics");
+      expect(synthetics).toMatchObject({ link: "/synthetics", licenseLocked: false });
+      wrapper?.unmount();
+      store.state.zoConfig.features = { synthetics: "hidden" };
+      expect((await railItems()).map((l) => l.name)).not.toContain("synthetics");
+    });
+
+    it("keeps a license-locked Profiles entry, though its flag is off", async () => {
+      store.state.zoConfig.profiling_enabled = false;
+      store.state.zoConfig.features = { continuous_profiling: "locked" };
+      const profiles = (await railItems()).find((l) => l.name === "profiles");
+      expect(profiles).toMatchObject({ link: "/profiles", licenseLocked: true });
+      delete store.state.zoConfig.profiling_enabled;
+    });
+
+    it("leaves a hidden or unsent feature off the rail", async () => {
+      store.state.zoConfig.features = { workflows: "hidden" };
+      const names = (await railItems()).map((l) => l.name);
+      expect(names).not.toContain("workflows");
+      expect(names).not.toContain("incidentList");
+    });
+  });
+
   it("uses only registered icons on the Experience tile and its children", async () => {
     const experience = NAV_GROUPS.find((g) => g.key === "experience")!;
     for (const icon of [experience.icon, ...experience.children.map((c) => c.icon)]) {
diff --git a/web/src/layouts/MainLayout.spec.ts b/web/src/layouts/MainLayout.spec.ts
index be8ece6959..8c9a14a4aa 100644
--- a/web/src/layouts/MainLayout.spec.ts
+++ b/web/src/layouts/MainLayout.spec.ts
@@ -1857,50 +1857,7 @@ describe("MainLayout Methods and Functions", () => {
   });
 });
 
-// The AI Observability nav entry's visibility formula, pinned as a pure
-// predicate (mirroring this file's own style for computed-property logic
-// elsewhere): `isOnlineEvalsEnabled.value || isOssBuild`, where
-// `isOnlineEvalsEnabled = (isEnterprise || isCloud) && online_evals_enabled`
-// and `isOssBuild = !(isEnterprise || isCloud)`. A true OSS build always
-// shows the menu (Monitor ships there with no backend flag); enterprise/cloud
-// still gate the FULL module behind the online_evals_enabled flag as before.
-describe("MainLayout — AI Observability menu visibility (isAiObservabilityMenuVisible)", () => {
-  function isAiObservabilityMenuVisible(
-    isEnterprise: "true" | "false",
-    isCloud: "true" | "false",
-    onlineEvalsEnabled: boolean,
-  ): boolean {
-    const isEnterpriseOrCloud = isEnterprise === "true" || isCloud === "true";
-    const isOnlineEvalsEnabled = isEnterpriseOrCloud && onlineEvalsEnabled;
-    const isOssBuild = !isEnterpriseOrCloud;
-    return isOnlineEvalsEnabled || isOssBuild;
-  }
-
-  it("shows the menu on a true OSS build regardless of the online_evals_enabled flag", () => {
-    expect(isAiObservabilityMenuVisible("false", "false", false)).toBe(true);
-    expect(isAiObservabilityMenuVisible("false", "false", true)).toBe(true);
-  });
-
-  it("hides the menu on an enterprise build when online_evals_enabled is false", () => {
-    expect(isAiObservabilityMenuVisible("true", "false", false)).toBe(false);
-  });
-
-  it("shows the menu on an enterprise build only once online_evals_enabled is true", () => {
-    expect(isAiObservabilityMenuVisible("true", "false", true)).toBe(true);
-  });
-
-  it("hides the menu on a cloud build when online_evals_enabled is false", () => {
-    expect(isAiObservabilityMenuVisible("false", "true", false)).toBe(false);
-  });
-
-  it("shows the menu on a cloud build once online_evals_enabled is true", () => {
-    expect(isAiObservabilityMenuVisible("false", "true", true)).toBe(true);
-  });
-
-  it("shows the menu when both isEnterprise and isCloud are true and the flag is on", () => {
-    expect(isAiObservabilityMenuVisible("true", "true", true)).toBe(true);
-  });
-
+describe("MainLayout — rail source", () => {
   // The rail is built inside setup() from literals, so the icon set is pinned on the source.
   describe("rail icons (AC-20)", () => {
     const source = readFileSync(resolve(__dirname, "./MainLayout.vue"), "utf8");
diff --git a/web/src/layouts/MainLayout.vue b/web/src/layouts/MainLayout.vue
index 30ad4b567d..0098d19d64 100644
--- a/web/src/layouts/MainLayout.vue
+++ b/web/src/layouts/MainLayout.vue
@@ -186,17 +186,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 @dismiss="firstDataNotice.dismiss"
               />
               <!-- Enter-only fade; the body's slide lives in OPageLayout so the header stays put. -->
-              <router-view v-slot="{ Component }">
-                <OAccessBoundary>
-                  <keep-alive :include="KEPT_ALIVE_VIEWS">
-                    <component
-                      :is="Component"
-                      :class="[ENTER_FADE, 'h-full']"
-                      @sendToAiChat="sendToAiChat"
-                    />
-                  </keep-alive>
-                </OAccessBoundary>
-              </router-view>
+              <FeatureLockBoundary :feature="lockedFeature">
+                <router-view v-slot="{ Component }">
+                  <OAccessBoundary>
+                    <keep-alive :include="KEPT_ALIVE_VIEWS">
+                      <component
+                        :is="Component"
+                        :class="[ENTER_FADE, 'h-full']"
+                        @sendToAiChat="sendToAiChat"
+                      />
+                    </keep-alive>
+                  </OAccessBoundary>
+                </router-view>
+              </FeatureLockBoundary>
             </div>
             <div
               v-else
@@ -279,6 +281,7 @@ import { orgSettingsQuery } from "@/services/organizations.queries";
 import ONavbar from "@/lib/core/Navbar/ONavbar.vue";
 import { ENTER_FADE } from "@/lib/styles/motion";
 import type { NavItem } from "@/lib/core/Navbar/ONavbar.types";
+import { featureState, menuState, streamTypeFeature, type FeatureState } from "@/utils/featureGate";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 import AppHeader from "../components/Header.vue";
 import OAccessBoundary from "@/components/access/OAccessBoundary.vue";
@@ -345,6 +348,8 @@ import ManagementIcon from "@/components/icons/ManagementIcon.vue";
 import useStreams from "@/composables/useStreams";
 import { userDataStreams } from "@/utils/internalStreams";
 import FirstDataNotice from "@/components/ingestion/FirstDataNotice.vue";
+import FeatureLockBoundary from "@/components/common/FeatureLockBoundary.vue";
+import { clearLicenseDenials } from "@/composables/useLicenseDenials";
 import { dashboardSaveConflictState } from "@/composables/dashboard/dashboardSaveConflictState";
 import {
   FIRST_DATA_NOTICE,
@@ -405,6 +410,7 @@ export default defineComponent({
     OSkeleton,
     FirstDataNotice,
     EditorDraftSignOutDialog,
+    FeatureLockBoundary,
     DashboardSaveConflictDialog: defineAsyncComponent(
       () => import("@/components/dashboards/DashboardSaveConflictDialog.vue"),
     ),
@@ -518,44 +524,31 @@ export default defineComponent({
       layoutStreams,
     );
     provide(FIRST_DATA_NOTICE, firstDataNotice);
-    const isIncidentsEnabled = computed(() => {
-      return (
-        (config.isEnterprise == "true" || config.isCloud == "true") &&
-        store.state.zoConfig.incidents_enabled
-      );
+    const isEnterpriseOrCloud = config.isEnterprise == "true" || config.isCloud == "true";
+    // Locked and hidden come from the license `features` map; the enabled path keeps the legacy flag for older backends.
+    const features = computed(() => store.state.zoConfig?.features);
+    // `route.meta` merges every matched record, so a gated parent locks its child pages too.
+    const lockedFeature = computed<string | null>(() => {
+      const { meta, query } = router.currentRoute.value;
+      const key = meta?.licenseFeatureFromStreamType
+        ? streamTypeFeature(query.stream_type as string | undefined)
+        : meta?.licenseFeature;
+      return typeof key === "string" && featureState(features.value, key) === "locked" ? key : null;
     });
+    const isIncidentsEnabled = computed(
+      () => isEnterpriseOrCloud && !!store.state.zoConfig.incidents_enabled,
+    );
 
-    // Workflows — enterprise/cloud only (FD3). Build-time gate, no runtime flag.
-    // Enterprise/cloud build AND the backend `/config` flag `workflows_enabled`
-    // (enterprise `O2_WORKFLOWS_ENABLED`). Reactive so the menu picks it up
-    // regardless of whether the config response arrived before or after mount.
     // `=== true`, not truthy: /config is fetched without await, so the flag is
     // briefly undefined and the entry must stay hidden rather than flash in.
     const isWorkflowsEnabled = computed(
-      () =>
-        (config.isEnterprise == "true" || config.isCloud == "true") &&
-        store.state.zoConfig?.workflows_enabled === true,
+      () => isEnterpriseOrCloud && store.state.zoConfig?.workflows_enabled === true,
     );
 
-    // Backend `/config` flag `online_evals_enabled` — controlled by
-    // enterprise `O2_EVAL_ENABLED`. Reactive so the menu picks it up regardless
-    // of whether the config response arrived before or after this component
-    // mounted.
-    const isOnlineEvalsEnabled = computed(() => {
-      return (
-        (config.isEnterprise == "true" || config.isCloud == "true") &&
-        Boolean(store.state.zoConfig?.online_evals_enabled)
-      );
-    });
-
-    // The AI Observability menu entry itself ships on true OSS builds too —
-    // Monitor (LLM Insights + Sessions) needs no backend flag, unlike the rest
-    // of the module. AIObservabilityShell (Index.vue) renders Evaluate/
-    // Experiment/Annotate/Agent Graph/Agent Behavior too, but locked (lock
-    // icon + tooltip) rather than hidden, so this entry point itself doesn't
-    // need to wait on `isOnlineEvalsEnabled` for those.
-    const isOssBuild = !(config.isEnterprise == "true" || config.isCloud == "true");
-    const isAiObservabilityMenuVisible = computed(() => isOnlineEvalsEnabled.value || isOssBuild);
+    // Monitor needs no flag or (on OSS) license; the eval sections gate on `online_evals_enabled` themselves.
+    const aiObservabilityMenuState = computed<FeatureState>(() =>
+      isEnterpriseOrCloud ? featureState(features.value, "ai_observability") : "enabled",
+    );
 
     // Backend `/config` flag `synthetics_enabled` — `ZO_SYNTHETICS_ENABLED`, and
     // no longer an enterprise build check: synthetics ships in OSS, and only the
@@ -938,6 +931,17 @@ export default defineComponent({
       }
     });
 
+    // One idempotent add/update/remove for a license-gated entry; `insertAt` returns -1 to skip.
+    const syncFeatureLink = (item: NavItem, state: FeatureState, insertAt: () => number) => {
+      const existingIndex = linksList.value.findIndex((link) => link.name === item.name);
+      // Removed, not just skipped: the menu is rebuilt on org switch and the state can change.
+      if (existingIndex !== -1) linksList.value.splice(existingIndex, 1);
+      if (state === "hidden") return;
+      const at = insertAt();
+      if (at === -1) return;
+      linksList.value.splice(at, 0, { ...item, licenseLocked: state === "locked" });
+    };
+
     // Shows the entry — locked, if this edition doesn't unlock `featureKey` —
     // whenever `enabledByRuntimeFlag` is true OR the edition flat-out doesn't
     // unlock it (so the locked entry stays discoverable rather than only
@@ -953,7 +957,13 @@ export default defineComponent({
     ) => {
       const existingIndex = linksList.value.findIndex((link) => link.name === name);
       const access = checkFeatureAccess(featureKey, buildFeatureGateContext(store.state.zoConfig));
-      const shouldShow = enabledByRuntimeFlag || !access.allowed;
+      // The license map applies once the edition allows the feature; a locked license also turns its runtime flag off.
+      const license = access.allowed ? featureState(features.value, featureKey) : "enabled";
+      const locked = !access.allowed;
+      // The real page renders locked, so a license lock keeps the entry navigable.
+      const licenseLocked = license === "locked";
+      const lockedMessage = access.message;
+      const shouldShow = license !== "hidden" && (enabledByRuntimeFlag || locked || licenseLocked);
 
       if (!shouldShow) {
         if (existingIndex !== -1) linksList.value.splice(existingIndex, 1);
@@ -961,18 +971,13 @@ export default defineComponent({
       }
 
       if (existingIndex !== -1) {
-        linksList.value[existingIndex].locked = !access.allowed;
-        linksList.value[existingIndex].lockedMessage = access.message;
+        Object.assign(linksList.value[existingIndex], { locked, lockedMessage, licenseLocked });
         return;
       }
 
       const anchor = linksList.value.findIndex((link) => link.name === anchorName);
       if (anchor === -1) return;
-      linksList.value.splice(anchor + 1, 0, {
-        ...entry,
-        locked: !access.allowed,
-        lockedMessage: access.message,
-      });
+      linksList.value.splice(anchor + 1, 0, { ...entry, locked, lockedMessage, licenseLocked });
     };
 
     const updateIncidentsMenu = () => {
@@ -1009,18 +1014,22 @@ export default defineComponent({
     watch(isExperimentalEnabled, () => updateAutoObserveMenu(), { immediate: false });
 
     // Absorbed into the Reliability flyout (navGroups.ts), which places it after Incidents.
-    const isDowntimesEnabled = computed(
-      () =>
-        (config.isEnterprise == "true" || config.isCloud == "true") &&
-        store.state.zoConfig?.downtimes_enabled === true,
+    const downtimesMenuState = computed<FeatureState>(() =>
+      isEnterpriseOrCloud
+        ? menuState(features.value, "alerts", store.state.zoConfig?.downtimes_enabled === true)
+        : "hidden",
     );
     const updateDowntimesMenu = () => {
       const existingIndex = linksList.value.findIndex((link) => link.name === "downtimes");
-      if (!isDowntimesEnabled.value) {
+      if (downtimesMenuState.value === "hidden") {
         if (existingIndex !== -1) linksList.value.splice(existingIndex, 1);
         return;
       }
-      if (existingIndex !== -1) return;
+      const licenseLocked = downtimesMenuState.value === "locked";
+      if (existingIndex !== -1) {
+        linksList.value[existingIndex].licenseLocked = licenseLocked;
+        return;
+      }
       const anchor = linksList.value.findIndex((link) => link.name === "alertList");
       if (anchor === -1) return;
       linksList.value.splice(anchor + 1, 0, {
@@ -1028,9 +1037,10 @@ export default defineComponent({
         icon: "notifications-paused",
         link: "/downtimes",
         name: "downtimes",
+        licenseLocked,
       });
     };
-    watch(isDowntimesEnabled, () => updateDowntimesMenu(), { immediate: false });
+    watch(downtimesMenuState, () => updateDowntimesMenu(), { immediate: false });
 
     // Insert the Workflows entry after Alerts. Idempotent.
     const updateWorkflowsMenu = () => {
@@ -1042,9 +1052,10 @@ export default defineComponent({
       });
     };
 
-    // If `/config` resolves after this component mounted (or the flag flips),
+    // If `/config` resolves after this component mounted (or the state flips),
     // keep the menu in sync — same contract as the other flag-driven entries.
-    watch(isWorkflowsEnabled, () => updateWorkflowsMenu(), { immediate: false });
+    watch([isIncidentsEnabled, features], () => updateIncidentsMenu(), { immediate: false });
+    watch([isWorkflowsEnabled, features], () => updateWorkflowsMenu(), { immediate: false });
     const splitterModel = ref(100);
     const selectedLanguage: any = langList.find((l) => l.code == getLocale()) || langList[0];
 
@@ -1052,83 +1063,101 @@ export default defineComponent({
     // flag. Position: directly after Traces. Idempotent — safe to call from
     // multiple lifecycle hooks.
     const updateAIObservabilityMenu = () => {
-      const existingIndex = linksList.value.findIndex(
-        (link: any) => link.name === "aiObservability",
-      );
-
-      if (isAiObservabilityMenuVisible.value) {
-        if (existingIndex !== -1) return;
-        const anchorIndex = linksList.value.findIndex(
-          (link: any) => link.name === "profiles" || link.name === "traces",
-        );
-        const insertAt = anchorIndex === -1 ? linksList.value.length : anchorIndex + 1;
-        linksList.value.splice(insertAt, 0, {
+      syncFeatureLink(
+        {
           title: t("menu.aiObservability"),
           icon: "auto-awesome",
           link: "/ai",
           name: "aiObservability",
-        });
-      } else if (existingIndex !== -1) {
-        linksList.value.splice(existingIndex, 1);
-      }
+        },
+        aiObservabilityMenuState.value,
+        () => {
+          // Profiles first: Traces precedes it, so a combined match always lands before Profiles.
+          const profilesIndex = linksList.value.findIndex((link) => link.name === "profiles");
+          const anchorIndex =
+            profilesIndex !== -1
+              ? profilesIndex
+              : linksList.value.findIndex((link) => link.name === "traces");
+          return anchorIndex === -1 ? linksList.value.length : anchorIndex + 1;
+        },
+      );
     };
 
-    // If `/config` resolves after this component mounted (or if the flag
+    // If `/config` resolves after this component mounted (or if the state
     // ever flips at runtime), keep the menu in sync.
-    watch(isAiObservabilityMenuVisible, () => updateAIObservabilityMenu(), { immediate: false });
+    watch(aiObservabilityMenuState, () => updateAIObservabilityMenu(), { immediate: false });
 
+    // A locked license keeps the entry even with the runtime flag off, so the lock stays discoverable.
+    const syntheticsMenuState = computed<FeatureState>(() =>
+      menuState(features.value, "synthetics", isSyntheticsEnabled.value),
+    );
     const updateSyntheticMenu = () => {
-      const existingIndex = linksList.value.findIndex((l: any) => l.name === "synthetics");
-
-      if (!isSyntheticsEnabled.value) {
-        if (existingIndex !== -1) linksList.value.splice(existingIndex, 1);
-        return;
-      }
-      if (existingIndex !== -1) return;
-
-      const incidentIndex = linksList.value.findIndex((l: any) => l.name === "incidentList");
-      const alertIndex = linksList.value.findIndex((l: any) => l.name === "alertList");
-      const insertAt =
-        incidentIndex !== -1
-          ? incidentIndex + 1
-          : alertIndex !== -1
-            ? alertIndex + 1
-            : linksList.value.length;
-
-      linksList.value.splice(insertAt, 0, {
-        title: t("menu.synthetic"),
-        icon: "radar",
-        link: "/synthetics",
-        name: "synthetics",
-      });
+      syncFeatureLink(
+        {
+          title: t("menu.synthetic"),
+          icon: "radar",
+          link: "/synthetics",
+          name: "synthetics",
+        },
+        syntheticsMenuState.value,
+        () => {
+          const incidentIndex = linksList.value.findIndex((l) => l.name === "incidentList");
+          const alertIndex = linksList.value.findIndex((l) => l.name === "alertList");
+          if (incidentIndex !== -1) return incidentIndex + 1;
+          return alertIndex !== -1 ? alertIndex + 1 : linksList.value.length;
+        },
+      );
     };
 
     // Keep the menu in sync if /config resolves after mount.
-    watch(isSyntheticsEnabled, () => updateSyntheticMenu(), {
+    watch(syntheticsMenuState, () => updateSyntheticMenu(), {
       immediate: false,
     });
 
+    const profilesMenuState = computed<FeatureState>(() =>
+      menuState(features.value, "continuous_profiling", isProfilingEnabled.value),
+    );
     const updateProfilesMenu = () => {
-      const existingIndex = linksList.value.findIndex((l: any) => l.name === "profiles");
-
-      if (!isProfilingEnabled.value) {
-        if (existingIndex !== -1) linksList.value.splice(existingIndex, 1);
-        return;
-      }
-      if (existingIndex !== -1) return;
-
-      const tracesIndex = linksList.value.findIndex((l: any) => l.name === "traces");
-      const insertAt = tracesIndex === -1 ? linksList.value.length : tracesIndex + 1;
-
-      linksList.value.splice(insertAt, 0, {
-        title: t("menu.profiles"),
-        icon: "memory",
-        link: "/profiles",
-        name: "profiles",
-      });
+      syncFeatureLink(
+        {
+          title: t("menu.profiles"),
+          icon: "memory",
+          link: "/profiles",
+          name: "profiles",
+        },
+        profilesMenuState.value,
+        () => {
+          const tracesIndex = linksList.value.findIndex((l) => l.name === "traces");
+          return tracesIndex === -1 ? linksList.value.length : tracesIndex + 1;
+        },
+      );
     };
 
-    watch(isProfilingEnabled, () => updateProfilesMenu(), { immediate: false });
+    watch(profilesMenuState, () => updateProfilesMenu(), { immediate: false });
+
+    // Static rail entries owned by a license feature: locked keeps the entry with a lock, hidden drops it.
+    const LICENSED_LINKS: Record<string, string> = {
+      logs: "logs",
+      metrics: "metrics",
+      traces: "traces",
+      rum: "rum",
+      productAnalytics: "product_analytics",
+      dashboards: "dashboards",
+      reports: "reports",
+      alertList: "alerts",
+      sloList: "anomaly_detection",
+    };
+    const applyLicenseStates = () => {
+      linksList.value = linksList.value.flatMap((link) => {
+        const key = LICENSED_LINKS[link.name];
+        if (!key) return [link];
+        const state = featureState(features.value, key);
+        if (state === "hidden") return [];
+        const { licenseLocked: _, ...rest } = link;
+        return [state === "locked" ? { ...rest, licenseLocked: true } : rest];
+      });
+    };
+    watch(features, () => applyLicenseStates(), { immediate: false });
 
     // On-call's Pages/Teams/Routing entries live entirely inside the
     // `reliability` flyout (navGroups.ts), gated there by `gate: "oncall"`.
@@ -1142,6 +1171,7 @@ export default defineComponent({
       updateSyntheticMenu();
       updateProfilesMenu();
       updateAIObservabilityMenu();
+      applyLicenseStates();
 
       const disableMenus = new Set(
         store.state.zoConfig?.custom_hide_menus?.split(",")?.filter((val: string) => val?.trim()) ||
@@ -1790,6 +1820,9 @@ export default defineComponent({
       { immediate: true },
     );
 
+    // Path, not the full route: a query-only change (time range, filters) stays on the same page.
+    watch(() => router.currentRoute.value.path, clearLicenseDenials);
+
     // Home page has its own inline AI tab (see toggleAIChat's home special-case
     // above), so the sidebar chat panel is redundant there — close it on
     // arrival so we don't show both the sidebar and the home AI tab at once.
@@ -1821,6 +1854,7 @@ export default defineComponent({
       raw,
       dashboardSaveConflict: dashboardSaveConflictState,
       firstDataNotice,
+      lockedFeature,
       layoutMixin,
       router,
       store,
diff --git a/web/src/lib/core/Badge/OLockBadge.spec.ts b/web/src/lib/core/Badge/OLockBadge.spec.ts
new file mode 100644
index 0000000000..f1238d1437
--- /dev/null
+++ b/web/src/lib/core/Badge/OLockBadge.spec.ts
@@ -0,0 +1,22 @@
+import { describe, it, expect } from "vitest";
+import { mount } from "@vue/test-utils";
+import OLockBadge from "./OLockBadge.vue";
+import { raw } from "@/types/i18n";
+
+describe("OLockBadge", () => {
+  it("renders a gold lock", () => {
+    const wrapper = mount(OLockBadge);
+    expect(wrapper.find(".text-icon-locked").exists()).toBe(true);
+  });
+
+  it("renders screen-reader text only when a label is given", () => {
+    expect(mount(OLockBadge).find(".sr-only").exists()).toBe(false);
+    const labelled = mount(OLockBadge, { props: { label: raw("Locked: needs X") } });
+    expect(labelled.get(".sr-only").text()).toBe("Locked: needs X");
+  });
+
+  it("forwards attributes to its root", () => {
+    const wrapper = mount(OLockBadge, { attrs: { "data-test": "badge" } });
+    expect(wrapper.get("[data-test='badge']").classes()).toContain("absolute");
+  });
+});
diff --git a/web/src/lib/core/Badge/OLockBadge.vue b/web/src/lib/core/Badge/OLockBadge.vue
new file mode 100644
index 0000000000..bce807a69f
--- /dev/null
+++ b/web/src/lib/core/Badge/OLockBadge.vue
@@ -0,0 +1,31 @@
+<script setup lang="ts">
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import type { I18nText } from "@/types/i18n";
+
+defineProps<{
+  /** Screen-reader text; omit when the host already carries the lock in its own name. */
+  label?: I18nText;
+}>();
+</script>
+
+<template>
+  <span class="lock-halo absolute -end-3 -top-2 z-1 flex size-4 items-center justify-center">
+    <OIcon name="lock" size="xs" class="text-icon-locked size-4!" aria-hidden="true" />
+    <span v-if="label" class="sr-only">{{ label }}</span>
+  </span>
+</template>
diff --git a/web/src/lib/core/Button/OButton.spec.ts b/web/src/lib/core/Button/OButton.spec.ts
index 8b506084e6..7f6c2df5f1 100644
--- a/web/src/lib/core/Button/OButton.spec.ts
+++ b/web/src/lib/core/Button/OButton.spec.ts
@@ -1,7 +1,8 @@
 import { describe, it, expect, vi, afterEach } from "vitest";
 import { mount } from "@vue/test-utils";
-import { h, nextTick } from "vue";
+import { defineComponent, h, nextTick, ref } from "vue";
 import OButton from "./OButton.vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
 import type { ButtonVariant } from "./OButton.types";
 
 describe("OButton", () => {
@@ -653,4 +654,55 @@ describe("OButton", () => {
       expect(warn).not.toHaveBeenCalled();
     });
   });
+
+  describe("lock icon", () => {
+    it.each(["iconLeft", "iconRight"])("paints a %s lock with the locked-icon token", (prop) => {
+      const wrapper = mount(OButton, { props: { [prop]: "lock" }, slots: { default: "Run" } });
+      expect(wrapper.find(".lock-chip").exists()).toBe(true);
+    });
+
+    it("leaves other icons uncoloured", () => {
+      const wrapper = mount(OButton, { props: { iconLeft: "add" }, slots: { default: "Run" } });
+      expect(wrapper.find(".lock-chip").exists()).toBe(false);
+    });
+  });
+
+  describe("inside a license-locked page", () => {
+    const mountLocked = (props: Record<string, unknown> = {}) => {
+      const Locked = defineComponent({
+        setup(_, { slots }) {
+          provideFeatureLock(ref("workflows"));
+          return () => slots.default?.();
+        },
+      });
+      return mount(Locked, {
+        slots: { default: () => h(OButton, { ...props, "data-test": "btn" }, () => "Save") },
+      });
+    };
+
+    it("renders disabled and emits no click", async () => {
+      const wrapper = mountLocked();
+      const button = wrapper.findComponent(OButton);
+      expect(button.attributes("disabled")).toBeDefined();
+      expect(button.attributes("aria-disabled")).toBe("true");
+      await button.trigger("click");
+      expect(button.emitted("click")).toBeUndefined();
+    });
+
+    it("blocks an anchor button, which has no native disabled", async () => {
+      const wrapper = mountLocked({ as: "a", href: "#target" });
+      const button = wrapper.findComponent(OButton);
+      expect(button.classes()).toContain("cursor-not-allowed!");
+      const event = new MouseEvent("click", { bubbles: true, cancelable: true });
+      button.element.dispatchEvent(event);
+      expect(event.defaultPrevented).toBe(true);
+      expect(button.emitted("click")).toBeUndefined();
+    });
+
+    it("stays enabled outside any provider", async () => {
+      const wrapper = mount(OButton, { slots: { default: "Save" } });
+      await wrapper.trigger("click");
+      expect(wrapper.emitted("click")).toHaveLength(1);
+    });
+  });
 });
diff --git a/web/src/lib/core/Button/OButton.vue b/web/src/lib/core/Button/OButton.vue
index 9f5d2ec228..362fa6d17a 100644
--- a/web/src/lib/core/Button/OButton.vue
+++ b/web/src/lib/core/Button/OButton.vue
@@ -4,6 +4,7 @@ import { Primitive } from "reka-ui";
 import { computed, ref, onMounted, onBeforeUnmount, useAttrs, useId } from "vue";
 import { UNNAMED_ICON_ONLY_DELAY_MS, warnIfUnnamedIconOnly } from "./iconOnlyName";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 
 defineOptions({ inheritAttrs: false });
 
@@ -22,7 +23,11 @@ const props = withDefaults(defineProps<ButtonProps>(), {
 const emit = defineEmits<ButtonEmits>();
 const attrs = useAttrs();
 const id = useId();
-const unavailable = computed(() => props.disabled && props.focusableUnavailable);
+const { locked } = useFeatureLock();
+const isDisabled = computed(() => props.disabled || locked.value);
+// No native `disabled` reaches an anchor or a slotted child, so a locked one is styled and blocked by hand.
+const lockedLink = computed(() => locked.value && (props.as !== "button" || !!props.asChild));
+const unavailable = computed(() => isDisabled.value && props.focusableUnavailable);
 const reasonId = computed(() => props.descriptionId ?? `${id}-reason`);
 const rootRef = ref<{ $el?: Element } | null>(null);
 // Labels that arrive with data are not unnamed, so the dev check waits for them.
@@ -449,9 +454,11 @@ const classes = computed<string[]>(() => [
   "outline-none",
   // A hugging ring vanishes on accent fills, so the outline sits off a gap; ring-0! mutes the per-variant rings.
   "focus-visible:outline-2! focus-visible:outline-solid! focus-visible:outline-offset-2! focus-visible:outline-focus-ring-accent! focus-visible:ring-0!",
-  unavailable.value ? "cursor-not-allowed!" : "disabled:cursor-not-allowed enabled:cursor-pointer",
+  unavailable.value || lockedLink.value
+    ? "cursor-not-allowed!"
+    : "disabled:cursor-not-allowed enabled:cursor-pointer",
   // Variant + size (active overrides variant to primary appearance)
-  unavailable.value
+  unavailable.value || lockedLink.value
     ? unavailableClasses.value
     : props.active
       ? activeClasses
@@ -467,8 +474,8 @@ function handleKeydown(event: KeyboardEvent): void {
 }
 
 function handleClick(event: MouseEvent): void {
-  if (props.disabled || props.loading) {
-    if (unavailable.value) {
+  if (isDisabled.value || props.loading) {
+    if (unavailable.value || lockedLink.value) {
       event.preventDefault();
       event.stopImmediatePropagation();
     }
@@ -486,9 +493,11 @@ function handleClick(event: MouseEvent): void {
     :class="classes"
     :type="as === 'button' ? type : undefined"
     :disabled="
-      as === 'button' ? (disabled && !focusableUnavailable) || (loading && !unavailable) : undefined
+      as === 'button'
+        ? (isDisabled && !focusableUnavailable) || (loading && !unavailable)
+        : undefined
     "
-    :aria-disabled="disabled || loading || undefined"
+    :aria-disabled="isDisabled || loading || undefined"
     :aria-busy="loading || undefined"
     data-o2-btn
     :data-o2-variant="variant"
@@ -509,14 +518,24 @@ function handleClick(event: MouseEvent): void {
     <!-- Keep display:contents while loading: a wrapper that later loses its box strands a child-mode OTooltip anchored to it at (0,0) -->
     <span :class="loading ? 'contents text-transparent [&>*]:opacity-0' : 'contents'">
       <slot name="icon-left">
-        <OIcon v-if="iconLeft" :name="iconLeft" size="sm" />
+        <OIcon
+          v-if="iconLeft"
+          :name="iconLeft"
+          size="sm"
+          :class="iconLeft === 'lock' ? 'lock-chip' : undefined"
+        />
       </slot>
       <slot />
       <span v-if="unavailable && !descriptionId" :id="reasonId" class="sr-only" aria-hidden="true"
         ><slot name="unavailable-reason"
       /></span>
       <slot name="icon-right">
-        <OIcon v-if="iconRight" :name="iconRight" size="sm" />
+        <OIcon
+          v-if="iconRight"
+          :name="iconRight"
+          size="sm"
+          :class="iconRight === 'lock' ? 'lock-chip' : undefined"
+        />
       </slot>
     </span>
   </Primitive>
diff --git a/web/src/lib/core/EmptyState/EmptyStateActionCard.spec.ts b/web/src/lib/core/EmptyState/EmptyStateActionCard.spec.ts
index c8cd474aa7..f86f73b8f0 100644
--- a/web/src/lib/core/EmptyState/EmptyStateActionCard.spec.ts
+++ b/web/src/lib/core/EmptyState/EmptyStateActionCard.spec.ts
@@ -161,6 +161,13 @@ describe("EmptyStateActionCard", () => {
     expect(wrapper.classes()).toContain("gap-2");
   });
 
+  it("drops the chevron hover motion while unavailable", () => {
+    const chevron = (props: Record<string, unknown>) =>
+      mountCard(props).findAll("[data-icon-name]")[1].classes().join(" ");
+    expect(chevron({})).toContain("group-hover:translate-x-0.5");
+    expect(chevron({ unavailable: true })).not.toContain("group-hover");
+  });
+
   it("keeps an unavailable card focusable without emitting its action", async () => {
     const wrapper = mountCard({ unavailable: true });
     expect(wrapper.attributes("disabled")).toBeUndefined();
diff --git a/web/src/lib/core/EmptyState/EmptyStateActionCard.vue b/web/src/lib/core/EmptyState/EmptyStateActionCard.vue
index 03e792d81e..4d5072677f 100644
--- a/web/src/lib/core/EmptyState/EmptyStateActionCard.vue
+++ b/web/src/lib/core/EmptyState/EmptyStateActionCard.vue
@@ -64,7 +64,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       v-if="!hideChevron"
       name="chevron-right"
       size="sm"
-      class="text-text-disabled group-hover:text-accent relative shrink-0 transition-transform group-hover:translate-x-0.5"
+      class="text-text-disabled relative shrink-0 transition-transform"
+      :class="!unavailable && 'group-hover:text-accent group-hover:translate-x-0.5'"
     />
     <!-- A marker pinned to the card itself, e.g. an unsaved-draft dot. -->
     <slot name="badge" />
diff --git a/web/src/lib/core/EmptyState/EmptyStateIngestionChip.spec.ts b/web/src/lib/core/EmptyState/EmptyStateIngestionChip.spec.ts
new file mode 100644
index 0000000000..e27ca3ea69
--- /dev/null
+++ b/web/src/lib/core/EmptyState/EmptyStateIngestionChip.spec.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect } from "vitest";
+import { mount } from "@vue/test-utils";
+import EmptyStateIngestionChip from "./EmptyStateIngestionChip.vue";
+
+describe("EmptyStateIngestionChip", () => {
+  it("renders a link when href is given and emits click for a button", async () => {
+    const link = mount(EmptyStateIngestionChip, { props: { href: "https://x.test" } });
+    expect(link.element.tagName).toBe("A");
+    const button = mount(EmptyStateIngestionChip);
+    await button.trigger("click");
+    expect(button.emitted("click")).toHaveLength(1);
+  });
+
+  it("keeps hover treatment when available", () => {
+    expect(mount(EmptyStateIngestionChip).classes()).toContain("hover:border-accent");
+  });
+
+  it.each(["default", "ai"] as const)(
+    "dims an unavailable %s chip, drops hover and blocks the action",
+    async (variant) => {
+      const wrapper = mount(EmptyStateIngestionChip, { props: { unavailable: true, variant } });
+      expect(wrapper.attributes("aria-disabled")).toBe("true");
+      expect(wrapper.attributes("disabled")).toBeUndefined();
+      expect(wrapper.classes()).toContain("opacity-60");
+      expect(wrapper.classes().join(" ")).not.toContain("hover:");
+      expect(wrapper.classes()).not.toContain("ai-hover-btn");
+      await wrapper.trigger("click");
+      expect(wrapper.emitted("click")).toBeUndefined();
+    },
+  );
+
+  it("renders a focusable button, not a link, when an href chip is unavailable", () => {
+    const wrapper = mount(EmptyStateIngestionChip, {
+      props: { href: "https://x.test", unavailable: true },
+    });
+    expect(wrapper.element.tagName).toBe("BUTTON");
+    expect(wrapper.attributes("href")).toBeUndefined();
+  });
+});
diff --git a/web/src/lib/core/EmptyState/EmptyStateIngestionChip.vue b/web/src/lib/core/EmptyState/EmptyStateIngestionChip.vue
index d3d728f292..3bcb66b698 100644
--- a/web/src/lib/core/EmptyState/EmptyStateIngestionChip.vue
+++ b/web/src/lib/core/EmptyState/EmptyStateIngestionChip.vue
@@ -25,10 +25,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 <template>
   <component
-    :is="href ? 'a' : 'button'"
-    :class="[CHIP_BASE, variant === 'ai' ? CHIP_AI : CHIP_DEFAULT]"
-    v-bind="href ? { href, target: '_blank', rel: 'noopener noreferrer' } : { type: 'button' }"
-    @click="!href && emit('click')"
+    :is="href && !unavailable ? 'a' : 'button'"
+    :class="chipClass"
+    :aria-disabled="unavailable || undefined"
+    v-bind="
+      href && !unavailable
+        ? { href, target: '_blank', rel: 'noopener noreferrer' }
+        : { type: 'button' }
+    "
+    @click="onClick"
   >
     <OIcon v-if="icon" :name="icon" size="xs" class="shrink-0" />
     <slot />
@@ -36,31 +41,58 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
+import { computed } from "vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 
 // Shape, spacing and focus ring — identical in both variants.
 const CHIP_BASE =
-  "es-ing-chip text-compact border-border-default hover:border-accent inline-flex cursor-pointer items-center gap-1.25 rounded-full border px-3 py-1 font-medium no-underline! outline-none focus-visible:ring-2 focus-visible:ring-accent/40";
+  "es-ing-chip text-compact border-border-default inline-flex items-center gap-1.25 rounded-full border px-3 py-1 font-medium no-underline! outline-none focus-visible:ring-2 focus-visible:ring-accent/40";
 
 // The two colour sets are mutually exclusive so no two `!` utilities ever
 // compete for the same property — which class wins would otherwise depend on
 // Tailwind's emit order rather than on intent.
 const CHIP_DEFAULT =
-  "bg-surface-panel text-text-secondary! hover:text-accent! transition-[border-color,color,background-color] duration-150 hover:bg-accent/6";
+  "hover:border-accent bg-surface-panel text-text-secondary! hover:text-accent! cursor-pointer transition-[border-color,color,background-color] duration-150 hover:bg-accent/6";
 
 // `ai-hover-btn` survives only as the hook for the two rules the utility layer
 // cannot express: the color-mix() glow and the filter on the slotted <img>.
 const CHIP_AI =
-  "ai-hover-btn bg-gradient-ai-subtle! text-ai-accent! hover:bg-gradient-ai! hover:text-white! dark:text-white! transition-[background,box-shadow,color] duration-300";
+  "hover:border-accent ai-hover-btn bg-gradient-ai-subtle! text-ai-accent! hover:bg-gradient-ai! hover:text-white! dark:text-white! cursor-pointer transition-[background,box-shadow,color] duration-300";
 
-defineProps<{
+// No hover utilities and no `ai-hover-btn` hook, whose scoped rules would otherwise still glow.
+const CHIP_UNAVAILABLE_DEFAULT = "bg-surface-panel text-text-secondary!";
+const CHIP_UNAVAILABLE_AI = "bg-gradient-ai-subtle! text-ai-accent! dark:text-white!";
+
+const props = defineProps<{
   icon?: IconName;
   href?: string;
   variant?: "default" | "ai";
+  /** Dims the chip and blocks the action while keeping it focusable for its reason. */
+  unavailable?: boolean;
 }>();
 
 const emit = defineEmits<{ click: [] }>();
+
+const chipClass = computed(() => {
+  const ai = props.variant === "ai";
+  if (props.unavailable) {
+    return [
+      CHIP_BASE,
+      "cursor-not-allowed opacity-60",
+      ai ? CHIP_UNAVAILABLE_AI : CHIP_UNAVAILABLE_DEFAULT,
+    ];
+  }
+  return [CHIP_BASE, ai ? CHIP_AI : CHIP_DEFAULT];
+});
+
+function onClick(event: MouseEvent) {
+  if (props.unavailable) {
+    event.preventDefault();
+    return;
+  }
+  if (!props.href) emit("click");
+}
 </script>
 
 <style scoped>
diff --git a/web/src/lib/core/Navbar/ONavGroup.spec.ts b/web/src/lib/core/Navbar/ONavGroup.spec.ts
index 01a930356b..330af9a6aa 100644
--- a/web/src/lib/core/Navbar/ONavGroup.spec.ts
+++ b/web/src/lib/core/Navbar/ONavGroup.spec.ts
@@ -369,8 +369,18 @@ describe("ONavGroup", () => {
     // Exposes the resolved tile link so the anchor-child rule is assertable.
     const linkedTileStub = {
       template:
-        '<a data-test="tile" href="#" :data-link="link" @click.prevent="$emit(\'click\')">{{ title }}</a>',
-      props: ["submenu", "asTrigger", "title", "icon", "link", "active", "expanded", "mini"],
+        '<a data-test="tile" href="#" :data-link="link" :data-license-locked="licenseLocked || undefined" @click.prevent="$emit(\'click\')">{{ title }}</a>',
+      props: [
+        "submenu",
+        "asTrigger",
+        "title",
+        "icon",
+        "link",
+        "active",
+        "expanded",
+        "mini",
+        "licenseLocked",
+      ],
       emits: ["click", "keydown"],
     };
 
@@ -409,13 +419,14 @@ describe("ONavGroup", () => {
       });
     }
 
-    function infraStore(dbmEnabled: boolean, hiddenMenus = "") {
+    function infraStore(dbmEnabled: boolean, hiddenMenus = "", features = {}) {
       return createStore({
         state: () => ({
           theme: "light",
           zoConfig: {
             database_monitoring_enabled: dbmEnabled,
             custom_hide_menus: hiddenMenus,
+            features,
           },
           organizationData: {},
           selectedOrganization: { identifier: "default" },
@@ -425,7 +436,12 @@ describe("ONavGroup", () => {
 
     function mountInfraTile(
       dbmEnabled: boolean,
-      { hiddenMenus = "", children = infraChildren(), parentLink = "/infra/databases" } = {},
+      {
+        hiddenMenus = "",
+        children = infraChildren(),
+        parentLink = "/infra/databases",
+        features = {},
+      } = {},
     ) {
       return mount(ONavGroup, {
         props: {
@@ -436,7 +452,7 @@ describe("ONavGroup", () => {
           parentItem: { link: parentLink, title: "Infra", icon: "dns", name: "infra" },
         },
         global: {
-          plugins: [infraRouter(), infraStore(dbmEnabled, hiddenMenus), i18n],
+          plugins: [infraRouter(), infraStore(dbmEnabled, hiddenMenus, features), i18n],
           stubs: { MenuLink: linkedTileStub, OIcon: oIconStub, teleport: true },
         },
       });
@@ -468,6 +484,80 @@ describe("ONavGroup", () => {
       expect(tileLink()).toBe("/infra/hosts");
     });
 
+    it("keeps a license-locked Databases child and its tile link while the DBM flag is off", async () => {
+      const children = infraChildren().map((c) =>
+        c.name === "dbmDatabases" ? { ...c, feature: "db_monitoring" } : c,
+      );
+      wrapper = mountInfraTile(false, { children, features: { db_monitoring: "locked" } });
+      expect(tileLink()).toBe("/infra/databases");
+      await hoverOpenInfra();
+      const fly = wrapper.find('[data-test="nav-group-flyout-infra"]');
+      expect(fly.find('[data-test="nav-group-item-dbmDatabases-license-lock"]').exists()).toBe(
+        true,
+      );
+    });
+
+    const licensedInfra = (): SubnavChild[] => [
+      { titleKey: "menu.hosts", icon: "dns", name: "infraHosts", feature: "host_monitoring" },
+      {
+        titleKey: "menu.databases",
+        icon: "database",
+        name: "dbmDatabases",
+        gate: "databaseMonitoring",
+        feature: "db_monitoring",
+      },
+      {
+        titleKey: "menu.kubernetes",
+        icon: "hub",
+        name: "infraKubernetes",
+        feature: "kubernetes_monitoring",
+      },
+    ];
+    const tileLocked = () =>
+      wrapper.find('[data-test="tile"]').attributes("data-license-locked") === "true";
+    const allLocked = {
+      host_monitoring: "locked",
+      db_monitoring: "locked",
+      kubernetes_monitoring: "locked",
+    };
+
+    it("puts the lock on the tile when every visible child is license-locked", () => {
+      wrapper = mountInfraTile(true, { children: licensedInfra(), features: allLocked });
+      expect(tileLocked()).toBe(true);
+    });
+
+    it("ignores a hidden child when deciding the tile lock", () => {
+      wrapper = mountInfraTile(true, {
+        children: licensedInfra(),
+        features: { ...allLocked, kubernetes_monitoring: "hidden" },
+      });
+      expect(tileLocked()).toBe(true);
+    });
+
+    it("keeps the tile unlocked while any visible child is free", () => {
+      wrapper = mountInfraTile(true, {
+        children: [
+          ...licensedInfra(),
+          { titleKey: "menu.kubernetes2", icon: "hub", name: "infraKubernetes2" },
+        ],
+        features: allLocked,
+      });
+      expect(tileLocked()).toBe(false);
+    });
+
+    it("keeps the tile unlocked when the license enables its children", () => {
+      wrapper = mountInfraTile(true, { children: licensedInfra() });
+      expect(tileLocked()).toBe(false);
+    });
+
+    it("drops a license-hidden Databases child and retargets the tile", () => {
+      const children = infraChildren().map((c) =>
+        c.name === "dbmDatabases" ? { ...c, feature: "db_monitoring" } : c,
+      );
+      wrapper = mountInfraTile(true, { children, features: { db_monitoring: "hidden" } });
+      expect(tileLink()).toBe("/infra/hosts");
+    });
+
     it("keeps /infra/databases as the tile link when DBM is on, despite Hosts being declared first", () => {
       // Ungated Hosts always survives, so keying on "first declared" would re-break DBM-off.
       wrapper = mountInfraTile(true);
@@ -1283,6 +1373,86 @@ describe("ONavGroup", () => {
     });
   });
 
+  describe("license feature state of a child", () => {
+    const workflowsChild: SubnavChild = {
+      titleKey: "menu.workflows",
+      icon: "schema",
+      name: "workflows",
+      feature: "workflows",
+    };
+
+    async function mountWithFeature(state?: "enabled" | "locked" | "hidden") {
+      const featureStore = createStore({
+        state: () => ({
+          theme: "light",
+          zoConfig: { features: state ? { workflows: state } : {} },
+          organizationData: {},
+          selectedOrganization: { identifier: "default" },
+        }),
+      });
+      const router = createRouter({
+        history: createMemoryHistory(),
+        routes: [
+          { path: "/", name: "home", component: { template: "<div />" } },
+          { path: "/streams", name: "logstreams", component: { template: "<div />" } },
+          { path: "/pipelines", name: "pipelines", component: { template: "<div />" } },
+          { path: "/workflows", name: "workflows", component: { template: "<div />" } },
+          {
+            path: "/feature-locked/:feature",
+            name: "featureLocked",
+            component: { template: "<div />" },
+          },
+        ],
+      });
+      router.push("/");
+      await router.isReady();
+      wrapper = mount(ONavGroup, {
+        props: {
+          groupKey: "data",
+          title: "Data",
+          icon: "database",
+          children: [...children, workflowsChild],
+          parentItem: { link: "/streams", title: "Data", icon: "database", name: "logstreams" },
+        },
+        global: {
+          plugins: [router, featureStore, i18n],
+          stubs: { MenuLink: menuLinkStub, OIcon: oIconStub, teleport: true },
+        },
+      });
+      await hoverOpen();
+      return router;
+    }
+
+    it("shows a locked child as a real link with a gold lock and screen-reader text", async () => {
+      const router = await mountWithFeature("locked");
+      const item = flyout().get('[data-test="nav-group-item-workflows-license-lock"]');
+      expect(item.element.tagName).toBe("A");
+      expect(item.attributes("href")).toContain("/workflows");
+      const lock = flyout().get('[data-test="nav-group-item-workflows-lock"]');
+      expect(lock.classes()).toContain("lock-chip");
+      expect(item.find(".sr-only").text()).toContain("Locked");
+      await item.trigger("click");
+      await flushPromises();
+      expect(router.currentRoute.value.fullPath).toBe("/workflows?org_identifier=default");
+    });
+
+    it("drops a hidden child", async () => {
+      await mountWithFeature("hidden");
+      expect(flyout().find('[data-test="nav-group-item-workflows"]').exists()).toBe(false);
+      expect(flyout().find('[data-test="nav-group-item-workflows-license-lock"]').exists()).toBe(
+        false,
+      );
+    });
+
+    it("renders an enabled or unsent feature as a normal link", async () => {
+      await mountWithFeature();
+      expect(flyout().find('[data-test="nav-group-item-workflows"]').exists()).toBe(true);
+      expect(flyout().find('[data-test="nav-group-item-workflows-license-lock"]').exists()).toBe(
+        false,
+      );
+    });
+  });
+
   // K1: a pointer still travelling inside the exit-to-flyout triangle neither opens a neighbour nor closes the flyout.
   describe("safe triangle (K1, AC-1)", () => {
     let now = 0;
diff --git a/web/src/lib/core/Navbar/ONavGroup.vue b/web/src/lib/core/Navbar/ONavGroup.vue
index b3102df5bf..474a62d435 100644
--- a/web/src/lib/core/Navbar/ONavGroup.vue
+++ b/web/src/lib/core/Navbar/ONavGroup.vue
@@ -65,8 +65,10 @@ import {
 import type { Point } from "./hoverIntent";
 import { findContentFocusTarget } from "./railFocus";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
+import { featureState } from "@/utils/featureGate";
 import useBreakpoint from "@/composables/useBreakpoint";
 import { useTrialPaywall } from "@/composables/useTrialPaywall";
+import { useFeatureNames } from "@/composables/useFeatureLock";
 import {
   checkFeatureAccess,
   buildFeatureGateContext,
@@ -115,6 +117,10 @@ const flyoutStyle = ref<Record<string, string>>({});
 // Shared with ONavbar, which applies the same gates when deciding whether a
 // group is worth collapsing into at all.
 const gateContext = useNavGateContext();
+const { featureName, featureNames } = useFeatureNames();
+
+const licenseState = (c: SubnavChild) =>
+  c.feature ? featureState(gateContext.value.features, c.feature) : "enabled";
 
 // A child shows when its route is registered and custom_hide_menus doesn't
 // name it. A FeatureKey `gate` then decides locked vs. unlocked instead of
@@ -127,13 +133,16 @@ const visibleChildren = computed<SubnavChild[]>(() =>
   props.children
     .filter((c) => router.hasRoute(c.name) && !gateContext.value.hiddenMenus.has(c.name))
     .flatMap((c): SubnavChild[] => {
-      if (!c.gate) return [{ ...c, locked: false }];
-      if (isFeatureKey(c.gate)) {
+      if (c.gate && isFeatureKey(c.gate)) {
         const access = checkFeatureAccess(c.gate, buildFeatureGateContext(store.state.zoConfig));
         if (!access.visible) return [];
         if (!access.allowed) return [{ ...c, locked: true, lockedMessage: access.message }];
-        return isGateOpen(gateContext.value, c.gate) ? [{ ...c, locked: false }] : [];
       }
+      // The license applies once the edition allows the feature; a locked license also turns its runtime flag off.
+      const license = licenseState(c);
+      if (license === "hidden") return [];
+      if (license === "locked") return [{ ...c, locked: false, licenseLocked: true }];
+      if (!c.gate) return [{ ...c, locked: false }];
       return isGateOpen(gateContext.value, c.gate) ? [{ ...c, locked: false }] : [];
     }),
 );
@@ -148,6 +157,19 @@ const visibleChildren = computed<SubnavChild[]>(() =>
 // has nothing left to offer.
 const hasVisibleChildren = computed(() => visibleChildren.value.length > 0);
 
+// One free child keeps the tile unlocked; only a tile whose every destination is license-locked shows the lock.
+const tileLicenseLocked = computed(
+  () =>
+    hasVisibleChildren.value &&
+    visibleChildren.value.every((c) => !!c.feature && licenseState(c) === "locked"),
+);
+
+const tileLockedLabel = computed<I18nText | undefined>(() => {
+  if (!tileLicenseLocked.value) return undefined;
+  const keys = [...new Set(visibleChildren.value.map((c) => c.feature as string))];
+  return t("featureLock.headerLocked", { feature: raw(featureNames(keys)) });
+});
+
 /**
  * Blocks, not a flat row list, so the grouping is real to assistive tech.
  *
@@ -336,6 +358,16 @@ function childDataTest(child: SubnavChild): string {
   return `nav-group-item-${child.name}${child.tab ? `-${child.tab}` : ""}`;
 }
 
+function childRowTestId(child: SubnavChild): string {
+  if (child.locked) return `${childDataTest(child)}-locked`;
+  return child.licenseLocked ? `${childDataTest(child)}-license-lock` : childDataTest(child);
+}
+
+function childLockedLabel(child: SubnavChild): I18nText {
+  const feature = child.feature ? (featureName(child.feature) ?? child.feature) : "";
+  return t("featureLock.headerLocked", { feature: raw(feature) });
+}
+
 function tileElement(): HTMLElement | null {
   return wrapperRef.value?.querySelector<HTMLElement>("a, button") ?? null;
 }
@@ -610,7 +642,7 @@ function onFlyoutKeydown(event: KeyboardEvent) {
 const markRailNavigation = inject(RailNavigationMarkKey, null);
 
 // Keyboard choice (detail 0) returns focus to the tile; a mouse choice leaves it to the page.
-function onChildClick(event: MouseEvent, child: SubnavChild & { locked?: boolean }) {
+function onChildClick(event: MouseEvent, child: SubnavChild) {
   if (child.locked) {
     event.preventDefault();
     close();
@@ -653,6 +685,8 @@ function onChildMouseenter(event: MouseEvent) {
       :active="isGroupActive"
       :expanded="isOpen"
       :paywalled="tilePaywalled"
+      :license-locked="tileLicenseLocked"
+      :license-locked-label="tileLockedLabel"
       @click="onLinkClick"
       @keydown="onTileKeydown"
     />
@@ -666,6 +700,8 @@ function onChildMouseenter(event: MouseEvent) {
       :active="isGroupActive"
       :expanded="isOpen"
       :paywalled="tilePaywalled"
+      :license-locked="tileLicenseLocked"
+      :license-locked-label="tileLockedLabel"
       @click="onTriggerClick"
       @keydown="onTileKeydown"
     />
@@ -707,7 +743,7 @@ function onChildMouseenter(event: MouseEvent) {
                  not rendering it at all stops navigation. -->
             <component
               :is="child.locked ? 'div' : 'router-link'"
-              :data-test="child.locked ? `${childDataTest(child)}-locked` : childDataTest(child)"
+              :data-test="childRowTestId(child)"
               role="menuitem"
               :to="child.locked ? undefined : childTo(child)"
               :tabindex="child.locked ? 0 : undefined"
@@ -732,14 +768,15 @@ function onChildMouseenter(event: MouseEvent) {
               <span class="leading-tight">{{ childLabel(child) }}</span>
               <BetaBadge v-if="child.beta" size="xs" />
               <OIcon
-                v-if="isChildPaywalled(child) || child.locked"
+                v-if="isChildPaywalled(child) || child.locked || child.licenseLocked"
                 name="lock"
                 size="xs"
                 class="ms-auto shrink-0"
-                :class="child.locked ? 'text-warning-600' : 'text-text-secondary'"
+                :class="child.locked || child.licenseLocked ? 'lock-chip' : 'text-text-secondary'"
                 :data-test="`${childDataTest(child)}-lock`"
                 aria-hidden="true"
               />
+              <span v-if="child.licenseLocked" class="sr-only">{{ childLockedLabel(child) }}</span>
               <span
                 v-if="isChildPaywalled(child)"
                 :id="itemDescriptionId(child, 'inline-')"
@@ -753,11 +790,7 @@ function onChildMouseenter(event: MouseEvent) {
         <template v-else>
           <component
             :is="block.child.locked ? 'div' : 'router-link'"
-            :data-test="
-              block.child.locked
-                ? `${childDataTest(block.child)}-locked`
-                : childDataTest(block.child)
-            "
+            :data-test="childRowTestId(block.child)"
             role="menuitem"
             :to="block.child.locked ? undefined : childTo(block.child)"
             :tabindex="block.child.locked ? 0 : undefined"
@@ -783,14 +816,23 @@ function onChildMouseenter(event: MouseEvent) {
             <span class="leading-tight">{{ childLabel(block.child) }}</span>
             <BetaBadge v-if="block.child.beta" size="xs" />
             <OIcon
-              v-if="isChildPaywalled(block.child) || block.child.locked"
+              v-if="
+                isChildPaywalled(block.child) || block.child.locked || block.child.licenseLocked
+              "
               name="lock"
               size="xs"
               class="ms-auto shrink-0"
-              :class="block.child.locked ? 'text-warning-600' : 'text-text-secondary'"
+              :class="
+                block.child.locked || block.child.licenseLocked
+                  ? 'lock-chip'
+                  : 'text-text-secondary'
+              "
               :data-test="`${childDataTest(block.child)}-lock`"
               aria-hidden="true"
             />
+            <span v-if="block.child.licenseLocked" class="sr-only">{{
+              childLockedLabel(block.child)
+            }}</span>
             <span
               v-if="isChildPaywalled(block.child)"
               :id="itemDescriptionId(block.child, 'inline-')"
@@ -864,7 +906,7 @@ function onChildMouseenter(event: MouseEvent) {
                    before onChildClick's preventDefault). -->
               <component
                 :is="child.locked ? 'div' : 'router-link'"
-                :data-test="child.locked ? `${childDataTest(child)}-locked` : childDataTest(child)"
+                :data-test="childRowTestId(child)"
                 role="menuitem"
                 :to="child.locked ? undefined : childTo(child)"
                 :tabindex="child.locked ? 0 : undefined"
@@ -893,14 +935,17 @@ function onChildMouseenter(event: MouseEvent) {
                 <span class="leading-none">{{ childLabel(child) }}</span>
                 <BetaBadge v-if="child.beta" size="xs" />
                 <OIcon
-                  v-if="isChildPaywalled(child) || child.locked"
+                  v-if="isChildPaywalled(child) || child.locked || child.licenseLocked"
                   name="lock"
                   size="xs"
                   class="ms-auto shrink-0"
-                  :class="child.locked ? 'text-warning-600' : 'text-text-secondary'"
+                  :class="child.locked || child.licenseLocked ? 'lock-chip' : 'text-text-secondary'"
                   :data-test="`${childDataTest(child)}-lock`"
                   aria-hidden="true"
                 />
+                <span v-if="child.licenseLocked" class="sr-only">{{
+                  childLockedLabel(child)
+                }}</span>
                 <span
                   v-if="isChildPaywalled(child)"
                   :id="itemDescriptionId(child)"
@@ -914,11 +959,7 @@ function onChildMouseenter(event: MouseEvent) {
           <template v-else>
             <component
               :is="block.child.locked ? 'div' : 'router-link'"
-              :data-test="
-                block.child.locked
-                  ? `${childDataTest(block.child)}-locked`
-                  : childDataTest(block.child)
-              "
+              :data-test="childRowTestId(block.child)"
               role="menuitem"
               :to="block.child.locked ? undefined : childTo(block.child)"
               :tabindex="block.child.locked ? 0 : undefined"
@@ -949,14 +990,23 @@ function onChildMouseenter(event: MouseEvent) {
               <span class="leading-none">{{ childLabel(block.child) }}</span>
               <BetaBadge v-if="block.child.beta" size="xs" />
               <OIcon
-                v-if="isChildPaywalled(block.child) || block.child.locked"
+                v-if="
+                  isChildPaywalled(block.child) || block.child.locked || block.child.licenseLocked
+                "
                 name="lock"
                 size="xs"
                 class="ms-auto shrink-0"
-                :class="block.child.locked ? 'text-warning-600' : 'text-text-secondary'"
+                :class="
+                  block.child.locked || block.child.licenseLocked
+                    ? 'lock-chip'
+                    : 'text-text-secondary'
+                "
                 :data-test="`${childDataTest(block.child)}-lock`"
                 aria-hidden="true"
               />
+              <span v-if="block.child.licenseLocked" class="sr-only">{{
+                childLockedLabel(block.child)
+              }}</span>
               <span
                 v-if="isChildPaywalled(block.child)"
                 :id="itemDescriptionId(block.child)"
diff --git a/web/src/lib/core/Navbar/ONavbar.types.ts b/web/src/lib/core/Navbar/ONavbar.types.ts
index fe03bf9fe2..bf8f6a1e74 100644
--- a/web/src/lib/core/Navbar/ONavbar.types.ts
+++ b/web/src/lib/core/Navbar/ONavbar.types.ts
@@ -15,6 +15,7 @@
 
 import type { ComputedRef, InjectionKey } from "vue";
 import type { I18nKey, I18nText } from "@/types/i18n";
+import type { FeatureStates } from "@/utils/featureGate";
 
 export interface NavItem {
   title: I18nText;
@@ -33,6 +34,8 @@ export interface NavItem {
    */
   locked?: boolean;
   lockedMessage?: I18nText;
+  /** The license marks the feature locked: a lock badge, but the link still opens the locked page. */
+  licenseLocked?: boolean;
 }
 
 /**
@@ -101,6 +104,8 @@ export interface SubnavChild {
   gate?: string;
   /** Shows the shared "Beta" tag (see BetaBadge.vue) next to this child's label. */
   beta?: boolean;
+  /** License feature key; `locked` keeps a lock badge on a link to the locked page, `hidden` drops the child. */
+  feature?: string;
   /**
    * Set at RENDER time (ONavGroup.vue), not in the static NAV_GROUPS/NAV_SUBNAV
    * tables: when `gate` corresponds to a registered `FeatureKey`
@@ -109,6 +114,8 @@ export interface SubnavChild {
    */
   locked?: boolean;
   lockedMessage?: I18nText;
+  /** Set at render time when the license locks `feature`: the row stays a real link to the locked page, with a lock. */
+  licenseLocked?: boolean;
 }
 
 /** Context for evaluating subnav `gate` predicates (see navGroups.ts). */
@@ -134,6 +141,8 @@ export interface NavGateContext {
   fleetEnabled: boolean;
   /** Raw `custom_hide_menus` entries (split on ",") — matches how pages test it. */
   hiddenMenus: Set<string>;
+  /** `/config` `features` map (enabled / locked / hidden per license feature). */
+  features: FeatureStates;
 }
 
 /**
diff --git a/web/src/lib/core/Navbar/navGroups.spec.ts b/web/src/lib/core/Navbar/navGroups.spec.ts
index d92d0c2a4e..9382b598f5 100644
--- a/web/src/lib/core/Navbar/navGroups.spec.ts
+++ b/web/src/lib/core/Navbar/navGroups.spec.ts
@@ -106,6 +106,15 @@ describe("groupNavLinks", () => {
     ]);
   });
 
+  it("gates every Traces flyout item on the traces license", () => {
+    expect(NAV_SUBNAV.traces.map((c) => c.feature)).toEqual([
+      "traces",
+      "traces",
+      "traces",
+      "traces",
+    ]);
+  });
+
   it("places the Data group right after the Reliability group it is anchored to", () => {
     const entries = groupNavLinks([
       link("home"),
@@ -835,14 +844,33 @@ describe("GATE_PREDICATES", () => {
     modelPricing: false,
     serviceStreams: true,
     onlineEvals: false,
+    oncallEnabled: false,
     databaseMonitoring: false,
     downtimesEnabled: false,
     alertCalibrationEnabled: false,
     fleetEnabled: false,
     hiddenMenus: new Set<string>(),
+    features: {},
     ...over,
   });
 
+  it("oncall stays open while the license locks it, so the entries can show the lock", () => {
+    expect(GATE_PREDICATES.oncall(ctx({ oncallEnabled: true }))).toBe(true);
+    expect(GATE_PREDICATES.oncall(ctx({ features: { oncall: "locked" } }))).toBe(true);
+    expect(GATE_PREDICATES.oncall(ctx({ features: { oncall: "hidden" } }))).toBe(false);
+    expect(GATE_PREDICATES.oncall(ctx())).toBe(false);
+  });
+
+  it.each([
+    ["downtimes", "alerts"],
+    ["alertCalibration", "alerts"],
+  ])("%s stays open while the license locks %s, though its flag is off", (gate, feature) => {
+    const ent = { isEnterprise: true };
+    expect(GATE_PREDICATES[gate](ctx({ ...ent, features: { [feature]: "locked" } }))).toBe(true);
+    expect(GATE_PREDICATES[gate](ctx({ ...ent, features: { [feature]: "hidden" } }))).toBe(false);
+    expect(GATE_PREDICATES[gate](ctx({ features: { [feature]: "locked" } }))).toBe(false);
+  });
+
   it("fleet needs enterprise AND the runtime flag", () => {
     expect(GATE_PREDICATES.fleet(ctx({ isEnterprise: true, fleetEnabled: true }))).toBe(true);
     expect(GATE_PREDICATES.fleet(ctx({ isEnterprise: true }))).toBe(false);
@@ -859,6 +887,39 @@ describe("GATE_PREDICATES", () => {
     expect(GATE_PREDICATES.databaseMonitoring(ctx())).toBe(false);
   });
 
+  it("databaseMonitoring stays open while the license locks db_monitoring, though its flag is off", () => {
+    const locked = { features: { db_monitoring: "locked" as const } };
+    expect(GATE_PREDICATES.databaseMonitoring(ctx(locked))).toBe(true);
+    expect(GATE_PREDICATES.databaseMonitoring(ctx({ features: { db_monitoring: "hidden" } }))).toBe(
+      false,
+    );
+  });
+
+  it.each([
+    ["alertList", "alerts"],
+    ["alertLibrary", "alerts"],
+    ["alertDestinations", "alerts"],
+    ["alertTemplates", "alerts"],
+    ["sloList", "anomaly_detection"],
+    ["infraHosts", "host_monitoring"],
+    ["dbmDatabases", "db_monitoring"],
+    ["infraKubernetes", "kubernetes_monitoring"],
+    ["pipelines", "pipelines"],
+    ["dashboards", "dashboards"],
+    ["reports", "reports"],
+    ["RUM", "rum"],
+    ["synthetics", "synthetics"],
+    ["productAnalytics", "product_analytics"],
+  ])("flyout child %s carries license feature %s", (name, feature) => {
+    const child = NAV_GROUPS.flatMap((g) => g.children).find((c) => c.name === name);
+    expect(child?.feature).toBe(feature);
+  });
+
+  it.each(["functionList", "enrichmentTables"])("flyout child %s stays license-free", (name) => {
+    const child = NAV_GROUPS.flatMap((g) => g.children).find((c) => c.name === name);
+    expect(child?.feature).toBeUndefined();
+  });
+
   it("downtimes needs enterprise or cloud AND the runtime flag", () => {
     expect(GATE_PREDICATES.downtimes(ctx({ isEnterprise: true, downtimesEnabled: true }))).toBe(
       true,
diff --git a/web/src/lib/core/Navbar/navGroups.ts b/web/src/lib/core/Navbar/navGroups.ts
index 6da6dc0611..0a11e50060 100644
--- a/web/src/lib/core/Navbar/navGroups.ts
+++ b/web/src/lib/core/Navbar/navGroups.ts
@@ -16,6 +16,7 @@
 import type { NavItem, RailEntry, SubnavChild, NavGateContext } from "./ONavbar.types";
 import { raw, type I18nKey, type TranslateFn } from "@/types/i18n";
 import { PA_ROUTES } from "@/utils/rum/productAnalyticsRoutes";
+import { featureState } from "@/utils/featureGate";
 
 /**
  * Visibility gates — each predicate mirrors the EXACT `visible` condition the
@@ -47,18 +48,24 @@ export const GATE_PREDICATES: Record<string, (c: NavGateContext) => boolean> = {
   // On-call: backend /config flag `oncall_enabled` (enterprise
   // O2_ONCALL_ENABLED). `!== false`, matching oncallRouteGuard, so the flyout
   // does not blink out while /config is still in flight on a cold load.
-  oncall: (c) => c.oncallEnabled,
+  // A locked license also reports the flag false, yet the entries stay to show the lock.
+  oncall: (c) => c.oncallEnabled || featureState(c.features, "oncall") === "locked",
   // The runtime flag is the whole gate for the MENU ENTRY, which is not
   // enterprise-only. Three of Database Monitoring's seven tabs (deadlocks,
   // blocked queries, table health) ARE enterprise-only, but they are gated
   // per-tab in DbmSectionTabs.vue and per-route in router.ts — not here. An
   // isEnterprise conjunct at this level would take the four OSS tabs down with
   // them and hide the section from a build that still serves most of it.
-  databaseMonitoring: (c) => c.databaseMonitoring,
-  // Enterprise/cloud plus `/config` `downtimes_enabled`, the same rule as the route guard.
-  downtimes: (c) => (c.isEnterprise || c.isCloud) && c.downtimesEnabled,
-  // Enterprise/cloud plus `/config` `alert_calibration_enabled`, the same rule as the route guard.
-  alertCalibration: (c) => (c.isEnterprise || c.isCloud) && c.alertCalibrationEnabled,
+  databaseMonitoring: (c) =>
+    c.databaseMonitoring || featureState(c.features, "db_monitoring") === "locked",
+  // Enterprise/cloud plus `/config` `downtimes_enabled`, the same rule as the route guard; a locked license keeps the entry to show the lock.
+  downtimes: (c) =>
+    (c.isEnterprise || c.isCloud) &&
+    (c.downtimesEnabled || featureState(c.features, "alerts") === "locked"),
+  // Enterprise/cloud plus `/config` `alert_calibration_enabled`, the same rule as the route guard; a locked license keeps the entry.
+  alertCalibration: (c) =>
+    (c.isEnterprise || c.isCloud) &&
+    (c.alertCalibrationEnabled || featureState(c.features, "alerts") === "locked"),
   // Enterprise plus `/config` `fleet_enabled`; the route stays so management reads keep working.
   fleet: (c) => c.isEnterprise && c.fleetEnabled,
 };
@@ -161,6 +168,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "alertList",
         requires: "alertList",
         categoryKey: "menu.alerts",
+        feature: "alerts",
       },
       {
         titleKey: "alert_destinations.header",
@@ -168,6 +176,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "alertDestinations",
         requires: "alertList",
         categoryKey: "menu.alerts",
+        feature: "alerts",
       },
       {
         titleKey: "alert_templates.header",
@@ -175,6 +184,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "alertTemplates",
         requires: "alertList",
         categoryKey: "menu.alerts",
+        feature: "alerts",
       },
       // The curated catalog you add alerts FROM — gated the same way, so
       // hiding Alerts hides the place to get more. Last, like its tab: you go
@@ -185,6 +195,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "alertLibrary",
         requires: "alertList",
         categoryKey: "menu.alerts",
+        feature: "alerts",
       },
       // ── Reliability's other concerns ────────────────────────────────────
       // Deliberately OUTSIDE the Alerts header: an SLO is what an SLO alert
@@ -194,13 +205,20 @@ export const NAV_GROUPS: NavGroupDef[] = [
       // any of them (`custom_hide_menus`, or Incidents being enterprise-gated)
       // shrinks the group, and dropping to a single survivor collapses it back
       // to a plain link rather than leaving a one-item flyout.
-      { titleKey: "menu.slos", icon: "target", name: "sloList", requires: "sloList" },
+      {
+        titleKey: "menu.slos",
+        icon: "target",
+        name: "sloList",
+        requires: "sloList",
+        feature: "anomaly_detection",
+      },
       {
         titleKey: "menu.incidents",
         icon: "notifications-active",
         name: "incidentList",
         requires: "incidentList",
         gate: "incidents",
+        feature: "incidents",
       },
       {
         titleKey: "menu.downtimes",
@@ -208,6 +226,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "downtimes",
         requires: "downtimes",
         gate: "downtimes",
+        feature: "alerts",
         activeOnRoutes: ["addDowntime", "editDowntime", "downtimeDetail"],
         beta: true,
       },
@@ -217,6 +236,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "alertCalibration",
         requires: "alertList",
         gate: "alertCalibration",
+        feature: "alerts",
         activeOnRoutes: [
           "alertCalibrationRuns",
           "alertCalibrationDigest",
@@ -237,6 +257,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "onCallResponses",
         categoryKey: "menu.onCall",
         gate: "oncall",
+        feature: "oncall",
       },
       {
         titleKey: "oncall.teams",
@@ -244,6 +265,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "onCallTeams",
         categoryKey: "menu.onCall",
         gate: "oncall",
+        feature: "oncall",
       },
       {
         titleKey: "oncall.routingNav",
@@ -251,6 +273,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "onCallRouting",
         categoryKey: "menu.onCall",
         gate: "oncall",
+        feature: "oncall",
       },
       // Same icon as the page's own header, so the menu and the page read as one place.
       {
@@ -269,6 +292,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         icon: "webhook",
         name: "alertSources",
         requires: "incidentList",
+        feature: "incidents",
       },
     ],
   },
@@ -297,7 +321,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
     placeAfter: "reliability",
     // Hosts leads the flyout; the workload children are ungated on purpose — detection changes page state, never existence.
     children: [
-      { titleKey: "menu.hosts", icon: "dns", name: "infraHosts" },
+      { titleKey: "menu.hosts", icon: "dns", name: "infraHosts", feature: "host_monitoring" },
       // Moved here from the Traces flyout. The routes are always registered
       // (the guard redirects when the feature is off), so the `gate` is what
       // keeps the link out of the menu.
@@ -313,6 +337,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         icon: "database",
         name: "dbmDatabases",
         gate: "databaseMonitoring",
+        feature: "db_monitoring",
         // EVERY in-page tab, not just the first two. Deadlocks and Blocked
         // queries are DbmSectionTabs destinations with no nav child of their
         // own, so omitting them unlit the Databases entry the moment the user
@@ -336,7 +361,12 @@ export const NAV_GROUPS: NavGroupDef[] = [
           "dbmTableHealth",
         ],
       },
-      { titleKey: "menu.kubernetes", icon: "hub", name: "infraKubernetes" },
+      {
+        titleKey: "menu.kubernetes",
+        icon: "hub",
+        name: "infraKubernetes",
+        feature: "kubernetes_monitoring",
+      },
     ],
   },
   {
@@ -359,6 +389,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "pipelines",
         requires: "pipeline",
         gate: "streamPipelines",
+        feature: "pipelines",
       },
       // Sits with Pipelines — the two are the same kind of thing (a flow canvas)
       // and share the canvas code. `requires` keys off the top-level entry
@@ -372,6 +403,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: "workflows",
         requires: "workflows",
         gate: "workflows",
+        feature: "workflows",
       },
       { titleKey: "function.header", icon: "function", name: "functionList", requires: "pipeline" },
       {
@@ -403,8 +435,20 @@ export const NAV_GROUPS: NavGroupDef[] = [
     parentLink: "/dashboards",
     absorbs: ["dashboards", "reports"],
     children: [
-      { titleKey: "menu.dashboard", icon: "dashboard", name: "dashboards", requires: "dashboards" },
-      { titleKey: "menu.report", icon: "description", name: "reports", requires: "reports" },
+      {
+        titleKey: "menu.dashboard",
+        icon: "dashboard",
+        name: "dashboards",
+        requires: "dashboards",
+        feature: "dashboards",
+      },
+      {
+        titleKey: "menu.report",
+        icon: "description",
+        name: "reports",
+        requires: "reports",
+        feature: "reports",
+      },
     ],
   },
   {
@@ -415,8 +459,21 @@ export const NAV_GROUPS: NavGroupDef[] = [
     parentLink: "/rum",
     absorbs: ["rum", "synthetics", "productAnalytics"],
     children: [
-      { titleKey: "menu.rum", title: "RUM", icon: "devices", name: "RUM", requires: "rum" },
-      { titleKey: "menu.synthetic", icon: "radar", name: "synthetics", requires: "synthetics" },
+      {
+        titleKey: "menu.rum",
+        title: "RUM",
+        icon: "devices",
+        name: "RUM",
+        requires: "rum",
+        feature: "rum",
+      },
+      {
+        titleKey: "menu.synthetic",
+        icon: "radar",
+        name: "synthetics",
+        requires: "synthetics",
+        feature: "synthetics",
+      },
       // The event editors sit outside the shell route, so name every PA route rather than rely on the path prefix.
       {
         titleKey: "menu.productAnalytics",
@@ -424,6 +481,7 @@ export const NAV_GROUPS: NavGroupDef[] = [
         name: PA_ROUTES.shell,
         requires: PA_ROUTES.shell,
         activeOnRoutes: Object.values(PA_ROUTES),
+        feature: "product_analytics",
         beta: true,
       },
     ],
@@ -449,6 +507,7 @@ export const NAV_SUBNAV: Record<string, SubnavChild[]> = {
       icon: "layers",
       name: "traces",
       tab: "spans",
+      feature: "traces",
       defaultForRoute: true,
     },
     {
@@ -456,12 +515,14 @@ export const NAV_SUBNAV: Record<string, SubnavChild[]> = {
       icon: "account-tree",
       name: "traces",
       tab: "traces",
+      feature: "traces",
     },
     {
       titleKey: "menu.serviceGraph",
       icon: "share",
       name: "traces",
       tab: "service-graph",
+      feature: "traces",
       gate: "enterprise",
     },
     {
@@ -469,6 +530,7 @@ export const NAV_SUBNAV: Record<string, SubnavChild[]> = {
       icon: "menu-book",
       name: "traces",
       tab: "services-catalog",
+      feature: "traces",
     },
     // Databases is NOT here — it moved to the Infra group (see NAV_GROUPS).
     // It sat on this flyout while Database Monitoring was read as a view over
diff --git a/web/src/lib/core/Navbar/useNavGateContext.ts b/web/src/lib/core/Navbar/useNavGateContext.ts
index 2fe01385d5..d67a6ce44f 100644
--- a/web/src/lib/core/Navbar/useNavGateContext.ts
+++ b/web/src/lib/core/Navbar/useNavGateContext.ts
@@ -55,6 +55,7 @@ const ALL_GATES_OPEN: NavGateContext = {
   alertCalibrationEnabled: true,
   fleetEnabled: true,
   hiddenMenus: new Set<string>(),
+  features: {},
 };
 
 export function useNavGateContext(): ComputedRef<NavGateContext> {
@@ -83,6 +84,7 @@ export function useNavGateContext(): ComputedRef<NavGateContext> {
       fleetEnabled: z.fleet_enabled !== false,
       // Raw split (no trim) to match how pages test custom_hide_menus.
       hiddenMenus: new Set((z.custom_hide_menus ?? "").split(",")),
+      features: z.features ?? {},
     };
   });
 }
diff --git a/web/src/lib/core/PageHeader/OPageHeader.vue b/web/src/lib/core/PageHeader/OPageHeader.vue
index b1c95f7b14..14ca1db694 100644
--- a/web/src/lib/core/PageHeader/OPageHeader.vue
+++ b/web/src/lib/core/PageHeader/OPageHeader.vue
@@ -70,32 +70,35 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           hasTabs() && !tabsBelow ? 'max-md:flex-wrap' : 'max-md:flex-nowrap',
         ]"
       >
-        <OButton
-          v-if="ownsSidebarTrigger"
-          variant="ghost"
-          size="icon-toolbar"
-          data-test="o-page-layout-mobile-sidebar-btn"
-          :aria-label="t('common.sidePanel')"
-          @click="layoutSidebar?.open()"
-        >
-          <OIcon name="menu" size="sm" />
-        </OButton>
+        <FeatureLockExempt v-if="ownsSidebarTrigger" as="span" class="contents">
+          <OButton
+            variant="ghost"
+            size="icon-toolbar"
+            data-test="o-page-layout-mobile-sidebar-btn"
+            :aria-label="t('common.sidePanel')"
+            @click="layoutSidebar?.open()"
+          >
+            <OIcon name="menu" size="sm" />
+          </OButton>
+        </FeatureLockExempt>
         <slot name="title-prefix" />
 
         <!-- Sub-page: the module-icon tile BECOMES a Back button (same 8×8
            footprint, so the title's X never shifts between list and add/edit). -->
         <template v-if="hasBack()">
           <slot name="back">
-            <button
-              type="button"
-              class="rounded-default bg-surface-subtle text-text-body hover:bg-button-ghost-hover-bg focus-visible:ring-focus-ring-accent inline-flex h-9.5 w-9.5 shrink-0 items-center justify-center transition-colors outline-none focus-visible:ring-4 focus-visible:ring-inset"
-              :title="backLabel"
-              :aria-label="backLabel"
-              :data-test="props.back?.dataTest ?? 'app-page-header-back'"
-              @click="onBack"
-            >
-              <OIcon name="chevron-left" size="md" />
-            </button>
+            <FeatureLockExempt as="span" class="contents">
+              <button
+                type="button"
+                class="rounded-default bg-surface-subtle text-text-body hover:bg-button-ghost-hover-bg focus-visible:ring-focus-ring-accent inline-flex h-9.5 w-9.5 shrink-0 items-center justify-center transition-colors outline-none focus-visible:ring-4 focus-visible:ring-inset"
+                :title="backLabel"
+                :aria-label="backLabel"
+                :data-test="props.back?.dataTest ?? 'app-page-header-back'"
+                @click="onBack"
+              >
+                <OIcon name="chevron-left" size="md" />
+              </button>
+            </FeatureLockExempt>
           </slot>
         </template>
 
@@ -126,21 +129,33 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             titleMinWidth ? 'min-w-40' : '',
           ]"
         >
-          <h1
-            v-if="titleOverflow === 'visible'"
-            class="text-text-heading min-h-6 min-w-0 text-base! leading-[1.45]! font-semibold! tracking-[-0.02em]!"
-            :data-test="titleDataTest"
-          >
-            <slot name="title">{{ title }}</slot>
-          </h1>
-          <OTruncatedText
-            v-else
-            as="h1"
-            class="text-text-heading min-h-6 text-base! leading-[1.45]! font-semibold! tracking-[-0.02em]!"
-            :data-test="titleDataTest"
-          >
-            <slot name="title">{{ title }}</slot>
-          </OTruncatedText>
+          <div class="flex min-w-0 items-center gap-1.5">
+            <h1
+              v-if="titleOverflow === 'visible'"
+              class="text-text-heading min-h-6 min-w-0 text-base! leading-[1.45]! font-semibold! tracking-[-0.02em]!"
+              :data-test="titleDataTest"
+            >
+              <slot name="title">{{ title }}</slot>
+            </h1>
+            <OTruncatedText
+              v-else
+              as="h1"
+              class="text-text-heading min-h-6 min-w-0 text-base! leading-[1.45]! font-semibold! tracking-[-0.02em]!"
+              :data-test="titleDataTest"
+            >
+              <slot name="title">{{ title }}</slot>
+            </OTruncatedText>
+            <span
+              v-if="locked"
+              role="img"
+              :aria-label="lockedLabel"
+              class="lock-chip inline-flex shrink-0"
+              data-test="app-page-header-locked"
+            >
+              <OIcon name="lock" size="sm" />
+              <OTooltip :content="lockedLabel" />
+            </span>
+          </div>
           <!-- Fixed-height subtitle band: keeps the <h1> at an identical Y whether
              the subtitle is present or not, so the title doesn't appear to shift
              when navigating between views. Content is vertically centered. -->
@@ -239,9 +254,12 @@ import OText from "@/lib/core/Typography/OText.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { useFeatureLock, useFeatureNames } from "@/composables/useFeatureLock";
 import { PAGE_LAYOUT_SIDEBAR_KEY } from "@/lib/core/PageLayout/pageLayoutSidebar";
 import { usePageHeaderStatusHost } from "@/lib/core/PageHeader/pageHeaderStatus";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 
 interface BackTarget {
@@ -297,7 +315,16 @@ const PAGE_WRAP_REM = 56;
 const router = useRouter();
 const slots = useSlots();
 const { t } = useI18nTyped();
+const { featureName } = useFeatureNames();
 const { isMobile, lgUp } = useBreakpoint();
+const { locked, feature: lockedFeature } = useFeatureLock();
+const lockedLabel = computed(() =>
+  t("featureLock.headerLocked", {
+    feature: raw(
+      lockedFeature.value ? (featureName(lockedFeature.value) ?? lockedFeature.value) : "",
+    ),
+  }),
+);
 
 // The first header inside a sidebar layout carries its phone trigger, saving the layout a row.
 const layoutSidebar = inject(PAGE_LAYOUT_SIDEBAR_KEY, null);
diff --git a/web/src/lib/core/PageLayout/OPageLayout.spec.ts b/web/src/lib/core/PageLayout/OPageLayout.spec.ts
index 55bf46da97..41313bbac2 100644
--- a/web/src/lib/core/PageLayout/OPageLayout.spec.ts
+++ b/web/src/lib/core/PageLayout/OPageLayout.spec.ts
@@ -14,9 +14,11 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, it, expect, vi } from "vitest";
+import { defineComponent, h, ref } from "vue";
 import { mount } from "@vue/test-utils";
 import { createI18n } from "vue-i18n";
 import OPageLayout from "./OPageLayout.vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
 
 vi.mock("vue-router", () => ({ useRouter: () => ({ push: vi.fn(), back: vi.fn() }) }));
 
@@ -39,4 +41,19 @@ describe("OPageLayout entrance", () => {
       "motion-safe:slide-in-from-bottom-1",
     );
   });
+
+  it("shows the license message without the slide while the page is locked", () => {
+    const wrapper = mount(
+      defineComponent({
+        setup() {
+          provideFeatureLock(ref("workflows"));
+          return () => h(OPageLayout, { title: "Page" }, { default: () => h("div") });
+        },
+      }),
+      { global: { plugins: [i18n] } },
+    );
+
+    expect(wrapper.find('[data-test="page-layout-license-locked"]').exists()).toBe(true);
+    expect(wrapper.html()).not.toContain("slide-in-from-bottom-1");
+  });
 });
diff --git a/web/src/lib/core/PageLayout/OPageLayout.vue b/web/src/lib/core/PageLayout/OPageLayout.vue
index 4f680ffdd4..a33b22cafa 100644
--- a/web/src/lib/core/PageLayout/OPageLayout.vue
+++ b/web/src/lib/core/PageLayout/OPageLayout.vue
@@ -96,7 +96,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     <!-- ── Body (mobile): sidebar collapses into an off-canvas drawer ── -->
     <template v-if="!!slots.sidebar && isMobile">
-      <div
+      <FeatureLockExempt
         v-if="!sidebarTriggerOwner"
         class="border-border-default px-page-edge flex shrink-0 items-center border-b py-1"
         data-drawer-anchor="page-layout-sidebar"
@@ -110,13 +110,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <template #icon-left><OIcon name="menu" size="sm" /></template>
           {{ t("common.sidePanel") }}
         </OButton>
-      </div>
+      </FeatureLockExempt>
       <OContent
         :bleed="bleed"
         :y="padY"
-        :class="[BODY_ENTER, 'flex min-h-0 w-full flex-1 flex-col overflow-hidden']"
+        :class="[bodyEnter, 'flex min-h-0 w-full flex-1 flex-col overflow-hidden']"
       >
-        <slot />
+        <OPageLockedBody :replace="showsOwnBody"><slot /></OPageLockedBody>
       </OContent>
       <ODrawer
         v-model:open="mobileSidebarOpen"
@@ -141,7 +141,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       unit="px"
       :limits="splitterLimits"
       :horizontal="false"
-      :class="[BODY_ENTER, 'min-h-0 flex-1 overflow-hidden']"
+      :class="[bodyEnter, 'min-h-0 flex-1 overflow-hidden']"
     >
       <template #before>
         <div
@@ -160,13 +160,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
       <template #after>
         <OContent :bleed="bleed" :y="padY" class="flex h-full w-full flex-col overflow-hidden">
-          <slot />
+          <OPageLockedBody :replace="showsOwnBody"><slot /></OPageLockedBody>
         </OContent>
       </template>
     </OSplitter>
 
     <!-- ── Body: fixed-width sidebar + main ─────────────────────── -->
-    <div v-else-if="!!slots.sidebar" :class="[BODY_ENTER, 'flex min-h-0 flex-1']">
+    <div v-else-if="!!slots.sidebar" :class="[bodyEnter, 'flex min-h-0 flex-1']">
       <aside
         class="border-border-default flex h-full shrink-0 flex-col overflow-hidden border-e"
         :style="{ width: sidebarWidth + 'px' }"
@@ -174,7 +174,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <slot name="sidebar" />
       </aside>
       <OContent as="section" :bleed="bleed" :y="padY" class="h-full min-w-0 flex-1 overflow-hidden">
-        <slot />
+        <OPageLockedBody :replace="showsOwnBody"><slot /></OPageLockedBody>
       </OContent>
     </div>
 
@@ -182,9 +182,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <ConstrainedPage
       v-else-if="constrained"
       :size="contentSize"
-      :class="[BODY_ENTER, 'min-h-0 flex-1']"
+      :class="[bodyEnter, 'min-h-0 flex-1']"
     >
-      <slot />
+      <OPageLockedBody :replace="showsOwnBody"><slot /></OPageLockedBody>
     </ConstrainedPage>
 
     <!-- ── Body: main only (no sidebar) ─────────────────────────── -->
@@ -193,11 +193,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :bleed="bleed"
       :y="padY"
       :class="[
-        BODY_ENTER,
+        bodyEnter,
         scroll ? 'min-h-0 flex-1 overflow-auto' : 'flex min-h-0 flex-1 flex-col overflow-hidden',
       ]"
     >
-      <slot />
+      <OPageLockedBody :replace="showsOwnBody"><slot /></OPageLockedBody>
     </OContent>
   </div>
 </template>
@@ -210,12 +210,15 @@ import { useRouter } from "vue-router";
 import { ENTER_SLIDE as BODY_ENTER } from "@/lib/styles/motion";
 import OSplitter from "@/lib/core/Splitter/OSplitter.vue";
 import ConstrainedPage from "@/components/common/ConstrainedPage.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import OPageLockedBody from "./OPageLockedBody.vue";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
 import OContent from "@/lib/core/Content/OContent.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 import { PAGE_LAYOUT_SIDEBAR_KEY } from "./pageLayoutSidebar";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 
@@ -317,6 +320,12 @@ const hasHeader = computed(
     !!slots["header-tabs"],
 );
 
+// A layout that is only a sidebar shell has its routed child's header inside the body, so that child shows the lock.
+const showsOwnBody = computed(() => hasHeader.value || !slots.sidebar);
+// A locked page, and the shell around it, shows its license message without the slide so nothing moves while it appears.
+const { locked: pageLocked } = useFeatureLock();
+const bodyEnter = computed(() => (pageLocked.value ? "" : BODY_ENTER));
+
 const internalWidth = ref(props.sidebarWidth);
 
 const sidebarVisible = computed(() => internalWidth.value > 0);
diff --git a/web/src/lib/core/PageLayout/OPageLockedBody.spec.ts b/web/src/lib/core/PageLayout/OPageLockedBody.spec.ts
new file mode 100644
index 0000000000..be63c64d2c
--- /dev/null
+++ b/web/src/lib/core/PageLayout/OPageLockedBody.spec.ts
@@ -0,0 +1,43 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { defineComponent, h, ref } from "vue";
+import { mount, enableAutoUnmount } from "@vue/test-utils";
+import i18n from "@/locales";
+import OPageLockedBody from "./OPageLockedBody.vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
+
+enableAutoUnmount(afterEach);
+
+const mountBody = (lockedFeature: string | null, replace = true) =>
+  mount(
+    defineComponent({
+      setup() {
+        provideFeatureLock(ref(lockedFeature));
+        return () =>
+          h(OPageLockedBody, { replace }, { default: () => h("div", { "data-test": "body" }) });
+      },
+    }),
+    { global: { plugins: [i18n], stubs: { OEmptyState: { template: "<div><slot /></div>" } } } },
+  );
+
+describe("OPageLockedBody", () => {
+  it("shows the page body while nothing is locked", () => {
+    const wrapper = mountBody(null);
+
+    expect(wrapper.find('[data-test="body"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="page-layout-license-locked"]').exists()).toBe(false);
+  });
+
+  it("shows the license message in place of the body while the page is locked", () => {
+    const wrapper = mountBody("workflows");
+
+    expect(wrapper.find('[data-test="page-layout-license-locked"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="body"]').exists()).toBe(false);
+  });
+
+  it("passes the body through on a locked shell so its routed child shows the lock", () => {
+    const wrapper = mountBody("workflows", false);
+
+    expect(wrapper.find('[data-test="body"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="page-layout-license-locked"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/lib/core/PageLayout/OPageLockedBody.vue b/web/src/lib/core/PageLayout/OPageLockedBody.vue
new file mode 100644
index 0000000000..0172044ac4
--- /dev/null
+++ b/web/src/lib/core/PageLayout/OPageLockedBody.vue
@@ -0,0 +1,36 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- A page's body, or the license message in its place while the route's feature is locked: the header, tabs and rails around it stay. A sidebar-only shell passes its routed child through, so the child keeps its own header. -->
+<template>
+  <div
+    v-if="locked && replace"
+    class="flex h-full min-h-0 w-full flex-1 items-center justify-center"
+    data-test="page-layout-license-locked"
+  >
+    <LicenseDeniedState :features="feature ? [feature] : []" />
+  </div>
+  <slot v-else />
+</template>
+
+<script setup lang="ts">
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { useFeatureLock } from "@/composables/useFeatureLock";
+
+withDefaults(defineProps<{ replace?: boolean }>(), { replace: true });
+
+const { locked, feature } = useFeatureLock();
+</script>
diff --git a/web/src/lib/core/Table/OTable.spec.ts b/web/src/lib/core/Table/OTable.spec.ts
index 71a4f5114a..eb7100a8b0 100644
--- a/web/src/lib/core/Table/OTable.spec.ts
+++ b/web/src/lib/core/Table/OTable.spec.ts
@@ -1294,6 +1294,15 @@ describe("OTable", () => {
       expect(forbidden.findComponent({ name: "OEmptyState" }).exists()).toBe(false);
     });
 
+    it("names the missing features instead of the no-access copy for a license denial", async () => {
+      wrapper = mount(OTable, { props: { data: [], columns: makeColumns(), forbidden: true } });
+      expect(wrapper.find('[data-test="o2-table-license-denied"]').exists()).toBe(false);
+      await wrapper.setProps({ forbidden: ["dashboards"] });
+      const denied = wrapper.find('[data-test="o2-table-license-denied"]');
+      expect(denied.exists()).toBe(true);
+      expect(denied.text()).toContain("dashboards");
+    });
+
     it("leaves pinning to the <thead> while rows show", () => {
       wrapper = mount(OTable, { props: { data: makeRows(5), columns: makeColumns() } });
       expect(isPinned(wrapper)).toBe(false);
@@ -2352,6 +2361,64 @@ describe("OTable", () => {
       });
       expect(wrapper.find('[data-test="o2-table-root"]').exists()).toBe(true);
     });
+
+    it("switches a pinned cell's background instantly, in step with its row", () => {
+      const cols: OTableColumnDef<TestRow>[] = [
+        { id: "id", header: "ID", accessorKey: "id" },
+        { id: "actions", header: "", isAction: true },
+      ];
+      wrapper = mount(OTable, {
+        props: { data: makeRows(3), columns: cols, selection: "multiple", selectedIds: ["2"] },
+      });
+      const pinnedCell = (row: number) =>
+        wrapper.find(`[data-test="o2-table-row-${row}"] [data-test="o2-table-cell-actions"]`);
+      expect(pinnedCell(0).classes()).toContain("group-hover/row:bg-table-row-hover-bg");
+      expect(pinnedCell(1).classes()).toContain("bg-table-row-selected-bg");
+      for (const row of [0, 1]) {
+        const motion = pinnedCell(row)
+          .classes()
+          .filter((c) => /(^|:)(transition|duration-)/.test(c));
+        expect(motion).toEqual([]);
+      }
+    });
+
+    it("paints a pinned cell with its row's active, striped and keyboard-focus backgrounds", () => {
+      const cols: OTableColumnDef<TestRow>[] = [
+        { id: "id", header: "ID", accessorKey: "id" },
+        { id: "actions", header: "", isAction: true },
+      ];
+      wrapper = mount(OTable, {
+        props: {
+          data: makeRows(4),
+          columns: cols,
+          striped: true,
+          activeRowIndex: 2,
+          onRowClick: vi.fn(),
+        },
+      });
+      const pinnedCell = (row: number) =>
+        wrapper
+          .find(`[data-test="o2-table-row-${row}"] [data-test="o2-table-cell-actions"]`)
+          .classes();
+      expect(pinnedCell(2)).toContain("bg-table-row-selected-bg");
+      expect(pinnedCell(2)).not.toContain("group-hover/row:bg-table-row-hover-bg");
+      expect(pinnedCell(1)).toContain("bg-table-row-striped-bg");
+      expect(pinnedCell(1)).not.toContain("bg-table-cell-bg");
+      expect(pinnedCell(0)).toContain("bg-table-cell-bg");
+      expect(pinnedCell(0)).toContain("group-focus-visible/row:bg-table-row-hover-bg");
+    });
+
+    it("leaves keyboard-focus fill off a pinned cell whose row cannot take focus", () => {
+      const cols: OTableColumnDef<TestRow>[] = [
+        { id: "id", header: "ID", accessorKey: "id" },
+        { id: "actions", header: "", isAction: true },
+      ];
+      wrapper = mount(OTable, { props: { data: makeRows(2), columns: cols } });
+      const pinned = wrapper.find(
+        '[data-test="o2-table-row-0"] [data-test="o2-table-cell-actions"]',
+      );
+      expect(pinned.classes()).not.toContain("group-focus-visible/row:bg-table-row-hover-bg");
+    });
   });
 
   // ── Highlighting ────────────────────────────────────────────
diff --git a/web/src/lib/core/Table/OTable.types.ts b/web/src/lib/core/Table/OTable.types.ts
index 9dea0e578e..3270ca0d91 100644
--- a/web/src/lib/core/Table/OTable.types.ts
+++ b/web/src/lib/core/Table/OTable.types.ts
@@ -1,6 +1,7 @@
 // Copyright 2026 OpenObserve Inc.
 
 import type { I18nText } from "@/types/i18n";
+import type { ForbiddenState } from "@/utils/featureGate";
 
 import type { Component, ComputedRef, InjectionKey, Ref } from "vue";
 import type { Row, Table } from "@tanstack/vue-table";
@@ -477,11 +478,11 @@ export interface OTableProps<TData = any> {
   streaming?: boolean;
   error?: string | null;
   /**
-   * The data this table lists was denied (403). Shows the no-access state
+   * The data this table lists was denied (403); feature keys mean a license denial. Shows the no-access state
    * instead of the first-run empty state, which would otherwise invite the
    * user to create something they are not allowed to create.
    */
-  forbidden?: boolean;
+  forbidden?: ForbiddenState;
   /** What the forbidden table lists, as the app's access state names it (an IAM resource key). */
   forbiddenResource?: string;
   /** Text shown when data is empty and not loading */
diff --git a/web/src/lib/core/Table/OTable.vue b/web/src/lib/core/Table/OTable.vue
index b7c08a0f02..428cf64841 100644
--- a/web/src/lib/core/Table/OTable.vue
+++ b/web/src/lib/core/Table/OTable.vue
@@ -14,7 +14,8 @@ import {
   watch,
   watchEffect,
 } from "vue";
-import { useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped } from "@/types/i18n";
+import { useFeatureNames } from "@/composables/useFeatureLock";
 import { useTableColumnPersistence } from "./composables/useTableColumnPersistence";
 import OTableColumnToggle from "./sub-components/OTableColumnToggle.vue";
 import { FlexRender, type Row } from "@tanstack/vue-table";
@@ -71,6 +72,7 @@ import OTableOverflowTooltip from "./sub-components/OTableOverflowTooltip.vue";
 import { PIVOT_TABLE_TOTAL_COLUMN_WIDTH } from "@/utils/dashboard/constants";
 
 const { t } = useI18nTyped();
+const { featureNames } = useFeatureNames();
 const props = withDefaults(defineProps<OTableProps<TData>>(), {
   pagination: "client",
   pageSize: 20,
@@ -1877,9 +1879,23 @@ defineExpose({
 
         <!-- ── Access Denied State ───────────────────────────── -->
         <OTableEmpty v-if="showForbidden" :floor="!props.fillHeight" data-test="o2-table-forbidden">
+          <OEmptyState
+            v-if="Array.isArray(props.forbidden)"
+            size="hero"
+            preset="no-access"
+            :title="t('featureLock.toastTitle')"
+            :description="
+              props.forbidden.length
+                ? t('featureLock.toastMessage', {
+                    features: raw(featureNames(props.forbidden)),
+                  })
+                : t('featureLock.toastMessageGeneric')
+            "
+            data-test="o2-table-license-denied"
+          />
           <component
             :is="forbiddenState"
-            v-if="forbiddenState"
+            v-else-if="forbiddenState"
             :resource="props.forbiddenResource"
           />
           <OEmptyState v-else size="hero" preset="no-access" />
diff --git a/web/src/lib/core/Table/sub-components/OTableBodyCell.vue b/web/src/lib/core/Table/sub-components/OTableBodyCell.vue
index 434e080bcf..b8d6b3bca4 100644
--- a/web/src/lib/core/Table/sub-components/OTableBodyCell.vue
+++ b/web/src/lib/core/Table/sub-components/OTableBodyCell.vue
@@ -52,6 +52,9 @@ const props = defineProps<{
   cell: Cell<any, any>;
   row: Row<any>;
   rowSelected?: boolean;
+  rowActive?: boolean;
+  rowStriped?: boolean;
+  rowFocusable?: boolean;
   highlightText?: string;
   shouldHighlight?: boolean;
   getHighlightedHtml?: (columnId: string, cellValue: any) => string | null;
@@ -104,6 +107,16 @@ const slotContentClass = computed(() =>
 
 const isPinned = computed(() => props.cell.column.getIsPinned?.() ?? false);
 
+// A sticky cell paints its own opaque background over the row's, so it must repeat every row state.
+const pinnedBgClass = computed(() => {
+  if (props.rowSelected || props.rowActive) return "bg-table-row-selected-bg";
+  return [
+    props.rowStriped ? "bg-table-row-striped-bg" : "bg-table-cell-bg",
+    "group-hover/row:bg-table-row-hover-bg",
+    props.rowFocusable ? "group-focus-visible/row:bg-table-row-hover-bg" : "",
+  ];
+});
+
 const pinOffset = computed(() => {
   if (!isPinned.value) return 0;
   if (isPinned.value === "left") return props.cell.column.getStart?.("left") ?? 0;
@@ -458,11 +471,7 @@ onBeforeUnmount(() => window.removeEventListener("scroll", onScrollDismiss, true
       bordered && !pivotMerge?.hideBorder ? 'border-table-row-divider border-b' : '',
       alignClass,
       isAction ? 'w-0 whitespace-nowrap' : '',
-      isPinned
-        ? rowSelected
-          ? 'bg-table-row-selected-bg transition-colors duration-(--duration-hover-out)'
-          : 'bg-table-cell-bg group-hover/row:bg-table-row-hover-bg transition-colors duration-(--duration-hover-out) group-hover/row:duration-(--duration-hover-in)'
-        : '',
+      isPinned ? pinnedBgClass : '',
       wrap
         ? 'wrap-anywhere whitespace-normal'
         : horizontalScroll?.value
diff --git a/web/src/lib/core/Table/sub-components/OTableBodyRow.spec.ts b/web/src/lib/core/Table/sub-components/OTableBodyRow.spec.ts
index b1b8e403c7..41bf768ce7 100644
--- a/web/src/lib/core/Table/sub-components/OTableBodyRow.spec.ts
+++ b/web/src/lib/core/Table/sub-components/OTableBodyRow.spec.ts
@@ -119,7 +119,7 @@ describe("OTableBodyRow selection marking", () => {
     }
   });
 
-  it("gives a clickable row an inset focus-visible outline and no outline transition", () => {
+  it("gives a clickable row an inset focus-visible outline and no transition", () => {
     const classes = mountSelectable({ clickable: true });
     expect(classes).toEqual(
       expect.arrayContaining([
@@ -129,14 +129,12 @@ describe("OTableBodyRow selection marking", () => {
         "focus-visible:outline-focus-ring-accent",
       ]),
     );
-    expect(classes).toContain("transition-[background-color]");
-    expect(classes).not.toContain("transition-colors");
+    expect(classes.filter((c) => /(^|:)transition/.test(c))).toEqual([]);
   });
 
-  it("puts the hover-in and hover-out motion tokens on the background transition", () => {
+  it("switches the hover background instantly so a fast pointer leaves no trail of fading rows", () => {
     const classes = mountSelectable({});
-    expect(classes).toContain("duration-(--duration-hover-out)");
-    expect(classes).toContain("hover:duration-(--duration-hover-in)");
+    expect(classes.filter((c) => /(^|:)(transition|duration-)/.test(c))).toEqual([]);
     expect(classes.some((c) => c.startsWith("focus-visible:outline"))).toBe(false);
   });
 });
diff --git a/web/src/lib/core/Table/sub-components/OTableBodyRow.vue b/web/src/lib/core/Table/sub-components/OTableBodyRow.vue
index 560ea64e06..7c3c402d6e 100644
--- a/web/src/lib/core/Table/sub-components/OTableBodyRow.vue
+++ b/web/src/lib/core/Table/sub-components/OTableBodyRow.vue
@@ -231,7 +231,6 @@ function onRowMouseleave() {
     :tabindex="clickable ? 0 : undefined"
     :class="[
       'group/row',
-      'transition-[background-color] duration-(--duration-hover-out) hover:duration-(--duration-hover-in)',
       clickable ? 'cursor-pointer' : '',
       isRowSelected || isActive
         ? 'bg-table-row-selected-bg [--color-text-secondary:var(--color-table-row-text-secondary-tinted)]'
@@ -331,6 +330,9 @@ function onRowMouseleave() {
       :cell="cell"
       :row="row"
       :row-selected="isRowSelected"
+      :row-active="isActive"
+      :row-striped="isStriped"
+      :row-focusable="clickable"
       :highlight-text="highlightText"
       :should-highlight="shouldHighlightColumn?.(cell.column.id) ?? false"
       :get-highlighted-html="getHighlightedHtml"
diff --git a/web/src/lib/core/ToggleGroup/OToggleGroupItem.spec.ts b/web/src/lib/core/ToggleGroup/OToggleGroupItem.spec.ts
index 92a2e8587b..3ecf86c656 100644
--- a/web/src/lib/core/ToggleGroup/OToggleGroupItem.spec.ts
+++ b/web/src/lib/core/ToggleGroup/OToggleGroupItem.spec.ts
@@ -43,6 +43,12 @@ describe("OToggleGroupItem", () => {
     expect(wrapper.find('[data-testid="icon-right"]').exists()).toBe(true);
   });
 
+  it.each(["iconLeft", "iconRight"])("paints a %s lock with the locked-icon token", (prop) => {
+    const wrapper = mountItem({ value: "x", [prop]: "lock" }, { default: () => h("span", "A") });
+    expect(wrapper.find(".lock-chip").exists()).toBe(true);
+    wrapper.unmount();
+  });
+
   it("applies base item classes", () => {
     const wrapper = mountItem({ value: "x" }, { default: () => h("span", "A") });
     const btn = wrapper.find("button");
diff --git a/web/src/lib/core/ToggleGroup/OToggleGroupItem.vue b/web/src/lib/core/ToggleGroup/OToggleGroupItem.vue
index c961c70939..26580e9ff1 100644
--- a/web/src/lib/core/ToggleGroup/OToggleGroupItem.vue
+++ b/web/src/lib/core/ToggleGroup/OToggleGroupItem.vue
@@ -14,6 +14,7 @@ import { computed, inject, useAttrs, useId, type ComputedRef } from "vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 defineOptions({ inheritAttrs: false });
 
@@ -34,7 +35,8 @@ const menu = inject(ToggleGroupMenuKey, null);
 const attrs = useAttrs();
 const reasonId = `${useId()}-reason`;
 const labelId = `${useId()}-label`;
-const unavailable = computed(() => props.disabled && props.focusableUnavailable);
+const isDisabled = useLockedDisabled(() => props.disabled);
+const unavailable = computed(() => isDisabled.value && props.focusableUnavailable);
 const menuItemTestId = computed(() =>
   attrs["data-test"] ? `${attrs["data-test"]}-item` : `o-toggle-group-item-${String(props.value)}`,
 );
@@ -51,7 +53,7 @@ const dragKey = computed<string>(() => String(props.value));
 
 // Disabled items are never draggable — they can't be interacted with at all.
 const isReorderable = computed<boolean>(
-  () => (context?.value.reorderable ?? false) && !props.disabled,
+  () => (context?.value.reorderable ?? false) && !isDisabled.value,
 );
 /** This item is the one being dragged → dim it. */
 const isDragging = computed<boolean>(
@@ -79,6 +81,10 @@ const sizeClasses: Record<NonNullable<ToggleGroupItemProps["size"]>, string> = {
   xs: "h-5 px-1.5 text-xs max-md:px-1",
 };
 
+function lockClass(icon: string): string | undefined {
+  return icon === "lock" ? "lock-chip" : undefined;
+}
+
 // Icon size mirrors the toggle size
 const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" | "md"> = {
   md: "md",
@@ -91,13 +97,18 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
   <template v-if="menu?.mode === 'trigger'">
     <template v-if="menu.isActive(props.value)">
       <slot v-if="slots['icon-left']" name="icon-left" />
-      <OIcon v-else-if="props.iconLeft" :name="props.iconLeft" size="sm" />
+      <OIcon
+        v-else-if="props.iconLeft"
+        :name="props.iconLeft"
+        size="sm"
+        :class="lockClass(props.iconLeft)"
+      />
       <slot />
     </template>
   </template>
   <ODropdownItem
     v-else-if="menu"
-    :disabled="props.disabled"
+    :disabled="isDisabled"
     :focusable-unavailable="props.focusableUnavailable"
     :description="unavailable ? props.tooltip : undefined"
     :data-test="menuItemTestId"
@@ -105,7 +116,12 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
   >
     <template v-if="slots['icon-left'] || props.iconLeft" #icon-left>
       <slot v-if="slots['icon-left']" name="icon-left" />
-      <OIcon v-else-if="props.iconLeft" :name="props.iconLeft" size="sm" />
+      <OIcon
+        v-else-if="props.iconLeft"
+        :name="props.iconLeft"
+        size="sm"
+        :class="lockClass(props.iconLeft)"
+      />
     </template>
     <slot />
     <template #icon-right>
@@ -119,7 +135,7 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
   -->
   <span
     v-else
-    :class="props.disabled ? 'cursor-not-allowed' : 'contents'"
+    :class="isDisabled ? 'cursor-not-allowed' : 'contents'"
     :tabindex="unavailable ? 0 : undefined"
     :role="unavailable ? 'button' : undefined"
     :aria-disabled="unavailable || undefined"
@@ -130,11 +146,11 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
     :aria-describedby="unavailable && props.tooltip ? reasonId : undefined"
   >
     <!-- First child when disabled: with nothing before it, the tooltip binds to this wrapper, the only element that gets the hover. -->
-    <OTooltip v-if="props.tooltip && props.disabled" :content="props.tooltip" />
+    <OTooltip v-if="props.tooltip && isDisabled" :content="props.tooltip" />
     <ToggleGroupItem
       v-bind="$attrs"
       :value="props.value"
-      :disabled="props.disabled"
+      :disabled="isDisabled"
       :aria-hidden="unavailable || undefined"
       :class="[
         // Layout
@@ -186,7 +202,12 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
       />
       <!-- Slot takes precedence; falls back to `icon-left` prop -->
       <slot v-if="slots['icon-left']" name="icon-left" />
-      <OIcon v-else-if="props.iconLeft" :name="props.iconLeft" :size="iconSize[props.size]" />
+      <OIcon
+        v-else-if="props.iconLeft"
+        :name="props.iconLeft"
+        :size="iconSize[props.size]"
+        :class="lockClass(props.iconLeft)"
+      />
       <span v-if="unavailable" :id="labelId" class="contents"><slot /></span>
       <slot v-else />
       <slot v-if="slots['icon-right']" name="icon-right" />
@@ -194,12 +215,12 @@ const iconSize: Record<NonNullable<ToggleGroupItemProps["size"]>, "xs" | "sm" |
         v-else-if="props.iconRight"
         :name="props.iconRight"
         :size="iconSize[props.size]"
-        :class="props.iconRight === 'lock' ? 'text-warning-600' : ''"
+        :class="lockClass(props.iconRight)"
       />
     </ToggleGroupItem>
     <span v-if="unavailable && props.tooltip" :id="reasonId" aria-hidden="true" class="sr-only">{{
       props.tooltip
     }}</span>
-    <OTooltip v-if="props.tooltip && !props.disabled" :content="props.tooltip" />
+    <OTooltip v-if="props.tooltip && !isDisabled" :content="props.tooltip" />
   </span>
 </template>
diff --git a/web/src/lib/feedback/Toast/useToast.ts b/web/src/lib/feedback/Toast/useToast.ts
index 0603d633e7..6170be8ba0 100644
--- a/web/src/lib/feedback/Toast/useToast.ts
+++ b/web/src/lib/feedback/Toast/useToast.ts
@@ -1,6 +1,7 @@
 import { reactive, ref } from "vue";
 import type { ToastVariant, ToastOptions, ToastPosition, ToastDetail } from "./OToast.types";
 import type { I18nText } from "@/types/i18n";
+import { isLicenseDenialToast } from "@/composables/useFeatureLock";
 
 // ── Internal record shape ────────────────────────────────────────────────────
 
@@ -126,6 +127,9 @@ function capitalizeFirst(str: I18nText): I18nText {
 
 function toast(options: ToastOptions): DismissFn {
   const variant: ToastVariant = options.variant ?? "default";
+  // The license warning toast already names the features a refused request needed.
+  if (variant === "error" && isLicenseDenialToast(options.message))
+    return Object.assign(() => {}, { id: "" });
   const position: ToastPosition = options.position ?? defaultPositions[variant];
   const timeout = options.timeout !== undefined ? options.timeout : defaultTimeouts[variant];
 
diff --git a/web/src/lib/forms/Checkbox/OCheckbox.vue b/web/src/lib/forms/Checkbox/OCheckbox.vue
index 296e2ab871..265327503f 100644
--- a/web/src/lib/forms/Checkbox/OCheckbox.vue
+++ b/web/src/lib/forms/Checkbox/OCheckbox.vue
@@ -10,6 +10,7 @@ import type {
 } from "./OCheckbox.types";
 import { CHECKBOX_GROUP_KEY } from "./OCheckbox.types";
 import { computed, inject } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 const props = withDefaults(defineProps<CheckboxProps>(), {
   size: "md",
@@ -60,7 +61,7 @@ const checked = computed((): boolean | "indeterminate" => {
   return Boolean(props.modelValue);
 });
 
-const isDisabled = computed(() => props.disabled || (groupContext?.disabled ?? false));
+const isDisabled = useLockedDisabled(() => props.disabled || (groupContext?.disabled ?? false));
 
 const dataState = computed<"checked" | "unchecked" | "indeterminate">(() => {
   if (checked.value === "indeterminate") return "indeterminate";
diff --git a/web/src/lib/forms/Color/OColor.vue b/web/src/lib/forms/Color/OColor.vue
index c3a9281009..d2d8dfc030 100644
--- a/web/src/lib/forms/Color/OColor.vue
+++ b/web/src/lib/forms/Color/OColor.vue
@@ -3,6 +3,7 @@
 
 import type { ColorProps, ColorEmits, ColorSlots } from "./OColor.types";
 import { computed, ref, useAttrs, useId, watch } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import {
   PopoverRoot,
   PopoverPortal,
@@ -44,6 +45,7 @@ const props = withDefaults(defineProps<ColorProps>(), {
 
 const emit = defineEmits<ColorEmits>();
 defineSlots<ColorSlots>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
@@ -129,7 +131,7 @@ const wrapperClasses = computed(() => [
     : "border-datepicker-border hover:border-datepicker-hover-border",
   "focus-within:border-datepicker-focus-border",
   "focus-within:ring-2 focus-within:ring-datepicker-focus-ring",
-  props.disabled ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60" : "",
+  isDisabled.value ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60" : "",
   heightClasses[props.size ?? "md"],
 ]);
 </script>
@@ -158,10 +160,10 @@ const wrapperClasses = computed(() => [
       <PopoverRoot>
         <PopoverTrigger
           type="button"
-          :disabled="disabled || readonly"
+          :disabled="isDisabled || readonly"
           :aria-label="label ? t('common.pickColorFor', { label }) : t('common.pickColor')"
           class="ring-offset-surface-base focus-visible:ring-datepicker-focus-ring rounded-s-default flex shrink-0 items-center ps-2 pe-1 ring-offset-1 transition-[box-shadow] duration-150 outline-none focus-visible:ring-2"
-          :class="disabled || readonly ? 'cursor-not-allowed' : 'cursor-pointer'"
+          :class="isDisabled || readonly ? 'cursor-not-allowed' : 'cursor-pointer'"
         >
           <span
             :class="['rounded-default border-datepicker-border border', swatchSize[size ?? 'md']]"
@@ -213,7 +215,7 @@ const wrapperClasses = computed(() => [
               :value="swatchHex"
               maxlength="7"
               :placeholder="t('components.color.hexPlaceholder')"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default text-datepicker-text placeholder:text-datepicker-placeholder bg-datepicker-bg border-datepicker-border focus:border-datepicker-focus-border w-full border px-2 py-1 font-mono text-xs outline-none"
               @input="handleText"
             />
@@ -230,7 +232,7 @@ const wrapperClasses = computed(() => [
         :name="name"
         :placeholder="placeholder ?? '#000000'"
         :readonly="readonly"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :aria-invalid="hasError || undefined"
         :tabindex="inputTabindex"
         maxlength="7"
diff --git a/web/src/lib/forms/Combobox/OCombobox.vue b/web/src/lib/forms/Combobox/OCombobox.vue
index 8e61fcab00..8a82d03bfd 100644
--- a/web/src/lib/forms/Combobox/OCombobox.vue
+++ b/web/src/lib/forms/Combobox/OCombobox.vue
@@ -18,6 +18,7 @@ import { computed, nextTick, onMounted, ref, useAttrs, useId, useSlots, watch }
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { splitControlAttrs, warnIfUnlabelled } from "@/lib/forms/controlAttrs";
 import { useI18nTyped } from "@/types/i18n";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
 
@@ -43,6 +44,7 @@ const props = withDefaults(defineProps<ComboboxProps>(), {
 
 const emit = defineEmits<ComboboxEmits>();
 defineSlots<ComboboxSlots>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 const slots = useSlots();
 const _fallbackId = useId();
@@ -199,7 +201,7 @@ const hasInsideLabel = computed(
       :for="inputId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
-        disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
@@ -221,7 +223,7 @@ const hasInsideLabel = computed(
       :ignore-filter="true"
       :open-on-click="true"
       :open-on-focus="true"
-      :disabled="disabled"
+      :disabled="isDisabled"
       @update:model-value="onSelect"
     >
       <ComboboxAnchor class="relative flex w-full items-center">
@@ -238,7 +240,7 @@ const hasInsideLabel = computed(
           :id="inputId"
           :name="name"
           :placeholder="placeholder"
-          :disabled="disabled"
+          :disabled="isDisabled"
           :tabindex="inputTabindex"
           auto-complete="off"
           :class="[
diff --git a/web/src/lib/forms/Date/ODate.vue b/web/src/lib/forms/Date/ODate.vue
index 157993776d..034d539bb7 100644
--- a/web/src/lib/forms/Date/ODate.vue
+++ b/web/src/lib/forms/Date/ODate.vue
@@ -3,6 +3,7 @@
 
 import type { DateProps, DateEmits, DateSlots } from "./ODate.types";
 import { computed, ref, useAttrs, useId, type Ref } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import {
   DatePickerRoot,
   DatePickerField,
@@ -51,6 +52,7 @@ const props = withDefaults(defineProps<DateProps>(), {
 
 const emit = defineEmits<DateEmits>();
 defineSlots<DateSlots>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
@@ -140,7 +142,7 @@ const wrapperClasses = computed(() => [
     : "border-datepicker-border hover:border-datepicker-hover-border",
   "focus-within:border-datepicker-focus-border",
   "focus-within:ring-[0.125rem] focus-within:ring-focus-ring-accent",
-  props.disabled ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60" : "",
+  isDisabled.value ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60" : "",
   heightClasses[props.size ?? "md"],
   isInsideLabel.value ? "relative" : "",
 ]);
@@ -175,7 +177,7 @@ const wrapperClasses = computed(() => [
       :model-value="autoApply === false ? stagedDate : rekaValue"
       :min-value="rekaMin"
       :max-value="rekaMax"
-      :disabled="disabled"
+      :disabled="isDisabled"
       :readonly="readonly"
       :name="name"
       @update:model-value="handleDateChange"
@@ -341,7 +343,7 @@ const wrapperClasses = computed(() => [
         >
           <button
             type="button"
-            :disabled="disabled"
+            :disabled="isDisabled"
             class="rounded-default bg-datepicker-day-selected-bg text-datepicker-day-selected-text ring-offset-surface-base focus-visible:ring-datepicker-focus-ring px-4 py-1.5 text-xs font-medium ring-offset-1 transition-[box-shadow] duration-150 outline-none hover:opacity-90 focus-visible:ring-2 disabled:cursor-not-allowed disabled:opacity-50"
             @click="handleApply"
           >
diff --git a/web/src/lib/forms/DateTimeRange/ODateTimeRange.vue b/web/src/lib/forms/DateTimeRange/ODateTimeRange.vue
index 5cf86ca9f3..3810dcbbd6 100644
--- a/web/src/lib/forms/DateTimeRange/ODateTimeRange.vue
+++ b/web/src/lib/forms/DateTimeRange/ODateTimeRange.vue
@@ -11,6 +11,7 @@ import type {
   DateTimeMode,
 } from "./ODateTimeRange.types";
 import { computed, ref, useAttrs, watch, type Ref } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import {
   PopoverRoot,
   PopoverTrigger,
@@ -57,6 +58,7 @@ const props = withDefaults(defineProps<DateTimeRangeProps>(), {
 
 const emit = defineEmits<DateTimeRangeEmits>();
 defineSlots<DateTimeRangeSlots>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 defineOptions({ inheritAttrs: false });
 const $attrs = useAttrs();
 const parentDataTest = computed(() => $attrs["data-test"] as string | undefined);
@@ -72,7 +74,7 @@ const _popoverOpen = ref(false);
 const popoverOpen = computed({
   get: () => _popoverOpen.value,
   set: (val: boolean) => {
-    if (!props.disabled) _popoverOpen.value = val;
+    if (!isDisabled.value) _popoverOpen.value = val;
   },
 });
 
@@ -234,7 +236,7 @@ function handleRangeChange(value: DateRange | undefined) {
 
 // ── Apply actions ──────────────────────────────────────────────
 function selectRelative(unit: RelativeUnit, amount: number) {
-  if (isRelativeDisabled(unit, amount) || props.disabled) return;
+  if (isRelativeDisabled(unit, amount) || isDisabled.value) return;
   stagedRelativeUnit.value = unit;
   stagedRelativeAmount.value = amount;
   if (props.autoApply) commitRelative();
@@ -295,7 +297,7 @@ const triggerClasses = computed(() => [
   hasError.value
     ? "border-datepicker-error-border"
     : "border-datepicker-border hover:border-datepicker-hover-border",
-  props.disabled
+  isDisabled.value
     ? "opacity-60 cursor-not-allowed bg-datepicker-disabled-bg border-datepicker-disabled-border"
     : "cursor-pointer",
 ]);
@@ -328,7 +330,7 @@ const triggerClasses = computed(() => [
           role="button"
           :aria-expanded="popoverOpen"
           :aria-haspopup="true"
-          :aria-disabled="disabled || undefined"
+          :aria-disabled="isDisabled || undefined"
           :tabindex="inputTabindex"
           data-test="datetimerange-trigger"
         >
@@ -425,7 +427,7 @@ const triggerClasses = computed(() => [
                 v-for="val in RELATIVE_OPTIONS[unit]"
                 :key="val"
                 type="button"
-                :disabled="isRelativeDisabled(unit, val) || disabled"
+                :disabled="isRelativeDisabled(unit, val) || isDisabled"
                 :class="[
                   'rounded-default ring-offset-surface-base focus-visible:ring-datepicker-focus-ring h-7 w-8 text-xs tabular-nums ring-offset-1 transition-[color,background-color,border-color,box-shadow] duration-150 outline-none focus-visible:ring-2',
                   stagedRelativeUnit === unit &&
@@ -452,14 +454,14 @@ const triggerClasses = computed(() => [
               v-model="customAmount"
               type="number"
               min="1"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default border-datepicker-border bg-datepicker-bg text-datepicker-text focus:border-datepicker-focus-border h-7 w-16 border px-2 text-xs tabular-nums outline-none disabled:opacity-50"
               data-test="datetimerange-custom-amount"
               @keydown.enter="applyCustomRelative"
             />
             <select
               v-model="customUnit"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default border-datepicker-border bg-datepicker-bg text-datepicker-text focus:border-datepicker-focus-border h-7 flex-1 border px-2 text-xs outline-none disabled:opacity-50"
               data-test="datetimerange-custom-unit"
             >
@@ -475,10 +477,10 @@ const triggerClasses = computed(() => [
             <span class="text-datepicker-relative-label text-xs">{{ t("common.timezone") }}</span>
             <button
               type="button"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default border-datepicker-inner-border bg-datepicker-bg text-datepicker-text flex h-7 w-full items-center justify-between border px-2 text-xs outline-none disabled:cursor-not-allowed disabled:opacity-50"
               data-test="datetimerange-timezone-trigger"
-              @click="!disabled && (tzOpen = !tzOpen)"
+              @click="!isDisabled && (tzOpen = !tzOpen)"
             >
               <span class="truncate">{{ tzLabel(stagedTimezone) }}</span>
               <svg
@@ -497,7 +499,7 @@ const triggerClasses = computed(() => [
               </svg>
             </button>
             <div
-              v-if="tzOpen && !disabled"
+              v-if="tzOpen && !isDisabled"
               class="rounded-default border-datepicker-inner-border overflow-hidden border"
             >
               <input
@@ -540,7 +542,7 @@ const triggerClasses = computed(() => [
           >
             <button
               type="button"
-              :disabled="disabled || stagedRelativeAmount <= 0"
+              :disabled="isDisabled || stagedRelativeAmount <= 0"
               class="rounded-default ring-offset-surface-base bg-datepicker-day-selected-bg text-datepicker-day-selected-text focus-visible:ring-datepicker-focus-ring px-4 py-1.5 text-sm font-medium ring-offset-1 transition-[color,background-color,border-color,box-shadow] duration-150 outline-none hover:opacity-90 focus-visible:ring-2 disabled:cursor-not-allowed disabled:opacity-50"
               data-test="datetimerange-relative-apply"
               @click="commitRelative"
@@ -559,7 +561,7 @@ const triggerClasses = computed(() => [
           <!-- Range calendar -->
           <RangeCalendarRoot
             :model-value="stagedRange"
-            :disabled="disabled"
+            :disabled="isDisabled"
             :min-value="minDate ? tryParseDate(minDate) : undefined"
             :max-value="maxDate ? tryParseDate(maxDate) : undefined"
             week-start-on="0"
@@ -658,7 +660,7 @@ const triggerClasses = computed(() => [
               v-model="stagedStartTime"
               :label="t('common.startTime')"
               :with-seconds="withSeconds"
-              :disabled="disabled"
+              :disabled="isDisabled"
               data-test="datetimerange-start-time"
               @change="autoApply && emitAbsolute()"
             />
@@ -666,7 +668,7 @@ const triggerClasses = computed(() => [
               v-model="stagedEndTime"
               :label="t('common.endTime')"
               :with-seconds="withSeconds"
-              :disabled="disabled"
+              :disabled="isDisabled"
               data-test="datetimerange-end-time"
               @change="autoApply && emitAbsolute()"
             />
@@ -677,10 +679,10 @@ const triggerClasses = computed(() => [
             <span class="text-datepicker-label text-xs">{{ t("common.timezone") }}</span>
             <button
               type="button"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default border-datepicker-inner-border bg-datepicker-bg text-datepicker-text flex h-9 w-full items-center justify-between border px-3 text-sm outline-none disabled:cursor-not-allowed disabled:opacity-50"
               data-test="datetimerange-timezone-trigger"
-              @click="!disabled && (tzOpen = !tzOpen)"
+              @click="!isDisabled && (tzOpen = !tzOpen)"
             >
               <span class="truncate">{{ tzLabel(stagedTimezone) }}</span>
               <svg
@@ -699,7 +701,7 @@ const triggerClasses = computed(() => [
               </svg>
             </button>
             <div
-              v-if="tzOpen && !disabled"
+              v-if="tzOpen && !isDisabled"
               class="rounded-default border-datepicker-inner-border overflow-hidden border"
             >
               <input
@@ -739,7 +741,7 @@ const triggerClasses = computed(() => [
           <div v-if="!autoApply" class="flex justify-end">
             <button
               type="button"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="rounded-default ring-offset-surface-base bg-datepicker-day-selected-bg text-datepicker-day-selected-text focus-visible:ring-datepicker-focus-ring px-4 py-1.5 text-sm font-medium ring-offset-1 transition-[color,background-color,border-color,box-shadow] duration-150 outline-none hover:opacity-90 focus-visible:ring-2 disabled:cursor-not-allowed disabled:opacity-50"
               data-test="datetimerange-apply"
               @click="handleApply"
diff --git a/web/src/lib/forms/EmojiPicker/OEmojiPicker.vue b/web/src/lib/forms/EmojiPicker/OEmojiPicker.vue
index 338b589b39..e1bf180dbe 100644
--- a/web/src/lib/forms/EmojiPicker/OEmojiPicker.vue
+++ b/web/src/lib/forms/EmojiPicker/OEmojiPicker.vue
@@ -6,6 +6,7 @@
 // fixed catalog instead of a continuous space.
 
 import { computed, inject, ref, watch, nextTick } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OPopover from "@/lib/overlay/Popover/OPopover.vue";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
@@ -24,6 +25,7 @@ const props = withDefaults(defineProps<EmojiPickerProps>(), {
 });
 
 const emit = defineEmits<EmojiPickerEmits>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 /** Grid width in cells — Up/Down step by this many. */
 const COLUMNS = 7;
@@ -153,7 +155,7 @@ watch(flatEmojis, (list) => {
       <template #trigger>
         <button
           type="button"
-          :disabled="disabled"
+          :disabled="isDisabled"
           :aria-label="ariaLabel ?? t('components.emojiPicker.chooseIcon')"
           data-test="emoji-picker-trigger"
           :class="[
@@ -163,7 +165,7 @@ watch(flatEmojis, (list) => {
             modelValue
               ? 'border-border-default bg-surface-base hover:bg-surface-subtle-hover'
               : 'border-border-default text-text-secondary hover:bg-surface-subtle-hover hover:text-text-heading border-dashed',
-            disabled ? 'cursor-not-allowed opacity-60' : 'cursor-pointer',
+            isDisabled ? 'cursor-not-allowed opacity-60' : 'cursor-pointer',
           ]"
         >
           <OGlyph v-if="modelValue" :token="modelValue" :size="size === 'sm' ? 'md' : 'lg'" />
@@ -225,7 +227,7 @@ watch(flatEmojis, (list) => {
     </OPopover>
 
     <button
-      v-if="modelValue && !disabled"
+      v-if="modelValue && !isDisabled"
       type="button"
       :aria-label="t('components.emojiPicker.removeIcon')"
       :title="t('components.emojiPicker.removeIcon')"
diff --git a/web/src/lib/forms/File/OFile.vue b/web/src/lib/forms/File/OFile.vue
index c2abd80236..eb924b98f1 100644
--- a/web/src/lib/forms/File/OFile.vue
+++ b/web/src/lib/forms/File/OFile.vue
@@ -3,6 +3,7 @@
 
 import type { FileProps, FileEmits, FileSlots, FileValue } from "./OFile.types";
 import { computed, ref, useAttrs, useId } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
@@ -32,6 +33,8 @@ const emit = defineEmits<FileEmits>();
 
 defineSlots<FileSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
 const inputRef = ref<HTMLInputElement | null>(null);
@@ -128,12 +131,12 @@ function removeFile(index: number, event?: Event) {
 }
 
 function openPicker() {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   inputRef.value?.click();
 }
 
 function onDragOver(event: DragEvent) {
-  if (props.disabled || !props.dropZone) return;
+  if (isDisabled.value || !props.dropZone) return;
   event.preventDefault();
   isDragging.value = true;
 }
@@ -170,7 +173,7 @@ function filterByAccept(files: File[], accept: string): File[] {
 }
 
 function onDrop(event: DragEvent) {
-  if (props.disabled || !props.dropZone) return;
+  if (isDisabled.value || !props.dropZone) return;
   event.preventDefault();
   isDragging.value = false;
   const dropped = event.dataTransfer?.files ?? null;
@@ -192,7 +195,7 @@ const wrapperClasses = computed(() => [
     : hasError.value
       ? "bg-file-bg border-file-error-border"
       : "bg-file-bg border-file-border hover:border-file-hover-border",
-  props.disabled
+  isDisabled.value
     ? "bg-file-disabled-bg border-file-disabled-border opacity-60 cursor-not-allowed"
     : "cursor-pointer",
   "focus-within:border-file-focus-border focus-within:ring-2 focus-within:ring-file-focus-ring",
@@ -233,7 +236,7 @@ const wrapperClasses = computed(() => [
         :name="name"
         :multiple="multiple"
         :accept="accept"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :tabindex="inputTabindex"
         class="sr-only"
         :aria-invalid="hasError || undefined"
@@ -283,7 +286,7 @@ const wrapperClasses = computed(() => [
             {{ formatSize(file.size) }}
           </span>
           <button
-            v-if="!disabled"
+            v-if="!isDisabled"
             type="button"
             tabindex="-1"
             :aria-label="t('components.file.removeFile')"
@@ -307,7 +310,7 @@ const wrapperClasses = computed(() => [
       </div>
 
       <button
-        v-if="files.length > 0 && !disabled"
+        v-if="files.length > 0 && !isDisabled"
         type="button"
         tabindex="-1"
         :aria-label="t('components.file.clearAll')"
diff --git a/web/src/lib/forms/InlineEdit/OInlineEdit.vue b/web/src/lib/forms/InlineEdit/OInlineEdit.vue
index f296f5b3ef..dee161b8df 100644
--- a/web/src/lib/forms/InlineEdit/OInlineEdit.vue
+++ b/web/src/lib/forms/InlineEdit/OInlineEdit.vue
@@ -21,6 +21,7 @@
 // without an inline style or a hardcoded px.
 
 import { computed, nextTick, ref, useAttrs, watch } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
@@ -61,7 +62,8 @@ const editRootEl = ref<HTMLElement | null>(null);
 
 const displayValue = computed(() => (props.modelValue ?? "").trim());
 const isEmpty = computed(() => displayValue.value === "");
-const canEdit = computed(() => !props.disabled && !props.readonly);
+const isDisabled = useLockedDisabled(() => props.disabled);
+const canEdit = computed(() => !isDisabled.value && !props.readonly);
 
 // Keep the draft in step with the model whenever the user isn't actively typing:
 // in display mode, and in edit mode until the first keystroke. So an auto-name
@@ -338,7 +340,7 @@ defineExpose({ focus: startEdit });
         v-else
         ref="triggerRef"
         type="button"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :aria-label="ariaLabel"
         :data-test="dataTest ? `${dataTest}-trigger` : undefined"
         data-inline-edit-trigger
@@ -350,7 +352,7 @@ defineExpose({ focus: startEdit });
           // clicked into — the required-name state must be visible at rest, not
           // only mid-edit (matches the pipeline/panel headers).
           error ? 'ring-input-border-error' : 'ring-transparent',
-          disabled
+          isDisabled
             ? 'cursor-not-allowed opacity-60'
             : error
               ? 'cursor-text'
@@ -375,7 +377,7 @@ defineExpose({ focus: startEdit });
              sits at reduced opacity so it reads as an affordance, not a control,
              and brightens on hover. -->
         <OIcon
-          v-if="!disabled"
+          v-if="!isDisabled"
           name="edit"
           size="sm"
           class="text-text-secondary shrink-0 opacity-50 transition-opacity group-hover/inline-edit:opacity-100"
@@ -384,7 +386,7 @@ defineExpose({ focus: startEdit });
              than a native `title`: this hint is the ONLY place a generated name
              explains itself, so it can't sit behind the browser's ~1s delay in
              unstyled system chrome. -->
-        <OTooltip v-if="editHint && !disabled" :content="editHint" max-width="18rem" />
+        <OTooltip v-if="editHint && !isDisabled" :content="editHint" max-width="18rem" />
       </button>
 
       <!-- Trailing content beside the name — display mode only, so it never
diff --git a/web/src/lib/forms/Input/OInput.vue b/web/src/lib/forms/Input/OInput.vue
index bc669bf3c1..501211ee2b 100644
--- a/web/src/lib/forms/Input/OInput.vue
+++ b/web/src/lib/forms/Input/OInput.vue
@@ -5,6 +5,7 @@ import type { InputProps, InputEmits, InputSlots } from "./OInput.types";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { splitControlAttrs, warnIfUnlabelled } from "@/lib/forms/controlAttrs";
 import { useI18nTyped } from "@/types/i18n";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import { computed, nextTick, onBeforeUnmount, onMounted, ref, useAttrs, useId, watch } from "vue";
 
 const { t } = useI18nTyped();
@@ -54,6 +55,8 @@ const emit = defineEmits<InputEmits>();
 
 defineSlots<InputSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 // useId() must be called at setup top-level — not inside computed — otherwise
 // each re-evaluation produces a new id, breaking the <label :for> association.
 const _fallbackId = useId();
@@ -275,7 +278,7 @@ const wrapperClasses = computed(() => [
     : "border-input-border hover:border-input-border-hover focus-within:border-input-border-focus focus-within:ring-[0.125rem] focus-within:ring-focus-ring-accent",
   /* Disabled inputs get a muted bg + dashed border so they read as obviously
      inactive at a glance. */
-  props.disabled
+  isDisabled.value
     ? "bg-input-disabled-bg border-input-disabled-border cursor-not-allowed border-dashed"
     : "",
   props.readonly ? "border-input-border bg-input-bg" : "",
@@ -291,7 +294,7 @@ const wrapperClasses = computed(() => [
       :for="inputId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
-        props.disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
@@ -343,7 +346,7 @@ const wrapperClasses = computed(() => [
         :value="String(modelValue ?? '')"
         :name="name"
         :placeholder="placeholder"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :readonly="readonly"
         :aria-required="required || undefined"
         :aria-invalid="hasError || undefined"
@@ -386,7 +389,7 @@ const wrapperClasses = computed(() => [
         :type="effectiveType"
         :name="name"
         :placeholder="placeholder"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :readonly="readonly"
         :aria-required="required || undefined"
         :autofocus="autofocus"
diff --git a/web/src/lib/forms/Input/OTextarea.vue b/web/src/lib/forms/Input/OTextarea.vue
index 664d2e7325..eaf3b08bff 100644
--- a/web/src/lib/forms/Input/OTextarea.vue
+++ b/web/src/lib/forms/Input/OTextarea.vue
@@ -5,6 +5,7 @@ import type { TextareaProps, TextareaEmits, TextareaSlots } from "./OTextarea.ty
 import { computed, nextTick, onMounted, ref, useAttrs, useId, watch } from "vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { splitControlAttrs, warnIfUnlabelled } from "@/lib/forms/controlAttrs";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 // Forward the consumer's `data-test` from <OTextarea data-test="…"> onto the
 // root wrapper so E2E selectors can scope to the specific field instance.
@@ -33,6 +34,8 @@ const emit = defineEmits<TextareaEmits>();
 
 defineSlots<TextareaSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const _fallbackId = useId();
 const textareaId = computed(() => props.id ?? _fallbackId);
 const textareaRef = ref<HTMLTextAreaElement | null>(null);
@@ -121,7 +124,7 @@ const wrapperClasses = computed(() => [
     : "border-input-border hover:border-input-border-hover focus-within:border-input-border-focus",
   /* Same opacity+dashed treatment as OInput so disabled textareas are
      visually obvious vs enabled ones. */
-  props.disabled
+  isDisabled.value
     ? "bg-input-disabled-bg border-input-disabled-border cursor-not-allowed border-dashed"
     : "",
 ]);
@@ -138,7 +141,7 @@ const wrapperClasses = computed(() => [
       :for="textareaId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
-        props.disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
@@ -163,7 +166,7 @@ const wrapperClasses = computed(() => [
         :value="modelValue ?? ''"
         :name="name"
         :placeholder="placeholder"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :readonly="readonly"
         :autofocus="autofocus"
         :maxlength="maxlength"
diff --git a/web/src/lib/forms/OptionGroup/OOptionGroup.vue b/web/src/lib/forms/OptionGroup/OOptionGroup.vue
index 4c6f51cf86..b168e78278 100644
--- a/web/src/lib/forms/OptionGroup/OOptionGroup.vue
+++ b/web/src/lib/forms/OptionGroup/OOptionGroup.vue
@@ -12,6 +12,7 @@ import ORadio from "../Radio/ORadio.vue";
 import OCheckboxGroup from "../Checkbox/OCheckboxGroup.vue";
 import OCheckbox from "../Checkbox/OCheckbox.vue";
 import { computed, useAttrs } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 
 defineOptions({ inheritAttrs: false });
@@ -34,6 +35,8 @@ const emit = defineEmits<OptionGroupEmits>();
 
 defineSlots<OptionGroupSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const effectiveError = computed(() => props.errorMessage || (props.error ? " " : null) || null);
 
 // Named computed (not an inline `as X | undefined` cast) so the template
@@ -69,7 +72,7 @@ function handleCheckbox(val: (string | number)[]) {
       v-if="$slots.label || label || $slots.tooltip"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
-        disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
@@ -89,7 +92,7 @@ function handleCheckbox(val: (string | number)[]) {
     <ORadioGroup
       v-if="type === 'radio'"
       :model-value="radioValue"
-      :disabled="disabled"
+      :disabled="isDisabled"
       :orientation="orientation"
       :name="name"
       :label="label"
@@ -102,7 +105,7 @@ function handleCheckbox(val: (string | number)[]) {
         :data-test-value="String(opt.value)"
         :value="opt.value"
         :label="opt.label"
-        :disabled="disabled || opt.disabled"
+        :disabled="isDisabled || opt.disabled"
         :size="size"
       />
     </ORadioGroup>
@@ -110,7 +113,7 @@ function handleCheckbox(val: (string | number)[]) {
     <OCheckboxGroup
       v-else
       :model-value="checkboxValue"
-      :disabled="disabled"
+      :disabled="isDisabled"
       @update:model-value="handleCheckbox"
     >
       <div :class="optionLayoutClasses">
@@ -121,7 +124,7 @@ function handleCheckbox(val: (string | number)[]) {
           :data-test-value="String(opt.value)"
           :value="opt.value as string"
           :label="opt.label"
-          :disabled="disabled || opt.disabled"
+          :disabled="isDisabled || opt.disabled"
           :size="size"
         />
       </div>
diff --git a/web/src/lib/forms/Radio/ORadio.vue b/web/src/lib/forms/Radio/ORadio.vue
index 93e2d02862..c3dcb25f48 100644
--- a/web/src/lib/forms/Radio/ORadio.vue
+++ b/web/src/lib/forms/Radio/ORadio.vue
@@ -14,6 +14,7 @@ import type { RadioProps, RadioSlots } from "./ORadio.types";
 import { RADIO_VALUE_MAP_KEY } from "./ORadio.types";
 import { RadioGroupItem, RadioGroupIndicator } from "reka-ui";
 import { computed, inject, useAttrs, watchEffect } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 defineOptions({ inheritAttrs: false });
 
@@ -37,6 +38,8 @@ const props = withDefaults(defineProps<RadioProps>(), {
 
 defineSlots<RadioSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const valueMap = inject(RADIO_VALUE_MAP_KEY, null);
 const resolvedValue = computed(() => props.value ?? props.val);
 
@@ -71,7 +74,7 @@ const surfaceClasses = computed(() => [
         "has-[[data-state=checked]]:ring-2 has-[[data-state=checked]]:ring-accent/20",
       ]
     : "items-center",
-  props.disabled ? "cursor-not-allowed opacity-60" : "cursor-pointer",
+  isDisabled.value ? "cursor-not-allowed opacity-60" : "cursor-pointer",
 ]);
 </script>
 
@@ -95,7 +98,7 @@ const surfaceClasses = computed(() => [
     <RadioGroupItem
       :id="props.id"
       :value="String(resolvedValue ?? '')"
-      :disabled="props.disabled"
+      :disabled="isDisabled"
       :data-test="parentDataTest"
       :data-test-value="parentDataTestValue"
       :class="[
@@ -121,7 +124,7 @@ const surfaceClasses = computed(() => [
       :class="[
         'o-input-label text-compact leading-tight select-none',
         props.variant === 'card' ? 'flex-1' : '',
-        props.disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
diff --git a/web/src/lib/forms/Range/ORange.vue b/web/src/lib/forms/Range/ORange.vue
index 55a2b76c94..a5e6bec8bd 100644
--- a/web/src/lib/forms/Range/ORange.vue
+++ b/web/src/lib/forms/Range/ORange.vue
@@ -3,6 +3,7 @@
 
 import type { RangeProps, RangeEmits, RangeSlots, RangeValue } from "./ORange.types";
 import { computed, ref, useAttrs, useId } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { useI18nTyped } from "@/types/i18n";
 
@@ -33,6 +34,8 @@ const emit = defineEmits<RangeEmits>();
 
 defineSlots<RangeSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const _fallbackId = useId();
 const baseId = computed(() => props.id ?? _fallbackId);
 
@@ -203,7 +206,7 @@ function vToValue(clientY: number): number {
 }
 
 function onVertDown(e: PointerEvent) {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   const target = e.target as HTMLElement;
   e.preventDefault();
   if (target.dataset.thumb === "min") {
@@ -232,7 +235,7 @@ function onVertDown(e: PointerEvent) {
 }
 
 function onVertMove(e: PointerEvent) {
-  if (!dragging || props.disabled) return;
+  if (!dragging || isDisabled.value) return;
   const v = vToValue(e.clientY);
   if (dragging === "min") {
     emit("update:modelValue", {
@@ -248,7 +251,7 @@ function onVertMove(e: PointerEvent) {
 }
 
 function onVertUp(e: PointerEvent) {
-  if (!dragging || props.disabled) {
+  if (!dragging || isDisabled.value) {
     dragging = null;
     return;
   }
@@ -291,7 +294,7 @@ function snapToStep(v: number): number {
 }
 
 function onHorizDown(e: PointerEvent) {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   // Prevent native range behaviour for pointer events so we control the drag.
   // Keyboard arrow-key events are unaffected by this.
   e.preventDefault();
@@ -318,7 +321,7 @@ function onHorizDown(e: PointerEvent) {
 }
 
 function onHorizMove(e: PointerEvent) {
-  if (!hDragging || props.disabled) return;
+  if (!hDragging || isDisabled.value) return;
   const raw = hToValue(e.clientX);
   const snapped = snapToStep(raw);
   if (hDragging === "min") {
@@ -341,7 +344,7 @@ function onHorizUp(e: PointerEvent) {
   // Always clear visual overrides so the thumb snaps to the final value
   dragVisualMin.value = null;
   dragVisualMax.value = null;
-  if (!hDragging || props.disabled) {
+  if (!hDragging || isDisabled.value) {
     hDragging = null;
     return;
   }
@@ -387,7 +390,7 @@ const { t } = useI18nTyped();
         ref="vertTrackRef"
         class="relative flex h-full shrink-0 justify-center"
         :class="
-          disabled
+          isDisabled
             ? 'cursor-not-allowed opacity-60'
             : hasRange
               ? 'cursor-pointer'
@@ -404,7 +407,7 @@ const { t } = useI18nTyped();
           class="absolute top-0 bottom-0 rounded-full"
           :class="[
             trackWidthV[resolvedSize],
-            disabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
+            isDisabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
           ]"
           aria-hidden="true"
         />
@@ -413,7 +416,7 @@ const { t } = useI18nTyped();
           class="absolute rounded-full"
           :class="[
             trackWidthV[resolvedSize],
-            disabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
+            isDisabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
           ]"
           :style="{ top: vertFilledTop + '%', height: vertFilledHeight + '%' }"
           aria-hidden="true"
@@ -424,7 +427,7 @@ const { t } = useI18nTyped();
             v-for="ml in markerLabels"
             :key="ml.value"
             class="absolute right-0 left-0 h-px opacity-50"
-            :class="disabled ? 'bg-slider-disabled-track' : 'bg-slider-track'"
+            :class="isDisabled ? 'bg-slider-disabled-track' : 'bg-slider-track'"
             :style="{ top: valueToTop(ml.value) + '%' }"
             aria-hidden="true"
           />
@@ -437,7 +440,7 @@ const { t } = useI18nTyped();
             'left-1/2 -translate-x-1/2 touch-none select-none',
             thumbSize[resolvedSize],
             vertMinZClass,
-            disabled
+            isDisabled
               ? 'bg-slider-disabled-thumb cursor-not-allowed'
               : hasRange
                 ? 'bg-slider-thumb cursor-grab'
@@ -459,7 +462,7 @@ const { t } = useI18nTyped();
             'left-1/2 -translate-x-1/2 touch-none select-none',
             thumbSize[resolvedSize],
             vertMaxZClass,
-            disabled
+            isDisabled
               ? 'bg-slider-disabled-thumb cursor-not-allowed'
               : hasRange
                 ? 'bg-slider-thumb cursor-grab'
@@ -523,7 +526,7 @@ const { t } = useI18nTyped();
         ref="hTrackRef"
         :class="[
           'relative flex w-full items-center',
-          disabled
+          isDisabled
             ? 'cursor-not-allowed opacity-60'
             : hasRange
               ? 'cursor-pointer'
@@ -539,7 +542,7 @@ const { t } = useI18nTyped();
           :class="[
             'absolute right-0 left-0 rounded-full',
             trackHeight[resolvedSize],
-            disabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
+            isDisabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
           ]"
           aria-hidden="true"
         />
@@ -548,7 +551,7 @@ const { t } = useI18nTyped();
           :class="[
             'absolute rounded-full',
             trackHeight[resolvedSize],
-            disabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
+            isDisabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
           ]"
           :style="{
             left: minPercent + '%',
@@ -565,7 +568,7 @@ const { t } = useI18nTyped();
           :max="max"
           :step="step"
           :value="current.min"
-          :disabled="disabled"
+          :disabled="isDisabled"
           :aria-label="t('common.rangeMinimum', { label: label ?? t('common.rangeFallbackLabel') })"
           :aria-invalid="hasError || undefined"
           :class="[
@@ -574,7 +577,7 @@ const { t } = useI18nTyped();
             minZClass,
             'focus-visible:ring-slider-focus-ring rounded-full outline-none focus-visible:ring-2',
             trackHeight[resolvedSize],
-            disabled ? 'cursor-not-allowed' : hasRange ? 'cursor-pointer' : 'cursor-default',
+            isDisabled ? 'cursor-not-allowed' : hasRange ? 'cursor-pointer' : 'cursor-default',
           ]"
           @input="handleMin"
           @change="handleMin"
@@ -589,7 +592,7 @@ const { t } = useI18nTyped();
           :max="max"
           :step="step"
           :value="current.max"
-          :disabled="disabled"
+          :disabled="isDisabled"
           :aria-label="t('common.rangeMaximum', { label: label ?? t('common.rangeFallbackLabel') })"
           :aria-invalid="hasError || undefined"
           :class="[
@@ -598,7 +601,7 @@ const { t } = useI18nTyped();
             maxZClass,
             'focus-visible:ring-slider-focus-ring rounded-full outline-none focus-visible:ring-2',
             trackHeight[resolvedSize],
-            disabled ? 'cursor-not-allowed' : hasRange ? 'cursor-pointer' : 'cursor-default',
+            isDisabled ? 'cursor-not-allowed' : hasRange ? 'cursor-pointer' : 'cursor-default',
           ]"
           @input="handleMax"
           @change="handleMax"
@@ -616,7 +619,7 @@ const { t } = useI18nTyped();
           :class="[
             'border-slider-thumb-border pointer-events-none absolute z-30 rounded-full border-2',
             thumbSize[resolvedSize],
-            disabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
+            isDisabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
           ]"
           :style="{
             left: `clamp(0px, calc(${minPercent}% - ${thumbHalf[resolvedSize]}), calc(100% - ${thumbSizePx[resolvedSize]}))`,
@@ -629,7 +632,7 @@ const { t } = useI18nTyped();
           :class="[
             'border-slider-thumb-border pointer-events-none absolute z-30 rounded-full border-2',
             thumbSize[resolvedSize],
-            disabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
+            isDisabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
           ]"
           :style="{
             left: `clamp(0px, calc(${maxPercent}% - ${thumbHalf[resolvedSize]}), calc(100% - ${thumbSizePx[resolvedSize]}))`,
diff --git a/web/src/lib/forms/Select/OSelect.vue b/web/src/lib/forms/Select/OSelect.vue
index 4eb581beb2..9628985fab 100644
--- a/web/src/lib/forms/Select/OSelect.vue
+++ b/web/src/lib/forms/Select/OSelect.vue
@@ -54,6 +54,7 @@ import {
   watchEffect,
 } from "vue";
 import useBreakpoint from "@/composables/useBreakpoint";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import { mergeDescribedBy, splitControlAttrs, warnIfUnlabelled } from "@/lib/forms/controlAttrs";
 import {
   O_DROPDOWN_NESTED_KEY,
@@ -140,6 +141,7 @@ const props = withDefaults(defineProps<SelectProps>(), {
 defineOptions({ inheritAttrs: false });
 const $attrs = useAttrs();
 const parentDataTest = computed(() => $attrs["data-test"] as string | undefined);
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 // Without a label the icon is aria-hidden and unreachable by assistive tech; the tooltip's own content never gets a name otherwise.
 const tooltipIconLabel = computed(() =>
@@ -751,7 +753,7 @@ function close() {
 function focus() {
   if (typeof document === "undefined") return;
   document.getElementById(inputId.value)?.focus();
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   if (listboxModeEnabled.value) {
     popoverOpen.value = true;
   } else {
@@ -766,7 +768,7 @@ defineExpose({ close, focus });
 // event is consumed here so page-level single-letter shortcuts (logs "s",
 // "r", "h", …) never fire while the select has keyboard focus.
 function handleTriggerKeydown(e: KeyboardEvent) {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   if (e.ctrlKey || e.metaKey || e.altKey) return;
   if (e.key.length !== 1 || e.key === " ") return;
   e.preventDefault();
@@ -1034,7 +1036,7 @@ const isOpen = computed(() => (listboxModeEnabled.value ? popoverOpen.value : se
 // the `click` a native <label for> forwards never opens them; open explicitly.
 // `.prevent` (on the template handler) stops the redundant native forwarding.
 function handleLabelClick() {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   if (listboxModeEnabled.value) {
     popoverOpen.value = true;
   } else {
@@ -1296,7 +1298,7 @@ const overflowSelectedCount = computed(() =>
 // clear button toggles into view.
 const isInlineAppearance = computed(() => props.appearance === "inline");
 const triggerTextTone = computed(() =>
-  props.disabled
+  isDisabled.value
     ? "text-select-disabled-text"
     : hasSelection.value
       ? "text-select-text"
@@ -1317,7 +1319,7 @@ const inlineTriggerClasses = computed(() => [
   "focus:outline-none focus-visible:outline-solid focus-visible:outline-2 focus-visible:outline-focus-ring-accent",
   // The hover ring is gated on !hasError so it can't override the resting error
   // ring on hover (equal specificity, later class wins) and hide the error.
-  props.disabled
+  isDisabled.value
     ? "ring-transparent cursor-not-allowed opacity-60"
     : hasError.value
       ? "ring-select-border-error cursor-pointer hover:bg-surface-subtle hover:text-text-heading"
@@ -1366,7 +1368,7 @@ const fieldWidthClass = computed(() => {
       :for="inputId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
-        disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text cursor-pointer font-medium',
       ]"
@@ -1395,7 +1397,7 @@ const fieldWidthClass = computed(() => {
             type="button"
             :id="inputId"
             :name="name"
-            :disabled="disabled"
+            :disabled="isDisabled"
             :tabindex="inputTabindex"
             role="combobox"
             :aria-expanded="popoverOpen"
@@ -1503,7 +1505,7 @@ const fieldWidthClass = computed(() => {
                       // width, letting any ancestor squeeze it to a lone ellipsis.
                       isInlineAppearance ? 'whitespace-nowrap' : 'flex-1 truncate text-sm',
                       labelPosition === 'inside' && label ? 'text-xs leading-4' : '',
-                      disabled
+                      isDisabled
                         ? 'text-select-disabled-text'
                         : hasSelection
                           ? 'text-select-text'
@@ -1608,7 +1610,7 @@ const fieldWidthClass = computed(() => {
             <ListboxRoot
               :model-value="listboxStringModelValue"
               :multiple="multiple"
-              :disabled="disabled"
+              :disabled="isDisabled"
               class="flex min-h-0 flex-1 flex-col"
               @update:model-value="handleListboxUpdate"
             >
@@ -2044,7 +2046,7 @@ const fieldWidthClass = computed(() => {
       v-else
       :model-value="stringValue"
       :open="selectOpen"
-      :disabled="disabled"
+      :disabled="isDisabled"
       :name="name"
       @update:model-value="handleUpdate"
       @update:open="
diff --git a/web/src/lib/forms/Slider/OSlider.vue b/web/src/lib/forms/Slider/OSlider.vue
index 6920b89208..eef6312cdc 100644
--- a/web/src/lib/forms/Slider/OSlider.vue
+++ b/web/src/lib/forms/Slider/OSlider.vue
@@ -3,6 +3,7 @@
 
 import type { SliderProps, SliderEmits, SliderSlots } from "./OSlider.types";
 import { computed, useAttrs, useId } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 
 defineOptions({ inheritAttrs: false });
@@ -29,6 +30,8 @@ const emit = defineEmits<SliderEmits>();
 
 defineSlots<SliderSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
 
@@ -132,14 +135,14 @@ const resolvedSize = computed(() => props.size ?? "md");
     <div
       :class="[
         'relative flex w-full items-center',
-        disabled ? 'cursor-not-allowed opacity-60' : 'cursor-pointer',
+        isDisabled ? 'cursor-not-allowed opacity-60' : 'cursor-pointer',
       ]"
     >
       <div
         :class="[
           'absolute right-0 left-0 rounded-full',
           trackHeight[resolvedSize],
-          disabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
+          isDisabled ? 'bg-slider-disabled-track' : 'bg-slider-track',
         ]"
         aria-hidden="true"
       />
@@ -147,7 +150,7 @@ const resolvedSize = computed(() => props.size ?? "md");
         :class="[
           'absolute left-0 rounded-full',
           trackHeight[resolvedSize],
-          disabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
+          isDisabled ? 'bg-slider-disabled-track-fill' : 'bg-slider-track-fill',
         ]"
         :style="{ width: fillPercent + '%' }"
         aria-hidden="true"
@@ -161,7 +164,7 @@ const resolvedSize = computed(() => props.size ?? "md");
         :max="max"
         :step="step"
         :value="currentValue"
-        :disabled="disabled"
+        :disabled="isDisabled"
         :tabindex="inputTabindex"
         :aria-invalid="hasError || undefined"
         :class="[
@@ -169,7 +172,7 @@ const resolvedSize = computed(() => props.size ?? "md");
           'relative z-10 m-0 w-full appearance-none bg-transparent',
           'ring-offset-surface-base focus-visible:ring-slider-focus-ring rounded-full ring-offset-1 transition-[box-shadow] duration-150 outline-none focus-visible:ring-2',
           trackHeight[resolvedSize],
-          disabled ? 'cursor-not-allowed' : 'cursor-pointer',
+          isDisabled ? 'cursor-not-allowed' : 'cursor-pointer',
         ]"
         @input="handleInput"
         @change="handleChange"
@@ -181,7 +184,7 @@ const resolvedSize = computed(() => props.size ?? "md");
         :class="[
           'border-slider-thumb-border pointer-events-none absolute rounded-full border-2',
           thumbSize[resolvedSize],
-          disabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
+          isDisabled ? 'bg-slider-disabled-thumb' : 'bg-slider-thumb',
         ]"
         :style="{
           left: `calc(${fillPercent}% - ${thumbHalf[resolvedSize]})`,
diff --git a/web/src/lib/forms/Switch/OSwitch.vue b/web/src/lib/forms/Switch/OSwitch.vue
index fd196d0d4c..cc5fc0af37 100644
--- a/web/src/lib/forms/Switch/OSwitch.vue
+++ b/web/src/lib/forms/Switch/OSwitch.vue
@@ -5,6 +5,7 @@ import type { SwitchProps, SwitchEmits, SwitchSlots } from "./OSwitch.types";
 import { computed, onMounted, ref, useAttrs, useId, useSlots, watch } from "vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { splitControlAttrs, warnIfUnlabelled } from "@/lib/forms/controlAttrs";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 defineOptions({ inheritAttrs: false });
 const $attrs = useAttrs();
@@ -26,6 +27,8 @@ const emit = defineEmits<SwitchEmits>();
 
 defineSlots<SwitchSlots>();
 
+const isDisabled = useLockedDisabled(() => props.disabled);
+
 // ── Local state — immediate visual feedback ────────────────────────────────
 const internalValue = ref(props.modelValue);
 
@@ -43,7 +46,7 @@ const isChecked = computed((): boolean => {
 });
 
 function toggle() {
-  if (props.disabled) return;
+  if (isDisabled.value) return;
   const next = !isChecked.value;
   let emitValue: typeof props.modelValue;
   if (props.checkedValue !== undefined || props.uncheckedValue !== undefined) {
@@ -111,7 +114,7 @@ onMounted(() =>
     :class="[
       'inline-flex items-center gap-2',
       labelPosition === 'left' ? 'flex-row-reverse' : 'flex-row',
-      disabled ? 'cursor-not-allowed' : 'cursor-pointer',
+      isDisabled ? 'cursor-not-allowed' : 'cursor-pointer',
     ]"
     @click="toggle"
   >
@@ -125,7 +128,7 @@ onMounted(() =>
       :aria-labelledby="hasLabel ? labelId : undefined"
       :data-state="isChecked ? 'checked' : 'unchecked'"
       :data-test="parentDataTest ? `${parentDataTest}-btn` : undefined"
-      :disabled="disabled"
+      :disabled="isDisabled"
       :tabindex="inputTabindex"
       v-bind="controlAttrs"
       :class="[
@@ -136,12 +139,12 @@ onMounted(() =>
            ON       → primary FILLED track + white thumb (high contrast)
            OFF      → transparent track + primary outline + primary thumb
            DISABLED → transparent + grey dashed outline + grey thumb */
-        props.disabled
+        isDisabled
           ? 'border-switch-disabled-border border-dashed bg-transparent'
           : isChecked
             ? 'bg-switch-track-on border-switch-border'
             : 'border-switch-border-off bg-transparent',
-        props.disabled ? 'cursor-not-allowed' : 'cursor-pointer',
+        isDisabled ? 'cursor-not-allowed' : 'cursor-pointer',
         'outline-none',
         'focus-visible:ring-focus-ring-accent focus-visible:ring-4',
         'transition-[color,background-color,border-color,box-shadow] duration-200',
@@ -152,11 +155,7 @@ onMounted(() =>
           'block rounded-full',
           'transition-transform duration-200',
           currentSizes.thumb,
-          props.disabled
-            ? 'bg-switch-disabled-thumb'
-            : isChecked
-              ? 'bg-white'
-              : 'bg-switch-thumb-off',
+          isDisabled ? 'bg-switch-disabled-thumb' : isChecked ? 'bg-white' : 'bg-switch-thumb-off',
           isChecked ? currentSizes.thumbTranslate : 'translate-x-0',
         ]"
       />
@@ -167,7 +166,7 @@ onMounted(() =>
       :id="labelId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight select-none',
-        disabled
+        isDisabled
           ? 'text-input-label-text-disabled font-normal'
           : 'text-input-label-text font-medium',
       ]"
diff --git a/web/src/lib/forms/Time/OTime.vue b/web/src/lib/forms/Time/OTime.vue
index 100809f64e..de29008e3c 100644
--- a/web/src/lib/forms/Time/OTime.vue
+++ b/web/src/lib/forms/Time/OTime.vue
@@ -3,6 +3,7 @@
 
 import type { TimeProps, TimeEmits, TimeSlots } from "./OTime.types";
 import { computed, ref, useAttrs, useId, watch } from "vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 import { PopoverRoot, PopoverTrigger, PopoverPortal, PopoverContent } from "reka-ui";
 import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
@@ -31,6 +32,7 @@ const props = withDefaults(defineProps<TimeProps>(), {
 
 const emit = defineEmits<TimeEmits>();
 defineSlots<TimeSlots>();
+const isDisabled = useLockedDisabled(() => props.disabled);
 
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
@@ -157,7 +159,7 @@ function isClockNumSelected(num: ClockNum): boolean {
 
 // ── Clock interactions ─────────────────────────────────────────
 function onClockClick(num: ClockNum) {
-  if (props.disabled || props.readonly) return;
+  if (isDisabled.value || props.readonly) return;
 
   if (clockMode.value === "hour") {
     if (props.format24) {
@@ -286,7 +288,7 @@ const fieldClasses = computed(() => [
     : "border-datepicker-border hover:border-datepicker-hover-border",
   "focus-within:border-datepicker-focus-border",
   "focus-within:ring-[0.125rem] focus-within:ring-focus-ring-accent",
-  props.disabled
+  isDisabled.value
     ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60 cursor-not-allowed"
     : "",
   heightClasses[props.size ?? "md"],
@@ -317,9 +319,9 @@ const fieldClasses = computed(() => [
         :id="inputId"
         role="group"
         :aria-invalid="hasError || undefined"
-        :aria-disabled="disabled || undefined"
+        :aria-disabled="isDisabled || undefined"
         :class="fieldClasses"
-        :data-disabled="disabled || undefined"
+        :data-disabled="isDisabled || undefined"
         :data-test="parentDataTest"
       >
         <PopoverTrigger
@@ -327,7 +329,7 @@ const fieldClasses = computed(() => [
           type="button"
           tabindex="-1"
           class="text-datepicker-icon flex shrink-0 cursor-pointer items-center ps-3 outline-none select-none focus-visible:opacity-80"
-          :disabled="disabled || undefined"
+          :disabled="isDisabled || undefined"
           :aria-label="t('components.time.openTimePicker')"
         >
           <OIcon name="schedule" size="sm" />
@@ -344,7 +346,7 @@ const fieldClasses = computed(() => [
           :tabindex="inputTabindex"
           :placeholder="placeholder ?? raw('HH:MM')"
           :maxlength="withSeconds ? 8 : 5"
-          :disabled="disabled || undefined"
+          :disabled="isDisabled || undefined"
           :readonly="readonly || undefined"
           :class="[
             'text-datepicker-text min-w-0 flex-1 bg-transparent ps-2 outline-none',
@@ -360,7 +362,7 @@ const fieldClasses = computed(() => [
           :value="modelValue ?? ''"
           :tabindex="inputTabindex"
           :step="withSeconds ? 1 : 60"
-          :disabled="disabled || undefined"
+          :disabled="isDisabled || undefined"
           :readonly="readonly || undefined"
           :class="[
             'text-datepicker-text min-w-0 flex-1 bg-transparent ps-2 outline-none',
diff --git a/web/src/lib/navigation/Pagination/OPagination.vue b/web/src/lib/navigation/Pagination/OPagination.vue
index c23769ee65..6c3c143bfd 100644
--- a/web/src/lib/navigation/Pagination/OPagination.vue
+++ b/web/src/lib/navigation/Pagination/OPagination.vue
@@ -3,6 +3,7 @@ import { computed, useAttrs } from "vue";
 import type { PaginationProps, PaginationEmits } from "./OPagination.types";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { useI18nTyped } from "@/types/i18n";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
 
@@ -19,6 +20,7 @@ const props = withDefaults(defineProps<PaginationProps>(), {
 });
 
 const emit = defineEmits<PaginationEmits>();
+const isDisabled = useLockedDisabled(() => props.disable);
 
 /** Clamp a value between min and max (inclusive). */
 const clamp = (val: number, min: number, max: number) => Math.min(Math.max(val, min), max);
@@ -47,7 +49,7 @@ const isFirst = computed(() => props.modelValue <= 1);
 const isLast = computed(() => props.modelValue >= props.max);
 
 const navigate = (page: number) => {
-  if (props.disable) return;
+  if (isDisabled.value) return;
   const clamped = clamp(page, 1, props.max);
   if (clamped !== props.modelValue) {
     emit("update:modelValue", clamped);
@@ -67,11 +69,11 @@ const navigate = (page: number) => {
       type="button"
       class="o-pagination__btn rounded-default flex size-7 items-center justify-center transition-colors"
       :class="[
-        isFirst || disable
+        isFirst || isDisabled
           ? 'text-pagination-nav-disabled-text cursor-not-allowed opacity-50'
           : 'text-pagination-nav-text hover:bg-pagination-nav-hover-bg cursor-pointer',
       ]"
-      :disabled="isFirst || disable"
+      :disabled="isFirst || isDisabled"
       :aria-label="t('components.pagination.previousPage')"
       :data-test="parentDataTest ? `${parentDataTest}-prev` : undefined"
       @click="navigate(modelValue - 1)"
@@ -88,11 +90,11 @@ const navigate = (page: number) => {
       :class="[
         page === modelValue
           ? 'bg-pagination-item-active-bg text-pagination-item-active-text cursor-default'
-          : disable
+          : isDisabled
             ? 'text-pagination-item-disabled-text cursor-not-allowed opacity-50'
             : 'text-pagination-item-text hover:bg-pagination-item-hover-bg cursor-pointer',
       ]"
-      :disabled="disable && page !== modelValue"
+      :disabled="isDisabled && page !== modelValue"
       :aria-label="t('common.pageNumber', { page })"
       :aria-current="page === modelValue ? 'page' : undefined"
       :data-test="parentDataTest ? `${parentDataTest}-page-${page}` : undefined"
@@ -108,11 +110,11 @@ const navigate = (page: number) => {
       type="button"
       class="o-pagination__btn rounded-default flex size-7 items-center justify-center transition-colors"
       :class="[
-        isLast || disable
+        isLast || isDisabled
           ? 'text-pagination-nav-disabled-text cursor-not-allowed opacity-50'
           : 'text-pagination-nav-text hover:bg-pagination-nav-hover-bg cursor-pointer',
       ]"
-      :disabled="isLast || disable"
+      :disabled="isLast || isDisabled"
       :aria-label="t('components.pagination.nextPage')"
       :data-test="parentDataTest ? `${parentDataTest}-next` : undefined"
       @click="navigate(modelValue + 1)"
diff --git a/web/src/lib/navigation/Tabs/OTab.spec.ts b/web/src/lib/navigation/Tabs/OTab.spec.ts
index f881885be3..2fa6773154 100644
--- a/web/src/lib/navigation/Tabs/OTab.spec.ts
+++ b/web/src/lib/navigation/Tabs/OTab.spec.ts
@@ -25,6 +25,9 @@ function mountTab(
     dense?: boolean;
     reorderable?: boolean;
     disableDrag?: boolean;
+    suffixIcon?: string;
+    suffixLabel?: string;
+    tooltip?: string;
     slots?: Record<string, string>;
   } = {},
 ) {
@@ -38,6 +41,9 @@ function mountTab(
     dense = false,
     reorderable = false,
     disableDrag = false,
+    suffixIcon,
+    suffixLabel,
+    tooltip,
     slots = {},
   } = options;
 
@@ -59,7 +65,7 @@ function mountTab(
         })),
       );
       return {
-        tabProps: { name, label, icon, disable, disableDrag },
+        tabProps: { name, label, icon, disable, disableDrag, suffixIcon, suffixLabel, tooltip },
         modelValue: activeTab,
         orientation: isVertical ? "vertical" : "horizontal",
       };
@@ -112,6 +118,14 @@ describe("OTab", () => {
     expect(wrapper.find('[role="tab"]').attributes("data-state")).toBe("inactive");
   });
 
+  it("keeps the active styling on a disabled active tab, and the disabled one elsewhere", () => {
+    const active = mountTab({ name: "tab1", activeTab: "tab1", disable: true });
+    expect(active.find('[role="tab"]').classes()).toContain("text-tabs-active-text");
+    expect(active.find('[role="tab"]').classes()).not.toContain("text-tabs-disabled-text");
+    const inactive = mountTab({ name: "tab2", activeTab: "tab1", disable: true });
+    expect(inactive.find('[role="tab"]').classes()).toContain("text-tabs-disabled-text");
+  });
+
   it("sets aria-disabled when disable is true", () => {
     const wrapper = mountTab({ disable: true });
     expect(wrapper.find('[role="tab"]').attributes("aria-disabled")).toBe("true");
@@ -138,6 +152,30 @@ describe("OTab", () => {
     expect(wrapper.find(".o-tab__icon").html()).not.toBe("");
   });
 
+  // --- Lock suffix ---
+
+  it("paints a lock suffix with the locked-icon token", () => {
+    const wrapper = mountTab({ label: "Alerts", suffixIcon: "lock" });
+    expect(wrapper.find(".lock-chip").exists()).toBe(true);
+  });
+
+  it("does not paint other suffix icons", () => {
+    const wrapper = mountTab({ label: "Alerts", suffixIcon: "add" });
+    expect(wrapper.find(".lock-chip").exists()).toBe(false);
+  });
+
+  it("gives a lock suffix screen-reader text from suffixLabel, else the tooltip", () => {
+    const explicit = mountTab({
+      label: "Alerts",
+      suffixIcon: "lock",
+      suffixLabel: "Locked: needs Alerts",
+      tooltip: "tip",
+    });
+    expect(explicit.get(".sr-only").text()).toBe("Locked: needs Alerts");
+    const fallback = mountTab({ label: "Alerts", suffixIcon: "lock", tooltip: "Locked: needs X" });
+    expect(fallback.get(".sr-only").text()).toBe("Locked: needs X");
+  });
+
   // --- Default slot (custom content) ---
 
   it("renders default slot content instead of icon+label", () => {
diff --git a/web/src/lib/navigation/Tabs/OTab.types.ts b/web/src/lib/navigation/Tabs/OTab.types.ts
index ce73210021..d26f21f69b 100644
--- a/web/src/lib/navigation/Tabs/OTab.types.ts
+++ b/web/src/lib/navigation/Tabs/OTab.types.ts
@@ -14,6 +14,8 @@ export interface OTabProps {
   icon?: string;
   /** Registered OIcon name shown after the label (e.g. a lock glyph on a locked tab) */
   suffixIcon?: string;
+  /** Screen-reader text for a lock suffix; falls back to `tooltip`. */
+  suffixLabel?: I18nText;
   /** Prevents interaction with this tab */
   disable?: boolean;
   /**
diff --git a/web/src/lib/navigation/Tabs/OTab.vue b/web/src/lib/navigation/Tabs/OTab.vue
index a2d7669ffd..6e3f02226d 100644
--- a/web/src/lib/navigation/Tabs/OTab.vue
+++ b/web/src/lib/navigation/Tabs/OTab.vue
@@ -9,6 +9,7 @@ import { iconRegistry } from "@/lib/core/Icon/OIcon.icons";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import useDragHandle from "@/composables/useDragHandle";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 // Disable auto-attribute inheritance so the consumer's `data-test="..."` lands
 // on the inner clickable TabsTrigger (Reka button) instead of the wrapper
@@ -24,6 +25,7 @@ const slots = defineSlots<OTabSlots>();
 
 const context = inject<ComputedRef<TabsContext>>(TABS_CONTEXT_KEY);
 
+const isDisabled = useLockedDisabled(() => props.disable);
 const isActive = computed<boolean>(() => context?.value.modelValue === props.name);
 const isDense = computed<boolean>(() => context?.value.dense ?? false);
 const isVertical = computed<boolean>(() => context?.value.isVertical ?? false);
@@ -101,7 +103,16 @@ const baseClasses = computed<string>(() =>
 );
 
 const stateClasses = computed<string>(() => {
-  if (props.disable) {
+  // A locked page disables its active tab too; it still has to read as the current one.
+  if (isDisabled.value && isActive.value) {
+    return [
+      "text-tabs-active-text cursor-not-allowed opacity-60",
+      isVertical.value
+        ? "bg-tabs-active-bg border-s-2 border-tabs-indicator"
+        : "border-b-2 border-transparent",
+    ].join(" ");
+  }
+  if (isDisabled.value) {
     return [
       "text-tabs-disabled-text cursor-not-allowed opacity-60",
       // Keep the transparent left border so disabled items don't shift width.
@@ -147,7 +158,7 @@ const heightClasses = computed<string>(() => {
     on the button itself never renders. The span wrapper intercepts hover and
     shows the cursor and tooltip even when the inner button is disabled.
   -->
-  <span :class="disable ? 'cursor-not-allowed' : 'contents'">
+  <span :class="isDisabled ? 'cursor-not-allowed' : 'contents'">
     <!--
       TabsTrigger handles: role="tab", aria-selected, tabindex (via RovingFocusItem),
       disabled, data-state, click/keyboard activation, and aria-controls linkage.
@@ -159,8 +170,8 @@ const heightClasses = computed<string>(() => {
     -->
     <TabsTrigger
       :value="name"
-      :disabled="disable"
-      :aria-disabled="disable || undefined"
+      :disabled="isDisabled"
+      :aria-disabled="isDisabled || undefined"
       :id="`tab-${name}`"
       :aria-controls="`tab-panel-${name}`"
       :class="[baseClasses, stateClasses, heightClasses, isDragging ? 'opacity-40' : '']"
@@ -186,7 +197,7 @@ const heightClasses = computed<string>(() => {
            (disableDrag, e.g. label editing) the grip stays mounted but inert so
            nothing shifts. Decorative for AT — drag has no keyboard path. -->
       <span
-        v-if="isReorderable && !disable"
+        v-if="isReorderable && !isDisabled"
         aria-hidden="true"
         data-otab-grip
         class="absolute inset-y-0 left-0 z-10 flex w-3 items-center justify-center transition-opacity duration-150"
@@ -240,8 +251,11 @@ const heightClasses = computed<string>(() => {
           :name="suffixIcon as any"
           size="xs"
           class="ms-auto shrink-0"
-          :class="suffixIcon === 'lock' ? 'text-warning-600' : ''"
+          :class="suffixIcon === 'lock' ? 'lock-chip' : ''"
         />
+        <span v-if="suffixIcon === 'lock' && (suffixLabel ?? tooltip)" class="sr-only">{{
+          suffixLabel ?? tooltip
+        }}</span>
       </template>
       <slot v-else />
     </TabsTrigger>
diff --git a/web/src/lib/overlay/ContextMenu/OContextMenuItem.vue b/web/src/lib/overlay/ContextMenu/OContextMenuItem.vue
index c91373e6e5..6550dc139b 100644
--- a/web/src/lib/overlay/ContextMenu/OContextMenuItem.vue
+++ b/web/src/lib/overlay/ContextMenu/OContextMenuItem.vue
@@ -8,6 +8,7 @@ import { computed, useId } from "vue";
 import { ContextMenuItem } from "reka-ui";
 import OIcon from "../../core/Icon/OIcon.vue";
 import OShortcut from "../../core/Shortcut/OShortcut.vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 const props = withDefaults(defineProps<ContextMenuItemProps>(), {
   disabled: false,
@@ -19,7 +20,8 @@ const emit = defineEmits<ContextMenuItemEmits>();
 
 defineSlots<ContextMenuItemSlots>();
 
-const unavailable = computed(() => props.disabled && props.focusableUnavailable);
+const isDisabled = useLockedDisabled(() => props.disabled);
+const unavailable = computed(() => isDisabled.value && props.focusableUnavailable);
 const reasonId = `${useId()}-reason`;
 
 const variantClasses: Record<NonNullable<ContextMenuItemProps["variant"]>, string> = {
@@ -39,7 +41,7 @@ function onKeydown(event: KeyboardEvent) {
 }
 
 function onSelect(event: Event) {
-  if (props.disabled) {
+  if (isDisabled.value) {
     event.preventDefault();
     return;
   }
@@ -49,7 +51,7 @@ function onSelect(event: Event) {
 
 <template>
   <ContextMenuItem
-    :disabled="disabled && !focusableUnavailable"
+    :disabled="isDisabled && !focusableUnavailable"
     as-child
     :text-value="textValue"
     :class="[
@@ -67,7 +69,7 @@ function onSelect(event: Event) {
     @select="onSelect"
   >
     <div
-      :aria-disabled="disabled || undefined"
+      :aria-disabled="isDisabled || undefined"
       :aria-describedby="unavailable && description ? reasonId : undefined"
     >
       <slot name="icon-left">
diff --git a/web/src/lib/overlay/Dropdown/ODropdownItem.unavailable.spec.ts b/web/src/lib/overlay/Dropdown/ODropdownItem.unavailable.spec.ts
index a13bebfd78..377022c8cb 100644
--- a/web/src/lib/overlay/Dropdown/ODropdownItem.unavailable.spec.ts
+++ b/web/src/lib/overlay/Dropdown/ODropdownItem.unavailable.spec.ts
@@ -66,6 +66,23 @@ describe("ODropdownItem focusable unavailable opt-in", () => {
     );
   });
 
+  it("paints a lock icon-left with the locked-icon token", async () => {
+    wrapper = mount(ODropdown, {
+      attachTo: document.body,
+      props: { open: true },
+      slots: {
+        trigger: () => h("button", "Menu"),
+        default: () => [
+          h(ODropdownItem, { iconLeft: "lock", "data-test": "locked" }, () => "Locked"),
+          h(ODropdownItem, { iconLeft: "add", "data-test": "plain" }, () => "Plain"),
+        ],
+      },
+    });
+    await flushPromises();
+    expect(document.querySelector('[data-test="locked"] .lock-chip')).not.toBeNull();
+    expect(document.querySelector('[data-test="plain"] .lock-chip')).toBeNull();
+  });
+
   it("emits enabled selections without changing existing behavior", async () => {
     const select = vi.fn();
     wrapper = mount(ODropdown, {
diff --git a/web/src/lib/overlay/Dropdown/ODropdownItem.vue b/web/src/lib/overlay/Dropdown/ODropdownItem.vue
index ea932a4d8b..ae601fec94 100644
--- a/web/src/lib/overlay/Dropdown/ODropdownItem.vue
+++ b/web/src/lib/overlay/Dropdown/ODropdownItem.vue
@@ -5,6 +5,7 @@ import OText from "../../core/Typography/OText.vue";
 import { DropdownMenuItem } from "reka-ui";
 import OIcon from "../../core/Icon/OIcon.vue";
 import OShortcut from "../../core/Shortcut/OShortcut.vue";
+import { useLockedDisabled } from "@/composables/useFeatureLock";
 
 const props = withDefaults(defineProps<DropdownItemProps>(), {
   as: "div",
@@ -19,7 +20,8 @@ defineSlots<DropdownItemSlots>();
 
 const attrs = useAttrs();
 const id = useId();
-const unavailable = computed(() => props.disabled && props.focusableUnavailable);
+const isDisabled = useLockedDisabled(() => props.disabled);
+const unavailable = computed(() => isDisabled.value && props.focusableUnavailable);
 const reasonId = computed(() => props.descriptionId ?? `${attrs["data-test"] ?? id}-reason`);
 
 function blockActivation(event: Event) {
@@ -33,7 +35,7 @@ function onKeydown(event: KeyboardEvent) {
 }
 
 function onSelect(event: Event) {
-  if (props.disabled) {
+  if (isDisabled.value) {
     event.preventDefault();
     return;
   }
@@ -49,7 +51,7 @@ const variantClasses: Record<NonNullable<DropdownItemProps["variant"]>, string>
 
 <template>
   <DropdownMenuItem
-    :disabled="disabled && !focusableUnavailable"
+    :disabled="isDisabled && !focusableUnavailable"
     as-child
     :aria-describedby="description ? reasonId : undefined"
     :text-value="textValue"
@@ -70,10 +72,15 @@ const variantClasses: Record<NonNullable<DropdownItemProps["variant"]>, string>
     <component
       :is="as"
       :type="as === 'button' ? 'button' : undefined"
-      :aria-disabled="disabled || undefined"
+      :aria-disabled="isDisabled || undefined"
     >
       <slot name="icon-left">
-        <OIcon v-if="props.iconLeft" :name="props.iconLeft" size="sm" />
+        <OIcon
+          v-if="props.iconLeft"
+          :name="props.iconLeft"
+          size="sm"
+          :class="props.iconLeft === 'lock' ? 'lock-chip' : undefined"
+        />
       </slot>
       <span v-if="description" class="flex min-w-0 flex-1 flex-col gap-0.5">
         <span><slot /></span>
diff --git a/web/src/lib/styles/tokens/colorMath.spec.ts b/web/src/lib/styles/tokens/colorMath.spec.ts
index 9f704bebf3..9212a61a7c 100644
--- a/web/src/lib/styles/tokens/colorMath.spec.ts
+++ b/web/src/lib/styles/tokens/colorMath.spec.ts
@@ -389,8 +389,8 @@ describe("the real token sheets", () => {
   });
 
   describe.each([
-    ["light", 1090, 1078],
-    ["dark", 1091, 1079],
+    ["light", 1091, 1079],
+    ["dark", 1092, 1080],
   ] as const)("%s theme", (theme, total, resolved) => {
     const scope = THEMES[theme];
     const names = colorTokens(scope);
diff --git a/web/src/lib/styles/tokens/dark.css b/web/src/lib/styles/tokens/dark.css
index 8e2ea7bbc4..5aa61656d2 100644
--- a/web/src/lib/styles/tokens/dark.css
+++ b/web/src/lib/styles/tokens/dark.css
@@ -954,6 +954,7 @@
   --color-icon-chip-success-text: var(--color-success-400);
   --color-icon-chip-warning-bg: color-mix(in srgb, var(--color-warning-400) 15%, transparent);
   --color-icon-chip-warning-text: var(--color-warning-400);
+  --color-icon-locked: var(--color-warning-400);
   --color-icon-chip-error-bg: color-mix(in srgb, var(--color-error-500) 15%, transparent);
   --color-icon-chip-error-text: var(--color-error-400);
   --color-icon-chip-info-bg: color-mix(in srgb, var(--color-blue-500) 15%, transparent);
diff --git a/web/src/lib/styles/tokens/semantic.css b/web/src/lib/styles/tokens/semantic.css
index fe4162fa91..951cf60943 100644
--- a/web/src/lib/styles/tokens/semantic.css
+++ b/web/src/lib/styles/tokens/semantic.css
@@ -57,6 +57,7 @@
   --color-icon-chip-error-text: var(--color-error-600);
   --color-icon-chip-info-bg: var(--color-blue-50);
   --color-icon-chip-info-text: var(--color-blue-600);
+  --color-icon-locked: var(--color-warning-700);
   --color-icon-chip-orange-bg: var(--color-orange-50);
   --color-icon-chip-orange-text: var(--color-orange-700);
   /* App chrome (top bar + side rail + the gutter behind the content card) — a
@@ -237,6 +238,7 @@
   --color-icon-chip-error-text: var(--color-icon-chip-error-text);
   --color-icon-chip-info-bg: var(--color-icon-chip-info-bg);
   --color-icon-chip-info-text: var(--color-icon-chip-info-text);
+  --color-icon-locked: var(--color-icon-locked);
   --color-icon-chip-orange-bg: var(--color-icon-chip-orange-bg);
   --color-icon-chip-orange-text: var(--color-icon-chip-orange-text);
   --color-surface-chrome: var(--color-surface-chrome);
diff --git a/web/src/locales/languages/ar-SA.json b/web/src/locales/languages/ar-SA.json
index 4591eabfee..5cb47d050b 100644
--- a/web/src/locales/languages/ar-SA.json
+++ b/web/src/locales/languages/ar-SA.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "غير متضمن في ترخيصك",
+    "title": "لا يتضمن ترخيصك {feature}",
+    "description": "يمكن لمسؤول النظام إضافتها بتحديث الترخيص، أو تواصل مع فريق المبيعات للحصول على ترخيص يتضمنها.",
+    "thisFeature": "هذه الميزة",
+    "contactSales": "تواصل مع المبيعات",
+    "toastTitle": "غير متضمن في ترخيصك",
+    "toastMessage": "لا يتضمن ترخيصك: {features}. اطلب من مسؤول النظام تحديث الترخيص.",
+    "toastMessageGeneric": "لا يتضمن ترخيصك هذه الميزة. اطلب من مسؤول النظام تحديث الترخيص.",
+    "bannerMessage": "هذه الميزة مقفلة. تحتاج إلى ميزة {feature} في ترخيصك.",
+    "bannerMessageGeneric": "تحتاج هذه الصفحة إلى ميزة غير متضمنة في ترخيصك.",
+    "headerLocked": "مقفل: يتطلب {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "لا يوجد سجل بعد",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "نطاق التاريخ المنسوخ",
     "dateRangePasted": "نطاق التاريخ المطبع",
     "dateRangePasteError": "لم أتمكن من تحليل نطاق التاريخ",
+    "dateRangePasteEmpty": "الحافظة فارغة. انسخ نطاق التاريخ أولاً.",
     "dateRangePasteBlocked": "حظر هذا المتصفح قراءة الحافظة. اضغط {shortcut} مع فتح المنتقي للصق.",
     "pastSecond": "آخر {count} ثانية | الثواني الـ {count} الماضية",
     "pastMinute": "آخر {count} دقيقة | الدقائق الـ {count} الماضية",
@@ -3406,6 +3420,22 @@
     "contact_name": "اسم الاتصال",
     "contact_email": "بريد إلكتروني للتواصل",
     "environment_type": "نوع البيئة",
+    "features": "الميزات",
+    "features_all_unlocked": "يتيح ترخيصك جميع الميزات.",
+    "features_summary": "يتيح ترخيصك {ratio}. {free} ميزة مجانية متضمنة دائمًا. | يتيح ترخيصك {ratio}. {free} ميزات مجانية متضمنة دائمًا.",
+    "features_paid_ratio": "{unlocked} من {paid} ميزة مدفوعة | {unlocked} من {paid} ميزات مدفوعة",
+    "features_unlocked": "مفتوحة",
+    "features_missing": "غير متضمن في ترخيصك",
+    "features_request_access": "طلب الوصول",
+    "features_search": "بحث في {count} ميزة | بحث في جميع الميزات البالغ عددها {count}",
+    "features_filter_all": "الكل",
+    "features_filter_free": "مجاني",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "لا توجد ميزات تطابق بحثك",
+    "features_none": "لا توجد ميزات في هذه المجموعة",
+    "features_free_heading": "مجانية، ومتضمنة مع كل ترخيص",
+    "features_new": "جديد بعد ترخيصك",
+    "features_filter_new": "جديد",
     "request_new_license": "طلب رخصة جديدة",
     "add_new_license_key": "إضافة مفتاح ترخيص جديد",
     "refresh_license_limits": "تحديث حدود الترخيص",
@@ -9901,6 +9931,12 @@
     "allClear": "جميع الأنظمة نظيفة",
     "allClearDesc": "لا توجد شذوذات نشطة، أو حوادث، أو خدمات متدهورة في الفترة الزمنية المحددة. تبدو بنيتك التحتية صحية.",
     "allClearDescScoped": "لا توجد حوادث مفتوحة أو شذوذات أو خدمات متدهورة في النطاق الزمني المحدد.",
+    "allClearPartial": "لا يوجد ما يُبلّغ عنه",
+    "allClearPartialDesc": "لا شيء يحتاج إلى انتباه. لم نتحقق من {areas} لأن ترخيصك لا يتضمن تلك الميزات.",
+    "areaAlerts": "التنبيهات",
+    "areaAnomalies": "كشف الحالات الشاذة",
+    "areaIncidents": "الحوادث",
+    "areaServices": "الخدمات",
     "notMonitoredTitle": "لا شيء تحت المراقبة بعد",
     "notMonitoredDesc": "بياناتك تصل، لكن لا يعمل عليها أي تنبيه أو فحص شذوذ. أضف واحدًا وستسرد النظرة العامة كل ما يحتاج إلى انتباه.",
     "notMonitoredAlert": "إنشاء تنبيه",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "إعادة تشغيل {count} Collectors؟",
       "restartMessage": "يُعاد تشغيل كل Collector عند رسالته التالية من الخادم. يتوقف جمع البيانات لفترة وجيزة على كل مضيف.",
       "restartQueued": "طُلبت إعادة التشغيل لـ {count} Collector | طُلبت إعادة التشغيل لـ {count} Collectors",
+      "restartOffline": "هذا المجمّع غير متصل. أعد تشغيله بمجرد عودته.",
       "restartUnsupported": "لا يقبل هذا الـ Collector أوامر إعادة التشغيل",
       "systemSections": "الأقسام التي يديرها النظام",
       "systemSectionsCaption": "امتداد OpAMP والقياس عن بُعد للخدمة، يضبطهما المشرف والخادم",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "يفتح محرر {config}. انشر إصدارًا مصححًا وغيّر هذا الأسطول إليه؛ وعندها تُستبدل عملية الطرح هذه.",
       "confirmResume": "تتابع عملية الطرح نفسها من المرحلة {n}.",
       "confirmRollback": "يبدأ فورًا عملية طرح للعودة إلى الإصدار المستقر، {config} v{version}. لا تتلقى Collectors الموجودة عليه شيئًا.",
-      "confirmRollbackNoStable": "يبدأ فورًا عملية طرح للعودة إلى الإصدار المستقر.",
+      "confirmRollbackNoStable": "لا يحتوي هذا الأسطول على إصدار مستقر، لذا ينتهي الطرح وتتوقف مجمّعاته عن الجمع حتى تنشر مرة أخرى.",
       "confirmSkip": "يستبعد {count} Collector فاشلًا ويتابع. يُوسَم بأنه مستبعد ويُضمَّن مجددًا في عملية الطرح التالية. | يستبعد {count} Collectors فاشلة ويتابع. تُوسَم بأنها مستبعدة وتُضمَّن مجددًا في عملية الطرح التالية.",
       "confirmed": "تم التأكيد",
       "eventConverged": "تقاربت المرحلة {n}",
@@ -29321,6 +29358,7 @@
       "phaseN": "المرحلة {n}",
       "phaseTimedOut": "انتهت المهلة",
       "phaseTimeoutNote": "المرحلة التي لا تؤكد ولا ترفض خلال {minutes} د توقف عملية الطرح (إعداد الأسطول)",
+      "phaseTimeoutNoteSeconds": "المرحلة التي لا تؤكد ولا ترفض خلال {minutes} دقيقة و{seconds} ثانية توقف الطرح (إعداد الأسطول)",
       "phaseVerifying": "قيد التحقق",
       "phases": "المراحل",
       "planEmpty": "لا يوجد أي جامع متصل، لذا ينتظر الطرح حتى يتصل أحدها.",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "وراثة ({value})",
       "offlineHeartbeats": "غير متصل بعد نبضات فائتة",
       "offlineHeartbeatsHelp": "يُعد الـ Collector غير متصل بعد هذا العدد من فواصل النبضات دون رسالة",
-      "offlineRatio": "حدث نسبة عدم الاتصال (%)",
-      "offlineRatioHelp": "يسجّل حدثًا للأسطول عندما تزيد نسبة Collectors غير المتصلة عن هذه النسبة",
+      "offlineRatio": "نسبة عدم الاتصال (%)",
+      "offlineRatioHelp": "يوقف المرحلة عندما تتجاوز نسبة مجمّعاتها غير المتصلة هذه النسبة",
       "outOfRange": "أدخل رقمًا من {min} إلى {max}",
       "phaseTimeout": "مهلة المرحلة (ثوانٍ)",
       "phaseTimeoutHelp": "المرحلة التي لا تؤكد ولا ترفض خلال هذه المدة توقف عملية الطرح",
diff --git a/web/src/locales/languages/de-DE.json b/web/src/locales/languages/de-DE.json
index ed5ff3d8ef..b152145a42 100644
--- a/web/src/locales/languages/de-DE.json
+++ b/web/src/locales/languages/de-DE.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Nicht in Ihrer Lizenz",
+    "title": "{feature} ist nicht in Ihrer Lizenz enthalten",
+    "description": "Ihr Administrator kann sie durch Aktualisieren der Lizenz hinzufügen, oder kontaktieren Sie den Vertrieb, um eine Lizenz zu erhalten, die sie enthält.",
+    "thisFeature": "Diese Funktion",
+    "contactSales": "Vertrieb kontaktieren",
+    "toastTitle": "Nicht in Ihrer Lizenz enthalten",
+    "toastMessage": "Ihre Lizenz enthält nicht: {features}. Bitten Sie Ihren Administrator, die Lizenz zu aktualisieren.",
+    "toastMessageGeneric": "Ihre Lizenz enthält diese Funktion nicht. Bitten Sie Ihren Administrator, die Lizenz zu aktualisieren.",
+    "bannerMessage": "Diese Funktion ist gesperrt. Sie erfordert die Funktion {feature} in Ihrer Lizenz.",
+    "bannerMessageGeneric": "Diese Seite benötigt eine Funktion, die nicht in Ihrer Lizenz enthalten ist.",
+    "headerLocked": "Gesperrt: benötigt {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Noch kein Verlauf",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Datumsbereich kopiert",
     "dateRangePasted": "Datumsbereich eingefügt",
     "dateRangePasteError": "Datumsbereich konnte nicht geparst werden",
+    "dateRangePasteEmpty": "Die Zwischenablage ist leer. Kopieren Sie zuerst einen Datumsbereich.",
     "dateRangePasteBlocked": "Dieser Browser hat das Lesen der Zwischenablage blockiert. Drücken Sie {shortcut} bei geöffnetem Auswahlfeld, um einzufügen.",
     "pastSecond": "Letzte {count} Sekunde | Letzte {count} Sekunden",
     "pastMinute": "Letzte {count} Minute | Letzte {count} Minuten",
@@ -3406,6 +3420,22 @@
     "contact_name": "Name des Ansprechpartners",
     "contact_email": "Kontakt-E-Mail",
     "environment_type": "Art der Umgebung",
+    "features": "Funktionen",
+    "features_all_unlocked": "Ihre Lizenz schaltet alle Funktionen frei.",
+    "features_summary": "Ihre Lizenz schaltet {ratio} frei. {free} kostenlose Funktion ist immer enthalten. | Ihre Lizenz schaltet {ratio} frei. {free} kostenlose Funktionen sind immer enthalten.",
+    "features_paid_ratio": "{unlocked} von {paid} kostenpflichtigen Funktion | {unlocked} von {paid} kostenpflichtigen Funktionen",
+    "features_unlocked": "Freigeschaltet",
+    "features_missing": "Nicht in Ihrer Lizenz",
+    "features_request_access": "Zugriff anfordern",
+    "features_search": "{count} Funktion durchsuchen | Alle {count} Funktionen durchsuchen",
+    "features_filter_all": "Alle",
+    "features_filter_free": "Kostenlos",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Keine Funktionen entsprechen Ihrer Suche",
+    "features_none": "Keine Funktionen in dieser Gruppe",
+    "features_free_heading": "Kostenlos, in jeder Lizenz enthalten",
+    "features_new": "Neu seit Ihrer Lizenz",
+    "features_filter_new": "Neu",
     "request_new_license": "Neue Lizenz anfordern",
     "add_new_license_key": "Neuen Lizenzschlüssel hinzufügen",
     "refresh_license_limits": "Lizenzlimits aktualisieren",
@@ -9901,6 +9931,12 @@
     "allClear": "Alles klar",
     "allClearDesc": "Keine aktiven Anomalien, Vorfälle oder beeinträchtigte Dienste im ausgewählten Zeitfenster.",
     "allClearDescScoped": "Keine offenen Vorfälle, Anomalien oder beeinträchtigten Dienste im ausgewählten Zeitraum.",
+    "allClearPartial": "Nichts zu melden",
+    "allClearPartialDesc": "Nichts erfordert Aufmerksamkeit. Wir haben {areas} nicht geprüft, da Ihre Lizenz diese Funktionen nicht umfasst.",
+    "areaAlerts": "Alarme",
+    "areaAnomalies": "Anomalieerkennung",
+    "areaIncidents": "Vorfälle",
+    "areaServices": "Services",
     "notMonitoredTitle": "Noch wird nichts überwacht",
     "notMonitoredDesc": "Ihre Daten treffen ein, aber es läuft keine Alarm- oder Anomalieprüfung darauf. Fügen Sie eine hinzu, und die Übersicht listet alles auf, was Aufmerksamkeit erfordert.",
     "notMonitoredAlert": "Alarm erstellen",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "{count} Collector neu starten?",
       "restartMessage": "Jeder Collector startet bei der nächsten Nachricht vom Server neu. Die Datenerfassung pausiert auf jedem Host kurz.",
       "restartQueued": "Neustart für {count} Collector angefordert | Neustart für {count} Collector angefordert",
+      "restartOffline": "Dieser Collector ist offline. Starten Sie ihn neu, sobald er wieder verfügbar ist.",
       "restartUnsupported": "Dieser Collector akzeptiert keine Neustart-Befehle",
       "systemSections": "Systemverwaltete Abschnitte",
       "systemSectionsCaption": "OpAMP-Erweiterung und Dienst-Telemetrie, vom Supervisor und vom Server festgelegt",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Öffnet den Editor für {config}. Veröffentlichen Sie eine korrigierte Version und stellen Sie dieses Fleet darauf um; dieses Rollout wird dann abgelöst.",
       "confirmResume": "Dasselbe Rollout wird ab Phase {n} fortgesetzt.",
       "confirmRollback": "Startet sofort ein Rollout zurück auf die stabile Version, {config} v{version}. Collector, die sie bereits haben, erhalten nichts.",
-      "confirmRollbackNoStable": "Startet sofort ein Rollout zurück auf die stabile Version.",
+      "confirmRollbackNoStable": "Diese Fleet hat keine stabile Version, daher endet das Rollout und ihre Collectors stellen die Erfassung ein, bis Sie erneut bereitstellen.",
       "confirmSkip": "Schließt {count} fehlerhaften Collector aus und fährt fort. Er wird als ausgeschlossen markiert und im nächsten Rollout wieder einbezogen. | Schließt {count} fehlerhafte Collector aus und fährt fort. Sie werden als ausgeschlossen markiert und im nächsten Rollout wieder einbezogen.",
       "confirmed": "Bestätigt",
       "eventConverged": "Phase {n} konvergiert",
@@ -29321,6 +29358,7 @@
       "phaseN": "Phase {n}",
       "phaseTimedOut": "Zeitüberschreitung",
       "phaseTimeoutNote": "Eine Phase, die innerhalb von {minutes} Min. weder bestätigt noch ablehnt, hält das Rollout an (Fleet-Einstellung)",
+      "phaseTimeoutNoteSeconds": "Eine Phase, die innerhalb von {minutes} Min. {seconds} Sek. weder bestätigt noch ablehnt, stoppt das Rollout (Fleet-Einstellung)",
       "phaseVerifying": "Wird überprüft",
       "phases": "Phasen",
       "planEmpty": "Kein Collector ist online, daher wartet der Rollout, bis sich einer verbindet",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Erben ({value})",
       "offlineHeartbeats": "Offline nach verpassten Heartbeats",
       "offlineHeartbeatsHelp": "Ein Collector gilt als offline, wenn so viele Heartbeat-Intervalle ohne Nachricht vergangen sind",
-      "offlineRatio": "Ereignis bei Offline-Anteil (%)",
-      "offlineRatioHelp": "Zeichnet ein Fleet-Ereignis auf, wenn mehr als dieser Anteil der Collector offline ist",
+      "offlineRatio": "Offline-Anteil (%)",
+      "offlineRatioHelp": "Stoppt die Phase, wenn mehr als dieser Anteil ihrer Collectors offline ist",
       "outOfRange": "Eine Zahl von {min} bis {max} eingeben",
       "phaseTimeout": "Phasen-Zeitlimit (Sekunden)",
       "phaseTimeoutHelp": "Ein Rollout, dessen Phase in dieser Zeit weder bestätigt noch ablehnt, wird angehalten",
diff --git a/web/src/locales/languages/en-US.json b/web/src/locales/languages/en-US.json
index b9b399b5c4..3b4ac33dea 100644
--- a/web/src/locales/languages/en-US.json
+++ b/web/src/locales/languages/en-US.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Not in your license",
+    "title": "{feature} is not included in your license",
+    "description": "Your administrator can add it by updating the license, or contact sales to get a license that includes it.",
+    "thisFeature": "This feature",
+    "contactSales": "Contact sales",
+    "toastTitle": "Not included in your license",
+    "toastMessage": "Your license does not include: {features}. Ask your administrator to update the license.",
+    "toastMessageGeneric": "Your license does not include this feature. Ask your administrator to update the license.",
+    "bannerMessage": "This feature is locked. It needs the {feature} feature in your license.",
+    "bannerMessageGeneric": "This page needs a feature that is not in your license.",
+    "headerLocked": "Locked: needs {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "No history yet",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Date range copied",
     "dateRangePasted": "Date range pasted",
     "dateRangePasteError": "Could not parse date range",
+    "dateRangePasteEmpty": "Clipboard is empty. Copy a date range first.",
     "dateRangePasteBlocked": "This browser blocked reading the clipboard. Press {shortcut} with the picker open to paste.",
     "pastSecond": "Past {count} Second | Past {count} Seconds",
     "pastMinute": "Past {count} Minute | Past {count} Minutes",
@@ -3406,6 +3420,22 @@
     "contact_name": "Contact Name",
     "contact_email": "Contact Email",
     "environment_type": "Environment Type",
+    "features": "Features",
+    "features_all_unlocked": "Your license unlocks all features.",
+    "features_summary": "Your license unlocks {ratio}. {free} free feature is always included. | Your license unlocks {ratio}. {free} free features are always included.",
+    "features_paid_ratio": "{unlocked} of {paid} paid feature | {unlocked} of {paid} paid features",
+    "features_unlocked": "Unlocked",
+    "features_missing": "Not in your license",
+    "features_request_access": "Request Access",
+    "features_search": "Search {count} feature | Search all {count} features",
+    "features_filter_all": "All",
+    "features_filter_free": "Free",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "No features match your search",
+    "features_none": "No features in this group",
+    "features_free_heading": "Free, included with every license",
+    "features_new": "New after your license",
+    "features_filter_new": "New",
     "request_new_license": "Request new License",
     "add_new_license_key": "Add New License Key",
     "refresh_license_limits": "Refresh License Limits",
@@ -10022,6 +10052,12 @@
     "allClear": "All systems clear",
     "allClearDesc": "No active anomalies, incidents, or degraded services in the selected time window. Your infrastructure looks healthy.",
     "allClearDescScoped": "No open incidents, anomalies or degraded services in the selected time range.",
+    "allClearPartial": "Nothing to report",
+    "allClearPartialDesc": "Nothing needs attention. We did not check {areas}, because your license does not include those features.",
+    "areaAlerts": "Alerts",
+    "areaAnomalies": "Anomaly detection",
+    "areaIncidents": "Incidents",
+    "areaServices": "Services",
     "notMonitoredTitle": "Nothing is watched yet",
     "notMonitoredDesc": "Your data is arriving, but no alert or anomaly check runs on it. Add one and Overview lists anything that needs attention.",
     "notMonitoredAlert": "Create an alert",
@@ -29670,6 +29706,7 @@
       "restartManyTitle": "Restart {count} collectors?",
       "restartMessage": "Each collector restarts on its next message from the server. Data collection pauses briefly on each host.",
       "restartQueued": "Restart requested for {count} collector | Restart requested for {count} collectors",
+      "restartOffline": "This collector is offline. Restart it once it is back.",
       "restartUnsupported": "This collector does not accept restart commands",
       "systemSections": "System-managed sections",
       "systemSectionsCaption": "OpAMP extension and service telemetry, set by the supervisor and the server",
@@ -29798,7 +29835,7 @@
       "confirmFixForward": "Opens the {config} editor. Publish a fixed version and change this fleet to it; this rollout is then superseded.",
       "confirmResume": "The same rollout continues from phase {n}.",
       "confirmRollback": "Starts an immediate rollout back to the stable version, {config} v{version}. Collectors already on it receive nothing.",
-      "confirmRollbackNoStable": "Starts an immediate rollout back to the stable version.",
+      "confirmRollbackNoStable": "This fleet has no stable version, so the rollout ends and its collectors stop collecting until you deploy again.",
       "confirmSkip": "Excludes {count} failing collector and continues. It is marked excluded and included again in the next rollout. | Excludes {count} failing collectors and continues. They are marked excluded and included again in the next rollout.",
       "confirmed": "Confirmed",
       "eventConverged": "Phase {n} converged",
@@ -29835,6 +29872,7 @@
       "phaseN": "Phase {n}",
       "phaseTimedOut": "Timed out",
       "phaseTimeoutNote": "A phase that neither confirms nor rejects within {minutes} min halts the rollout (fleet setting)",
+      "phaseTimeoutNoteSeconds": "A phase that neither confirms nor rejects within {minutes} min {seconds} s halts the rollout (fleet setting)",
       "phaseVerifying": "Verifying",
       "phases": "Phases",
       "planEmpty": "No collector is online, so the rollout waits until one connects",
@@ -29975,8 +30013,8 @@
       "inheritPlaceholder": "Inherit ({value})",
       "offlineHeartbeats": "Offline after missed heartbeats",
       "offlineHeartbeatsHelp": "A collector is offline after this many heartbeat intervals without a message",
-      "offlineRatio": "Offline-ratio event (%)",
-      "offlineRatioHelp": "Records a fleet event when more than this share of collectors is offline",
+      "offlineRatio": "Offline ratio (%)",
+      "offlineRatioHelp": "Halts the phase when more than this share of its collectors is offline",
       "outOfRange": "Enter a number from {min} to {max}",
       "phaseTimeout": "Phase timeout (seconds)",
       "phaseTimeoutHelp": "A rollout phase that neither confirms nor rejects in this time halts",
diff --git a/web/src/locales/languages/es-ES.json b/web/src/locales/languages/es-ES.json
index cca37f8795..47a18ee58b 100644
--- a/web/src/locales/languages/es-ES.json
+++ b/web/src/locales/languages/es-ES.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "No incluido en tu licencia",
+    "title": "{feature} no se incluye en tu licencia",
+    "description": "Tu administrador puede añadirlo actualizando la licencia, o contacta con ventas para obtener una licencia que lo incluya.",
+    "thisFeature": "Esta función",
+    "contactSales": "Contactar con ventas",
+    "toastTitle": "No incluido en tu licencia",
+    "toastMessage": "Tu licencia no incluye: {features}. Pide a tu administrador que actualice la licencia.",
+    "toastMessageGeneric": "Tu licencia no incluye esta función. Pide a tu administrador que actualice la licencia.",
+    "bannerMessage": "Esta función está bloqueada. Necesita la función {feature} en tu licencia.",
+    "bannerMessageGeneric": "Esta página necesita una función que no está en tu licencia.",
+    "headerLocked": "Bloqueado: necesita {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Aún no hay historial",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Rango de fechas copiado",
     "dateRangePasted": "Rango de fechas pegado",
     "dateRangePasteError": "No se pudo analizar el rango de fechas",
+    "dateRangePasteEmpty": "El portapapeles está vacío. Copia primero un rango de fechas.",
     "dateRangePasteBlocked": "Este navegador ha bloqueado la lectura del portapapeles. Pulsa {shortcut} con el selector abierto para pegar.",
     "pastSecond": "Último {count} segundo | Últimos {count} segundos",
     "pastMinute": "Último {count} minuto | Últimos {count} minutos",
@@ -3406,6 +3420,22 @@
     "contact_name": "Nombre de contacto",
     "contact_email": "Correo electrónico de contacto",
     "environment_type": "Tipo de entorno",
+    "features": "Funciones",
+    "features_all_unlocked": "Tu licencia desbloquea todas las funciones.",
+    "features_summary": "Tu licencia desbloquea {ratio}. {free} función gratuita siempre está incluida. | Tu licencia desbloquea {ratio}. {free} funciones gratuitas siempre están incluidas.",
+    "features_paid_ratio": "{unlocked} de {paid} función de pago | {unlocked} de {paid} funciones de pago",
+    "features_unlocked": "Desbloqueadas",
+    "features_missing": "No incluidas en tu licencia",
+    "features_request_access": "Solicitar acceso",
+    "features_search": "Buscar {count} función | Buscar las {count} funciones",
+    "features_filter_all": "Todas",
+    "features_filter_free": "Gratuitas",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Ninguna función coincide con tu búsqueda",
+    "features_none": "No hay funciones en este grupo",
+    "features_free_heading": "Gratuitas, incluidas con todas las licencias",
+    "features_new": "Nuevas después de tu licencia",
+    "features_filter_new": "Nuevas",
     "request_new_license": "Solicitar una nueva licencia",
     "add_new_license_key": "Agregar nueva clave de licencia",
     "refresh_license_limits": "Actualizar los límites de la licencia",
@@ -9901,6 +9931,12 @@
     "allClear": "Todo despejado",
     "allClearDesc": "No hay anomalías, incidentes ni servicios degradados activos en la ventana de tiempo seleccionada.",
     "allClearDescScoped": "No hay incidentes abiertos, anomalías ni servicios degradados en el intervalo de tiempo seleccionado.",
+    "allClearPartial": "Nada que informar",
+    "allClearPartialDesc": "Nada requiere atención. No hemos comprobado {areas} porque tu licencia no incluye esas funcionalidades.",
+    "areaAlerts": "Alertas",
+    "areaAnomalies": "Detección de anomalías",
+    "areaIncidents": "Incidentes",
+    "areaServices": "Servicios",
     "notMonitoredTitle": "Todavía no se monitoriza nada",
     "notMonitoredDesc": "Tus datos están llegando, pero no se ejecuta ninguna alerta ni comprobación de anomalías sobre ellos. Añade una y la Vista general mostrará todo lo que requiera atención.",
     "notMonitoredAlert": "Crear una alerta",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "¿Reiniciar {count} colectores?",
       "restartMessage": "Cada colector se reinicia con su próximo mensaje del servidor. La recopilación de datos se detiene brevemente en cada host.",
       "restartQueued": "Reinicio solicitado para {count} colector | Reinicio solicitado para {count} colectores",
+      "restartOffline": "Este colector está desconectado. Reinícialo cuando vuelva a estar en línea.",
       "restartUnsupported": "Este colector no admite comandos de reinicio",
       "systemSections": "Secciones gestionadas por el sistema",
       "systemSectionsCaption": "Extensión de OpAMP y telemetría del servicio, definidas por el supervisor y el servidor",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Abre el editor de {config}. Publica una versión corregida y cambia esta flota a ella; este despliegue queda entonces reemplazado.",
       "confirmResume": "El mismo despliegue continúa desde la fase {n}.",
       "confirmRollback": "Inicia un despliegue inmediato de vuelta a la versión estable, {config} v{version}. Los colectores que ya la tienen no reciben nada.",
-      "confirmRollbackNoStable": "Inicia un despliegue inmediato de vuelta a la versión estable.",
+      "confirmRollbackNoStable": "Esta flota no tiene una versión estable, por lo que el despliegue finaliza y sus colectores dejan de recopilar hasta que vuelvas a desplegar.",
       "confirmSkip": "Excluye {count} colector con fallos y continúa. Se marca como excluido y se vuelve a incluir en el siguiente despliegue. | Excluye {count} colectores con fallos y continúa. Se marcan como excluidos y se vuelven a incluir en el siguiente despliegue.",
       "confirmed": "Confirmado",
       "eventConverged": "La fase {n} convergió",
@@ -29321,6 +29358,7 @@
       "phaseN": "Fase {n}",
       "phaseTimedOut": "Tiempo agotado",
       "phaseTimeoutNote": "Una fase que no confirma ni rechaza en {minutes} min detiene el despliegue (ajuste de la flota)",
+      "phaseTimeoutNoteSeconds": "Una fase que no confirme ni rechace en {minutes} min {seconds} s detiene el despliegue (ajuste de la flota)",
       "phaseVerifying": "Verificando",
       "phases": "Fases",
       "planEmpty": "No hay ningún colector en línea, así que el despliegue esperará hasta que se conecte uno",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Heredar ({value})",
       "offlineHeartbeats": "Sin conexión tras latidos perdidos",
       "offlineHeartbeatsHelp": "Un colector está sin conexión tras este número de intervalos de latido sin mensaje",
-      "offlineRatio": "Evento de proporción sin conexión (%)",
-      "offlineRatioHelp": "Registra un evento de flota cuando más de esta proporción de colectores está sin conexión",
+      "offlineRatio": "Proporción de colectores desconectados (%)",
+      "offlineRatioHelp": "Detiene la fase cuando más de esta proporción de sus colectores está desconectada",
       "outOfRange": "Introduce un número de {min} a {max}",
       "phaseTimeout": "Tiempo de espera de la fase (segundos)",
       "phaseTimeoutHelp": "Una fase del despliegue que no confirma ni rechaza en este tiempo se detiene",
diff --git a/web/src/locales/languages/fr-FR.json b/web/src/locales/languages/fr-FR.json
index 23ba010d3e..03c921e208 100644
--- a/web/src/locales/languages/fr-FR.json
+++ b/web/src/locales/languages/fr-FR.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Non inclus dans votre licence",
+    "title": "{feature} ne fait pas partie de votre licence.",
+    "description": "Votre administrateur peut l'ajouter en mettant à jour la licence, ou contactez le service commercial pour obtenir une licence qui l'inclut.",
+    "thisFeature": "Cette fonctionnalité",
+    "contactSales": "Contacter le service commercial",
+    "toastTitle": "Non inclus dans votre licence",
+    "toastMessage": "Votre licence n'inclut pas : {features}. Demandez à votre administrateur de mettre à jour la licence.",
+    "toastMessageGeneric": "Votre licence n'inclut pas cette fonctionnalité. Demandez à votre administrateur de mettre à jour la licence.",
+    "bannerMessage": "Cette fonctionnalité est verrouillée. Elle nécessite la fonctionnalité {feature} dans votre licence.",
+    "bannerMessageGeneric": "Cette page nécessite une fonctionnalité qui ne fait pas partie de votre licence.",
+    "headerLocked": "Verrouillé : nécessite {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Aucun historique pour le moment",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Plage de dates copiée",
     "dateRangePasted": "Plage de dates collée",
     "dateRangePasteError": "Impossible d'analyser la plage de dates",
+    "dateRangePasteEmpty": "Le presse-papiers est vide. Copiez d'abord une plage de dates.",
     "dateRangePasteBlocked": "Ce navigateur a bloqué la lecture du presse-papiers. Appuyez sur {shortcut} avec le sélecteur ouvert pour coller.",
     "pastSecond": "Dernière {count} seconde | Dernières {count} secondes",
     "pastMinute": "Dernière {count} minute | Dernières {count} minutes",
@@ -3406,6 +3420,22 @@
     "contact_name": "Nom du contact",
     "contact_email": "E-mail de contact",
     "environment_type": "Type d'environnement",
+    "features": "Fonctionnalités",
+    "features_all_unlocked": "Votre licence débloque toutes les fonctionnalités.",
+    "features_summary": "Votre licence débloque {ratio}. {free} fonctionnalité gratuite est toujours incluse. | Votre licence débloque {ratio}. {free} fonctionnalités gratuites sont toujours incluses.",
+    "features_paid_ratio": "{unlocked} fonctionnalité payante sur {paid} | {unlocked} fonctionnalités payantes sur {paid}",
+    "features_unlocked": "Débloquée",
+    "features_missing": "Non incluse dans votre licence",
+    "features_request_access": "Demander l'accès",
+    "features_search": "Rechercher {count} fonctionnalité | Rechercher les {count} fonctionnalités",
+    "features_filter_all": "Toutes",
+    "features_filter_free": "Gratuites",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Aucune fonctionnalité ne correspond à votre recherche",
+    "features_none": "Aucune fonctionnalité dans ce groupe",
+    "features_free_heading": "Gratuites, incluses avec chaque licence",
+    "features_new": "Nouvelles depuis votre licence",
+    "features_filter_new": "Nouvelles",
     "request_new_license": "Demander une nouvelle licence",
     "add_new_license_key": "Ajouter une nouvelle clé de licence",
     "refresh_license_limits": "Actualiser les limites de licence",
@@ -9901,6 +9931,12 @@
     "allClear": "Tout est clair",
     "allClearDesc": "Aucune anomalie active, aucun incident ou service dégradé dans la fenêtre de temps sélectionnée.",
     "allClearDescScoped": "Aucun incident ouvert, aucune anomalie ni service dégradé dans la plage de temps sélectionnée.",
+    "allClearPartial": "Rien à signaler",
+    "allClearPartialDesc": "Rien ne nécessite votre attention. Nous n'avons pas vérifié {areas}, car votre licence n'inclut pas ces fonctionnalités.",
+    "areaAlerts": "Alertes",
+    "areaAnomalies": "Détection d'anomalies",
+    "areaIncidents": "Incidents",
+    "areaServices": "Services",
     "notMonitoredTitle": "Rien n'est encore surveillé",
     "notMonitoredDesc": "Vos données arrivent, mais aucune alerte ni vérification d'anomalie ne s'exécute dessus. Ajoutez-en une et la Vue d'ensemble listera tout ce qui nécessite votre attention.",
     "notMonitoredAlert": "Créer une alerte",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Redémarrer {count} collecteurs ?",
       "restartMessage": "Chaque collecteur redémarre à son prochain message du serveur. La collecte de données est brièvement interrompue sur chaque hôte.",
       "restartQueued": "Redémarrage demandé pour {count} collecteur | Redémarrage demandé pour {count} collecteurs",
+      "restartOffline": "Ce collecteur est hors ligne. Redémarrez-le une fois qu'il sera de nouveau en ligne.",
       "restartUnsupported": "Ce collecteur n'accepte pas les commandes de redémarrage",
       "systemSections": "Sections gérées par le système",
       "systemSectionsCaption": "Extension OpAMP et télémétrie du service, définies par le superviseur et le serveur",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Ouvre l'éditeur de {config}. Publiez une version corrigée et faites-y passer cette flotte ; ce déploiement est alors remplacé.",
       "confirmResume": "Le même déploiement reprend à la phase {n}.",
       "confirmRollback": "Lance immédiatement un déploiement de retour à la version stable, {config} v{version}. Les collecteurs qui l'utilisent déjà ne reçoivent rien.",
-      "confirmRollbackNoStable": "Lance immédiatement un déploiement de retour à la version stable.",
+      "confirmRollbackNoStable": "Cette flotte n'a pas de version stable, donc le déploiement se termine et ses collecteurs cessent de collecter jusqu'à votre prochain déploiement.",
       "confirmSkip": "Exclut {count} collecteur en échec et continue. Il est marqué comme exclu et inclus de nouveau au prochain déploiement. | Exclut {count} collecteurs en échec et continue. Ils sont marqués comme exclus et inclus de nouveau au prochain déploiement.",
       "confirmed": "Confirmé",
       "eventConverged": "Phase {n} convergée",
@@ -29321,6 +29358,7 @@
       "phaseN": "Phase {n}",
       "phaseTimedOut": "Délai dépassé",
       "phaseTimeoutNote": "Une phase qui ne confirme ni ne rejette en {minutes} min interrompt le déploiement (paramètre de la flotte)",
+      "phaseTimeoutNoteSeconds": "Une phase qui ne confirme ni ne rejette dans un délai de {minutes} min {seconds} s interrompt le déploiement (paramètre de la flotte)",
       "phaseVerifying": "Vérification",
       "phases": "Phases",
       "planEmpty": "Aucun collecteur n'est en ligne, le déploiement attend qu'un collecteur se connecte",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Hérité ({value})",
       "offlineHeartbeats": "Hors ligne après des heartbeats manqués",
       "offlineHeartbeatsHelp": "Un collecteur est hors ligne après ce nombre d'intervalles de heartbeat sans message",
-      "offlineRatio": "Événement de ratio hors ligne (%)",
-      "offlineRatioHelp": "Enregistre un événement de flotte lorsque plus de cette part de collecteurs est hors ligne",
+      "offlineRatio": "Taux hors ligne (%)",
+      "offlineRatioHelp": "Interrompt la phase lorsque la part de ses collecteurs hors ligne dépasse cette valeur",
       "outOfRange": "Saisissez un nombre de {min} à {max}",
       "phaseTimeout": "Délai d'une phase (secondes)",
       "phaseTimeoutHelp": "Une phase de déploiement qui ne confirme ni ne rejette dans ce délai est interrompue",
diff --git a/web/src/locales/languages/it-IT.json b/web/src/locales/languages/it-IT.json
index cca8025f39..e45c822c15 100644
--- a/web/src/locales/languages/it-IT.json
+++ b/web/src/locales/languages/it-IT.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Non incluso nella tua licenza",
+    "title": "La funzionalità {feature} non è inclusa nella tua licenza",
+    "description": "Il tuo amministratore può aggiungerla aggiornando la licenza, oppure contatta il team commerciale per ottenere una licenza che la includa.",
+    "thisFeature": "Questa funzionalità",
+    "contactSales": "Contatta il team commerciale",
+    "toastTitle": "Non incluso nella tua licenza",
+    "toastMessage": "La tua licenza non include: {features}. Chiedi al tuo amministratore di aggiornare la licenza.",
+    "toastMessageGeneric": "La tua licenza non include questa funzionalità. Chiedi al tuo amministratore di aggiornare la licenza.",
+    "bannerMessage": "Questa funzionalità è bloccata. Richiede la funzionalità {feature} nella tua licenza.",
+    "bannerMessageGeneric": "Questa pagina richiede una funzionalità non inclusa nella tua licenza.",
+    "headerLocked": "Bloccata: richiede {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Nessuna cronologia ancora",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Intervallo di date copiato",
     "dateRangePasted": "Intervallo di date incollato",
     "dateRangePasteError": "Impossibile analizzare l'intervallo di date",
+    "dateRangePasteEmpty": "Gli appunti sono vuoti. Copia prima un intervallo di date.",
     "dateRangePasteBlocked": "Questo browser ha bloccato la lettura degli appunti. Premi {shortcut} con il selettore aperto per incollare.",
     "pastSecond": "Ultimo {count} secondo | Ultimi {count} secondi",
     "pastMinute": "Ultimo {count} minuto | Ultimi {count} minuti",
@@ -3406,6 +3420,22 @@
     "contact_name": "Nome del contatto",
     "contact_email": "Email di contatto",
     "environment_type": "Tipo di ambiente",
+    "features": "Funzionalità",
+    "features_all_unlocked": "La tua licenza sblocca tutte le funzionalità.",
+    "features_summary": "La tua licenza sblocca {ratio}. {free} funzionalità gratuita è sempre inclusa. | La tua licenza sblocca {ratio}. {free} funzionalità gratuite sono sempre incluse.",
+    "features_paid_ratio": "{unlocked} di {paid} funzionalità a pagamento | {unlocked} di {paid} funzionalità a pagamento",
+    "features_unlocked": "Sbloccate",
+    "features_missing": "Non incluse nella tua licenza",
+    "features_request_access": "Richiedi accesso",
+    "features_search": "Cerca tra {count} funzionalità | Cerca tra tutte le {count} funzionalità",
+    "features_filter_all": "Tutte",
+    "features_filter_free": "Gratuite",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Nessuna funzionalità corrisponde alla ricerca",
+    "features_none": "Nessuna funzionalità in questo gruppo",
+    "features_free_heading": "Gratuite, incluse in ogni licenza",
+    "features_new": "Nuove dopo la tua licenza",
+    "features_filter_new": "Nuove",
     "request_new_license": "Richiedi una nuova licenza",
     "add_new_license_key": "Aggiungi nuova chiave di licenza",
     "refresh_license_limits": "Aggiorna i limiti delle licenze",
@@ -9901,6 +9931,12 @@
     "allClear": "Tutto chiaro",
     "allClearDesc": "Nessuna anomalia attiva, incidente o servizio degradato nella finestra temporale selezionata.",
     "allClearDescScoped": "Nessun incidente aperto, anomalia o servizio degradato nell'intervallo di tempo selezionato.",
+    "allClearPartial": "Niente da segnalare",
+    "allClearPartialDesc": "Nulla richiede attenzione. Non abbiamo verificato {areas}, perché la tua licenza non include queste funzionalità.",
+    "areaAlerts": "Avvisi",
+    "areaAnomalies": "Rilevamento anomalie",
+    "areaIncidents": "Incidenti",
+    "areaServices": "Servizi",
     "notMonitoredTitle": "Non c'è ancora nulla sotto monitoraggio",
     "notMonitoredDesc": "I tuoi dati stanno arrivando, ma non viene eseguito alcun controllo di avvisi o anomalie su di essi. Aggiungine uno e la Panoramica elencherà tutto ciò che richiede attenzione.",
     "notMonitoredAlert": "Crea un avviso",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Riavviare {count} collector?",
       "restartMessage": "Ogni collector si riavvia al suo prossimo messaggio dal server. La raccolta dei dati si interrompe brevemente su ogni host.",
       "restartQueued": "Riavvio richiesto per {count} collector | Riavvio richiesto per {count} collector",
+      "restartOffline": "Questo collector è offline. Riavvialo quando sarà di nuovo online.",
       "restartUnsupported": "Questo collector non accetta comandi di riavvio",
       "systemSections": "Sezioni gestite dal sistema",
       "systemSectionsCaption": "Estensione OpAMP e telemetria del servizio, impostate dal supervisor e dal server",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Apre l'editor di {config}. Pubblica una versione corretta e porta questo fleet su di essa; questo rollout viene quindi sostituito.",
       "confirmResume": "Lo stesso rollout continua dalla fase {n}.",
       "confirmRollback": "Avvia subito un rollout di ritorno alla versione stabile, {config} v{version}. I collector che la eseguono già non ricevono nulla.",
-      "confirmRollbackNoStable": "Avvia subito un rollout di ritorno alla versione stabile.",
+      "confirmRollbackNoStable": "Questa flotta non ha una versione stabile, quindi il rollout termina e i suoi collector smettono di raccogliere finché non esegui di nuovo il deployment.",
       "confirmSkip": "Esclude {count} collector in errore e continua. Viene contrassegnato come escluso e reincluso nel prossimo rollout. | Esclude {count} collector in errore e continua. Vengono contrassegnati come esclusi e reinclusi nel prossimo rollout.",
       "confirmed": "Confermato",
       "eventConverged": "Fase {n} convergente",
@@ -29321,6 +29358,7 @@
       "phaseN": "Fase {n}",
       "phaseTimedOut": "Scaduta",
       "phaseTimeoutNote": "Una fase che non conferma né rifiuta entro {minutes} min interrompe il rollout (impostazione del fleet)",
+      "phaseTimeoutNoteSeconds": "Una fase che non conferma né rifiuta entro {minutes} min {seconds} s interrompe il rollout (impostazione della flotta)",
       "phaseVerifying": "In verifica",
       "phases": "Fasi",
       "planEmpty": "Nessun collector è online, quindi il rollout attende che uno si connetta",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Eredita ({value})",
       "offlineHeartbeats": "Offline dopo heartbeat mancati",
       "offlineHeartbeatsHelp": "Un collector è offline dopo questo numero di intervalli di heartbeat senza alcun messaggio",
-      "offlineRatio": "Evento di quota offline (%)",
-      "offlineRatioHelp": "Registra un evento del fleet quando più di questa quota di collector è offline",
+      "offlineRatio": "Percentuale offline (%)",
+      "offlineRatioHelp": "Interrompe la fase quando la percentuale dei suoi collector offline supera questo valore",
       "outOfRange": "Inserisci un numero da {min} a {max}",
       "phaseTimeout": "Timeout della fase (secondi)",
       "phaseTimeoutHelp": "Una fase del rollout che non conferma né rifiuta entro questo tempo viene interrotta",
diff --git a/web/src/locales/languages/ja-JP.json b/web/src/locales/languages/ja-JP.json
index ede4c2a27a..17e7566520 100644
--- a/web/src/locales/languages/ja-JP.json
+++ b/web/src/locales/languages/ja-JP.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "ライセンスに含まれていません",
+    "title": "{feature} はライセンスに含まれていません",
+    "description": "管理者がライセンスを更新して追加するか、含まれているライセンスについて営業担当者にお問い合わせください。",
+    "thisFeature": "この機能",
+    "contactSales": "営業担当者に問い合わせる",
+    "toastTitle": "ライセンスに含まれていません",
+    "toastMessage": "ライセンスに含まれていない機能: {features}。管理者にライセンスの更新を依頼してください。",
+    "toastMessageGeneric": "ライセンスにこの機能は含まれていません。管理者にライセンスの更新を依頼してください。",
+    "bannerMessage": "この機能はロックされています。ライセンスに {feature} 機能が必要です。",
+    "bannerMessageGeneric": "このページにはライセンスに含まれていない機能が必要です。",
+    "headerLocked": "ロック中: {feature} が必要"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "履歴はまだありません",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "日付範囲をコピーしました",
     "dateRangePasted": "日付範囲を貼り付けました",
     "dateRangePasteError": "日付範囲を解析できませんでした",
+    "dateRangePasteEmpty": "クリップボードが空です。先に日付範囲をコピーしてください。",
     "dateRangePasteBlocked": "このブラウザではクリップボードの読み取りがブロックされています。ピッカーを開いた状態で {shortcut} を押して貼り付けてください。",
     "pastSecond": "{count} 秒前 | {count} 秒前",
     "pastMinute": "{count} 分前 | {count} 分前",
@@ -3406,6 +3420,22 @@
     "contact_name": "連絡先名",
     "contact_email": "連絡先電子メール",
     "environment_type": "環境タイプ",
+    "features": "機能",
+    "features_all_unlocked": "ライセンスですべての機能が利用可能です。",
+    "features_summary": "ライセンスで {ratio} が利用可能です。{free} 個の無料機能が常に含まれます。 | ライセンスで {ratio} が利用可能です。{free} 個の無料機能が常に含まれます。",
+    "features_paid_ratio": "{paid} 個の有料機能のうち {unlocked} 個 | {paid} 個の有料機能のうち {unlocked} 個",
+    "features_unlocked": "利用可能",
+    "features_missing": "ライセンスに含まれていません",
+    "features_request_access": "アクセスをリクエスト",
+    "features_search": "{count} 件の機能を検索 | すべての {count} 件の機能を検索",
+    "features_filter_all": "すべて",
+    "features_filter_free": "無料",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "検索に一致する機能はありません",
+    "features_none": "このグループに機能はありません",
+    "features_free_heading": "無料、すべてのライセンスに含まれます",
+    "features_new": "ライセンス発行後に追加された機能",
+    "features_filter_new": "新規",
     "request_new_license": "新しいライセンスをリクエスト",
     "add_new_license_key": "新しいライセンスキーを追加",
     "refresh_license_limits": "ライセンス制限を更新",
@@ -9901,6 +9931,12 @@
     "allClear": "すべてクリア",
     "allClearDesc": "選択した時間枠には、アクティブな異常、インシデント、または低下したサービスはありません。",
     "allClearDescScoped": "選択した期間に未解決のインシデント、異常、サービス劣化はありません。",
+    "allClearPartial": "報告事項はありません",
+    "allClearPartialDesc": "注意が必要な項目はありません。ライセンスに対象の機能が含まれていないため、{areas}は確認していません。",
+    "areaAlerts": "アラート",
+    "areaAnomalies": "異常検知",
+    "areaIncidents": "インシデント",
+    "areaServices": "サービス",
     "notMonitoredTitle": "まだ何も監視されていません",
     "notMonitoredDesc": "データは到着していますが、アラートや異常検知が実行されていません。追加すると、概要に注意が必要な項目が表示されます。",
     "notMonitoredAlert": "アラートを作成",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "{count} 台のコレクターを再起動しますか？",
       "restartMessage": "各コレクターは、サーバーからの次のメッセージで再起動します。各ホストでデータ収集が一時的に停止します。",
       "restartQueued": "{count} 台のコレクターの再起動をリクエストしました | {count} 台のコレクターの再起動をリクエストしました",
+      "restartOffline": "このコレクターはオフラインです。復旧したら再起動してください。",
       "restartUnsupported": "このコレクターは再起動コマンドに対応していません",
       "systemSections": "システム管理セクション",
       "systemSectionsCaption": "OpAMP 拡張とサービステレメトリ。スーパーバイザーとサーバーが設定します",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "{config} のエディターを開きます。修正版を公開し、このフリートをそのバージョンに変更してください。このロールアウトは置き換えられます。",
       "confirmResume": "同じロールアウトがフェーズ {n} から続行されます。",
       "confirmRollback": "安定バージョン {config} v{version} への即時ロールアウトを開始します。すでにそのバージョンのコレクターには何も送信されません。",
-      "confirmRollbackNoStable": "安定バージョンへの即時ロールアウトを開始します。",
+      "confirmRollbackNoStable": "このフリートには安定バージョンがないため、ロールアウトは終了し、再度デプロイするまでコレクターは収集を停止します。",
       "confirmSkip": "失敗している {count} 台のコレクターを除外して続行します。除外済みとしてマークされ、次のロールアウトで再び対象になります。 | 失敗している {count} 台のコレクターを除外して続行します。除外済みとしてマークされ、次のロールアウトで再び対象になります。",
       "confirmed": "確認済み",
       "eventConverged": "フェーズ {n} が収束",
@@ -29321,6 +29358,7 @@
       "phaseN": "フェーズ {n}",
       "phaseTimedOut": "タイムアウト",
       "phaseTimeoutNote": "{minutes} 分以内に承認も拒否もされないフェーズがあると、ロールアウトは停止します（フリート設定）",
+      "phaseTimeoutNoteSeconds": "{minutes}分{seconds}秒以内に確認も拒否もしないフェーズはロールアウトを停止します（フリート設定）",
       "phaseVerifying": "検証中",
       "phases": "フェーズ",
       "planEmpty": "オンラインのコレクターがないため、コレクターが接続するまでロールアウトは待機します。",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "継承（{value}）",
       "offlineHeartbeats": "オフラインと判定するハートビート欠落回数",
       "offlineHeartbeatsHelp": "メッセージがないままこの回数のハートビート間隔が経過すると、コレクターはオフラインとみなされます",
-      "offlineRatio": "オフライン率イベント（%）",
-      "offlineRatioHelp": "オフラインのコレクターの割合がこの値を超えると、フリートイベントを記録します",
+      "offlineRatio": "オフライン率（%）",
+      "offlineRatioHelp": "コレクターのオフライン率がこの割合を超えるとフェーズを停止します",
       "outOfRange": "{min} から {max} までの数値を入力してください",
       "phaseTimeout": "フェーズのタイムアウト（秒）",
       "phaseTimeoutHelp": "この時間内に承認も拒否もされないロールアウトフェーズがあると、停止します",
diff --git a/web/src/locales/languages/ko-KR.json b/web/src/locales/languages/ko-KR.json
index 68b1ea322c..beb3eecfda 100644
--- a/web/src/locales/languages/ko-KR.json
+++ b/web/src/locales/languages/ko-KR.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "라이선스에 포함되지 않음",
+    "title": "{feature} 기능은 라이선스에 포함되어 있지 않습니다",
+    "description": "관리자가 라이선스를 업데이트하여 추가할 수 있으며, 해당 기능이 포함된 라이선스가 필요하면 영업팀에 문의하세요.",
+    "thisFeature": "이 기능",
+    "contactSales": "영업팀 문의",
+    "toastTitle": "라이선스에 포함되지 않음",
+    "toastMessage": "라이선스에 다음이 포함되어 있지 않습니다: {features}. 관리자에게 라이선스 업데이트를 요청하세요.",
+    "toastMessageGeneric": "라이선스에 이 기능이 포함되어 있지 않습니다. 관리자에게 라이선스 업데이트를 요청하세요.",
+    "bannerMessage": "이 기능은 잠겨 있습니다. 라이선스에 {feature} 기능이 필요합니다.",
+    "bannerMessageGeneric": "이 페이지에는 라이선스에 없는 기능이 필요합니다.",
+    "headerLocked": "잠김: {feature} 필요"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "아직 기록이 없습니다",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "날짜 범위가 복사됨",
     "dateRangePasted": "날짜 범위가 붙여넣기됨",
     "dateRangePasteError": "날짜 범위를 구문 분석할 수 없음",
+    "dateRangePasteEmpty": "클립보드가 비어 있습니다. 먼저 날짜 범위를 복사하세요.",
     "dateRangePasteBlocked": "이 브라우저에서 클립보드 읽기가 차단되었습니다. 선택기를 연 상태에서 {shortcut}을 눌러 붙여넣으세요.",
     "pastSecond": "지난 {count}초 | 지난 {count}초",
     "pastMinute": "지난 {count}분 | 지난 {count}분",
@@ -3406,6 +3420,22 @@
     "contact_name": "담당자 이름",
     "contact_email": "연락처 이메일",
     "environment_type": "환경 유형",
+    "features": "기능",
+    "features_all_unlocked": "라이선스로 모든 기능을 사용할 수 있습니다.",
+    "features_summary": "라이선스로 {ratio}을(를) 사용할 수 있습니다. 무료 기능 {free}개는 항상 포함됩니다. | 라이선스로 {ratio}을(를) 사용할 수 있습니다. 무료 기능 {free}개는 항상 포함됩니다.",
+    "features_paid_ratio": "{paid}개 유료 기능 중 {unlocked}개 | {paid}개 유료 기능 중 {unlocked}개",
+    "features_unlocked": "사용 가능",
+    "features_missing": "라이선스에 포함되지 않음",
+    "features_request_access": "액세스 요청",
+    "features_search": "{count}개 기능 검색 | 전체 {count}개 기능 검색",
+    "features_filter_all": "전체",
+    "features_filter_free": "무료",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "검색과 일치하는 기능이 없습니다",
+    "features_none": "이 그룹에 기능이 없습니다",
+    "features_free_heading": "무료, 모든 라이선스에 포함",
+    "features_new": "라이선스 이후 새로 추가된 기능",
+    "features_filter_new": "신규",
     "request_new_license": "새 라이선스 요청",
     "add_new_license_key": "새 라이선스 키 추가",
     "refresh_license_limits": "라이선스 제한 새로고침",
@@ -9901,6 +9931,12 @@
     "allClear": "모든 시스템 정상",
     "allClearDesc": "선택한 기간에 활성 이상 징후, 인시던트 또는 성능이 저하된 서비스가 없습니다. 인프라가 정상입니다.",
     "allClearDescScoped": "선택한 시간 범위에 미해결 인시던트, 이상 징후 또는 성능이 저하된 서비스가 없습니다.",
+    "allClearPartial": "보고할 내용이 없습니다",
+    "allClearPartialDesc": "주의가 필요한 항목이 없습니다. 라이선스에 해당 기능이 포함되어 있지 않아 {areas} 항목은 확인하지 않았습니다.",
+    "areaAlerts": "알림",
+    "areaAnomalies": "이상 탐지",
+    "areaIncidents": "인시던트",
+    "areaServices": "서비스",
     "notMonitoredTitle": "아직 모니터링하는 항목이 없습니다",
     "notMonitoredDesc": "데이터는 도착하고 있지만 이에 대해 실행되는 알림이나 이상 감지 검사가 없습니다. 하나를 추가하면 개요에서 주의가 필요한 항목을 모두 나열합니다.",
     "notMonitoredAlert": "알림 생성",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "수집기 {count}개를 재시작하시겠습니까?",
       "restartMessage": "각 수집기는 서버의 다음 메시지를 받을 때 재시작됩니다. 각 호스트에서 데이터 수집이 잠시 중단됩니다.",
       "restartQueued": "수집기 {count}개에 재시작이 요청되었습니다 | 수집기 {count}개에 재시작이 요청되었습니다",
+      "restartOffline": "이 컬렉터는 오프라인 상태입니다. 다시 온라인이 되면 재시작하세요.",
       "restartUnsupported": "이 수집기는 재시작 명령을 지원하지 않습니다",
       "systemSections": "시스템 관리 섹션",
       "systemSectionsCaption": "슈퍼바이저와 서버가 설정하는 OpAMP 확장 및 서비스 텔레메트리",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "{config} 편집기를 엽니다. 수정된 버전을 게시하고 이 플릿을 해당 버전으로 변경하면 이 롤아웃은 대체됩니다.",
       "confirmResume": "동일한 롤아웃이 {n}단계부터 계속됩니다.",
       "confirmRollback": "안정 버전인 {config} v{version}(으)로 즉시 롤백하는 롤아웃을 시작합니다. 이미 해당 버전인 수집기에는 아무것도 전달되지 않습니다.",
-      "confirmRollbackNoStable": "안정 버전으로 즉시 롤백하는 롤아웃을 시작합니다.",
+      "confirmRollbackNoStable": "이 플릿에는 안정 버전이 없으므로 롤아웃이 종료되고, 다시 배포할 때까지 해당 컬렉터의 수집이 중단됩니다.",
       "confirmSkip": "실패한 수집기 {count}개를 제외하고 계속합니다. 제외 표시되며 다음 롤아웃에 다시 포함됩니다. | 실패한 수집기 {count}개를 제외하고 계속합니다. 제외 표시되며 다음 롤아웃에 다시 포함됩니다.",
       "confirmed": "확인됨",
       "eventConverged": "{n}단계 수렴 완료",
@@ -29321,6 +29358,7 @@
       "phaseN": "{n}단계",
       "phaseTimedOut": "시간 초과",
       "phaseTimeoutNote": "{minutes}분 안에 확인도 거부도 하지 않는 단계가 있으면 롤아웃이 중단됩니다 (플릿 설정)",
+      "phaseTimeoutNoteSeconds": "{minutes}분 {seconds}초 내에 확인도 거부도 하지 않는 단계가 있으면 롤아웃이 중단됩니다(플릿 설정)",
       "phaseVerifying": "검증 중",
       "phases": "단계",
       "planEmpty": "온라인 상태인 컬렉터가 없어 하나가 연결될 때까지 롤아웃이 대기합니다",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "상속 ({value})",
       "offlineHeartbeats": "오프라인으로 간주하는 하트비트 누락 횟수",
       "offlineHeartbeatsHelp": "메시지 없이 이 횟수만큼 하트비트 간격이 지나면 수집기는 오프라인입니다",
-      "offlineRatio": "오프라인 비율 이벤트 (%)",
-      "offlineRatioHelp": "이 비율을 넘는 수집기가 오프라인이면 플릿 이벤트를 기록합니다",
+      "offlineRatio": "오프라인 비율 (%)",
+      "offlineRatioHelp": "컬렉터 중 이 비율을 초과하는 수가 오프라인이 되면 해당 단계가 중단됩니다",
       "outOfRange": "{min}에서 {max} 사이의 숫자를 입력하세요",
       "phaseTimeout": "단계 제한 시간 (초)",
       "phaseTimeoutHelp": "이 시간 안에 확인도 거부도 하지 않는 롤아웃 단계는 중단됩니다",
diff --git a/web/src/locales/languages/nl-NL.json b/web/src/locales/languages/nl-NL.json
index ded81b9d97..32355ce273 100644
--- a/web/src/locales/languages/nl-NL.json
+++ b/web/src/locales/languages/nl-NL.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Niet in je licentie",
+    "title": "{feature} is niet inbegrepen in je licentie",
+    "description": "Je beheerder kan het toevoegen door de licentie bij te werken, of neem contact op met sales voor een licentie die het bevat.",
+    "thisFeature": "Deze functie",
+    "contactSales": "Contact opnemen met sales",
+    "toastTitle": "Niet inbegrepen in je licentie",
+    "toastMessage": "Je licentie bevat niet: {features}. Vraag je beheerder de licentie bij te werken.",
+    "toastMessageGeneric": "Je licentie bevat deze functie niet. Vraag je beheerder de licentie bij te werken.",
+    "bannerMessage": "Deze functie is vergrendeld. Er is de functie {feature} in je licentie voor nodig.",
+    "bannerMessageGeneric": "Deze pagina vereist een functie die niet in je licentie zit.",
+    "headerLocked": "Vergrendeld: {feature} vereist"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Nog geen geschiedenis",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Datumbereik gekopieerd",
     "dateRangePasted": "Datumbereik geplakt",
     "dateRangePasteError": "Kon datumbereik niet parseren",
+    "dateRangePasteEmpty": "Klembord is leeg. Kopieer eerst een datumbereik.",
     "dateRangePasteBlocked": "Deze browser heeft het lezen van het klembord geblokkeerd. Druk op {shortcut} terwijl de kiezer open is om te plakken.",
     "pastSecond": "Laatste {count} seconde | Laatste {count} seconden",
     "pastMinute": "Laatste {count} minuut | Laatste {count} minuten",
@@ -3406,6 +3420,22 @@
     "contact_name": "Naam van de contactpersoon",
     "contact_email": "E-mailadres voor contact",
     "environment_type": "Omgevingstype",
+    "features": "Functies",
+    "features_all_unlocked": "Je licentie ontgrendelt alle functies.",
+    "features_summary": "Je licentie ontgrendelt {ratio}. {free} gratis functie is altijd inbegrepen. | Je licentie ontgrendelt {ratio}. {free} gratis functies zijn altijd inbegrepen.",
+    "features_paid_ratio": "{unlocked} van {paid} betaalde functie | {unlocked} van {paid} betaalde functies",
+    "features_unlocked": "Ontgrendeld",
+    "features_missing": "Niet in je licentie",
+    "features_request_access": "Toegang aanvragen",
+    "features_search": "Zoek in {count} functie | Zoek in alle {count} functies",
+    "features_filter_all": "Alle",
+    "features_filter_free": "Gratis",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Geen functies gevonden voor je zoekopdracht",
+    "features_none": "Geen functies in deze groep",
+    "features_free_heading": "Gratis, inbegrepen bij elke licentie",
+    "features_new": "Nieuw sinds je licentie",
+    "features_filter_new": "Nieuw",
     "request_new_license": "Nieuwe licentie aanvragen",
     "add_new_license_key": "Nieuwe licentiecode toevoegen",
     "refresh_license_limits": "Licentielimieten vernieuwen",
@@ -9901,6 +9931,12 @@
     "allClear": "Alles duidelijk",
     "allClearDesc": "Geen actieve afwijkingen, incidenten of slechte services in het geselecteerde tijdvenster.",
     "allClearDescScoped": "Geen open incidenten, afwijkingen of gedegradeerde services in het geselecteerde tijdsbereik.",
+    "allClearPartial": "Niets te melden",
+    "allClearPartialDesc": "Niets vereist aandacht. We hebben {areas} niet gecontroleerd, omdat je licentie die functies niet omvat.",
+    "areaAlerts": "Alarmen",
+    "areaAnomalies": "Anomaliedetectie",
+    "areaIncidents": "Incidenten",
+    "areaServices": "Services",
     "notMonitoredTitle": "Er wordt nog niets bewaakt",
     "notMonitoredDesc": "Je gegevens komen binnen, maar er wordt geen alarm- of afwijkingscontrole op uitgevoerd. Voeg er een toe en Overzicht toont alles wat aandacht nodig heeft.",
     "notMonitoredAlert": "Een alarm aanmaken",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "{count} collectors herstarten?",
       "restartMessage": "Elke collector herstart bij zijn volgende bericht van de server. Het verzamelen van gegevens pauzeert kort op elke host.",
       "restartQueued": "Herstart aangevraagd voor {count} collector | Herstart aangevraagd voor {count} collectors",
+      "restartOffline": "Deze collector is offline. Herstart hem zodra hij weer online is.",
       "restartUnsupported": "Deze collector accepteert geen herstartopdrachten",
       "systemSections": "Door het systeem beheerde secties",
       "systemSectionsCaption": "OpAMP-extensie en servicetelemetrie, ingesteld door de supervisor en de server",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Opent de editor voor {config}. Publiceer een gecorrigeerde versie en zet deze fleet daarop; deze uitrol wordt dan vervangen.",
       "confirmResume": "Dezelfde uitrol gaat verder vanaf fase {n}.",
       "confirmRollback": "Start direct een uitrol terug naar de stabiele versie, {config} v{version}. Collectors die er al op staan, ontvangen niets.",
-      "confirmRollbackNoStable": "Start direct een uitrol terug naar de stabiele versie.",
+      "confirmRollbackNoStable": "Deze fleet heeft geen stabiele versie, dus de uitrol eindigt en de collectors stoppen met verzamelen totdat je opnieuw deployt.",
       "confirmSkip": "Sluit {count} falende collector uit en gaat verder. Deze wordt als uitgesloten gemarkeerd en bij de volgende uitrol opnieuw meegenomen. | Sluit {count} falende collectors uit en gaat verder. Ze worden als uitgesloten gemarkeerd en bij de volgende uitrol opnieuw meegenomen.",
       "confirmed": "Bevestigd",
       "eventConverged": "Fase {n} geconvergeerd",
@@ -29321,6 +29358,7 @@
       "phaseN": "Fase {n}",
       "phaseTimedOut": "Verlopen",
       "phaseTimeoutNote": "Een fase die binnen {minutes} min niet bevestigt of weigert, stopt de uitrol (fleet-instelling)",
+      "phaseTimeoutNoteSeconds": "Een fase die niet binnen {minutes} min {seconds} s bevestigt of afwijst, stopt de uitrol (fleetinstelling)",
       "phaseVerifying": "Verifiëren",
       "phases": "Fasen",
       "planEmpty": "Er is geen collector online, dus de uitrol wacht tot er één verbinding maakt",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Standaardwaarde ({value})",
       "offlineHeartbeats": "Offline na gemiste heartbeats",
       "offlineHeartbeatsHelp": "Een collector is offline na zoveel heartbeat-intervallen zonder bericht",
-      "offlineRatio": "Offline-aandeelgebeurtenis (%)",
-      "offlineRatioHelp": "Legt een fleet-gebeurtenis vast wanneer meer dan dit aandeel van de collectors offline is",
+      "offlineRatio": "Offline-ratio (%)",
+      "offlineRatioHelp": "Stopt de fase wanneer meer dan dit aandeel van de collectors offline is",
       "outOfRange": "Voer een getal van {min} tot {max} in",
       "phaseTimeout": "Fasetime-out (seconden)",
       "phaseTimeoutHelp": "Een uitrolfase die in deze tijd niet bevestigt of weigert, stopt",
diff --git a/web/src/locales/languages/pl-PL.json b/web/src/locales/languages/pl-PL.json
index 773ff870dc..826a12ad16 100644
--- a/web/src/locales/languages/pl-PL.json
+++ b/web/src/locales/languages/pl-PL.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Brak w licencji",
+    "title": "{feature} nie jest objęta Twoją licencją",
+    "description": "Administrator może ją dodać, aktualizując licencję. Możesz też skontaktować się z działem sprzedaży, aby uzyskać licencję, która ją obejmuje.",
+    "thisFeature": "Ta funkcja",
+    "contactSales": "Skontaktuj się z działem sprzedaży",
+    "toastTitle": "Nieobjęte licencją",
+    "toastMessage": "Twoja licencja nie obejmuje: {features}. Poproś administratora o aktualizację licencji.",
+    "toastMessageGeneric": "Twoja licencja nie obejmuje tej funkcji. Poproś administratora o aktualizację licencji.",
+    "bannerMessage": "Ta funkcja jest zablokowana. Wymaga funkcji {feature} w Twojej licencji.",
+    "bannerMessageGeneric": "Ta strona wymaga funkcji, której nie ma w Twojej licencji.",
+    "headerLocked": "Zablokowano: wymaga {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Brak historii",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Zakres dat skopiowany",
     "dateRangePasted": "Zakres dat wklejony",
     "dateRangePasteError": "Nie można przetworzyć zakresu dat",
+    "dateRangePasteEmpty": "Schowek jest pusty. Najpierw skopiuj zakres dat.",
     "dateRangePasteBlocked": "Ta przeglądarka zablokowała odczyt schowka. Naciśnij {shortcut} przy otwartym selektorze, aby wkleić.",
     "pastSecond": "W ciągu ostatniej {count} sekundy | W ciągu ostatnich {count} s",
     "pastMinute": "W ciągu ostatniej {count} minuty | W ciągu ostatnich {count} min",
@@ -3406,6 +3420,22 @@
     "contact_name": "Imię i nazwisko kontaktowe",
     "contact_email": "Adres e-mail kontaktowy",
     "environment_type": "Typ środowiska",
+    "features": "Funkcje",
+    "features_all_unlocked": "Twoja licencja odblokowuje wszystkie funkcje.",
+    "features_summary": "Twoja licencja odblokowuje {ratio}. Zawsze wliczona jest {free} bezpłatna funkcja. | Twoja licencja odblokowuje {ratio}. Zawsze wliczane są bezpłatne funkcje ({free}).",
+    "features_paid_ratio": "{unlocked} z {paid} płatnej funkcji | {unlocked} z {paid} płatnych funkcji",
+    "features_unlocked": "Odblokowane",
+    "features_missing": "Nieobjęte licencją",
+    "features_request_access": "Poproś o dostęp",
+    "features_search": "Przeszukaj {count} funkcję | Przeszukaj wszystkie funkcje ({count})",
+    "features_filter_all": "Wszystkie",
+    "features_filter_free": "Bezpłatne",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Brak funkcji pasujących do wyszukiwania",
+    "features_none": "Brak funkcji w tej grupie",
+    "features_free_heading": "Bezpłatne, wliczone w każdą licencję",
+    "features_new": "Nowe po Twojej licencji",
+    "features_filter_new": "Nowe",
     "request_new_license": "Poproś o nową licencję",
     "add_new_license_key": "Dodaj nowy klucz licencyjny",
     "refresh_license_limits": "Odśwież limity licencji",
@@ -9901,6 +9931,12 @@
     "allClear": "Wszystkie systemy sprawne",
     "allClearDesc": "Brak aktywnych anomalii, incydentów lub usług w stanie obniżonej wydajności w wybranym przedziale czasu. Twoja infrastruktura wygląda zdrowo.",
     "allClearDescScoped": "Brak otwartych incydentów, anomalii lub zdegradowanych usług w wybranym zakresie czasu.",
+    "allClearPartial": "Nic do zgłoszenia",
+    "allClearPartialDesc": "Nic nie wymaga uwagi. Nie sprawdziliśmy {areas}, ponieważ Twoja licencja nie obejmuje tych funkcji.",
+    "areaAlerts": "Alerty",
+    "areaAnomalies": "Wykrywanie anomalii",
+    "areaIncidents": "Incydenty",
+    "areaServices": "Usługi",
     "notMonitoredTitle": "Nic nie jest jeszcze monitorowane",
     "notMonitoredDesc": "Twoje dane docierają, ale nie działa na nich żaden alert ani kontrola anomalii. Dodaj go, a Przegląd będzie wyświetlać wszystko, co wymaga uwagi.",
     "notMonitoredAlert": "Utwórz alert",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Uruchomić ponownie kolektory ({count})?",
       "restartMessage": "Każdy kolektor uruchomi się ponownie po następnej wiadomości z serwera. Zbieranie danych na każdym hoście na chwilę się wstrzyma.",
       "restartQueued": "Zażądano restartu kolektora: {count} | Zażądano restartu kolektorów: {count}",
+      "restartOffline": "Ten kolektor jest offline. Uruchom go ponownie, gdy znów będzie dostępny.",
       "restartUnsupported": "Ten kolektor nie przyjmuje poleceń restartu",
       "systemSections": "Sekcje zarządzane przez system",
       "systemSectionsCaption": "Rozszerzenie OpAMP i telemetria usługi, ustawiane przez supervisora i serwer",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Otwiera edytor {config}. Opublikuj poprawioną wersję i ustaw ją dla tej floty; to wdrożenie zostanie wtedy zastąpione.",
       "confirmResume": "To samo wdrożenie jest kontynuowane od fazy {n}.",
       "confirmRollback": "Uruchamia natychmiastowe wdrożenie z powrotem do wersji stabilnej, {config} v{version}. Kolektory, które już ją mają, nic nie otrzymają.",
-      "confirmRollbackNoStable": "Uruchamia natychmiastowe wdrożenie z powrotem do wersji stabilnej.",
+      "confirmRollbackNoStable": "Ta flota nie ma stabilnej wersji, więc wdrożenie kończy się, a jej kolektory przestają zbierać dane, dopóki nie wdrożysz ponownie.",
       "confirmSkip": "Wyklucza kolektor z błędem ({count}) i kontynuuje. Zostaje oznaczony jako wykluczony i ponownie uwzględniony w następnym wdrożeniu. | Wyklucza kolektory z błędami ({count}) i kontynuuje. Zostają oznaczone jako wykluczone i ponownie uwzględnione w następnym wdrożeniu.",
       "confirmed": "Potwierdzono",
       "eventConverged": "Faza {n} osiągnęła stan docelowy",
@@ -29321,6 +29358,7 @@
       "phaseN": "Faza {n}",
       "phaseTimedOut": "Przekroczono czas",
       "phaseTimeoutNote": "Faza, która nie potwierdzi ani nie odrzuci w ciągu {minutes} min, wstrzymuje wdrożenie (ustawienie floty)",
+      "phaseTimeoutNoteSeconds": "Faza, która w ciągu {minutes} min {seconds} s ani nie potwierdzi, ani nie odrzuci, wstrzymuje wdrożenie (ustawienie floty)",
       "phaseVerifying": "Weryfikacja",
       "phases": "Fazy",
       "planEmpty": "Żaden kolektor nie jest online, więc wdrożenie poczeka, aż któryś się połączy",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Dziedzicz ({value})",
       "offlineHeartbeats": "Offline po pominiętych heartbeatach",
       "offlineHeartbeatsHelp": "Kolektor jest offline po tylu interwałach heartbeatu bez wiadomości",
-      "offlineRatio": "Zdarzenie odsetka offline (%)",
-      "offlineRatioHelp": "Zapisuje zdarzenie floty, gdy więcej niż ten odsetek kolektorów jest offline",
+      "offlineRatio": "Udział offline (%)",
+      "offlineRatioHelp": "Wstrzymuje fazę, gdy odsetek jej kolektorów offline przekroczy tę wartość",
       "outOfRange": "Wpisz liczbę od {min} do {max}",
       "phaseTimeout": "Limit czasu fazy (sekundy)",
       "phaseTimeoutHelp": "Faza wdrożenia, która nie potwierdzi ani nie odrzuci w tym czasie, zostaje wstrzymana",
diff --git a/web/src/locales/languages/pt-PT.json b/web/src/locales/languages/pt-PT.json
index 133c3c19d6..aa594eae68 100644
--- a/web/src/locales/languages/pt-PT.json
+++ b/web/src/locales/languages/pt-PT.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Não incluído na sua licença",
+    "title": "{feature} não está incluído na sua licença",
+    "description": "O seu administrador pode adicioná-lo atualizando a licença, ou contacte a equipa de vendas para obter uma licença que o inclua.",
+    "thisFeature": "Esta funcionalidade",
+    "contactSales": "Contactar vendas",
+    "toastTitle": "Não incluído na sua licença",
+    "toastMessage": "A sua licença não inclui: {features}. Peça ao seu administrador para atualizar a licença.",
+    "toastMessageGeneric": "A sua licença não inclui esta funcionalidade. Peça ao seu administrador para atualizar a licença.",
+    "bannerMessage": "Esta funcionalidade está bloqueada. Necessita da funcionalidade {feature} na sua licença.",
+    "bannerMessageGeneric": "Esta página necessita de uma funcionalidade que não está na sua licença.",
+    "headerLocked": "Bloqueado: necessita de {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Sem histórico ainda",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Intervalo de datas copiado",
     "dateRangePasted": "Intervalo de datas colado",
     "dateRangePasteError": "Não foi possível analisar o intervalo de datas",
+    "dateRangePasteEmpty": "A área de transferência está vazia. Copie primeiro um intervalo de datas.",
     "dateRangePasteBlocked": "Este navegador bloqueou a leitura da área de transferência. Prima {shortcut} com o seletor aberto para colar.",
     "pastSecond": "Último {count} segundo | Últimos {count} segundos",
     "pastMinute": "Último {count} minuto | Últimos {count} minutos",
@@ -3406,6 +3420,22 @@
     "contact_name": "Nome do contacto",
     "contact_email": "E-mail de contacto",
     "environment_type": "Tipo de ambiente",
+    "features": "Funcionalidades",
+    "features_all_unlocked": "A sua licença desbloqueia todas as funcionalidades.",
+    "features_summary": "A sua licença desbloqueia {ratio}. {free} funcionalidade gratuita está sempre incluída. | A sua licença desbloqueia {ratio}. {free} funcionalidades gratuitas estão sempre incluídas.",
+    "features_paid_ratio": "{unlocked} de {paid} funcionalidade paga | {unlocked} de {paid} funcionalidades pagas",
+    "features_unlocked": "Desbloqueado",
+    "features_missing": "Não incluído na sua licença",
+    "features_request_access": "Pedir acesso",
+    "features_search": "Pesquisar {count} funcionalidade | Pesquisar todas as {count} funcionalidades",
+    "features_filter_all": "Todas",
+    "features_filter_free": "Gratuita",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Nenhuma funcionalidade corresponde à sua pesquisa",
+    "features_none": "Nenhuma funcionalidade neste grupo",
+    "features_free_heading": "Gratuita, incluída em todas as licenças",
+    "features_new": "Novas após a sua licença",
+    "features_filter_new": "Novas",
     "request_new_license": "Solicitar nova licença",
     "add_new_license_key": "Adicionar nova chave de licença",
     "refresh_license_limits": "Atualizar limites de licença",
@@ -9901,6 +9931,12 @@
     "allClear": "Tudo em ordem",
     "allClearDesc": "Sem anomalias ativas, incidentes ou serviços degradados na janela de tempo selecionada. A sua infraestrutura parece estar em bom estado.",
     "allClearDescScoped": "Nenhum incidente aberto, anomalia ou serviço degradado no intervalo de tempo selecionado.",
+    "allClearPartial": "Nada a assinalar",
+    "allClearPartialDesc": "Nada requer atenção. Não verificámos {areas}, porque a sua licença não inclui essas funcionalidades.",
+    "areaAlerts": "Alertas",
+    "areaAnomalies": "Deteção de anomalias",
+    "areaIncidents": "Incidentes",
+    "areaServices": "Serviços",
     "notMonitoredTitle": "Ainda nada está a ser monitorizado",
     "notMonitoredDesc": "Os seus dados estão a chegar, mas nenhum alerta ou verificação de anomalia é executado sobre eles. Adicione um e a Visão geral listará tudo o que precisa de atenção.",
     "notMonitoredAlert": "Criar um alerta",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Reiniciar {count} coletores?",
       "restartMessage": "Cada coletor reinicia na próxima mensagem do servidor. A recolha de dados pára brevemente em cada anfitrião.",
       "restartQueued": "Reinício solicitado para {count} coletor | Reinício solicitado para {count} coletores",
+      "restartOffline": "Este coletor está offline. Reinicie-o quando voltar a estar online.",
       "restartUnsupported": "Este coletor não aceita comandos de reinício",
       "systemSections": "Secções geridas pelo sistema",
       "systemSectionsCaption": "Extensão OpAMP e telemetria do serviço, definidas pelo supervisor e pelo servidor",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Abre o editor de {config}. Publique uma versão corrigida e mude esta frota para ela; esta implementação fica então substituída.",
       "confirmResume": "A mesma implementação continua a partir da fase {n}.",
       "confirmRollback": "Inicia de imediato uma implementação de regresso à versão estável, {config} v{version}. Os coletores que já a têm não recebem nada.",
-      "confirmRollbackNoStable": "Inicia de imediato uma implementação de regresso à versão estável.",
+      "confirmRollbackNoStable": "Esta frota não tem uma versão estável, pelo que a implementação termina e os seus coletores deixam de recolher até implementar novamente.",
       "confirmSkip": "Exclui {count} coletor com falhas e continua. Fica marcado como excluído e é incluído novamente na próxima implementação. | Exclui {count} coletores com falhas e continua. Ficam marcados como excluídos e são incluídos novamente na próxima implementação.",
       "confirmed": "Confirmado",
       "eventConverged": "Fase {n} convergiu",
@@ -29321,6 +29358,7 @@
       "phaseN": "Fase {n}",
       "phaseTimedOut": "Tempo limite excedido",
       "phaseTimeoutNote": "Uma fase que não confirma nem rejeita em {minutes} min interrompe a implementação (definição da frota)",
+      "phaseTimeoutNoteSeconds": "Uma fase que não confirme nem rejeite dentro de {minutes} min {seconds} s interrompe a implementação (definição da frota)",
       "phaseVerifying": "A verificar",
       "phases": "Fases",
       "planEmpty": "Nenhum coletor está online, pelo que a implementação aguarda até um se ligar",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Herdar ({value})",
       "offlineHeartbeats": "Offline após heartbeats em falta",
       "offlineHeartbeatsHelp": "Um coletor fica offline após este número de intervalos de heartbeat sem mensagem",
-      "offlineRatio": "Evento de proporção offline (%)",
-      "offlineRatioHelp": "Regista um evento da frota quando mais do que esta proporção de coletores está offline",
+      "offlineRatio": "Proporção offline (%)",
+      "offlineRatioHelp": "Interrompe a fase quando mais do que esta proporção dos seus coletores está offline",
       "outOfRange": "Introduza um número de {min} a {max}",
       "phaseTimeout": "Tempo limite da fase (segundos)",
       "phaseTimeoutHelp": "Uma fase da implementação que não confirma nem rejeita neste tempo é interrompida",
diff --git a/web/src/locales/languages/ru-RU.json b/web/src/locales/languages/ru-RU.json
index 968e049587..5309cc73fd 100644
--- a/web/src/locales/languages/ru-RU.json
+++ b/web/src/locales/languages/ru-RU.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Нет в вашей лицензии",
+    "title": "{feature} не входит в вашу лицензию",
+    "description": "Ваш администратор может добавить её, обновив лицензию, или свяжитесь с отделом продаж, чтобы получить лицензию, включающую её.",
+    "thisFeature": "Эта функция",
+    "contactSales": "Связаться с отделом продаж",
+    "toastTitle": "Не входит в вашу лицензию",
+    "toastMessage": "Ваша лицензия не включает: {features}. Попросите администратора обновить лицензию.",
+    "toastMessageGeneric": "Ваша лицензия не включает эту функцию. Попросите администратора обновить лицензию.",
+    "bannerMessage": "Эта функция заблокирована. Для неё нужна функция {feature} в вашей лицензии.",
+    "bannerMessageGeneric": "Для этой страницы нужна функция, которой нет в вашей лицензии.",
+    "headerLocked": "Заблокировано: нужна {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Истории пока нет",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Диапазон дат скопирован",
     "dateRangePasted": "Диапазон дат вставлен",
     "dateRangePasteError": "Не удалось разобрать диапазон дат",
+    "dateRangePasteEmpty": "Буфер обмена пуст. Сначала скопируйте диапазон дат.",
     "dateRangePasteBlocked": "Этот браузер заблокировал чтение буфера обмена. Нажмите {shortcut} при открытом средстве выбора, чтобы вставить.",
     "pastSecond": "Последняя {count} секунда | Последние {count} с",
     "pastMinute": "Последняя {count} минута | Последние {count} мин",
@@ -3406,6 +3420,22 @@
     "contact_name": "Контактное лицо",
     "contact_email": "Контактный email",
     "environment_type": "Тип среды",
+    "features": "Функции",
+    "features_all_unlocked": "Ваша лицензия открывает все функции.",
+    "features_summary": "Ваша лицензия открывает {ratio}. {free} бесплатная функция всегда включена. | Ваша лицензия открывает {ratio}. {free} бесплатных функций всегда включены.",
+    "features_paid_ratio": "{unlocked} из {paid} платной функции | {unlocked} из {paid} платных функций",
+    "features_unlocked": "Открыто",
+    "features_missing": "Нет в вашей лицензии",
+    "features_request_access": "Запросить доступ",
+    "features_search": "Поиск по {count} функции | Поиск по всем {count} функциям",
+    "features_filter_all": "Все",
+    "features_filter_free": "Бесплатные",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Нет функций, соответствующих поиску",
+    "features_none": "В этой группе нет функций",
+    "features_free_heading": "Бесплатные, входят в каждую лицензию",
+    "features_new": "Новые после вашей лицензии",
+    "features_filter_new": "Новые",
     "request_new_license": "Запросить новую лицензию",
     "add_new_license_key": "Добавить новый ключ лицензии",
     "refresh_license_limits": "Обновить лимиты лицензии",
@@ -9901,6 +9931,12 @@
     "allClear": "Все системы в порядке",
     "allClearDesc": "Нет активных аномалий, инцидентов или деградировавших сервисов в выбранном временном окне. Ваша инфраструктура выглядит здоровой.",
     "allClearDescScoped": "Нет открытых инцидентов, аномалий или деградировавших сервисов в выбранном временном диапазоне.",
+    "allClearPartial": "Сообщать нечего",
+    "allClearPartialDesc": "Ничего не требует внимания. Мы не проверяли {areas}, так как ваша лицензия не включает эти функции.",
+    "areaAlerts": "Оповещения",
+    "areaAnomalies": "Обнаружение аномалий",
+    "areaIncidents": "Инциденты",
+    "areaServices": "Сервисы",
     "notMonitoredTitle": "Пока ничего не отслеживается",
     "notMonitoredDesc": "Ваши данные поступают, но для них не выполняется ни оповещение, ни проверка аномалий. Добавьте одно из них, и Обзор покажет всё, что требует внимания.",
     "notMonitoredAlert": "Создать оповещение",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Перезапустить коллекторы ({count})?",
       "restartMessage": "Каждый коллектор перезапустится при следующем сообщении от сервера. Сбор данных на каждом хосте ненадолго приостановится.",
       "restartQueued": "Запрошен перезапуск {count} коллектора | Запрошен перезапуск коллекторов: {count}",
+      "restartOffline": "Этот коллектор офлайн. Перезапустите его, когда он снова будет в сети.",
       "restartUnsupported": "Этот коллектор не принимает команды перезапуска",
       "systemSections": "Разделы, управляемые системой",
       "systemSectionsCaption": "Расширение OpAMP и телеметрия сервиса, задаются supervisor и сервером",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Открывает редактор {config}. Опубликуйте исправленную версию и переведите на неё этот парк; тогда это развертывание будет заменено.",
       "confirmResume": "То же развертывание продолжится с этапа {n}.",
       "confirmRollback": "Немедленно запускает откат на стабильную версию, {config} v{version}. Коллекторы, уже работающие на ней, ничего не получат.",
-      "confirmRollbackNoStable": "Немедленно запускает откат на стабильную версию.",
+      "confirmRollbackNoStable": "В этом парке нет стабильной версии, поэтому раскатка завершится, а её коллекторы перестанут собирать данные, пока вы снова не выполните развёртывание.",
       "confirmSkip": "Исключает {count} сбойный коллектор и продолжает. Он помечается как исключённый и снова включается в следующее развертывание. | Исключает сбойные коллекторы ({count}) и продолжает. Они помечаются как исключённые и снова включаются в следующее развертывание.",
       "confirmed": "Подтверждено",
       "eventConverged": "Этап {n} завершён",
@@ -29321,6 +29358,7 @@
       "phaseN": "Этап {n}",
       "phaseTimedOut": "Время истекло",
       "phaseTimeoutNote": "Этап, который не подтверждается и не отклоняется за {minutes} мин, останавливает развертывание (настройка парка)",
+      "phaseTimeoutNoteSeconds": "Фаза, которая не подтверждается и не отклоняется в течение {minutes} мин {seconds} с, останавливает раскатку (настройка парка)",
       "phaseVerifying": "Проверка",
       "phases": "Этапы",
       "planEmpty": "Ни один коллектор не в сети, поэтому развёртывание ждёт, пока не подключится хотя бы один.",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Наследовать ({value})",
       "offlineHeartbeats": "Не в сети после пропущенных heartbeat",
       "offlineHeartbeatsHelp": "Коллектор считается не в сети, если сообщений нет столько интервалов heartbeat",
-      "offlineRatio": "Событие доли «не в сети» (%)",
-      "offlineRatioHelp": "Записывает событие парка, когда не в сети более этой доли коллекторов",
+      "offlineRatio": "Доля не в сети (%)",
+      "offlineRatioHelp": "Останавливает фазу, если больше этой доли её коллекторов не в сети",
       "outOfRange": "Введите число от {min} до {max}",
       "phaseTimeout": "Тайм-аут этапа (секунды)",
       "phaseTimeoutHelp": "Этап развертывания, который не подтверждается и не отклоняется за это время, останавливается",
diff --git a/web/src/locales/languages/th-TH.json b/web/src/locales/languages/th-TH.json
index 2ef609f778..fbd7dec4ab 100644
--- a/web/src/locales/languages/th-TH.json
+++ b/web/src/locales/languages/th-TH.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "ไม่มีในสิทธิ์การใช้งานของคุณ",
+    "title": "{feature} ไม่ได้รวมอยู่ในสิทธิ์การใช้งานของคุณ",
+    "description": "ผู้ดูแลระบบของคุณสามารถเพิ่มได้โดยอัปเดตสิทธิ์การใช้งาน หรือติดต่อฝ่ายขายเพื่อขอสิทธิ์การใช้งานที่รวมฟีเจอร์นี้",
+    "thisFeature": "ฟีเจอร์นี้",
+    "contactSales": "ติดต่อฝ่ายขาย",
+    "toastTitle": "ไม่รวมอยู่ในสิทธิ์การใช้งานของคุณ",
+    "toastMessage": "สิทธิ์การใช้งานของคุณไม่รวม: {features} โปรดขอให้ผู้ดูแลระบบอัปเดตสิทธิ์การใช้งาน",
+    "toastMessageGeneric": "สิทธิ์การใช้งานของคุณไม่รวมฟีเจอร์นี้ โปรดขอให้ผู้ดูแลระบบอัปเดตสิทธิ์การใช้งาน",
+    "bannerMessage": "ฟีเจอร์นี้ถูกล็อก ต้องมีฟีเจอร์ {feature} ในสิทธิ์การใช้งานของคุณ",
+    "bannerMessageGeneric": "หน้านี้ต้องใช้ฟีเจอร์ที่ไม่มีในสิทธิ์การใช้งานของคุณ",
+    "headerLocked": "ล็อกอยู่: ต้องมี {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "No history yet",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Date range copied",
     "dateRangePasted": "Date range pasted",
     "dateRangePasteError": "Could not parse date range",
+    "dateRangePasteEmpty": "คลิปบอร์ดว่างเปล่า โปรดคัดลอกช่วงวันที่ก่อน",
     "dateRangePasteBlocked": "This browser blocked reading the clipboard. Press {shortcut} with the picker open to paste.",
     "pastSecond": "Past {count} Second | Past {count} Seconds",
     "pastMinute": "Past {count} Minute | Past {count} Minutes",
@@ -3406,6 +3420,22 @@
     "contact_name": "Contact Name",
     "contact_email": "Contact Email",
     "environment_type": "Environment Type",
+    "features": "ฟีเจอร์",
+    "features_all_unlocked": "สิทธิ์การใช้งานของคุณปลดล็อกฟีเจอร์ทั้งหมด",
+    "features_summary": "สิทธิ์การใช้งานของคุณปลดล็อก {ratio} ฟีเจอร์ฟรี {free} รายการถูกรวมไว้เสมอ | สิทธิ์การใช้งานของคุณปลดล็อก {ratio} ฟีเจอร์ฟรี {free} รายการถูกรวมไว้เสมอ",
+    "features_paid_ratio": "{unlocked} จาก {paid} ฟีเจอร์แบบชำระเงิน | {unlocked} จาก {paid} ฟีเจอร์แบบชำระเงิน",
+    "features_unlocked": "ปลดล็อกแล้ว",
+    "features_missing": "ไม่มีในสิทธิ์การใช้งานของคุณ",
+    "features_request_access": "ขอสิทธิ์การเข้าถึง",
+    "features_search": "ค้นหา {count} ฟีเจอร์ | ค้นหาฟีเจอร์ทั้งหมด {count} รายการ",
+    "features_filter_all": "ทั้งหมด",
+    "features_filter_free": "ฟรี",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "ไม่มีฟีเจอร์ที่ตรงกับการค้นหาของคุณ",
+    "features_none": "ไม่มีฟีเจอร์ในกลุ่มนี้",
+    "features_free_heading": "ฟรี รวมอยู่ในทุกสิทธิ์การใช้งาน",
+    "features_new": "ใหม่หลังจากสิทธิ์การใช้งานของคุณ",
+    "features_filter_new": "ใหม่",
     "request_new_license": "Request new License",
     "add_new_license_key": "Add New License Key",
     "refresh_license_limits": "Refresh License Limits",
@@ -9899,6 +9929,12 @@
     "allClear": "All systems clear",
     "allClearDesc": "No active anomalies, incidents, or degraded services in the selected time window. Your infrastructure looks healthy.",
     "allClearDescScoped": "No open incidents, anomalies or degraded services in the selected time range.",
+    "allClearPartial": "ไม่มีอะไรต้องรายงาน",
+    "allClearPartialDesc": "ไม่มีอะไรต้องดูแล เราไม่ได้ตรวจสอบ{areas} เนื่องจากไลเซนส์ของคุณไม่รวมฟีเจอร์เหล่านั้น",
+    "areaAlerts": "การแจ้งเตือน",
+    "areaAnomalies": "การตรวจจับความผิดปกติ",
+    "areaIncidents": "เหตุการณ์ขัดข้อง",
+    "areaServices": "บริการ",
     "notMonitoredTitle": "Nothing is watched yet",
     "notMonitoredDesc": "Your data is arriving, but no alert or anomaly check runs on it. Add one and Overview lists anything that needs attention.",
     "notMonitoredAlert": "Create an alert",
@@ -29154,6 +29190,7 @@
       "restartManyTitle": "Restart {count} collectors?",
       "restartMessage": "Each collector restarts on its next message from the server. Data collection pauses briefly on each host.",
       "restartQueued": "Restart requested for {count} collector | Restart requested for {count} collectors",
+      "restartOffline": "คอลเลกเตอร์นี้อยู่ในสถานะออฟไลน์ ให้รีสตาร์ตเมื่อกลับมาออนไลน์อีกครั้ง",
       "restartUnsupported": "This collector does not accept restart commands",
       "systemSections": "System-managed sections",
       "systemSectionsCaption": "OpAMP extension and service telemetry, set by the supervisor and the server",
@@ -29282,7 +29319,7 @@
       "confirmFixForward": "Opens the {config} editor. Publish a fixed version and change this fleet to it; this rollout is then superseded.",
       "confirmResume": "The same rollout continues from phase {n}.",
       "confirmRollback": "Starts an immediate rollout back to the stable version, {config} v{version}. Collectors already on it receive nothing.",
-      "confirmRollbackNoStable": "Starts an immediate rollout back to the stable version.",
+      "confirmRollbackNoStable": "กลุ่มเครื่องนี้ไม่มีเวอร์ชันที่เสถียร การทยอยปรับใช้จึงสิ้นสุดลง และคอลเลกเตอร์จะหยุดเก็บข้อมูลจนกว่าคุณจะปรับใช้ใหม่",
       "confirmSkip": "Excludes {count} failing collector and continues. It is marked excluded and included again in the next rollout. | Excludes {count} failing collectors and continues. They are marked excluded and included again in the next rollout.",
       "confirmed": "Confirmed",
       "eventConverged": "Phase {n} converged",
@@ -29319,6 +29356,7 @@
       "phaseN": "Phase {n}",
       "phaseTimedOut": "Timed out",
       "phaseTimeoutNote": "A phase that neither confirms nor rejects within {minutes} min halts the rollout (fleet setting)",
+      "phaseTimeoutNoteSeconds": "เฟสที่ไม่ยืนยันหรือปฏิเสธภายใน {minutes} นาที {seconds} วินาที จะทำให้การทยอยปรับใช้หยุดลง (การตั้งค่ากลุ่มเครื่อง)",
       "phaseVerifying": "Verifying",
       "phases": "Phases",
       "planEmpty": "ไม่มีคอลเลกเตอร์ออนไลน์ ดังนั้นการทยอยติดตั้งจะรอจนกว่าจะมีตัวหนึ่งเชื่อมต่อ",
@@ -29459,8 +29497,8 @@
       "inheritPlaceholder": "Inherit ({value})",
       "offlineHeartbeats": "Offline after missed heartbeats",
       "offlineHeartbeatsHelp": "A collector is offline after this many heartbeat intervals without a message",
-      "offlineRatio": "Offline-ratio event (%)",
-      "offlineRatioHelp": "Records a fleet event when more than this share of collectors is offline",
+      "offlineRatio": "สัดส่วนออฟไลน์ (%)",
+      "offlineRatioHelp": "หยุดเฟสเมื่อมีคอลเลกเตอร์ออฟไลน์เกินสัดส่วนนี้",
       "outOfRange": "Enter a number from {min} to {max}",
       "phaseTimeout": "Phase timeout (seconds)",
       "phaseTimeoutHelp": "A rollout phase that neither confirms nor rejects in this time halts",
diff --git a/web/src/locales/languages/tr-TR.json b/web/src/locales/languages/tr-TR.json
index a9f47608f5..cc03e40daf 100644
--- a/web/src/locales/languages/tr-TR.json
+++ b/web/src/locales/languages/tr-TR.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Lisansınızda yok",
+    "title": "{feature} lisansınıza dahil değil",
+    "description": "Yöneticiniz lisansı güncelleyerek bunu ekleyebilir veya bunu içeren bir lisans almak için satış ekibiyle iletişime geçebilir.",
+    "thisFeature": "Bu özellik",
+    "contactSales": "Satış ekibiyle iletişime geçin",
+    "toastTitle": "Lisansınıza dahil değil",
+    "toastMessage": "Lisansınız şunları içermiyor: {features}. Yöneticinizden lisansı güncellemesini isteyin.",
+    "toastMessageGeneric": "Lisansınız bu özelliği içermiyor. Yöneticinizden lisansı güncellemesini isteyin.",
+    "bannerMessage": "Bu özellik kilitli. Lisansınızda {feature} özelliği gerekiyor.",
+    "bannerMessageGeneric": "Bu sayfa lisansınızda olmayan bir özellik gerektiriyor.",
+    "headerLocked": "Kilitli: {feature} gerekiyor"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Henüz geçmiş yok",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Tarih aralığı kopyalandı",
     "dateRangePasted": "Tarih aralığı yapıştırıldı",
     "dateRangePasteError": "Tarih aralığı ayrıştırılamadı",
+    "dateRangePasteEmpty": "Pano boş. Önce bir tarih aralığı kopyalayın.",
     "dateRangePasteBlocked": "Bu tarayıcı panoyu okumayı engelledi. Yapıştırmak için seçici açıkken {shortcut} tuşlarına basın.",
     "pastSecond": "Son {count} Saniye | Son {count} Saniye",
     "pastMinute": "Son {count} Dakika | Son {count} Dakika",
@@ -3406,6 +3420,22 @@
     "contact_name": "İletişim Adı",
     "contact_email": "İletişim E-posta",
     "environment_type": "Ortam Türü",
+    "features": "Özellikler",
+    "features_all_unlocked": "Lisansınız tüm özelliklerin kilidini açar.",
+    "features_summary": "Lisansınız {ratio} kısmının kilidini açar. {free} ücretsiz özellik her zaman dahildir. | Lisansınız {ratio} kısmının kilidini açar. {free} ücretsiz özellik her zaman dahildir.",
+    "features_paid_ratio": "{paid} ücretli özellikten {unlocked} tanesi | {paid} ücretli özellikten {unlocked} tanesi",
+    "features_unlocked": "Kilidi açık",
+    "features_missing": "Lisansınızda yok",
+    "features_request_access": "Erişim Talep Et",
+    "features_search": "{count} özellikte ara | Tüm {count} özellikte ara",
+    "features_filter_all": "Tümü",
+    "features_filter_free": "Ücretsiz",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Aramanızla eşleşen özellik yok",
+    "features_none": "Bu grupta özellik yok",
+    "features_free_heading": "Ücretsiz, her lisansa dahildir",
+    "features_new": "Lisansınızdan sonra eklenen",
+    "features_filter_new": "Yeni",
     "request_new_license": "Yeni Lisans isteyin",
     "add_new_license_key": "Yeni Lisans Anahtarı Ekle",
     "refresh_license_limits": "Lisans Sınırlarını Yenile",
@@ -9901,6 +9931,12 @@
     "allClear": "Hepsi temiz",
     "allClearDesc": "Seçilen zaman aralığında etkin anomali, vaka veya performansı düşmüş hizmet yok. Altyapınız sağlıklı görünüyor.",
     "allClearDescScoped": "Seçilen zaman aralığında açık vaka, anomali veya performansı düşmüş hizmet yok.",
+    "allClearPartial": "Rapor edilecek bir şey yok",
+    "allClearPartialDesc": "İlgi gerektiren bir durum yok. Lisansınız bu özellikleri içermediği için {areas} kontrol edilmedi.",
+    "areaAlerts": "Uyarılar",
+    "areaAnomalies": "Anomali tespiti",
+    "areaIncidents": "Vakalar",
+    "areaServices": "Hizmetler",
     "notMonitoredTitle": "Henüz hiçbir şey izlenmiyor",
     "notMonitoredDesc": "Verileriniz geliyor, ancak üzerinde hiçbir uyarı veya anomali kontrolü çalışmıyor. Bir tane ekleyin; Genel Bakış dikkat gerektiren her şeyi listeler.",
     "notMonitoredAlert": "Uyarı oluştur",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "{count} toplayıcı yeniden başlatılsın mı?",
       "restartMessage": "Her toplayıcı, sunucudan gelen bir sonraki mesajda yeniden başlar. Veri toplama her ana bilgisayarda kısa süre duraklar.",
       "restartQueued": "{count} toplayıcı için yeniden başlatma istendi | {count} toplayıcı için yeniden başlatma istendi",
+      "restartOffline": "Bu toplayıcı çevrimdışı. Geri geldiğinde yeniden başlatın.",
       "restartUnsupported": "Bu toplayıcı yeniden başlatma komutlarını kabul etmiyor",
       "systemSections": "Sistem tarafından yönetilen bölümler",
       "systemSectionsCaption": "OpAMP uzantısı ve hizmet telemetrisi; supervisor ve sunucu tarafından ayarlanır",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "{config} düzenleyicisini açar. Düzeltilmiş bir sürüm yayınlayın ve bu filoyu ona geçirin; bu dağıtımın yerini o alır.",
       "confirmResume": "Aynı dağıtım {n}. aşamadan devam eder.",
       "confirmRollback": "Kararlı sürüme, {config} v{version}, hemen geri dönen bir dağıtım başlatır. Zaten bu sürümde olan toplayıcılara hiçbir şey gönderilmez.",
-      "confirmRollbackNoStable": "Kararlı sürüme hemen geri dönen bir dağıtım başlatır.",
+      "confirmRollbackNoStable": "Bu filonun kararlı bir sürümü yok; bu nedenle dağıtım sona erer ve siz yeniden dağıtım yapana kadar toplayıcıları veri toplamayı durdurur.",
       "confirmSkip": "Başarısız olan {count} toplayıcıyı hariç tutar ve devam eder. Hariç tutuldu olarak işaretlenir ve bir sonraki dağıtıma yeniden dahil edilir. | Başarısız olan {count} toplayıcıyı hariç tutar ve devam eder. Hariç tutuldu olarak işaretlenirler ve bir sonraki dağıtıma yeniden dahil edilirler.",
       "confirmed": "Onaylandı",
       "eventConverged": "{n}. aşama yakınsadı",
@@ -29321,6 +29358,7 @@
       "phaseN": "{n}. aşama",
       "phaseTimedOut": "Zaman aşımı",
       "phaseTimeoutNote": "{minutes} dk içinde ne onaylanan ne de reddedilen bir aşama dağıtımı durdurur (filo ayarı)",
+      "phaseTimeoutNoteSeconds": "{minutes} dk {seconds} sn içinde ne onaylanan ne de reddedilen bir aşama dağıtımı durdurur (filo ayarı)",
       "phaseVerifying": "Doğrulanıyor",
       "phases": "Aşamalar",
       "planEmpty": "Hiçbir toplayıcı çevrimiçi değil, bu nedenle dağıtım bir toplayıcı bağlanana kadar bekler",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Devral ({value})",
       "offlineHeartbeats": "Kaçırılan kalp atışından sonra çevrimdışı",
       "offlineHeartbeatsHelp": "Bir toplayıcı, bu kadar kalp atışı aralığı boyunca mesaj göndermezse çevrimdışı sayılır",
-      "offlineRatio": "Çevrimdışı oranı olayı (%)",
-      "offlineRatioHelp": "Toplayıcıların bu orandan fazlası çevrimdışı olduğunda bir filo olayı kaydeder",
+      "offlineRatio": "Çevrimdışı oranı (%)",
+      "offlineRatioHelp": "Toplayıcılarının bu orandan daha fazlası çevrimdışı olduğunda aşamayı durdurur",
       "outOfRange": "{min} ile {max} arasında bir sayı girin",
       "phaseTimeout": "Aşama zaman aşımı (saniye)",
       "phaseTimeoutHelp": "Bu süre içinde ne onaylanan ne de reddedilen bir dağıtım aşaması durdurulur",
diff --git a/web/src/locales/languages/vi-VN.json b/web/src/locales/languages/vi-VN.json
index 569d6ddf10..27fb41538b 100644
--- a/web/src/locales/languages/vi-VN.json
+++ b/web/src/locales/languages/vi-VN.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "Không có trong giấy phép của bạn",
+    "title": "{feature} không có trong giấy phép của bạn",
+    "description": "Quản trị viên của bạn có thể thêm bằng cách cập nhật giấy phép, hoặc liên hệ bộ phận kinh doanh để nhận giấy phép có bao gồm tính năng này.",
+    "thisFeature": "Tính năng này",
+    "contactSales": "Liên hệ kinh doanh",
+    "toastTitle": "Không có trong giấy phép của bạn",
+    "toastMessage": "Giấy phép của bạn không bao gồm: {features}. Hãy yêu cầu quản trị viên cập nhật giấy phép.",
+    "toastMessageGeneric": "Giấy phép của bạn không bao gồm tính năng này. Hãy yêu cầu quản trị viên cập nhật giấy phép.",
+    "bannerMessage": "Tính năng này bị khóa. Cần có tính năng {feature} trong giấy phép của bạn.",
+    "bannerMessageGeneric": "Trang này cần một tính năng không có trong giấy phép của bạn.",
+    "headerLocked": "Đã khóa: cần {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "Chưa có lịch sử",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "Đã sao chép khoảng thời gian",
     "dateRangePasted": "Đã dán khoảng thời gian",
     "dateRangePasteError": "Không thể phân tích khoảng thời gian",
+    "dateRangePasteEmpty": "Bộ nhớ tạm trống. Hãy sao chép khoảng thời gian trước.",
     "dateRangePasteBlocked": "Trình duyệt này đã chặn việc đọc clipboard. Nhấn {shortcut} khi trình chọn đang mở để dán.",
     "pastSecond": "Trong {count} giây qua | Trong {count} giây qua",
     "pastMinute": "Trong {count} phút qua | Trong {count} phút qua",
@@ -3406,6 +3420,22 @@
     "contact_name": "Tên liên hệ",
     "contact_email": "Email liên hệ",
     "environment_type": "Loại môi trường",
+    "features": "Tính năng",
+    "features_all_unlocked": "Giấy phép của bạn mở khóa tất cả tính năng.",
+    "features_summary": "Giấy phép của bạn mở khóa {ratio}. {free} tính năng miễn phí luôn được bao gồm. | Giấy phép của bạn mở khóa {ratio}. {free} tính năng miễn phí luôn được bao gồm.",
+    "features_paid_ratio": "{unlocked} trên {paid} tính năng trả phí | {unlocked} trên {paid} tính năng trả phí",
+    "features_unlocked": "Đã mở khóa",
+    "features_missing": "Không có trong giấy phép của bạn",
+    "features_request_access": "Yêu cầu truy cập",
+    "features_search": "Tìm kiếm {count} tính năng | Tìm kiếm tất cả {count} tính năng",
+    "features_filter_all": "Tất cả",
+    "features_filter_free": "Miễn phí",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "Không có tính năng nào khớp với tìm kiếm của bạn",
+    "features_none": "Không có tính năng nào trong nhóm này",
+    "features_free_heading": "Miễn phí, có trong mọi giấy phép",
+    "features_new": "Mới sau giấy phép của bạn",
+    "features_filter_new": "Mới",
     "request_new_license": "Yêu cầu giấy phép mới",
     "add_new_license_key": "Thêm khóa giấy phép mới",
     "refresh_license_limits": "Làm mới giới hạn giấy phép",
@@ -9901,6 +9931,12 @@
     "allClear": "Tất cả hệ thống ổn định",
     "allClearDesc": "Không có bất thường, sự cố hoặc dịch vụ suy giảm nào đang hoạt động trong khoảng thời gian đã chọn. Cơ sở hạ tầng của bạn có vẻ khỏe mạnh.",
     "allClearDescScoped": "Không có sự cố đang mở, bất thường hoặc dịch vụ bị suy giảm trong khoảng thời gian đã chọn.",
+    "allClearPartial": "Không có gì để báo cáo",
+    "allClearPartialDesc": "Không có gì cần chú ý. Chúng tôi không kiểm tra {areas}, vì giấy phép của bạn không bao gồm các tính năng đó.",
+    "areaAlerts": "Cảnh báo",
+    "areaAnomalies": "Phát hiện bất thường",
+    "areaIncidents": "Sự cố",
+    "areaServices": "Dịch vụ",
     "notMonitoredTitle": "Chưa có gì được theo dõi",
     "notMonitoredDesc": "Dữ liệu của bạn đang đến, nhưng không có cảnh báo hoặc kiểm tra bất thường nào chạy trên đó. Thêm một cái và Tổng quan sẽ liệt kê mọi thứ cần chú ý.",
     "notMonitoredAlert": "Tạo cảnh báo",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "Khởi động lại {count} collector?",
       "restartMessage": "Mỗi collector khởi động lại ở thông điệp kế tiếp từ máy chủ. Việc thu thập dữ liệu tạm dừng ngắn trên mỗi máy chủ.",
       "restartQueued": "Đã yêu cầu khởi động lại {count} collector | Đã yêu cầu khởi động lại {count} collector",
+      "restartOffline": "Collector này đang ngoại tuyến. Hãy khởi động lại khi nó hoạt động trở lại.",
       "restartUnsupported": "Collector này không chấp nhận lệnh khởi động lại",
       "systemSections": "Phần do hệ thống quản lý",
       "systemSectionsCaption": "Tiện ích mở rộng OpAMP và dữ liệu đo từ xa của dịch vụ, do supervisor và máy chủ thiết lập",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "Mở trình chỉnh sửa {config}. Hãy phát hành một phiên bản đã sửa và đổi fleet này sang phiên bản đó; đợt triển khai này khi đó sẽ bị thay thế.",
       "confirmResume": "Cùng đợt triển khai này tiếp tục từ giai đoạn {n}.",
       "confirmRollback": "Bắt đầu ngay một đợt triển khai quay lui về phiên bản ổn định, {config} v{version}. Các collector đã ở phiên bản đó sẽ không nhận gì.",
-      "confirmRollbackNoStable": "Bắt đầu ngay một đợt triển khai quay lui về phiên bản ổn định.",
+      "confirmRollbackNoStable": "Fleet này không có phiên bản ổn định, nên quá trình triển khai kết thúc và các collector của nó ngừng thu thập cho đến khi bạn triển khai lại.",
       "confirmSkip": "Loại trừ {count} collector bị lỗi và tiếp tục. Nó được đánh dấu là bị loại trừ và được đưa vào lại ở đợt triển khai kế tiếp. | Loại trừ {count} collector bị lỗi và tiếp tục. Chúng được đánh dấu là bị loại trừ và được đưa vào lại ở đợt triển khai kế tiếp.",
       "confirmed": "Đã xác nhận",
       "eventConverged": "Giai đoạn {n} đã hội tụ",
@@ -29321,6 +29358,7 @@
       "phaseN": "Giai đoạn {n}",
       "phaseTimedOut": "Hết thời gian chờ",
       "phaseTimeoutNote": "Giai đoạn không xác nhận cũng không từ chối trong vòng {minutes} phút sẽ làm đợt triển khai dừng (cài đặt fleet)",
+      "phaseTimeoutNoteSeconds": "Giai đoạn không xác nhận cũng không từ chối trong {minutes} phút {seconds} giây sẽ tạm dừng quá trình triển khai (cài đặt fleet)",
       "phaseVerifying": "Đang xác minh",
       "phases": "Các giai đoạn",
       "planEmpty": "Không có collector nào trực tuyến, nên đợt triển khai chờ đến khi có một collector kết nối",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "Kế thừa ({value})",
       "offlineHeartbeats": "Ngoại tuyến sau số heartbeat bị lỡ",
       "offlineHeartbeatsHelp": "Collector bị coi là ngoại tuyến sau chừng này chu kỳ heartbeat không có thông điệp",
-      "offlineRatio": "Sự kiện tỷ lệ ngoại tuyến (%)",
-      "offlineRatioHelp": "Ghi lại một sự kiện fleet khi hơn tỷ lệ này số collector ngoại tuyến",
+      "offlineRatio": "Tỷ lệ ngoại tuyến (%)",
+      "offlineRatioHelp": "Tạm dừng giai đoạn khi nhiều hơn tỷ lệ này trong số các collector của giai đoạn đang ngoại tuyến",
       "outOfRange": "Nhập một số từ {min} đến {max}",
       "phaseTimeout": "Thời gian chờ giai đoạn (giây)",
       "phaseTimeoutHelp": "Giai đoạn triển khai không xác nhận cũng không từ chối trong thời gian này sẽ dừng",
diff --git a/web/src/locales/languages/zh-CN.json b/web/src/locales/languages/zh-CN.json
index a6a3ad8d1e..a88968b547 100644
--- a/web/src/locales/languages/zh-CN.json
+++ b/web/src/locales/languages/zh-CN.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "不在您的许可证中",
+    "title": "{feature} 未包含在您的许可证中",
+    "description": "您的管理员可以通过更新许可证来添加它，或联系销售获取包含该功能的许可证。",
+    "thisFeature": "此功能",
+    "contactSales": "联系销售",
+    "toastTitle": "未包含在您的许可证中",
+    "toastMessage": "您的许可证不包含：{features}。请让管理员更新许可证。",
+    "toastMessageGeneric": "您的许可证不包含此功能。请让管理员更新许可证。",
+    "bannerMessage": "此功能已锁定。需要您的许可证包含 {feature} 功能。",
+    "bannerMessageGeneric": "此页面需要一项不在您许可证中的功能。",
+    "headerLocked": "已锁定：需要 {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "暂无历史记录",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "日期范围已复制",
     "dateRangePasted": "日期范围已粘贴",
     "dateRangePasteError": "无法解析日期范围",
+    "dateRangePasteEmpty": "剪贴板为空。请先复制日期范围。",
     "dateRangePasteBlocked": "此浏览器禁止了读取剪贴板。在选取器打开时按 {shortcut} 即可粘贴。",
     "pastSecond": "过去 {count} 秒 | 过去 {count} 秒",
     "pastMinute": "过去 {count} 分钟 | 过去 {count} 分钟",
@@ -3406,6 +3420,22 @@
     "contact_name": "联系人姓名",
     "contact_email": "联系人邮箱",
     "environment_type": "环境类型",
+    "features": "功能",
+    "features_all_unlocked": "您的许可证已解锁所有功能。",
+    "features_summary": "您的许可证解锁了 {ratio}。始终包含 {free} 项免费功能。 | 您的许可证解锁了 {ratio}。始终包含 {free} 项免费功能。",
+    "features_paid_ratio": "已解锁 {unlocked}/{paid} 项付费功能 | 已解锁 {unlocked}/{paid} 项付费功能",
+    "features_unlocked": "已解锁",
+    "features_missing": "不在您的许可证中",
+    "features_request_access": "申请访问权限",
+    "features_search": "搜索 {count} 项功能 | 搜索所有 {count} 项功能",
+    "features_filter_all": "全部",
+    "features_filter_free": "免费",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "没有功能与您的搜索匹配",
+    "features_none": "此组中没有功能",
+    "features_free_heading": "免费，所有许可证均包含",
+    "features_new": "许可证之后新增",
+    "features_filter_new": "新增",
     "request_new_license": "申请新许可证",
     "add_new_license_key": "添加新的许可证密钥",
     "refresh_license_limits": "刷新许可证限制",
@@ -9901,6 +9931,12 @@
     "allClear": "全部清除",
     "allClearDesc": "在所选时间窗口内没有活跃的异常、事件或降级的服务。",
     "allClearDescScoped": "所选时间范围内没有未解决的事件、异常或性能下降的服务。",
+    "allClearPartial": "无可报告内容",
+    "allClearPartialDesc": "没有需要关注的内容。我们未检查 {areas}，因为您的许可证不包含这些功能。",
+    "areaAlerts": "告警",
+    "areaAnomalies": "异常检测",
+    "areaIncidents": "事件",
+    "areaServices": "服务",
     "notMonitoredTitle": "尚无任何被监控项",
     "notMonitoredDesc": "您的数据正在到达，但没有对其运行任何告警或异常检查。添加一个后，概览会列出所有需要关注的内容。",
     "notMonitoredAlert": "创建告警",
@@ -29156,6 +29192,7 @@
       "restartManyTitle": "重启 {count} 个 Collector？",
       "restartMessage": "每个 Collector 将在收到服务器的下一条消息时重启。每台主机上的数据采集会短暂暂停。",
       "restartQueued": "已请求重启 {count} 个 Collector | 已请求重启 {count} 个 Collector",
+      "restartOffline": "此采集器已离线。待其恢复在线后重启。",
       "restartUnsupported": "此 Collector 不接受重启命令",
       "systemSections": "系统管理的部分",
       "systemSectionsCaption": "OpAMP 扩展和服务遥测，由 supervisor 和服务器设置",
@@ -29284,7 +29321,7 @@
       "confirmFixForward": "打开 {config} 编辑器。发布修复后的版本并将此机群切换到该版本；此上线随后将被取代。",
       "confirmResume": "同一上线将从阶段 {n} 继续。",
       "confirmRollback": "立即开始回滚到稳定版本 {config} v{version}。已处于该版本的 Collector 不会收到任何内容。",
-      "confirmRollbackNoStable": "立即开始回滚到稳定版本。",
+      "confirmRollbackNoStable": "此 Fleet 没有稳定版本，因此发布将结束，其采集器将停止采集，直到您再次部署。",
       "confirmSkip": "排除 {count} 个失败的 Collector 并继续。它将被标记为已排除，并在下次上线时重新纳入。 | 排除 {count} 个失败的 Collector 并继续。它们将被标记为已排除，并在下次上线时重新纳入。",
       "confirmed": "已确认",
       "eventConverged": "阶段 {n} 已收敛",
@@ -29321,6 +29358,7 @@
       "phaseN": "阶段 {n}",
       "phaseTimedOut": "已超时",
       "phaseTimeoutNote": "阶段在 {minutes} 分钟内既未确认也未拒绝时，上线将暂停（机群设置）",
+      "phaseTimeoutNoteSeconds": "若某个阶段在 {minutes} 分 {seconds} 秒内既未确认也未拒绝，则暂停发布（Fleet 设置）",
       "phaseVerifying": "验证中",
       "phases": "阶段",
       "planEmpty": "没有采集器在线，因此发布需等到有采集器连接后才继续",
@@ -29461,8 +29499,8 @@
       "inheritPlaceholder": "继承（{value}）",
       "offlineHeartbeats": "错过心跳后离线",
       "offlineHeartbeatsHelp": "Collector 在这么多个心跳间隔内没有消息即视为离线",
-      "offlineRatio": "离线占比事件（%）",
-      "offlineRatioHelp": "当离线 Collector 的占比超过此值时记录机群事件",
+      "offlineRatio": "离线比例 (%)",
+      "offlineRatioHelp": "当处于离线状态的采集器占比超过该值时，暂停当前阶段",
       "outOfRange": "请输入 {min} 到 {max} 之间的数字",
       "phaseTimeout": "阶段超时（秒）",
       "phaseTimeoutHelp": "上线阶段在此时间内既未确认也未拒绝则暂停",
diff --git a/web/src/locales/languages/zh-TW.json b/web/src/locales/languages/zh-TW.json
index 6932b1c102..a20c088e05 100644
--- a/web/src/locales/languages/zh-TW.json
+++ b/web/src/locales/languages/zh-TW.json
@@ -1,4 +1,17 @@
 {
+  "featureLock": {
+    "routeTitle": "不在您的授權中",
+    "title": "{feature} 未包含在您的授權中",
+    "description": "您的管理員可透過更新授權來新增此功能，或聯絡業務取得包含此功能的授權。",
+    "thisFeature": "此功能",
+    "contactSales": "聯絡業務",
+    "toastTitle": "未包含在您的授權中",
+    "toastMessage": "您的授權不包含：{features}。請您的管理員更新授權。",
+    "toastMessageGeneric": "您的授權不包含此功能。請您的管理員更新授權。",
+    "bannerMessage": "此功能已上鎖。您的授權需要 {feature} 功能。",
+    "bannerMessageGeneric": "此頁面需要一項不在您授權中的功能。",
+    "headerLocked": "已上鎖：需要 {feature}"
+  },
   "emptyState": {
     "illustrations": {
       "noHistoryYet": "尚無歷史記錄",
@@ -837,6 +850,7 @@
     "dateRangeCopied": "日期範圍已複製",
     "dateRangePasted": "日期範圍已貼上",
     "dateRangePasteError": "無法解析日期範圍",
+    "dateRangePasteEmpty": "剪貼簿是空的。請先複製日期範圍。",
     "dateRangePasteBlocked": "此瀏覽器封鎖了讀取剪貼簿。請在選擇器開啟時按下 {shortcut} 以貼上。",
     "pastSecond": "過去 {count} 秒 | 過去 {count} 秒",
     "pastMinute": "過去 {count} 分鐘 | 過去 {count} 分鐘",
@@ -3406,6 +3420,22 @@
     "contact_name": "聯絡人姓名",
     "contact_email": "聯絡人電子郵件",
     "environment_type": "環境類型",
+    "features": "功能",
+    "features_all_unlocked": "您的授權已解鎖所有功能。",
+    "features_summary": "您的授權解鎖了 {ratio}。永遠包含 {free} 項免費功能。 | 您的授權解鎖了 {ratio}。永遠包含 {free} 項免費功能。",
+    "features_paid_ratio": "{paid} 項付費功能中的 {unlocked} 項 | {paid} 項付費功能中的 {unlocked} 項",
+    "features_unlocked": "已解鎖",
+    "features_missing": "不在您的授權中",
+    "features_request_access": "申請存取權",
+    "features_search": "搜尋 {count} 項功能 | 搜尋全部 {count} 項功能",
+    "features_filter_all": "全部",
+    "features_filter_free": "免費",
+    "features_group_heading": "{heading} · {count}",
+    "features_no_match": "沒有符合您搜尋的功能",
+    "features_none": "此群組中沒有功能",
+    "features_free_heading": "免費，每份授權皆包含",
+    "features_new": "授權後新增",
+    "features_filter_new": "新增",
     "request_new_license": "申請新授權",
     "add_new_license_key": "新增授權金鑰",
     "refresh_license_limits": "重新整理授權限制",
@@ -9896,6 +9926,12 @@
     "allClear": "一切正常",
     "allClearDesc": "在選取的時間區段中沒有作用中的異常、事件或降級服務。",
     "allClearDescScoped": "在所選時間範圍內沒有未解決的事件、異常或降級的服務。",
+    "allClearPartial": "沒有需要回報的事項",
+    "allClearPartialDesc": "沒有需要關注的事項。我們未檢查 {areas}，因為您的授權不包含這些功能。",
+    "areaAlerts": "警示",
+    "areaAnomalies": "異常偵測",
+    "areaIncidents": "事件",
+    "areaServices": "服務",
     "notMonitoredTitle": "尚未監控任何項目",
     "notMonitoredDesc": "你的資料正在送達，但沒有任何警示或異常檢查在執行。新增一個，總覽就會列出需要關注的項目。",
     "notMonitoredAlert": "建立警示",
@@ -29151,6 +29187,7 @@
       "restartManyTitle": "要重新啟動 {count} 個收集器嗎？",
       "restartMessage": "每個收集器會在收到伺服器的下一則訊息時重新啟動。每台主機的資料收集會短暫暫停。",
       "restartQueued": "已要求重新啟動 {count} 個收集器 | 已要求重新啟動 {count} 個收集器",
+      "restartOffline": "此收集器處於離線狀態。待其恢復上線後請重新啟動。",
       "restartUnsupported": "此收集器不接受重新啟動指令",
       "systemSections": "系統管理區段",
       "systemSectionsCaption": "OpAMP 擴充功能與服務遙測，由 supervisor 與伺服器設定",
@@ -29279,7 +29316,7 @@
       "confirmFixForward": "開啟 {config} 編輯器。請發佈修正後的版本並將此機群變更為該版本；屆時此推出將被取代。",
       "confirmResume": "同一個推出會從第 {n} 階段繼續。",
       "confirmRollback": "立即開始推出以回復到穩定版本 {config} v{version}。已在該版本的收集器不會收到任何內容。",
-      "confirmRollbackNoStable": "立即開始推出以回復到穩定版本。",
+      "confirmRollbackNoStable": "此機群沒有穩定版本，因此推出會結束，其收集器會停止收集，直到您再次部署為止。",
       "confirmSkip": "排除 {count} 個失敗的收集器並繼續。它會被標記為已排除，並在下次推出時重新納入。 | 排除 {count} 個失敗的收集器並繼續。它們會被標記為已排除，並在下次推出時重新納入。",
       "confirmed": "已確認",
       "eventConverged": "第 {n} 階段已收斂",
@@ -29316,6 +29353,7 @@
       "phaseN": "第 {n} 階段",
       "phaseTimedOut": "已逾時",
       "phaseTimeoutNote": "若某階段在 {minutes} 分鐘內既未確認也未拒絕，推出將中止（機群設定）",
+      "phaseTimeoutNoteSeconds": "若某個階段在 {minutes} 分 {seconds} 秒內既未確認也未拒絕，就會中止推出（機群設定）",
       "phaseVerifying": "驗證中",
       "phases": "階段",
       "planEmpty": "目前沒有收集器上線，因此部署會等到有收集器連線後才開始",
@@ -29456,8 +29494,8 @@
       "inheritPlaceholder": "沿用（{value}）",
       "offlineHeartbeats": "遺漏幾次心跳後視為離線",
       "offlineHeartbeatsHelp": "收集器在這麼多個心跳間隔內未傳送任何訊息即視為離線",
-      "offlineRatio": "離線比例事件（%）",
-      "offlineRatioHelp": "當離線的收集器比例超過此值時，記錄一則機群事件",
+      "offlineRatio": "離線比例 (%)",
+      "offlineRatioHelp": "當離線的收集器占比超過此數值時，中止該階段",
       "outOfRange": "請輸入 {min} 到 {max} 之間的數字",
       "phaseTimeout": "階段逾時（秒）",
       "phaseTimeoutHelp": "推出階段在此時間內既未確認也未拒絕即中止",
diff --git a/web/src/main.ts b/web/src/main.ts
index 66fd3a42ef..87383a6d70 100644
--- a/web/src/main.ts
+++ b/web/src/main.ts
@@ -36,6 +36,9 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { bootstrapTheme } from "@/utils/themeManager";
 import { raw } from "@/types/i18n";
 import { bindAccess } from "@/composables/useAccessStore";
+import { installFetchLicenseReceiver } from "@/services/licenseDenialReceiver";
+
+installFetchLicenseReceiver();
 
 // Apply the resolved theme synchronously before the app mounts so the first
 // paint already uses the correct colors (no flash of the base stylesheet theme).
diff --git a/web/src/plugins/correlation/TelemetryCorrelationDashboard.spec.ts b/web/src/plugins/correlation/TelemetryCorrelationDashboard.spec.ts
index f5af44379e..5007e81dc6 100644
--- a/web/src/plugins/correlation/TelemetryCorrelationDashboard.spec.ts
+++ b/web/src/plugins/correlation/TelemetryCorrelationDashboard.spec.ts
@@ -980,4 +980,42 @@ describe("TelemetryCorrelationDashboard.vue", () => {
       expect(details.attributes("shortcuts-active")).toBe("true");
     });
   });
+
+  describe("View in Traces under the traces license", () => {
+    const VIEW_TRACES = '[data-test="correlation-view-traces-page"]';
+
+    const showDimensionTraces = async () => {
+      wrapper = createWrapper({ externalActiveTab: "traces" });
+      await flushPromises();
+      wrapper.vm.tracesLoading = false;
+      wrapper.vm.tracesError = null;
+      wrapper.vm.traceCorrelationMode = "dimension-based";
+      wrapper.vm.tracesForDimensions = [{ trace_id: "t1" }];
+      await flushPromises();
+    };
+
+    afterEach(() => {
+      const { features: _features, ...rest } = store.state.zoConfig;
+      store.state.zoConfig = rest;
+    });
+
+    it("keeps the button enabled while traces is licensed", async () => {
+      await showDimensionTraces();
+      const btn = wrapper.find(VIEW_TRACES);
+      expect(btn.exists()).toBe(true);
+      expect(btn.attributes("disabled")).toBeUndefined();
+    });
+
+    it("disables the button and opens nothing while traces is locked", async () => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: { traces: "locked" } };
+      const open = vi.spyOn(window, "open").mockReturnValue(null);
+      await showDimensionTraces();
+      const btn = wrapper.find(VIEW_TRACES);
+      expect(btn.attributes("disabled")).toBeDefined();
+      await btn.trigger("click");
+      wrapper.vm.openTraceInNewWindow("t1");
+      expect(open).not.toHaveBeenCalled();
+      open.mockRestore();
+    });
+  });
 });
diff --git a/web/src/plugins/correlation/TelemetryCorrelationDashboard.vue b/web/src/plugins/correlation/TelemetryCorrelationDashboard.vue
index 16fb9f73e4..adecdf4b0b 100644
--- a/web/src/plugins/correlation/TelemetryCorrelationDashboard.vue
+++ b/web/src/plugins/correlation/TelemetryCorrelationDashboard.vue
@@ -459,16 +459,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   }}</span>
                 </div>
                 <div class="ms-auto flex items-center gap-2">
+                  <OTooltip v-if="tracesLocked" :content="tracesLockedReason">
+                    <span class="inline-flex">
+                      <OButton
+                        variant="ghost"
+                        size="sm-action"
+                        disabled
+                        icon-left="lock"
+                        data-test="correlation-view-traces-page"
+                        class="text-xs"
+                      >
+                        {{ t("correlation.viewInTraces") }}
+                      </OButton>
+                    </span>
+                  </OTooltip>
                   <OButton
+                    v-else
                     variant="ghost"
                     size="sm-action"
+                    icon-left="open-in-new"
                     @click="openTracesPage"
                     data-test="correlation-view-traces-page"
                     class="text-xs"
                   >
-                    <OIcon name="open-in-new" size="xs" class="me-1" />
                     {{ t("correlation.viewInTraces") }}
-                    <OTooltip :content="t('correlation.viewInTraces')" side="top" />
                   </OButton>
                   <OTag type="fieldTag" value="primary">
                     {{ tracesForDimensions.length }} {{ t("menu.traces") }}
@@ -904,16 +918,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 {{ tracesForDimensions.length }} {{ t("menu.traces") }}
               </OTag>
               <div class="ms-auto flex items-center gap-2">
+                <OTooltip v-if="tracesLocked" :content="tracesLockedReason">
+                  <span class="inline-flex">
+                    <OButton
+                      variant="ghost"
+                      size="sm-action"
+                      disabled
+                      icon-left="lock"
+                      data-test="correlation-view-traces-page"
+                      class="text-xs"
+                    >
+                      {{ t("correlation.viewInTraces") }}
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
+                  v-else
                   variant="ghost"
                   size="sm-action"
+                  icon-left="open-in-new"
                   @click="openTracesPage"
                   data-test="correlation-view-traces-page"
                   class="text-xs"
                 >
-                  <OIcon name="open-in-new" size="xs" class="me-1" />
                   {{ t("correlation.viewInTraces") }}
-                  <OTooltip :content="t('correlation.viewInTraces')" side="top" />
                 </OButton>
               </div>
             </div>
@@ -1054,6 +1082,7 @@ import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
 import { ref, computed, watch, defineAsyncComponent, provide, nextTick, onUnmounted } from "vue";
 import { useStore } from "vuex";
 import { useRouter } from "vue-router";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { useI18nTyped, raw, type I18nText } from "@/types/i18n";
 import useNotifications from "@/composables/useNotifications";
 import useTraces from "@/composables/useTraces";
@@ -1163,6 +1192,7 @@ const emit = defineEmits<{
 const { showErrorNotification } = useNotifications();
 const store = useStore();
 const router = useRouter();
+const { locked: tracesLocked, lockedReason: tracesLockedReason } = useLicenseLock("traces");
 const { t } = useI18nTyped();
 const { generateDashboard, generateLogsDashboard } = useMetricsCorrelationDashboard(t);
 const { semanticGroups, loadSemanticGroups } = useServiceCorrelation();
@@ -2825,6 +2855,7 @@ const openTraceInNewWindow = (
         trace_end_time?: number;
       },
 ) => {
+  if (tracesLocked.value) return;
   // Handle case where event object is passed instead of trace_id (e.g., from @click without args)
   const traceObj = typeof trace === "string" ? undefined : trace;
   const traceId = typeof trace === "string" ? trace : trace.trace_id;
diff --git a/web/src/plugins/logs/DetailTable.spec.ts b/web/src/plugins/logs/DetailTable.spec.ts
index 0369360974..c0025202a9 100644
--- a/web/src/plugins/logs/DetailTable.spec.ts
+++ b/web/src/plugins/logs/DetailTable.spec.ts
@@ -850,6 +850,24 @@ describe("DetailTable Component", () => {
       expect(traceWrapper.emitted()["view-trace"]).toHaveLength(1);
     });
 
+    it("disables the button with a lock and hides the picker while traces is locked", async () => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: { traces: "locked" } };
+      try {
+        traceWrapper = mountDetailTable();
+        await flushPromises();
+
+        const button = traceWrapper.find(BUTTON);
+        expect(button.attributes("disabled")).toBeDefined();
+        expect(button.attributes("icon-left")).toBe("lock");
+        expect(traceWrapper.find(SELECT).exists()).toBe(false);
+        await button.trigger("click");
+        expect(traceWrapper.emitted()["view-trace"]).toBeUndefined();
+      } finally {
+        const { features: _features, ...rest } = store.state.zoConfig;
+        store.state.zoConfig = rest;
+      }
+    });
+
     // REGRESSION: the gate must read `props.modelValue`, which exists during
     // setup, and not `rowData`, which the async created() hook only fills a
     // microtask later. Reading rowData left the button permanently hidden.
@@ -1132,6 +1150,28 @@ describe("DetailTable Component", () => {
         await flushPromises();
         expect(traces()?.props("shortcutsActive")).toBe(true);
       });
+
+      describe("when the license locks correlation", () => {
+        beforeEach(() => {
+          store.state.zoConfig = { ...store.state.zoConfig, features: { correlation: "locked" } };
+        });
+        afterEach(() => {
+          const { features: _features, ...rest } = store.state.zoConfig;
+          store.state.zoConfig = rest;
+        });
+
+        it("opens the locked tab on LicenseDeniedState without loading correlation", async () => {
+          await mountFooter({ initialTab: "json" });
+          expect(wrapper.vm.tabOrder.find((t: any) => t.name === "correlated-logs")?.locked).toBe(
+            true,
+          );
+          wrapper.vm.onTabChange("correlated-logs");
+          await flushPromises();
+          expect(wrapper.vm.tab).toBe("correlated-logs");
+          expect(wrapper.findComponent({ name: "LicenseDeniedState" }).exists()).toBe(true);
+          expect(wrapper.emitted("load-correlation")).toBeUndefined();
+        });
+      });
     });
 
     it("never emits a locked correlated tab and bounces back from one", async () => {
diff --git a/web/src/plugins/logs/DetailTable.vue b/web/src/plugins/logs/DetailTable.vue
index 6be8a5ef87..b96bc28934 100644
--- a/web/src/plugins/logs/DetailTable.vue
+++ b/web/src/plugins/logs/DetailTable.vue
@@ -49,6 +49,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :name="tabItem.name"
               :label="tabItem.label"
               :suffix-icon="tabItem.locked ? 'lock' : undefined"
+              :tooltip="tabItem.locked ? correlationLockedReason : undefined"
             />
           </template>
         </OTabs>
@@ -147,27 +148,43 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
              stays reachable from every tab. JsonPreview is told to hide its own
              copy via `hide-view-trace`. -->
         <div
-          v-if="showViewTraceBtn && (tracesStreams.length || isTracesStreamsLoading)"
+          v-if="
+            showViewTraceBtn && (tracesLocked || tracesStreams.length || isTracesStreamsLoading)
+          "
           class="flex shrink-0 items-center gap-2"
         >
-          <OSelect
-            data-test="log-detail-view-trace-stream-select"
-            v-model="searchObj.meta.selectedTraceStream"
-            :options="tracesStreams"
-            class="w-40! shrink-0"
-            :loading="isTracesStreamsLoading"
-            :disabled="isTracesStreamsLoading"
-            size="sm"
-          />
-          <OButton
-            data-test="log-detail-view-trace-btn"
-            size="xs"
-            variant="outline"
-            icon-left="account-tree"
-            :disabled="pageLoading"
-            @click="viewTrace"
-            >{{ t("search.viewTrace") }}</OButton
-          >
+          <OTooltip v-if="tracesLocked" :content="tracesLockedReason">
+            <span class="inline-flex">
+              <OButton
+                data-test="log-detail-view-trace-btn"
+                size="xs"
+                variant="outline"
+                icon-left="lock"
+                disabled
+                >{{ t("search.viewTrace") }}</OButton
+              >
+            </span>
+          </OTooltip>
+          <template v-else>
+            <OSelect
+              data-test="log-detail-view-trace-stream-select"
+              v-model="searchObj.meta.selectedTraceStream"
+              :options="tracesStreams"
+              class="w-40! shrink-0"
+              :loading="isTracesStreamsLoading"
+              :disabled="isTracesStreamsLoading"
+              size="sm"
+            />
+            <OButton
+              data-test="log-detail-view-trace-btn"
+              size="xs"
+              variant="outline"
+              icon-left="account-tree"
+              :disabled="pageLoading"
+              @click="viewTrace"
+              >{{ t("search.viewTrace") }}</OButton
+            >
+          </template>
         </div>
         <OSwitch
           v-show="tab === 'table'"
@@ -401,8 +418,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
         <!-- Correlated Logs Tab Panel (Custom Component) -->
         <OTabPanel name="correlated-logs" stretch>
+          <LicenseDeniedState v-if="correlationLicenseLocked" :features="['correlation']" />
           <CorrelatedLogsTable
-            v-if="correlationProps"
+            v-else-if="correlationProps"
             :service-name="correlationProps.serviceName"
             :matched-dimensions="correlationProps.matchedDimensions"
             :additional-dimensions="correlationProps.additionalDimensions"
@@ -444,8 +462,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
         <!-- Correlated Metrics Tab Panel -->
         <OTabPanel name="correlated-metrics" stretch>
+          <LicenseDeniedState v-if="correlationLicenseLocked" :features="['correlation']" />
           <TelemetryCorrelationDashboard
-            v-if="correlationProps"
+            v-else-if="correlationProps"
             mode="embedded-tabs"
             external-active-tab="metrics"
             :service-name="correlationProps.serviceName"
@@ -486,8 +505,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
         <!-- Correlated Traces Tab Panel -->
         <OTabPanel name="correlated-traces" stretch>
+          <LicenseDeniedState v-if="correlationLicenseLocked" :features="['correlation']" />
           <TelemetryCorrelationDashboard
-            v-if="correlationProps"
+            v-else-if="correlationProps"
             mode="embedded-tabs"
             external-active-tab="traces"
             :shortcuts-active="tab === 'correlated-traces'"
@@ -655,6 +675,8 @@ import CorrelatedLogsTable from "@/plugins/correlation/CorrelatedLogsTable.vue";
 import config from "@/aws-exports";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 import OShortcut from "@/lib/core/Shortcut/OShortcut.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
@@ -704,6 +726,7 @@ export default defineComponent({
     ChunkedContent,
     TelemetryCorrelationDashboard,
     CorrelatedLogsTable,
+    LicenseDeniedState,
     OButton,
     OSelect,
     ODropdown,
@@ -849,6 +872,8 @@ export default defineComponent({
       checkFeatureAccess("correlation", buildFeatureGateContext(store.state.zoConfig)),
     );
     const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+    const { locked: correlationLicenseLocked, lockedReason: correlationLockedReason } =
+      useLicenseLock("correlation");
 
     const selectedRelativeValue = ref<number>(10);
     const recordSizeOptions = ref<Array<{ label: I18nText; value: number }>>([
@@ -880,6 +905,8 @@ export default defineComponent({
       tracesStreams,
       isTracesStreamsLoading,
       showViewTraceBtn,
+      tracesLocked,
+      tracesLockedReason,
       setViewTraceBtn: setViewTraceBtnFor,
     } = useViewTraceAction(t, searchObj);
 
@@ -922,6 +949,7 @@ export default defineComponent({
           Object.keys(newRowData).length > 0 &&
           tab.value.startsWith("correlated-") &&
           correlationAccess.value.allowed &&
+          !correlationLicenseLocked.value &&
           !props.correlationProps
         ) {
           // Emit the original modelValue (not flattened rowData) as it has _timestamp
@@ -949,6 +977,7 @@ export default defineComponent({
       // Skip if this is the initial load (oldTab is undefined) as rowData watcher handles it
       if (
         isCorrelationTab &&
+        !correlationLicenseLocked.value &&
         !props.correlationProps &&
         oldTab !== undefined &&
         rowData.value &&
@@ -1063,7 +1092,7 @@ export default defineComponent({
         },
       ];
       if (serviceStreamsEnabled.value) {
-        const locked = !correlationAccess.value.allowed;
+        const locked = !correlationAccess.value.allowed || correlationLicenseLocked.value;
         tabs.push(
           {
             name: "correlated-logs",
@@ -1116,7 +1145,7 @@ export default defineComponent({
     // order whenever the set of available tabs changes — keeping the user's
     // order and appending anything new.
     watch(
-      () => availableTabs.value.map((t) => t.name).join(","),
+      () => availableTabs.value.map((t) => `${t.name}:${!!t.locked}`).join(","),
       () => {
         const merged: DetailTab[] = [];
         tabOrder.value.forEach((t) => {
@@ -1424,6 +1453,8 @@ export default defineComponent({
       tracesStreams,
       isTracesStreamsLoading,
       showViewTraceBtn,
+      tracesLocked,
+      tracesLockedReason,
       hasAggregationQuery,
       canSearchAroundStream,
       scopeHighlightQuery,
@@ -1440,6 +1471,8 @@ export default defineComponent({
       detailSearchQuery,
       serviceStreamsEnabled,
       correlationAccess,
+      correlationLicenseLocked,
+      correlationLockedReason,
       onTabChange,
       tabOrder,
       onTabReorder,
diff --git a/web/src/plugins/logs/Index.autoRun.spec.ts b/web/src/plugins/logs/Index.autoRun.spec.ts
index 0586df4561..a9f5c66ac6 100644
--- a/web/src/plugins/logs/Index.autoRun.spec.ts
+++ b/web/src/plugins/logs/Index.autoRun.spec.ts
@@ -37,6 +37,7 @@ import { getFieldsFromQuery } from "@/utils/query/sqlUtils";
 import { useLogsAutoRun } from "@/composables/useLogs/logsAutoRun";
 import { REFRESH_QUERY_ORIGIN } from "@/composables/useLogs/logsRowNav";
 import { urlWriteMode } from "@/composables/useLogs/useLogsUrl";
+import { saveLogsStreamType } from "@/utils/streamPersist";
 
 initializeLogsIndexDom();
 
@@ -183,6 +184,15 @@ describe("Logs Index — first landing and URL loads (item 2)", { timeout: 30000
     );
   });
 
+  it.each([
+    ["licensed", {}, "traces"],
+    ["locked", { traces: "locked" }, "logs"],
+  ])("restores a remembered traces type only while traces is %s", async (_s, features, type) => {
+    saveLogsStreamType(org, "traces");
+    await land({}, { auto_query_enabled: true, query_on_stream_selection: true, features });
+    expect(wrapper.vm.searchObj.data.stream.streamType).toBe(type);
+  });
+
   it("AQE=false: no restore and no preselect, as today", async () => {
     localStorage.setItem(`oo_logs_selected_stream_logs_${org}`, '["k8s_json"]');
     const logs = await land(
diff --git a/web/src/plugins/logs/Index.permalink.spec.ts b/web/src/plugins/logs/Index.permalink.spec.ts
index 4d22be8619..7f45cf47ad 100644
--- a/web/src/plugins/logs/Index.permalink.spec.ts
+++ b/web/src/plugins/logs/Index.permalink.spec.ts
@@ -216,7 +216,7 @@ describe("Logs Index — opening a line link (4c C5)", { timeout: 30000 }, () =>
     } as any);
     gridRuns.length = 0;
     await land(linkQuery(), {}, { realExecutor: true });
-    await vi.waitFor(() => expect(gridRuns.length).toBeGreaterThan(0));
+    expect(gridRuns.length).toBeGreaterThan(0);
     expect(gridRuns[0][2]).toMatch(/^permalink-init:/);
   });
 
@@ -239,11 +239,7 @@ describe("Logs Index — opening a line link (4c C5)", { timeout: 30000 }, () =>
     await vi.waitFor(() =>
       expect(document.querySelector('[data-test="logs-permalink-detail-dialog"]')).not.toBeNull(),
     );
-    await vi.waitFor(() =>
-      expect(
-        document.querySelector('[data-test="log-detail-json-content"]')?.textContent,
-      ).toContain("payment declined"),
-    );
+    await vi.waitFor(() => expect(sharedLineRecord.value).toEqual(line));
     logs.mockClear();
     wrapper.vm.onGuardRunAnyway();
     expect(logs).toHaveBeenCalledTimes(1);
diff --git a/web/src/plugins/logs/Index.vue b/web/src/plugins/logs/Index.vue
index 6e2f9125cf..f269554bc2 100644
--- a/web/src/plugins/logs/Index.vue
+++ b/web/src/plugins/logs/Index.vue
@@ -688,6 +688,8 @@ import { raw, useI18nTyped } from "@/types/i18n";
 
 import analytics from "@/services/product_analytics";
 import config from "@/aws-exports";
+import { featureState, streamTypeFeature } from "@/utils/featureGate";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 import { verifyOrganizationStatus, deepCopy, addSpacesToOperators } from "@/utils/zincutils";
 import MainLayoutCloudMixin from "@/enterprise/mixins/mainLayout.mixin";
 import useLogs from "@/composables/useLogs";
@@ -945,6 +947,7 @@ export default defineComponent({
     const { t } = useI18nTyped();
     const store = useStore();
     const router = useRouter();
+    const signalLocks = useLicenseLocks();
     const {
       searchObj,
       resetSearchObj,
@@ -1604,7 +1607,8 @@ export default defineComponent({
             const persistedType = restoreLogsStreamType(
               store.state.selectedOrganization.identifier,
             );
-            if (persistedType) {
+            // The page lock reads the URL type, so a remembered locked type would run unlocked.
+            if (persistedType && !signalLocks.isLocked(streamTypeFeature(persistedType))) {
               searchObj.data.stream.streamType = persistedType;
             }
           }
@@ -1674,7 +1678,11 @@ export default defineComponent({
 
     // Helper function to check if the environment is enterprise and super cluster is enabled
     function isEnterpriseClusterEnabled() {
-      return config.isEnterprise === "true" && store.state.zoConfig.super_cluster_enabled;
+      return (
+        config.isEnterprise === "true" &&
+        store.state.zoConfig.super_cluster_enabled &&
+        featureState(store.state.zoConfig.features, "super_cluster") !== "locked"
+      );
     }
 
     // Helper function to check if quick mode is enabled
@@ -3981,7 +3989,9 @@ export default defineComponent({
     };
 
     const permalinkResolveContext = (): ResolveContext => {
-      const superCluster = !!store.state.zoConfig?.super_cluster_enabled;
+      const superCluster =
+        !!store.state.zoConfig?.super_cluster_enabled &&
+        featureState(store.state.zoConfig?.features, "super_cluster") !== "locked";
       return {
         regions: superCluster ? [...(searchObj.meta.regions ?? [])] : [],
         clusters: superCluster ? [...(searchObj.meta.clusters ?? [])] : [],
diff --git a/web/src/plugins/logs/IndexList.typeSwitch.spec.ts b/web/src/plugins/logs/IndexList.typeSwitch.spec.ts
index 2c7a1abec6..cbee875220 100644
--- a/web/src/plugins/logs/IndexList.typeSwitch.spec.ts
+++ b/web/src/plugins/logs/IndexList.typeSwitch.spec.ts
@@ -22,6 +22,7 @@ import IndexList from "@/plugins/logs/IndexList.vue";
 import { searchState } from "@/composables/useLogs/searchState";
 import { useStreamFields } from "@/composables/useLogs/useStreamFields";
 import { defineComponent } from "vue";
+import FeatureLockBoundary from "@/components/common/FeatureLockBoundary.vue";
 
 const getStreamsMock = vi.hoisted(() => vi.fn());
 const onStreamChangeMock = vi.hoisted(() => vi.fn());
@@ -128,4 +129,50 @@ describe("IndexList stream type switch with out-of-order list responses (F3)", (
     expect(onStreamChangeMock).toHaveBeenCalledTimes(1);
     expect(onStreamChangeMock).toHaveBeenCalledWith("", { origin: "selector" });
   });
+
+  it("leaves the URL to the search on an unlocked page", async () => {
+    getStreamsMock.mockResolvedValue(listOf(["log_A"]));
+    await router.replace({ query: { stream_type: "traces", stream: "trace_A" } });
+    await wrapper.vm.onStreamTypeChange("logs");
+    await flushPromises();
+    expect(router.currentRoute.value.query.stream_type).toBe("traces");
+    expect(router.currentRoute.value.query.stream).toBe("trace_A");
+  });
+});
+
+describe("IndexList switch-to-logs on a license-locked page", () => {
+  const { searchObj } = searchState();
+  const BACK_TO_LOGS = '[data-test="log-search-index-list-back-to-logs-btn"]';
+
+  const mountUnderLock = (feature: string | null) =>
+    mount(
+      defineComponent({
+        components: { IndexList, FeatureLockBoundary },
+        setup: () => ({ feature }),
+        template: '<FeatureLockBoundary :feature="feature"><IndexList /></FeatureLockBoundary>',
+      }),
+      { global: { provide: { store }, plugins: [i18n, router] } },
+    );
+
+  beforeEach(() => {
+    getStreamsMock.mockResolvedValue(listOf([]));
+    searchObj.data.stream.streamType = "metrics";
+    searchObj.data.stream.selectedStream = [];
+  });
+
+  it.each([
+    ["locked", "metrics"],
+    ["unlocked", null],
+  ])("switches to logs while the page is %s", async (_state, feature) => {
+    await router.replace({ query: { stream_type: "metrics", stream: "metric_A" } });
+    const wrapper = mountUnderLock(feature);
+    await flushPromises();
+    getStreamsMock.mockClear();
+    await wrapper.find(BACK_TO_LOGS).trigger("click");
+    await flushPromises();
+    expect(searchObj.data.stream.streamType).toBe("logs");
+    expect(getStreamsMock).toHaveBeenCalled();
+    expect(router.currentRoute.value.query.stream_type).toBe(feature ? "logs" : "metrics");
+    wrapper.unmount();
+  });
 });
diff --git a/web/src/plugins/logs/IndexList.vue b/web/src/plugins/logs/IndexList.vue
index 3b0cfdca3d..73d8b7eca1 100644
--- a/web/src/plugins/logs/IndexList.vue
+++ b/web/src/plugins/logs/IndexList.vue
@@ -22,17 +22,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          list itself deliberately runs flush to the divider so its scrollbar lands
          on the panel edge — only the rows inside it carry the gutter. -->
     <div class="px-page-edge flex max-w-full items-center gap-2">
-      <OButton
+      <FeatureLockExempt
         v-if="searchObj.data.stream.streamType && searchObj.data.stream.streamType !== 'logs'"
-        data-test="log-search-index-list-back-to-logs-btn"
-        variant="outline"
-        size="icon-sm"
-        class="border-border-default rounded-default h-8 w-8 shrink-0 border p-0"
-        @click="onStreamTypeChange('logs')"
+        class="shrink-0"
       >
-        <OIcon name="swap-horiz" size="sm" />
-        <OTooltip :content="t('search.switchToLogs')" side="bottom" align="center" />
-      </OButton>
+        <OButton
+          data-test="log-search-index-list-back-to-logs-btn"
+          variant="outline"
+          size="icon-sm"
+          class="border-border-default rounded-default h-8 w-8 shrink-0 border p-0"
+          @click="onStreamTypeChange('logs')"
+        >
+          <OIcon name="swap-horiz" size="sm" />
+          <OTooltip :content="t('search.switchToLogs')" side="bottom" align="center" />
+        </OButton>
+      </FeatureLockExempt>
       <div class="min-w-0 flex-1">
         <!-- A slot-less OTooltip anchors to its previous sibling, so this must not sit between OSelect and it. -->
         <span
@@ -301,6 +305,8 @@ import { useSearchStream } from "@/composables/useLogs/useSearchStream";
 import { searchState } from "@/composables/useLogs/searchState";
 import { useStreamFields } from "@/composables/useLogs/useStreamFields";
 import OButton from "@/lib/core/Button/OButton.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import { useFeatureLock } from "@/composables/useFeatureLock";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
@@ -340,6 +346,7 @@ export default defineComponent({
     FieldExpansion,
     GroupedFieldListPagination,
     OButton,
+    FeatureLockExempt,
     OSelect,
     OIcon,
     OTooltip,
@@ -375,6 +382,7 @@ export default defineComponent({
   setup(props, { emit }) {
     const store = useStore();
     const router = useRouter();
+    const pageLock = useFeatureLock();
     const { t } = useI18nTyped();
     const { reorderSelectedFields, getFilterExpressionByFieldType, extractValueQuery } = useLogs(t);
 
@@ -476,6 +484,12 @@ export default defineComponent({
       searchObj.data.stream.selectedStream = [];
       searchObj.data.stream.selectedStreamFields = [];
       saveLogsStreamType(org, newType);
+      // A locked page cannot run the search that would update `stream_type`, which the lock reads from the URL.
+      if (pageLock.locked.value) {
+        void router.replace({
+          query: { ...router.currentRoute.value.query, stream_type: newType, stream: undefined },
+        });
+      }
       const isCurrent = () =>
         token === currentSelectionToken() &&
         searchObj.data.stream.streamType === newType &&
diff --git a/web/src/plugins/logs/JsonPreview.spec.ts b/web/src/plugins/logs/JsonPreview.spec.ts
index 0f4c232b9c..4a06d0fa61 100644
--- a/web/src/plugins/logs/JsonPreview.spec.ts
+++ b/web/src/plugins/logs/JsonPreview.spec.ts
@@ -1070,6 +1070,51 @@ describe("JsonPreview Component", () => {
         expect(traceWrapper.vm.tracesStreams).toEqual(["trace-stream1", "trace-stream2"]);
         expect(traceWrapper.find(streamSelectSelector).exists()).toBe(true);
         expect(traceWrapper.find(viewTraceBtnSelector).exists()).toBe(true);
+        expect(traceWrapper.find(viewTraceBtnSelector).attributes("disabled")).not.toBe("true");
+      });
+
+      it("disables the button with a lock and hides the picker while traces is locked", async () => {
+        store.state.zoConfig.features = { traces: "locked" };
+        try {
+          traceWrapper = mount(JsonPreview, {
+            props: { value: recordWithTraceId, mode: "sidebar" },
+            global: {
+              plugins: [i18n],
+              provide: { store },
+              stubs: {
+                AppTabs: true,
+                CodeQueryEditor: true,
+                ODialog: ODialogStub,
+                OButton: {
+                  props: { disabled: Boolean, iconLeft: String },
+                  template:
+                    '<button :disabled="disabled" :data-icon="iconLeft" @click="$emit(\'click\')"><slot /></button>',
+                },
+                OTooltip: { template: "<div><slot /></div>" },
+                ODropdown: true,
+                ODropdownItem: true,
+                ODropdownSeparator: true,
+                OSelect: true,
+                OIcon: true,
+                OInput: true,
+                OSpinner: true,
+                LogsHighLighting: true,
+                ChunkedContent: true,
+                EqualIcon: true,
+                NotEqualIcon: true,
+              },
+            },
+          });
+          await flushPromises();
+          const btn = traceWrapper.find(viewTraceBtnSelector);
+          expect(btn.attributes("disabled")).toBeDefined();
+          expect(btn.attributes("data-icon")).toBe("lock");
+          expect(traceWrapper.find(streamSelectSelector).exists()).toBe(false);
+          await btn.trigger("click");
+          expect(traceWrapper.emitted("view-trace")).toBeUndefined();
+        } finally {
+          delete store.state.zoConfig.features;
+        }
       });
 
       it("should hide the stream picker and the button when hideViewTrace is true", async () => {
@@ -1200,6 +1245,60 @@ describe("JsonPreview Component", () => {
       });
     });
   });
+
+  describe("View Related under a license lock", () => {
+    const mountRelated = () =>
+      mount(JsonPreview, {
+        props: { value: mockValue, mode: "sidebar" },
+        global: {
+          plugins: [i18n],
+          provide: { store },
+          stubs: {
+            AppTabs: true,
+            CodeQueryEditor: true,
+            ODialog: ODialogStub,
+            OButton: {
+              props: { disabled: Boolean },
+              template:
+                '<button :disabled="disabled" @click="$emit(\'click\')"><slot name="icon-left" /><slot /></button>',
+            },
+            OTooltip: { template: "<div><slot /></div>" },
+            ODropdown: true,
+            ODropdownItem: true,
+            ODropdownSeparator: true,
+            OSelect: true,
+            OIcon: { props: ["name"], template: '<i :data-icon="name" />' },
+            OInput: true,
+            OSpinner: true,
+            LogsHighLighting: true,
+            ChunkedContent: true,
+            EqualIcon: true,
+            NotEqualIcon: true,
+          },
+        },
+      });
+
+    afterEach(() => {
+      store.state.zoConfig = { ai_enabled: true };
+    });
+
+    it("renders the button disabled with a lock, skips the probe and emits nothing on click", async () => {
+      store.state.zoConfig = {
+        ai_enabled: true,
+        service_streams_enabled: true,
+        features: { correlation: "locked" },
+      };
+      const related = mountRelated();
+      await flushPromises();
+      const btn = related.find('[data-test="log-correlation-btn"]');
+      expect(btn.exists()).toBe(true);
+      expect(btn.attributes("disabled")).toBeDefined();
+      expect(related.find('[data-test="log-correlation-btn-lock"]').exists()).toBe(true);
+      await btn.trigger("click");
+      expect(related.emitted("show-correlation")).toBeUndefined();
+      related.unmount();
+    });
+  });
 });
 
 describe("JsonPreview in-place copy", () => {
diff --git a/web/src/plugins/logs/JsonPreview.vue b/web/src/plugins/logs/JsonPreview.vue
index 2ecf2b4a72..ddbf809c4f 100644
--- a/web/src/plugins/logs/JsonPreview.vue
+++ b/web/src/plugins/logs/JsonPreview.vue
@@ -29,8 +29,27 @@
           }}</span></span
         ></OButton
       >
+      <OTooltip
+        v-if="showViewRelatedBtn && correlationAccess.allowed && correlationLicense.locked.value"
+        :content="correlationLicense.lockedReason.value"
+      >
+        <span class="inline-flex">
+          <OButton
+            size="xs"
+            variant="outline"
+            class="me-2 mb-1.5"
+            disabled
+            data-test="log-correlation-btn"
+          >
+            <template #icon-left>
+              <OIcon name="lock" class="lock-chip" size="sm" data-test="log-correlation-btn-lock" />
+            </template>
+            {{ t("search.viewRelated") }}
+          </OButton>
+        </span>
+      </OTooltip>
       <OButton
-        v-if="showViewRelatedBtn"
+        v-else-if="showViewRelatedBtn"
         size="xs"
         variant="outline"
         class="me-2 mb-1.5"
@@ -38,40 +57,51 @@
         data-test="log-correlation-btn"
       >
         <OIcon name="link" size="xs" class="me-1" />{{ t("search.viewRelated") }}
-        <OIcon
-          v-if="!correlationAccess.allowed"
-          name="lock"
-          size="xs"
-          class="text-warning-600 ms-1"
-        />
+        <OIcon v-if="!correlationAccess.allowed" name="lock" size="xs" class="lock-chip ms-1" />
         <OTooltip v-if="correlationAccess.allowed" :content="t('search.viewRelatedTooltip')" />
       </OButton>
       <!-- Stream picker and its action read as one control, sized to sit level
            with the toolbar buttons above rather than towering over them. -->
       <div
         v-if="
-          !hideViewTrace && showViewTraceBtn && (tracesStreams.length || isTracesStreamsLoading)
+          !hideViewTrace &&
+          showViewTraceBtn &&
+          (tracesLocked || tracesStreams.length || isTracesStreamsLoading)
         "
         class="mb-1.5 flex items-center gap-2"
       >
-        <OSelect
-          :aria-label="t('search.selectStream')"
-          data-test="log-search-index-list-select-stream"
-          v-model="searchObj.meta.selectedTraceStream"
-          :options="tracesStreams"
-          class="w-auto shrink-0"
-          :loading="isTracesStreamsLoading"
-          :disabled="isTracesStreamsLoading"
-          size="sm"
-        />
-        <OButton
-          data-test="trace-view-logs-btn"
-          size="xs"
-          variant="outline"
-          icon-left="account-tree"
-          @click="redirectToTraces"
-          >{{ t("search.viewTrace") }}</OButton
-        >
+        <OTooltip v-if="tracesLocked" :content="tracesLockedReason">
+          <span class="inline-flex">
+            <OButton
+              data-test="trace-view-logs-btn"
+              size="xs"
+              variant="outline"
+              icon-left="lock"
+              disabled
+              >{{ t("search.viewTrace") }}</OButton
+            >
+          </span>
+        </OTooltip>
+        <template v-else>
+          <OSelect
+            :aria-label="t('search.selectStream')"
+            data-test="log-search-index-list-select-stream"
+            v-model="searchObj.meta.selectedTraceStream"
+            :options="tracesStreams"
+            class="w-auto shrink-0"
+            :loading="isTracesStreamsLoading"
+            :disabled="isTracesStreamsLoading"
+            size="sm"
+          />
+          <OButton
+            data-test="trace-view-logs-btn"
+            size="xs"
+            variant="outline"
+            icon-left="account-tree"
+            @click="redirectToTraces"
+            >{{ t("search.viewTrace") }}</OButton
+          >
+        </template>
       </div>
     </div>
     <div v-show="activeTab === 'unflattened'" class="ps-3">
@@ -164,7 +194,7 @@
             </template>
             {{ t("logs.jsonPreview.sendToAiChat") }}
             <template v-if="!aiAssistantAccess.allowed" #icon-right>
-              <OIcon name="lock" size="xs" class="text-warning-600 shrink-0" />
+              <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
             </template>
           </ODropdownItem>
           <ODropdownItem
@@ -176,7 +206,7 @@
             </template>
             {{ t("regex_patterns.create_regex_pattern_field") }}
             <template v-if="!regexPatternsAccess.allowed" #icon-right>
-              <OIcon name="lock" size="xs" class="text-warning-600 shrink-0" />
+              <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
             </template>
           </ODropdownItem>
         </ODropdown>
@@ -281,6 +311,7 @@ import { generateTraceContext } from "@/utils/zincutils";
 import { defineAsyncComponent } from "vue";
 import config from "@/aws-exports";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 import LogsHighLighting from "@/components/logs/LogsHighLighting.vue";
 import ChunkedContent from "@/components/logs/ChunkedContent.vue";
@@ -458,6 +489,8 @@ export default {
       filteredTracesStreamOptions,
       isTracesStreamsLoading,
       showViewTraceBtn,
+      tracesLocked,
+      tracesLockedReason,
       getTracesStreams,
       setViewTraceBtn: setViewTraceBtnFor,
       filterStreamFn,
@@ -565,6 +598,7 @@ export default {
       checkFeatureAccess("regexPatterns", buildFeatureGateContext(store.state.zoConfig)),
     );
     const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+    const correlationLicense = useLicenseLock("correlation");
 
     // Initialize service correlation composable
     const { isCorrelationAvailable } = useServiceCorrelation();
@@ -586,7 +620,7 @@ export default {
           return;
         }
 
-        if (!correlationAccess.value.allowed) {
+        if (!correlationAccess.value.allowed || correlationLicense.locked.value) {
           // Locked — show it locked, but skip the correlation-availability
           // probe entirely: that call hits a backend route an OSS build 403s
           // on, so there's nothing useful to check before unlocking.
@@ -773,6 +807,7 @@ export default {
         openUpgradeDialog();
         return;
       }
+      if (correlationLicense.locked.value) return;
       emit("show-correlation", props.value);
     };
 
@@ -956,7 +991,10 @@ export default {
       streamSearchValue,
       activeTab,
       showViewTraceBtn,
+      tracesLocked,
+      tracesLockedReason,
       showViewRelatedBtn,
+      correlationLicense,
       correlationAccess,
       aiAssistantAccess,
       regexPatternsAccess,
diff --git a/web/src/plugins/logs/SearchBar.regionLock.spec.ts b/web/src/plugins/logs/SearchBar.regionLock.spec.ts
new file mode 100644
index 0000000000..7f1aad896f
--- /dev/null
+++ b/web/src/plugins/logs/SearchBar.regionLock.spec.ts
@@ -0,0 +1,83 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, afterEach, beforeEach } from "vitest";
+import { mount, VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import router from "@/test/unit/helpers/router";
+import config from "@/aws-exports";
+import SearchBar from "@/plugins/logs/SearchBar.vue";
+
+describe("SearchBar — region dropdown under a super_cluster license lock", () => {
+  let wrapper: VueWrapper<any> | undefined;
+  const originalIsEnterprise = config.isEnterprise;
+  const originalZoConfig = { ...store.state.zoConfig };
+  const originalRegionInfo = store.state.regionInfo;
+
+  const mountSearchBar = () =>
+    mount(SearchBar, {
+      global: {
+        provide: { store },
+        plugins: [i18n, router],
+        stubs: {
+          QueryEditor: true,
+          OTooltip: { template: "<div><slot /></div>" },
+        },
+      },
+    });
+
+  const regionButton = () =>
+    wrapper
+      ?.findAllComponents({ name: "OButton" })
+      .find((c) => c.attributes("data-test") === "logs-search-bar-region-btn");
+
+  const regionDropdown = () =>
+    wrapper
+      ?.findAllComponents({ name: "ODropdown" })
+      .find((c) => c.vm.$attrs["data-test"] === "logs-search-bar-region-btn");
+
+  beforeEach(() => {
+    (config as any).isEnterprise = "true";
+    store.state.regionInfo = [{ label: "us", children: [{ label: "c1" }] }];
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = undefined;
+    (config as any).isEnterprise = originalIsEnterprise;
+    store.state.zoConfig = { ...originalZoConfig };
+    store.state.regionInfo = originalRegionInfo;
+  });
+
+  it("renders a disabled Region button with a lock and no region menu when locked", () => {
+    store.state.zoConfig = {
+      ...originalZoConfig,
+      super_cluster_enabled: true,
+      features: { super_cluster: "locked" },
+    };
+    wrapper = mountSearchBar();
+    expect(regionButton()?.props("disabled")).toBe(true);
+    expect(wrapper.find('[data-test="logs-search-bar-region-lock"]').exists()).toBe(true);
+    expect(regionDropdown()).toBeUndefined();
+  });
+
+  it("keeps the region menu when the license leaves super_cluster enabled", () => {
+    store.state.zoConfig = { ...originalZoConfig, super_cluster_enabled: true };
+    wrapper = mountSearchBar();
+    expect(wrapper.find('[data-test="logs-search-bar-region-lock"]').exists()).toBe(false);
+    expect(regionDropdown()).toBeDefined();
+  });
+});
diff --git a/web/src/plugins/logs/SearchBar.toolbarSpacing.spec.ts b/web/src/plugins/logs/SearchBar.toolbarSpacing.spec.ts
index a63018c6a7..65949f5331 100644
--- a/web/src/plugins/logs/SearchBar.toolbarSpacing.spec.ts
+++ b/web/src/plugins/logs/SearchBar.toolbarSpacing.spec.ts
@@ -21,6 +21,8 @@ import { createRouter, createMemoryHistory } from "vue-router";
 import SearchBar from "@/plugins/logs/SearchBar.vue";
 import { resetLogsAutoRunForTests } from "@/composables/useLogs/logsAutoRun";
 import { useToolbarPins, type ToolbarPinKey } from "@/composables/useToolbarPins";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
+import { defineComponent, ref } from "vue";
 
 const router = createRouter({
   history: createMemoryHistory(),
@@ -106,4 +108,28 @@ describe("SearchBar — toolbar controls are spaced only by the row gap", () =>
       expect(marginClassesOf(control), control.outerHTML.slice(0, 120)).toEqual([]);
     }
   });
+
+  it.each([
+    ["unlocked", null, "bg-button-primary!", "enabled:bg-button-primary!"],
+    ["license-locked", "logs", "enabled:bg-button-primary!", "bg-button-primary!"],
+  ])("forces the Run query fill only while the page is %s", async (_s, feature, fill, other) => {
+    wrapper = mount(
+      defineComponent({
+        components: { SearchBar },
+        setup() {
+          provideFeatureLock(ref(feature));
+          return {};
+        },
+        template: "<SearchBar />",
+      }),
+      {
+        attachTo: document.body,
+        global: { provide: { store }, plugins: [i18n, router], stubs: { QueryEditor: true } },
+      },
+    );
+    await flushPromises();
+    const run = wrapper.get('[data-test="logs-search-bar-refresh-btn"]');
+    expect(run.classes()).toContain(fill);
+    expect(run.classes()).not.toContain(other);
+  });
 });
diff --git a/web/src/plugins/logs/SearchBar.vue b/web/src/plugins/logs/SearchBar.vue
index fa041b13ed..d35fccf75b 100644
--- a/web/src/plugins/logs/SearchBar.vue
+++ b/web/src/plugins/logs/SearchBar.vue
@@ -145,7 +145,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </template>
               <span v-if="!toolbarToggleIconOnly">{{ t("search.showPatternsLabel") }}</span>
               <template v-if="!patternsAccess.allowed" #icon-right>
-                <OIcon name="lock" size="xs" class="text-warning-600 shrink-0" />
+                <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
               </template>
             </OToggleGroupItem>
           </OToggleGroup>
@@ -722,7 +722,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <OIcon
                 name="lock"
                 size="xs"
-                class="text-warning-600"
+                class="lock-chip"
                 data-test="search-scheduler-locked-icon"
               />
             </template>
@@ -901,9 +901,37 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
         <div class="search-time order-2">
           <div class="flex">
+            <OTooltip
+              v-if="
+                config.isEnterprise == 'true' &&
+                store.state.zoConfig.super_cluster_enabled &&
+                superClusterLocked
+              "
+              :content="superClusterLockedReason"
+            >
+              <span class="me-1 inline-flex">
+                <OButton
+                  variant="outline"
+                  size="sm"
+                  class="region-dropdown-btn px-1"
+                  disabled
+                  data-test="logs-search-bar-region-btn"
+                >
+                  <template #icon-left>
+                    <OIcon
+                      name="lock"
+                      class="lock-chip"
+                      size="sm"
+                      data-test="logs-search-bar-region-lock"
+                    />
+                  </template>
+                  {{ t("search.region") }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButtonGroup
               class="border-card-glass-border me-1 border p-0"
-              v-if="
+              v-else-if="
                 config.isEnterprise == 'true' &&
                 Object.keys(store.state.regionInfo).length > 0 &&
                 store.state.zoConfig.super_cluster_enabled
@@ -972,7 +1000,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :title="t('search.runQuery')"
                   :disabled="buildRunBlocked"
                   size="sm-toolbar"
-                  class="bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 rounded-s-default! h-[2.125rem]! w-[5.875rem]! rounded-e-none! p-0 px-1! text-center leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,opacity_0.2s_ease] hover:opacity-90 hover:shadow-md"
+                  class="hover:shadow-button-primary/70 rounded-s-default! h-[2.125rem]! w-[5.875rem]! rounded-e-none! p-0 px-1! text-center leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,opacity_0.2s_ease] hover:opacity-90 hover:shadow-md"
+                  :class="runButtonTone"
                   @click="handleRunQueryFn()"
                 >
                   {{ t("search.runQuery") }}
@@ -989,7 +1018,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       :class="[
                         config.isEnterprise == 'true' && visualizeSearchRequestTraceIds.length
                           ? 'bg-cancel-query-bg! text-button-primary-foreground!'
-                          : 'bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                          : [
+                              runButtonTone,
+                              'hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                            ],
                         'rounded-e-default! rounded-s-none!',
                       ]"
                     >
@@ -1030,7 +1062,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :title="t('search.runQuery')"
                   :disabled="buildRunBlocked || disable"
                   size="sm-toolbar"
-                  class="bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 rounded-s-default! h-[2.125rem]! w-[5.875rem]! rounded-e-none! p-0 px-1! text-center leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,opacity_0.2s_ease] hover:opacity-90 hover:shadow-md"
+                  class="hover:shadow-button-primary/70 rounded-s-default! h-[2.125rem]! w-[5.875rem]! rounded-e-none! p-0 px-1! text-center leading-4! font-medium! break-words whitespace-normal [transition:box-shadow_0.3s_ease,opacity_0.2s_ease] hover:opacity-90 hover:shadow-md"
+                  :class="runButtonTone"
                   @click="handleRunQueryFn()"
                 >
                   {{ t("search.runQuery") }}
@@ -1047,7 +1080,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       :class="[
                         config.isEnterprise == 'true' && visualizeSearchRequestTraceIds.length
                           ? 'bg-cancel-query-bg! text-button-primary-foreground!'
-                          : 'bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                          : [
+                              runButtonTone,
+                              'hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                            ],
                         'rounded-e-default! rounded-s-none!',
                       ]"
                     >
@@ -1106,7 +1142,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :class="[
                   showRunQueryPending
                     ? ''
-                    : 'bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                    : [
+                        runButtonTone,
+                        'hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                      ],
                   showRunQueryPending ? 'border-e-button-pending-hover-bg!' : '',
                 ]"
                 @click="handleRunQueryFn()"
@@ -1151,7 +1190,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       isRunQueryCancelShown
                         ? 'bg-cancel-query-bg! text-button-primary-foreground!'
                         : !showRunQueryPending
-                          ? 'bg-button-primary! text-button-primary-foreground! hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md'
+                          ? [
+                              runButtonTone,
+                              'hover:shadow-button-primary/70 hover:opacity-90 hover:shadow-md',
+                            ]
                           : showRunQueryPending
                             ? 'border-s-0'
                             : '',
@@ -1814,6 +1856,7 @@ import ODropdownSeparator from "@/lib/overlay/Dropdown/ODropdownSeparator.vue";
 import ODropdownGroup from "@/lib/overlay/Dropdown/ODropdownGroup.vue";
 import { hasFieldCondition, removeFieldCondition } from "@/plugins/logs/filterUtils";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useFeatureLock, useLicenseLock } from "@/composables/useFeatureLock";
 import OInput from "@/lib/forms/Input/OInput.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
@@ -2063,6 +2106,15 @@ export default defineComponent({
     const { isDark } = useTheme();
     const { showErrorNotification } = useNotifications();
     const regionFilter = ref();
+    const { locked: superClusterLocked, lockedReason: superClusterLockedReason } =
+      useLicenseLock("super_cluster");
+    const { locked: pageLocked } = useFeatureLock();
+    // The forced primary fill hides the disabled look, so it yields only on a license-locked page.
+    const runButtonTone = computed(() =>
+      pageLocked.value
+        ? "enabled:bg-button-primary! enabled:text-button-primary-foreground!"
+        : "bg-button-primary! text-button-primary-foreground!",
+    );
     const regionFilterRef = ref(null);
     const { resetStreamData, searchObj } = searchState();
     const { buildPatternsAlertPrefill } = usePatternActions();
@@ -5178,6 +5230,9 @@ export default defineComponent({
       regionFilterMethod,
       regionFilterRef,
       regionFilter,
+      superClusterLocked,
+      runButtonTone,
+      superClusterLockedReason,
       resetRegionFilter,
       cancelQuery,
       onLogsVisualizeToggleUpdate,
diff --git a/web/src/plugins/logs/SearchHistory.vue b/web/src/plugins/logs/SearchHistory.vue
index ccf43aa137..2406ae2b62 100644
--- a/web/src/plugins/logs/SearchHistory.vue
+++ b/web/src/plugins/logs/SearchHistory.vue
@@ -347,6 +347,7 @@ import { COL } from "@/lib/core/Table/OTable.types";
 
 import { logsUtils } from "@/composables/useLogs/logsUtils";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { copyToClipboard } from "@/utils/clipboard";
 
 const QueryEditor = defineAsyncComponent(() => import("@/components/CodeQueryEditor.vue"));
@@ -421,7 +422,7 @@ export default defineComponent({
     const columnsToBeRendered = ref<OTableColumnDef[]>([]);
     const expandedIds = ref<string[]>([]);
     const isLoading = ref(false);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     const moreDetailsToDisplay = ref("");
 
     const { extractTimestamps } = logsUtils();
@@ -581,7 +582,7 @@ export default defineComponent({
           setTimeout(() => oTableRef.value?.restorePage?.(currentPage.value), 0);
         }
       } catch (error: any) {
-        forbidden.value = error?.response?.status === 403;
+        forbidden.value = forbiddenState(error);
         if (!forbidden.value) {
           toast({
             variant: "error",
diff --git a/web/src/plugins/logs/SearchResult.spec.ts b/web/src/plugins/logs/SearchResult.spec.ts
index 5b6a457456..9f63be7f52 100644
--- a/web/src/plugins/logs/SearchResult.spec.ts
+++ b/web/src/plugins/logs/SearchResult.spec.ts
@@ -1528,6 +1528,15 @@ describe("SearchResult Component", () => {
       expect(bar.classList.contains("h-9")).toBe(false);
     });
   });
+
+  describe("correlation under a license lock", () => {
+    it("starts no correlation lookup while the license locks correlation", async () => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: { correlation: "locked" } };
+      await wrapper.vm.openCorrelationFromLog({ _timestamp: 1, service: "checkout" });
+      expect(wrapper.vm.correlationLoading).toBe(false);
+      expect(wrapper.vm.correlationContext).toBeNull();
+    });
+  });
 });
 
 describe("SearchResult rows while a search re-runs", () => {
diff --git a/web/src/plugins/logs/SearchResult.vue b/web/src/plugins/logs/SearchResult.vue
index 14061a4e37..206effa645 100644
--- a/web/src/plugins/logs/SearchResult.vue
+++ b/web/src/plugins/logs/SearchResult.vue
@@ -972,6 +972,7 @@ import { matchDetailRow, trustworthyFields } from "@/utils/logs/detailRowMatch";
 import { acceptsPageLoad, type PageLoad, type PendingPageSelection } from "@/utils/pageCrossing";
 import type { TelemetryContext } from "@/utils/telemetryCorrelation";
 import { useServiceCorrelation } from "@/composables/useServiceCorrelation";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { buildChipDimensionsFromFilters } from "@/services/service_streams";
 import { buildWorkloadChipDimensions } from "@/composables/useMetricSubjectButtons";
 import { extractSeverity } from "@/utils/sourceEventSeverity";
@@ -1499,6 +1500,7 @@ export default defineComponent({
 
     // Flag to prevent duplicate correlation API calls
     const correlationFetchInProgress = ref(false);
+    const { locked: correlationLicenseLocked } = useLicenseLock("correlation");
 
     const shouldShowInlineDialog = computed(() => {
       return (
@@ -1869,7 +1871,7 @@ export default defineComponent({
 
     const openCorrelationFromLog = async (logData: any) => {
       // Prevent duplicate calls - if a fetch is already in progress, skip
-      if (correlationFetchInProgress.value) {
+      if (correlationFetchInProgress.value || correlationLicenseLocked.value) {
         return;
       }
 
diff --git a/web/src/plugins/logs/SearchSchedulersList.vue b/web/src/plugins/logs/SearchSchedulersList.vue
index 380e56b99c..6631f105c3 100644
--- a/web/src/plugins/logs/SearchSchedulersList.vue
+++ b/web/src/plugins/logs/SearchSchedulersList.vue
@@ -367,6 +367,7 @@ import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { copyToClipboard } from "@/utils/clipboard";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
@@ -418,7 +419,7 @@ export default defineComponent({
     );
     const expandedIds = ref<string[]>([]);
     const isLoading = ref(false);
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     const showSearchResults = ref(false);
     const toBeCancelled = ref({});
     const confirmCancel = ref(false);
@@ -594,7 +595,7 @@ export default defineComponent({
             }
           })
           .catch((e) => {
-            forbidden.value = e?.response?.status === 403;
+            forbidden.value = forbiddenState(e);
             if (!forbidden.value) {
               toast({
                 variant: "error",
diff --git a/web/src/plugins/logs/VisualizeLogsQuery.vue b/web/src/plugins/logs/VisualizeLogsQuery.vue
index 3b5c60f6f9..83e010dd5a 100644
--- a/web/src/plugins/logs/VisualizeLogsQuery.vue
+++ b/web/src/plugins/logs/VisualizeLogsQuery.vue
@@ -60,6 +60,7 @@ import {
 } from "vue";
 import { useI18nTyped } from "@/types/i18n";
 import { useStore } from "vuex";
+import { featureState } from "@/utils/featureGate";
 import useDashboardPanelData from "@/composables/dashboard/useDashboardPanel";
 import useNotifications from "@/composables/useNotifications";
 import { isSimpleSelectAllQuery } from "@/utils/query/sqlUtils";
@@ -131,7 +132,10 @@ export default defineComponent({
     const errorDataModel = computed(() => props.errorData);
 
     const regionClusterParams = computed(() => {
-      if (store.state.zoConfig?.super_cluster_enabled) {
+      if (
+        store.state.zoConfig?.super_cluster_enabled &&
+        featureState(store.state.zoConfig?.features, "super_cluster") !== "locked"
+      ) {
         return {
           regions: searchObj.meta.regions,
           clusters: searchObj.meta.clusters,
diff --git a/web/src/plugins/logs/patterns/PatternDetailsDialog.spec.ts b/web/src/plugins/logs/patterns/PatternDetailsDialog.spec.ts
index df6ce6c6e2..9f4127d607 100644
--- a/web/src/plugins/logs/patterns/PatternDetailsDialog.spec.ts
+++ b/web/src/plugins/logs/patterns/PatternDetailsDialog.spec.ts
@@ -42,6 +42,8 @@ const ODrawerStub = {
 // Stub OButton so we can read the disabled prop directly (the underlying
 // reka-ui button does not always project a DOM `disabled` attribute), and
 // click events still fire the bound @click handler.
+const TooltipStub = { template: "<div><slot /></div>" };
+
 const OButtonStub = {
   name: "OButton",
   props: ["variant", "size", "disabled", "loading"],
@@ -185,6 +187,27 @@ describe("PatternDetailsDialog", () => {
       expect(wrapper.emitted("create-alert")![0]).toEqual([mockSelectedPattern.pattern]);
       expect(wrapper.emitted("update:modelValue")![0]).toEqual([false]);
     });
+
+    it("disables create-alert with a lock and emits nothing when the license locks alerts", async () => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: { alerts: "locked" } };
+      try {
+        const locked = mount(PatternDetailsDialog, {
+          props: { modelValue: true, selectedPattern: mockSelectedPattern, totalPatterns },
+          global: { ...globalConfig, stubs: { ...globalConfig.stubs, OTooltip: TooltipStub } },
+        });
+        const btn = locked.find('[data-test="pattern-detail-create-alert-btn"]');
+        const btnComponent = locked
+          .findAllComponents(OButtonStub)
+          .find((c: any) => c.attributes("data-test") === "pattern-detail-create-alert-btn");
+        expect(btnComponent?.props("disabled")).toBeDefined();
+        expect(locked.find('[data-test="pattern-detail-create-alert-lock"]').exists()).toBe(true);
+        await btn.trigger("click");
+        expect(locked.emitted("create-alert")).toBeUndefined();
+        locked.unmount();
+      } finally {
+        store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+      }
+    });
   });
 
   describe("ODrawer wrapper", () => {
diff --git a/web/src/plugins/logs/patterns/PatternDetailsDialog.vue b/web/src/plugins/logs/patterns/PatternDetailsDialog.vue
index 871fe5aa50..d0db5387c2 100644
--- a/web/src/plugins/logs/patterns/PatternDetailsDialog.vue
+++ b/web/src/plugins/logs/patterns/PatternDetailsDialog.vue
@@ -104,7 +104,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <template #icon-left><NotEqualIcon class="size-2.5" /></template>
               {{ t("logs.patternList.excludeFromQuery") }}
             </OButton>
+            <OTooltip v-if="alertsLocked" :content="alertsLockedReason">
+              <span class="inline-flex">
+                <OButton
+                  variant="warning"
+                  size="xs"
+                  disabled
+                  data-test="pattern-detail-create-alert-btn"
+                >
+                  <template #icon-left>
+                    <OIcon
+                      name="lock"
+                      class="lock-chip"
+                      size="sm"
+                      data-test="pattern-detail-create-alert-lock"
+                    />
+                  </template>
+                  {{ t("logs.patternList.createAlertAction") }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
+              v-else
               variant="warning"
               size="xs"
               icon-left="notifications"
@@ -362,6 +383,8 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import EqualIcon from "@/components/icons/EqualIcon.vue";
 import NotEqualIcon from "@/components/icons/NotEqualIcon.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
@@ -394,6 +417,7 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const { locked: alertsLocked, lockedReason: alertsLockedReason } = useLicenseLock("alerts");
 
 // Window-wide occurrences for the selected pattern, read from the SAME cache the
 // rows use. Opening a row is therefore a cache hit and shows its real count
@@ -435,7 +459,7 @@ const onExclude = () => {
   emit("update:modelValue", false);
 };
 const onCreateAlert = () => {
-  if (!props.selectedPattern) return;
+  if (!props.selectedPattern || alertsLocked.value) return;
   emit("create-alert", props.selectedPattern.pattern);
   emit("update:modelValue", false);
 };
diff --git a/web/src/plugins/metrics/AddToDashboard.spec.ts b/web/src/plugins/metrics/AddToDashboard.spec.ts
index 227db684c4..0b342427ed 100644
--- a/web/src/plugins/metrics/AddToDashboard.spec.ts
+++ b/web/src/plugins/metrics/AddToDashboard.spec.ts
@@ -157,6 +157,8 @@ const createWrapper = (props: Record<string, any> = {}) => {
       ...props,
     },
     global: {
+      // The setup file loads useFeatureLock before this spec's vuex mock, so it injects the store by key.
+      provide: { store: mockStore },
       stubs: {
         ODialog: ODialogStub,
         OForm: {
@@ -1292,3 +1294,27 @@ describe("AddToDashboard — remembers the last dashboard", () => {
     expect(wrapper.vm.activeFolderId).toBe("default");
   });
 });
+
+describe("AddToDashboard — license lock", () => {
+  beforeEach(() => vi.clearAllMocks());
+  afterEach(() => {
+    delete (mockStore.state as any).zoConfig;
+    vi.clearAllMocks();
+  });
+
+  it("keeps the dialog closed and lists no folders while dashboards is locked", async () => {
+    (mockStore.state as any).zoConfig = { features: { dashboards: "locked" } };
+    const wrapper = createWrapper();
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "ODialog" }).props("open")).toBe(false);
+    expect(mockGetFoldersList).not.toHaveBeenCalled();
+  });
+
+  it("opens and lists folders while dashboards is enabled", async () => {
+    (mockStore.state as any).zoConfig = { features: { dashboards: "enabled" } };
+    const wrapper = createWrapper();
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "ODialog" }).props("open")).toBe(true);
+    expect(mockGetFoldersList).toHaveBeenCalledWith(mockStore);
+  });
+});
diff --git a/web/src/plugins/metrics/AddToDashboard.vue b/web/src/plugins/metrics/AddToDashboard.vue
index c128176fbd..51b6123293 100644
--- a/web/src/plugins/metrics/AddToDashboard.vue
+++ b/web/src/plugins/metrics/AddToDashboard.vue
@@ -1,6 +1,6 @@
 <template>
   <ODialog
-    :open="open"
+    :open="open && !dashboardsLocked"
     size="md"
     :title="t('dashboard.addDashboard')"
     :secondary-button-label="t('metrics.addToDashboardPage.cancel')"
@@ -95,6 +95,7 @@ import { useRouter } from "vue-router";
 import useNotifications from "@/composables/useNotifications";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import analytics from "@/services/product_analytics";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import {
   makeAddToDashboardSchema,
   addToDashboardDefaults,
@@ -165,6 +166,7 @@ export default defineComponent({
     const activeFolderId = ref("default");
     const activeTabId: any = ref(null);
     const { t } = useI18nTyped();
+    const { locked: dashboardsLocked } = useLicenseLock("dashboards");
     const addToDashboardSchema = makeAddToDashboardSchema(t);
     // Each panel brings its own title, so the hidden title field must not block submit.
     const multiPanelSchema = z.object({ panelTitle: z.string() });
@@ -208,7 +210,7 @@ export default defineComponent({
     watch(
       () => props.open,
       async (isOpen) => {
-        if (isOpen) {
+        if (isOpen && !dashboardsLocked.value) {
           rememberedTarget.value = readRememberedTarget();
           await getFoldersList(store);
           const folderId = rememberedTarget.value?.folderId;
@@ -362,6 +364,7 @@ export default defineComponent({
       activeFolderId,
       activeTabId,
       updateSelectedDashboard,
+      dashboardsLocked,
     };
   },
 });
diff --git a/web/src/plugins/metrics/explorer/MetricBreakdown.spec.ts b/web/src/plugins/metrics/explorer/MetricBreakdown.spec.ts
index 85ba9b2c1c..286924684b 100644
--- a/web/src/plugins/metrics/explorer/MetricBreakdown.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricBreakdown.spec.ts
@@ -1781,6 +1781,25 @@ describe("MetricBreakdown", () => {
       wrapper = mountBreakdown({ selectedLabel: "method" });
       await flushPromises();
       expect(button(wrapper).text()).toBe("Add to dashboard");
+      expect(wrapper.find('[data-test="metrics-breakdown-add-to-dashboard-lock"]').exists()).toBe(
+        false,
+      );
+    });
+
+    it("is disabled with a lock and opens no dialog when the license locks dashboards", async () => {
+      store.state.zoConfig = { ...store.state.zoConfig, features: { dashboards: "locked" } };
+      try {
+        wrapper = mountBreakdown({ selectedLabel: "method" });
+        await flushPromises();
+        expect(button(wrapper).attributes("disabled")).toBeDefined();
+        expect(wrapper.find('[data-test="metrics-breakdown-add-to-dashboard-lock"]').exists()).toBe(
+          true,
+        );
+        await button(wrapper).trigger("click");
+        expect(dialog(wrapper).props("open")).toBeFalsy();
+      } finally {
+        store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+      }
     });
 
     it("hands the dialog a panel that reproduces the focused chart", async () => {
diff --git a/web/src/plugins/metrics/explorer/MetricBreakdown.vue b/web/src/plugins/metrics/explorer/MetricBreakdown.vue
index 86c976ea2b..d3f1c8d2c6 100644
--- a/web/src/plugins/metrics/explorer/MetricBreakdown.vue
+++ b/web/src/plugins/metrics/explorer/MetricBreakdown.vue
@@ -82,7 +82,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           />
           <div class="flex-1" />
           <!-- Only once the chart has drawn: the panel's decimals come from its values. -->
+          <OTooltip v-if="dashboardsLocked" :content="dashboardsLockedReason">
+            <span class="inline-flex shrink-0">
+              <OButton
+                variant="ghost"
+                size="xs"
+                disabled
+                data-test="metrics-breakdown-add-to-dashboard"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="lock-chip"
+                    size="sm"
+                    data-test="metrics-breakdown-add-to-dashboard-lock"
+                  />
+                </template>
+                {{ t("metrics.explorer.detail.breakdown.addToDashboard") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
+            v-else
             variant="ghost"
             size="xs"
             icon-left="dashboard-customize"
@@ -436,6 +457,8 @@ import MetricOverlayKey from "./MetricOverlayKey.vue";
 import AddToDashboard from "../AddToDashboard.vue";
 import PanelBar from "@/components/common/PanelBar.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
@@ -576,6 +599,7 @@ export default defineComponent({
     AddToDashboard,
     PanelBar,
     OButton,
+    OIcon,
     OTag,
     OEmptyState,
     OBanner,
@@ -625,6 +649,8 @@ export default defineComponent({
   setup(props, { emit }) {
     const { t } = useI18nTyped();
     const store = useStore();
+    const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+      useLicenseLock("dashboards");
 
     /** The stream the card's default query reads — `_count` for the exp fallback. */
     const valuesStream = computed(() => operandStreamsOf(props.card)[0]);
@@ -1264,6 +1290,8 @@ export default defineComponent({
       dashboardPanel,
       dashboardPanelTitle,
       openAddToDashboard,
+      dashboardsLocked,
+      dashboardsLockedReason,
     };
   },
 });
diff --git a/web/src/plugins/metrics/explorer/MetricDetailView.spec.ts b/web/src/plugins/metrics/explorer/MetricDetailView.spec.ts
index 5142399b79..aa71fbba7c 100644
--- a/web/src/plugins/metrics/explorer/MetricDetailView.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricDetailView.spec.ts
@@ -777,6 +777,42 @@ describe("MetricDetailView", () => {
         (config as any).isEnterprise = "true";
       });
 
+      describe("when the license locks correlation", () => {
+        beforeEach(() => {
+          store.state.zoConfig = { ...store.state.zoConfig, features: { correlation: "locked" } };
+        });
+        afterEach(() => {
+          store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+        });
+
+        it("is disabled with the lock, no menu, and reads nothing", async () => {
+          wrapper = mountView();
+          await flushPromises();
+          expect(button().attributes("disabled")).toBeDefined();
+          expect(button().find('[data-test="metrics-detail-drilldown-lock"]').exists()).toBe(true);
+          expect(isMenuTrigger()).toBe(false);
+          expect(drilldownApi.getIdentityConfig).not.toHaveBeenCalled();
+          expect(drilldownApi.getSemanticGroups).not.toHaveBeenCalled();
+          expect(drilldownApi.correlate).not.toHaveBeenCalled();
+        });
+      });
+
+      it("locks the stream items of a locked signal only", async () => {
+        wrapper = mountView();
+        await flushPromises();
+        const vm = wrapper.vm as any;
+        expect(vm.isSignalLocked("logs")).toBe(false);
+        expect(vm.isSignalLocked("traces")).toBe(false);
+        store.state.zoConfig = { ...store.state.zoConfig, features: { traces: "locked" } };
+        try {
+          expect(vm.isSignalLocked("logs")).toBe(false);
+          expect(vm.isSignalLocked("traces")).toBe(true);
+          expect(vm.signalLockedReason("traces")).toMatch(/needs traces/i);
+        } finally {
+          store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+        }
+      });
+
       it("is an enabled dropdown trigger when service discovery is on", async () => {
         wrapper = mountView();
         await flushPromises();
diff --git a/web/src/plugins/metrics/explorer/MetricDetailView.vue b/web/src/plugins/metrics/explorer/MetricDetailView.vue
index ede85ff267..598981892e 100644
--- a/web/src/plugins/metrics/explorer/MetricDetailView.vue
+++ b/web/src/plugins/metrics/explorer/MetricDetailView.vue
@@ -251,16 +251,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   <ODropdownItem
                     v-for="item in drilldownMenu[signal]"
                     :key="item.name"
-                    :disabled="!item.openable"
+                    :disabled="!item.openable || isSignalLocked(signal)"
+                    focusable-unavailable
+                    :icon-left="isSignalLocked(signal) ? 'lock' : undefined"
+                    :description="
+                      isSignalLocked(signal)
+                        ? signalLockedReason(signal)
+                        : item.openable
+                          ? undefined
+                          : t('metrics.explorer.detail.drilldown.noServiceField')
+                    "
                     :data-test="`metrics-detail-drilldown-${signal}-${item.name}`"
                     @select="drilldown.openStream(signal, item)"
                   >
-                    <span class="flex min-w-0 flex-col">
-                      <span class="truncate">{{ raw(item.name) }}</span>
-                      <span v-if="!item.openable" class="text-text-secondary text-xs">{{
-                        t("metrics.explorer.detail.drilldown.noServiceField")
-                      }}</span>
-                    </span>
+                    <span class="truncate">{{ raw(item.name) }}</span>
                   </ODropdownItem>
                   <ODropdownItem v-if="!drilldownMenu[signal].length" disabled>
                     {{
@@ -286,8 +290,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :aria-label="t('metrics.explorer.detail.drilldown.button')"
                 data-test="metrics-detail-drilldown"
               >
-                <template v-if="drilldown.availability.value === 'oss'" #icon-left>
-                  <OIcon name="lock" size="sm" data-test="metrics-detail-drilldown-lock" />
+                <template
+                  v-if="
+                    drilldown.availability.value === 'oss' ||
+                    drilldown.availability.value === 'licenseLocked'
+                  "
+                  #icon-left
+                >
+                  <OIcon
+                    name="lock"
+                    class="lock-chip"
+                    size="sm"
+                    data-test="metrics-detail-drilldown-lock"
+                  />
                 </template>
                 <span class="max-md:hidden">{{
                   t("metrics.explorer.detail.drilldown.button")
@@ -631,6 +646,8 @@ import { useStore } from "vuex";
 import { useRouter } from "vue-router";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useMetricDrilldown } from "@/composables/metrics/useMetricDrilldown";
+import { useLicenseLock, useLicenseLocks } from "@/composables/useFeatureLock";
+import { streamTypeFeature } from "@/utils/featureGate";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import CreateAlertAction from "@/components/alerts/CreateAlertAction.vue";
 import { buildPrefillFromPanel } from "@/utils/alerts/prefill/fromPanel";
@@ -889,6 +906,11 @@ export default defineComponent({
     const overviewState = ref<OverviewState>(IDLE);
 
     const router = useRouter();
+    const correlationLock = useLicenseLock("correlation");
+    const signalLocks = useLicenseLocks();
+    const isSignalLocked = (signal: string) => signalLocks.isLocked(streamTypeFeature(signal));
+    const signalLockedReason = (signal: string) =>
+      signalLocks.lockedReason(streamTypeFeature(signal) ?? signal);
     const drilldown = useMetricDrilldown({
       org: () => store.state.selectedOrganization?.identifier ?? "",
       metric: () => (props.card ? { name: props.card.name, labels: props.card.labels } : null),
@@ -898,6 +920,7 @@ export default defineComponent({
       inapplicableFilters: () => props.inapplicableFilters,
       timeRange: () => props.timeRange,
       serviceStreamsEnabled: () => !!store.state.zoConfig?.service_streams_enabled,
+      licenseLocked: () => correlationLock.locked.value,
       router,
       store,
       onDropped: (labels) =>
@@ -912,6 +935,7 @@ export default defineComponent({
     const drilldownBlockedReason = computed(() => {
       const state = drilldown.availability.value;
       if (state === "oss") return t("metrics.explorer.detail.drilldown.enterprise");
+      if (state === "licenseLocked") return correlationLock.lockedReason.value;
       if (state === "discoveryOff") return t("metrics.explorer.detail.drilldown.discoveryOff");
       if (state === "pending") return t("metrics.explorer.detail.drilldown.checking");
       return t("metrics.explorer.detail.drilldown.forbidden");
@@ -1215,6 +1239,8 @@ export default defineComponent({
       drilldown,
       drilldownMenu,
       drilldownBlockedReason,
+      isSignalLocked,
+      signalLockedReason,
       onDrilldownOpen,
       onDrilldownPick,
       onDrilldownRetry,
diff --git a/web/src/plugins/metrics/explorer/MetricUsageList.spec.ts b/web/src/plugins/metrics/explorer/MetricUsageList.spec.ts
index 9cb659904a..6081162acb 100644
--- a/web/src/plugins/metrics/explorer/MetricUsageList.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricUsageList.spec.ts
@@ -88,6 +88,21 @@ describe("MetricUsageList", () => {
     expect(find(wrapper, "metrics-detail-used-in-dashboards").exists()).toBe(false);
   });
 
+  it("marks only the groups whose feature is license-locked", () => {
+    const zo = (store.state as any).zoConfig;
+    const prior = zo.features;
+    zo.features = { alerts: "locked", anomaly_detection: "locked" };
+    try {
+      wrapper = mountList({ usage: USAGE, status: "done" });
+      expect(find(wrapper, "metrics-detail-used-in-lock-alerts").exists()).toBe(true);
+      expect(find(wrapper, "metrics-detail-used-in-lock-slos").exists()).toBe(true);
+      expect(find(wrapper, "metrics-detail-used-in-lock-dashboards").exists()).toBe(false);
+      expect(find(wrapper, "metrics-detail-used-in-lock-pipelines").exists()).toBe(false);
+    } finally {
+      zo.features = prior;
+    }
+  });
+
   it("says how many queries were matched only by name, and marks those objects", () => {
     wrapper = mountList({ usage: USAGE, status: "done" });
     expect(find(wrapper, "metrics-detail-used-in-unparsed").text()).toContain(
diff --git a/web/src/plugins/metrics/explorer/MetricUsageList.vue b/web/src/plugins/metrics/explorer/MetricUsageList.vue
index e2db5c4edf..97d8c1354c 100644
--- a/web/src/plugins/metrics/explorer/MetricUsageList.vue
+++ b/web/src/plugins/metrics/explorer/MetricUsageList.vue
@@ -62,7 +62,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="mb-4"
         :data-test="`metrics-detail-used-in-${group.kind}`"
       >
-        <h3 class="text-text-secondary mb-1 text-xs font-semibold">{{ group.label }}</h3>
+        <h3 class="text-text-secondary mb-1 flex items-center gap-1 text-xs font-semibold">
+          {{ group.label }}
+          <OTooltip v-if="isLocked(group.feature)" :content="lockedReason(group.feature)">
+            <span tabindex="0" class="inline-flex">
+              <OIcon
+                name="lock"
+                size="xs"
+                class="text-icon-locked"
+                :data-test="`metrics-detail-used-in-lock-${group.kind}`"
+              />
+              <span class="sr-only">{{ lockedReason(group.feature) }}</span>
+            </span>
+          </OTooltip>
+        </h3>
         <ul class="flex flex-col gap-1">
           <li v-for="item in group.items" :key="item.id" class="flex items-center gap-2">
             <router-link
@@ -105,12 +118,15 @@ import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 import type { MetricUsage, MetricUsageEntry } from "@/services/metrics";
 
 interface UsageGroup {
   kind: "dashboards" | "alerts" | "slos" | "pipelines";
+  feature: string;
   label: I18nText;
   items: MetricUsageEntry[];
   to: (item: MetricUsageEntry) => RouteLocationRaw;
@@ -125,6 +141,7 @@ const emit = defineEmits<{ retry: [] }>();
 
 const { t } = useI18nTyped();
 const store = useStore();
+const { isLocked, lockedReason } = useLicenseLocks();
 
 const groups = computed<UsageGroup[]>(() => {
   const usage = props.usage;
@@ -133,6 +150,7 @@ const groups = computed<UsageGroup[]>(() => {
   const all: UsageGroup[] = [
     {
       kind: "dashboards",
+      feature: "dashboards",
       label: t("metrics.explorer.detail.usedIn.dashboards", { count: usage.dashboards.length }),
       items: usage.dashboards,
       to: (item) => ({
@@ -142,6 +160,7 @@ const groups = computed<UsageGroup[]>(() => {
     },
     {
       kind: "alerts",
+      feature: "alerts",
       label: t("metrics.explorer.detail.usedIn.alerts", { count: usage.alerts.length }),
       items: usage.alerts,
       to: (item) => ({
@@ -152,6 +171,7 @@ const groups = computed<UsageGroup[]>(() => {
     },
     {
       kind: "slos",
+      feature: "anomaly_detection",
       label: t("metrics.explorer.detail.usedIn.slos", { count: usage.slos.length }),
       items: usage.slos,
       to: (item) => ({
@@ -162,6 +182,7 @@ const groups = computed<UsageGroup[]>(() => {
     },
     {
       kind: "pipelines",
+      feature: "pipelines",
       label: t("metrics.explorer.detail.usedIn.pipelines", { count: usage.pipelines.length }),
       items: usage.pipelines,
       to: (item) => ({
diff --git a/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts b/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
index c255d27506..d319994c24 100644
--- a/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
+++ b/web/src/plugins/metrics/explorer/MetricsExplorer.spec.ts
@@ -15,7 +15,7 @@
 
 import { describe, it, expect, vi, beforeEach, afterEach, onTestFinished } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
-import { reactive, computed, ref } from "vue";
+import { reactive, computed, ref, nextTick } from "vue";
 import {
   getMetricsConfig,
   encodeMetricsConfig,
@@ -194,9 +194,13 @@ const visualizeApplyPanelData = vi.fn();
  *  Visualize; null/query-less means "blank canvas, nothing to share". */
 let visualizePanel: any = null;
 
-const mountExplorer = (stubOverrides: Record<string, any> = {}) =>
+const mountExplorer = (
+  stubOverrides: Record<string, any> = {},
+  provide: Record<string, unknown> = {},
+) =>
   mount(MetricsExplorer, {
     global: {
+      provide,
       stubs: {
         OPageHeader: true,
         DateTimePickerDashboard: true,
@@ -589,6 +593,34 @@ describe("MetricsExplorer wiring", () => {
       expect((wrapper.vm as any).convertDialogOpen).toBe(true);
     });
 
+    it("renders the convert button disabled with a lock when the license locks dashboards", async () => {
+      (storeState.zoConfig as any).features = { dashboards: "locked" };
+      try {
+        const wrapper = mountExplorer(
+          {
+            OTooltip: { template: "<div><slot /></div>" },
+            OButton: {
+              props: { disabled: Boolean },
+              template: '<button :disabled="disabled"><slot name="icon-left" /><slot /></button>',
+            },
+            OIcon: { template: "<i />" },
+          },
+          // useFeatureLock reaches vuex before this file's mock applies, so it injects the store.
+          { store: { state: storeState } },
+        );
+        (wrapper.vm as any).setMode("workspace");
+        grid.favorites.value = ["http_requests_total"];
+        await nextTick();
+        const btn = wrapper.find('[data-test="metrics-explorer-convert-dashboard"]');
+        expect(btn.attributes("disabled")).toBeDefined();
+        expect(wrapper.find('[data-test="metrics-explorer-convert-dashboard-lock"]').exists()).toBe(
+          true,
+        );
+      } finally {
+        delete (storeState.zoConfig as any).features;
+      }
+    });
+
     it("does nothing when nothing is pinned", () => {
       const wrapper = mountExplorer();
       grid.favorites.value = [];
diff --git a/web/src/plugins/metrics/explorer/MetricsExplorer.vue b/web/src/plugins/metrics/explorer/MetricsExplorer.vue
index 4683b562a3..a903cbfce9 100644
--- a/web/src/plugins/metrics/explorer/MetricsExplorer.vue
+++ b/web/src/plugins/metrics/explorer/MetricsExplorer.vue
@@ -510,8 +510,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
           <!-- Convert to dashboard: each favourite becomes a panel. FAVOURITES
                only, where they are what's on screen. -->
+          <OTooltip
+            v-if="isWorkspace && grid.favorites.value.length && dashboardsLocked"
+            :content="dashboardsLockedReason"
+          >
+            <span class="inline-flex">
+              <OButton
+                variant="outline"
+                size="sm-action"
+                disabled
+                data-test="metrics-explorer-convert-dashboard"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="lock-chip"
+                    size="sm"
+                    data-test="metrics-explorer-convert-dashboard-lock"
+                  />
+                </template>
+                {{ t("metrics.explorer.convertToDashboard") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
-            v-if="isWorkspace && grid.favorites.value.length"
+            v-else-if="isWorkspace && grid.favorites.value.length"
             variant="outline"
             size="sm-action"
             icon-left="dashboard-customize"
@@ -788,6 +811,7 @@ import AutoRefreshInterval from "@/components/AutoRefreshInterval.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OPageHeaderStatus from "@/lib/core/PageHeader/OPageHeaderStatus.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import OCheckboxGroup from "@/lib/forms/Checkbox/OCheckboxGroup.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
@@ -927,6 +951,8 @@ export default defineComponent({
       );
     };
     const store = useStore();
+    const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+      useLicenseLock("dashboards");
     const router = useRouter();
     const route = useRoute();
     const grid = useMetricsExplorerGrid(t);
@@ -2477,6 +2503,8 @@ export default defineComponent({
       onApplyOverride,
       onRestoreOverride,
       openConvertToDashboard,
+      dashboardsLocked,
+      dashboardsLockedReason,
       panelRateWindowFor,
       convertPanels,
       convertDialogOpen,
diff --git a/web/src/plugins/traces/DbSpanDetails.spec.ts b/web/src/plugins/traces/DbSpanDetails.spec.ts
index fea184e299..a0ca648078 100644
--- a/web/src/plugins/traces/DbSpanDetails.spec.ts
+++ b/web/src/plugins/traces/DbSpanDetails.spec.ts
@@ -2,6 +2,8 @@
 import { describe, expect, it, afterEach, vi } from "vitest";
 import { mount, VueWrapper, config } from "@vue/test-utils";
 import i18n from "@/locales";
+import { createStore } from "vuex";
+import { createRouter, createMemoryHistory } from "vue-router";
 
 config.global.plugins = [...(config.global.plugins ?? []), i18n];
 
@@ -273,6 +275,34 @@ describe("DbSpanDetails", () => {
     });
   });
 
+  describe("view query trend license lock", () => {
+    const mountWithFeatures = (features: Record<string, string>) => {
+      const store = createStore({
+        state: { zoConfig: { database_monitoring_enabled: true, features } },
+      });
+      const router = createRouter({
+        history: createMemoryHistory(),
+        routes: [{ path: "/:p(.*)*", component: { template: "<div />" } }],
+      });
+      return mount(DbSpanDetails, {
+        props: { span: { o2_db_fingerprint: "fp1" } },
+        global: { plugins: [store, router] },
+      });
+    };
+    const trend = '[data-test="traces-db-span-details-view-trend"]';
+
+    it("renders the trend button disabled with a lock when db_monitoring is locked", () => {
+      wrapper = mountWithFeatures({ db_monitoring: "locked" });
+      expect(wrapper.find(trend).attributes("disabled")).toBeDefined();
+      expect(wrapper.find(trend).findComponent({ name: "OIcon" }).props("name")).toBe("lock");
+    });
+
+    it("keeps the enabled trend button when db_monitoring is enabled", () => {
+      wrapper = mountWithFeatures({ db_monitoring: "enabled" });
+      expect(wrapper.find(trend).attributes("disabled")).toBeUndefined();
+    });
+  });
+
   describe("performance section", () => {
     it("should not render performance section when no performance data present", () => {
       wrapper = mountDbSpanDetails({ db_system: "postgresql" });
diff --git a/web/src/plugins/traces/DbSpanDetails.vue b/web/src/plugins/traces/DbSpanDetails.vue
index abaab584ca..bbab40825e 100644
--- a/web/src/plugins/traces/DbSpanDetails.vue
+++ b/web/src/plugins/traces/DbSpanDetails.vue
@@ -9,6 +9,9 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OCollapsible from "@/lib/core/Collapsible/OCollapsible.vue";
 import OCard from "@/lib/core/Card/OCard.vue";
 import OCardSection from "@/lib/core/Card/OCardSection.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
 // This panel is mounted inside the trace sidebar and in isolation, so the store
@@ -37,6 +40,8 @@ const dbmEnabled = computed(() => Boolean(store?.state?.zoConfig?.database_monit
 
 const fingerprint = computed(() => String(props.span.o2_db_fingerprint ?? ""));
 
+const { locked: dbmLocked, lockedReason: dbmLockedReason } = useLicenseLock("db_monitoring");
+
 const canViewTrend = computed(() => dbmEnabled.value && !!fingerprint.value && !!router);
 
 const openQueryTrend = () => {
@@ -132,7 +137,24 @@ const metadataRows = computed(() =>
 
 <template>
   <div class="flex h-full flex-col gap-3 overflow-auto">
-    <div v-if="canViewTrend" class="flex justify-end">
+    <div v-if="dbmLocked && fingerprint" class="flex justify-end">
+      <OTooltip :content="dbmLockedReason">
+        <span class="inline-flex">
+          <OButton
+            variant="outline"
+            size="sm-action"
+            disabled
+            data-test="traces-db-span-details-view-trend"
+          >
+            <template #icon-left>
+              <OIcon name="lock" class="lock-chip" size="sm" />
+            </template>
+            {{ t("traces.dbSpanDetails.viewQueryTrend") }}
+          </OButton>
+        </span>
+      </OTooltip>
+    </div>
+    <div v-else-if="canViewTrend" class="flex justify-end">
       <OButton
         variant="outline"
         size="sm-action"
diff --git a/web/src/plugins/traces/LLMInsightsDashboard.vue b/web/src/plugins/traces/LLMInsightsDashboard.vue
index 0b4e9ec48f..573b09e4be 100644
--- a/web/src/plugins/traces/LLMInsightsDashboard.vue
+++ b/web/src/plugins/traces/LLMInsightsDashboard.vue
@@ -68,7 +68,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
              affordance when it can't apply is cleaner (ui-architect empty-affordance
              rule). The tooltip explains the concept when the entry IS available. -->
         <OTooltip
-          v-if="genAiAgentMappingAccess.allowed && canCompare && !compareMode"
+          v-if="aiObsLock.locked.value && !compareMode"
+          :content="aiObsLock.lockedReason.value"
+        >
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="sm"
+              disabled
+              icon-left="lock"
+              data-test="llm-insights-compare-license-locked"
+            >
+              {{ t("traces.lLMInsightsDashboard.compareEntry") }}
+            </OButton>
+          </span>
+        </OTooltip>
+        <OTooltip
+          v-else-if="genAiAgentMappingAccess.allowed && canCompare && !compareMode"
           :content="t('traces.lLMInsightsDashboard.compareEntryHint')"
         >
           <OButton
@@ -93,9 +109,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             data-test="llm-insights-compare-locked"
             @click="openUpgradeDialog"
           >
-            <template #icon-right
-              ><OIcon name="lock" size="sm" class="text-warning-600"
-            /></template>
+            <template #icon-right><OIcon name="lock" size="sm" class="lock-chip" /></template>
             {{ t("traces.lLMInsightsDashboard.compareEntry") }}
           </OButton>
         </template>
@@ -476,6 +490,7 @@ import VersionCompareView from "@/enterprise/components/AIObservability/VersionC
 import { useVersionCompare } from "./composables/useVersionCompare";
 import analytics from "@/services/product_analytics";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { buildFeatureGateContext, checkFeatureAccess } from "@/utils/enterpriseFeatures";
 
 const { t } = useI18nTyped();
@@ -599,13 +614,17 @@ const genAiAgentMappingAccess = checkFeatureAccess(
   buildFeatureGateContext(store.state.zoConfig),
 );
 const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+const aiObsLock = useLicenseLock("ai_observability");
 // The mode the user asked for (URL `type`/`agent`, else the remembered toggle),
 // or null when the agents list decides: Agent when the window has agents,
-// Stream when it has none (see loadInsights). OSS has no agent-mapping API, so
-// it is pinned to Stream. Until the mode is resolved the panels stay unmounted,
-// so they mount once, with the final mode, and no query is started and then
-// cancelled by a mode flip.
-const explicitMode = genAiAgentMappingAccess.allowed ? explicitScopeMode(urlScope) : "stream";
+// Stream when it has none (see loadInsights). OSS has no agent-mapping API and a
+// locked AI license cannot use it, so both are pinned to Stream. Until the mode
+// is resolved the panels stay unmounted, so they mount once, with the final
+// mode, and no query is started and then cancelled by a mode flip.
+const explicitMode =
+  genAiAgentMappingAccess.allowed && !aiObsLock.locked.value
+    ? explicitScopeMode(urlScope)
+    : "stream";
 const filterMode = ref<ScopeMode>(explicitMode ?? "stream");
 const modeExplicit = ref(explicitMode !== null);
 // False until the first loadInsights has settled the mode and the selection;
diff --git a/web/src/plugins/traces/ServiceGraphNodeSidePanel.spec.ts b/web/src/plugins/traces/ServiceGraphNodeSidePanel.spec.ts
index 1a7a59e982..3ed917794b 100644
--- a/web/src/plugins/traces/ServiceGraphNodeSidePanel.spec.ts
+++ b/web/src/plugins/traces/ServiceGraphNodeSidePanel.spec.ts
@@ -114,7 +114,7 @@ vi.mock("@/lib/feedback/Toast/useToast", () => ({
 
 import ServiceGraphNodeSidePanel from "./ServiceGraphNodeSidePanel.vue";
 import searchService from "@/services/search";
-import { correlate as correlateStreams } from "@/services/service_streams";
+import { correlate as correlateStreams, getDimensionAnalytics } from "@/services/service_streams";
 
 // ---------------------------------------------------------------------------
 // Shared fixtures
@@ -1460,3 +1460,95 @@ describe("ServiceGraphNodeSidePanel", () => {
     });
   });
 });
+
+describe("ServiceGraphNodeSidePanel — license locks", () => {
+  let wrapper: VueWrapper;
+  const LOGS_ITEM = '[data-test="service-graph-node-panel-view-related-logs-btn"]';
+  const DB_ITEM = '[data-test="service-graph-node-panel-view-related-databases-btn"]';
+  const TRACES_ITEM = '[data-test="service-graph-node-panel-view-related-traces-btn"]';
+  const METRICS_TAB = '[data-test="service-graph-node-panel-tab-metrics"]';
+
+  afterEach(() => {
+    wrapper?.unmount();
+    delete store.state.zoConfig.features;
+    vi.clearAllMocks();
+  });
+
+  it("locks the metrics tab and related logs without any correlation call when correlation is locked", async () => {
+    getStreamMock.mockResolvedValueOnce({ schema: [{ name: "service_name", type: "keyword" }] });
+    store.state.zoConfig.features = { correlation: "locked" };
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    await wrapper.find(METRICS_TAB).trigger("click");
+    await flushPromises();
+    expect(wrapper.find(METRICS_TAB).attributes("suffix-icon")).toBe("lock");
+    expect(
+      wrapper.find('[data-test="service-graph-side-panel-metrics-license-denied"]').exists(),
+    ).toBe(true);
+    expect(wrapper.find(LOGS_ITEM).attributes("disabled")).toBeDefined();
+    await wrapper.find(LOGS_ITEM).trigger("click");
+    await flushPromises();
+    expect(correlateStreams).not.toHaveBeenCalled();
+    expect(getDimensionAnalytics).not.toHaveBeenCalled();
+    expect(routerPushMock).not.toHaveBeenCalled();
+  });
+
+  it("keeps the correlation calls when correlation is enabled", async () => {
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    await wrapper.find(METRICS_TAB).trigger("click");
+    await flushPromises();
+    expect(wrapper.find(METRICS_TAB).attributes("suffix-icon")).toBeUndefined();
+    expect(correlateStreams).toHaveBeenCalled();
+  });
+
+  it("shows the related-databases item locked and does not navigate when db_monitoring is locked", async () => {
+    store.state.zoConfig.features = { db_monitoring: "locked" };
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    expect(wrapper.find(DB_ITEM).attributes("disabled")).toBeDefined();
+    await wrapper.find(DB_ITEM).trigger("click");
+    expect(routerPushMock).not.toHaveBeenCalled();
+  });
+
+  it("locks the related-logs item and does not navigate when logs is locked", async () => {
+    store.state.zoConfig.features = { logs: "locked" };
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    expect(wrapper.find(LOGS_ITEM).attributes("disabled")).toBeDefined();
+    await wrapper.find(LOGS_ITEM).trigger("click");
+    await flushPromises();
+    expect(routerPushMock).not.toHaveBeenCalled();
+  });
+
+  it("locks the related-traces item when traces is locked and leaves it live otherwise", async () => {
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    expect(wrapper.find(TRACES_ITEM).attributes("disabled")).toBe("false");
+    wrapper.unmount();
+    store.state.zoConfig.features = { traces: "locked" };
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    expect(wrapper.find(TRACES_ITEM).attributes("disabled")).toBe("true");
+    await wrapper.find(TRACES_ITEM).trigger("click");
+    await flushPromises();
+    expect(wrapper.emitted("view-traces")).toBeUndefined();
+  });
+
+  it("emits view-traces from View traces and row clicks only while traces is licensed", async () => {
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    const vm = wrapper.vm as any;
+    vm.viewInTraces();
+    vm.navigateToTraces({ operationName: "GET /" });
+    expect(wrapper.emitted("view-traces")).toHaveLength(2);
+    wrapper.unmount();
+
+    store.state.zoConfig.features = { traces: "locked" };
+    wrapper = mountPanel({ streamFilter: "default" });
+    await flushPromises();
+    (wrapper.vm as any).viewInTraces();
+    (wrapper.vm as any).navigateToTraces({ operationName: "GET /" });
+    expect(wrapper.emitted("view-traces")).toBeUndefined();
+  });
+});
diff --git a/web/src/plugins/traces/ServiceGraphNodeSidePanel.vue b/web/src/plugins/traces/ServiceGraphNodeSidePanel.vue
index 5610c0cb39..e36bfdc6a7 100644
--- a/web/src/plugins/traces/ServiceGraphNodeSidePanel.vue
+++ b/web/src/plugins/traces/ServiceGraphNodeSidePanel.vue
@@ -54,11 +54,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </OButton>
           </template>
           <ODropdownItem
+            :disabled="logsLocked || correlationLocked"
+            :focusable-unavailable="logsLocked || correlationLocked"
+            :icon-left="logsLocked || correlationLocked ? 'lock' : undefined"
+            :description="
+              logsLocked ? logsLockedReason : correlationLocked ? correlationLockedReason : null
+            "
             @select="viewRelatedLogs"
             data-test="service-graph-node-panel-view-related-logs-btn"
             >{{ t("traces.serviceGraphNodeSidePanel.logs") }}</ODropdownItem
           >
           <ODropdownItem
+            :disabled="tracesLocked"
+            :focusable-unavailable="tracesLocked"
+            :icon-left="tracesLocked ? 'lock' : undefined"
+            :description="tracesLocked ? tracesLockedReason : null"
             @select="viewRelatedTraces"
             data-test="service-graph-node-panel-view-related-traces-btn"
             >{{ t("traces.serviceGraphNodeSidePanel.traces") }}</ODropdownItem
@@ -67,7 +77,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                Database Monitoring already accepts a `service` scope; this is
                the entry point that sets it. Hidden when the feature is off. -->
           <ODropdownItem
-            v-if="dbmEnabled"
+            v-if="dbmEnabled || dbmLocked"
+            :disabled="dbmLocked"
+            :focusable-unavailable="dbmLocked"
+            :icon-left="dbmLocked ? 'lock' : undefined"
+            :description="dbmLocked ? dbmLockedReason : null"
             @select="viewRelatedDatabases"
             data-test="service-graph-node-panel-view-related-databases-btn"
             >{{ t("traces.serviceGraphNodeSidePanel.databases") }}</ODropdownItem
@@ -136,7 +150,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <div class="flex-1" />
 
           <!-- View in Traces button -->
+          <OTooltip v-if="tracesLocked" :content="tracesLockedReason">
+            <span class="inline-flex">
+              <OButton
+                variant="ghost-primary"
+                size="sm"
+                disabled
+                data-test="service-graph-side-panel-view-in-traces-btn"
+              >
+                <template #icon-left>
+                  <OIcon name="lock" class="text-icon-locked" size="xs" />
+                </template>
+                {{ t("traces.serviceGraphNodeSidePanel.viewTraces") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
+            v-else
             variant="ghost-primary"
             size="sm"
             data-test="service-graph-side-panel-view-in-traces-btn"
@@ -194,7 +224,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               v-if="isAgentBehaviorContext"
               name="behavior"
               :label="t('aiObservability.behavior.node.tabLabel')"
-              :suffix-icon="!agentBehaviorAccess.allowed ? 'lock' : undefined"
+              :suffix-icon="behaviorLocked ? 'lock' : undefined"
+              :tooltip="aiObsLocked ? aiObsLockedReason : undefined"
               class="capitalize"
               data-test="service-graph-node-panel-tab-behavior"
             />
@@ -210,6 +241,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               v-if="!isInferred"
               name="metrics"
               :label="t('traces.serviceGraphNodeSidePanel.metrics')"
+              :suffix-icon="correlationLocked ? 'lock' : undefined"
+              :tooltip="correlationLocked ? correlationLockedReason : undefined"
               class="capitalize"
               data-test="service-graph-node-panel-tab-metrics"
             />
@@ -299,12 +332,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :fill-height="false"
                 pagination="none"
                 @sort-change="(p: any) => handleSortChange(p.column)"
-                @row-click="
-                  (row: any) =>
-                    navigateToTraces({
-                      operationName: row.operation,
-                      callerService: isInferred ? row.caller : undefined,
-                    })
+                v-on="
+                  tracesLocked
+                    ? {}
+                    : {
+                        rowClick: (row: any) =>
+                          navigateToTraces({
+                            operationName: row.operation,
+                            callerService: isInferred ? row.caller : undefined,
+                          }),
+                      }
                 "
               >
                 <template #cell-errors="{ row }">
@@ -341,8 +378,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   />
                 </template>
                 <template #cell-hover-actions="{ row, column, active }">
+                  <span v-if="active && tracesLocked" class="inline-flex" @click.stop>
+                    <OButton
+                      variant="ghost"
+                      size="icon"
+                      disabled
+                      :aria-label="t('traces.serviceGraphNodeSidePanel.viewInTraces')"
+                      data-test="service-graph-side-panel-view-traces-btn"
+                    >
+                      <OIcon name="lock" class="text-icon-locked" size="sm" />
+                    </OButton>
+                    <OTooltip :content="tracesLockedReason" />
+                  </span>
                   <OButton
-                    v-if="active"
+                    v-else-if="active"
                     variant="ghost"
                     size="icon"
                     data-test="service-graph-side-panel-view-traces-btn"
@@ -379,7 +428,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             class="panel-section mb-0! p-0!"
             data-test="service-graph-side-panel-behavior"
           >
+            <LicenseDeniedState
+              v-if="aiObsLocked"
+              :features="['ai_observability']"
+              data-test="service-graph-side-panel-behavior-license-denied"
+            />
             <AgentNodeBehaviorTab
+              v-else
               :agent-name="behaviorAgentName"
               :source-stream="streamFilter"
               :start-time="timeRange.startTime"
@@ -424,18 +479,34 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :fill-height="false"
                 pagination="none"
                 @sort-change="(p: any) => handleSortChange(p.column)"
-                @row-click="
-                  (row: any) =>
-                    navigateToTraces({
-                      resourceFilter: cfg.fields
-                        ? { fields: cfg.fields, value: row[cfg.colId] }
-                        : { field: cfg.groupField, value: row[cfg.colId] },
-                    })
+                v-on="
+                  tracesLocked
+                    ? {}
+                    : {
+                        rowClick: (row: any) =>
+                          navigateToTraces({
+                            resourceFilter: cfg.fields
+                              ? { fields: cfg.fields, value: row[cfg.colId] }
+                              : { field: cfg.groupField, value: row[cfg.colId] },
+                          }),
+                      }
                 "
               >
                 <template #cell-hover-actions="{ row, column, active }">
+                  <span v-if="active && tracesLocked" class="inline-flex" @click.stop>
+                    <OButton
+                      variant="ghost"
+                      size="icon"
+                      disabled
+                      :aria-label="t('traces.serviceGraphNodeSidePanel.viewInTraces')"
+                      :data-test="`service-graph-side-panel-${cfg.id}-view-traces-btn`"
+                    >
+                      <OIcon name="lock" class="text-icon-locked" size="sm" />
+                    </OButton>
+                    <OTooltip :content="tracesLockedReason" />
+                  </span>
                   <OButton
-                    v-if="active"
+                    v-else-if="active"
                     variant="ghost"
                     size="icon"
                     :data-test="`service-graph-side-panel-${cfg.id}-view-traces-btn`"
@@ -508,9 +579,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             class="panel-section mb-0! h-full! p-0!"
             data-test="service-graph-side-panel-metrics"
           >
+            <LicenseDeniedState
+              v-if="correlationLocked"
+              :features="['correlation']"
+              data-test="service-graph-side-panel-metrics-license-denied"
+            />
             <!-- Loading state — shimmer skeletons standing in for the metric charts -->
             <div
-              v-if="metricsCorrelationLoading"
+              v-else-if="metricsCorrelationLoading"
               class="px-page-edge flex flex-col gap-3 py-4"
               data-test="service-graph-side-panel-metrics-loading"
             >
@@ -606,6 +682,8 @@ import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import { defineComponent, computed, ref, watch, defineAsyncComponent, type PropType } from "vue";
 import { useStore } from "vuex";
 import { useRouter } from "vue-router";
@@ -909,6 +987,7 @@ export default defineComponent({
     ODropdownItem,
     ODrawer,
     TelemetryCorrelationDashboard,
+    LicenseDeniedState,
     OTable,
     RenderDashboardCharts,
     OTooltip,
@@ -1272,6 +1351,12 @@ export default defineComponent({
       }
     };
 
+    const { locked: correlationLocked, lockedReason: correlationLockedReason } =
+      useLicenseLock("correlation");
+    const { locked: dbmLocked, lockedReason: dbmLockedReason } = useLicenseLock("db_monitoring");
+    const { locked: logsLocked, lockedReason: logsLockedReason } = useLicenseLock("logs");
+    const { locked: tracesLocked, lockedReason: tracesLockedReason } = useLicenseLock("traces");
+
     // Metrics Correlation State
     const showTelemetryDialog = ref(false);
     const correlationLoading = ref(false);
@@ -1313,7 +1398,7 @@ export default defineComponent({
     const metricsCorrelationLoaded = ref(false);
 
     const fetchCorrelatedStreams = async (force = false) => {
-      if (!props.selectedNode) return;
+      if (!props.selectedNode || correlationLocked.value) return;
       if (!force && correlationData.value) return;
 
       correlationLoading.value = true;
@@ -1399,7 +1484,7 @@ export default defineComponent({
 
     // Fetch correlated metric streams for the Metrics tab
     const fetchMetricsCorrelation = async (force = false) => {
-      if (!props.selectedNode) return;
+      if (!props.selectedNode || correlationLocked.value) return;
       if (!force && metricsCorrelationLoaded.value) return;
 
       metricsCorrelationLoading.value = true;
@@ -1604,8 +1689,12 @@ export default defineComponent({
     // The AgentNodeBehaviorTab itself degrades gracefully to a "feature off"
     // hint if the rollup is disabled, so the panel only needs to mount once
     // both the context is right AND the edition allows it.
+    const { locked: aiObsLocked, lockedReason: aiObsLockedReason } =
+      useLicenseLock("ai_observability");
+    const behaviorLocked = computed(() => aiObsLocked.value || !agentBehaviorAccess.value.allowed);
     const showBehaviorTab = computed(
-      () => isAgentBehaviorContext.value && agentBehaviorAccess.value.allowed,
+      () =>
+        isAgentBehaviorContext.value && (aiObsLocked.value || agentBehaviorAccess.value.allowed),
     );
     const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
 
@@ -1613,7 +1702,7 @@ export default defineComponent({
     // here is what keeps the locked Behavior tab from becoming active —
     // clicking it opens the upgrade dialog instead of switching.
     function onTabChange(name: string | number) {
-      if (name === "behavior" && !agentBehaviorAccess.value.allowed) {
+      if (name === "behavior" && !aiObsLocked.value && !agentBehaviorAccess.value.allowed) {
         openUpgradeDialog();
         return;
       }
@@ -2236,7 +2325,7 @@ export default defineComponent({
 
       // Ensure the stream schema is resolved (shared with inferred tab resolution)
       await resolveStreamSchema();
-      if (streamFieldSet.value.size === 0) return;
+      if (streamFieldSet.value.size === 0 || correlationLocked.value) return;
 
       try {
         const org = store.state.selectedOrganization.identifier;
@@ -2385,6 +2474,7 @@ export default defineComponent({
       maxDurationMicros?: number;
       mode?: "spans" | "traces";
     }) => {
+      if (tracesLocked.value) return;
       emit("view-traces", {
         stream: props.streamFilter,
         serviceName:
@@ -2430,7 +2520,7 @@ export default defineComponent({
     const viewRelatedDatabases = () => {
       const node = props.selectedNode;
       const serviceName = node?.name || node?.label || node?.id;
-      if (!serviceName) return;
+      if (!serviceName || dbmLocked.value) return;
       router.push({
         name: "dbmQueries",
         query: {
@@ -2444,7 +2534,7 @@ export default defineComponent({
 
     const viewRelatedLogs = async () => {
       const serviceName = buildServiceName();
-      if (!serviceName) return;
+      if (!serviceName || logsLocked.value || correlationLocked.value) return;
 
       const org = store.state.selectedOrganization.identifier;
 
@@ -2574,7 +2664,9 @@ export default defineComponent({
       isAllStreamsSelected,
       isInferred,
       isAgentBehaviorContext,
-      agentBehaviorAccess,
+      behaviorLocked,
+      aiObsLocked,
+      aiObsLockedReason,
       onTabChange,
       showBehaviorTab,
       behaviorAgentName,
@@ -2588,6 +2680,14 @@ export default defineComponent({
       viewRelatedTraces,
       viewRelatedLogs,
       dbmEnabled,
+      dbmLocked,
+      dbmLockedReason,
+      logsLocked,
+      logsLockedReason,
+      tracesLocked,
+      tracesLockedReason,
+      correlationLocked,
+      correlationLockedReason,
       viewRelatedDatabases,
       handleShowTelemetry,
       // RED Charts
diff --git a/web/src/plugins/traces/ServicesCatalog.spec.ts b/web/src/plugins/traces/ServicesCatalog.spec.ts
index 2164610e14..5b4ac18a57 100644
--- a/web/src/plugins/traces/ServicesCatalog.spec.ts
+++ b/web/src/plugins/traces/ServicesCatalog.spec.ts
@@ -2650,6 +2650,17 @@ describe("ServicesCatalog", () => {
       expect(wrapper.find('[data-test="services-catalog-insights"]').exists()).toBe(false);
     });
 
+    it("makes no anomaly calls and shows no strip when anomaly_detection is license-locked", async () => {
+      wrapper = mountServicesCatalog({
+        storeOverrides: { zoConfig: { features: { anomaly_detection: "locked" } } },
+      });
+      await flushPromises();
+      expect(anomaliesSchemaCalls()).toHaveLength(0);
+      expect(anomalyCalls()).toHaveLength(0);
+      expect(mockAnomalyList).not.toHaveBeenCalled();
+      expect(wrapper.find('[data-test="services-catalog-insights"]').exists()).toBe(false);
+    });
+
     it("queries managed anomalies over the catalog time range, keeping below-direction rate ones", async () => {
       mockSearchObj.data.datetime.type = "absolute";
       await mountEnabled();
diff --git a/web/src/plugins/traces/ServicesCatalog.vue b/web/src/plugins/traces/ServicesCatalog.vue
index 0ace8e7d92..774e7463e5 100644
--- a/web/src/plugins/traces/ServicesCatalog.vue
+++ b/web/src/plugins/traces/ServicesCatalog.vue
@@ -244,8 +244,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >
           {{ t("traces.servicesCatalog.insights.viewTraces") }}
         </OButton>
+        <OTooltip v-if="entry.folder && alertsLocked" :content="alertsLockedReason">
+          <span class="inline-flex">
+            <OButton
+              variant="ghost-primary"
+              size="xs"
+              disabled
+              icon-left="lock"
+              :data-test="`services-catalog-insight-charts-${i}`"
+            >
+              {{ t("traces.servicesCatalog.insights.viewCharts") }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="entry.folder"
+          v-else-if="entry.folder"
           variant="ghost-primary"
           size="xs"
           :data-test="`services-catalog-insight-charts-${i}`"
@@ -552,6 +565,7 @@ import { useRouter } from "vue-router";
 import searchService from "@/services/search";
 import config from "@/aws-exports";
 import { anomalyConfigsQuery } from "@/services/anomaly_detection.queries";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { timestampToTimezoneDate } from "@/utils/timezone";
 import { useListViewState } from "@/composables/useListViewState";
 
@@ -714,9 +728,12 @@ const insights = ref<RedInsight[]>([]);
 let insightsRequest = 0;
 let catalogLoad = 0;
 // The RED insights job is enterprise-only, so OSS never fetches the _anomalies schema for it.
+const { locked: anomalyLocked } = useLicenseLock("anomaly_detection");
+const { locked: alertsLocked, lockedReason: alertsLockedReason } = useLicenseLock("alerts");
 const redInsightsEnabled = computed(
   () =>
     config.isEnterprise == "true" &&
+    !anomalyLocked.value &&
     store.state.organizationData?.organizationSettings?.red_insights_enabled === true,
 );
 
diff --git a/web/src/plugins/traces/SessionDetails.vue b/web/src/plugins/traces/SessionDetails.vue
index 05171235c2..6433b40263 100644
--- a/web/src/plugins/traces/SessionDetails.vue
+++ b/web/src/plugins/traces/SessionDetails.vue
@@ -54,8 +54,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
       <template #actions>
         <template v-if="canAnnotateContext">
+          <OTooltip v-if="aiObsLock.locked.value" :content="aiObsLock.lockedReason.value">
+            <span class="inline-flex">
+              <OButton
+                variant="outline"
+                size="sm"
+                disabled
+                icon-left="lock"
+                data-test="session-detail-annotate-btn"
+              >
+                {{ t("aiObservability.traceActions.annotate.button") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <TraceAnnotateMenu
-            v-if="queuesAccess.allowed"
+            v-else-if="queuesAccess.allowed"
             ref-type="session"
             :ref-id="sessionId"
             :ref-trace-start-time="sessionEvaluationRange.startTime"
@@ -74,13 +87,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @click="openUpgradeDialog"
           >
             {{ t("aiObservability.traceActions.annotate.button") }}
-            <template #icon-right
-              ><OIcon name="lock" size="sm" class="text-warning-600"
-            /></template>
+            <template #icon-right><OIcon name="lock" size="sm" class="lock-chip" /></template>
           </OButton>
         </template>
+        <OTooltip
+          v-if="aiObsLock.locked.value && evaluateContextReady"
+          :content="aiObsLock.lockedReason.value"
+        >
+          <span class="inline-flex">
+            <OButton
+              variant="outline"
+              size="sm"
+              disabled
+              icon-left="lock"
+              data-test="session-detail-evaluate-btn"
+            >
+              {{ t("onlineEvals.manualEvaluation.titles.session") }}
+            </OButton>
+          </span>
+        </OTooltip>
         <OButton
-          v-if="canManualEvaluate"
+          v-else-if="canManualEvaluate"
           variant="outline"
           size="sm"
           data-test="session-detail-evaluate-btn"
@@ -978,6 +1005,7 @@ import ThreadToolCalls from "./ThreadToolCalls.vue";
 import config from "@/aws-exports";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 import { splitNumberWithUnit, splitDuration } from "./llmInsightsDashboard.utils";
 import LLMCostCell from "./LLMCostCell.vue";
@@ -1042,12 +1070,10 @@ const sessionEvaluationRange = computed(() => {
 // The session detail endpoint is keyed by gen_ai_conversation_id, so a
 // populated response is authoritative evidence that this is an LLM session.
 const hasLlmSessionData = computed(() => detail.value !== null && traces.value.length > 0);
-const canManualEvaluate = computed(() => {
+const evaluateContextReady = computed(() => {
   const range = sessionEvaluationRange.value;
   return (
     hasLlmSessionData.value &&
-    (config.isEnterprise === "true" || config.isCloud === "true") &&
-    Boolean(store.state.zoConfig?.online_evals_enabled) &&
     Boolean(orgIdentifier.value) &&
     Boolean(streamName.value) &&
     Boolean(sessionId.value) &&
@@ -1056,6 +1082,12 @@ const canManualEvaluate = computed(() => {
     range.endTime > range.startTime
   );
 });
+const canManualEvaluate = computed(
+  () =>
+    evaluateContextReady.value &&
+    (config.isEnterprise === "true" || config.isCloud === "true") &&
+    Boolean(store.state.zoConfig?.online_evals_enabled),
+);
 const manualEvaluationOpen = ref(false);
 
 // Same non-edition conditions as manual evaluation minus the online-eval
@@ -1076,6 +1108,7 @@ const canAnnotateContext = computed(() => {
 // Annotating a session is the same capability as queuing it into AI
 // Observability's review Queues, so it shares that gate.
 const queuesAccess = useLockedAffordance("queues");
+const aiObsLock = useLicenseLock("ai_observability");
 const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
 
 // Per-turn rollups used by the KPI sub-lines. All values are measured from the
diff --git a/web/src/plugins/traces/TraceDetails.spec.ts b/web/src/plugins/traces/TraceDetails.spec.ts
index a4f87f1177..1f98862b03 100644
--- a/web/src/plugins/traces/TraceDetails.spec.ts
+++ b/web/src/plugins/traces/TraceDetails.spec.ts
@@ -24,6 +24,7 @@ import config from "@/aws-exports";
 import router from "@/test/unit/helpers/router";
 import { http, HttpResponse } from "msw";
 import tracesMockData from "@/test/unit/mockData/traces";
+import searchService from "@/services/search";
 
 const node = document.createElement("div");
 node.setAttribute("id", "app");
@@ -446,6 +447,21 @@ describe("TraceDetails", () => {
         routerPushSpy.mockRestore();
       }
     });
+
+    it("should disable View Logs with a lock while logs is locked", async () => {
+      expect(wrapper.vm.logsLocked).toBe(false);
+      store.state.zoConfig.features = { logs: "locked" };
+      try {
+        await wrapper.vm.$nextTick();
+        const viewLogsBtn = wrapper.find('[data-test="trace-details-view-logs-btn"]');
+        expect(wrapper.vm.logsLocked).toBe(true);
+        expect(wrapper.vm.isViewLogsDisabled).toBe(true);
+        expect(viewLogsBtn.attributes("disabled")).toBeDefined();
+        expect(viewLogsBtn.findComponent({ name: "OIcon" }).props("name")).toBe("lock");
+      } finally {
+        delete store.state.zoConfig.features;
+      }
+    });
   });
 
   describe("Span interaction", () => {
@@ -2107,6 +2123,25 @@ describe("TraceDetails", () => {
       expect(replayBtn.exists()).toBe(true);
     });
 
+    it("should render the session replay button disabled with a lock when rum is locked", async () => {
+      store.state.zoConfig.features = { rum: "locked" };
+      try {
+        wrapper.vm.searchObj.data.traceDetails.spanList = [
+          {
+            ...tracesMockData.tracesDetails.traceSpans.hits[0],
+            rum_session_id: "session-123",
+            rum_session_has_replay: true,
+          },
+        ];
+        await wrapper.vm.$nextTick();
+        const replayBtn = wrapper.find('[data-test="trace-details-view-session-replay-btn"]');
+        expect(replayBtn.attributes("disabled")).toBeDefined();
+        expect(replayBtn.findComponent({ name: "OIcon" }).props("name")).toBe("lock");
+      } finally {
+        delete store.state.zoConfig.features;
+      }
+    });
+
     it("should not show session replay button when no RUM session exists", async () => {
       wrapper.vm.searchObj.data.traceDetails.spanList =
         tracesMockData.tracesDetails.traceSpans.hits;
@@ -2667,6 +2702,52 @@ describe("TraceDetails", () => {
       localWrapper.unmount();
     });
 
+    it("stays on the page without a not-found redirect when the details call is a license denial", async () => {
+      // The unit-test http mock flattens error bodies, so reject with the shape production http rethrows.
+      vi.spyOn(searchService, "get_trace_details").mockRejectedValue({
+        response: { status: 403, data: { code: 40001, error_detail: "traces" } },
+      });
+      const pushSpy = vi.spyOn(router, "push");
+      const localWrapper = mountWithSpanQuery("any-span");
+      await flushPromises();
+      expect(pushSpy).not.toHaveBeenCalledWith(expect.objectContaining({ name: "traces" }));
+      expect(mockShowErrorNotification).not.toHaveBeenCalled();
+      localWrapper.unmount();
+    });
+
+    it("skips the details call while traces is locked and makes it while licensed", async () => {
+      let detailCalls = 0;
+      globalThis.server.use(
+        http.get(
+          `${store.state.API_ENDPOINT}/api/${store.state.selectedOrganization.identifier}/:stream/traces/:traceId/details`,
+          () => {
+            detailCalls++;
+            return HttpResponse.json(tracesMockData.tracesDetails.traceSpans);
+          },
+        ),
+      );
+      store.state.zoConfig.features = { traces: "locked" };
+      try {
+        const locked = mountWithSpanQuery("any-span");
+        await flushPromises();
+        expect(detailCalls).toBe(0);
+        const lockedView = locked.find('[data-test="trace-details-license-locked"]');
+        expect(lockedView.exists()).toBe(true);
+        const denied = lockedView.findComponent({ name: "LicenseDeniedState" });
+        expect(denied.props("features")).toEqual(["traces"]);
+        const exempt = lockedView.find("[data-feature-lock-exempt]");
+        expect(exempt.find('[data-test="trace-details-back-btn"]').exists()).toBe(true);
+        locked.unmount();
+      } finally {
+        delete store.state.zoConfig.features;
+      }
+      const licensed = mountWithSpanQuery("any-span");
+      await flushPromises();
+      expect(detailCalls).toBeGreaterThan(0);
+      expect(licensed.find('[data-test="trace-details-license-locked"]').exists()).toBe(false);
+      licensed.unmount();
+    });
+
     it("opens Preview when a URL-selected span is an LLM evaluator span", async () => {
       const response = JSON.parse(JSON.stringify(tracesMockData.tracesDetails.traceSpans));
       response.hits[0].gen_ai_system = "openai";
@@ -3247,6 +3328,20 @@ describe("TraceDetails", () => {
 
       expect(viewSpanLogs).not.toHaveBeenCalled();
     });
+
+    it("opens a plain logs search without a warning when correlation is license-locked", async () => {
+      store.state.zoConfig.features = { correlation: "locked" };
+      try {
+        const pushSpy = vi.spyOn(router, "push").mockResolvedValue(undefined as any);
+        wrapper.vm.searchObj.data.traceDetails.correlationProps = null;
+        const spanId = tracesMockData.tracesDetails.traceSpans.hits[0].span_id;
+        await wrapper.vm.handleTreeViewCorrelatedLogs({ span_id: spanId });
+        await flushPromises();
+        expect(pushSpy).toHaveBeenCalledWith(expect.objectContaining({ path: "/logs" }));
+      } finally {
+        delete store.state.zoConfig.features;
+      }
+    });
   });
 
   describe("Ask AI: Explain trace and the span relay", () => {
diff --git a/web/src/plugins/traces/TraceDetails.vue b/web/src/plugins/traces/TraceDetails.vue
index a1b8747cf5..5715a30dd7 100644
--- a/web/src/plugins/traces/TraceDetails.vue
+++ b/web/src/plugins/traces/TraceDetails.vue
@@ -177,9 +177,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 @click="openUpgradeDialog"
               >
                 <OIcon name="fact-check" size="sm" />
-                <template #icon-right
-                  ><OIcon name="lock" size="xs" class="text-warning-600"
-                /></template>
+                <template #icon-right><OIcon name="lock" size="xs" class="lock-chip" /></template>
               </OButton>
             </template>
 
@@ -193,7 +191,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             >
               <OIcon name="table-chart" size="sm" />
               <template v-if="!queuesAccess.allowed" #icon-right>
-                <OIcon name="lock" size="xs" class="text-warning-600" />
+                <OIcon name="lock" size="xs" class="lock-chip" />
               </template>
               <OTooltip
                 v-if="queuesAccess.allowed"
@@ -531,17 +529,34 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 class="w-44!"
               />
               <span class="traces-view-logs-btn ps-1">
-                <!-- Single button with wrapper for tooltip functionality -->
-                <span class="inline-block" tabindex="0">
+                <OTooltip v-if="logsLocked" :content="logsLockedReason">
+                  <span class="inline-flex">
+                    <OButton
+                      data-test="trace-details-view-logs-btn"
+                      variant="outline"
+                      size="sm"
+                      class="h-8! text-xs font-normal!"
+                      disabled
+                      icon-left="lock"
+                    >
+                      {{
+                        searchObj.meta.redirectedFromLogs
+                          ? t("traces.backToLogs")
+                          : t("traces.viewLogs")
+                      }}
+                    </OButton>
+                  </span>
+                </OTooltip>
+                <span v-else class="inline-block" tabindex="0">
                   <OButton
                     data-test="trace-details-view-logs-btn"
                     variant="outline"
                     size="sm"
                     class="h-8! text-xs font-normal!"
+                    icon-left="search"
                     :disabled="isViewLogsDisabled"
                     @click="redirectToLogs"
                   >
-                    <template #icon-left><OIcon name="search" size="xs" /></template>
                     {{
                       searchObj.meta.redirectedFromLogs
                         ? t("traces.backToLogs")
@@ -556,8 +571,26 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 </span>
               </span>
             </div>
+            <OTooltip
+              v-if="hasReplaySession && !hideSessionReplayButton && rumLocked"
+              :content="rumLockedReason"
+            >
+              <span class="ms-1 inline-flex">
+                <OButton
+                  data-test="trace-details-view-session-replay-btn"
+                  variant="outline"
+                  size="sm"
+                  disabled
+                >
+                  <template #icon-left>
+                    <OIcon name="lock" class="lock-chip" size="sm" />
+                  </template>
+                  {{ t("rum.playSessionReplay") }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
-              v-if="hasReplaySession && !hideSessionReplayButton"
+              v-else-if="hasReplaySession && !hideSessionReplayButton"
               data-test="trace-details-view-session-replay-btn"
               variant="outline"
               size="sm"
@@ -936,6 +969,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         {{ t("traces.fetchingTrace") }}
       </div>
     </div>
+    <div
+      v-else-if="licenseLockedView"
+      class="flex min-h-0 flex-1 flex-col"
+      data-test="trace-details-license-locked"
+    >
+      <FeatureLockExempt v-if="showBackButton" class="shrink-0">
+        <OPageHeader
+          :title="t('menu.traces')"
+          :back="{ onClick: handleBackOrClose, dataTest: 'trace-details-back-btn' }"
+        />
+      </FeatureLockExempt>
+      <LicenseDeniedState :features="['traces']" />
+    </div>
 
     <!-- Filters Sidebar -->
     <ODrawer
@@ -1010,6 +1056,8 @@ import {
 import { cloneDeep } from "lodash-es";
 import ShareButton from "@/components/common/ShareButton.vue";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import useTraces from "@/composables/useTraces";
 import TraceDetailsSidebar from "./TraceDetailsSidebar.vue";
@@ -1061,9 +1109,11 @@ import { spanWindowUs, waterfallAxisSpans } from "@/utils/rum/traceWindow";
 import useResizer from "@/composables/useResizer";
 import useSmartBack from "@/composables/useSmartBack";
 import { copyToClipboard } from "@/utils/clipboard";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import useStreams from "@/composables/useStreams";
 import useRumSpanBuilder, { hasDanglingParent } from "@/composables/rum/useRumSpanBuilder";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { useRouter } from "vue-router";
 import searchService from "@/services/search";
 import analytics from "@/services/product_analytics";
@@ -1319,6 +1369,8 @@ export default defineComponent({
   components: {
     ShareButton,
     OPageHeader,
+    FeatureLockExempt,
+    LicenseDeniedState,
     OTag,
     TraceDetailsSidebar,
     TraceTree,
@@ -1364,7 +1416,17 @@ export default defineComponent({
     const traceGraphSearch = ref("");
     const sidebarActiveTab = ref("attributes");
 
-    const { searchObj, getUrlQueryParams, navigateToCorrelatedLogs } = useTraces();
+    const {
+      searchObj,
+      getUrlQueryParams,
+      navigateToCorrelatedLogs,
+      navigateToLogs,
+      buildQueryDetails,
+    } = useTraces();
+    const { locked: correlationLocked } = useLicenseLock("correlation");
+    const { locked: logsLocked, lockedReason: logsLockedReason } = useLicenseLock("logs");
+    const { locked: tracesLocked } = useLicenseLock("traces");
+    const licenseLockedView = computed(() => props.mode !== "embedded" && tracesLocked.value);
 
     const { loadKeyFields } = useServiceCorrelation();
 
@@ -1673,6 +1735,7 @@ export default defineComponent({
 
     // Check if View Logs button should be disabled
     const isViewLogsDisabled = computed(() => {
+      if (logsLocked.value) return true;
       // In non-enterprise mode with visible log stream selector, disable when no streams are selected
       return (
         config.isEnterprise !== "true" &&
@@ -1698,6 +1761,7 @@ export default defineComponent({
     // Gate and target share one span so the button never links to a session with nothing to play.
     const replaySpan = computed(() => resolveReplaySpan(spanList.value));
     const hasReplaySession = computed(() => replaySpan.value !== null);
+    const { locked: rumLocked, lockedReason: rumLockedReason } = useLicenseLock("rum");
 
     // Computed properties for mode-based priority logic
     const effectiveTraceId = computed(() => {
@@ -2336,6 +2400,8 @@ export default defineComponent({
         return;
       }
 
+      // The route-locked page shows its locked view; the details call would only 403.
+      if (licenseLockedView.value) return;
       // Fetch from API — standalone mode, or embedded with no pre-fetched spans
       await loadLogStreams();
       const timeRange = effectiveTimeRange.value;
@@ -2608,6 +2674,8 @@ export default defineComponent({
         analytics.track("trace_details_loaded", { mode: props.mode });
       } catch (error) {
         if (generation !== loadGeneration) return;
+        // The top bar explains a license denial; redirecting would leave the locked page.
+        if (licenseDeniedFeatures(error) !== null) return;
         // A 401 is the expired session the global handler is already logging the user out of.
         if ((error as { response?: { status?: number } })?.response?.status !== 401) {
           console.error("Error fetching trace details:", error);
@@ -3239,6 +3307,10 @@ export default defineComponent({
         return;
       }
 
+      if (correlationLocked.value) {
+        navigateToLogs(buildQueryDetails(spanMap.value[spanId] ?? span));
+        return;
+      }
       const correlationData = searchObj.data.traceDetails.correlationProps;
       if (correlationData?.logStreams?.length) {
         navigateToCorrelatedLogs(correlationData);
@@ -3550,6 +3622,11 @@ export default defineComponent({
       handleTreeViewCorrelatedLogs,
       redirectToSessionReplay,
       hasReplaySession,
+      rumLocked,
+      rumLockedReason,
+      logsLocked,
+      logsLockedReason,
+      licenseLockedView,
       filteredStreamOptions,
       filterStreamFn,
       streamSearchValue,
diff --git a/web/src/plugins/traces/TraceDetailsSidebar.spec.ts b/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
index b569868fa5..73d962fe32 100644
--- a/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
+++ b/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
@@ -2823,6 +2823,70 @@ describe("TraceDetailsSidebar — span to profile link", () => {
     expect(w.find(BUTTON).exists()).toBe(true);
     w.unmount();
   });
+
+  it("skips discovery and shows a disabled locked button when continuous_profiling is locked", async () => {
+    setStreams({ prof: FULL_SCHEMA });
+    profileHits.prof = [{ profile_type: "cpu", profile_unit: "nanoseconds", c: 1 }];
+    mockStore.state.zoConfig.features = { continuous_profiling: "locked" };
+    try {
+      const w = await mountWith();
+      expect(mockStreamNameList).not.toHaveBeenCalled();
+      expect(profileCalls()).toHaveLength(0);
+      expect(w.find(BUTTON).attributes("disabled")).toBeDefined();
+      expect(w.find(BUTTON).findComponent({ name: "OIcon" }).props("name")).toBe("lock");
+      w.unmount();
+    } finally {
+      delete mockStore.state.zoConfig.features;
+    }
+  });
+});
+
+describe("TraceDetailsSidebar — correlation license lock", () => {
+  const LOGS_TAB = '[data-test="trace-details-sidebar-tabs-correlated-logs"]';
+
+  afterEach(() => {
+    delete mockStore.state.zoConfig.features;
+    mockFindRelatedTelemetry.mockClear();
+  });
+
+  it("shows locked tabs and LicenseDeniedState without a correlation lookup when locked", async () => {
+    mockStore.state.zoConfig.features = { correlation: "locked" };
+    const w = mountSidebar({
+      streamName: "default",
+      serviceStreamsEnabled: true,
+      activeTab: "correlated-logs",
+    });
+    await w.setProps({ span: { ...mockSpan, span_id: "another" } });
+    await flushPromises();
+    expect(w.find(LOGS_TAB).attributes("suffix-icon")).toBe("lock");
+    expect(
+      w.find('[data-test="trace-details-sidebar-correlated-logs-license-denied"]').exists(),
+    ).toBe(true);
+    expect(mockFindRelatedTelemetry).not.toHaveBeenCalled();
+    w.unmount();
+  });
+
+  it("opens View Logs as a plain logs search when correlation is locked", async () => {
+    mockStore.state.zoConfig.features = { correlation: "locked" };
+    mockNavigateToLogs.mockClear();
+    const w = mountSidebar({ streamName: "default", parentMode: "standalone" });
+    await w
+      .find('[data-test="trace-details-sidebar-header-toolbar-view-logs-btn"]')
+      .trigger("click");
+    await flushPromises();
+    expect(mockNavigateToLogs).toHaveBeenCalled();
+    expect(mockFindRelatedTelemetry).not.toHaveBeenCalled();
+    w.unmount();
+  });
+
+  it("keeps the correlation lookup and unlocked tabs when correlation is enabled", async () => {
+    const w = mountSidebar({ streamName: "default", serviceStreamsEnabled: true });
+    await w.setProps({ activeTab: "correlated-logs" });
+    await flushPromises();
+    expect(w.find(LOGS_TAB).attributes("suffix-icon")).toBeUndefined();
+    expect(mockFindRelatedTelemetry).toHaveBeenCalled();
+    w.unmount();
+  });
 });
 
 describe("TraceDetailsSidebar — Ask AI about this span", () => {
@@ -2899,3 +2963,34 @@ describe("TraceDetailsSidebar — Ask AI about this span", () => {
     w.unmount();
   });
 });
+
+describe("TraceDetailsSidebar — logs license lock", () => {
+  const VIEW_LOGS = '[data-test="trace-details-sidebar-header-toolbar-view-logs-btn"]';
+
+  afterEach(() => {
+    delete mockStore.state.zoConfig.features;
+  });
+
+  it("disables View Logs with a lock and the logs reason while logs is locked", async () => {
+    mockStore.state.zoConfig.features = { logs: "locked" };
+    mockNavigateToLogs.mockClear();
+    const w = mountSidebar({ streamName: "default", parentMode: "standalone" });
+    await flushPromises();
+    const btn = w.find(VIEW_LOGS);
+    expect(btn.attributes("disabled")).toBeDefined();
+    expect(w.vm.logsLocked).toBe(true);
+    expect(w.vm.viewLogsTooltipContent).toMatch(/needs logs/i);
+    await btn.trigger("click");
+    await flushPromises();
+    expect(mockNavigateToLogs).not.toHaveBeenCalled();
+    w.unmount();
+  });
+
+  it("keeps View Logs enabled while logs is licensed", async () => {
+    const w = mountSidebar({ streamName: "default", parentMode: "standalone" });
+    await flushPromises();
+    expect(w.vm.logsLocked).toBe(false);
+    expect(w.vm.viewLogsTooltipContent).toBe("View Logs");
+    w.unmount();
+  });
+});
diff --git a/web/src/plugins/traces/TraceDetailsSidebar.vue b/web/src/plugins/traces/TraceDetailsSidebar.vue
index 5ee28960df..403bb3f434 100644
--- a/web/src/plugins/traces/TraceDetailsSidebar.vue
+++ b/web/src/plugins/traces/TraceDetailsSidebar.vue
@@ -205,8 +205,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
           <!-- View Logs Button -->
           <span v-if="parentMode === 'standalone'" class="shrink-0">
-            <!-- Single button with wrapper for tooltip functionality -->
-            <span class="inline-block" tabindex="0">
+            <OTooltip v-if="logsLocked" :content="logsLockedReason">
+              <span class="inline-flex">
+                <OButton
+                  variant="outline"
+                  size="xs"
+                  class="h-full text-xs!"
+                  disabled
+                  icon-left="lock"
+                  data-test="trace-details-sidebar-header-toolbar-view-logs-btn"
+                >
+                  {{ t("traces.viewLogs") }}
+                </OButton>
+              </span>
+            </OTooltip>
+            <span v-else class="inline-block" tabindex="0">
               <OButton
                 variant="outline"
                 size="xs"
@@ -220,8 +233,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </OButton>
               <OTooltip :content="viewLogsTooltipContent" />
             </span>
+            <OTooltip v-if="profilingLocked && spanProfileRequest" :content="profilingLockedReason">
+              <span class="ms-1 inline-flex">
+                <OButton
+                  variant="outline"
+                  size="xs"
+                  class="h-full text-xs!"
+                  disabled
+                  data-test="trace-details-sidebar-header-toolbar-view-profile-btn"
+                >
+                  <template #icon-left>
+                    <OIcon name="lock" class="lock-chip" size="sm" />
+                  </template>
+                  {{ t("traces.viewProfile") }}
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
-              v-if="spanProfileMatch"
+              v-else-if="spanProfileMatch"
               variant="outline"
               size="xs"
               class="ms-1 h-full text-xs!"
@@ -463,7 +492,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           v-if="serviceStreamsEnabled"
           name="correlated-logs"
           :label="t('correlation.correlatedLogs')"
-          :suffix-icon="!correlationAccess.allowed ? 'lock' : undefined"
+          :suffix-icon="correlationTabLocked ? 'lock' : undefined"
+          :tooltip="correlationTabLocked ? correlationLockedReason : undefined"
           data-test="trace-details-sidebar-tabs-correlated-logs"
           class="font-normal! capitalize"
         />
@@ -471,7 +501,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           v-if="serviceStreamsEnabled"
           name="correlated-metrics"
           :label="t('correlation.correlatedMetrics')"
-          :suffix-icon="!correlationAccess.allowed ? 'lock' : undefined"
+          :suffix-icon="correlationTabLocked ? 'lock' : undefined"
+          :tooltip="correlationTabLocked ? correlationLockedReason : undefined"
           data-test="trace-details-sidebar-tabs-correlated-metrics"
           class="font-normal! capitalize"
         />
@@ -927,8 +958,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           name="correlated-logs"
           class="traces-correlated-logs-container h-full max-h-full overflow-hidden p-0"
         >
+          <LicenseDeniedState
+            v-if="correlationLicenseLocked"
+            :features="['correlation']"
+            data-test="trace-details-sidebar-correlated-logs-license-denied"
+          />
           <CorrelatedLogsTable
-            v-if="correlationProps"
+            v-else-if="correlationProps"
             :service-name="correlationProps.serviceName"
             :matched-dimensions="correlationProps.matchedDimensions"
             :additional-dimensions="correlationProps.additionalDimensions"
@@ -966,8 +1002,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           name="correlated-metrics"
           class="traces-correlated-metrics-container h-full max-h-full overflow-hidden p-0"
         >
+          <LicenseDeniedState
+            v-if="correlationLicenseLocked"
+            :features="['correlation']"
+            data-test="trace-details-sidebar-correlated-metrics-license-denied"
+          />
           <TelemetryCorrelationDashboard
-            v-if="correlationProps"
+            v-else-if="correlationProps"
             mode="embedded-tabs"
             external-active-tab="metrics"
             :service-name="correlationProps.serviceName"
@@ -1052,6 +1093,8 @@ import {
 } from "vue";
 import { useStore } from "vuex";
 import useTheme from "@/composables/useTheme";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { formatTimeWithSuffix, convertTimeFromNsToUs, getImageURL } from "@/utils/zincutils";
 import { useAiIcon } from "@/composables/useAiIcon";
@@ -1234,6 +1277,7 @@ export default defineComponent({
     LLMContentRenderer,
     OTable,
     CorrelatedLogsTable,
+    LicenseDeniedState,
     TelemetryCorrelationDashboard: defineAsyncComponent(
       () => import("@/plugins/correlation/TelemetryCorrelationDashboard.vue"),
     ),
@@ -1306,6 +1350,17 @@ export default defineComponent({
       return !isNaN(num) && num > 0 ? num : null;
     });
 
+    const correlationAccess = useLockedAffordance("correlation");
+    const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+    const { locked: correlationLicenseLocked, lockedReason: correlationLockedReason } =
+      useLicenseLock("correlation");
+    const correlationTabLocked = computed(
+      () => !correlationAccess.value.allowed || correlationLicenseLocked.value,
+    );
+    const { locked: profilingLocked, lockedReason: profilingLockedReason } =
+      useLicenseLock("continuous_profiling");
+    const { locked: logsLocked, lockedReason: logsLockedReason } = useLicenseLock("logs");
+
     const activeTabModel = computed({
       get: () => props.activeTab,
       // OTabs is controlled (`:model-value`), so refusing to emit here is
@@ -1587,6 +1642,7 @@ export default defineComponent({
 
     // Check if View Logs button should be disabled
     const isViewLogsDisabled = computed(() => {
+      if (logsLocked.value) return true;
       // Enterprise loading state
       if (config.isEnterprise === "true" && correlationLoading.value) {
         return true;
@@ -1602,6 +1658,7 @@ export default defineComponent({
 
     // Get tooltip content based on disabled state
     const viewLogsTooltipContent = computed(() => {
+      if (logsLocked.value) return logsLockedReason.value;
       // Enterprise loading state
       if (config.isEnterprise === "true" && correlationLoading.value) {
         return t("correlation.loadingCorrelation");
@@ -1929,7 +1986,7 @@ export default defineComponent({
     );
 
     const viewSpanLogs = async () => {
-      if (config.isEnterprise === "true") {
+      if (config.isEnterprise === "true" && !correlationLicenseLocked.value) {
         const clickedSpan = spanKey(props.span);
         await loadCorrelation();
         // The user moved to another span while this lookup ran: do nothing.
@@ -2185,7 +2242,7 @@ export default defineComponent({
     watch(
       spanProfileRequest,
       (req) => {
-        if (req) detectSpanProfile(req);
+        if (req && !profilingLocked.value) detectSpanProfile(req);
       },
       { immediate: true },
     );
@@ -2455,7 +2512,7 @@ export default defineComponent({
      * Load correlation data for this span (called when user clicks on correlation tabs)
      */
     const loadCorrelation = (): Promise<void> => {
-      if (correlationProps.value) return Promise.resolve();
+      if (correlationProps.value || correlationLicenseLocked.value) return Promise.resolve();
       const key = spanKey(props.span);
       if (correlationRequest?.key !== key) {
         const promise: Promise<void> = fetchCorrelation(key).finally(() => {
@@ -2805,12 +2862,15 @@ export default defineComponent({
       });
     };
 
-    const correlationAccess = useLockedAffordance("correlation");
-    const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
-
     return {
       t,
       correlationAccess,
+      correlationLicenseLocked,
+      correlationLockedReason,
+      correlationTabLocked,
+      profilingLocked,
+      profilingLockedReason,
+      spanProfileRequest,
       activeTabModel,
       filterActions,
       closeSidebar,
@@ -2900,6 +2960,8 @@ export default defineComponent({
       isDarkMode,
       isViewLogsDisabled,
       viewLogsTooltipContent,
+      logsLocked,
+      logsLockedReason,
       serviceIconUrl,
       getImageURL,
       copyContentToClipboard,
diff --git a/web/src/plugins/traces/TraceTree.spec.ts b/web/src/plugins/traces/TraceTree.spec.ts
index 3fafdb000f..52980372aa 100644
--- a/web/src/plugins/traces/TraceTree.spec.ts
+++ b/web/src/plugins/traces/TraceTree.spec.ts
@@ -364,6 +364,24 @@ describe("TraceTree", () => {
       '[data-test="trace-tree-span-view-logs-btn-d9603ec7f76eb499"]',
     );
     expect(viewLogsBtn.exists()).toBe(true);
+    expect(viewLogsBtn.attributes("disabled")).toBeUndefined();
+  });
+
+  it("disables the row view logs button with a lock while logs is locked", async () => {
+    const lockedStore = createStore({
+      state: {
+        ...mockStore.state,
+        zoConfig: { timestamp_column: "@timestamp", features: { logs: "locked" } },
+      },
+    });
+    const locked = mountTraceTree({}, lockedStore);
+    const btn = locked.find('[data-test="trace-tree-span-view-logs-btn-d9603ec7f76eb499"]');
+    expect(btn.attributes("disabled")).toBeDefined();
+    expect(btn.findComponent({ name: "OIcon" }).props("name")).toBe("lock");
+    expect(btn.attributes("aria-label")).toBeTruthy();
+    await btn.trigger("click");
+    expect(locked.emitted("view-correlated-logs")).toBeUndefined();
+    locked.unmount();
   });
 
   describe("Span selection", () => {
diff --git a/web/src/plugins/traces/TraceTree.vue b/web/src/plugins/traces/TraceTree.vue
index f715fc7cb4..9b4aa02452 100644
--- a/web/src/plugins/traces/TraceTree.vue
+++ b/web/src/plugins/traces/TraceTree.vue
@@ -237,7 +237,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       class="view-span-logs hidden"
                       :data-test="`trace-tree-span-view-logs-container-${(spans as any[])[virtualRow.index].spanId}`"
                     >
+                      <span v-if="logsLocked" class="inline-flex">
+                        <OButton
+                          variant="outline"
+                          size="icon"
+                          disabled
+                          :aria-label="t('traces.viewLogs')"
+                          :data-test="`trace-tree-span-view-logs-btn-${(spans as any[])[virtualRow.index].spanId}`"
+                        >
+                          <OIcon name="lock" class="text-icon-locked" size="sm" />
+                        </OButton>
+                        <OTooltip :content="logsLockedReason" />
+                      </span>
                       <OButton
+                        v-else
                         variant="outline"
                         size="icon"
                         :title="t('traces.viewLogs')"
@@ -375,6 +388,8 @@ import OBadge from "@/lib/core/Badge/OBadge.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import config from "@/aws-exports";
 
 export default defineComponent({
@@ -458,6 +473,7 @@ export default defineComponent({
   ],
   setup(props, { emit }) {
     const { buildQueryDetails, navigateToLogs, searchObj } = useTraces();
+    const { locked: logsLocked, lockedReason: logsLockedReason } = useLicenseLock("logs");
     const store = useStore();
     const { isDark } = useTheme();
 
@@ -891,6 +907,8 @@ export default defineComponent({
       highlightedSpanId,
       store,
       viewSpanLogs,
+      logsLocked,
+      logsLockedReason,
       t,
       searchResults,
       getVirtualRowKey,
@@ -925,7 +943,7 @@ export default defineComponent({
       ancestorSiblingMap,
     };
   },
-  components: { SpanBlock, SpanKindBadge, OBadge, OButton, OIcon, OTruncatedText },
+  components: { SpanBlock, SpanKindBadge, OBadge, OButton, OIcon, OTruncatedText, OTooltip },
 });
 </script>
 
diff --git a/web/src/services/fleet.mock.ts b/web/src/services/fleet.mock.ts
index d3d7fd804a..6957705e41 100644
--- a/web/src/services/fleet.mock.ts
+++ b/web/src/services/fleet.mock.ts
@@ -555,11 +555,6 @@ function exitRollout(id: string, exit: "resume" | "skip" | "rollback", skip: str
       : r.status === "halted" && r.halt?.exits.includes(exit);
   if (!offered) return fail(409, `rollout cannot ${exit} from ${r.status}`);
   const state = store.fleets.find((f) => f.id === r.fleet.id)?.state;
-  if (exit === "rollback" && !state?.stable)
-    return fail(
-      400,
-      `fleet ${r.fleet.id} has no stable version to roll back to; fix forward instead`,
-    );
   if (exit === "rollback") {
     r.status = "rolled_back";
     r.ended_at = Date.now();
@@ -573,6 +568,15 @@ function exitRollout(id: string, exit: "resume" | "skip" | "rollback", skip: str
         verify: false,
         auto_rollback: false,
       });
+    } else {
+      if (state) {
+        state.desired = null;
+        state.rollout = null;
+      }
+      for (const c of store.collectors.filter((x) => x.fleet.id === r.fleet.id)) {
+        c.config = null;
+        c.config_version = null;
+      }
     }
     return reply(r);
   }
@@ -689,7 +693,10 @@ export const fleetMock: FleetApi = {
     store.collectors = store.collectors.filter((c) => c.id !== id);
     return reply(undefined as unknown);
   },
-  restartCollector: () => reply({ queued: true }),
+  restartCollector: (_org, id) =>
+    store.collectors.find((c) => c.id === id)?.status === "offline"
+      ? fail(409, `collector ${id} is offline; restart it when it is back`)
+      : reply({ queued: true }),
   redeliverCollector: (_org, id) => {
     const c = findCollector(id);
     if (c?.config) c.delivery = "assigned";
diff --git a/web/src/services/http.licenseLock.spec.ts b/web/src/services/http.licenseLock.spec.ts
new file mode 100644
index 0000000000..78f85f15eb
--- /dev/null
+++ b/web/src/services/http.licenseLock.spec.ts
@@ -0,0 +1,235 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.unmock("@/services/http.ts");
+vi.mock("../stores", () => ({
+  default: { state: { API_ENDPOINT: "http://localhost:5080", zoConfig: {} }, dispatch: vi.fn() },
+}));
+vi.mock("../aws-exports", () => ({ default: { isCloud: "false", isEnterprise: "true" } }));
+vi.mock("@/utils/zincutils", () => ({ useLocalCurrentUser: vi.fn(), useLocalUserInfo: vi.fn() }));
+vi.mock("axios");
+// Spy on toast but keep the real store, so error-toast dedupe is still exercised.
+vi.mock("@/lib/feedback/Toast/useToast", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/lib/feedback/Toast/useToast")>();
+  return { ...actual, toast: vi.fn(actual.toast) };
+});
+
+import axios from "axios";
+import { mount, type VueWrapper } from "@vue/test-utils";
+import { defineComponent, ref } from "vue";
+import http from "./http";
+import { installFetchLicenseReceiver } from "./licenseDenialReceiver";
+import { raw } from "@/types/i18n";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
+import { dismissAll, toast, toastRecords } from "@/lib/feedback/Toast/useToast";
+import { clearLicenseDenials } from "@/composables/useLicenseDenials";
+
+// Sends the request config through the instance's request interceptor, then fails it with `error`.
+const sendAndFail = (error: any, beforeResponse: () => void = () => {}) => {
+  const onRequest = vi.fn();
+  const onResponse = vi.fn();
+  vi.mocked(axios.create).mockReturnValue({
+    interceptors: { request: { use: onRequest }, response: { use: onResponse } },
+  } as any);
+  http();
+  error.config = onRequest.mock.calls[0][0](error.config);
+  beforeResponse();
+  return onResponse.mock.calls[0][1](error) as Promise<unknown>;
+};
+
+const denial = (features: string, message: string) => ({
+  response: { status: 403, data: { code: 40001, error_detail: features, message } },
+  request: { responseURL: "http://localhost:5080/api/org/x" },
+  config: { url: "/api/org/x" },
+});
+
+const serverError = (message: string) => ({
+  response: { status: 500, data: { message } },
+  request: { responseURL: "http://localhost:5080/api/org/x" },
+  config: { url: "/api/org/x" },
+});
+
+// Most catch sites toast a fixed or generic message, not the server's.
+const genericToast = () =>
+  toast({ variant: "error", message: raw("Request failed with status code 403") });
+
+const failAndToast = (error: any, beforeResponse?: () => void) =>
+  sendAndFail(error, beforeResponse).catch(genericToast);
+
+// A path change between the request starting and its response.
+const navigate = () => {
+  vi.setSystemTime(Date.now() + 1);
+  clearLicenseDenials();
+};
+
+const denialToasts = () => vi.mocked(toast).mock.calls.filter(([o]) => o.variant === "warning");
+// Record-store view of the error toasts only; the denial warning also lands there.
+const errorRecords = () => toastRecords.filter((r) => r.variant === "error");
+
+const feature = ref<string | null>("workflows");
+let wrapper: VueWrapper | undefined;
+
+let now = 0;
+// Each test starts past the previous one's toast window.
+beforeEach(() => vi.useFakeTimers({ toFake: ["Date"], now: (now += 5000) }));
+
+afterEach(() => {
+  // Clear while the fake clock runs, or pageChangedAt lands in real time and rejects every later request.
+  clearLicenseDenials();
+  vi.useRealTimers();
+  wrapper?.unmount();
+  wrapper = undefined;
+  dismissAll();
+  vi.mocked(toast).mockClear();
+});
+
+describe("http on a license-locked page", () => {
+  beforeEach(() => {
+    feature.value = "workflows";
+    wrapper = mount(
+      defineComponent({
+        setup() {
+          provideFeatureLock(feature);
+          return () => null;
+        },
+      }),
+    );
+  });
+
+  it("keeps a denial of the locked feature without a denial toast and out of error toasts", async () => {
+    await failAndToast(denial("workflows", "Workflows is not in your license"));
+    expect(errorRecords()).toHaveLength(0);
+    expect(denialToasts()).toHaveLength(0);
+  });
+
+  it("still toasts a non-license error when no denial preceded it", async () => {
+    await sendAndFail(serverError("Header lookup failed")).catch(() =>
+      toast({ variant: "error", message: raw("A new version is available, refresh") }),
+    );
+    expect(errorRecords().map((r) => r.message)).toEqual(["A new version is available, refresh"]);
+  });
+
+  it("keeps a denial of another feature without a denial toast and out of error toasts", async () => {
+    await failAndToast(denial("ai_assistant", "AI assistant is not in your license"));
+    expect(denialToasts()).toHaveLength(0);
+    expect(errorRecords()).toHaveLength(0);
+  });
+
+  it("keeps a denial naming the locked feature and another without a denial toast", async () => {
+    await failAndToast(denial("workflows, oncall", "Not in your license"));
+    expect(denialToasts()).toHaveLength(0);
+  });
+});
+
+describe("http with no page locked", () => {
+  it("shows one denial warning and drops the catch site's generic toast", async () => {
+    await failAndToast(denial("workflows", "Workflows needs a license"));
+    expect(denialToasts()).toHaveLength(1);
+    expect(denialToasts()[0][0].variant).toBe("warning");
+    expect(errorRecords()).toHaveLength(0);
+  });
+
+  it("warns once per feature set until the page changes, and again for a different set", async () => {
+    await failAndToast(denial("workflows", "Workflows needs a license"));
+    await failAndToast(denial("workflows", "Workflows needs a license"));
+    expect(denialToasts()).toHaveLength(1);
+    await failAndToast(denial("oncall", "Oncall needs a license"));
+    expect(denialToasts()).toHaveLength(2);
+    navigate();
+    await failAndToast(denial("workflows", "Workflows needs a license"));
+    expect(denialToasts()).toHaveLength(3);
+  });
+
+  it("toasts again once the denial's window has passed", async () => {
+    await failAndToast(denial("workflows", "Workflows needs a license"));
+    vi.setSystemTime(Date.now() + 2000);
+    genericToast();
+    expect(errorRecords()).toHaveLength(1);
+  });
+
+  it("still toasts a non-license error", async () => {
+    await sendAndFail(serverError("Header lookup failed")).catch((err: any) =>
+      toast({ variant: "error", message: raw(err.response.data.message) }),
+    );
+    expect(errorRecords().map((r) => r.message)).toEqual(["Header lookup failed"]);
+  });
+
+  it("keeps a denial of a request the previous page started without a denial toast, and out of error toasts", async () => {
+    await failAndToast(denial("workflows", "Workflows needs a license"), navigate);
+    expect(denialToasts()).toHaveLength(0);
+    expect(errorRecords()).toHaveLength(0);
+  });
+});
+
+describe("fetch license receiver", () => {
+  const nativeFetch = window.fetch;
+  const respond = (url: string, status: number, body: string, beforeResponse = () => {}) => {
+    const response = new Response(body, { status });
+    Object.defineProperty(response, "url", { value: url });
+    window.fetch = vi.fn(async () => {
+      beforeResponse();
+      return response;
+    });
+    installFetchLicenseReceiver();
+    return response;
+  };
+  const licenseBody = JSON.stringify({
+    code: 40001,
+    message: "Features not included in your license: oncall",
+    error_detail: "oncall",
+  });
+
+  afterEach(() => {
+    window.fetch = nativeFetch;
+  });
+
+  it("sends a 403 + 40001 from the API to a warning toast and returns the response untouched", async () => {
+    const response = respond("http://localhost:5080/api/org/oncall", 403, licenseBody);
+    const got = await fetch("http://localhost:5080/api/org/oncall");
+    expect(got).toBe(response);
+    expect(denialToasts()).toHaveLength(1);
+    genericToast();
+    expect(errorRecords()).toHaveLength(0);
+  });
+
+  it("keeps a denial of a request the previous page started without a denial toast, and out of error toasts", async () => {
+    respond("http://localhost:5080/api/org/oncall", 403, licenseBody, navigate);
+    await fetch("http://localhost:5080/api/org/oncall");
+    expect(denialToasts()).toHaveLength(0);
+    genericToast();
+    expect(errorRecords()).toHaveLength(0);
+  });
+
+  it("ignores a 403 that is not a license denial", async () => {
+    respond("http://localhost:5080/api/org/x", 403, JSON.stringify({ code: 403 }));
+    await fetch("http://localhost:5080/api/org/x");
+    expect(denialToasts()).toHaveLength(0);
+  });
+
+  it("ignores a license-shaped 403 from another origin", async () => {
+    respond("https://elsewhere.example/api/org/oncall", 403, licenseBody);
+    await fetch("https://elsewhere.example/api/org/oncall");
+    expect(denialToasts()).toHaveLength(0);
+  });
+
+  it("returns a 403 whose body is not JSON without throwing", async () => {
+    const response = respond("http://localhost:5080/api/org/x", 403, "<html>forbidden</html>");
+    await expect(fetch("http://localhost:5080/api/org/x")).resolves.toBe(response);
+    expect(await response.text()).toBe("<html>forbidden</html>");
+    expect(denialToasts()).toHaveLength(0);
+  });
+});
diff --git a/web/src/services/http.spec.ts b/web/src/services/http.spec.ts
index 359b579f59..50fb5fab77 100644
--- a/web/src/services/http.spec.ts
+++ b/web/src/services/http.spec.ts
@@ -57,6 +57,8 @@ vi.mock("@/composables/useAccessStore", () => ({
   currentAccessRouteKey,
   resetAccess: vi.fn(),
 }));
+const { addLicenseDeniedError } = vi.hoisted(() => ({ addLicenseDeniedError: vi.fn() }));
+vi.mock("@/composables/useLicenseDenials", () => ({ addLicenseDeniedError }));
 
 import config from "../aws-exports";
 import store from "../stores";
@@ -189,6 +191,52 @@ describe("attemptTokenRefresh", () => {
   });
 });
 
+describe("response interceptor — license 403 handling", () => {
+  // Builds a real instance and returns the rejection handler it registered.
+  function errorHandler() {
+    const use = vi.fn();
+    vi.mocked(axios.create).mockReturnValue({
+      interceptors: { request: { use: vi.fn() }, response: { use } },
+    } as any);
+    http();
+    return use.mock.calls[0][1] as (error: unknown) => Promise<unknown>;
+  }
+
+  const forbidden = (data: Record<string, unknown>) => ({
+    response: { status: 403, data },
+    request: { responseURL: "http://localhost:5080/api/org/workflows" },
+    config: { url: "/api/org/workflows" },
+  });
+
+  beforeEach(() => {
+    (config as any).isEnterprise = "true";
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+    (config as any).isEnterprise = "false";
+  });
+
+  it("sends the missing features of a code 40001 denial to the top bar", async () => {
+    const error = forbidden({ code: 40001, error_detail: "oncall, workflows" });
+    (error.config as Record<string, unknown>).startedAt = 42;
+
+    await expect(errorHandler()(error)).rejects.toBe(error);
+
+    expect(addLicenseDeniedError).toHaveBeenCalledWith(["oncall", "workflows"], 42);
+    expect(recordForbidden).not.toHaveBeenCalled();
+  });
+
+  it("keeps a plain 403 on the RBAC access toast", async () => {
+    const error = forbidden({ code: 403, message: "Unauthorized Access" });
+
+    await expect(errorHandler()(error)).rejects.toBe(error);
+
+    expect(recordForbidden).toHaveBeenCalledTimes(1);
+    expect(addLicenseDeniedError).not.toHaveBeenCalled();
+  });
+});
+
 describe("http 403 interceptor", () => {
   /** Builds an instance and returns the rejection handler it registered. */
   const errorHandler = () => {
diff --git a/web/src/services/http.ts b/web/src/services/http.ts
index 6d4f3a875a..31fd5a5b1c 100644
--- a/web/src/services/http.ts
+++ b/web/src/services/http.ts
@@ -25,6 +25,7 @@ import {
 } from "@/composables/useAccessStore";
 import { usePasswordReset } from "@/composables/usePasswordReset";
 import { isPasswordResetError } from "@/utils/passwordResetErrors";
+import { receiveLicenseDenial } from "@/services/licenseDenialReceiver";
 
 declare module "axios" {
   interface AxiosRequestConfig {
@@ -34,6 +35,7 @@ declare module "axios" {
     silentForbidden?: boolean;
     /** Route the request started on, so a late 403 is not pinned on the page the user moved to. */
     accessRouteKey?: string;
+    startedAt?: number;
   }
 }
 
@@ -108,6 +110,7 @@ const http = ({ headers } = {} as any) => {
   instance.interceptors.request.use((requestConfig) => {
     // A retry after a token refresh reuses its config, so it keeps the page that first asked.
     requestConfig.accessRouteKey ??= currentAccessRouteKey();
+    requestConfig.startedAt = Date.now();
     return requestConfig;
   });
 
@@ -127,6 +130,8 @@ const http = ({ headers } = {} as any) => {
         // A blocked page fires many requests behind an undismissable dialog; one toast per rejection would stack.
         return new Promise(() => {});
       }
+      // Ahead of the status switch: a license denial must not read as a missing RBAC permission.
+      if (receiveLicenseDenial(error, error?.config?.startedAt)) return Promise.reject(error);
       if (error && error.response && error.response.status) {
         switch (error.response.status) {
           case 400:
diff --git a/web/src/services/licenseDenialReceiver.ts b/web/src/services/licenseDenialReceiver.ts
new file mode 100644
index 0000000000..78286a98f0
--- /dev/null
+++ b/web/src/services/licenseDenialReceiver.ts
@@ -0,0 +1,50 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import store from "../stores";
+import { addLicenseDeniedError } from "@/composables/useLicenseDenials";
+import { markLicenseDenial } from "@/composables/useFeatureLock";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
+
+/** Sends a license denial (403 + 40001) to the top bar; true when the error was one. */
+export const receiveLicenseDenial = (error: unknown, requestStartedAt?: number): boolean => {
+  const features = licenseDeniedFeatures(error);
+  if (!features) return false;
+  markLicenseDenial(error);
+  addLicenseDeniedError(features, requestStartedAt);
+  return true;
+};
+
+/** Wraps `window.fetch` so raw-fetch API calls reach the same license-denial receiver as axios. */
+export const installFetchLicenseReceiver = (): void => {
+  const nativeFetch = window.fetch.bind(window);
+  window.fetch = async (...args) => {
+    const startedAt = Date.now();
+    const response = await nativeFetch(...args);
+    if (response.status !== 403) return response;
+    try {
+      if (response.url.startsWith(new URL(store.state.API_ENDPOINT, window.location.origin).href)) {
+        // Awaited so the denial is marked before the caller can toast its message.
+        receiveLicenseDenial(
+          { response: { status: 403, data: await response.clone().json() } },
+          startedAt,
+        );
+      }
+    } catch {
+      // A body that is not JSON is not a license denial.
+    }
+    return response;
+  };
+};
diff --git a/web/src/services/oncall.queries.spec.ts b/web/src/services/oncall.queries.spec.ts
index 3702c975ff..46ff196fe2 100644
--- a/web/src/services/oncall.queries.spec.ts
+++ b/web/src/services/oncall.queries.spec.ts
@@ -17,18 +17,26 @@ import { describe, it, expect, vi, beforeEach } from "vitest";
 import { queryClient } from "@/composables/query/queryClient";
 import { LIVE_STALE_TIME, NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
 import {
+  addTeamMembersMutation,
+  applySchedulePresetMutation,
   confirmCodeMutation,
   contactQuery,
+  createOverrideMutation,
   createOwnershipRuleMutation,
+  deleteOverrideMutation,
   deleteOwnershipRuleMutation,
   deleteTelephonyMutation,
   oncallTeamsQuery,
   pagedResponsesQuery,
   responsesQuery,
   routingConfigQuery,
+  removeTeamMemberMutation,
   saveTelephonyMutation,
   setContactMutation,
   setTeamChannelMutation,
+  setTeamPolicyMutation,
+  setTeamScheduleMutation,
+  teamContextQuery,
   telephonyQuery,
   testTeamSlackChannelMutation,
   updateOwnershipRuleMutation,
@@ -127,6 +135,31 @@ describe("editing a team", () => {
   });
 });
 
+describe("the Pages list's team context", () => {
+  beforeEach(() => queryClient.clear());
+
+  // One entry for many teams, so it sits outside every per-team prefix those writes drop.
+  it.each([
+    ["a policy write", setTeamPolicyMutation],
+    ["a schedule write", setTeamScheduleMutation],
+    ["a schedule preset", applySchedulePresetMutation],
+    ["an override", createOverrideMutation],
+    ["an override removal", deleteOverrideMutation],
+    ["adding members", addTeamMembersMutation],
+    ["removing a member", removeTeamMemberMutation],
+    ["a channel write", setTeamChannelMutation],
+  ])("is marked stale by %s", async (_, mutation) => {
+    const key = teamContextQuery(ORG, ["t1", "t2"], true).queryKey;
+    queryClient.setQueryData(key, []);
+
+    for (const scope of mutation(ORG, "t1").meta?.invalidates ?? []) {
+      await queryClient.invalidateQueries({ queryKey: scope, refetchType: "none" });
+    }
+
+    expect(queryClient.getQueryState(key)?.isInvalidated).toBe(true);
+  });
+});
+
 describe("ownership rule writes", () => {
   /// A rule's "never matched" finding lives in its team's risk list, so a
   /// deleted rule kept warning from the team page for the risk tier.
diff --git a/web/src/services/oncall.queries.ts b/web/src/services/oncall.queries.ts
index d025418b7c..438098f7d5 100644
--- a/web/src/services/oncall.queries.ts
+++ b/web/src/services/oncall.queries.ts
@@ -28,6 +28,7 @@ import type {
   Contact,
   CoverageGaps,
   EscalationProgress,
+  EscalationProgressEntry,
   MyDeliveries,
   MyOnCall,
   OnCallPolicy,
@@ -36,6 +37,7 @@ import type {
   OnCallResponseReport,
   OnCallSchedule,
   OnCallTeam,
+  OnCallTeamContext,
   OnCallTeamMember,
   Override,
   OwnershipRule,
@@ -162,6 +164,21 @@ export const whoIsOnCallQuery = (org: string, teamId: string, at?: number) =>
     staleTime: LIVE_STALE_TIME,
   });
 
+/** Carries each team's rotation, which handovers move, so it takes the live tier like `whoIsOnCallQuery`. */
+export const teamContextQuery = (org: string, teamIds: string[], includeMine: boolean) =>
+  queryOptions({
+    queryKey: oncallKeys.teamContext(org, teamIds, includeMine),
+    queryFn: async (): Promise<OnCallTeamContext[]> =>
+      (
+        await oncallService.teamContext({
+          org_identifier: org,
+          team_ids: teamIds,
+          include_mine: includeMine,
+        })
+      ).data?.teams ?? [],
+    staleTime: LIVE_STALE_TIME,
+  });
+
 /** Mixes the ladder (config) with `covered_now`, so it follows the live half. */
 export const teamOverviewQuery = (org: string, teamId: string) =>
   queryOptions({
@@ -342,6 +359,20 @@ export const responseProgressQuery = (org: string, responseId: string) =>
     staleTime: LIVE_STALE_TIME,
   });
 
+/** The batch form of `responseProgressQuery`, for a list of open pages. */
+export const responsesProgressQuery = (org: string, responseIds: string[]) =>
+  queryOptions({
+    queryKey: oncallKeys.responsesProgress(org, responseIds),
+    queryFn: async (): Promise<EscalationProgressEntry[]> =>
+      (
+        await oncallService.escalationProgressBatch({
+          org_identifier: org,
+          response_ids: responseIds,
+        })
+      ).data?.progress ?? [],
+    staleTime: LIVE_STALE_TIME,
+  });
+
 /** How this signal ended the last times it fired — history, so it cannot change under us. */
 export const responsePriorCausesQuery = (org: string, responseId: string) =>
   queryOptions({
@@ -509,6 +540,7 @@ export const unavailabilityQuery = (org: string, userEmail?: string, from?: numb
  */
 const teamWriteScopes = (org: string, teamId: string) => [
   oncallKeys.team(org, teamId),
+  oncallKeys.teamContextAll(org),
   oncallKeys.coverageGaps(org),
   oncallKeys.myAll(org),
 ];
@@ -595,14 +627,20 @@ export const setTeamPolicyMutation = (org: string, teamId: string) =>
     mutationFn: (data: Parameters<typeof oncallService.setPolicy>[0]["data"]) =>
       oncallService.setPolicy({ org_identifier: org, team_id: teamId, data }),
     // Rungs feed the overview, the dry run and the risk list; coverage is unmoved.
-    meta: { invalidates: [oncallKeys.team(org, teamId)], silentError: true },
+    meta: {
+      invalidates: [oncallKeys.team(org, teamId), oncallKeys.teamContextAll(org)],
+      silentError: true,
+    },
   });
 
 export const setTeamChannelMutation = (org: string, teamId: string) =>
   mutationOptions({
     mutationFn: (data: SetTeamChannelBody) =>
       oncallService.setTeamChannel({ org_identifier: org, team_id: teamId, data }),
-    meta: { invalidates: [oncallKeys.team(org, teamId)], silentError: true },
+    meta: {
+      invalidates: [oncallKeys.team(org, teamId), oncallKeys.teamContextAll(org)],
+      silentError: true,
+    },
   });
 
 /** RO-6: posts one plain message and writes no row, so it expires nothing. */
diff --git a/web/src/services/oncall.querykeys.ts b/web/src/services/oncall.querykeys.ts
index 7c6804545e..951ff85c91 100644
--- a/web/src/services/oncall.querykeys.ts
+++ b/web/src/services/oncall.querykeys.ts
@@ -43,6 +43,10 @@ export const oncallKeys = {
   members: (org: string, teamId: string) => orgKey(org, "oncall", "teams", teamId, "members"),
   schedule: (org: string, teamId: string) => orgKey(org, "oncall", "teams", teamId, "schedule"),
   policy: (org: string, teamId: string) => orgKey(org, "oncall", "teams", teamId, "policy"),
+  /** Many teams in one entry, outside every per-team prefix, so each team write names this scope too. */
+  teamContextAll: (org: string) => orgKey(org, "oncall", "teams", "context"),
+  teamContext: (org: string, teamIds: string[], includeMine: boolean) =>
+    orgKey(org, "oncall", "teams", "context", [...teamIds].sort().join(","), includeMine),
   /**
    * `at` omitted asks for "now", which every caller derives from the clock, so
    * it buckets to the minute; a pinned instant (a closed record's `closed_at`)
@@ -108,6 +112,9 @@ export const oncallKeys = {
   response: (org: string, responseId: string) => orgKey(org, "oncall", "responses", responseId),
   responseProgress: (org: string, responseId: string) =>
     orgKey(org, "oncall", "responses", responseId, "progress"),
+  /** Under `responsesAll`, so a response write drops it like the per-record entry. */
+  responsesProgress: (org: string, responseIds: string[]) =>
+    orgKey(org, "oncall", "responses", "escalation", [...responseIds].sort().join(",")),
   responsePriorCauses: (org: string, responseId: string) =>
     orgKey(org, "oncall", "responses", responseId, "priorCauses"),
   responseReport: (org: string, responseId: string) =>
diff --git a/web/src/services/oncall.ts b/web/src/services/oncall.ts
index e5c223c653..56c5cc1d58 100644
--- a/web/src/services/oncall.ts
+++ b/web/src/services/oncall.ts
@@ -33,6 +33,7 @@ import type {
   PresetDescriptor,
   OnCallPosition,
   OnCallTeam,
+  OnCallTeamContext,
   OnCallTeamMember,
   L0Policy,
   PolicyFinalAction,
@@ -49,6 +50,7 @@ import type {
   DeliveryLedger,
   EscalateResult,
   EscalationProgress,
+  EscalationProgressEntry,
   MyDeliveries,
   MyDeliveriesRead,
   MyOnCall,
@@ -205,6 +207,20 @@ const oncall = {
       at === undefined ? undefined : { params: { at } },
     ),
 
+  /// Policy, rotation and schedule for many teams in one read; `include_mine` adds the caller's teams.
+  teamContext: ({
+    org_identifier,
+    team_ids,
+    include_mine,
+  }: {
+    org_identifier: string;
+    team_ids: string[];
+    include_mine: boolean;
+  }) =>
+    http().get<{ teams: OnCallTeamContext[] }>(`/api/${org_identifier}/oncall/teams/context`, {
+      params: { team_ids: team_ids.join(","), include_mine },
+    }),
+
   getPolicy: ({ org_identifier, team_id }: { org_identifier: string; team_id: string }) =>
     http().get<OnCallPolicy>(
       `/api/${org_identifier}/oncall/teams/${encodeURIComponent(team_id)}/policy`,
@@ -600,6 +616,19 @@ const oncall = {
       `/api/${org_identifier}/oncall/responses/${encodeURIComponent(response_id)}/escalation`,
     ),
 
+  /// Where the ladder has got to for many records in one read; an unreadable id is left out.
+  escalationProgressBatch: ({
+    org_identifier,
+    response_ids,
+  }: {
+    org_identifier: string;
+    response_ids: string[];
+  }) =>
+    http().get<{ progress: EscalationProgressEntry[] }>(
+      `/api/${org_identifier}/oncall/responses/escalation`,
+      { params: { response_ids: response_ids.join(",") } },
+    ),
+
   /// What previous firings of this subject turned out to be, grouped by cause.
   priorCauses: ({ org_identifier, response_id }: { org_identifier: string; response_id: string }) =>
     http().get<CauseGroup[]>(
diff --git a/web/src/services/service_streams.spec.ts b/web/src/services/service_streams.spec.ts
index ad3c6f46b4..d5a2248e50 100644
--- a/web/src/services/service_streams.spec.ts
+++ b/web/src/services/service_streams.spec.ts
@@ -23,6 +23,7 @@ import serviceStreams, {
   type FieldAlias,
 } from "@/services/service_streams";
 import http from "@/services/http";
+import store from "@/stores";
 
 vi.mock("@/services/http", () => ({
   default: vi.fn(() => ({
@@ -91,8 +92,8 @@ describe("service_streams service", () => {
 
   // -------------------------------------------------------------------------
   describe("getSemanticGroups", () => {
-    it("calls GET /api/{org}/alerts/deduplication/semantic-groups", () => {
-      getSemanticGroups(ORG);
+    it("calls GET /api/{org}/alerts/deduplication/semantic-groups", async () => {
+      await getSemanticGroups(ORG);
 
       expect(mockHttpInstance.get).toHaveBeenCalledWith(
         `/api/${ORG}/alerts/deduplication/semantic-groups`,
@@ -100,8 +101,8 @@ describe("service_streams service", () => {
       );
     });
 
-    it("forwards silentForbidden to the request config", () => {
-      getSemanticGroups(ORG, { silentForbidden: true });
+    it("forwards silentForbidden to the request config", async () => {
+      await getSemanticGroups(ORG, { silentForbidden: true });
 
       expect(mockHttpInstance.get).toHaveBeenCalledWith(
         `/api/${ORG}/alerts/deduplication/semantic-groups`,
@@ -109,19 +110,17 @@ describe("service_streams service", () => {
       );
     });
 
-    it("calls GET exactly once", () => {
-      getSemanticGroups(ORG);
+    it("calls GET exactly once", async () => {
+      await getSemanticGroups(ORG);
 
       expect(mockHttpInstance.get).toHaveBeenCalledTimes(1);
     });
 
-    it("returns the promise from http().get", () => {
-      const expected = Promise.resolve({ data: [] });
-      mockHttpInstance.get.mockReturnValue(expected);
+    it("resolves with the http().get response", async () => {
+      const expected = { data: [{ id: "host" }] };
+      mockHttpInstance.get.mockResolvedValue(expected);
 
-      const result = getSemanticGroups(ORG);
-
-      expect(result).toBe(expected);
+      await expect(getSemanticGroups(ORG)).resolves.toBe(expected);
     });
 
     it("propagates rejection from http().get", async () => {
@@ -130,8 +129,24 @@ describe("service_streams service", () => {
       await expect(getSemanticGroups(ORG)).rejects.toThrow("not found");
     });
 
-    it("works when called via the default export", () => {
-      serviceStreams.getSemanticGroups(ORG);
+    it.each([
+      ["locked", 0],
+      ["enabled", 1],
+      ["hidden", 1],
+    ])("a %s alerts license makes %i request(s)", async (state, calls) => {
+      const original = store.state.zoConfig;
+      store.state.zoConfig = { ...original, features: { alerts: state } };
+      try {
+        const result = await getSemanticGroups(ORG);
+        expect(mockHttpInstance.get).toHaveBeenCalledTimes(calls);
+        if (!calls) expect(result).toEqual({ data: [] });
+      } finally {
+        store.state.zoConfig = original;
+      }
+    });
+
+    it("works when called via the default export", async () => {
+      await serviceStreams.getSemanticGroups(ORG);
 
       expect(mockHttpInstance.get).toHaveBeenCalledWith(
         `/api/${ORG}/alerts/deduplication/semantic-groups`,
@@ -240,8 +255,8 @@ describe("service_streams service", () => {
 
   // -------------------------------------------------------------------------
   describe("org_identifier scoping", () => {
-    it("getSemanticGroups uses the provided org in the URL", () => {
-      getSemanticGroups("acme-corp");
+    it("getSemanticGroups uses the provided org in the URL", async () => {
+      await getSemanticGroups("acme-corp");
 
       expect(mockHttpInstance.get).toHaveBeenCalledWith(
         "/api/acme-corp/alerts/deduplication/semantic-groups",
diff --git a/web/src/services/service_streams.ts b/web/src/services/service_streams.ts
index 29e6be3627..398e2572b9 100644
--- a/web/src/services/service_streams.ts
+++ b/web/src/services/service_streams.ts
@@ -14,6 +14,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import http from "./http";
+import { featureState } from "@/utils/featureGate";
 
 /**
  * Service Streams API Client
@@ -203,10 +204,14 @@ export interface DimensionAnalyticsSummary {
  * Get semantic field groups for field name translation
  * Uses the existing alerts/deduplication/semantic-groups API
  */
-export const getSemanticGroups = (
+export const getSemanticGroups = async (
   org_identifier: string,
   options?: { silentForbidden?: boolean },
 ): Promise<{ data: FieldAlias[] }> => {
+  // Imported lazily: chart specs mock vuex and load this module, and a static import would build the store there.
+  const { default: store } = await import("../stores");
+  // The backend licenses this read under alerts, yet free pages call it, so a locked alerts license reads no groups.
+  if (featureState(store.state.zoConfig?.features, "alerts") === "locked") return { data: [] };
   return http().get(`/api/${org_identifier}/alerts/deduplication/semantic-groups`, options);
 };
 
diff --git a/web/src/styles/utilities.css b/web/src/styles/utilities.css
index 1980538d7d..1d57117efc 100644
--- a/web/src/styles/utilities.css
+++ b/web/src/styles/utilities.css
@@ -90,6 +90,55 @@
   box-shadow: var(--shadow-lg) !important;
 }
 
+/* License-locked page: controls, drag handles and splitters lose pointer input and look disabled, while scroll containers and FeatureLockExempt navigation stay live. Consumer: components/common/FeatureLockBoundary.vue. */
+@utility feature-locked-content {
+  &
+    :is(
+      a[href],
+      button,
+      input,
+      select,
+      textarea,
+      label,
+      summary,
+      [contenteditable="true"],
+      [role="button"],
+      [role="link"],
+      [role="tab"],
+      [role="checkbox"],
+      [role="radio"],
+      [role="switch"],
+      [role="combobox"],
+      [role="menuitem"],
+      [role="option"],
+      [role="slider"],
+      [role="separator"],
+      [draggable="true"],
+      .vue-flow__node,
+      .vue-flow__handle,
+      .vue-flow__edge,
+      .q-btn,
+      .q-field,
+      .q-toggle,
+      .q-checkbox,
+      .q-radio,
+      .q-tab,
+      .q-item--clickable
+    ):not([data-feature-lock-exempt] *) {
+    pointer-events: none;
+  }
+  &
+    :is(a[href], button, .q-btn, .q-field, .q-toggle, .q-checkbox, .q-radio, .q-tab):not(
+      :disabled,
+      [aria-disabled="true"],
+      [data-o2-btn],
+      [data-feature-lock-exempt] *
+    ) {
+    color: var(--color-text-disabled);
+    opacity: 0.6;
+  }
+}
+
 /* Announcement message markup comes from v-html, so links and code inherit the operator-chosen banner colour. */
 @utility announcement-message {
   overflow-wrap: anywhere;
@@ -130,3 +179,16 @@
     var(--color-status-negative)
   );
 }
+
+/* Thin ring cut around a glyph so it stays legible when it overlaps another icon. */
+@utility lock-halo {
+  filter: drop-shadow(0.09375rem 0 0 var(--color-surface-chrome-deeper))
+    drop-shadow(-0.09375rem 0 0 var(--color-surface-chrome-deeper))
+    drop-shadow(0 0.09375rem 0 var(--color-surface-chrome-deeper))
+    drop-shadow(0 -0.09375rem 0 var(--color-surface-chrome-deeper));
+}
+
+/* Bare amber lock glyph, no container: the one look for every lock icon. */
+@utility lock-chip {
+  @apply text-icon-locked;
+}
diff --git a/web/src/test/unit/HomeView.spec.ts b/web/src/test/unit/HomeView.spec.ts
index 92dd225c53..bee9ec9e4a 100644
--- a/web/src/test/unit/HomeView.spec.ts
+++ b/web/src/test/unit/HomeView.spec.ts
@@ -22,6 +22,7 @@ import i18n from "@/locales";
 import { nextTick } from "vue";
 import { useHomeDashboard } from "@/composables/useHomeDashboard";
 import { queryClient } from "@/composables/query/queryClient";
+import { settingKeys } from "@/services/settings.querykeys";
 
 vi.mock("../../aws-exports", () => ({
   default: {
@@ -367,6 +368,7 @@ describe("HomeView org home dashboard tab", () => {
     vi.clearAllTimers();
     localStorage.clear();
     useHomeDashboard(gt).homeDashboard.value = null;
+    queryClient.clear();
   });
 
   const createWrapper = () => {
@@ -438,56 +440,50 @@ describe("HomeView org home dashboard tab", () => {
     };
     wrapper = createWrapper();
     wrapper.vm.activeHomeTab = "dash:default:abc";
-    await wrapper.vm.$nextTick();
+    await flushPromises();
     expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).exists()).toBe(true);
   });
 
-  it("clears the home dashboard and falls back to first tab on unavailable", async () => {
+  const pinIn = (folderId: string, dashboardId = "abc") => ({
+    data: { setting_value: { dashboardId, folderId, label: "X" } },
+  });
+
+  it("clears the home dashboard and falls back to first tab when a fresh read confirms the pin", async () => {
     const hd = useHomeDashboard(gt);
-    hd.homeDashboard.value = {
-      dashboardId: "abc",
-      folderId: "default",
-      label: "Payments Health",
-    };
+    hd.homeDashboard.value = { dashboardId: "abc", folderId: "default", label: "Payments Health" };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("default"));
     wrapper = createWrapper();
     wrapper.vm.activeHomeTab = "dash:default:abc";
-    await wrapper.vm.$nextTick();
-    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc");
-    await wrapper.vm.$nextTick();
+    await flushPromises();
+    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc", "default");
+    await flushPromises();
     expect(hd.homeDashboard.value).toBeNull();
     expect(wrapper.vm.activeHomeTab).not.toBe("dash:default:abc");
   });
 
   it("toasts when the pinned dashboard is reported unavailable", async () => {
-    const hd = useHomeDashboard(gt);
-    hd.homeDashboard.value = {
+    useHomeDashboard(gt).homeDashboard.value = {
       dashboardId: "abc",
       folderId: "default",
       label: "Payments Health",
     };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("default"));
     wrapper = createWrapper();
     wrapper.vm.activeHomeTab = "dash:default:abc";
-    await wrapper.vm.$nextTick();
+    await flushPromises();
     toastSpy.mockClear();
-    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc");
-    await wrapper.vm.$nextTick();
+    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc", "default");
+    await flushPromises();
     expect(toastSpy).toHaveBeenCalledWith(expect.objectContaining({ variant: "error" }));
   });
 
   it("re-syncs the home_dashboard setting when the pinned tab is activated", async () => {
     (settingsService.getSetting as any).mockClear();
-    (settingsService.getSetting as any).mockResolvedValue({
-      data: { setting_value: { dashboardId: "abc", folderId: "A", label: "X" } },
-    });
-    useHomeDashboard(gt).homeDashboard.value = {
-      dashboardId: "abc",
-      folderId: "B",
-      label: "X",
-    };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("A"));
+    useHomeDashboard(gt).homeDashboard.value = { dashboardId: "abc", folderId: "B", label: "X" };
     wrapper = createWrapper();
     wrapper.vm.activeHomeTab = "dash:B:abc";
     await flushPromises();
-    // load(org) re-reads the authoritative setting via getSetting(org, key).
     expect(settingsService.getSetting).toHaveBeenCalledWith(
       "test-org",
       "home_dashboard",
@@ -495,6 +491,135 @@ describe("HomeView org home dashboard tab", () => {
     );
   });
 
+  it("re-reads the pin in the background on each switch without holding the tab back", async () => {
+    const pin = { dashboardId: "abc", folderId: "A", label: "X" };
+    queryClient.setQueryData(settingKeys.one("test-org", "home_dashboard"), pin);
+    useHomeDashboard(gt).homeDashboard.value = { ...pin };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("A"));
+    wrapper = createWrapper();
+    await flushPromises();
+    (settingsService.getSetting as any).mockClear();
+    for (let i = 0; i < 3; i++) {
+      wrapper.vm.activeHomeTab = "overview";
+      await flushPromises();
+      wrapper.vm.activeHomeTab = "dash:A:abc";
+      await nextTick();
+      expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).exists()).toBe(true);
+      await flushPromises();
+    }
+    expect(settingsService.getSetting).toHaveBeenCalledTimes(3);
+  });
+
+  it("drops a pin cleared on another device when Home is revisited on another tab", async () => {
+    useHomeDashboard(gt).homeDashboard.value = { dashboardId: "abc", folderId: "A", label: "X" };
+    (settingsService.getSetting as any).mockRejectedValue({ response: { status: 404 } });
+    wrapper = createWrapper();
+    await flushPromises();
+
+    expect(wrapper.vm.activeHomeTab).toBe("overview");
+    expect(wrapper.find('[data-test^="home-tab-dash:"]').exists()).toBe(false);
+  });
+
+  it("ignores a late failure from the tab of the folder the pin moved out of", async () => {
+    const pin = { dashboardId: "abc", folderId: "A", label: "X" };
+    useHomeDashboard(gt).homeDashboard.value = { ...pin };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("A"));
+    wrapper = createWrapper();
+    wrapper.vm.activeHomeTab = "dash:A:abc";
+    await flushPromises();
+    toastSpy.mockClear();
+
+    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc", "B");
+    await flushPromises();
+
+    expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("A");
+    expect(wrapper.vm.activeHomeTab).toBe("dash:A:abc");
+    expect(settingsService.deleteOrgSetting).not.toHaveBeenCalled();
+    expect(toastSpy).not.toHaveBeenCalled();
+  });
+
+  it("follows a pin moved elsewhere when the cached folder fails, instead of deleting it", async () => {
+    const stale = { dashboardId: "abc", folderId: "B", label: "X" };
+    queryClient.setQueryData(settingKeys.one("test-org", "home_dashboard"), stale);
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("A"));
+    useHomeDashboard(gt).homeDashboard.value = { ...stale };
+    wrapper = createWrapper();
+    wrapper.vm.activeHomeTab = "dash:B:abc";
+    await flushPromises();
+    toastSpy.mockClear();
+
+    wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc", "B");
+    await flushPromises();
+
+    expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("A");
+    expect(wrapper.vm.activeHomeTab).toBe("dash:A:abc");
+    expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).props("folderId")).toBe("A");
+    expect(settingsService.deleteOrgSetting).not.toHaveBeenCalled();
+    expect(toastSpy).not.toHaveBeenCalled();
+  });
+
+  it("leaves the pinned tab without deleting anything when the pin was cleared elsewhere", async () => {
+    const pin = { dashboardId: "abc", folderId: "A", label: "X" };
+    useHomeDashboard(gt).homeDashboard.value = { ...pin };
+    (settingsService.getSetting as any).mockRejectedValue({ response: { status: 404 } });
+    wrapper = createWrapper();
+    wrapper.vm.activeHomeTab = "dash:A:abc";
+    await flushPromises();
+
+    expect(useHomeDashboard(gt).homeDashboard.value).toBeNull();
+    expect(wrapper.vm.activeHomeTab).toBe("overview");
+    expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).exists()).toBe(false);
+    expect(settingsService.deleteOrgSetting).not.toHaveBeenCalled();
+  });
+
+  it("leaves the pinned tab when the pin was replaced by another dashboard elsewhere", async () => {
+    useHomeDashboard(gt).homeDashboard.value = { dashboardId: "abc", folderId: "A", label: "X" };
+    (settingsService.getSetting as any).mockResolvedValue(pinIn("A", "xyz"));
+    wrapper = createWrapper();
+    wrapper.vm.activeHomeTab = "dash:A:abc";
+    await flushPromises();
+
+    expect(wrapper.vm.activeHomeTab).toBe("overview");
+    expect(wrapper.find('[data-test="home-tab-dash:A:xyz"]').exists()).toBe(true);
+  });
+
+  describe("a saved pinned tab restored on mount", () => {
+    const loadPin = async (folderId: string) => {
+      queryClient.clear();
+      (settingsService.getSetting as any).mockResolvedValueOnce(pinIn(folderId));
+      await useHomeDashboard(gt).load("test-org");
+    };
+
+    it("opens the pin's current folder after the dashboard moved", async () => {
+      await loadPin("A");
+      (settingsService.getSetting as any).mockResolvedValue(pinIn("A"));
+      localStorage.setItem("o2_home_active_tab", "dash:B:abc");
+      wrapper = createWrapper();
+      await flushPromises();
+
+      expect(wrapper.vm.activeHomeTab).toBe("dash:A:abc");
+      expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).props("folderId")).toBe("A");
+    });
+
+    it("recovers from an out-of-band move once the stale folder fails, keeping the pin", async () => {
+      await loadPin("B");
+      let answer: (v: unknown) => void = () => {};
+      (settingsService.getSetting as any).mockReturnValue(new Promise((r) => (answer = r)));
+      localStorage.setItem("o2_home_active_tab", "dash:B:abc");
+      wrapper = createWrapper();
+      await flushPromises();
+      expect(wrapper.vm.activeHomeTab).toBe("dash:B:abc");
+
+      wrapper.findComponent({ name: "PinnedDashboardTab" }).vm.$emit("unavailable", "abc", "B");
+      answer(pinIn("A"));
+      await flushPromises();
+
+      expect(wrapper.vm.activeHomeTab).toBe("dash:A:abc");
+      expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("A");
+      expect(settingsService.deleteOrgSetting).not.toHaveBeenCalled();
+    });
+  });
+
   it("does NOT toast when the pin is closed deliberately via the ×", async () => {
     const hd = useHomeDashboard(gt);
     hd.homeDashboard.value = {
@@ -567,6 +692,21 @@ describe("HomeView org home dashboard tab", () => {
       expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).exists()).toBe(true);
     });
 
+    it("opens the pin's new folder when the pending pin arrives moved", async () => {
+      localStorage.setItem("o2_home_active_tab", "dash:old:abc");
+      await startPendingLoad();
+      wrapper = createWrapper();
+      await flushPromises();
+      expect(wrapper.vm.activeHomeTab).toBe("dash:old:abc");
+
+      answer({ data: { setting_value: PINNED } });
+      await flushPromises();
+      expect(wrapper.vm.activeHomeTab).toBe("dash:default:abc");
+      expect(wrapper.findComponent({ name: "PinnedDashboardTab" }).props("folderId")).toBe(
+        "default",
+      );
+    });
+
     it("falls back to the first tab once the org turns out to have no pin", async () => {
       localStorage.setItem("o2_home_active_tab", "dash:default:abc");
       await startPendingLoad();
diff --git a/web/src/test/unit/PinnedDashboardTab.spec.ts b/web/src/test/unit/PinnedDashboardTab.spec.ts
index 493482b6a6..05cc581f0d 100644
--- a/web/src/test/unit/PinnedDashboardTab.spec.ts
+++ b/web/src/test/unit/PinnedDashboardTab.spec.ts
@@ -182,7 +182,7 @@ describe("PinnedDashboardTab", () => {
     (getDashboard as any).mockRejectedValue({ response: { status: 404 } });
     wrapper = factory();
     await flushPromises();
-    expect(wrapper.emitted("unavailable")?.[0]).toEqual(["abc"]);
+    expect(wrapper.emitted("unavailable")?.[0]).toEqual(["abc", "default"]);
   });
 
   it("emits unavailable when getDashboard returns an empty object (deleted)", async () => {
@@ -190,7 +190,7 @@ describe("PinnedDashboardTab", () => {
     (getDashboard as any).mockResolvedValue({});
     wrapper = factory();
     await flushPromises();
-    expect(wrapper.emitted("unavailable")?.[0]).toEqual(["abc"]);
+    expect(wrapper.emitted("unavailable")?.[0]).toEqual(["abc", "default"]);
   });
 
   it("shows skeleton while loading", async () => {
diff --git a/web/src/ts/interfaces/oncall.ts b/web/src/ts/interfaces/oncall.ts
index 338b3400a1..fdd45df63e 100644
--- a/web/src/ts/interfaces/oncall.ts
+++ b/web/src/ts/interfaces/oncall.ts
@@ -594,6 +594,8 @@ export interface OnCallResponse {
   reached_rung_micros?: number | null;
   /** Server-computed, and only present on a record somebody answered. */
   time_to_ack_micros?: number | null;
+  /** The linked incident's title; absent when the incident is gone, untitled or unreadable. */
+  incident_title?: string;
 }
 
 /**
@@ -1011,6 +1013,9 @@ export interface EscalationProgress {
   held_until_micros?: number | null;
 }
 
+/** `GET /oncall/responses/escalation` answers each record it could read, by id. */
+export type EscalationProgressEntry = EscalationProgress & { response_id: string };
+
 export interface OnCallResponseEvent {
   kind: ResponseEventKind;
   at: number;
@@ -1228,6 +1233,14 @@ export interface MyOnCall {
   teams: MyOnCallTeam[];
 }
 
+/** One team in `GET /oncall/teams/context`; a field the server could not read is absent, not empty. */
+export interface OnCallTeamContext {
+  team_id: string;
+  policy?: OnCallPolicy;
+  on_call?: OnCallPosition[];
+  schedule?: OnCallSchedule | null;
+}
+
 /** `GET /oncall/contacts/{email}` — the caller's own phone and whether a code can be sent to it. */
 export interface Contact {
   /** E.164; absent when none is saved. */
diff --git a/web/src/types/slack.ts b/web/src/types/slack.ts
index 1e78043fc0..06b1b45867 100644
--- a/web/src/types/slack.ts
+++ b/web/src/types/slack.ts
@@ -25,7 +25,7 @@ export type SlackAnswerMode = "thread" | "private";
 
 export type SlackSetFrom = "settings" | "install" | "destination" | "oncall";
 
-export type SlackDisabledReason = "edition" | "flag" | "master_key" | "super_cluster";
+export type SlackDisabledReason = "edition" | "license" | "flag" | "master_key" | "super_cluster";
 
 export type SlackInstallationStatus = "pending" | "revoked" | "degraded" | "healthy";
 
diff --git a/web/src/types/vue-router.d.ts b/web/src/types/vue-router.d.ts
index e4fb2437f4..8b206b1208 100644
--- a/web/src/types/vue-router.d.ts
+++ b/web/src/types/vue-router.d.ts
@@ -24,5 +24,9 @@ declare module "vue-router" {
     accessScopeQuery?: string[];
     /** API exists only with online evaluations on, else the shell renders the disabled state. */
     requiresOnlineEvals?: boolean;
+    /** License feature key the page needs; a `locked` key renders the page with every control disabled. */
+    licenseFeature?: string;
+    /** The license key comes from `query.stream_type` instead, via `streamTypeFeature`. */
+    licenseFeatureFromStreamType?: boolean;
   }
 }
diff --git a/web/src/utils/featureGate.spec.ts b/web/src/utils/featureGate.spec.ts
new file mode 100644
index 0000000000..3b7021aab9
--- /dev/null
+++ b/web/src/utils/featureGate.spec.ts
@@ -0,0 +1,137 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+
+import {
+  featureLockedPath,
+  featureState,
+  forbiddenState,
+  licenseDeniedFeatures,
+  menuState,
+  streamTypeFeature,
+  withLicenseFeature,
+} from "./featureGate";
+
+const forbidden = (data: Record<string, unknown>) => ({ response: { status: 403, data } });
+
+describe("featureState", () => {
+  it("treats a key the backend did not send as enabled", () => {
+    expect(featureState(undefined, "workflows")).toBe("enabled");
+    expect(featureState({}, "workflows")).toBe("enabled");
+    expect(featureState({ oncall: "locked" }, "workflows")).toBe("enabled");
+  });
+
+  it("returns each state the backend sent", () => {
+    const features = { workflows: "enabled", oncall: "locked", incidents: "hidden" } as const;
+    expect(featureState(features, "workflows")).toBe("enabled");
+    expect(featureState(features, "oncall")).toBe("locked");
+    expect(featureState(features, "incidents")).toBe("hidden");
+  });
+});
+
+describe("menuState", () => {
+  it("keeps locked and hidden whatever the runtime flag says", () => {
+    expect(menuState({ oncall: "locked" }, "oncall", false)).toBe("locked");
+    expect(menuState({ oncall: "hidden" }, "oncall", true)).toBe("hidden");
+  });
+
+  it("hides an enabled feature whose runtime flag is off, as older backends expect", () => {
+    expect(menuState(undefined, "oncall", true)).toBe("enabled");
+    expect(menuState(undefined, "oncall", false)).toBe("hidden");
+    expect(menuState({ oncall: "enabled" }, "oncall", false)).toBe("hidden");
+  });
+});
+
+describe("streamTypeFeature", () => {
+  it("maps each signal stream type to its own license key", () => {
+    expect(streamTypeFeature("logs")).toBe("logs");
+    expect(streamTypeFeature("metrics")).toBe("metrics");
+    expect(streamTypeFeature("traces")).toBe("traces");
+  });
+
+  it("reads a missing stream type as logs, as the backend does", () => {
+    expect(streamTypeFeature(undefined)).toBe("logs");
+    expect(streamTypeFeature(null)).toBe("logs");
+    expect(streamTypeFeature("")).toBe("logs");
+  });
+
+  it("gives other stream types no license key", () => {
+    expect(streamTypeFeature("enrichment_tables")).toBeNull();
+    expect(streamTypeFeature("metadata")).toBeNull();
+  });
+});
+
+describe("featureLockedPath", () => {
+  it("points at the shared upsell route", () => {
+    expect(featureLockedPath("ai_assistant")).toBe("/feature-locked/ai_assistant");
+  });
+});
+
+describe("withLicenseFeature", () => {
+  it("tags the route and every child, keeping the meta already there", () => {
+    const route = withLicenseFeature("workflows", {
+      path: "workflows",
+      meta: { titleKey: "menu.workflows" },
+      children: [{ path: "add" }, { path: "runs", children: [{ path: "detail" }] }],
+    });
+    expect(route.meta).toEqual({ titleKey: "menu.workflows", licenseFeature: "workflows" });
+    expect(route.children?.[0].meta).toEqual({ licenseFeature: "workflows" });
+    expect(route.children?.[1].children?.[0].meta).toEqual({ licenseFeature: "workflows" });
+  });
+
+  it("adds no children to a leaf route", () => {
+    expect(withLicenseFeature("oncall", { path: "oncall" })).not.toHaveProperty("children");
+  });
+});
+
+describe("licenseDeniedFeatures", () => {
+  it("returns the missing keys of a 403 with code 40001", () => {
+    expect(
+      licenseDeniedFeatures(forbidden({ code: 40001, error_detail: "oncall, workflows" })),
+    ).toEqual(["oncall", "workflows"]);
+    expect(licenseDeniedFeatures(forbidden({ code: 40001, error_detail: "incidents" }))).toEqual([
+      "incidents",
+    ]);
+  });
+
+  it("still flags a denial whose detail is missing", () => {
+    expect(licenseDeniedFeatures(forbidden({ code: 40001 }))).toEqual([]);
+  });
+
+  it("ignores RBAC 403s and other statuses", () => {
+    expect(licenseDeniedFeatures(forbidden({}))).toBeNull();
+    expect(
+      licenseDeniedFeatures(forbidden({ code: 403, message: "Unauthorized Access" })),
+    ).toBeNull();
+    expect(
+      licenseDeniedFeatures({
+        response: { status: 400, data: { code: 40001, error_detail: "x" } },
+      }),
+    ).toBeNull();
+    expect(licenseDeniedFeatures(undefined)).toBeNull();
+  });
+});
+
+describe("forbiddenState", () => {
+  it("returns the missing keys for a license 403, true for an RBAC 403, false otherwise", () => {
+    expect(forbiddenState(forbidden({ code: 40001, error_detail: "dashboards" }))).toEqual([
+      "dashboards",
+    ]);
+    expect(forbiddenState(forbidden({ code: 403, message: "Unauthorized Access" }))).toBe(true);
+    expect(forbiddenState({ response: { status: 500, data: {} } })).toBe(false);
+    expect(forbiddenState(undefined)).toBe(false);
+  });
+});
diff --git a/web/src/utils/featureGate.ts b/web/src/utils/featureGate.ts
new file mode 100644
index 0000000000..d6cbbe412b
--- /dev/null
+++ b/web/src/utils/featureGate.ts
@@ -0,0 +1,141 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { IconName } from "@/lib/core/Icon/OIcon.icons";
+
+export type FeatureState = "enabled" | "locked" | "hidden";
+
+/** The `features` map of the org config response, keyed by snake_case feature name. */
+export type FeatureStates = Partial<Record<string, FeatureState>>;
+
+const LICENSE_FEATURE_NOT_ENTITLED = 40001;
+
+// Icon mirrors each feature's own nav entry.
+export const LOCKED_FEATURES: Partial<Record<string, { icon: IconName }>> = {
+  ai_assistant: { icon: "auto-awesome" },
+};
+
+interface RejectedResponse {
+  response?: { status?: number; data?: { code?: unknown; error_detail?: unknown } };
+}
+
+/** A key the backend did not send is enabled: older backends and ungated features omit it. */
+export const featureState = (features: FeatureStates | undefined, key: string): FeatureState =>
+  features?.[key] ?? "enabled";
+
+/** Menu state for a feature whose enabled path still needs its own runtime flag. */
+export const menuState = (
+  features: FeatureStates | undefined,
+  key: string,
+  enabledWhen: boolean,
+): FeatureState => {
+  const state = featureState(features, key);
+  if (state !== "enabled") return state;
+  return enabledWhen ? "enabled" : "hidden";
+};
+
+const SIGNAL_FEATURES: Partial<Record<string, string>> = {
+  logs: "logs",
+  metrics: "metrics",
+  traces: "traces",
+};
+
+/** License key of a stream type; the backend reads a missing type as logs, other types have no key. */
+export const streamTypeFeature = (streamType?: string | null): string | null =>
+  SIGNAL_FEATURES[streamType || "logs"] ?? null;
+
+/** Path of the shared upsell page, for a locked feature that has no page of its own. */
+export const featureLockedPath = (key: string): string => `/feature-locked/${key}`;
+
+interface LicensedRoute {
+  meta?: Record<string, unknown>;
+  children?: LicensedRoute[];
+}
+
+/** Tags a route and its children with the license feature their page needs (`meta.licenseFeature`). */
+export const withLicenseFeature = <T extends object>(key: string, route: T): T => {
+  // `T extends object`, not LicensedRoute: a weak-type constraint rejects inline route literals.
+  const { meta, children } = route as LicensedRoute;
+  return {
+    ...route,
+    meta: { ...meta, licenseFeature: key },
+    ...(children ? { children: children.map((child) => withLicenseFeature(key, child)) } : {}),
+  };
+};
+
+/** A denied list's state: false, true for an RBAC 403, or the missing feature keys of a license 403. */
+export type ForbiddenState = boolean | string[];
+
+export const forbiddenState = (error: unknown): ForbiddenState =>
+  licenseDeniedFeatures(error) ?? (error as RejectedResponse | undefined)?.response?.status === 403;
+
+/** Missing feature keys of a license denial (403 + 40001), or null for any other error. */
+export const licenseDeniedFeatures = (error: unknown): string[] | null => {
+  const response = (error as RejectedResponse | undefined)?.response;
+  if (response?.status !== 403 || response.data?.code !== LICENSE_FEATURE_NOT_ENTITLED) return null;
+  const detail = response.data.error_detail;
+  if (typeof detail !== "string") return [];
+  return detail
+    .split(",")
+    .map((key) => key.trim())
+    .filter(Boolean);
+};
+
+interface FeatureDefinition {
+  display_name?: string;
+  gate?: boolean;
+  plumbing?: boolean;
+}
+
+export interface LicenseFeatureSource {
+  features?: string[] | null;
+  feature_definition?: { features?: Record<string, FeatureDefinition> } | null;
+}
+
+/** A license's features as unlocked / missing / free / added keys, or null for a pre-entitlement license. */
+export const splitLicenseFeatures = (
+  license: LicenseFeatureSource | null | undefined,
+  states: FeatureStates,
+) => {
+  if (!license?.features) return null;
+  const definition = license.feature_definition?.features;
+  const gated = definition
+    ? Object.keys(definition).filter((key) => definition[key].gate && !definition[key].plumbing)
+    : Object.keys(states).filter((key) => states[key] === "locked");
+  // The backend reads a list of only "all" as every feature, so the page does the same.
+  const listsOnlyAll =
+    license.features.length > 0 && license.features.every((key) => key === "all");
+  const unlocked = (listsOnlyAll ? [...gated] : [...license.features]).sort();
+  // A listed key counts as paid even when ungated, so "unlocked of paid" never exceeds the total.
+  const paid = new Set([...gated, ...unlocked]);
+  const missing = [...paid].filter((key) => !unlocked.includes(key)).sort();
+  const freeCandidates = definition
+    ? Object.keys(definition).filter((key) => !definition[key].gate || definition[key].plumbing)
+    : Object.keys(states).filter((key) => states[key] === "enabled");
+  const free = freeCandidates
+    .filter((key) => !unlocked.includes(key) && featureState(states, key) !== "hidden")
+    .sort();
+  // Unlocked is excluded too so a listed key missing from its own definition never shows twice.
+  const added = definition
+    ? Object.keys(states)
+        .filter((key) => !(key in definition) && !unlocked.includes(key))
+        .filter((key) => featureState(states, key) !== "hidden")
+        .sort()
+    : [];
+  const addedLocked = added.filter((key) => featureState(states, key) === "locked");
+  return { unlocked, missing, free, added, addedLocked, paid: paid.size };
+};
+
+export type LicenseFeatureSplit = ReturnType<typeof splitLicenseFeatures>;
diff --git a/web/src/utils/incidents/rcaEvidenceLinks.spec.ts b/web/src/utils/incidents/rcaEvidenceLinks.spec.ts
index cb2ee33d3d..03365728e6 100644
--- a/web/src/utils/incidents/rcaEvidenceLinks.spec.ts
+++ b/web/src/utils/incidents/rcaEvidenceLinks.spec.ts
@@ -17,6 +17,7 @@ import { describe, expect, it } from "vitest";
 import type { RcaEvidenceTarget } from "@/services/incidents";
 import { b64DecodeUnicode } from "@/utils/formatters";
 import {
+  rcaBlindSpotFeature,
   rcaBlindSpotRoute,
   rcaEvidenceLink,
   rcaEvidenceQuery,
@@ -201,3 +202,16 @@ describe("rcaBlindSpotRoute (03 VE37)", () => {
     expect(rcaBlindSpotRoute(fix, "default")).toBeNull();
   });
 });
+
+describe("rcaBlindSpotFeature", () => {
+  it.each([
+    ["connect_toolset", "ai_toolsets"],
+    ["open_pipeline", "pipelines"],
+    ["sampling_rules", "pipelines"],
+    ["ingest_data", null],
+    ["resume_run", null],
+    ["none", null],
+  ] as const)("%s is licensed under %s", (fix, feature) => {
+    expect(rcaBlindSpotFeature(fix)).toBe(feature);
+  });
+});
diff --git a/web/src/utils/incidents/rcaEvidenceLinks.ts b/web/src/utils/incidents/rcaEvidenceLinks.ts
index 9ce5b30d99..b9e6e22a8f 100644
--- a/web/src/utils/incidents/rcaEvidenceLinks.ts
+++ b/web/src/utils/incidents/rcaEvidenceLinks.ts
@@ -120,6 +120,13 @@ export function rcaEvidenceLink(link: RcaEvidenceTarget, org: string): RcaEviden
 export const rcaEvidenceQuery = (link: RcaEvidenceTarget): string | null =>
   link.sql || link.promql || link.filter || link.command || null;
 
+/** The license feature whose page a blind spot's button opens, or null when that page is free. */
+export function rcaBlindSpotFeature(fix: RcaBlindSpotFix): "ai_toolsets" | "pipelines" | null {
+  if (fix === "connect_toolset") return "ai_toolsets";
+  if (fix === "open_pipeline" || fix === "sampling_rules") return "pipelines";
+  return null;
+}
+
 /** The page a blind spot's button opens, or null for no button. */
 export function rcaBlindSpotRoute(fix: RcaBlindSpotFix, org: string): RouteLocationRaw | null {
   const query = { org_identifier: org };
diff --git a/web/src/views/AIObservability/PromptsPage.vue b/web/src/views/AIObservability/PromptsPage.vue
index f5b16d846d..2c6a6d6444 100644
--- a/web/src/views/AIObservability/PromptsPage.vue
+++ b/web/src/views/AIObservability/PromptsPage.vue
@@ -53,7 +53,7 @@
         :loading="promptQuery.isPending.value"
         :loading-reset-key="activeFolderId"
         :error="listError"
-        :forbidden="errorStatus(promptQuery.error.value) === 403"
+        :forbidden="forbiddenState(promptQuery.error.value)"
         :frame="false"
         :default-columns="false"
         :show-global-filter="false"
@@ -334,6 +334,7 @@ import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import { getFoldersListByType } from "@/utils/commons";
+import { forbiddenState } from "@/utils/featureGate";
 import llmPromptsService, {
   type Prompt,
   type PromptLabel,
diff --git a/web/src/views/AlertLibrary/AlertLibrary.spec.ts b/web/src/views/AlertLibrary/AlertLibrary.spec.ts
index 84f0cd7581..a4ec61f6f2 100644
--- a/web/src/views/AlertLibrary/AlertLibrary.spec.ts
+++ b/web/src/views/AlertLibrary/AlertLibrary.spec.ts
@@ -1394,6 +1394,43 @@ describe("AlertLibrary", () => {
       expect(card(wrapper).find('[data-test="alert-library-card-enterprise"]').exists()).toBe(true);
     });
 
+    it("shows anomaly alerts locked when anomaly_detection is license-locked", async () => {
+      setAccess("enabled");
+      store.state.zoConfig = {
+        ...store.state.zoConfig,
+        features: { anomaly_detection: "locked" },
+      } as typeof original.zoConfig;
+      const wrapper = await mountView();
+      expect(card(wrapper).find('[data-test="alert-library-card-enterprise"]').exists()).toBe(
+        false,
+      );
+      expect(card(wrapper).find('[data-test="alert-library-card-license-locked"]').exists()).toBe(
+        true,
+      );
+      const reasons = card(wrapper)
+        .findAllComponents({ name: "OTooltip" })
+        .map((tooltip) => String(tooltip.props("content")));
+      expect(reasons.some((reason) => reason.includes("anomaly_detection"))).toBe(true);
+
+      await card(wrapper).trigger("click");
+      await wrapper
+        .get(`[data-test="alert-library-select-${ANOMALY}"]`)
+        .get('[role="checkbox"]')
+        .trigger("click");
+      await flushPromises();
+      expect(upgrade.isOpen.value).toBe(false);
+      expect(wrapper.findComponent({ name: "LibraryDrawer" }).props("open")).toBe(false);
+      expect(card(wrapper).attributes("data-selected")).toBe("false");
+    });
+
+    it("shows the edition badge, not the license lock, when the build is not entitled", async () => {
+      setAccess("locked");
+      const wrapper = await mountView();
+      expect(card(wrapper).find('[data-test="alert-library-card-license-locked"]').exists()).toBe(
+        false,
+      );
+    });
+
     it("opens the upgrade dialog instead of the drawer for a locked card", async () => {
       setAccess("locked");
       const wrapper = await mountView();
diff --git a/web/src/views/AlertLibrary/AlertLibrary.vue b/web/src/views/AlertLibrary/AlertLibrary.vue
index 4745f3f7a7..28e889140d 100644
--- a/web/src/views/AlertLibrary/AlertLibrary.vue
+++ b/web/src/views/AlertLibrary/AlertLibrary.vue
@@ -326,6 +326,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                       :ready="entryReady(entry)"
                       :selected="selectedIds.has(entry.id)"
                       :locked="isLocked(entry)"
+                      :license-locked-reason="
+                        isLocked(entry) && anomalyAccess === 'licenseLocked'
+                          ? anomalyLockedReason
+                          : undefined
+                      "
                       @open="openEntry(entry)"
                       @update:selected="onCardSelected(entry, $event)"
                       @install="addEntry(entry)"
@@ -395,6 +400,7 @@ import {
 import type { AlertLibraryErrorCode } from "@/composables/alerts/useAlertLibrary";
 import useStreams from "@/composables/useStreams";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
@@ -422,7 +428,12 @@ const router = useRouter();
 
 const { manifest, isLoading, error, loadManifest, loadAlertFile, isReady } = useAlertLibrary();
 const anomalyAccess = useAnomalyLibraryAccess();
-const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
+const { open: openEditionUpgradeDialog } = useEnterpriseUpgradeDialog();
+const { lockedReason: anomalyLockedReason } = useLicenseLock("anomaly_detection");
+// A license lock explains itself on the card and never opens the edition upsell.
+const openUpgradeDialog = () => {
+  if (anomalyAccess.value !== "licenseLocked") openEditionUpgradeDialog();
+};
 const { getStreams } = useStreams(t);
 const { customizeInEditor } = useLibraryCustomize();
 
diff --git a/web/src/views/Dashboards/Dashboards.spec.ts b/web/src/views/Dashboards/Dashboards.spec.ts
index 0277d87ce7..d64fa7bddc 100644
--- a/web/src/views/Dashboards/Dashboards.spec.ts
+++ b/web/src/views/Dashboards/Dashboards.spec.ts
@@ -80,6 +80,8 @@ vi.mock("@/services/settings", async (importOriginal) => {
 import settingsService from "@/services/settings";
 import * as commons from "@/utils/commons";
 import { useFavoriteDashboards } from "@/composables/useFavoriteDashboards";
+import { useHomeDashboard } from "@/composables/useHomeDashboard";
+import { gt } from "@/types/i18n";
 
 // Mock DOM methods to prevent errors from missing DOM APIs
 Object.defineProperty(Element.prototype, "removeAttribute", {
@@ -1091,6 +1093,47 @@ describe("Dashboards.vue", () => {
     });
   });
 
+  describe("Home pin after a move", () => {
+    const pinIn = (folderId: string) => ({
+      data: { setting_value: { dashboardId: "d1", folderId, label: "Pinned" } },
+    });
+
+    afterEach(() => {
+      useHomeDashboard(gt).homeDashboard.value = null;
+    });
+
+    const mountWithWarmPin = async () => {
+      vi.mocked(settingsService.getSetting).mockResolvedValue(pinIn("B") as any);
+      wrapper = shallowMount(Dashboards, { global: buildGlobalConfig(store, router, i18n) });
+      await flushPromises();
+      expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("B");
+      vi.mocked(settingsService.getSetting).mockClear();
+      vi.mocked(settingsService.getSetting).mockResolvedValue(pinIn("A") as any);
+    };
+
+    it("re-reads the pin past a warm cache when the pinned dashboard is moved", async () => {
+      await mountWithWarmPin();
+
+      wrapper.vm.selectedDashboardIdToMove = ["d1"];
+      await wrapper.findComponent({ name: "MoveDashboardToAnotherFolder" }).vm.$emit("updated");
+      await flushPromises();
+
+      expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("A");
+      expect(wrapper.vm.showMoveDashboardDialog).toBe(false);
+    });
+
+    it("does not re-read the pin when a different dashboard is moved", async () => {
+      await mountWithWarmPin();
+
+      wrapper.vm.selectedDashboardIdToMove = ["other"];
+      await wrapper.findComponent({ name: "MoveDashboardToAnotherFolder" }).vm.$emit("updated");
+      await flushPromises();
+
+      expect(settingsService.getSetting).not.toHaveBeenCalled();
+      expect(useHomeDashboard(gt).homeDashboard.value?.folderId).toBe("B");
+    });
+  });
+
   describe("product analytics", () => {
     const mountDashboards = async () => {
       wrapper = shallowMount(Dashboards, { global: buildGlobalConfig(store, router, i18n) });
diff --git a/web/src/views/Dashboards/Dashboards.vue b/web/src/views/Dashboards/Dashboards.vue
index 2578763f6c..9919d94f1c 100644
--- a/web/src/views/Dashboards/Dashboards.vue
+++ b/web/src/views/Dashboards/Dashboards.vue
@@ -636,6 +636,7 @@ import { useReo } from "@/services/reodotdev_analytics";
 import { useAiDashboardEvents } from "@/composables/useAiDashboardEvents";
 import type { AiDashboardEvent } from "@/composables/useAiDashboardEvents";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { focusSearchInput, isInputFocused } from "@/utils/keyboardShortcuts";
 import { useHomeDashboard } from "@/composables/useHomeDashboard";
@@ -788,7 +789,13 @@ export default defineComponent({
 
     const { showPositiveNotification, showErrorNotification } = useNotifications();
 
-    const { isHome, setHomeDashboard, clearHomeDashboard, homeDashboard } = useHomeDashboard(t);
+    const {
+      isHome,
+      setHomeDashboard,
+      clearHomeDashboard,
+      homeDashboard,
+      load: loadHomeDashboard,
+    } = useHomeDashboard(t);
 
     // Per-user favorites — heart toggle on each row + a folder-independent
     // favorites view.
@@ -1083,7 +1090,7 @@ export default defineComponent({
           // A newer folder switch cancelled this load; the newer one reports its own outcome.
           if (isCancelledError(error)) return;
           console.error("Error loading dashboards:", error);
-          forbidden.value = asCaughtError(error).response?.status === 403;
+          forbidden.value = forbiddenState(error);
           if (!forbidden.value) {
             showErrorNotification(
               raw(asCaughtError(error).message || t("dashboard.dashboards.failedToLoadFolder")),
@@ -1334,7 +1341,7 @@ export default defineComponent({
     };
     const loading = ref(true);
     // Only the dashboards fetch is authoritative on access; the folder list is not.
-    const forbidden = ref(false);
+    const forbidden = ref<ForbiddenState>(false);
     // The first real load lands after mount and races TanStack's own auto-reset-on-data-change, which resolves through its own deferred microtask queue — setTimeout(0) runs strictly after that queue drains, so the restored page reliably wins.
     watch(
       loading,
@@ -1573,6 +1580,11 @@ export default defineComponent({
 
     const handleDashboardMoved = async () => {
       showMoveDashboardDialog.value = false;
+      const org = store.state.selectedOrganization?.identifier;
+      // The server rewrites the pin's folder on move; the cached copy would keep routing to the old one.
+      if (org && selectedDashboardIdToMove.value?.some((id) => isHome(id))) {
+        await loadHomeDashboard(org, true);
+      }
     };
 
     const deleteFolder = async () => {
diff --git a/web/src/views/Dashboards/ImportDashboard.spec.ts b/web/src/views/Dashboards/ImportDashboard.spec.ts
index 1c1ef6d6bc..7adfe290b1 100644
--- a/web/src/views/Dashboards/ImportDashboard.spec.ts
+++ b/web/src/views/Dashboards/ImportDashboard.spec.ts
@@ -47,6 +47,7 @@ vi.mock("@/utils/dashboard/panelValidation", () => ({
 vi.mock("@/components/dashboards/SelectFolderDropdown.vue", () => ({
   default: {
     name: "SelectFolderDropdown",
+    props: ["activeFolderId", "disabled"],
     template: '<div data-test="select-folder-dropdown"></div>',
   },
 }));
@@ -385,6 +386,96 @@ describe("ImportDashboard.vue", () => {
     ]);
   });
 
+  it.each(["import_json_file", "import_json_url"])(
+    "locks the folder picker on %s while an import is running",
+    async (tab) => {
+      wrapper = mountComponent();
+      wrapper.vm.activeTab = tab;
+      await nextTick();
+      const picker = () => wrapper.findComponent({ name: "SelectFolderDropdown" });
+      expect(picker().props("disabled")).toBe(false);
+
+      wrapper.vm.isLoading = tab === "import_json_url" ? "url" : "files";
+      await nextTick();
+      expect(picker().props("disabled")).toBe(true);
+
+      wrapper.vm.isLoading = false;
+      await nextTick();
+      expect(picker().props("disabled")).toBe(false);
+    },
+  );
+
+  it("keeps the folder picker locked until a pending create settles", async () => {
+    const dashboardService = (await import("@/services/dashboards")).default;
+    let settle: (v: unknown) => void = () => {};
+    (dashboardService.create as any).mockReturnValue(new Promise((resolve) => (settle = resolve)));
+    wrapper = mountComponent();
+    await nextTick();
+    wrapper.vm.jsonStr = JSON.stringify({ title: "Pending", tabs: [{ tabId: "t1", panels: [] }] });
+
+    const run = wrapper.vm.importFromJsonStr();
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "SelectFolderDropdown" }).props("disabled")).toBe(true);
+
+    settle({ data: {} });
+    await run;
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "SelectFolderDropdown" }).props("disabled")).toBe(false);
+  });
+
+  it("keeps the folder picker locked while uploaded files are importing", async () => {
+    const dashboardService = (await import("@/services/dashboards")).default;
+    let settle: (v: unknown) => void = () => {};
+    (dashboardService.create as any).mockReturnValue(new Promise((resolve) => (settle = resolve)));
+    const content = JSON.stringify({ title: "Pending", tabs: [{ tabId: "t1", panels: [] }] });
+    wrapper = mountComponent();
+    await nextTick();
+    wrapper.vm.form.setFieldValue("jsonFiles", [
+      new File([content], "a.json", { type: "application/json" }),
+    ]);
+    await flushPromises();
+    wrapper.vm.jsonStr = JSON.stringify([JSON.parse(content)]);
+    const picker = () => wrapper.findComponent({ name: "SelectFolderDropdown" });
+
+    void wrapper.vm.importFiles();
+    await flushPromises();
+    expect(picker().props("disabled")).toBe(true);
+
+    settle({ data: {} });
+    await flushPromises();
+    expect(picker().props("disabled")).toBe(false);
+  });
+
+  it("imports every uploaded dashboard into the folder chosen when the import started", async () => {
+    const dashboardService = (await import("@/services/dashboards")).default;
+    const settles: Array<(v: unknown) => void> = [];
+    (dashboardService.create as any).mockImplementation(
+      () => new Promise((resolve) => settles.push(resolve)),
+    );
+    const dash = (title: string) => ({ title, tabs: [{ tabId: "t1", panels: [] }] });
+    wrapper = mountComponent();
+    await nextTick();
+    wrapper.vm.selectedFolder = { label: "A", value: "folder-a" };
+    wrapper.vm.form.setFieldValue("jsonFiles", [
+      new File([JSON.stringify([dash("One"), dash("Two")])], "a.json", {
+        type: "application/json",
+      }),
+    ]);
+    await flushPromises();
+    wrapper.vm.jsonStr = JSON.stringify([[dash("One"), dash("Two")]]);
+
+    void wrapper.vm.importFiles();
+    await flushPromises();
+    wrapper.vm.selectedFolder = { label: "B", value: "folder-b" };
+    settles.shift()?.({ data: {} });
+    await flushPromises();
+    settles.shift()?.({ data: {} });
+    await flushPromises();
+
+    const folders = (dashboardService.create as any).mock.calls.map((c: any[]) => c[2]);
+    expect(folders).toEqual(["folder-a", "folder-a"]);
+  });
+
   // Real-OForm validation wiring (playbook §5): the OForm covers only the
   // url/jsonFiles input collection. The URL-format rule is the one field check
   // (non-required, so the paste-JSON flow is preserved).
diff --git a/web/src/views/Dashboards/ImportDashboard.vue b/web/src/views/Dashboards/ImportDashboard.vue
index a755f6cbcb..dae310f86e 100644
--- a/web/src/views/Dashboards/ImportDashboard.vue
+++ b/web/src/views/Dashboards/ImportDashboard.vue
@@ -102,6 +102,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         <SelectFolderDropdown
                           @folder-selected="selectedFolder = $event"
                           :activeFolderId="selectedFolder.value"
+                          :disabled="!!isLoading"
                         />
                       </div>
                     </div>
@@ -140,6 +141,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         <SelectFolderDropdown
                           @folder-selected="selectedFolder = $event"
                           :activeFolderId="selectedFolder.value"
+                          :disabled="!!isLoading"
                         />
                       </div>
                     </div>
@@ -541,6 +543,7 @@ export default defineComponent({
       }
 
       createdInAction = 0;
+      const importFolder = selectedFolder.value;
       const data = jsonStr.value.map((parsedContent, fileIndex) => {
         return new Promise((resolve, reject) => {
           (async () => {
@@ -575,7 +578,7 @@ export default defineComponent({
                     continue;
                   }
 
-                  const res = await importDashboardFromJSON(convertedSchema, selectedFolder.value);
+                  const res = await importDashboardFromJSON(convertedSchema, importFolder);
                   results.push({ index: i + 1, result: res });
                 } catch (e) {
                   results.push({ index: i + 1, error: e });
@@ -613,7 +616,7 @@ export default defineComponent({
         const successfulImports = results.filter((r) => r.status === "fulfilled").length;
 
         if (results.length === successfulImports) {
-          await resetAndRefresh(ImportType.FILES, selectedFolder.value);
+          await resetAndRefresh(ImportType.FILES, importFolder);
         }
 
         if (successfulImports) {
@@ -666,6 +669,7 @@ export default defineComponent({
     const importFromUrl = async () => {
       isLoading.value = ImportType.URL;
       createdInAction = 0;
+      const importFolder = selectedFolder.value;
       try {
         const urlData = url.value.trim();
 
@@ -691,7 +695,7 @@ export default defineComponent({
               return Promise.reject({ index, error: new Error(errorMessage) });
             }
 
-            return importDashboardFromJSON(converted, selectedFolder.value);
+            return importDashboardFromJSON(converted, importFolder);
           } catch (e) {
             return Promise.reject({ index, error: e });
           }
@@ -706,7 +710,7 @@ export default defineComponent({
         }
 
         if (successCount > 0) {
-          await resetAndRefresh(ImportType.URL, selectedFolder.value);
+          await resetAndRefresh(ImportType.URL, importFolder);
           showPositiveNotification(
             t("dashboard.importDashboardPage.dashboardsImportedSuccessfully", { n: successCount }),
           );
@@ -733,6 +737,7 @@ export default defineComponent({
     const importFromJsonStr = async () => {
       isLoading.value = ImportType.JSON_STRING;
       createdInAction = 0;
+      const importFolder = selectedFolder.value;
       try {
         // get the dashboard
 
@@ -749,8 +754,8 @@ export default defineComponent({
           return;
         }
 
-        await importDashboardFromJSON(convertedSchema, selectedFolder.value).then((_res) => {
-          resetAndRefresh(ImportType.JSON_STRING, selectedFolder.value);
+        await importDashboardFromJSON(convertedSchema, importFolder).then((_res) => {
+          resetAndRefresh(ImportType.JSON_STRING, importFolder);
           filesImportResults.value = [];
           jsonStr.value = "";
 
diff --git a/web/src/views/Dashboards/ViewDashboard.vue b/web/src/views/Dashboards/ViewDashboard.vue
index 30de6d857e..82785fbc1c 100644
--- a/web/src/views/Dashboards/ViewDashboard.vue
+++ b/web/src/views/Dashboards/ViewDashboard.vue
@@ -418,8 +418,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :min-refresh-seconds="store.state?.zoConfig?.min_auto_refresh_interval || 5"
               @open="enterKiosk"
             />
+            <OTooltip v-if="!isFullscreen && reportsLocked" :content="reportsLockedReason">
+              <span v-show="store.state.printMode !== true" class="inline-flex">
+                <OButton
+                  variant="outline"
+                  size="icon-toolbar"
+                  disabled
+                  :aria-label="t('dashboard.scheduledDashboards')"
+                  data-test="view-dashboard-scheduled-reports"
+                >
+                  <template #icon-left>
+                    <OIcon
+                      name="lock"
+                      class="lock-chip"
+                      size="sm"
+                      data-test="view-dashboard-scheduled-reports-lock"
+                    />
+                  </template>
+                </OButton>
+              </span>
+            </OTooltip>
             <OButton
-              v-if="!isFullscreen"
+              v-else-if="!isFullscreen"
               v-show="store.state.printMode !== true"
               variant="outline"
               size="icon-toolbar"
@@ -716,6 +736,7 @@ import { dashboardSaveConflictState } from "@/composables/dashboard/dashboardSav
 import { DASHBOARD_FRESH_PANEL_TIME } from "@/composables/dashboard/dashboardFreshPanelTime";
 import { useHomeDashboard } from "@/composables/useHomeDashboard";
 import reports from "@/services/reports";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import config from "@/aws-exports";
 import useCancelQuery from "@/composables/dashboard/useCancelQuery";
 import { useAutoRunToggle } from "@/composables/dashboard/useAutoRunToggle";
@@ -856,6 +877,7 @@ export default defineComponent({
       data: {},
     });
     const showScheduledReportsDialog = ref(false);
+    const { locked: reportsLocked, lockedReason: reportsLockedReason } = useLicenseLock("reports");
 
     // Set before the first render so a reloaded TV never flashes the app chrome.
     if (isKioskEnabled(route.query.kiosk) && !store.state.kioskMode) {
@@ -2626,7 +2648,7 @@ export default defineComponent({
     watch(kioskMode, toggleKioskEscape, { immediate: true, flush: "sync" });
 
     const openScheduledReports = () => {
-      if (isLoadingReports.value) return;
+      if (isLoadingReports.value || reportsLocked.value) return;
 
       showScheduledReportsDialog.value = true;
       scheduledReports.value = [];
@@ -2951,6 +2973,8 @@ export default defineComponent({
       searchType,
       openScheduledReports,
       showScheduledReportsDialog,
+      reportsLocked,
+      reportsLockedReason,
       isLoadingReports,
       scheduledReports,
       dashboardId,
diff --git a/web/src/views/Dashboards/addPanel/AddPanel.spec.ts b/web/src/views/Dashboards/addPanel/AddPanel.spec.ts
index d4b7ea2529..1c08858106 100644
--- a/web/src/views/Dashboards/addPanel/AddPanel.spec.ts
+++ b/web/src/views/Dashboards/addPanel/AddPanel.spec.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { mount, shallowMount } from "@vue/test-utils";
+import { flushPromises, mount, shallowMount } from "@vue/test-utils";
 import { nextTick, reactive } from "vue";
 import AddPanel from "./AddPanel.vue";
 import { createStore } from "vuex";
@@ -254,6 +254,26 @@ describe("AddPanel.vue", () => {
     vi.clearAllMocks();
   });
 
+  describe("License gating", () => {
+    it.each([
+      ["locked", 0],
+      ["enabled", 1],
+    ])("loads the dashboard only when dashboards is not locked (%s)", async (state, calls) => {
+      store.state.zoConfig.features = { dashboards: state };
+      vi.mocked(getDashboard).mockClear();
+      vi.mocked(getDashboard).mockResolvedValue({});
+      wrapper = shallowMount(AddPanel, {
+        global: {
+          plugins: [store, router, i18n],
+          stubs: { PanelEditor: true, PanelSchemaRenderer: true },
+        },
+        props: { metaData: null },
+      });
+      await flushPromises();
+      expect(vi.mocked(getDashboard)).toHaveBeenCalledTimes(calls);
+    });
+  });
+
   describe("Computed Properties", () => {
     beforeEach(async () => {
       const mockRoute = {
diff --git a/web/src/views/Dashboards/addPanel/AddPanel.vue b/web/src/views/Dashboards/addPanel/AddPanel.vue
index 823c444479..cfb67bf48a 100644
--- a/web/src/views/Dashboards/addPanel/AddPanel.vue
+++ b/web/src/views/Dashboards/addPanel/AddPanel.vue
@@ -353,6 +353,7 @@ import {
 } from "../../../utils/commons";
 import { onBeforeRouteLeave, useRoute, useRouter } from "vue-router";
 import { useStore } from "vuex";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import useDashboardPanelData from "../../../composables/dashboard/useDashboardPanel";
 import DateTimePickerDashboard from "../../../components/DateTimePickerDashboard.vue";
 import AddSettingVariable from "../../../components/dashboards/settings/AddSettingVariable.vue";
@@ -477,6 +478,7 @@ export default defineComponent({
     const router = useRouter();
     const route = useRoute();
     const store = useStore();
+    const { locked: dashboardsLocked } = useLicenseLock("dashboards");
 
     // Initialize or inject variables manager
     const injectedManager = inject("variablesManager", null);
@@ -1063,6 +1065,8 @@ export default defineComponent({
     };
 
     onMounted(async () => {
+      // The page is route-locked and the top bar explains it; loading would only 403.
+      if (dashboardsLocked.value) return;
       // assign the route query params
       routeQueryParamsOnMount = withoutFocusParam(JSON.parse(JSON.stringify(route?.query ?? {})));
 
diff --git a/web/src/views/Dashboards/viewDashboard.spec.ts b/web/src/views/Dashboards/viewDashboard.spec.ts
index 3622ee18a5..e12c681338 100644
--- a/web/src/views/Dashboards/viewDashboard.spec.ts
+++ b/web/src/views/Dashboards/viewDashboard.spec.ts
@@ -1284,6 +1284,42 @@ describe("ViewDashboard", () => {
     });
   });
 
+  describe("reports license lock", () => {
+    const setReports = (state: string | undefined) => {
+      for (const zoConfig of [mockStoreState.zoConfig, (store.state as any).zoConfig]) {
+        zoConfig.features = state ? { reports: state } : undefined;
+      }
+    };
+    afterEach(() => setReports(undefined));
+
+    it("locks the scheduled reports button and lists no reports while reports is locked", async () => {
+      setReports("locked");
+      const { default: reportsService } = await import("@/services/reports");
+      vi.mocked(reportsService.list).mockClear();
+      wrapper = createWrapper();
+      await flushPromises();
+
+      expect(wrapper.vm.reportsLocked).toBe(true);
+      expect(wrapper.vm.reportsLockedReason).toContain("Locked");
+      wrapper.vm.openScheduledReports();
+      expect(reportsService.list).not.toHaveBeenCalled();
+      expect(wrapper.vm.showScheduledReportsDialog).toBe(false);
+    });
+
+    it("opens scheduled reports as before while reports is enabled", async () => {
+      setReports("enabled");
+      const { default: reportsService } = await import("@/services/reports");
+      vi.mocked(reportsService.list).mockClear();
+      wrapper = createWrapper();
+      await flushPromises();
+
+      expect(wrapper.vm.reportsLocked).toBe(false);
+      wrapper.vm.openScheduledReports();
+      expect(reportsService.list).toHaveBeenCalled();
+      expect(wrapper.vm.showScheduledReportsDialog).toBe(true);
+    });
+  });
+
   describe("Component Lifecycle and Cleanup", () => {
     it("should load dashboard on mount", async () => {
       wrapper = createWrapper();
diff --git a/web/src/views/DatabaseMonitoring/DatabasesPage.vue b/web/src/views/DatabaseMonitoring/DatabasesPage.vue
index 2d908346d6..c335224020 100644
--- a/web/src/views/DatabaseMonitoring/DatabasesPage.vue
+++ b/web/src/views/DatabaseMonitoring/DatabasesPage.vue
@@ -60,6 +60,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :loading="loading"
         :frame="false"
         :error="error"
+        :forbidden="forbidden"
         sorting="server"
         :sort-by="sortBy"
         :sort-order="sortOrder"
@@ -545,6 +546,7 @@ const {
   tabCountsContext,
   loading,
   error,
+  forbidden,
   search,
   lastRunAt,
   org,
diff --git a/web/src/views/DatabaseMonitoring/QueriesPage.vue b/web/src/views/DatabaseMonitoring/QueriesPage.vue
index 9eb246a7f5..4b91e14862 100644
--- a/web/src/views/DatabaseMonitoring/QueriesPage.vue
+++ b/web/src/views/DatabaseMonitoring/QueriesPage.vue
@@ -209,6 +209,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :frame="false"
         :toolbar-bordered="false"
         :error="error"
+        :forbidden="forbidden"
         sorting="server"
         :sort-by="sortBy"
         sort-order="desc"
@@ -635,6 +636,7 @@ import { hasDbmTraceVantage } from "@/composables/dbm/useDbmTraceVantage";
 import { useDbmQueryDetailHop } from "@/composables/dbm/useDbmQueryDetailHop";
 import { useDbmTracePresence } from "@/composables/dbm/useDbmTracePresence";
 import useStreams from "@/composables/useStreams";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { tabCountProps } from "@/composables/dbm/useDbmTabCounts";
 import { useDbmListPage } from "@/composables/dbm/useDbmListPage";
 import { useDbmOwnFilterSync } from "@/composables/dbm/useDbmScopeFilters";
@@ -695,6 +697,7 @@ const emit = defineEmits<{
   (e: "sendToAiChat", value: { query: string; autoSend: boolean }): void;
 }>();
 
+const aiLock = useLicenseLock("ai_assistant");
 const aiEnabled = computed(
   () => config.isEnterprise == "true" && Boolean(store.state.zoConfig?.ai_enabled),
 );
@@ -710,6 +713,7 @@ const {
   tabCountsContext,
   loading,
   error,
+  forbidden,
   search,
   lastRunAt,
   org,
@@ -1978,11 +1982,19 @@ const rowActions = computed<DbmRowAction[]>(() => [
   { id: "traces", icon: "account-tree", label: t("dbm.queries.actions.traces") },
   { id: "copy", icon: "content-copy", label: t("dbm.queries.actions.copy") },
   { id: "alert", icon: "shield", label: t("dbm.queries.actions.alert") },
-  // Absent, not disabled, when AI is off — a row of buttons must not carry a
-  // permanent dead one.
-  ...(aiEnabled.value
-    ? [{ id: "ai", icon: "brain-circuit", label: t("dbm.ai.rowSuggestFix") } as DbmRowAction]
-    : []),
+  // Absent when AI is off, locked when the license lacks it.
+  ...(aiLock.locked.value
+    ? [
+        {
+          id: "ai",
+          icon: "brain-circuit",
+          label: t("dbm.ai.rowSuggestFix"),
+          lockedReason: aiLock.lockedReason.value,
+        } as DbmRowAction,
+      ]
+    : aiEnabled.value
+      ? [{ id: "ai", icon: "brain-circuit", label: t("dbm.ai.rowSuggestFix") } as DbmRowAction]
+      : []),
 ]);
 
 const onRowAction = async (id: string, row: QueryRow) => {
diff --git a/web/src/views/DatabaseMonitoring/QueryDetailPage.vue b/web/src/views/DatabaseMonitoring/QueryDetailPage.vue
index 1f1de5b626..89388fe0dc 100644
--- a/web/src/views/DatabaseMonitoring/QueryDetailPage.vue
+++ b/web/src/views/DatabaseMonitoring/QueryDetailPage.vue
@@ -172,37 +172,39 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
            DbmSectionTabs, one level down — OTabs/OTab with a hint tooltip, and
            the Callers tab locked with the same lock+tooltip treatment when the
            vantage that fills it reported nothing. -->
-      <OTabs
-        v-if="hasQuery"
-        :model-value="activeTab"
-        align="left"
-        bordered
-        class="px-page-edge shrink-0"
-        data-test="dbm-detail-tabs"
-        @change="onTabChange"
-      >
-        <OTab
-          v-for="tab in detailTabs"
-          :key="tab.key"
-          :name="tab.key"
-          :disable="tab.disabled"
-          :data-test="`dbm-detail-tab-${tab.key}`"
+      <FeatureLockExempt v-if="hasQuery" class="contents">
+        <OTabs
+          :model-value="activeTab"
+          align="left"
+          bordered
+          class="px-page-edge shrink-0"
+          data-test="dbm-detail-tabs"
+          @change="onTabChange"
         >
-          <span>{{ tab.label }}</span>
-          <!-- The lock is what makes an empty tab read as "nothing measured
-               this" rather than "broken" — the same reason the L2 strip locks
-               its gated tabs instead of hiding them. Decorative for AT; the
-               tooltip carries the sentence. -->
-          <OIcon
-            v-if="tab.disabled"
-            name="lock"
-            size="xs"
-            aria-hidden="true"
-            :data-test="`dbm-detail-tab-lock-${tab.key}`"
-          />
-          <OTooltip side="bottom" :content="tab.hint" />
-        </OTab>
-      </OTabs>
+          <OTab
+            v-for="tab in detailTabs"
+            :key="tab.key"
+            :name="tab.key"
+            :disable="tab.disabled"
+            :data-test="`dbm-detail-tab-${tab.key}`"
+          >
+            <span>{{ tab.label }}</span>
+            <!-- The lock is what makes an empty tab read as "nothing measured
+                 this" rather than "broken" — the same reason the L2 strip locks
+                 its gated tabs instead of hiding them. Decorative for AT; the
+                 tooltip carries the sentence. -->
+            <OIcon
+              v-if="tab.disabled"
+              name="lock"
+              class="lock-chip"
+              size="xs"
+              aria-hidden="true"
+              :data-test="`dbm-detail-tab-lock-${tab.key}`"
+            />
+            <OTooltip side="bottom" :content="tab.hint" />
+          </OTab>
+        </OTabs>
+      </FeatureLockExempt>
 
       <OTabPanels v-if="hasQuery" :model-value="activeTab" data-test="dbm-detail-tab-panels">
         <!-- ── Overview ────────────────────────────────────────────────────
@@ -1053,7 +1055,32 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <span class="tabular-nums">{{ formatNs(endpoint.p95_ns) }}</span>
               </template>
               <template #cell-actions="{ row: endpoint }">
+                <OTooltip
+                  v-if="tracesLock.locked.value"
+                  side="left"
+                  :content="tracesLock.lockedReason.value"
+                >
+                  <span class="inline-flex">
+                    <OButton
+                      variant="ghost"
+                      size="icon-sm"
+                      disabled
+                      :aria-label="t('dbm.detail.viewTraces')"
+                      :data-test="`dbm-detail-endpoint-traces-${endpoint.rowKey}`"
+                    >
+                      <template #icon-left>
+                        <OIcon
+                          name="lock"
+                          class="text-icon-locked"
+                          size="sm"
+                          :data-test="`dbm-detail-endpoint-traces-lock-${endpoint.rowKey}`"
+                        />
+                      </template>
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
+                  v-else
                   variant="ghost"
                   size="icon-sm"
                   icon-left="open-in-new"
@@ -1088,7 +1115,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </template>
 
             <div v-if="samples.length" class="h-50 w-full px-3">
-              <ChartRenderer :data="scatterData" @click="onSampleClick" />
+              <ChartRenderer
+                :data="scatterData"
+                v-on="tracesLock.locked.value ? {} : { click: onSampleClick }"
+              />
             </div>
 
             <OTable
@@ -1102,7 +1132,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :page-size="10"
               table-id="dbm-query-samples"
               data-test="dbm-detail-samples-table"
-              @row-click="openSampleTrace"
+              v-on="tracesLock.locked.value ? {} : { rowClick: openSampleTrace }"
             >
               <template #cell-timestamp="{ row: sample }">
                 <span class="tabular-nums">{{ formatClock(sample.timestamp) }}</span>
@@ -1120,7 +1150,32 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <span v-else class="text-text-muted">{{ raw("—") }}</span>
               </template>
               <template #cell-actions="{ row: sample }">
+                <OTooltip
+                  v-if="tracesLock.locked.value"
+                  side="left"
+                  :content="tracesLock.lockedReason.value"
+                >
+                  <span class="inline-flex">
+                    <OButton
+                      variant="ghost"
+                      size="icon-sm"
+                      disabled
+                      :aria-label="t('dbm.detail.viewTrace')"
+                      :data-test="`dbm-detail-sample-trace-${sample.rowKey}`"
+                    >
+                      <template #icon-left>
+                        <OIcon
+                          name="lock"
+                          class="text-icon-locked"
+                          size="sm"
+                          :data-test="`dbm-detail-sample-trace-lock-${sample.rowKey}`"
+                        />
+                      </template>
+                    </OButton>
+                  </span>
+                </OTooltip>
                 <OButton
+                  v-else
                   variant="ghost"
                   size="icon-sm"
                   icon-left="open-in-new"
@@ -1197,6 +1252,7 @@ import DbmLockEmptyState, {
   type DbmLockEmptyAction,
 } from "@/components/dbm/DbmLockEmptyState.vue";
 import DbmSuggestFixButton from "@/components/dbm/DbmSuggestFixButton.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import DateTime from "@/components/DateTime.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
@@ -1216,6 +1272,7 @@ import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import type { SelectModelValue, SelectOption } from "@/lib/forms/Select/OSelect.types";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import dbMonitoringService, {
   type EndpointRow,
   type ErrorCodeCount,
@@ -1328,6 +1385,7 @@ const { t } = useI18nTyped();
 const store = useStore();
 const route = useRoute();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
 const { getStreams } = useStreams(t);
 
 // This page is a route root, so MainLayout's `@sendToAiChat` binding is on it
@@ -3045,6 +3103,7 @@ const errorMessage = (err: unknown): string =>
 
 /** The traces route hydrates from `stream`/`filter`/`from`/`to` query params. */
 const openTraces = (filter: string) => {
+  if (tracesLock.locked.value) return;
   router
     .push({
       name: "traces",
diff --git a/web/src/views/DatabaseMonitoring/SamplesPage.vue b/web/src/views/DatabaseMonitoring/SamplesPage.vue
index 5a0d273f85..9b8b6307db 100644
--- a/web/src/views/DatabaseMonitoring/SamplesPage.vue
+++ b/web/src/views/DatabaseMonitoring/SamplesPage.vue
@@ -124,6 +124,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :frame="false"
         :toolbar-bordered="false"
         :error="error"
+        :forbidden="forbidden"
         sorting="client"
         :show-global-filter="false"
         table-id="dbm-samples"
@@ -202,8 +203,32 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </template>
 
         <template #cell-actions="{ row }">
+          <OTooltip
+            v-if="sampleTraceFilter(row) && tracesLock.locked.value"
+            side="left"
+            :content="tracesLock.lockedReason.value"
+          >
+            <span class="inline-flex">
+              <OButton
+                variant="ghost"
+                size="icon-sm"
+                disabled
+                :aria-label="t('dbm.samples.viewTrace')"
+                :data-test="`dbm-samples-trace-${row.rowKey}`"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    :data-test="`dbm-samples-trace-lock-${row.rowKey}`"
+                  />
+                </template>
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
-            v-if="sampleTraceFilter(row)"
+            v-else-if="sampleTraceFilter(row)"
             variant="ghost"
             size="icon-sm"
             icon-left="open-in-new"
@@ -372,6 +397,8 @@ import OTableColumnToggle from "@/lib/core/Table/sub-components/OTableColumnTogg
 import useExternalColumnToggle from "@/composables/useExternalColumnToggle";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import dbMonitoringService, { type ServerSampleRow } from "@/services/db_monitoring";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import { useDbmTracePresence } from "@/composables/dbm/useDbmTracePresence";
@@ -407,6 +434,7 @@ const { columnVisibility, setColumnVisibility } = useExternalColumnToggle("dbm-s
 const store = useStore();
 const route = useRoute();
 const router = useRouter();
+const tracesLock = useLicenseLock("traces");
 
 // The shared list-page spine: scope from the URL, the request-sequence guard,
 // the shell's badge snapshot, refresh/date-change handlers and the load
@@ -418,6 +446,7 @@ const {
   tabCountsContext,
   loading,
   error,
+  forbidden,
   search,
   lastRunAt,
   org,
@@ -911,7 +940,7 @@ const countLine = computed<I18nText | null>(() => {
 /** The traces route hydrates from `stream`/`filter`/`from`/`to` query params. */
 const openSampleTrace = (row: DbmSampleRow) => {
   const filter = sampleTraceFilter(row);
-  if (!filter) return;
+  if (!filter || tracesLock.locked.value) return;
   router
     .push({
       name: "traces",
diff --git a/web/src/views/DatabaseMonitoring/dbmQueryDetailNotFound.spec.ts b/web/src/views/DatabaseMonitoring/dbmQueryDetailNotFound.spec.ts
index 324681a9f4..b8b3d8aae4 100644
--- a/web/src/views/DatabaseMonitoring/dbmQueryDetailNotFound.spec.ts
+++ b/web/src/views/DatabaseMonitoring/dbmQueryDetailNotFound.spec.ts
@@ -110,8 +110,10 @@ describe("the page renders that state instead of a blank body", () => {
     const gated = (dataTest: string): string => {
       const index = template.indexOf(`data-test="${dataTest}"`);
       expect(index, `the template must render ${dataTest}`).toBeGreaterThan(-1);
-      // The opening tag this marker belongs to.
-      const open = template.lastIndexOf("<", index);
+      // The tab strip sits in a lock-exempt wrapper that carries the gate.
+      const wrapper = template.lastIndexOf("<FeatureLockExempt", index);
+      const open =
+        dataTest === "dbm-detail-tabs" && wrapper > -1 ? wrapper : template.lastIndexOf("<", index);
       return template.slice(open, index);
     };
     for (const marker of ["dbm-detail-identity", "dbm-detail-tabs"]) {
@@ -171,7 +173,7 @@ describe("a named query that missed its scope keeps the page", () => {
     // stays truthy there — the exact thing the first cut got wrong.
     const index = template.indexOf('data-test="dbm-detail-tabs"');
     expect(index, "the template must render the tab strip").toBeGreaterThan(-1);
-    const open = template.slice(template.lastIndexOf("<", index), index);
+    const open = template.slice(template.lastIndexOf("<FeatureLockExempt", index), index);
     expect(open, "the strip must not be gated on anything stricter").toMatch(/v-if="hasQuery"/);
     expect(hasQuery("notFound")).toBe(true);
   });
diff --git a/web/src/views/DatabaseMonitoring/dbmTracesLicenseLock.spec.ts b/web/src/views/DatabaseMonitoring/dbmTracesLicenseLock.spec.ts
new file mode 100644
index 0000000000..5005b68a40
--- /dev/null
+++ b/web/src/views/DatabaseMonitoring/dbmTracesLicenseLock.spec.ts
@@ -0,0 +1,76 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Source-read like its siblings: these views need a router, a store and a dozen O2 children to mount.
+
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const read = (file: string) => readFileSync(join(here, file), "utf8");
+
+const templateOf = (source: string) => source.slice(0, source.indexOf("<script setup"));
+
+const block = (source: string, start: string) => {
+  const at = source.indexOf(start);
+  expect(at, start).toBeGreaterThan(-1);
+  return source.slice(at, source.indexOf("\n};", at));
+};
+
+describe.each([
+  ["SamplesPage.vue", "const openSampleTrace", ["dbm-samples-trace-lock-"]],
+  [
+    "QueryDetailPage.vue",
+    "const openTraces",
+    ["dbm-detail-endpoint-traces-lock-", "dbm-detail-sample-trace-lock-"],
+  ],
+])("%s trace pivots", (file, opener, lockTests) => {
+  const source = read(file);
+  const template = templateOf(source);
+
+  it("keys the lock on the traces license", () => {
+    expect(source).toContain('const tracesLock = useLicenseLock("traces");');
+  });
+
+  it("renders a disabled lock with the locked reason while traces are locked", () => {
+    for (const lockTest of lockTests) {
+      const at = template.indexOf(lockTest);
+      expect(at, lockTest).toBeGreaterThan(-1);
+      const tooltipAt = template.lastIndexOf("<OTooltip", at);
+      const markup = template.slice(tooltipAt, at);
+      expect(markup).toContain("tracesLock.locked.value");
+      expect(markup).toContain(':content="tracesLock.lockedReason.value"');
+      expect(markup).toContain('<span class="inline-flex">');
+      expect(markup).toContain("disabled");
+      expect(markup).not.toContain("@click");
+    }
+  });
+
+  it("keeps the live pivot on the enabled branch", () => {
+    for (const lockTest of lockTests) {
+      const closeAt = template.indexOf("</OTooltip>", template.indexOf(lockTest));
+      const live = template.slice(closeAt, template.indexOf("</OButton>", closeAt));
+      expect(live).toMatch(/<OButton\s+v-else/);
+      expect(live).toMatch(/@click(\.stop)?="open\w+\(/);
+    }
+  });
+
+  it("navigates nowhere from a row or chart click while traces are locked", () => {
+    expect(block(source, opener)).toMatch(/tracesLock\.locked\.value\) return;/);
+  });
+});
diff --git a/web/src/views/HomeNoDataState.spec.ts b/web/src/views/HomeNoDataState.spec.ts
index 368e532b6d..1367a5e120 100644
--- a/web/src/views/HomeNoDataState.spec.ts
+++ b/web/src/views/HomeNoDataState.spec.ts
@@ -119,4 +119,28 @@ describe("HomeNoDataState", () => {
       }),
     });
   });
+
+  it("marks the Profiles chip unavailable with a gold lock when continuous profiling is license-locked", async () => {
+    push.mockClear();
+    store.state.zoConfig = {
+      ...store.state.zoConfig,
+      profiling_enabled: true,
+      features: { continuous_profiling: "locked" },
+    };
+    const wrapper = mount(HomeNoDataState, {
+      props: { tab: "overview" },
+      global: { plugins: [i18n, store] },
+    });
+
+    const chip = wrapper.find('[data-test="home-no-data-profiles-btn"]');
+    expect(chip.attributes("aria-disabled")).toBe("true");
+    const chipComponent = wrapper
+      .findAllComponents({ name: "EmptyStateIngestionChip" })
+      .find((c) => c.attributes("data-test") === "home-no-data-profiles-btn")!;
+    expect(chipComponent.props("unavailable")).toBe(true);
+    expect(chip.find(".lock-chip").exists()).toBe(true);
+    await chip.trigger("click");
+    expect(push).not.toHaveBeenCalled();
+    store.state.zoConfig = { ...store.state.zoConfig, features: {} };
+  });
 });
diff --git a/web/src/views/HomeNoDataState.vue b/web/src/views/HomeNoDataState.vue
index 10da542fa9..cb0107831e 100644
--- a/web/src/views/HomeNoDataState.vue
+++ b/web/src/views/HomeNoDataState.vue
@@ -144,8 +144,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           @click="go('ingestLogs')"
           >{{ t("home.noDataState.shippers") }}</EmptyStateIngestionChip
         >
+        <OTooltip
+          v-if="store.state.zoConfig?.profiling_enabled && profilesLocked"
+          :content="profilesLockedReason"
+        >
+          <span class="inline-flex">
+            <EmptyStateIngestionChip unavailable data-test="home-no-data-profiles-btn">
+              <OIcon name="lock" size="xs" class="lock-chip shrink-0" />
+              {{ t("home.noDataState.profiles") }}
+            </EmptyStateIngestionChip>
+          </span>
+        </OTooltip>
         <EmptyStateIngestionChip
-          v-if="store.state.zoConfig?.profiling_enabled"
+          v-else-if="store.state.zoConfig?.profiling_enabled"
           icon="memory"
           data-test="home-no-data-profiles-btn"
           @click="go('ingestProfiles')"
@@ -173,14 +184,17 @@ import { raw, useI18nTyped } from "@/types/i18n";
 import { useRouter } from "vue-router";
 import { useStore } from "vuex";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import EmptyStateIngestionCard from "@/lib/core/EmptyState/EmptyStateIngestionCard.vue";
 import EmptyStateIngestionChip from "@/lib/core/EmptyState/EmptyStateIngestionChip.vue";
 import SampleDataCallout from "@/components/sampleData/SampleDataCallout.vue";
 import { sampleDataFlowOn } from "@/utils/firstRunFlow";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { getImageURL } from "@/utils/zincutils";
 import { useSetupTarget } from "@/composables/useNoDataIntro";
 import type { OnboardingChoiceId } from "@/components/onboarding/onboardingChoices";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import DOMPurify from "dompurify";
 
 const props = defineProps<{
@@ -200,6 +214,8 @@ defineSlots<{
 const { t } = useI18nTyped();
 const router = useRouter();
 const store = useStore();
+const { locked: profilesLocked, lockedReason: profilesLockedReason } =
+  useLicenseLock("continuous_profiling");
 
 const shell = computed(() => {
   if (props.alternativesOnly) return { size: "block" as const, backdrop: false };
diff --git a/web/src/views/HomeView.spec.ts b/web/src/views/HomeView.spec.ts
index 489da77e30..b34094a18c 100644
--- a/web/src/views/HomeView.spec.ts
+++ b/web/src/views/HomeView.spec.ts
@@ -98,6 +98,8 @@ vi.mock("@/composables/useOrgHasUserData", async () => {
 
 import config from "@/aws-exports";
 import HomeView from "./HomeView.vue";
+import { useHomeDashboard } from "@/composables/useHomeDashboard";
+import { raw } from "@/types/i18n";
 
 const mountHome = () =>
   mount(HomeView, {
@@ -133,6 +135,79 @@ describe("HomeView", () => {
     vi.restoreAllMocks();
   });
 
+  describe("a pinned home dashboard", () => {
+    const { homeDashboard } = useHomeDashboard(i18n.global.t as never);
+    const TAB = "dash:default:d1";
+
+    beforeEach(() => {
+      setFlag(false);
+      homeDashboard.value = { folderId: "default", dashboardId: "d1", label: raw("Pinned") };
+    });
+    afterEach(() => {
+      homeDashboard.value = null;
+    });
+
+    it("should show a lock on the pinned tab when dashboards are locked", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, features: { dashboards: "locked" } });
+      wrapper = mountHome();
+      await flushPromises();
+
+      expect(has(`home-tab-${TAB}`)).toBe(true);
+      expect(has(`home-tab-lock-${TAB}`)).toBe(true);
+    });
+
+    it("should show no lock on the pinned tab when dashboards are enabled", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, features: { dashboards: "enabled" } });
+      wrapper = mountHome();
+      await flushPromises();
+
+      expect(has(`home-tab-${TAB}`)).toBe(true);
+      expect(has(`home-tab-lock-${TAB}`)).toBe(false);
+    });
+  });
+
+  describe("the AI Assistant tab", () => {
+    beforeEach(() => setFlag(false));
+
+    it("should stay visible with a lock and show the denied state when ai_assistant is locked", async () => {
+      store.commit("setConfig", {
+        ...store.state.zoConfig,
+        ai_enabled: false,
+        features: { ai_assistant: "locked" },
+      });
+      openTab("ai");
+      wrapper = mountHome();
+      await flushPromises();
+
+      expect(has("home-tab-ai")).toBe(true);
+      expect(has("home-tab-lock-ai")).toBe(true);
+      expect(has("home-ai-locked")).toBe(true);
+      expect(has("ai-chat-stub")).toBe(false);
+    });
+
+    it("should be absent when ai_assistant is not offered", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, ai_enabled: false, features: {} });
+      wrapper = mountHome();
+      await flushPromises();
+
+      expect(has("home-tab-ai")).toBe(false);
+    });
+
+    it("should mount the chat with no lock when ai_assistant is enabled", async () => {
+      store.commit("setConfig", {
+        ...store.state.zoConfig,
+        ai_enabled: true,
+        features: { ai_assistant: "enabled" },
+      });
+      openTab("ai");
+      wrapper = mountHome();
+      await flushPromises();
+
+      expect(has("home-tab-lock-ai")).toBe(false);
+      expect(has("ai-chat-stub")).toBe(true);
+    });
+  });
+
   describe("with the empty-data flag off", () => {
     beforeEach(() => setFlag(false));
 
diff --git a/web/src/views/HomeView.vue b/web/src/views/HomeView.vue
index d5e7bcdcff..1d3d1559db 100644
--- a/web/src/views/HomeView.vue
+++ b/web/src/views/HomeView.vue
@@ -30,7 +30,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :tabs-below="tabOrder.length > 1"
       bleed
     >
-      <template v-if="isMobile && activeHomeTab === 'ai'" #actions>
+      <template v-if="isMobile && activeHomeTab === 'ai' && !aiLocked" #actions>
         <OButton
           variant="outline"
           size="sm"
@@ -60,8 +60,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             :key="tab.id"
             :name="tab.id"
             :data-test="`home-tab-${tab.id}`"
+            :tooltip="tab.id === 'ai' ? tabLockReason(tab.id) : undefined"
           >
             <span class="o-tab__label truncate">{{ tab.label }}</span>
+            <template v-if="tabLockReason(tab.id)">
+              <OIcon
+                name="lock"
+                size="xs"
+                class="lock-chip ms-1 shrink-0"
+                :data-test="`home-tab-lock-${tab.id}`"
+              />
+              <span class="sr-only">{{ tabLockReason(tab.id) }}</span>
+            </template>
             <template v-if="tab.id.startsWith('dash:')" #trailing>
               <button
                 type="button"
@@ -106,9 +116,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           @dismiss="arrived = undefined"
           @open="openArrived"
         />
+        <LicenseDeniedState
+          v-if="activeHomeTab === 'ai' && aiLocked"
+          :features="['ai_assistant']"
+          data-test="home-ai-locked"
+        />
         <!-- O2 AI Assistant tab -->
         <div
-          v-if="activeHomeTab === 'ai'"
+          v-else-if="activeHomeTab === 'ai'"
           class="home-ai-panel flex min-h-0 flex-1 flex-row overflow-hidden max-md:flex-col"
         >
           <HomeChatHistory class="max-md:hidden" @load-chat="onLoadChat" @new-chat="onNewChat" />
@@ -226,6 +241,8 @@ import config from "../aws-exports";
 import OverviewTab from "@/views/OverviewTab.vue";
 import UsageTab from "@/views/UsageTab.vue";
 import O2AIChat from "@/components/O2AIChat.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { menuState } from "@/utils/featureGate";
 import HomeChatHistory from "@/views/HomeChatHistory.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
@@ -237,6 +254,7 @@ import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import useBreakpoint from "@/composables/useBreakpoint";
 import PinnedDashboardTab from "@/views/PinnedDashboardTab.vue";
 import { useHomeDashboard } from "@/composables/useHomeDashboard";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import FirstDataPanel from "@/components/ingestion/FirstDataPanel.vue";
 import FirstDataNotice from "@/components/ingestion/FirstDataNotice.vue";
@@ -263,11 +281,28 @@ export default defineComponent({
 
     const isEnterpriseOrCloud = config.isEnterprise === "true" || config.isCloud === "true";
 
-    const { homeDashboard, clearHomeDashboard, updateLabel, isLoadedFor } = useHomeDashboard(t);
+    const { homeDashboard, clearHomeDashboard, updateLabel, isLoadedFor, load } =
+      useHomeDashboard(t);
+    const { locked: dashboardsLocked, lockedReason: dashboardsLockedReason } =
+      useLicenseLock("dashboards");
+    const { lockedReason: aiLockedReason } = useLicenseLock("ai_assistant");
+    const aiState = computed(() =>
+      menuState(
+        store.state.zoConfig?.features,
+        "ai_assistant",
+        Boolean(store.state.zoConfig?.ai_enabled),
+      ),
+    );
+    const aiLocked = computed(() => aiState.value === "locked");
+    const tabLockReason = (id: string) => {
+      if (id === "ai" && aiLocked.value) return aiLockedReason.value;
+      if (id.startsWith("dash:") && dashboardsLocked.value) return dashboardsLockedReason.value;
+      return undefined;
+    };
 
     const DEFAULT_TABS = computed(() => {
       const tabs: { id: string; label: string; closable?: boolean }[] = [];
-      if (isEnterpriseOrCloud && store.state.zoConfig.ai_enabled) {
+      if (isEnterpriseOrCloud && aiState.value !== "hidden") {
         tabs.push({ id: "ai", label: t("home.tabAiAssistant") });
       }
       // Always reachable — Incidents/Services inside render locked (not
@@ -307,9 +342,29 @@ export default defineComponent({
       }
     }
 
+    let verifyingPin = false;
+
     // The pinned dashboard could not be loaded (deleted / inaccessible). Clear
     // the pin and tell the user why — distinct from a deliberate close.
-    function onPinnedUnavailable() {
+    async function onPinnedUnavailable(dashboardId: string, folderId: string) {
+      const org = store.state.selectedOrganization?.identifier;
+      if (!org || verifyingPin) return;
+      verifyingPin = true;
+      try {
+        await load(org, true);
+      } finally {
+        verifyingPin = false;
+      }
+      const failed = `dash:${folderId}:${dashboardId}`;
+      const pin = homeDashboard.value;
+      if (pin?.dashboardId !== dashboardId) return;
+      const pinTab = `dash:${pin.folderId}:${pin.dashboardId}`;
+      // The pin is org-wide, so it is only deleted when a fresh read still names the folder that failed; a late failure from a replaced tab must not.
+      if (pinTab !== failed) {
+        if (activeHomeTab.value === failed) activeHomeTab.value = pinTab;
+        return;
+      }
+      if (activeHomeTab.value !== failed) return;
       removeHomePin();
       toast({
         variant: "error",
@@ -357,7 +412,16 @@ export default defineComponent({
       },
     );
 
-    const savedActiveTab = localStorage.getItem(LS_ACTIVE_TAB_KEY);
+    // The tab id carries the folder, so a saved tab for the pinned dashboard takes the pin's current folder.
+    function pinTabFor(id: string) {
+      const pin = homeDashboard.value;
+      if (!pin || !id.startsWith("dash:")) return id;
+      if (parsePinnedTabId(id).dashboardId !== pin.dashboardId) return id;
+      return `dash:${pin.folderId}:${pin.dashboardId}`;
+    }
+
+    const storedActiveTab = localStorage.getItem(LS_ACTIVE_TAB_KEY);
+    const savedActiveTab = storedActiveTab && pinTabFor(storedActiveTab);
     const isAvailableTab = (id: string) => DEFAULT_TABS.value.some((tb) => tb.id === id);
     const pinnedTabPending = ref(
       !!savedActiveTab?.startsWith("dash:") &&
@@ -372,13 +436,15 @@ export default defineComponent({
     if (pinnedTabPending.value) {
       const stopHold = watch(
         () => [
-          isAvailableTab(activeHomeTab.value),
+          isAvailableTab(pinTabFor(activeHomeTab.value)),
           isLoadedFor(store.state.selectedOrganization?.identifier),
         ],
         ([available, loaded]) => {
           if (!available && !loaded) return;
           pinnedTabPending.value = false;
-          if (!available) activeHomeTab.value = tabOrder.value[0]?.id ?? "usage";
+          activeHomeTab.value = available
+            ? pinTabFor(activeHomeTab.value)
+            : (tabOrder.value[0]?.id ?? "usage");
           stopHold();
         },
       );
@@ -408,17 +474,36 @@ export default defineComponent({
       { immediate: true },
     );
 
-    // When the user opens the pinned dashboard tab, re-read the authoritative
-    // home_dashboard org setting so a snapshot that went stale on another system
-    // (e.g. the dashboard was moved to a different folder elsewhere) self-corrects
-    // before we render / navigate with its folderId.
-    watch(activeHomeTab, (val) => {
-      if (val.startsWith("dash:")) {
-        const org = store.state.selectedOrganization?.identifier;
-        if (org) useHomeDashboard(t).load(org);
-      }
+    // The cached pin can be stale from another device, so it is re-read without holding the tab; a stale folder is caught by onPinnedUnavailable.
+    function revalidatePin() {
+      const org = store.state.selectedOrganization?.identifier;
+      if (org) void load(org, true);
+    }
+
+    watch(activeHomeTab, (val, prev) => {
+      if (!val.startsWith("dash:")) return;
+      // Only the folder changed, by the watch below, which already applied the fresh pin.
+      if (
+        prev?.startsWith("dash:") &&
+        parsePinnedTabId(prev).dashboardId === parsePinnedTabId(val).dashboardId
+      )
+        return;
+      revalidatePin();
     });
 
+    // The tab id carries the folder, so a re-read that moved, replaced or dropped the pin must move the open tab with it.
+    watch(homeDashboard, (pin) => {
+      if (pinnedTabPending.value || !activeHomeTab.value.startsWith("dash:")) return;
+      if (!pin || pin.dashboardId !== parsePinnedTabId(activeHomeTab.value).dashboardId) {
+        activeHomeTab.value = tabOrder.value[0]?.id ?? "usage";
+        return;
+      }
+      const nextId = `dash:${pin.folderId}:${pin.dashboardId}`;
+      if (activeHomeTab.value !== nextId) activeHomeTab.value = nextId;
+    });
+
+    if (homeDashboard.value && !pinnedTabPending.value) revalidatePin();
+
     // Drag-to-reorder — OTabs reports the move (dragged id → target id + which
     // side of the target) and we apply it to our own ordered list, then persist.
     function onTabReorder({
@@ -506,12 +591,15 @@ export default defineComponent({
       isDataTab,
       arrived,
       openArrived,
+      aiLocked,
+      tabLockReason,
     };
   },
   components: {
     OverviewTab,
     UsageTab,
     O2AIChat,
+    LicenseDeniedState,
     HomeChatHistory,
     OTabs,
     OTab,
diff --git a/web/src/views/IdentityAccessManagement.spec.ts b/web/src/views/IdentityAccessManagement.spec.ts
index b14e06bd6a..c12e00f916 100644
--- a/web/src/views/IdentityAccessManagement.spec.ts
+++ b/web/src/views/IdentityAccessManagement.spec.ts
@@ -281,6 +281,99 @@ describe("IdentityAccessManagement.vue Component", () => {
       expect(groups?.lockedShowUpgradeCta).toBe(false);
       w.unmount();
     });
+
+    it.each([
+      ["locked", true],
+      ["hidden", false],
+    ])("shows groups and roles under a %s rbac license: %s", async (state, shown) => {
+      vi.spyOn(config, "isEnterprise", "get").mockReturnValue("true");
+      store.state.zoConfig.rbac_enabled = true;
+      store.state.zoConfig.features = { rbac: state };
+
+      const w = mount(IdentityAccessManagement, {
+        global: { provide: { store }, plugins: [i18n, router], stubs: defaultStubs },
+      });
+      await flushPromises();
+
+      const items = visibleItems(w.vm.sectionGroups);
+      expect(items.some((i: any) => i.key === "groups")).toBe(shown);
+      expect(items.some((i: any) => i.key === "roles")).toBe(shown);
+      expect(items.some((i: any) => i.key === "users")).toBe(true);
+      w.unmount();
+      delete store.state.zoConfig.features;
+    });
+
+    it.each([
+      ["locked", true],
+      ["enabled", false],
+    ])(
+      "marks groups and roles license-locked under a %s rbac license: %s",
+      async (state, locked) => {
+        vi.spyOn(config, "isEnterprise", "get").mockReturnValue("true");
+        store.state.zoConfig.rbac_enabled = true;
+        store.state.zoConfig.features = { rbac: state };
+
+        const w = mount(IdentityAccessManagement, {
+          global: { provide: { store }, plugins: [i18n, router], stubs: defaultStubs },
+        });
+        await flushPromises();
+
+        const items = visibleItems(w.vm.sectionGroups);
+        const byKey = (key: string) => items.find((i: any) => i.key === key);
+        expect(byKey("groups")?.licenseLocked).toBe(locked);
+        expect(byKey("roles")?.licenseLocked).toBe(locked);
+        // A license lock is not an edition lock: the click must reach the page, not the upsell.
+        expect(byKey("groups")?.locked).toBe(false);
+        expect(byKey("users")?.licenseLocked).toBeUndefined();
+        w.unmount();
+        delete store.state.zoConfig.features;
+      },
+    );
+  });
+
+  describe("License-gated rail items", () => {
+    const itemsUnder = async (features: Record<string, string>, extra = {}) => {
+      Object.assign(store.state.zoConfig, extra, { features });
+      const w = mount(IdentityAccessManagement, {
+        global: { provide: { store }, plugins: [i18n, router], stubs: defaultStubs },
+      });
+      await flushPromises();
+      const items = allItems(w.vm.sectionGroups);
+      w.unmount();
+      delete store.state.zoConfig.features;
+      return (key: string) => items.find((i: any) => i.key === key);
+    };
+
+    it.each([
+      ["syntheticsTokens", "synthetics"],
+      ["mcpServer", "mcp"],
+      ["quota", "ratelimit"],
+    ])("%s is license-locked under a locked %s license", async (key, feature) => {
+      const byKey = await itemsUnder({ [feature]: "locked" });
+      expect(byKey(key)?.licenseLocked).toBe(true);
+    });
+
+    it.each([
+      ["syntheticsTokens", "synthetics"],
+      ["mcpServer", "mcp"],
+      ["quota", "ratelimit"],
+    ])("%s is hidden under a hidden %s license", async (key, feature) => {
+      const byKey = await itemsUnder({ [feature]: "hidden" });
+      expect(byKey(key)?.visible).toBe(false);
+    });
+
+    it("keeps a locked synthetics tokens item visible though the synthetics flag is off", async () => {
+      const byKey = await itemsUnder({ synthetics: "locked" }, { synthetics_enabled: false });
+      expect(byKey("syntheticsTokens")).toMatchObject({ visible: true, licenseLocked: true });
+      delete store.state.zoConfig.synthetics_enabled;
+    });
+
+    it("leaves the items unlocked and visible when the license enables them", async () => {
+      const byKey = await itemsUnder({});
+      expect(byKey("syntheticsTokens")).toMatchObject({ licenseLocked: false });
+      expect(byKey("mcpServer")).toMatchObject({ visible: true, licenseLocked: false });
+      expect(byKey("quota")?.licenseLocked).toBe(false);
+    });
   });
 
   describe("Tab Configuration Tests - Enterprise vs Open Source", () => {
diff --git a/web/src/views/IdentityAccessManagement.vue b/web/src/views/IdentityAccessManagement.vue
index 529931170a..343e256623 100644
--- a/web/src/views/IdentityAccessManagement.vue
+++ b/web/src/views/IdentityAccessManagement.vue
@@ -43,6 +43,7 @@ import config from "@/aws-exports";
 import { useRouter, useRoute, RouterView } from "vue-router";
 import useIsMetaOrg from "@/composables/useIsMetaOrg";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
+import { featureState, menuState } from "@/utils/featureGate";
 
 const store = useStore();
 const { t } = useI18nTyped();
@@ -76,6 +77,14 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
   const meta = isMetaOrg.value;
   const svc = store.state.zoConfig.service_account_enabled ?? true;
   const rbacAccess = checkFeatureAccess("rbac", buildFeatureGateContext(store.state.zoConfig));
+  const rbacLicense = featureState(store.state.zoConfig?.features, "rbac");
+  const syntheticsLicense = menuState(
+    store.state.zoConfig?.features,
+    "synthetics",
+    store.state.zoConfig?.synthetics_enabled !== false,
+  );
+  const mcpLicense = featureState(store.state.zoConfig?.features, "mcp");
+  const ratelimitLicense = featureState(store.state.zoConfig?.features, "ratelimit");
 
   const groups: SectionHubGroup[] = [
     {
@@ -112,7 +121,8 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
           description: t("iam.syntheticsTokensDesc"),
           icon: "key",
           to: { name: "syntheticsTokens", query: orgQuery.value },
-          visible: store.state.zoConfig?.synthetics_enabled !== false,
+          visible: syntheticsLicense !== "hidden",
+          licenseLocked: syntheticsLicense === "locked",
           dataTest: "iam-synthetics-tokens-tab",
         },
         {
@@ -121,9 +131,9 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
           description: t("iam.mcpServerDesc", { product: raw("Model Context Protocol") }),
           icon: "mcp",
           to: { name: "mcpServer", query: orgQuery.value },
-          // No `visible` gate: the MCP endpoint is served by every edition, so
-          // the card shows on OSS too. See the route comment in
-          // useEnterpriseRoutes.ts.
+          // No edition gate (every edition serves MCP); only a hidden license removes it.
+          visible: mcpLicense !== "hidden",
+          licenseLocked: mcpLicense === "locked",
           dataTest: "iam-mcp-server-tab",
         },
         {
@@ -146,9 +156,11 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
           description: t("iam.groupsDesc"),
           icon: "group",
           to: { name: "groups", query: orgQuery.value },
+          visible: rbacLicense !== "hidden",
           locked: !rbacAccess.allowed,
           lockedMessage: rbacAccess.message,
           lockedShowUpgradeCta: rbacAccess.ctaRelevant,
+          licenseLocked: rbacLicense === "locked",
           dataTest: "iam-groups-tab",
         },
         {
@@ -157,9 +169,11 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
           description: t("iam.rolesDesc"),
           icon: "shield",
           to: { name: "roles", query: orgQuery.value },
+          visible: rbacLicense !== "hidden",
           locked: !rbacAccess.allowed,
           lockedMessage: rbacAccess.message,
           lockedShowUpgradeCta: rbacAccess.ctaRelevant,
+          licenseLocked: rbacLicense === "locked",
           dataTest: "iam-roles-tab",
         },
         {
@@ -170,10 +184,11 @@ const sectionGroups = computed<SectionHubGroup[]>(() => {
           to: { name: "quota", query: orgQuery.value },
           // Meta-org is a cluster-topology restriction, not an edition
           // upsell — stays a hide, not a lock.
-          visible: meta,
+          visible: meta && ratelimitLicense !== "hidden",
           locked: !rbacAccess.allowed,
           lockedMessage: rbacAccess.message,
           lockedShowUpgradeCta: rbacAccess.ctaRelevant,
+          licenseLocked: ratelimitLicense === "locked",
           dataTest: "iam-quota-tab",
         },
       ],
diff --git a/web/src/views/Infrastructure/kubernetes2/ClusterOverview.spec.ts b/web/src/views/Infrastructure/kubernetes2/ClusterOverview.spec.ts
index d9d517f60f..fa4e91bf77 100644
--- a/web/src/views/Infrastructure/kubernetes2/ClusterOverview.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/ClusterOverview.spec.ts
@@ -143,12 +143,13 @@ const WARNINGS: WarningEvent[] = [
 
 describe("ClusterOverview", () => {
   let wrapper: VueWrapper<any>;
+  let features: Record<string, string> = {};
 
   const overviewStore = () =>
     createStore({
       state: {
         selectedOrganization: { identifier: "org1" },
-        zoConfig: { incidents_enabled: true },
+        zoConfig: { incidents_enabled: true, features },
       },
     });
 
@@ -194,6 +195,7 @@ describe("ClusterOverview", () => {
 
   beforeEach(() => {
     push.mockClear();
+    features = {};
     listAlerts.mockResolvedValue({ data: { list: [] } });
     listIncidents.mockResolvedValue({ data: { incidents: [], total: 0 } });
   });
@@ -368,6 +370,21 @@ describe("ClusterOverview", () => {
       expect(wrapper.find('[data-test="k8s2-overview-alerts-card"]').exists()).toBe(false);
     });
 
+    it("locks the alerts tile and skips both reads when alerts and incidents are license-locked", async () => {
+      features = { alerts: "locked", incidents: "locked" };
+      listAlerts.mockClear();
+      listIncidents.mockClear();
+      await mountView();
+      await flushPromises();
+      expect(listAlerts).not.toHaveBeenCalled();
+      expect(listIncidents).not.toHaveBeenCalled();
+      expect(text("k8s2-overview-kpi-alerts")).toContain("Locked: needs");
+      expect(text("k8s2-overview-alerts-locked")).toContain("Locked: needs");
+      expect(text("k8s2-overview-incident-locked")).toContain("Locked: needs");
+      await wrapper.find('[data-test="k8s2-overview-kpi-alerts"]').trigger("click");
+      expect(push).not.toHaveBeenCalled();
+    });
+
     it("shows the alerts tile as unavailable when the reads fail", async () => {
       listAlerts.mockRejectedValue(new Error("403"));
       listIncidents.mockRejectedValue(new Error("403"));
diff --git a/web/src/views/Infrastructure/kubernetes2/ClusterOverview.vue b/web/src/views/Infrastructure/kubernetes2/ClusterOverview.vue
index 07f1b40979..0ac026c446 100644
--- a/web/src/views/Infrastructure/kubernetes2/ClusterOverview.vue
+++ b/web/src/views/Infrastructure/kubernetes2/ClusterOverview.vue
@@ -29,6 +29,7 @@ import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import OStatCard from "@/lib/data/StatStrip/OStatCard.vue";
 import type { StatTone } from "@/lib/data/StatStrip/OStatStrip.types";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useOrgId } from "@/composables/query";
 import { escapeLabel, type QueryId } from "./kubernetesQueries";
@@ -229,17 +230,24 @@ const alertsTile = computed(() => {
   const firing = signals.firingAlerts.value.length;
   const incidents = signals.openIncidents.value.length;
   if (!signals.alertsAvailable.value && !signals.incidentsAvailable.value) {
+    const locked = signals.alertsLocked.value;
     return {
       value: "—",
-      sub: t("infra.k8s2.overviewKpiUnavailable"),
+      sub: locked ? signals.alertsLockedReason.value : t("infra.k8s2.overviewKpiUnavailable"),
       tone: "neutral" as StatTone,
+      locked,
     };
   }
   const sub =
     signals.incidentsAvailable.value && incidents
       ? t("infra.k8s2.overviewKpiAlertsIncidents", { count: incidents }, incidents)
       : t("infra.k8s2.overviewKpiAlertsFiring");
-  return { value: firing, sub, tone: (firing || incidents ? "error" : "success") as StatTone };
+  return {
+    value: firing,
+    sub,
+    tone: (firing || incidents ? "error" : "success") as StatTone,
+    locked: false,
+  };
 });
 
 const chartLabel = computed(
@@ -342,6 +350,7 @@ function openAlerts() {
 }
 
 function onAlertsTile() {
+  if (alertsTile.value.locked) return;
   if (!signals.alertsAvailable.value && signals.incidentsAvailable.value) openIncidents();
   else openAlerts();
 }
@@ -407,7 +416,7 @@ function onAlertsTile() {
           @click="emit('navigate', { view: 'events', status: 'warnings' })"
         />
         <OStatCard
-          clickable
+          :clickable="!alertsTile.locked"
           icon="campaign"
           :label="t('infra.k8s2.overviewKpiAlerts')"
           :value="alertsTile.value"
@@ -416,7 +425,20 @@ function onAlertsTile() {
           :loading="signals.alertsLoading.value"
           data-test="k8s2-overview-kpi-alerts"
           @click="onAlertsTile"
-        />
+        >
+          <template v-if="alertsTile.locked" #value>
+            <OTooltip :content="signals.alertsLockedReason.value">
+              <span class="inline-flex">
+                <OIcon
+                  name="lock"
+                  size="sm"
+                  class="lock-chip"
+                  data-test="k8s2-overview-kpi-alerts-lock"
+                />
+              </span>
+            </OTooltip>
+          </template>
+        </OStatCard>
       </div>
 
       <div class="grid grid-cols-1 items-start gap-3 lg:grid-cols-2">
@@ -541,9 +563,13 @@ function onAlertsTile() {
             :incidents="signals.openIncidents.value"
             :incidents-visible="signals.incidentsAvailable.value"
             :incidents-loading="signals.incidentsLoading.value"
+            :incidents-locked="signals.incidentsLocked.value"
+            :incidents-locked-reason="signals.incidentsLockedReason.value"
             :alerts="signals.firingAlerts.value"
             :alerts-visible="signals.alertsAvailable.value"
             :alerts-loading="signals.alertsLoading.value"
+            :alerts-locked="signals.alertsLocked.value"
+            :alerts-locked-reason="signals.alertsLockedReason.value"
             :end-us="range.end"
             @open-incident="openIncident"
             @open-incidents="openIncidents"
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.spec.ts b/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.spec.ts
index 48465d4f6d..04ff8b4aa5 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.spec.ts
@@ -756,6 +756,25 @@ describe("K8sDetailsDrawer actions", () => {
     expect(wrapper.emitted("action")).toHaveLength(3);
   });
 
+  it("locks Traces and Metrics behind their license, keeping Logs and YAML live", async () => {
+    const saved = store.state.zoConfig.features;
+    store.state.zoConfig.features = { traces: "locked", metrics: "locked", logs: "locked" };
+    try {
+      const ref = refOf("pod", "web-abc-1");
+      const wrapper = mountDrawer(ref);
+      for (const type of ["traces", "metrics"]) {
+        const button = wrapper.find(`[data-test="k8s2-drawer-action-${type}"]`);
+        expect(button.attributes("disabled")).toBeDefined();
+        expect(wrapper.find(`[data-test="k8s2-drawer-action-${type}-lock"]`).exists()).toBe(true);
+        await button.trigger("click");
+      }
+      await wrapper.find('[data-test="k8s2-drawer-view-logs"]').trigger("click");
+      expect(wrapper.emitted("action")).toEqual([["logs", ref]]);
+    } finally {
+      store.state.zoConfig.features = saved;
+    }
+  });
+
   it("emits action logs from the Logs button", async () => {
     const ref = refOf("pod", "web-abc-1");
     const wrapper = mountDrawer(ref);
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.vue b/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.vue
index b6d52d3d2a..06cf63ed12 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.vue
+++ b/web/src/views/Infrastructure/kubernetes2/K8sDetailsDrawer.vue
@@ -25,6 +25,8 @@ import OTag from "@/lib/core/Badge/OTag.vue";
 import OText from "@/lib/core/Typography/OText.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import ODescriptionList from "@/lib/lists/DescriptionList/ODescriptionList.vue";
 import ODescriptionItem from "@/lib/lists/DescriptionList/ODescriptionItem.vue";
@@ -80,6 +82,8 @@ const emit = defineEmits<{
 
 const store = useStore();
 const { t } = useI18nTyped();
+const tracesLock = useLicenseLock("traces");
+const metricsLock = useLicenseLock("metrics");
 
 const EVENT_LIMIT = 100;
 
@@ -325,8 +329,31 @@ const showPods = () => emit("navigate", { view: "pods", search: props.details.na
             @click="act('yaml')"
             >{{ t("infra.k8s2.drawerActionYaml") }}</OButton
           >
+          <OTooltip
+            v-if="hasTraces && tracesLock.locked.value"
+            :content="tracesLock.lockedReason.value"
+          >
+            <span class="inline-flex">
+              <OButton
+                variant="outline"
+                size="sm-action"
+                disabled
+                data-test="k8s2-drawer-action-traces"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    data-test="k8s2-drawer-action-traces-lock"
+                  />
+                </template>
+                {{ t("infra.k8s2.drawerActionTraces") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
-            v-if="hasTraces"
+            v-else-if="hasTraces"
             variant="outline"
             size="sm-action"
             icon-left="account-tree"
@@ -337,7 +364,28 @@ const showPods = () => emit("navigate", { view: "pods", search: props.details.na
             >{{ t("infra.k8s2.drawerActionTraces") }}
             <OTooltip v-if="noMember" :content="t('infra.k8s2.drawerNoMemberPods')"
           /></OButton>
+          <OTooltip v-if="metricsLock.locked.value" :content="metricsLock.lockedReason.value">
+            <span class="inline-flex">
+              <OButton
+                variant="outline"
+                size="sm-action"
+                disabled
+                data-test="k8s2-drawer-action-metrics"
+              >
+                <template #icon-left>
+                  <OIcon
+                    name="lock"
+                    class="text-icon-locked"
+                    size="sm"
+                    data-test="k8s2-drawer-action-metrics-lock"
+                  />
+                </template>
+                {{ t("infra.k8s2.drawerActionMetrics") }}
+              </OButton>
+            </span>
+          </OTooltip>
           <OButton
+            v-else
             variant="outline"
             size="sm-action"
             icon-left="show-chart"
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.spec.ts b/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.spec.ts
index 43538f838e..75f678d816 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.spec.ts
@@ -50,8 +50,11 @@ const dispatch = vi.fn();
 const POLL_MS = 5000;
 const DAY_US = 24 * 60 * 60 * 1_000_000;
 
-const mountPanel = async (overrides: Record<string, unknown> = {}) => {
-  const store = createStore({ state: { timezone: "UTC" } });
+const mountPanel = async (
+  overrides: Record<string, unknown> = {},
+  features: Record<string, string> = {},
+) => {
+  const store = createStore({ state: { timezone: "UTC", zoConfig: { features } } });
   store.dispatch = dispatch;
   const wrapper = mount(K8sLogsPanel, {
     props: {
@@ -114,6 +117,23 @@ describe("K8sLogsPanel", () => {
     expect(push).toHaveBeenCalledWith(link.route);
   });
 
+  it("locks the Logs hand-off when the logs license is locked, still tailing in the dock", async () => {
+    const wrapper = await mountPanel({}, { logs: "locked" });
+    const open = wrapper.find('[data-test="k8s2-logs-open"]');
+    expect(open.attributes("disabled")).toBeDefined();
+    expect(wrapper.find('[data-test="k8s2-logs-open-lock"]').exists()).toBe(true);
+    await open.trigger("click");
+    expect(push).not.toHaveBeenCalled();
+    expect(wrapper.findAll('[data-test="k8s2-logs-line"]')).toHaveLength(3);
+  });
+
+  it("keeps the Logs hand-off live when the license enables logs", async () => {
+    const wrapper = await mountPanel({}, { logs: "enabled" });
+    expect(wrapper.find('[data-test="k8s2-logs-open-lock"]').exists()).toBe(false);
+    await wrapper.find('[data-test="k8s2-logs-open"]').trigger("click");
+    expect(push).toHaveBeenCalledWith(link.route);
+  });
+
   describe("polling", () => {
     const fakeTimers = () => vi.useFakeTimers({ toFake: ["setInterval", "clearInterval", "Date"] });
     const advance = async (ms: number) => {
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.vue b/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.vue
index f4b034c943..e606132a32 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.vue
+++ b/web/src/views/Infrastructure/kubernetes2/K8sLogsPanel.vue
@@ -26,6 +26,9 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
 import OText from "@/lib/core/Typography/OText.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import searchService from "@/services/search";
 import useStreams from "@/composables/useStreams";
@@ -53,6 +56,7 @@ const props = defineProps<{
 const store = useStore();
 const router = useRouter();
 const { t } = useI18nTyped();
+const logsLock = useLicenseLock("logs");
 // useStreams injects the store, which only works during setup, never inside a click handler.
 const streamsApi = useStreams(gt);
 
@@ -189,6 +193,7 @@ const stopPolling = () => {
 };
 
 const openInLogs = () => {
+  if (logsLock.locked.value) return;
   if (!link.value) {
     toast({ variant: "warning", message: t("infra.k8s2.logsNoStream") });
     return;
@@ -284,7 +289,23 @@ onBeforeUnmount(stopPolling);
             : t("infra.k8s2.logsLines", { count: visible.length }, visible.length)
         }}
       </OText>
+      <OTooltip v-if="logsLock.locked.value" :content="logsLock.lockedReason.value">
+        <span class="inline-flex">
+          <OButton variant="ghost-primary" size="sm" disabled data-test="k8s2-logs-open">
+            <template #icon-left>
+              <OIcon
+                name="lock"
+                class="text-icon-locked"
+                size="sm"
+                data-test="k8s2-logs-open-lock"
+              />
+            </template>
+            {{ t("infra.k8s2.logsOpenIn") }}
+          </OButton>
+        </span>
+      </OTooltip>
       <OButton
+        v-else
         variant="ghost-primary"
         size="sm"
         icon-right="arrow-forward"
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.spec.ts b/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.spec.ts
index db8d2b1905..9d7f820b43 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.spec.ts
@@ -15,6 +15,7 @@
 
 import { afterEach, describe, expect, it } from "vitest";
 import { enableAutoUnmount, flushPromises, mount } from "@vue/test-utils";
+import { createStore } from "vuex";
 import i18n from "@/locales";
 import K8sRowMenu from "./K8sRowMenu.vue";
 import { readActionsFor, writeActionsFor } from "./k8sActions";
@@ -70,4 +71,38 @@ describe("K8sRowMenu", () => {
     await flushPromises();
     expect(wrapper.emitted("action")).toBeUndefined();
   });
+
+  const openWithFeatures = async (features: Record<string, string>) => {
+    const store = createStore({ state: { zoConfig: { features } } });
+    const wrapper = mount(K8sRowMenu, {
+      props: { target: pod },
+      global: { plugins: [i18n, store] },
+      attachTo: document.body,
+    });
+    await wrapper.find('[data-test="k8s2-row-menu-trigger"]').trigger("click");
+    await flushPromises();
+    return wrapper;
+  };
+
+  it("locks the traces and metrics hand-offs when their license is locked, keeping logs live", async () => {
+    const wrapper = await openWithFeatures({ traces: "locked", metrics: "locked", logs: "locked" });
+    for (const type of ["traces", "metrics"]) {
+      expect(item(type)?.getAttribute("aria-disabled")).toBe("true");
+      expect(
+        document.body.querySelector(`[data-test="k8s2-row-menu-${type}-license-lock"]`),
+      ).not.toBeNull();
+    }
+    expect(item("logs")?.hasAttribute("aria-disabled")).toBe(false);
+    (item("traces") as HTMLElement).click();
+    await flushPromises();
+    expect(wrapper.emitted("action")).toBeUndefined();
+  });
+
+  it("keeps the hand-offs live when the license enables them", async () => {
+    const wrapper = await openWithFeatures({ traces: "enabled", metrics: "enabled" });
+    expect(document.body.querySelector('[data-test$="-license-lock"]')).toBeNull();
+    (item("metrics") as HTMLElement).click();
+    await flushPromises();
+    expect(wrapper.emitted("action")).toEqual([["metrics", pod]]);
+  });
 });
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.vue b/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.vue
index 82ad251e7c..456ac046e6 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.vue
+++ b/web/src/views/Infrastructure/kubernetes2/K8sRowMenu.vue
@@ -24,6 +24,7 @@ import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import ODropdownSeparator from "@/lib/overlay/Dropdown/ODropdownSeparator.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 import type { DetailsRef } from "./kubernetesUrlState";
 import { readActionsFor, writeActionsFor, type K8sAction } from "./k8sActions";
 
@@ -44,6 +45,11 @@ const ITEMS: Record<Exclude<K8sAction, "explain">, { label: I18nKey; icon: IconN
   delete: { label: "infra.k8s2.menuDelete", icon: "delete" },
 };
 
+// Logs open in the in-page dock, not the Logs page, so only the two page hand-offs lock.
+const LICENSE_KEYS: Partial<Record<K8sAction, string>> = { traces: "traces", metrics: "metrics" };
+
+const { isLocked, lockedReason } = useLicenseLocks();
+
 const reads = computed(() => readActionsFor(props.target.kind));
 
 const writes = computed(() => writeActionsFor(props.target.kind));
@@ -61,15 +67,38 @@ const writes = computed(() => writeActionsFor(props.target.kind));
         @click.stop
       />
     </template>
-    <ODropdownItem
-      v-for="type in reads"
-      :key="type"
-      :icon-left="ITEMS[type].icon"
-      :data-test="`k8s2-row-menu-${type}`"
-      @select="emit('action', type, target)"
-    >
-      {{ t(ITEMS[type].label) }}
-    </ODropdownItem>
+    <template v-for="type in reads" :key="type">
+      <ODropdownItem
+        v-if="isLocked(LICENSE_KEYS[type])"
+        disabled
+        focusable-unavailable
+        :data-test="`k8s2-row-menu-${type}`"
+      >
+        <template #icon-left>
+          <OIcon :name="ITEMS[type].icon" size="sm" />
+        </template>
+        <span class="min-w-0 flex-1">
+          <OTooltip :content="lockedReason(LICENSE_KEYS[type] ?? '')" side="left" />
+          {{ t(ITEMS[type].label) }}
+        </span>
+        <template #icon-right>
+          <OIcon
+            name="lock"
+            class="text-icon-locked"
+            size="sm"
+            :data-test="`k8s2-row-menu-${type}-license-lock`"
+          />
+        </template>
+      </ODropdownItem>
+      <ODropdownItem
+        v-else
+        :icon-left="ITEMS[type].icon"
+        :data-test="`k8s2-row-menu-${type}`"
+        @select="emit('action', type, target)"
+      >
+        {{ t(ITEMS[type].label) }}
+      </ODropdownItem>
+    </template>
     <ODropdownSeparator v-if="writes.length" />
     <ODropdownItem
       v-for="type in writes"
@@ -86,7 +115,7 @@ const writes = computed(() => writeActionsFor(props.target.kind));
         {{ t(ITEMS[type].label) }}
       </span>
       <template #icon-right>
-        <OIcon name="lock" size="sm" data-test="k8s2-row-menu-lock" />
+        <OIcon name="lock" class="lock-chip" size="sm" data-test="k8s2-row-menu-lock" />
       </template>
     </ODropdownItem>
   </ODropdown>
diff --git a/web/src/views/Infrastructure/kubernetes2/K8sSignalCards.vue b/web/src/views/Infrastructure/kubernetes2/K8sSignalCards.vue
index d7b0376daf..1704c9971f 100644
--- a/web/src/views/Infrastructure/kubernetes2/K8sSignalCards.vue
+++ b/web/src/views/Infrastructure/kubernetes2/K8sSignalCards.vue
@@ -16,7 +16,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script setup lang="ts">
 import { computed } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OText from "@/lib/core/Typography/OText.vue";
@@ -35,6 +36,10 @@ const props = defineProps<{
   alerts: FiringAlert[];
   alertsVisible: boolean;
   alertsLoading: boolean;
+  incidentsLocked: boolean;
+  incidentsLockedReason: I18nText;
+  alertsLocked: boolean;
+  alertsLockedReason: I18nText;
   // µs
   endUs: number;
 }>();
@@ -55,6 +60,18 @@ const ageOf = (us: number | null | undefined) =>
 </script>
 
 <template>
+  <section
+    v-if="incidentsLocked"
+    class="bg-surface-panel border-border-default rounded-surface flex min-w-0 flex-col gap-2 border p-3"
+    data-test="k8s2-overview-incident-locked"
+  >
+    <OText variant="card-title">{{ t("infra.k8s2.overviewIncidentTitle") }}</OText>
+    <div class="text-text-secondary flex items-center gap-2 text-sm">
+      <OIcon name="lock" size="sm" class="lock-chip shrink-0" />
+      <span>{{ incidentsLockedReason }}</span>
+    </div>
+  </section>
+
   <section
     v-if="incidentsVisible && (incidentsLoading || incident)"
     class="bg-surface-panel border-border-default rounded-surface flex min-w-0 flex-col gap-2 border p-3"
@@ -104,6 +121,18 @@ const ageOf = (us: number | null | undefined) =>
     </template>
   </section>
 
+  <section
+    v-if="alertsLocked"
+    class="bg-surface-panel border-border-default rounded-surface flex min-w-0 flex-col gap-2 border p-3"
+    data-test="k8s2-overview-alerts-locked"
+  >
+    <OText variant="card-title">{{ t("infra.k8s2.overviewAlertsTitle") }}</OText>
+    <div class="text-text-secondary flex items-center gap-2 text-sm">
+      <OIcon name="lock" size="sm" class="lock-chip shrink-0" />
+      <span>{{ alertsLockedReason }}</span>
+    </div>
+  </section>
+
   <section
     v-if="alertsVisible && (alertsLoading || alerts.length)"
     class="bg-surface-panel border-border-default rounded-surface flex min-w-0 flex-col gap-2 border p-3"
diff --git a/web/src/views/Infrastructure/kubernetes2/KubernetesPage.spec.ts b/web/src/views/Infrastructure/kubernetes2/KubernetesPage.spec.ts
index 90d7129998..60381e3f43 100644
--- a/web/src/views/Infrastructure/kubernetes2/KubernetesPage.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/KubernetesPage.spec.ts
@@ -743,6 +743,18 @@ describe("KubernetesPage", () => {
         query: { query_type: "promql", stream_name: "k8s_pod_cpu_usage" },
       });
     });
+
+    it.each(["traces", "metrics"])(
+      "does not leave for %s when its license is locked",
+      async (type) => {
+        await mountPage({ view: "pods", cluster: "alpha" });
+        store.state.zoConfig = { features: { [type]: "locked" } };
+        const push = vi.spyOn(router, "push").mockResolvedValue(undefined as any);
+        wrapper.findComponent(ListStub).vm.$emit("action", type, pod);
+        await flushPromises();
+        expect(push).not.toHaveBeenCalled();
+      },
+    );
   });
 
   describe("wiring", () => {
diff --git a/web/src/views/Infrastructure/kubernetes2/KubernetesPage.vue b/web/src/views/Infrastructure/kubernetes2/KubernetesPage.vue
index 4809461fff..826ae47ecb 100644
--- a/web/src/views/Infrastructure/kubernetes2/KubernetesPage.vue
+++ b/web/src/views/Infrastructure/kubernetes2/KubernetesPage.vue
@@ -39,6 +39,7 @@ import K8sDock from "./K8sDock.vue";
 import { metricsRoute, pickTracesStream, tracesRoute } from "./k8sNavigation";
 import useStreams from "@/composables/useStreams";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 import type { K8sAction } from "./k8sActions";
 import {
   closeTab,
@@ -98,6 +99,7 @@ const streamsApi = useStreams(gt);
 const route = useRoute();
 const router = useRouter();
 const { t } = useI18nTyped();
+const { isLocked } = useLicenseLocks();
 
 const state = computed(() => parseUrlState(route.query));
 const orgId = computed(() => store.state.selectedOrganization?.identifier ?? "");
@@ -454,6 +456,7 @@ const openTraces = async (ref: DetailsRef) => {
 };
 
 const onAction = (type: K8sAction, ref: DetailsRef) => {
+  if ((type === "metrics" || type === "traces") && isLocked(type)) return;
   if (type === "details") onDrawerLink(ref);
   else if (type === "logs") dock.value = openTab(dock.value, type, ref);
   else if (type === "yaml") dock.value = openTab(dock.value, type, ref, dockRowOf(ref));
diff --git a/web/src/views/Infrastructure/kubernetes2/useOverviewSignals.ts b/web/src/views/Infrastructure/kubernetes2/useOverviewSignals.ts
index c16165f178..10b93d783b 100644
--- a/web/src/views/Infrastructure/kubernetes2/useOverviewSignals.ts
+++ b/web/src/views/Infrastructure/kubernetes2/useOverviewSignals.ts
@@ -18,6 +18,7 @@ import { useStore } from "vuex";
 import { useQuery } from "@tanstack/vue-query";
 import { useOrgId } from "@/composables/query";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import { alertsListQuery } from "@/services/alerts.queries";
 import { incidentsQuery } from "@/services/incidents.queries";
 import type { Incident } from "@/services/incidents";
@@ -44,12 +45,19 @@ export function useOverviewSignals(cluster: Ref<string | null>, refreshNonce: Re
   const store = useStore();
   const orgId = useOrgId();
   const incidentsAccess = useLockedAffordance("incidents");
+  const alertsLock = useLicenseLock("alerts");
+  const incidentsLock = useLicenseLock("incidents");
   const incidentsEnabled = computed(
-    () => incidentsAccess.value.allowed && store.state.zoConfig?.incidents_enabled === true,
+    () =>
+      incidentsAccess.value.allowed &&
+      store.state.zoConfig?.incidents_enabled === true &&
+      !incidentsLock.locked.value,
   );
 
   const alerts = useQuery(() =>
-    Object.assign(alertsListQuery(orgId.value, ""), { enabled: !!orgId.value }),
+    Object.assign(alertsListQuery(orgId.value, ""), {
+      enabled: !!orgId.value && !alertsLock.locked.value,
+    }),
   );
   const incidents = useQuery(() =>
     Object.assign(incidentsQuery(orgId.value, "open", INCIDENT_PAGE, 0), {
@@ -58,7 +66,7 @@ export function useOverviewSignals(cluster: Ref<string | null>, refreshNonce: Re
   );
 
   watch(refreshNonce, () => {
-    void alerts.refetch();
+    if (!alertsLock.locked.value) void alerts.refetch();
     if (incidentsEnabled.value) void incidents.refetch();
   });
 
@@ -83,10 +91,19 @@ export function useOverviewSignals(cluster: Ref<string | null>, refreshNonce: Re
   );
 
   return {
-    alertsLoading: computed(() => alerts.isPending.value),
-    alertsAvailable: computed(() => !alerts.isError.value),
+    alertsLocked: alertsLock.locked,
+    alertsLockedReason: alertsLock.lockedReason,
+    alertsLoading: computed(() => !alertsLock.locked.value && alerts.isPending.value),
+    alertsAvailable: computed(() => !alertsLock.locked.value && !alerts.isError.value),
     firingAlerts,
     incidentsEnabled,
+    incidentsLocked: computed(
+      () =>
+        incidentsAccess.value.allowed &&
+        store.state.zoConfig?.incidents_enabled === true &&
+        incidentsLock.locked.value,
+    ),
+    incidentsLockedReason: incidentsLock.lockedReason,
     incidentsLoading: computed(() => incidentsEnabled.value && incidents.isPending.value),
     incidentsAvailable: computed(() => incidentsEnabled.value && !incidents.isError.value),
     openIncidents,
diff --git a/web/src/views/Ingestion.spec.ts b/web/src/views/Ingestion.spec.ts
index 908dbc6db3..5e7a8118c0 100644
--- a/web/src/views/Ingestion.spec.ts
+++ b/web/src/views/Ingestion.spec.ts
@@ -479,7 +479,7 @@ describe("Ingestion", () => {
             ConfirmDialog: { template: "<div />" },
             OButton: { template: "<button><slot /></button>" },
             OTabs: { template: "<div><slot /></div>" },
-            ORouteTab: { template: "<div><slot /></div>" },
+            ORouteTab: { template: "<div class='route-tab-stub'><slot /></div>" },
             "router-view": { template: "<div />" },
           },
         },
@@ -542,7 +542,7 @@ describe("Ingestion", () => {
             ConfirmDialog: { template: "<div />" },
             OButton: { template: "<button><slot /></button>" },
             OTabs: { template: "<div><slot /></div>" },
-            ORouteTab: { template: "<div><slot /></div>" },
+            ORouteTab: { template: "<div class='route-tab-stub'><slot /></div>" },
             "router-view": { template: "<div />" },
           },
         },
@@ -1082,6 +1082,91 @@ describe("Ingestion", () => {
     });
   });
 
+  describe("RUM license lock", () => {
+    const mountLocked = async () => {
+      const w = mount(Ingestion, {
+        global: {
+          provide: { store },
+          plugins: [i18n, router],
+          stubs: {
+            ConfirmDialog: true,
+            OTooltip: { template: "<span><slot /></span>" },
+            OButton: {
+              name: "OButton",
+              template: "<button @click=\"$emit('click')\"><slot /></button>",
+              props: { variant: String, size: String, disabled: Boolean, iconLeft: String },
+              emits: ["click"],
+            },
+            OTabs: { template: "<div><slot /></div>" },
+            ORouteTab: { template: "<div class='route-tab-stub'><slot /></div>" },
+            "router-view": { template: "<div />" },
+          },
+        },
+      });
+      await flushPromises();
+      return w;
+    };
+
+    afterEach(() => {
+      store.state.zoConfig.features = {};
+    });
+
+    it("never requests the RUM token when rum is locked", async () => {
+      store.state.zoConfig.features = { rum: "locked" };
+      queryClient.clear();
+      apiKeysService.listRUMTokens.mockClear();
+
+      const w = await mountLocked();
+      await w.vm.getRUMToken();
+
+      expect(apiKeysService.listRUMTokens).not.toHaveBeenCalled();
+      w.unmount();
+    });
+
+    it("leaves the lock to the page on the RUM token button when rum is locked", async () => {
+      store.state.zoConfig.features = { rum: "locked" };
+      if (!router.hasRoute("frontendMonitoring")) {
+        router.addRoute({
+          name: "frontendMonitoring",
+          path: "/rum-lock-test",
+          component: { template: "<div />" },
+        });
+      }
+      const before = router.currentRoute.value.fullPath;
+      await router.push({ name: "frontendMonitoring" });
+      const w = await mountLocked();
+
+      const btn = w
+        .findAllComponents({ name: "OButton" })
+        .find((b: any) => b.attributes("data-test") === "ingestion-reset-token-btn");
+      expect(btn?.exists()).toBe(true);
+      expect(btn?.props("iconLeft")).not.toBe("lock");
+      w.unmount();
+      await router.push(before);
+    });
+
+    it("keeps the section tabs, search and Manage Tokens live on a locked page", async () => {
+      const w = await mountLocked();
+      const exempt = w.findAll("[data-feature-lock-exempt]");
+      const inExempt = (selector: string) => exempt.some((e: any) => e.find(selector).exists());
+      expect(inExempt('[data-test="recommended-list-search-input"]')).toBe(true);
+      expect(inExempt('[data-test="ingestion-manage-tokens-btn"]')).toBe(true);
+      expect(inExempt(".route-tab-stub")).toBe(true);
+      w.unmount();
+    });
+
+    it("requests the RUM token when rum is enabled", async () => {
+      store.state.zoConfig.features = { rum: "enabled" };
+      queryClient.clear();
+      apiKeysService.listRUMTokens.mockClear();
+
+      const w = await mountLocked();
+
+      expect(apiKeysService.listRUMTokens).toHaveBeenCalled();
+      w.unmount();
+    });
+  });
+
   describe("Conditional Button Rendering Logic", () => {
     it("should show reset RUM token button when rum token exists and route is in rumRoutes", async () => {
       if (!wrapper) {
diff --git a/web/src/views/Ingestion.vue b/web/src/views/Ingestion.vue
index fdb17c60dc..610c21ac79 100644
--- a/web/src/views/Ingestion.vue
+++ b/web/src/views/Ingestion.vue
@@ -27,7 +27,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   >
     <template #actions>
       <!-- A fixed phone width lets the title, search and token button share one row. -->
-      <div class="w-50 flex-none max-md:w-40">
+      <!-- The search only routes to a matching guide, so a locked guide must not trap the reader. -->
+      <FeatureLockExempt class="w-50 flex-none max-md:w-40">
         <OSearchInput
           v-model="globalSearchQuery"
           :placeholder="t('common.search')"
@@ -35,7 +36,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           class="indexlist-search-input w-full"
           data-test="recommended-list-search-input"
         />
-      </div>
+      </FeatureLockExempt>
       <OSelect
         v-if="lgUp && !isRUMPage && tokenOptions.length > 0"
         ref="tokenSelectRef"
@@ -49,16 +50,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         style="min-width: 13.75rem"
         @update:model-value="onTokenSelected"
       />
-      <OButton
-        v-if="!isRUMPage"
-        variant="primary"
-        size="sm"
-        icon-left="key"
-        :title="isMobile ? t('ingestion.manageTokensBtnLabel') : undefined"
-        @click="navigateToIngestionTokens"
-      >
-        <span class="max-md:hidden">{{ t("ingestion.manageTokensBtnLabel") }}</span>
-      </OButton>
+      <FeatureLockExempt v-if="!isRUMPage" class="contents">
+        <OButton
+          variant="primary"
+          size="sm"
+          icon-left="key"
+          :title="isMobile ? t('ingestion.manageTokensBtnLabel') : undefined"
+          data-test="ingestion-manage-tokens-btn"
+          @click="navigateToIngestionTokens"
+        >
+          <span class="max-md:hidden">{{ t("ingestion.manageTokensBtnLabel") }}</span>
+        </OButton>
+      </FeatureLockExempt>
       <OButton
         v-if="
           rumRoutes.indexOf(router.currentRoute.value.name) > -1 &&
@@ -103,96 +106,98 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @update:model-value="onTokenSelected"
           />
         </div>
-        <OTabs v-model="ingestTabType" align="left">
-          <ORouteTab
-            name="recommended"
-            :to="{
-              name: 'recommended',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.recommendedLabel')"
-          />
-          <ORouteTab
-            name="custom"
-            :to="{
-              name: 'custom',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.customLabel')"
-          />
-          <ORouteTab
-            name="server"
-            :to="{
-              name: 'servers',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.serverLabel')"
-          />
-          <ORouteTab
-            name="database"
-            :to="{
-              name: 'databases',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.databaseLabel')"
-          />
-          <ORouteTab
-            name="security"
-            :to="{
-              name: 'security',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.securityLabel')"
-          />
-          <ORouteTab
-            name="devops"
-            :to="{
-              name: 'devops',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.devopsLabel')"
-          />
-          <ORouteTab
-            name="networking"
-            :to="{
-              name: 'networking',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.networkingLabel')"
-          />
-          <ORouteTab
-            name="message-queues"
-            :to="{
-              name: 'message-queues',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.messageQueuesLabel')"
-          />
-          <ORouteTab
-            name="languages"
-            :to="{
-              name: 'languages',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.languagesLabel')"
-          />
-          <ORouteTab
-            name="ai-integrations"
-            :to="{
-              name: 'ai-integrations',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.aiLabel')"
-          />
-          <ORouteTab
-            name="others"
-            :to="{
-              name: 'others',
-              query: { org_identifier: store.state.selectedOrganization.identifier },
-            }"
-            :label="t('ingestion.otherLabel')"
-          />
-        </OTabs>
+        <FeatureLockExempt>
+          <OTabs v-model="ingestTabType" align="left">
+            <ORouteTab
+              name="recommended"
+              :to="{
+                name: 'recommended',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.recommendedLabel')"
+            />
+            <ORouteTab
+              name="custom"
+              :to="{
+                name: 'custom',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.customLabel')"
+            />
+            <ORouteTab
+              name="server"
+              :to="{
+                name: 'servers',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.serverLabel')"
+            />
+            <ORouteTab
+              name="database"
+              :to="{
+                name: 'databases',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.databaseLabel')"
+            />
+            <ORouteTab
+              name="security"
+              :to="{
+                name: 'security',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.securityLabel')"
+            />
+            <ORouteTab
+              name="devops"
+              :to="{
+                name: 'devops',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.devopsLabel')"
+            />
+            <ORouteTab
+              name="networking"
+              :to="{
+                name: 'networking',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.networkingLabel')"
+            />
+            <ORouteTab
+              name="message-queues"
+              :to="{
+                name: 'message-queues',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.messageQueuesLabel')"
+            />
+            <ORouteTab
+              name="languages"
+              :to="{
+                name: 'languages',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.languagesLabel')"
+            />
+            <ORouteTab
+              name="ai-integrations"
+              :to="{
+                name: 'ai-integrations',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.aiLabel')"
+            />
+            <ORouteTab
+              name="others"
+              :to="{
+                name: 'others',
+                query: { org_identifier: store.state.selectedOrganization.identifier },
+              }"
+              :label="t('ingestion.otherLabel')"
+            />
+          </OTabs>
+        </FeatureLockExempt>
       </div>
     </template>
     <ConfirmDialog
@@ -245,6 +250,8 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import { OPEN_TOKEN_PICKER } from "@/composables/useCredentialSnippet";
 import { useOrgCredential, type PasscodeRead } from "@/composables/useOrgCredential";
 import { FIRST_EVENT_ASK_AI } from "@/components/ingestion/firstEventAskAi";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 
 export default defineComponent({
   name: "PageIngestion",
@@ -256,6 +263,7 @@ export default defineComponent({
     OButton,
     OSearchInput,
     OSelect,
+    FeatureLockExempt,
   },
   emits: ["sendToAiChat"],
   setup(_props, { emit }) {
@@ -269,6 +277,7 @@ export default defineComponent({
     const confirmRUMUpdate = ref<boolean>(false);
     // A viewer may not read the RUM token, so it may neither generate nor reset one.
     const rumTokenForbidden = computed(() => !!store.state.organizationData.rumTokenForbidden);
+    const { locked: rumLocked } = useLicenseLock("rum");
     const currentOrgIdentifier: any = ref(store.state.selectedOrganization.identifier);
     const ingestTabType = ref("recommended");
     const globalSearchQuery = ref("");
@@ -400,6 +409,7 @@ export default defineComponent({
 
     // A 403 hides the token actions; staleTime 0 keeps a cached token from outliving that 403.
     const getRUMToken = () => {
+      if (rumLocked.value) return Promise.resolve();
       const org = store.state.selectedOrganization.identifier;
       return queryClient
         .fetchQuery({ ...rumTokensQuery(org), staleTime: 0 })
@@ -655,6 +665,7 @@ export default defineComponent({
       fetchOrgTokens,
       navigateToIngestionTokens,
       isRUMPage,
+      rumLocked,
       confirmUpdate,
       confirmRUMUpdate,
       getImageURL,
diff --git a/web/src/views/LogStream.spec.ts b/web/src/views/LogStream.spec.ts
index c030c1da92..5d76f3e4f7 100644
--- a/web/src/views/LogStream.spec.ts
+++ b/web/src/views/LogStream.spec.ts
@@ -275,6 +275,61 @@ describe("LogStream Component", () => {
     }
   });
 
+  describe("continuous profiling license lock", () => {
+    const profilesToggle = (w: any) =>
+      w
+        .findAllComponents({ name: "OToggleGroupItem" })
+        .find((i: any) => i.props("value") === "profiles");
+
+    afterEach(() => {
+      store.state.zoConfig.features = {};
+      store.state.zoConfig.profiling_enabled = false;
+    });
+
+    it("disables the profiles toggle and drops a remembered profiles tab when locked", async () => {
+      store.state.zoConfig.profiling_enabled = true;
+      store.state.zoConfig.features = { continuous_profiling: "locked" };
+      resetListViewState();
+      useListViewState("logStreams", { streamType: "profiles" } as never);
+      const w = mountLogStream();
+      await flushPromises();
+
+      expect(profilesToggle(w)?.props("disabled")).toBe(true);
+      expect(profilesToggle(w)?.props("tooltip")).toBeTruthy();
+      expect(w.vm.selectedStreamType).toBe("logs");
+      w.unmount();
+    });
+
+    it("falls back from the profiles tab when the lock arrives after mount", async () => {
+      store.state.zoConfig.profiling_enabled = true;
+      store.state.zoConfig.features = {};
+      resetListViewState();
+      useListViewState("logStreams", { streamType: "profiles" } as never);
+      const w = mountLogStream();
+      await flushPromises();
+      expect(w.vm.selectedStreamType).toBe("profiles");
+
+      store.state.zoConfig.features = { continuous_profiling: "locked" };
+      await flushPromises();
+
+      expect(w.vm.selectedStreamType).toBe("logs");
+      expect(w.vm.streamActiveTab).toBe("logs");
+      expect(profilesToggle(w)?.props("disabled")).toBe(true);
+      w.unmount();
+    });
+
+    it("keeps the profiles toggle live when profiling is enabled", async () => {
+      store.state.zoConfig.profiling_enabled = true;
+      store.state.zoConfig.features = { continuous_profiling: "enabled" };
+      const w = mountLogStream();
+      await flushPromises();
+
+      expect(profilesToggle(w)?.props("disabled")).toBe(false);
+      expect(profilesToggle(w)?.props("tooltip")).toBeUndefined();
+      w.unmount();
+    });
+  });
+
   describe("View state restore", () => {
     it("restores saved filter, type, page and sort on mount", async () => {
       resetListViewState();
diff --git a/web/src/views/LogStream.vue b/web/src/views/LogStream.vue
index b30b1ae105..1b14cda2da 100644
--- a/web/src/views/LogStream.vue
+++ b/web/src/views/LogStream.vue
@@ -107,8 +107,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   v-if="store.state.zoConfig?.profiling_enabled"
                   value="profiles"
                   size="sm"
+                  :disabled="profilesLocked"
+                  :tooltip="profilesLocked ? profilesLockedReason : undefined"
+                  data-test="log-stream-profiles-toggle"
                 >
-                  <template #icon-left><OIcon name="memory" size="xs" class="shrink-0" /></template>
+                  <template #icon-left
+                    ><OIcon
+                      :name="profilesLocked ? 'lock' : 'memory'"
+                      size="xs"
+                      class="shrink-0"
+                      :class="profilesLocked && 'lock-chip'"
+                  /></template>
                   {{ t("logStream.labelProfiles") }}
                 </OToggleGroupItem>
                 <OToggleGroupItem value="metadata" size="sm">
@@ -470,6 +479,7 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import { useReo } from "@/services/reodotdev_analytics";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
@@ -521,6 +531,10 @@ export default defineComponent({
       sortBy: "name",
       sortOrder: "asc" as "asc" | "desc",
     });
+    const { locked: profilesLocked, lockedReason: profilesLockedReason } =
+      useLicenseLock("continuous_profiling");
+    // a remembered profiles tab must not reopen a locked feature
+    if (profilesLocked.value && viewState.streamType === "profiles") viewState.streamType = "logs";
     const filterQuery = ref(viewState.filterQuery);
     const duplicateStreamList: Ref<any[]> = ref([]);
     const selectedStreamType = ref(viewState.streamType);
@@ -1372,6 +1386,11 @@ export default defineComponent({
       onChangeStreamFilter(tab);
     };
 
+    // The org config, with its license states, can land after this page mounted.
+    watch(profilesLocked, (locked) => {
+      if (locked && selectedStreamType.value === "profiles") filterLogStreamByTab("logs");
+    });
+
     // ── Keyboard shortcuts ────────────────────────────────────────────────
     useShortcuts([
       {
@@ -1398,6 +1417,8 @@ export default defineComponent({
       raw,
       router,
       store,
+      profilesLocked,
+      profilesLockedReason,
       logStream: logStream,
       columns,
       selectedIds,
diff --git a/web/src/views/OnCall/OnCallPolicies.vue b/web/src/views/OnCall/OnCallPolicies.vue
index 6044ece396..c9ec56dd53 100644
--- a/web/src/views/OnCall/OnCallPolicies.vue
+++ b/web/src/views/OnCall/OnCallPolicies.vue
@@ -41,6 +41,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <OTable
       ref="oTableRef"
       :frame="false"
+      :forbidden="forbidden"
       :data="rows"
       :columns="columns"
       row-key="teamId"
@@ -177,6 +178,7 @@ import { oncallTeamsQuery, teamPolicyQuery, whoIsOnCallQuery } from "@/services/
 import type { OnCallPolicy, OnCallPosition, OnCallTeam } from "@/ts/interfaces/oncall";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { priorityLabel, priorityTagVariant, resolveLadder } from "@/utils/oncall";
+import { licenseDeniedFeatures, type ForbiddenState } from "@/utils/featureGate";
 
 /// One team's ladder, reduced to the two questions this page exists to answer.
 interface PolicyRow {
@@ -198,6 +200,7 @@ const ABSENT = raw("—");
 const policyDrafts = useEditorDraftIds("oncall_policy");
 
 const allRows = ref<PolicyRow[]>([]);
+const forbidden = ref<ForbiddenState>(false);
 const loading = ref(false);
 const lastUpdatedAt = ref<number | null>(null);
 const savedView = useListViewState("oncall-policies", {
@@ -358,6 +361,7 @@ async function fetchAll(force = false) {
     const teams = await read<OnCallTeam[]>(oncallTeamsQuery(orgId.value), force);
     const settled = await Promise.all(teams.map((team) => fetchTeamRow(team, force)));
     allRows.value = settled.filter((row): row is PolicyRow => row !== null);
+    forbidden.value = false;
     // The oldest of the reads the rows are built from, so the age never claims the table is fresher than it is.
     lastUpdatedAt.value = Math.min(
       ...[
@@ -366,6 +370,12 @@ async function fetchAll(force = false) {
       ].map((options) => queryClient.getQueryState(options.queryKey)?.dataUpdatedAt || Date.now()),
     );
   } catch (err: any) {
+    // A license denial is not a failed read: the table shows the license copy instead.
+    const denied = licenseDeniedFeatures(err);
+    if (denied) {
+      forbidden.value = denied;
+      return;
+    }
     toast({
       variant: "error",
       message: raw(err?.response?.data?.message) || t("oncall.loadTeamsFailed"),
diff --git a/web/src/views/OnCall/OnCallResponses.spec.ts b/web/src/views/OnCall/OnCallResponses.spec.ts
index 4364587819..562848fe1b 100644
--- a/web/src/views/OnCall/OnCallResponses.spec.ts
+++ b/web/src/views/OnCall/OnCallResponses.spec.ts
@@ -19,7 +19,6 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { queryClient } from "@/composables/query/queryClient";
 import i18n from "@/locales";
 import destinationService from "@/services/alert_destination";
-import incidentsService from "@/services/incidents";
 import oncallService from "@/services/oncall";
 import store from "@/test/unit/helpers/store";
 import { resetListViewState, useListViewState } from "@/composables/useListViewState";
@@ -44,9 +43,8 @@ vi.mock("@/services/oncall", () => ({
     resolveResponse: vi.fn(),
     snoozeResponse: vi.fn(),
     unsnoozeResponse: vi.fn(),
-    getPolicy: vi.fn(),
-    getSchedule: vi.fn(),
-    escalationProgress: vi.fn(),
+    teamContext: vi.fn(),
+    escalationProgressBatch: vi.fn(),
     getResponse: vi.fn(),
   },
 }));
@@ -64,10 +62,6 @@ vi.mock("@/services/alert_destination", () => ({
   default: { list: vi.fn() },
 }));
 
-vi.mock("@/services/incidents", () => ({
-  default: { get: vi.fn() },
-}));
-
 const push = vi.fn();
 const routeQuery: Record<string, string> = {};
 vi.mock("vue-router", () => ({
@@ -92,7 +86,6 @@ vi.mock("@/composables/useBreakpoint", async () => {
 
 const service = vi.mocked(oncallService);
 const destinations = vi.mocked(destinationService);
-const incidents = vi.mocked(incidentsService);
 
 // Every `mount()` in this file — across all three top-level `describe`s —
 // stays alive as a real, reactive component instance unless something
@@ -271,6 +264,33 @@ function render() {
   return mountTracked(OnCallResponses, { global: { plugins: [i18n, store], stubs } });
 }
 
+/// What a team answers by default: "answered, with nothing in it".
+const emptyTeam = { policy: { rungs: [] }, on_call: [], schedule: null };
+
+/// The team-context read answers `facts(id)` for each asked team, plus `mine` when `include_mine` is set; `undefined` is a team the server left out.
+function answerTeams(facts: (teamId: string) => object | undefined, mine: string[] = []) {
+  service.teamContext.mockImplementation((async ({ team_ids, include_mine }: any) => {
+    const ids = [...new Set([...team_ids, ...(include_mine ? mine : [])])];
+    const teams = ids.flatMap((id) => {
+      const answer = facts(id);
+      return answer ? [{ team_id: id, ...answer }] : [];
+    });
+    return { data: { teams } };
+  }) as any);
+}
+
+/// The batch ladder read answers `progress(id)` for each asked id; `undefined` is an id the server left out.
+function answerProgress(progress: (responseId: string) => object | undefined) {
+  service.escalationProgressBatch.mockImplementation((async ({ response_ids }: any) => ({
+    data: {
+      progress: response_ids.flatMap((id: string) => {
+        const answer = progress(id);
+        return answer ? [{ response_id: id, ...answer }] : [];
+      }),
+    },
+  })) as any);
+}
+
 describe("OnCallResponses", () => {
   beforeEach(() => {
     vi.clearAllMocks();
@@ -290,11 +310,8 @@ describe("OnCallResponses", () => {
     // The ladder, the policy behind its denominator, and the expanded row's
     // events. Every one of them degrades a single cell rather than the page,
     // so the default is "answered, with nothing in it".
-    service.getPolicy.mockResolvedValue({ data: { rungs: [] } } as any);
-    service.getSchedule.mockResolvedValue({ data: null } as any);
-    service.escalationProgress.mockResolvedValue({
-      data: { fired: [], next_targets: [], next_at: null, exhausted: false },
-    } as any);
+    answerTeams(() => emptyTeam);
+    answerProgress(() => ({ fired: [], next_targets: [], next_at: null, exhausted: false }));
     service.getResponse.mockResolvedValue({ data: { events: [] } } as any);
   });
 
@@ -469,10 +486,8 @@ describe("OnCallResponses", () => {
       service.listTeams.mock.calls.length +
       service.coverageGaps.mock.calls.length +
       service.listOwnershipRules.mock.calls.length +
-      service.getPolicy.mock.calls.length +
-      service.whoIsOnCall.mock.calls.length +
-      service.getSchedule.mock.calls.length +
-      service.escalationProgress.mock.calls.length;
+      service.teamContext.mock.calls.length +
+      service.escalationProgressBatch.mock.calls.length;
 
     const first = await withPages([page()]);
     const afterFirst = cachedCalls();
@@ -494,23 +509,17 @@ describe("OnCallResponses", () => {
     expect(service.listTeams).toHaveBeenCalledTimes(2);
   });
 
-  // Incident titles and the destination check are other modules' cache entries; only Refresh forces them.
-  it("serves incident titles and the destination check from the cache, and forces both on refresh", async () => {
-    incidents.get.mockResolvedValue({ data: { title: "Checkout down" } } as any);
-
-    const first = await withPages([page({ incident_id: "inc_1" })]);
-    expect(incidents.get).toHaveBeenCalledTimes(1);
+  // The destination check is another module's cache entry; only Refresh forces it.
+  it("serves the destination check from the cache, and forces it on refresh", async () => {
+    const first = await withPages([page()]);
     expect(destinations.list).toHaveBeenCalledTimes(1);
     first.unmount();
 
-    const second = await withPages([page({ incident_id: "inc_1" })]);
-    expect(incidents.get).toHaveBeenCalledTimes(1);
+    const second = await withPages([page()]);
     expect(destinations.list).toHaveBeenCalledTimes(1);
-    expect(second.text()).toContain("Checkout down");
 
     await second.find('[data-test="oncall-responses-refresh"]').trigger("click");
     await flushPromises();
-    expect(incidents.get).toHaveBeenCalledTimes(2);
     expect(destinations.list).toHaveBeenCalledTimes(2);
   });
 
@@ -552,15 +561,13 @@ describe("OnCallResponses", () => {
     });
 
     it("keeps an exhausted-ladder page in the ringing run until somebody claims it", async () => {
-      service.escalationProgress.mockResolvedValue({
-        data: {
-          fired: [{ after_micros: 0, at: 1, targets: [] }],
-          next_targets: [],
-          next_at: null,
-          exhausted: true,
-          stopped_because: "the ladder is exhausted — nobody acknowledged",
-        },
-      } as any);
+      answerProgress(() => ({
+        fired: [{ after_micros: 0, at: 1, targets: [] }],
+        next_targets: [],
+        next_at: null,
+        exhausted: true,
+        stopped_because: "the ladder is exhausted — nobody acknowledged",
+      }));
       const wrapper = await withPages([page({ id: "resp_1" })]);
 
       expect(sections(wrapper)).toEqual({ ringing: 1 });
@@ -574,9 +581,10 @@ describe("OnCallResponses", () => {
     /// ladder at all, so `exhausted` never even gets a chance to be true.
     /// Same fix has to cover this path too, or the bug just moves.
     it("keeps a zero-rung priority in the ringing run until somebody claims it", async () => {
-      service.getPolicy.mockResolvedValue({
-        data: { rungs: [{ priority: 1, steps: [], channels: [] }] },
-      } as any);
+      answerTeams(() => ({
+        ...emptyTeam,
+        policy: { rungs: [{ priority: 1, steps: [], channels: [] }] },
+      }));
       const wrapper = await withPages([page({ id: "resp_1" })]);
 
       expect(sections(wrapper)).toEqual({ ringing: 1 });
@@ -601,16 +609,13 @@ describe("OnCallResponses", () => {
 
     /// R11: a page whose ladder stopped has a team but pages nobody, so it is not counted as paging.
     it("does not count a page whose ladder stopped as still paging", async () => {
-      service.escalationProgress.mockImplementation((({ response_id }: { response_id: string }) =>
-        Promise.resolve({
-          data: {
-            fired: [{ after_micros: 0, at: 1, targets: [], reached: ["ana@o2.ai"] }],
-            next_targets: [],
-            next_at: null,
-            exhausted: false,
-            stopped_because: response_id === "b" ? "the owning team was deleted" : undefined,
-          },
-        })) as any);
+      answerProgress((id) => ({
+        fired: [{ after_micros: 0, at: 1, targets: [], reached: ["ana@o2.ai"] }],
+        next_targets: [],
+        next_at: null,
+        exhausted: false,
+        stopped_because: id === "b" ? "the owning team was deleted" : undefined,
+      }));
       const wrapper = await withPages([page({ id: "a" }), page({ id: "b" }, "al_pay")]);
 
       const text = wrapper.find(ringingHeader).text();
@@ -624,7 +629,7 @@ describe("OnCallResponses", () => {
 
     /// F4: a deleted team pages nobody, so a page past the progress cap is counted and phrased as such.
     it("counts and phrases a page whose team was deleted as not paged, without its progress", async () => {
-      service.escalationProgress.mockRejectedValue({ response: { status: 500, data: {} } });
+      service.escalationProgressBatch.mockRejectedValue({ response: { status: 500, data: {} } });
       const wrapper = await withPages([
         page({ id: "a" }),
         page({ id: "b", team_id: "team_gone" }, "al_pay"),
@@ -685,20 +690,19 @@ describe("OnCallResponses", () => {
   });
 
   describe("the escalation ladder", () => {
-    it("loads the ladder for open pages and passes it to the cell", async () => {
-      service.escalationProgress.mockResolvedValue({
-        data: {
-          fired: [{ after_micros: 0, at: 1, targets: ["the on-call"] }],
-          next_targets: ["the next on-call"],
-          next_at: (Date.now() + 60_000) * 1000,
-          exhausted: false,
-        },
-      } as any);
-      const wrapper = await withPages([page()]);
+    it("loads the ladder for open pages in one read and passes it to the cell", async () => {
+      answerProgress(() => ({
+        fired: [{ after_micros: 0, at: 1, targets: ["the on-call"] }],
+        next_targets: ["the next on-call"],
+        next_at: (Date.now() + 60_000) * 1000,
+        exhausted: false,
+      }));
+      const wrapper = await withPages([page(), page({ id: "resp_2" }, "al_pay")]);
 
-      expect(service.escalationProgress).toHaveBeenCalledWith({
+      expect(service.escalationProgressBatch).toHaveBeenCalledTimes(1);
+      expect(service.escalationProgressBatch).toHaveBeenCalledWith({
         org_identifier: "default",
-        response_id: "resp_1",
+        response_ids: ["resp_1", "resp_2"],
       });
       expect(wrapper.findComponent({ name: "OnCallEscalationCell" }).props("progress")).toEqual(
         expect.objectContaining({ next_targets: ["the next on-call"] }),
@@ -709,25 +713,28 @@ describe("OnCallResponses", () => {
     /// request per row spent on an answer nobody reads.
     it("does not ask for the ladder of a page that is already closed", async () => {
       await withPages([page({ state: "resolved", closed_at: Date.now() * 1000 })]);
-      expect(service.escalationProgress).not.toHaveBeenCalled();
+      expect(service.escalationProgressBatch).not.toHaveBeenCalled();
     });
 
-    /// One request per page and no bulk endpoint: past the cap the list says so
-    /// rather than leaving a blank cell that reads as "nothing has fired".
+    /// Past the route's cap the list says so rather than leaving a blank cell that reads as "nothing has fired".
     it("caps how many ladders it loads, and says that it did", async () => {
-      const many = Array.from({ length: 30 }, (_, i) =>
+      const many = Array.from({ length: 205 }, (_, i) =>
         page({ id: `resp_${i}`, opened_at: 1_700_000_000_000_000 + i }, `al_${i}`),
       );
       const wrapper = await withPages(many);
 
-      expect(service.escalationProgress).toHaveBeenCalledTimes(25);
+      expect(service.escalationProgressBatch).toHaveBeenCalledTimes(1);
+      const asked = service.escalationProgressBatch.mock.calls[0][0].response_ids;
+      expect(asked).toHaveLength(200);
+      expect(asked).not.toContain("resp_200");
       expect(wrapper.find('[data-test="oncall-escalation-capped"]').exists()).toBe(true);
     });
 
-    /// Rows past the cap have no progress: the record's own step, or no claim, never "Not paged yet".
-    it("says what it can for rows past the cap, without claiming they were not paged", async () => {
-      service.getPolicy.mockResolvedValue({
-        data: {
+    /// Rows the server left out have no progress: the record's own step, or no claim, never "Not paged yet".
+    it("says what it can for rows without an answer, without claiming they were not paged", async () => {
+      answerTeams(() => ({
+        ...emptyTeam,
+        policy: {
           rungs: [
             {
               priority: 1,
@@ -740,48 +747,51 @@ describe("OnCallResponses", () => {
             },
           ],
         },
-      } as any);
-      const many = Array.from({ length: 30 }, (_, i) =>
-        page(
-          {
-            id: `resp_${i}`,
-            opened_at: 1_700_000_000_000_000 + i,
-            ...(i === 29 ? { reached_rung_micros: 300_000_000 } : {}),
-          },
-          `al_${i}`,
-        ),
+      }));
+      answerProgress((id) =>
+        id === "resp_0"
+          ? { fired: [], next_targets: [], next_at: null, exhausted: false }
+          : undefined,
       );
-      const wrapper = await withPages(many);
+      const wrapper = await withPages([
+        page({ id: "resp_0", opened_at: 1_700_000_000_000_000 }, "al_0"),
+        page({ id: "resp_1", opened_at: 1_700_000_000_000_001 }, "al_1"),
+        page(
+          { id: "resp_2", opened_at: 1_700_000_000_000_002, reached_rung_micros: 300_000_000 },
+          "al_2",
+        ),
+      ]);
       const cell = (id: string) =>
         wrapper.find(`[data-test="oncall-escalation-cell-${id}"]`).text();
 
       expect(cell("resp_0")).toBe("Not paged yet");
-      expect(cell("resp_29")).toBe("Paging step 2 of 3");
-      expect(cell("resp_28")).toBe("");
+      expect(cell("resp_2")).toBe("Paging step 2 of 3");
+      expect(cell("resp_1")).toBe("");
 
       const table = wrapper.findComponent({ name: "OTable" });
       const escalation = (table.props("columns") as any[]).find((c) => c.id === "escalation");
       const rowFor = (id: string) => (table.props("data") as any[]).find((r) => r.latest.id === id);
-      expect(escalation.accessorFn(rowFor("resp_29"))).toBe(2);
+      expect(escalation.accessorFn(rowFor("resp_2"))).toBe(2);
     });
 
-    /// An empty 200 body is not an answer: the row makes no claim rather than "Not paged yet".
-    it("makes no claim for a row whose progress came back empty", async () => {
-      service.escalationProgress.mockResolvedValue({ data: null } as any);
+    /// A failed ladder read is not an answer: the row makes no claim rather than "Not paged yet".
+    it("makes no claim for a row when the ladder read fails", async () => {
+      service.escalationProgressBatch.mockRejectedValue(new Error("down"));
       const wrapper = await withPages([page()]);
 
       expect(wrapper.find('[data-test="oncall-escalation-cell-resp_1"]').text()).toBe("");
     });
 
     it("takes the rung total for the row's priority from the team's policy", async () => {
-      service.getPolicy.mockResolvedValue({
-        data: {
+      answerTeams(() => ({
+        ...emptyTeam,
+        policy: {
           rungs: [
             { priority: 1, steps: [{}, {}, {}], channels: [] },
             { priority: 2, steps: [{}], channels: [] },
           ],
         },
-      } as any);
+      }));
       const wrapper = await withPages([page({ priority: 1 })]);
 
       expect(wrapper.findComponent({ name: "OnCallEscalationCell" }).props("totalRungs")).toBe(3);
@@ -899,9 +909,10 @@ describe("OnCallResponses", () => {
 
     /// The channels shown are the policy's — what WOULD be used, not what happened.
     it("shows the channels the page would go out on", async () => {
-      service.getPolicy.mockResolvedValue({
-        data: { rungs: [{ priority: 1, steps: [{}, {}], channels: ["email", "webhook"] }] },
-      } as any);
+      answerTeams(() => ({
+        ...emptyTeam,
+        policy: { rungs: [{ priority: 1, steps: [{}, {}], channels: ["email", "webhook"] }] },
+      }));
       const wrapper = await withPages([page({ priority: 1 })]);
 
       expect(wrapper.find('[data-test$="-email"]').exists()).toBe(true);
@@ -1291,13 +1302,11 @@ describe("OnCallResponses", () => {
 
   /// One signal: the ladder's own progress, which the "nobody answered" tag and the ladder text both read.
   it("tags nobody answered from the ladder's progress, before the record's flag lands", async () => {
-    service.escalationProgress.mockImplementation(async ({ response_id }: any) => ({
-      data: {
-        fired: [{ after_micros: 0, at: 1, targets: [], reached: ["ana@o2.ai"] }],
-        next_targets: [],
-        next_at: null,
-        exhausted: response_id === "resp_done",
-      },
+    answerProgress((id) => ({
+      fired: [{ after_micros: 0, at: 1, targets: [], reached: ["ana@o2.ai"] }],
+      next_targets: [],
+      next_at: null,
+      exhausted: id === "resp_done",
     }));
     const wrapper = await withPages([
       page({ id: "resp_done", exhausted_at: null }, "al_done"),
@@ -1425,12 +1434,10 @@ describe("OnCallResponses", () => {
     const mineBtn = '[data-test="oncall-responses-mine-btn"]';
 
     async function withMyShift(rows: Record<string, unknown>[]) {
-      service.whoIsOnCall.mockImplementation(({ team_id }: any) =>
-        Promise.resolve({
-          data:
-            team_id === "team_1" ? [{ rotation: "Primary", user_email: "example@gmail.com" }] : [],
-        } as any),
-      );
+      answerTeams((id) => ({
+        ...emptyTeam,
+        on_call: id === "team_1" ? [{ rotation: "Primary", user_email: "example@gmail.com" }] : [],
+      }));
       return withPages(rows);
     }
 
@@ -1570,46 +1577,52 @@ describe("OnCallResponses", () => {
         shift_micros,
         anchor_micros: 0,
       });
-      service.getSchedule.mockResolvedValue({
-        data: {
-          id: "sch_1",
-          org_id: "default",
-          team_id: "team_1",
-          timezone: "UTC",
-          created_at: 0,
-          updated_at: 0,
-          rotations: [
-            {
-              id: "rot_weekly",
-              name: "Primary",
-              shift_rules: [rule(["ana@o2.ai"], 604_800_000_000)],
-            },
-            {
-              id: "rot_hourly",
-              name: "Secondary",
-              shift_rules: [rule(["example@gmail.com"], 3_600_000_000)],
-            },
-          ],
-        },
-      } as any);
-      service.whoIsOnCall.mockResolvedValue({
-        data: [
-          {
-            rotation_id: "rot_weekly",
-            rotation_name: "Primary",
-            rule: "Base",
-            user_email: "ana@o2.ai",
-          },
-          {
-            rotation_id: "rot_hourly",
-            rotation_name: "Secondary",
-            rule: "Base",
-            user_email: "example@gmail.com",
-          },
-        ],
-      } as any);
+      // The viewer's team has no row on screen: only `include_mine` brings it into the answer.
+      answerTeams(
+        (id) =>
+          id === "team_1"
+            ? {
+                ...emptyTeam,
+                schedule: {
+                  id: "sch_1",
+                  org_id: "default",
+                  team_id: "team_1",
+                  timezone: "UTC",
+                  created_at: 0,
+                  updated_at: 0,
+                  rotations: [
+                    {
+                      id: "rot_weekly",
+                      name: "Primary",
+                      shift_rules: [rule(["ana@o2.ai"], 604_800_000_000)],
+                    },
+                    {
+                      id: "rot_hourly",
+                      name: "Secondary",
+                      shift_rules: [rule(["example@gmail.com"], 3_600_000_000)],
+                    },
+                  ],
+                },
+                on_call: [
+                  {
+                    rotation_id: "rot_weekly",
+                    rotation_name: "Primary",
+                    rule: "Base",
+                    user_email: "ana@o2.ai",
+                  },
+                  {
+                    rotation_id: "rot_hourly",
+                    rotation_name: "Secondary",
+                    rule: "Base",
+                    user_email: "example@gmail.com",
+                  },
+                ],
+              }
+            : emptyTeam,
+        ["team_1"],
+      );
       try {
-        const wrapper = await withPages([page()]);
+        const wrapper = await withPages([page({ team_id: "team_other" })]);
 
         const banner = wrapper.findComponent({ name: "OnCallShiftBanner" });
         expect(banner.props("rotation")).toBe("Secondary");
@@ -1621,6 +1634,120 @@ describe("OnCallResponses", () => {
     });
   });
 
+  describe("request fan-out", () => {
+    const position = (email: string) => ({
+      rotation_id: "r",
+      rotation_name: "Primary",
+      rule: "Base",
+      user_email: email,
+    });
+    const shownOnCall = (wrapper: VueWrapper) =>
+      wrapper.findAllComponents({ name: "OUserCell" }).map((c) => c.props("value"));
+    const pickTeam = (wrapper: VueWrapper, teamId: string) =>
+      wrapper
+        .findAllComponents({ name: "OSelect" })
+        .find((node) => node.attributes("data-test") === "oncall-responses-team-filter")!
+        .vm.$emit("update:modelValue", teamId);
+
+    it("names an incident from the row's title, and the id when the row has none", async () => {
+      const wrapper = await withPages([
+        page({ id: "a", incident_id: "inc_1", incident_title: "Checkout down" }),
+        page({ id: "b", incident_id: "inc_2" }, "al_b"),
+      ]);
+
+      const chips = wrapper.findAll('[data-test^="oncall-row-incident-"]').map((c) => c.text());
+      expect(chips.sort()).toEqual(["Checkout down", "inc_2"]);
+    });
+
+    it("reads every team's context in one request, for the row teams and the viewer's", async () => {
+      service.listTeams.mockResolvedValue({
+        data: [team, { ...team, id: "team_2", name: "Payments" }],
+      } as any);
+      service.listResponses.mockResolvedValue({
+        data: [page(), page({ id: "b", team_id: "team_2" }, "al_b"), page({ id: "c" }, "al_c")],
+      } as any);
+      render();
+      await flushPromises();
+
+      expect(service.teamContext).toHaveBeenCalledTimes(1);
+      expect(service.teamContext).toHaveBeenCalledWith({
+        org_identifier: "default",
+        team_ids: ["team_1", "team_2"],
+        include_mine: true,
+      });
+      expect(service.whoIsOnCall).not.toHaveBeenCalled();
+    });
+
+    it("splits row teams past the route's cap across context reads, asking for the viewer's once", async () => {
+      answerTeams((id) => ({ ...emptyTeam, on_call: [position(`${id}@o2.ai`)] }));
+      const many = Array.from({ length: 205 }, (_, i) =>
+        page({ id: `resp_${i}`, team_id: `team_${i}` }, `al_${i}`),
+      );
+      const wrapper = await withPages(many);
+
+      const calls = service.teamContext.mock.calls.map(([args]: any) => args);
+      expect(calls.map((c: any) => [c.team_ids.length, c.include_mine])).toEqual([
+        [200, true],
+        [5, false],
+      ]);
+      expect(shownOnCall(wrapper)).toContain("team_204@o2.ai");
+    });
+
+    it("shows the on-call cell from the context answer", async () => {
+      answerTeams(() => ({ ...emptyTeam, on_call: [position("ana@o2.ai")] }));
+      const wrapper = await withPages([page()]);
+
+      expect(shownOnCall(wrapper)).toEqual(["ana@o2.ai"]);
+    });
+
+    it("forces the context and ladder reads on refresh", async () => {
+      const wrapper = await withPages([page()]);
+      expect(service.teamContext).toHaveBeenCalledTimes(1);
+      expect(service.escalationProgressBatch).toHaveBeenCalledTimes(1);
+
+      await wrapper.find('[data-test="oncall-responses-refresh"]').trigger("click");
+      await flushPromises();
+
+      expect(service.teamContext).toHaveBeenCalledTimes(2);
+      expect(service.escalationProgressBatch).toHaveBeenCalledTimes(2);
+    });
+
+    it("sends the context and ladder reads together, without waiting for the teams list", async () => {
+      service.listTeams.mockReturnValue(new Promise(() => {}) as any);
+      service.listResponses.mockResolvedValue({ data: [page()] } as any);
+      render();
+      await flushPromises();
+
+      expect(service.teamContext).toHaveBeenCalledTimes(1);
+      expect(service.escalationProgressBatch).toHaveBeenCalledTimes(1);
+    });
+
+    it("keeps the newer context read when an older one answers last", async () => {
+      let answerOld!: (value: unknown) => void;
+      service.teamContext.mockImplementation((({ team_ids }: { team_ids: string[] }) =>
+        team_ids.includes("team_1")
+          ? new Promise((resolve) => (answerOld = resolve))
+          : Promise.resolve({
+              data: {
+                teams: [{ team_id: "team_new", ...emptyTeam, on_call: [position("new@o2.ai")] }],
+              },
+            })) as any);
+      const wrapper = await withPages([page()]);
+      service.listResponses.mockResolvedValue({
+        data: [page({ id: "n", team_id: "team_new" }, "al_new")],
+      } as any);
+      pickTeam(wrapper, "team_new");
+      await flushPromises();
+
+      answerOld({
+        data: { teams: [{ team_id: "team_new", ...emptyTeam, on_call: [position("old@o2.ai")] }] },
+      });
+      await flushPromises();
+
+      expect(shownOnCall(wrapper)).toEqual(["new@o2.ai"]);
+    });
+  });
+
   /// During an incident the list IS the work surface. Opening 200 pages one at
   /// a time to claim them is not triage.
   describe("acting from the list", () => {
@@ -2015,11 +2142,8 @@ describe("OnCallResponses — the rows' own fields", () => {
     service.whoIsOnCall.mockResolvedValue({ data: [] } as any);
     service.listOwnershipRules.mockResolvedValue({ data: [{ id: "rule_1" }] } as any);
     destinations.list.mockResolvedValue({ data: [{ name: "dest_1" }] } as any);
-    service.getPolicy.mockResolvedValue({ data: { rungs: [] } } as any);
-    service.getSchedule.mockResolvedValue({ data: null } as any);
-    service.escalationProgress.mockResolvedValue({
-      data: { fired: [], next_targets: [], next_at: null, exhausted: false },
-    } as any);
+    answerTeams(() => emptyTeam);
+    answerProgress(() => ({ fired: [], next_targets: [], next_at: null, exhausted: false }));
     service.getResponse.mockResolvedValue({ data: { events: [] } } as any);
   });
 
@@ -2199,11 +2323,8 @@ describe("OnCallResponses — filtering by cause", () => {
     service.whoIsOnCall.mockResolvedValue({ data: [] } as any);
     service.listOwnershipRules.mockResolvedValue({ data: [{ id: "rule_1" }] } as any);
     destinations.list.mockResolvedValue({ data: [{ name: "dest_1" }] } as any);
-    service.getPolicy.mockResolvedValue({ data: { rungs: [] } } as any);
-    service.getSchedule.mockResolvedValue({ data: null } as any);
-    service.escalationProgress.mockResolvedValue({
-      data: { fired: [], next_targets: [], next_at: null, exhausted: false },
-    } as any);
+    answerTeams(() => emptyTeam);
+    answerProgress(() => ({ fired: [], next_targets: [], next_at: null, exhausted: false }));
     service.getResponse.mockResolvedValue({ data: { events: [] } } as any);
   });
 
diff --git a/web/src/views/OnCall/OnCallResponses.vue b/web/src/views/OnCall/OnCallResponses.vue
index 19a7a2b000..893d4299f9 100644
--- a/web/src/views/OnCall/OnCallResponses.vue
+++ b/web/src/views/OnCall/OnCallResponses.vue
@@ -109,6 +109,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :loading="loading || !setupLoaded"
       :streaming="backgroundLoading"
       :error="loadError"
+      :forbidden="forbidden"
       pagination="client"
       :page-size="pageSize"
       :current-page="currentPage"
@@ -479,7 +480,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           @click.stop
         >
           <OTruncatedText class="block">{{
-            raw(incidentTitleById[row.latest.incident_id] ?? row.latest.incident_id)
+            raw(row.latest.incident_title ?? row.latest.incident_id)
           }}</OTruncatedText>
         </router-link>
       </template>
@@ -981,12 +982,11 @@ import {
   ownershipRulesQuery,
   pagedResponsesQuery,
   resolveResponseMutation,
-  responseProgressQuery,
   responseQuery,
+  responsesProgressQuery,
   snoozeResponseMutation,
   unsnoozeResponseMutation,
-  teamPolicyQuery,
-  teamScheduleQuery,
+  teamContextQuery,
   whoIsOnCallQuery,
 } from "@/services/oncall.queries";
 
@@ -999,12 +999,11 @@ import { toast } from "@/lib/feedback/Toast/useToast";
 import analytics from "@/services/product_analytics";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { destinationsQuery } from "@/services/alert_destination.queries";
-import type { IncidentWithAlerts } from "@/services/incidents";
-import { incidentQuery } from "@/services/incidents.queries";
 import type {
   Channel,
   CoverageGaps,
   EscalationProgress,
+  EscalationProgressEntry,
   OnCallPolicy,
   OnCallResponse,
   OnCallResponseEvent,
@@ -1012,6 +1011,7 @@ import type {
   OnCallSchedule,
   OnCallPosition,
   OnCallTeam,
+  OnCallTeamContext,
   OwnershipRule,
   ResolutionCause,
 } from "@/ts/interfaces/oncall";
@@ -1033,6 +1033,7 @@ import {
   nextHandover,
   winningRule,
 } from "@/utils/oncall";
+import { licenseDeniedFeatures, type ForbiddenState } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
 const { isMobile } = useBreakpoint();
@@ -1045,16 +1046,8 @@ const { canConfigure } = useOnCallPermissions();
 /// columns and the actions never have to branch on the mode.
 type PageRow = OnCallResponseGroup & { rowKey: string };
 
-/**
- * How many open pages get their escalation ladder loaded.
- *
- * There is no bulk escalation endpoint, so this costs one request per page, on
- * every poll. Twenty-five covers the top of a triage list without turning a
- * 200-row incident into 200 requests every twenty seconds; the rows past it
- * still show their state, and the list says so rather than leaving a blank cell
- * that would read as "nothing has fired".
- */
-const ESCALATION_DETAIL_LIMIT = 25;
+/** The batch routes' cap on ids per request; rows past it on the ladder read are flagged, not left blank. */
+const ESCALATION_DETAIL_LIMIT = 200;
 
 /**
  * The states a reader triages by, in the order they matter.
@@ -1105,6 +1098,7 @@ const lastUpdatedAt = ref<number | null>(null);
 /// for a fetch nothing visible was waiting on.
 const backgroundLoading = ref(false);
 const loadError = ref<string | null>(null);
+const forbidden = ref<ForbiddenState>(false);
 /// §G.8.1: 404 or 403 "Not Supported" from the entry fetch — on-call is not
 /// available on this deployment. A fact about the build, never an error.
 const unavailable = ref(false);
@@ -1188,12 +1182,6 @@ const teamNameById = computed<Record<string, string>>(() =>
 const teamIsDeleted = (teamId: string | null) =>
   isDeletedTeam(teamId, teamsLoaded.value ? teams.value.map((team) => team.id) : null);
 
-// A ksuid asks the reader to look it up somewhere else, same as team_id
-// (`fetchTeamContext` below). There is no bulk "get these incidents" endpoint,
-// so this fills in one id at a time and the chip falls back to the raw id
-// until its title lands.
-const incidentTitleById = ref<Record<string, string>>({});
-
 const teamOptions = computed(() => [
   { label: t("oncall.allTeams"), value: "all" },
   ...teams.value.map((team) => ({ label: raw(team.name), value: team.id })),
@@ -1305,9 +1293,7 @@ const columns = computed<OTableColumnDef<PageRow>[]>(() => [
     header: t("oncall.incident"),
     size: 160,
     accessorFn: (row: PageRow) =>
-      row.latest.incident_id
-        ? (incidentTitleById.value[row.latest.incident_id] ?? row.latest.incident_id)
-        : "",
+      row.latest.incident_id ? (row.latest.incident_title ?? row.latest.incident_id) : "",
     sortable: true,
     hideable: true,
   },
@@ -1951,13 +1937,13 @@ async function fetchResponses(opts: { background?: boolean; force?: boolean } =
     // From the payload, cache hit included: the cap describes these rows, not this request.
     truncated.value = walk.truncated;
     loadError.value = null;
+    forbidden.value = false;
     // Only on SUCCESS. Setting this in `finally` would let a transient API
     // error render the first-run checklist, telling a configured org that
     // nothing is set up.
     loaded.value = true;
-    // Fire-and-forget: the list is already usable with ids as the fallback,
-    // so titles fill in behind it rather than holding up the table.
-    void fetchIncidentTitles(!!opts.force);
+    // Fire-and-forget: the rows are already usable while their teams and ladders fill in.
+    void fetchRowContext(!!opts.force);
   } catch (err) {
     if (readId !== latestResponsesRead) return;
     // §G.8.1: the probe said "not here". Leaving `loaded` false keeps the
@@ -1967,38 +1953,18 @@ async function fetchResponses(opts: { background?: boolean; force?: boolean } =
       unavailable.value = true;
       return;
     }
+    // A license denial is not a failed read: the table shows the license copy, with no retry.
+    const denied = licenseDeniedFeatures(err);
+    if (denied) {
+      forbidden.value = denied;
+      return;
+    }
     loadError.value = errorMessage(err) || String(t("oncall.loadResponsesFailed"));
   } finally {
     if (readId === latestResponsesRead) busy.value = false;
   }
 }
 
-/// One request per incident id — there is no bulk "get these incidents"
-/// endpoint (see `fetchTeamContext` for the same constraint on team data).
-/// Already-resolved ids are skipped so a background fetch doesn't re-read
-/// titles the list already has; only the reader's Refresh re-reads them all.
-async function fetchIncidentTitles(force = false) {
-  const ids = [
-    ...new Set(
-      responses.value
-        .map((response) => response.incident_id)
-        .filter((id): id is string => !!id && (force || !(id in incidentTitleById.value))),
-    ),
-  ];
-  if (!ids.length) return;
-  const results = await Promise.allSettled(
-    ids.map((id) => read<IncidentWithAlerts>(incidentQuery(orgId.value, id), force)),
-  );
-  const next = { ...incidentTitleById.value };
-  ids.forEach((id, index) => {
-    const result = results[index];
-    if (result.status === "fulfilled" && result.value?.title) {
-      next[id] = result.value.title;
-    }
-  });
-  incidentTitleById.value = next;
-}
-
 /// Teams, coverage and ownership answer the checklist, not the list. A failure
 /// on any one of them degrades a single control rather than the page.
 async function fetchContext(force = false) {
@@ -2048,73 +2014,63 @@ async function someTeamWouldPage(
   return slots.some((s) => s.status === "fulfilled" && s.value.length > 0);
 }
 
-/// Policy and rotation per team. Both are one request per team — there is no
-/// bulk endpoint for either — but team counts are small and the answers change
-/// far more slowly than the pages do.
-async function fetchTeamContext(force = false) {
-  const ids = teams.value.map((team) => team.id);
-  const [policies, slots, schedules] = await Promise.all([
-    Promise.allSettled(
-      ids.map((id) => read<OnCallPolicy | null>(teamPolicyQuery(orgId.value, id), force)),
-    ),
-    Promise.allSettled(
-      ids.map((id) => read<OnCallPosition[]>(whoIsOnCallQuery(orgId.value, id), force)),
-    ),
-    Promise.allSettled(
-      ids.map((id) => read<OnCallSchedule | null>(teamScheduleQuery(orgId.value, id), force)),
-    ),
-  ]);
+// The newest row-context read: one started for rows a filter has since replaced must not overwrite the maps.
+let latestRowContextRead = 0;
 
-  const nextPolicies: Record<string, OnCallPolicy> = {};
-  const nextSlots: Record<string, OnCallPosition[]> = {};
-  const nextSchedules: Record<string, OnCallSchedule> = {};
-  ids.forEach((id, index) => {
-    const policy = policies[index];
-    if (policy.status === "fulfilled" && policy.value) nextPolicies[id] = policy.value;
-    const slot = slots[index];
-    // A team whose rotation could not be read is left OUT rather than recorded
-    // as empty: an unreadable schedule is not the same fact as a coverage gap,
-    // and the card would otherwise accuse a staffed team of having none.
-    if (slot.status === "fulfilled") nextSlots[id] = slot.value;
-    const schedule = schedules[index];
-    if (schedule.status === "fulfilled" && schedule.value) {
-      nextSchedules[id] = schedule.value;
-    }
-  });
-  policyByTeam.value = nextPolicies;
-  positionsByTeam.value = nextSlots;
-  scheduleByTeam.value = nextSchedules;
-}
-
-/// Ladder position for the oldest open pages. Bounded by
-/// ESCALATION_DETAIL_LIMIT because each one is its own request.
-async function fetchEscalationProgress(force = false) {
+/// Team context for the row teams and the viewer's, and the ladder of the oldest open pages: one request each, sent together.
+async function fetchRowContext(force = false) {
+  const readId = ++latestRowContextRead;
+  const teamIds = [
+    ...new Set(responses.value.map((r) => r.team_id).filter((id): id is string => !!id)),
+  ];
   const open = responses.value
     .filter((r) => isEscalating(r.state))
     .sort((a, b) => a.opened_at - b.opened_at);
-
+  const wanted = open.slice(0, ESCALATION_DETAIL_LIMIT).map((r) => r.id);
+  const teamChunks: string[][] = [];
+  for (let i = 0; i < teamIds.length; i += ESCALATION_DETAIL_LIMIT) {
+    teamChunks.push(teamIds.slice(i, i + ESCALATION_DETAIL_LIMIT));
+  }
+  if (!teamChunks.length) teamChunks.push([]);
+  const [context, progress] = await Promise.allSettled([
+    Promise.allSettled(
+      teamChunks.map((ids, i) =>
+        read<OnCallTeamContext[]>(teamContextQuery(orgId.value, ids, i === 0), force),
+      ),
+    ).then((reads) => reads.flatMap((r) => (r.status === "fulfilled" ? r.value : []))),
+    wanted.length
+      ? read<EscalationProgressEntry[]>(responsesProgressQuery(orgId.value, wanted), force)
+      : Promise.resolve([]),
+  ]);
+  if (readId !== latestRowContextRead) return;
+  applyTeamContext(context.status === "fulfilled" ? context.value : []);
   escalationCapped.value = open.length > ESCALATION_DETAIL_LIMIT;
-  const wanted = open.slice(0, ESCALATION_DETAIL_LIMIT);
+  applyProgress(progress.status === "fulfilled" ? progress.value : []);
+}
 
-  const results = await Promise.allSettled(
-    wanted.map((r) =>
-      read<EscalationProgress | null>(responseProgressQuery(orgId.value, r.id), force),
-    ),
-  );
+/// Replaced wholesale, so a team no longer on screen drops out of the maps.
+function applyTeamContext(context: OnCallTeamContext[]) {
+  const policies: Record<string, OnCallPolicy> = {};
+  const slots: Record<string, OnCallPosition[]> = {};
+  const schedules: Record<string, OnCallSchedule> = {};
+  for (const team of context) {
+    if (team.policy) policies[team.team_id] = team.policy;
+    // An unreadable rotation is left OUT, not empty: it is not the same fact as a coverage gap.
+    if (team.on_call) slots[team.team_id] = team.on_call;
+    if (team.schedule) schedules[team.team_id] = team.schedule;
+  }
+  policyByTeam.value = policies;
+  positionsByTeam.value = slots;
+  scheduleByTeam.value = schedules;
+}
 
+/// Replaced wholesale, so a record that resolved since the last read drops a countdown that will never fire.
+function applyProgress(entries: EscalationProgressEntry[]) {
   const next: Record<string, EscalationProgress> = {};
-  const answered = new Set<string>();
-  wanted.forEach((record, index) => {
-    const result = results[index];
-    // An empty body is no answer, so the row stays unknown rather than reading "Not paged yet".
-    if (result.status !== "fulfilled" || !result.value) return;
-    answered.add(record.id);
-    next[record.id] = result.value;
-  });
-  // Replaced wholesale so a record that resolved since the last poll drops its
-  // stale ladder instead of keeping a countdown that will never fire.
+  for (const { response_id, ...progress } of entries) next[response_id] = progress;
   progressById.value = next;
-  progressAnswered.value = answered;
+  // Only the ids the server answered, so an unread row never reads "Not paged yet".
+  progressAnswered.value = new Set(Object.keys(next));
 }
 
 /// The expanded row's timeline.
@@ -2160,9 +2116,8 @@ async function loadAll(force = false) {
   // The probe answered "not here" — every further call would 404/403 the
   // same way, so stop asking.
   if (unavailable.value) return;
+  // Team and ladder reads were started by fetchResponses.
   await fetchContext(force);
-  await fetchTeamContext(force);
-  await fetchEscalationProgress(force);
   // The open timeline is part of what the reader sees, so a refresh reaches it too.
   const open = expandedResponseId();
   if (open) await fetchExpandedEvents(open, force);
diff --git a/web/src/views/OnCall/OnCallRouting.spec.ts b/web/src/views/OnCall/OnCallRouting.spec.ts
index d759ef085c..133bd04952 100644
--- a/web/src/views/OnCall/OnCallRouting.spec.ts
+++ b/web/src/views/OnCall/OnCallRouting.spec.ts
@@ -488,6 +488,43 @@ describe("OnCallRouting", () => {
     expect(wrapper.find('[data-test="oncall-routing-content"]').exists()).toBe(true);
   });
 
+  it("shows the license empty state, not an error with the server text, for a license denial", async () => {
+    service.listTeams.mockRejectedValueOnce({
+      response: {
+        status: 403,
+        data: { code: 40001, message: "Features not included", error_detail: "oncall" },
+      },
+    });
+    const wrapper = render();
+    await flushPromises();
+    expect(wrapper.find('[data-test="oncall-routing-license-denied"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="oncall-routing-error"]').exists()).toBe(false);
+  });
+
+  it("skips the correlation reads while correlation is license-locked", async () => {
+    queryClient.clear();
+    store.state.zoConfig.features = { correlation: "locked" };
+    try {
+      const wrapper = render();
+      await flushPromises();
+      expect(wrapper.find('[data-test="oncall-routing-content"]').exists()).toBe(true);
+      expect(correlation.getServicesList).not.toHaveBeenCalled();
+      expect(correlation.getIdentityConfig).not.toHaveBeenCalled();
+      expect(correlation.getDimensionAnalytics).not.toHaveBeenCalled();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("reads the correlation catalogue while correlation is enabled", async () => {
+    queryClient.clear();
+    render();
+    await flushPromises();
+    expect(correlation.getServicesList).toHaveBeenCalled();
+    expect(correlation.getIdentityConfig).toHaveBeenCalled();
+    expect(correlation.getDimensionAnalytics).toHaveBeenCalled();
+  });
+
   /// A revisit pays for none of the three org reads; only the reader's Retry reaches the server.
   it("serves a revisit from the cache and forces on retry", async () => {
     service.ownershipStats.mockRejectedValueOnce(new Error("boom"));
diff --git a/web/src/views/OnCall/OnCallRouting.vue b/web/src/views/OnCall/OnCallRouting.vue
index be51dd4dd8..a43de3def9 100644
--- a/web/src/views/OnCall/OnCallRouting.vue
+++ b/web/src/views/OnCall/OnCallRouting.vue
@@ -89,6 +89,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       data-test="oncall-routing-unavailable"
     />
 
+    <LicenseDeniedState
+      v-else-if="licenseDenied"
+      :features="licenseDenied"
+      data-test="oncall-routing-license-denied"
+    />
+
     <!-- A transient 500 is not "this org has no rules" — say it failed and
          offer the way back. -->
     <OEmptyState
@@ -331,11 +337,15 @@ import type {
 } from "@/ts/interfaces/oncall";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { identityDimensions, isOnCallUnavailable } from "@/utils/oncall";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
 const { isMobile } = useBreakpoint();
 const store = useStore();
 const router = useRouter();
+const { locked: correlationLocked } = useLicenseLock("correlation");
 
 const orgId = computed(() => store.state.selectedOrganization.identifier);
 
@@ -356,6 +366,7 @@ const ladder = ref<TeamRungSummary[]>([]);
 
 const loaded = ref(false);
 const loadError = ref("");
+const licenseDenied = ref<string[] | null>(null);
 const unavailable = ref(false);
 const signalsError = ref(false);
 // True from mount, not false: the content div renders before `fetchAll`'s
@@ -499,6 +510,7 @@ async function read<T>(
 /// The vocabulary and the queue degrade section-by-section instead.
 async function fetchAll(force = false) {
   loadError.value = "";
+  licenseDenied.value = null;
   try {
     teams.value = await read<OnCallTeam[]>(oncallTeamsQuery(orgId.value), force);
   } catch (err) {
@@ -507,7 +519,8 @@ async function fetchAll(force = false) {
       unavailable.value = true;
       return;
     }
-    loadError.value = errorText(err);
+    licenseDenied.value = licenseDeniedFeatures(err);
+    if (!licenseDenied.value) loadError.value = errorText(err);
     loaded.value = true;
     return;
   }
@@ -521,9 +534,10 @@ async function fetchAll(force = false) {
     fetchRules(force),
     fetchSignals(force),
     fetchAliases(force),
-    fetchCatalogue(force),
-    fetchServices(force),
-    fetchSets(force),
+    // The rule editor's discovered services and dimensions come from the correlation API.
+    ...(correlationLocked.value
+      ? []
+      : [fetchCatalogue(force), fetchServices(force), fetchSets(force)]),
   ]);
   // The oldest of the backbone reads, so the age never claims the page is fresher than it is.
   lastFetchedAt.value = Math.min(
diff --git a/web/src/views/OnCall/OnCallTeams.spec.ts b/web/src/views/OnCall/OnCallTeams.spec.ts
index 0413f6a7a1..ad8c23a4ca 100644
--- a/web/src/views/OnCall/OnCallTeams.spec.ts
+++ b/web/src/views/OnCall/OnCallTeams.spec.ts
@@ -73,7 +73,16 @@ const stubs = {
   // draws rather than a column-def function OTable never calls.
   OTable: {
     name: "OTable",
-    props: ["data", "columns", "error", "currentPage", "pageSize", "sortBy", "sortOrder"],
+    props: [
+      "data",
+      "columns",
+      "error",
+      "forbidden",
+      "currentPage",
+      "pageSize",
+      "sortBy",
+      "sortOrder",
+    ],
     emits: ["update:currentPage", "update:pageSize", "update:sortBy", "update:sortOrder"],
     template: `<div>
       <slot name='toolbar' />
@@ -595,6 +604,18 @@ describe("OnCallTeams", () => {
     expect(wrapper.find('[data-test="oncall-teams-error"]').exists()).toBe(false);
   });
 
+  it("shows a license denial as the license state, not an error with retry", async () => {
+    service.listTeams.mockRejectedValueOnce({
+      response: { status: 403, data: { code: 40001, error_detail: "oncall", message: "denied" } },
+    });
+    const wrapper = render();
+    await flushPromises();
+
+    const table = wrapper.findComponent({ name: "OTable" });
+    expect(table.props("forbidden")).toEqual(["oncall"]);
+    expect(wrapper.find('[data-test="oncall-teams-error"]').exists()).toBe(false);
+  });
+
   /// B8. A toast evaporates; what stayed on screen was "no teams" — the exact
   /// look of an unconfigured org, on a failed read.
   it("renders a failed load as an error with retry, never as an empty org", async () => {
diff --git a/web/src/views/OnCall/OnCallTeams.vue b/web/src/views/OnCall/OnCallTeams.vue
index 8e25787f1d..d3eb881dcf 100644
--- a/web/src/views/OnCall/OnCallTeams.vue
+++ b/web/src/views/OnCall/OnCallTeams.vue
@@ -37,6 +37,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <OTable
       ref="oTableRef"
       :error="loadError"
+      :forbidden="forbidden"
       :frame="false"
       :data="filteredTeams"
       :columns="columns"
@@ -333,6 +334,7 @@ import { useMutation } from "@tanstack/vue-query";
 import type { OnCallPosition, OnCallTeam } from "@/ts/interfaces/oncall";
 import { raw, useI18nTyped, type I18nKey } from "@/types/i18n";
 import { isOnCallUnavailable } from "@/utils/oncall";
+import { licenseDeniedFeatures, type ForbiddenState } from "@/utils/featureGate";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
@@ -351,6 +353,7 @@ const teams = ref<OnCallTeam[]>([]);
 const loading = ref(false);
 const lastUpdatedAt = ref<number | null>(null);
 const loadError = ref<string | null>(null);
+const forbidden = ref<ForbiddenState>(false);
 const notAvailable = ref(false);
 const savedView = useListViewState("oncall-teams", {
   search: "",
@@ -556,6 +559,7 @@ async function fetchTeams(force = false) {
     await fetchOnCallNow(force);
     loadError.value = null;
     notAvailable.value = false;
+    forbidden.value = false;
   } catch (err: any) {
     // Feature-off (404) and OSS (403 "Not Supported") are the same calm fact,
     // not an error: nothing failed and there is nothing to retry. §G.8.1 —
@@ -564,6 +568,12 @@ async function fetchTeams(force = false) {
       notAvailable.value = true;
       return;
     }
+    // A license denial is not a failed read: the table shows the license copy, with no retry.
+    const denied = licenseDeniedFeatures(err);
+    if (denied) {
+      forbidden.value = denied;
+      return;
+    }
     // The state, not a toast: a toast evaporates and leaves "no teams" on
     // screen, which reads as an unconfigured org rather than a failed read.
     loadError.value = String(err?.response?.data?.message ?? err?.message ?? "");
diff --git a/web/src/views/OverviewTab.spec.ts b/web/src/views/OverviewTab.spec.ts
index 79a66b70ec..573b6a9f2f 100644
--- a/web/src/views/OverviewTab.spec.ts
+++ b/web/src/views/OverviewTab.spec.ts
@@ -25,6 +25,11 @@ import mockOverview from "@/test/unit/mockData/overview";
 // Data payloads are wired up per-test in beforeEach so each `it()` owns its
 // own state; the factories below stay data-free to survive vi.mock hoisting.
 
+const upgradeDialogOpen = vi.hoisted(() => vi.fn());
+vi.mock("@/composables/useEnterpriseUpgradeDialog", () => ({
+  useEnterpriseUpgradeDialog: () => ({ open: upgradeDialogOpen }),
+}));
+
 vi.mock("@/services/alerts", async (importOriginal) => {
   const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
   return overlayServiceMock(await importOriginal(), {
@@ -271,6 +276,57 @@ describe("OverviewTab", () => {
     vi.clearAllMocks();
   });
 
+  describe("alerts entry point under a license lock", () => {
+    it("locks the alerts card while alerts is locked", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, features: { alerts: "locked" } });
+      const push = vi.spyOn(router, "push");
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      const card = wrapper.find('[data-test="overview-empty-alerts-card"]');
+      expect(card.attributes("aria-disabled")).toBe("true");
+      await card.trigger("click");
+      expect(push).not.toHaveBeenCalled();
+      push.mockRestore();
+    });
+  });
+
+  describe("signal entry points under a license lock", () => {
+    const LOGS_CARD = '[data-test="overview-empty-logs-card"]';
+    const TRACES_CARD = '[data-test="overview-empty-traces-card"]';
+
+    it("locks the Traces card and keeps Logs live while traces is locked", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, features: { traces: "locked" } });
+      const push = vi.spyOn(router, "push");
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      expect(wrapper.find(TRACES_CARD).exists()).toBe(true);
+      expect(wrapper.find(TRACES_CARD).attributes("aria-disabled")).toBe("true");
+      expect(wrapper.find(TRACES_CARD).classes()).toContain("cursor-not-allowed");
+      await wrapper.find(TRACES_CARD).trigger("click");
+      expect(push).not.toHaveBeenCalled();
+
+      expect(wrapper.find(LOGS_CARD).attributes("aria-disabled")).toBeUndefined();
+      await wrapper.find(LOGS_CARD).trigger("click");
+      expect(push).toHaveBeenCalledWith(expect.objectContaining({ name: "logs" }));
+      push.mockRestore();
+    });
+
+    it("locks the Logs card while logs is locked", async () => {
+      store.commit("setConfig", { ...store.state.zoConfig, features: { logs: "locked" } });
+      const push = vi.spyOn(router, "push");
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      expect(wrapper.find(LOGS_CARD).attributes("aria-disabled")).toBe("true");
+      await wrapper.find(LOGS_CARD).trigger("click");
+      expect(push).not.toHaveBeenCalled();
+      expect(wrapper.find(TRACES_CARD).attributes("aria-disabled")).toBeUndefined();
+      push.mockRestore();
+    });
+  });
+
   describe("loaded with no data", () => {
     beforeEach(async () => {
       wrapper = mountOverviewTab();
@@ -644,6 +700,104 @@ describe("OverviewTab", () => {
     });
   });
 
+  describe("license-locked incidents and anomaly sections", () => {
+    it("renders the locked cards with the reason and no upgrade dialog", async () => {
+      config.isEnterprise = "true";
+      store.commit("setConfig", {
+        ...store.state.zoConfig,
+        incidents_enabled: false,
+        anomaly_detection_enabled: false,
+        features: { incidents: "locked", anomaly_detection: "locked" },
+      });
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      const incidents = wrapper.find('[data-test="overview-incidents-locked"]');
+      const anomalies = wrapper.find('[data-test="overview-anomalies-locked"]');
+      expect(incidents.exists()).toBe(true);
+      expect(anomalies.exists()).toBe(true);
+      expect(incidents.text()).not.toContain(i18n.global.t("enterpriseFeature.pitch.incidents"));
+      expect(incidents.text()).toContain("Locked: needs");
+    });
+  });
+
+  describe("license-locked alerts and anomaly detection", () => {
+    const lockFeatures = (features: Record<string, string>) =>
+      store.commit("setConfig", {
+        ...store.state.zoConfig,
+        anomaly_detection_enabled: true,
+        features,
+      });
+
+    it("should request neither alert history nor anomalies when both are locked", async () => {
+      lockFeatures({ alerts: "locked", anomaly_detection: "locked" });
+      givenRecentEvents();
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      expect(alertsService.getHistory).not.toHaveBeenCalled();
+      expect(anomalyService.list).not.toHaveBeenCalled();
+      expect(anomalyService.getAllHistory).not.toHaveBeenCalled();
+      expect(wrapper.find(RECENT_EVENTS).exists()).toBe(false);
+      expect(wrapper.find('[data-test="overview-load-error-empty-state"]').exists()).toBe(false);
+    });
+
+    it("should load alert history and anomalies when both are enabled", async () => {
+      lockFeatures({ alerts: "enabled", anomaly_detection: "enabled" });
+      givenRecentEvents();
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      expect(alertsService.getHistory).toHaveBeenCalled();
+      expect(anomalyService.list).toHaveBeenCalled();
+      expect(wrapper.find(RECENT_EVENTS).exists()).toBe(true);
+    });
+  });
+
+  describe("services under a traces license lock", () => {
+    const SERVICES_LOCKED = '[data-test="overview-services-locked"]';
+
+    beforeEach(() => {
+      config.isEnterprise = "true";
+      store.commit("setConfig", {
+        ...store.state.zoConfig,
+        incidents_enabled: true,
+        features: { traces: "locked" },
+      });
+    });
+
+    it("locks Services with the reason and never requests the topology", async () => {
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      expect(serviceGraphService.getCurrentTopology).not.toHaveBeenCalled();
+      expect(wrapper.find(SERVICES_LOCKED).text()).toContain("Locked: needs");
+      expect(wrapper.find('[data-test="overview-load-error-empty-state"]').exists()).toBe(false);
+    });
+
+    it("does not open the upgrade dialog from the locked Services row", async () => {
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      const row = wrapper.find(SERVICES_LOCKED).find(".rounded-default");
+      await row.trigger("click");
+
+      expect(row.classes()).not.toContain("cursor-pointer");
+
+      expect(upgradeDialogOpen).not.toHaveBeenCalled();
+    });
+
+    it("does not claim all clear for what the license kept it from checking", async () => {
+      wrapper = mountOverviewTab();
+      await flushPromises();
+
+      const hero = wrapper.find(EMPTY_STATE);
+      expect(hero.text()).toContain(i18n.global.t("overview.allClearPartial"));
+      expect(hero.text()).toContain(i18n.global.t("overview.areaServices"));
+      expect(hero.text()).not.toContain(i18n.global.t("overview.allClear"));
+    });
+  });
+
   describe("enterprise sections", () => {
     beforeEach(() => {
       // `config` is a plain object read by `incidentsAccess` (useLockedAffordance)
diff --git a/web/src/views/OverviewTab.vue b/web/src/views/OverviewTab.vue
index 8d093275d3..042916086f 100644
--- a/web/src/views/OverviewTab.vue
+++ b/web/src/views/OverviewTab.vue
@@ -130,7 +130,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- Locked: no license to unlock Incidents, shown instead of omitted so
          the capability is discoverable from a build that can't enable it. -->
     <section
-      v-else-if="!incidentsAccess.allowed"
+      v-else-if="!incidentsAccess.allowed || incidentsLicenseLocked"
       class="mb-5"
       data-test="overview-incidents-locked"
     >
@@ -140,11 +140,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </div>
       </div>
       <div
-        class="border-border-default bg-surface-subtle rounded-default flex cursor-pointer items-center gap-3 border border-[0.0625em] px-4 py-5"
-        @click="openUpgradeDialog"
+        class="border-border-default bg-surface-subtle rounded-default flex items-center gap-3 border border-[0.0625em] px-4 py-5"
+        :class="{ 'cursor-pointer': !incidentsLicenseLocked }"
+        @click="!incidentsLicenseLocked && openUpgradeDialog()"
       >
-        <OIcon name="lock" size="md" class="text-warning-600 shrink-0" />
-        <span class="text-text-secondary text-sm">{{ incidentsAccess.message }}</span>
+        <OIcon name="lock" size="md" class="lock-chip shrink-0" />
+        <span class="text-text-secondary text-sm">{{
+          incidentsLicenseLocked ? incidentsLockedReason : incidentsAccess.message
+        }}</span>
       </div>
     </section>
 
@@ -168,12 +171,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             }}</strong>
           </span>
         </div>
-        <button
-          class="text-text-link cursor-pointer border-none bg-none p-0 text-xs font-medium whitespace-nowrap opacity-80 transition-opacity duration-150 hover:underline hover:opacity-100"
-          @click="goToServiceGraph"
-        >
-          {{ t("overview.viewAll") }} {{ "→" }}
-        </button>
+        <OTooltip :content="tracesLock.lockedReason.value" :disabled="!tracesLock.locked.value">
+          <button
+            class="text-text-link aria-disabled:text-text-disabled inline-flex cursor-pointer items-center gap-1 border-none bg-none p-0 text-xs font-medium whitespace-nowrap opacity-80 transition-opacity duration-150 hover:underline hover:opacity-100 aria-disabled:cursor-not-allowed aria-disabled:no-underline"
+            :aria-disabled="tracesLock.locked.value || undefined"
+            data-test="overview-services-view-all"
+            @click="goToServiceGraph"
+          >
+            <OIcon
+              v-if="tracesLock.locked.value"
+              name="lock"
+              class="text-icon-locked"
+              size="sm"
+              data-test="overview-services-view-all-lock"
+            />
+            {{ t("overview.viewAll") }}
+            <template v-if="!tracesLock.locked.value">{{ "→" }}</template>
+          </button>
+        </OTooltip>
       </div>
       <div class="relative">
         <!-- Left fade + floating scroll control (only present when scrollable) -->
@@ -221,11 +236,30 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 class="text-text-heading block flex-1 cursor-default text-sm font-medium"
                 >{{ svc.label }}</OTruncatedText
               >
-              <span class="ms-1 inline-flex shrink-0 items-center">
+              <OTooltip v-if="tracesLock.locked.value" :content="tracesLock.lockedReason.value">
+                <span class="ms-1 inline-flex shrink-0 items-center" @click.stop>
+                  <OButton
+                    variant="ghost-muted"
+                    size="icon"
+                    disabled
+                    :aria-label="t('traces.servicesCatalog.viewTraces')"
+                    data-test="overview-service-view-traces"
+                  >
+                    <OIcon
+                      name="lock"
+                      class="text-icon-locked"
+                      size="sm"
+                      data-test="overview-service-view-traces-lock"
+                    />
+                  </OButton>
+                </span>
+              </OTooltip>
+              <span v-else class="ms-1 inline-flex shrink-0 items-center">
                 <OButton
                   variant="ghost-muted"
                   size="icon"
                   :title="t('traces.servicesCatalog.viewTraces')"
+                  data-test="overview-service-view-traces"
                   @click="goToService(svc, $event)"
                 >
                   <svg width="13" height="13" viewBox="0 0 24 24" fill="none">
@@ -310,20 +344,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       @retry="() => loadAll(true)"
     />
 
-    <!-- Locked: Services shares the Incidents license gate — same bundle, no
-         separate upsell story of its own. -->
-    <section v-else-if="!incidentsAccess.allowed" class="mb-5" data-test="overview-services-locked">
+    <!-- Locked: Services shares the Incidents license gate, and its data comes from traces,
+         so a license without traces locks it too. -->
+    <section
+      v-else-if="!incidentsAccess.allowed || tracesLock.locked.value"
+      class="mb-5"
+      data-test="overview-services-locked"
+    >
       <div class="mb-2 flex items-center justify-between ps-1">
         <div class="text-text-heading text-sm font-medium tracking-[0.01em]">
           {{ t("overview.services") }}
         </div>
       </div>
       <div
-        class="border-border-default bg-surface-subtle rounded-default flex cursor-pointer items-center gap-3 border border-[0.0625em] px-4 py-5"
-        @click="openUpgradeDialog"
+        class="border-border-default bg-surface-subtle rounded-default flex items-center gap-3 border border-[0.0625em] px-4 py-5"
+        :class="{ 'cursor-pointer': !servicesLicenseLocked }"
+        @click="!servicesLicenseLocked && openUpgradeDialog()"
       >
-        <OIcon name="lock" size="md" class="text-warning-600 shrink-0" />
-        <span class="text-text-secondary text-sm">{{ incidentsAccess.message }}</span>
+        <OIcon name="lock" size="md" class="lock-chip shrink-0" />
+        <span class="text-text-secondary text-sm">{{
+          incidentsAccess.allowed ? tracesLock.lockedReason.value : incidentsAccess.message
+        }}</span>
       </div>
     </section>
 
@@ -401,6 +442,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :title="t('overview.activeAnomalies')"
       @retry="() => loadAll(true)"
     />
+    <section v-else-if="anomalyLocked" class="mb-5" data-test="overview-anomalies-locked">
+      <div class="mb-2 flex items-center justify-between ps-1">
+        <div class="text-text-heading text-sm font-medium tracking-[0.01em]">
+          {{ t("overview.activeAnomalies") }}
+        </div>
+      </div>
+      <div
+        class="border-border-default bg-surface-subtle rounded-default flex items-center gap-3 border border-[0.0625em] px-4 py-5"
+      >
+        <OIcon name="lock" size="md" class="lock-chip shrink-0" />
+        <span class="text-text-secondary text-sm">{{ anomalyLock.lockedReason.value }}</span>
+      </div>
+    </section>
 
     <!-- RECENT EVENTS (alert firing feed) -->
     <section v-if="recentEvents.length > 0" class="mb-5" data-test="overview-recent-events-section">
@@ -483,14 +537,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <template #title>{{ t("overview.notMonitoredTitle") }}</template>
       <template #description>{{ t("overview.notMonitoredDesc") }}</template>
       <template #actions>
-        <EmptyStateActionCard
+        <OTooltip
           v-if="showAlertsCard"
-          icon="notifications"
-          :label="t('overview.notMonitoredAlert')"
-          :sublabel="t('overview.notMonitoredAlertDesc')"
-          data-test="overview-not-monitored-alert-card"
-          @click="goToAddAlert"
-        />
+          :content="alertsLock.lockedReason.value"
+          :disabled="!alertsLocked"
+        >
+          <EmptyStateActionCard
+            :icon="alertsLocked ? 'lock' : 'notifications'"
+            :label="t('overview.notMonitoredAlert')"
+            :sublabel="t('overview.notMonitoredAlertDesc')"
+            :unavailable="alertsLocked"
+            data-test="overview-not-monitored-alert-card"
+            @click="goToAddAlert"
+          />
+        </OTooltip>
         <EmptyStateActionCard
           v-if="showAlertsCard && anomalyEnabled"
           icon="auto-awesome"
@@ -499,14 +559,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           data-test="overview-not-monitored-anomaly-card"
           @click="goToAnomalies"
         />
-        <EmptyStateActionCard
+        <OTooltip
           v-if="showLogsCard"
-          icon="search"
-          :label="t('overview.emptyActionLogs')"
-          :sublabel="t('overview.emptyActionLogsDesc')"
-          data-test="overview-not-monitored-logs-card"
-          @click="goToLogs"
-        />
+          :content="logsLock.lockedReason.value"
+          :disabled="!logsLock.locked.value"
+        >
+          <EmptyStateActionCard
+            :icon="logsLock.locked.value ? 'lock' : 'search'"
+            :label="t('overview.emptyActionLogs')"
+            :sublabel="t('overview.emptyActionLogsDesc')"
+            :unavailable="logsLock.locked.value"
+            data-test="overview-not-monitored-logs-card"
+            @click="goToLogs"
+          />
+        </OTooltip>
       </template>
     </OEmptyState>
 
@@ -520,92 +586,59 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :hide-action="true"
       data-test="overview-all-clear-empty-state"
     >
-      <template #title>{{ t("overview.allClear") }}</template>
+      <template #title>{{
+        uncheckedAreas.length ? t("overview.allClearPartial") : t("overview.allClear")
+      }}</template>
       <template #description>{{
-        flagOn ? t("overview.allClearDescScoped") : t("overview.allClearDesc")
+        uncheckedAreas.length
+          ? t("overview.allClearPartialDesc", { areas: raw(uncheckedAreas.join(", ")) })
+          : flagOn
+            ? t("overview.allClearDescScoped")
+            : t("overview.allClearDesc")
       }}</template>
       <template #actions>
-        <!-- View alerts -->
-        <button
+        <OTooltip
           v-if="showAlertsCard"
-          type="button"
-          class="group rounded-default border-border-default bg-surface-base hover:border-accent hover:bg-tabs-hover-bg focus-visible:ring-accent/40 relative flex min-h-16 max-w-72 min-w-0 flex-1 basis-56 cursor-pointer items-center gap-3 border py-2.5 ps-3 pe-3.5 text-left transition-[color,background-color,border-color,box-shadow] duration-150 outline-none hover:shadow-md focus-visible:ring-2"
-          data-test="overview-empty-alerts-card"
-          @click="goToAlertList"
+          :content="alertsLock.lockedReason.value"
+          :disabled="!alertsLocked"
         >
-          <span
-            class="rounded-default bg-icon-chip-warning-bg text-icon-chip-warning-text group-hover:bg-accent group-hover:text-text-inverse inline-flex h-10 w-10 shrink-0 items-center justify-center transition-[background-color,color] duration-150"
-          >
-            <OIcon name="notifications" size="md" />
-          </span>
-          <span class="flex min-w-0 flex-1 flex-col gap-0.5">
-            <OTruncatedText class="text-text-heading text-(length:--text-sm) font-semibold">{{
-              t("overview.emptyActionAlerts")
-            }}</OTruncatedText>
-            <span class="text-text-secondary text-(length:--text-xs) leading-[1.4]">{{
-              t("overview.emptyActionAlertsDesc")
-            }}</span>
-          </span>
-          <OIcon
-            name="chevron-right"
-            size="sm"
-            class="text-text-disabled group-hover:text-accent shrink-0 transition-[transform,color] duration-150 group-hover:translate-x-0.5"
+          <EmptyStateActionCard
+            :icon="alertsLocked ? 'lock' : 'notifications'"
+            :label="t('overview.emptyActionAlerts')"
+            :sublabel="t('overview.emptyActionAlertsDesc')"
+            :unavailable="alertsLocked"
+            data-test="overview-empty-alerts-card"
+            @click="goToAlertList"
           />
-        </button>
-        <!-- Explore logs -->
-        <button
+        </OTooltip>
+        <OTooltip
           v-if="showLogsCard"
-          type="button"
-          class="group rounded-default border-border-default bg-surface-base hover:border-accent hover:bg-tabs-hover-bg focus-visible:ring-accent/40 relative flex min-h-16 max-w-72 min-w-0 flex-1 basis-56 cursor-pointer items-center gap-3 border py-2.5 ps-3 pe-3.5 text-left transition-[color,background-color,border-color,box-shadow] duration-150 outline-none hover:shadow-md focus-visible:ring-2"
-          data-test="overview-empty-logs-card"
-          @click="goToLogs"
+          :content="logsLock.lockedReason.value"
+          :disabled="!logsLock.locked.value"
         >
-          <span
-            class="rounded-default bg-status-info-bg text-status-info-text group-hover:bg-accent group-hover:text-text-inverse inline-flex h-10 w-10 shrink-0 items-center justify-center transition-[background-color,color] duration-150"
-          >
-            <OIcon name="search" size="md" />
-          </span>
-          <span class="flex min-w-0 flex-1 flex-col gap-0.5">
-            <OTruncatedText class="text-text-heading text-(length:--text-sm) font-semibold">{{
-              t("overview.emptyActionLogs")
-            }}</OTruncatedText>
-            <span class="text-text-secondary text-(length:--text-xs) leading-[1.4]">{{
-              t("overview.emptyActionLogsDesc")
-            }}</span>
-          </span>
-          <OIcon
-            name="chevron-right"
-            size="sm"
-            class="text-text-disabled group-hover:text-accent shrink-0 transition-[transform,color] duration-150 group-hover:translate-x-0.5"
+          <EmptyStateActionCard
+            :icon="logsLock.locked.value ? 'lock' : 'search'"
+            :label="t('overview.emptyActionLogs')"
+            :sublabel="t('overview.emptyActionLogsDesc')"
+            :unavailable="logsLock.locked.value"
+            data-test="overview-empty-logs-card"
+            @click="goToLogs"
           />
-        </button>
-        <!-- Explore traces -->
-        <button
+        </OTooltip>
+        <OTooltip
           v-if="showTracesCard"
-          type="button"
-          class="group rounded-default border-border-default bg-surface-base hover:border-accent hover:bg-tabs-hover-bg focus-visible:ring-accent/40 relative flex min-h-16 max-w-72 min-w-0 flex-1 basis-56 cursor-pointer items-center gap-3 border py-2.5 ps-3 pe-3.5 text-left transition-[color,background-color,border-color,box-shadow] duration-150 outline-none hover:shadow-md focus-visible:ring-2"
-          data-test="overview-empty-traces-card"
-          @click="goToTraces"
+          :content="tracesLock.lockedReason.value"
+          :disabled="!tracesLock.locked.value"
         >
-          <span
-            class="rounded-default bg-status-info-bg text-status-info-text group-hover:bg-accent group-hover:text-text-inverse inline-flex h-10 w-10 shrink-0 items-center justify-center transition-[background-color,color] duration-150"
-          >
-            <OIcon name="account-tree" size="md" />
-          </span>
-          <span class="flex min-w-0 flex-1 flex-col gap-0.5">
-            <OTruncatedText class="text-text-heading text-(length:--text-sm) font-semibold">{{
-              t("overview.emptyActionTraces")
-            }}</OTruncatedText>
-            <span class="text-text-secondary text-(length:--text-xs) leading-[1.4]">{{
-              t("overview.emptyActionTracesDesc")
-            }}</span>
-          </span>
-          <OIcon
-            name="chevron-right"
-            size="sm"
-            class="text-text-disabled group-hover:text-accent shrink-0 transition-[transform,color] duration-150 group-hover:translate-x-0.5"
+          <EmptyStateActionCard
+            :icon="tracesLock.locked.value ? 'lock' : 'account-tree'"
+            :label="t('overview.emptyActionTraces')"
+            :sublabel="t('overview.emptyActionTracesDesc')"
+            :unavailable="tracesLock.locked.value"
+            data-test="overview-empty-traces-card"
+            @click="goToTraces"
           />
-        </button>
+        </OTooltip>
       </template>
     </OEmptyState>
 
@@ -644,6 +677,7 @@ import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OverviewSkeleton from "./OverviewSkeleton.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import EmptyStateActionCard from "@/lib/core/EmptyState/EmptyStateActionCard.vue";
@@ -655,6 +689,7 @@ import ServiceGraphNodeSidePanel from "@/plugins/traces/ServiceGraphNodeSidePane
 import { sqlEquals } from "@/utils/query/sqlFilterBuilder";
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
 import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDialog";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 
 const AlertHistoryDrawer = defineAsyncComponent(
   () => import("@/components/alerts/AlertHistoryDrawer.vue"),
@@ -674,7 +709,33 @@ const isIncidentsEnabled = computed(
 );
 const flagOn = computed(() => store.state.zoConfig?.restricted_routes_on_empty_data === true);
 // a deployment with anomaly detection off answers 403 by design, which is no load failure
-const anomalyEnabled = computed(() => store.state.zoConfig?.anomaly_detection_enabled === true);
+const alertsLock = useLicenseLock("alerts");
+const alertsLocked = alertsLock.locked;
+const { locked: incidentsFeatureLocked, lockedReason: incidentsLockedReason } =
+  useLicenseLock("incidents");
+const incidentsLicenseLocked = computed(
+  () => incidentsAccess.value.allowed && incidentsFeatureLocked.value,
+);
+const anomalyLock = useLicenseLock("anomaly_detection");
+const anomalyLocked = anomalyLock.locked;
+const logsLock = useLicenseLock("logs");
+const tracesLock = useLicenseLock("traces");
+// a license lock on traces locks Services too
+const servicesLicenseLocked = computed(
+  () => incidentsLicenseLocked.value || (incidentsAccess.value.allowed && tracesLock.locked.value),
+);
+// areas the license keeps the page from reading, so "all clear" must not claim them
+const uncheckedAreas = computed<string[]>(() => {
+  const areas: string[] = [];
+  if (alertsLocked.value) areas.push(t("overview.areaAlerts"));
+  if (anomalyLocked.value) areas.push(t("overview.areaAnomalies"));
+  if (incidentsLicenseLocked.value) areas.push(t("overview.areaIncidents"));
+  if (servicesLicenseLocked.value) areas.push(t("overview.areaServices"));
+  return areas;
+});
+const anomalyEnabled = computed(
+  () => store.state.zoConfig?.anomaly_detection_enabled === true && !anomalyLocked.value,
+);
 
 // ── Date / time picker ───────────────────────────────────────────────────────
 const LS_TIME_KEY = "o2_overview_time";
@@ -795,15 +856,18 @@ const isForbidden = (err: unknown) => {
   return e?.status === 403 || e?.response?.status === 403;
 };
 const attemptedSections = computed<SectionKey[]>(() => {
-  const keys: SectionKey[] = ["recentEvents"];
+  const keys: SectionKey[] = [];
+  if (!alertsLocked.value) keys.push("recentEvents");
   if (anomalyEnabled.value) keys.push("anomalies");
   if (isIncidentsEnabled.value) keys.push("incidents");
-  if (incidentsAccess.value.allowed) keys.push("services");
+  if (incidentsAccess.value.allowed && !tracesLock.locked.value) keys.push("services");
   return keys;
 });
 const isFailed = (key: SectionKey) =>
   !!sectionFailure[key] && attemptedSections.value.includes(key);
-const allFailed = computed(() => attemptedSections.value.every(isFailed));
+const allFailed = computed(
+  () => attemptedSections.value.length > 0 && attemptedSections.value.every(isFailed),
+);
 
 type PageState =
   "content" | "partial" | "forbidden" | "error" | "not-monitored" | "no-data" | "all-clear";
@@ -961,6 +1025,11 @@ const loadUserStreams = async (force = false) => {
 // Dedicated anomaly loader — uses anomaly_detection service for reliable results
 const loadAnomalies = async (force = false) => {
   sectionFailure.anomalies = null;
+  if (anomalyLocked.value) {
+    anomalies.value = [];
+    anomalyConfigCount.value = null;
+    return;
+  }
   try {
     const org = orgId.value;
     const { startTime, endTime } = timeRange.value;
@@ -1066,6 +1135,10 @@ const loadAnomalies = async (force = false) => {
 // Alert trigger history feeds recentEvents only
 const loadHistoryAndSplit = async (force = false) => {
   sectionFailure.recentEvents = null;
+  if (alertsLocked.value) {
+    recentEvents.value = [];
+    return;
+  }
   try {
     // Exact bounds: `alertHistoryQuery` rounds only its key, so the newest minutes still reach the server.
     const historyOptions = alertHistoryQuery(orgId.value, {
@@ -1161,7 +1234,7 @@ const loadIncidents = async (force = false) => {
 };
 
 const loadServiceGraph = async (force = false) => {
-  if (!incidentsAccess.value.allowed) return;
+  if (!incidentsAccess.value.allowed || tracesLock.locked.value) return;
   sectionFailure.services = null;
   try {
     graphStream.value = "all";
@@ -1308,6 +1381,8 @@ const goToService = (svc: any, e?: MouseEvent) => {
   // Fired from the per-card info-icon button — stop it bubbling to the card
   // click (which opens the latency/info side panel).
   e?.stopPropagation();
+  // the service panel's View traces emits here too, outside this file's lock markup
+  if (tracesLock.locked.value) return;
   let filter = sqlEquals("service_name", svc.label ?? svc.id);
   if (svc.errorFlag) filter += ` AND span_status = 'ERROR'`;
 
@@ -1376,14 +1451,17 @@ const goToAnomalies = () => {
 };
 
 const goToLogs = () => {
+  if (logsLock.locked.value) return;
   router.push({ name: "logs", query: { org_identifier: orgId.value } });
 };
 
 const goToTraces = () => {
+  if (tracesLock.locked.value) return;
   router.push({ name: "traces", query: { org_identifier: orgId.value } });
 };
 
 const goToServiceGraph = () => {
+  if (tracesLock.locked.value) return;
   const query: Record<string, string> = {
     org_identifier: orgId.value,
     tab: "service-graph",
diff --git a/web/src/views/PinnedDashboardTab.spec.ts b/web/src/views/PinnedDashboardTab.spec.ts
index f3f821a6a2..00d367a275 100644
--- a/web/src/views/PinnedDashboardTab.spec.ts
+++ b/web/src/views/PinnedDashboardTab.spec.ts
@@ -18,6 +18,7 @@ import { flushPromises, mount, VueWrapper } from "@vue/test-utils";
 import { createStore } from "vuex";
 import { createI18n } from "vue-i18n";
 import PinnedDashboardTab from "./PinnedDashboardTab.vue";
+import { getDashboard } from "@/utils/commons";
 
 vi.mock("@/utils/commons", () => ({
   getDashboard: vi.fn(async () => ({ title: "Pinned", tabs: [{ tabId: "t1", panels: [] }] })),
@@ -25,13 +26,17 @@ vi.mock("@/utils/commons", () => ({
 
 describe("PinnedDashboardTab", () => {
   let wrapper: VueWrapper<any>;
+  let store: any;
 
-  const mountTab = async () => {
+  const mountTab = async (features: Record<string, string> = {}) => {
+    store = createStore({
+      state: { zoConfig: { features }, selectedOrganization: { identifier: "o1" } },
+    });
     wrapper = mount(PinnedDashboardTab, {
       props: { dashboardId: "d1", folderId: "default" },
       global: {
         plugins: [
-          createStore({ state: { zoConfig: {}, selectedOrganization: { identifier: "o1" } } }),
+          store,
           createI18n({
             legacy: false,
             locale: "en",
@@ -39,6 +44,11 @@ describe("PinnedDashboardTab", () => {
           }),
         ],
         stubs: {
+          LicenseDeniedState: {
+            name: "LicenseDeniedState",
+            props: ["features"],
+            template: '<div v-bind="$attrs" />',
+          },
           RenderDashboardCharts: true,
           DateTimePickerDashboard: true,
           AutoRefreshInterval: true,
@@ -62,6 +72,55 @@ describe("PinnedDashboardTab", () => {
 
   afterEach(() => {
     wrapper?.unmount();
+    vi.mocked(getDashboard).mockClear();
+  });
+
+  it("shows the license-denied state and loads nothing when dashboards are locked", async () => {
+    await mountTab({ dashboards: "locked" });
+
+    const denied = wrapper.findComponent({ name: "LicenseDeniedState" });
+    expect(denied.exists()).toBe(true);
+    expect(denied.props("features")).toEqual(["dashboards"]);
+    expect(getDashboard).not.toHaveBeenCalled();
+    expect(wrapper.emitted("unavailable")).toBeUndefined();
+  });
+
+  it("never emits unavailable for a license 403 that beat the config, and shows the license state", async () => {
+    vi.mocked(getDashboard).mockRejectedValueOnce({
+      response: { status: 403, data: { code: 40001, error_detail: "dashboards" } },
+    });
+    await mountTab();
+
+    expect(wrapper.emitted("unavailable")).toBeUndefined();
+    expect(wrapper.findComponent({ name: "LicenseDeniedState" }).props("features")).toEqual([
+      "dashboards",
+    ]);
+  });
+
+  it("still emits unavailable for a dashboard that is really gone", async () => {
+    vi.mocked(getDashboard).mockRejectedValueOnce({ response: { status: 404 } });
+    await mountTab();
+
+    expect(wrapper.emitted("unavailable")).toEqual([["d1", "default"]]);
+  });
+
+  it("drops the dashboard and shows the license state when the lock arrives late", async () => {
+    await mountTab();
+    expect(wrapper.findComponent({ name: "LicenseDeniedState" }).exists()).toBe(false);
+
+    store.state.zoConfig = { features: { dashboards: "locked" } };
+    await flushPromises();
+
+    expect(wrapper.findComponent({ name: "LicenseDeniedState" }).exists()).toBe(true);
+    expect(wrapper.find('[data-test="pinned-dashboard-refresh-btn"]').exists()).toBe(false);
+    expect(wrapper.emitted("unavailable")).toBeUndefined();
+  });
+
+  it("loads the dashboard when dashboards are enabled", async () => {
+    await mountTab({ dashboards: "enabled" });
+
+    expect(wrapper.findComponent({ name: "LicenseDeniedState" }).exists()).toBe(false);
+    expect(getDashboard).toHaveBeenCalledTimes(1);
   });
 
   it("shows Refresh as a labelled primary button", async () => {
diff --git a/web/src/views/PinnedDashboardTab.vue b/web/src/views/PinnedDashboardTab.vue
index a0e07ff99a..60a9af43eb 100644
--- a/web/src/views/PinnedDashboardTab.vue
+++ b/web/src/views/PinnedDashboardTab.vue
@@ -14,9 +14,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 <template>
   <div class="pinned-dashboard-tab flex h-full min-h-0 flex-col">
+    <LicenseDeniedState
+      v-if="dashboardsLocked || licenseDenied"
+      :features="licenseDenied ?? ['dashboards']"
+      data-test="pinned-dashboard-license-denied"
+    />
     <!-- Skeleton mirrors the loaded layout (toolbar + panels grid) so the
          transition to real content is stable, instead of flat full-width bars. -->
-    <div v-if="isLoading" class="flex h-full min-h-0 flex-col">
+    <div v-else-if="isLoading" class="flex h-full min-h-0 flex-col">
       <div
         class="border-border-default flex shrink-0 items-center justify-end gap-2 border-b px-4 py-2"
       >
@@ -102,14 +107,19 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useI18nTyped } from "@/types/i18n";
 import useBreakpoint from "@/composables/useBreakpoint";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import { licenseDeniedFeatures } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
+const { locked: dashboardsLocked } = useLicenseLock("dashboards");
+const licenseDenied = ref<string[] | null>(null);
 const { isMobile } = useBreakpoint();
 
 const props = defineProps<{ dashboardId: string; folderId: string }>();
 const emit = defineEmits<{
   (e: "update-label", label: string): void;
-  (e: "unavailable", dashboardId: string): void;
+  (e: "unavailable", dashboardId: string, folderId: string): void;
 }>();
 
 const store = useStore();
@@ -205,7 +215,10 @@ const refreshData = () => {
   setTime();
 };
 
+// A license denial is never "unavailable": that emit deletes the org-wide pin for everyone.
 const load = async () => {
+  if (dashboardsLocked.value) return;
+  licenseDenied.value = null;
   isLoading.value = true;
   try {
     // Use the shared getDashboard util (same as ViewDashboard) — NOT the raw
@@ -214,10 +227,11 @@ const load = async () => {
     // The raw service returns {version, v5:{...}} whose top level has no `tabs`,
     // which made RenderDashboardCharts render "No panels here yet".
     const dashboard = await getDashboard(store, props.dashboardId, props.folderId);
+    if (dashboardsLocked.value) return;
 
     // getDashboard returns {} (not a throw) for a missing/deleted dashboard.
     if (!dashboard || typeof dashboard !== "object" || !dashboard.title) {
-      emit("unavailable", props.dashboardId);
+      emit("unavailable", props.dashboardId, props.folderId);
       return;
     }
 
@@ -229,8 +243,10 @@ const load = async () => {
     selectedTabId.value = dashboard.tabs?.[0]?.tabId ?? "default";
     await nextTick();
     setTime();
-  } catch {
-    emit("unavailable", props.dashboardId);
+  } catch (err) {
+    const denied = licenseDeniedFeatures(err);
+    if (denied) licenseDenied.value = denied.length ? denied : ["dashboards"];
+    else if (!dashboardsLocked.value) emit("unavailable", props.dashboardId, props.folderId);
   } finally {
     isLoading.value = false;
   }
@@ -238,6 +254,11 @@ const load = async () => {
 
 onMounted(load);
 watch(() => props.dashboardId, load);
+// The org config, with its license states, can land after the first load started.
+watch(dashboardsLocked, (locked) => {
+  if (locked) dashboardData.value = null;
+  else void load();
+});
 
 // Recompute the window whenever the selected range changes. The
 // DateTimePickerDashboard updates its v-model (selectedDate) on Apply /
diff --git a/web/src/views/RUM/AppAnalytics.spec.ts b/web/src/views/RUM/AppAnalytics.spec.ts
index da4021c32f..8c85f7b38f 100644
--- a/web/src/views/RUM/AppAnalytics.spec.ts
+++ b/web/src/views/RUM/AppAnalytics.spec.ts
@@ -188,6 +188,15 @@ describe("AppAnalytics shell", () => {
     ).toBe("active");
   });
 
+  it("sits the sub-tabs in a lock-exempt container, so they stay live on a license-locked page", async () => {
+    await mountAt("/product-analytics/funnels?period=7d");
+    const tabs = wrapper!.findAll('[data-test^="rum-analytics-subtab-"][role="tab"]');
+    expect(tabs.length).toBe(6);
+    for (const tab of tabs) {
+      expect(tab.element.closest("[data-feature-lock-exempt]")).not.toBeNull();
+    }
+  });
+
   it("lights Funnels on the funnel builder route", async () => {
     await mountAt("/product-analytics/funnels/build?app=web&period=7d");
     expect(router.currentRoute.value.name).toBe(PA_ROUTES.funnelBuilder);
diff --git a/web/src/views/RUM/AppAnalytics.vue b/web/src/views/RUM/AppAnalytics.vue
index f5f3412d5c..7808862251 100644
--- a/web/src/views/RUM/AppAnalytics.vue
+++ b/web/src/views/RUM/AppAnalytics.vue
@@ -281,21 +281,24 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </OBanner>
 
       <div class="border-border-default pe-page-edge flex shrink-0 items-center gap-2 border-b">
-        <OTabs
-          :model-value="activeSubTab"
-          align="left"
-          dense
-          class="min-w-0 flex-1"
-          @update:model-value="onSubTabChange"
-        >
-          <OTab
-            v-for="tab in subTabs"
-            :key="tab.value"
-            :name="tab.value"
-            :label="tab.label"
-            :data-test="`rum-analytics-subtab-${tab.value}`"
-          />
-        </OTabs>
+        <!-- Sub-tab navigation stays live on a license-locked page. -->
+        <FeatureLockExempt class="contents">
+          <OTabs
+            :model-value="activeSubTab"
+            align="left"
+            dense
+            class="min-w-0 flex-1"
+            @update:model-value="onSubTabChange"
+          >
+            <OTab
+              v-for="tab in subTabs"
+              :key="tab.value"
+              :name="tab.value"
+              :label="tab.label"
+              :data-test="`rum-analytics-subtab-${tab.value}`"
+            />
+          </OTabs>
+        </FeatureLockExempt>
         <SampledTag
           v-if="showSampledTag"
           :ratio="sampleRatio"
@@ -353,6 +356,7 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OPopover from "@/lib/overlay/Popover/OPopover.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import DateTimePickerDashboard from "@/components/DateTimePickerDashboard.vue";
diff --git a/web/src/views/RUM/AppPerformance.vue b/web/src/views/RUM/AppPerformance.vue
index da49867d65..5dcb203181 100644
--- a/web/src/views/RUM/AppPerformance.vue
+++ b/web/src/views/RUM/AppPerformance.vue
@@ -26,23 +26,25 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       class="px-page-edge border-border-default flex shrink-0 items-center gap-2 border-b py-2 max-md:flex-wrap"
       data-test="rum-performance-toolbar"
     >
-      <OToggleGroup
-        v-model="activePerformanceTab"
-        mobile-dropdown
-        class="shrink-0"
-        data-test="rum-performance-tabs"
-      >
-        <OToggleGroupItem
-          v-for="tab in tabs"
-          :key="tab.value"
-          :value="tab.value"
-          :icon-left="tab.icon"
-          size="sm"
-          :data-test="`rum-performance-tab-${tab.value}`"
+      <FeatureLockExempt class="contents">
+        <OToggleGroup
+          v-model="activePerformanceTab"
+          mobile-dropdown
+          class="shrink-0"
+          data-test="rum-performance-tabs"
         >
-          {{ tab.label }}
-        </OToggleGroupItem>
-      </OToggleGroup>
+          <OToggleGroupItem
+            v-for="tab in tabs"
+            :key="tab.value"
+            :value="tab.value"
+            :icon-left="tab.icon"
+            size="sm"
+            :data-test="`rum-performance-tab-${tab.value}`"
+          >
+            {{ tab.label }}
+          </OToggleGroupItem>
+        </OToggleGroup>
+      </FeatureLockExempt>
       <div
         class="ms-auto flex shrink-0 items-center gap-2 max-md:max-w-full max-md:shrink max-md:flex-wrap max-md:justify-end max-md:[&_.date-time-label]:hidden"
       >
@@ -172,6 +174,7 @@ import { useRoute } from "vue-router";
 import AutoRefreshInterval from "@/components/AutoRefreshInterval.vue";
 import overviewDashboard from "@/utils/rum/overview.json";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import DateTimePickerDashboard from "@/components/DateTimePickerDashboard.vue";
 import usePerformance from "@/composables/rum/usePerformance";
@@ -196,6 +199,7 @@ export default defineComponent({
   name: "AppPerformance",
   components: {
     AutoRefreshInterval,
+    FeatureLockExempt,
     OToggleGroup,
     OToggleGroupItem,
     DateTimePickerDashboard,
diff --git a/web/src/views/RUM/NamedEventEditor.spec.ts b/web/src/views/RUM/NamedEventEditor.spec.ts
index dae50ba744..a2d32678c5 100644
--- a/web/src/views/RUM/NamedEventEditor.spec.ts
+++ b/web/src/views/RUM/NamedEventEditor.spec.ts
@@ -687,5 +687,23 @@ describe("NamedEventEditor (AC-44)", () => {
       expect(carried).toContain("_rumdata");
       expect(carried).toContain("new_user_login");
     });
+
+    it("logs locked: the Open in Logs link is a disabled button with a lock", async () => {
+      (store.state.zoConfig as Record<string, unknown>).features = { logs: "locked" };
+      try {
+        vi.mocked(searchService.search).mockResolvedValue({
+          data: { hits: [{ e0_sessions: 0 }] },
+        } as never);
+        await withDraft([{ t: "view", op: "param", name: "new_user_login", value: "true" }]);
+        await waitPreview();
+        const link = q<HTMLButtonElement>("rum-analytics-named-events-preview-logs-link")!;
+        expect(link.tagName).toBe("BUTTON");
+        expect(link.disabled).toBe(true);
+        expect(link.getAttribute("href")).toBeNull();
+        expect(q("rum-analytics-named-events-preview-logs-link-lock")).not.toBeNull();
+      } finally {
+        delete (store.state.zoConfig as Record<string, unknown>).features;
+      }
+    });
   });
 });
diff --git a/web/src/views/RUM/NamedEventEditor.vue b/web/src/views/RUM/NamedEventEditor.vue
index f3b623a4ff..221df576cc 100644
--- a/web/src/views/RUM/NamedEventEditor.vue
+++ b/web/src/views/RUM/NamedEventEditor.vue
@@ -89,7 +89,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   class="text-text-secondary flex flex-wrap items-center gap-1 text-xs"
                   data-test="rum-analytics-named-events-preview-no-param"
                   >{{ t("rum.analytics.events.previewNoParam") }}
+                  <OTooltip v-if="logsLock.locked.value" :content="logsLock.lockedReason.value">
+                    <span class="inline-flex">
+                      <OButton
+                        variant="ghost-primary"
+                        size="xs"
+                        disabled
+                        data-test="rum-analytics-named-events-preview-logs-link"
+                      >
+                        <template #icon-left>
+                          <OIcon
+                            name="lock"
+                            class="text-icon-locked"
+                            size="sm"
+                            data-test="rum-analytics-named-events-preview-logs-link-lock"
+                          />
+                        </template>
+                        {{ t("rum.analytics.events.openInLogs") }}
+                      </OButton>
+                    </span>
+                  </OTooltip>
                   <OButton
+                    v-else
                     as="a"
                     variant="ghost-primary"
                     size="xs"
@@ -142,6 +163,9 @@ import OFormSection from "@/lib/core/FormSection/OFormSection.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
 import { setServerFieldErrors, useOForm } from "@/lib/forms/Form/useOForm";
@@ -280,6 +304,8 @@ const noParamMatch = computed(() => {
   return p.status === "ok" && !Number(p.rows[0]?.e0_sessions ?? 0) && paramRules.value.length > 0;
 });
 
+const logsLock = useLicenseLock("logs");
+
 // Logs gets the same predicate the preview counted, so the analyst can read the raw URLs.
 const logsHref = computed(() => {
   const ev = draftEvent(paramRules.value);
diff --git a/web/src/views/RUM/RealUserMonitoring.spec.ts b/web/src/views/RUM/RealUserMonitoring.spec.ts
index 0f41afa673..3b6b1ab81d 100644
--- a/web/src/views/RUM/RealUserMonitoring.spec.ts
+++ b/web/src/views/RUM/RealUserMonitoring.spec.ts
@@ -15,8 +15,10 @@
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
-import { createRouter, createWebHistory, type Router } from "vue-router";
+import { createRouter, createWebHistory, RouterView, type Router } from "vue-router";
 import { createStore } from "vuex";
+import { defineComponent, h, ref } from "vue";
+import { provideFeatureLock } from "@/composables/useFeatureLock";
 
 const streams: Record<string, { name: string; schema: { name: string }[] } | undefined> = {};
 let streamGate: Promise<void> = Promise.resolve();
@@ -103,6 +105,22 @@ describe("RealUserMonitoring tabs", () => {
     expect(wrapper!.find('[data-test="rum-tab-product-analytics"]').exists()).toBe(false);
   });
 
+  it("keeps the section tabs live on a license-locked page", async () => {
+    router = makeRouter();
+    await router.push("/rum/sessions");
+    const LockedShell = defineComponent({
+      setup() {
+        provideFeatureLock(ref("rum"));
+        return () => h(RouterView);
+      },
+    });
+    wrapper = mount(LockedShell, { global: { plugins: [router, store] } });
+    await flushPromises();
+    const tabs = wrapper.findAll('[role="tab"]');
+    expect(tabs.length).toBeGreaterThan(0);
+    expect(tabs.filter((t) => t.attributes("aria-disabled") === "true")).toHaveLength(0);
+  });
+
   it("keeps Performance as the default landing tab", async () => {
     await mountAt("/rum");
     expect(router.currentRoute.value.name).toBe("rumPerformanceSummary");
diff --git a/web/src/views/RUM/RealUserMonitoring.vue b/web/src/views/RUM/RealUserMonitoring.vue
index e154d91ecd..2c07d7a386 100644
--- a/web/src/views/RUM/RealUserMonitoring.vue
+++ b/web/src/views/RUM/RealUserMonitoring.vue
@@ -36,15 +36,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="shrink-0"
       >
         <template #tabs>
-          <OTabs v-model="activeTab" align="left" @change="changeTab">
-            <OTab
-              v-for="tab in tabs"
-              :key="tab.value"
-              :name="tab.value"
-              :label="tab.label"
-              :data-test="`rum-tab-${tab.value.replace('_', '-')}`"
-            />
-          </OTabs>
+          <!-- Section navigation stays live on a license-locked page. -->
+          <FeatureLockExempt class="contents">
+            <OTabs v-model="activeTab" align="left" @change="changeTab">
+              <OTab
+                v-for="tab in tabs"
+                :key="tab.value"
+                :name="tab.value"
+                :label="tab.label"
+                :data-test="`rum-tab-${tab.value.replace('_', '-')}`"
+              />
+            </OTabs>
+          </FeatureLockExempt>
         </template>
       </OPageHeader>
       <router-view v-slot="{ Component }">
@@ -85,6 +88,7 @@ import { b64EncodeUnicode } from "@/utils/zincutils";
 import { useI18nTyped } from "@/types/i18n";
 import useStreams from "@/composables/useStreams";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
diff --git a/web/src/views/RUM/SourceMaps.vue b/web/src/views/RUM/SourceMaps.vue
index f9027140d7..ae2e967a2c 100644
--- a/web/src/views/RUM/SourceMaps.vue
+++ b/web/src/views/RUM/SourceMaps.vue
@@ -248,6 +248,7 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 
 const { t } = useI18nTyped();
 const store = useStore();
@@ -311,7 +312,7 @@ const fetchFilterValues = async () => {
 
 // State
 const isLoading = ref(false);
-const forbidden = ref(false);
+const forbidden = ref<ForbiddenState>(false);
 const sourceMaps = ref<any[]>([]);
 const groupedSourceMaps = ref<any[]>([]);
 const expandedIds = ref<string[]>([]);
@@ -416,7 +417,7 @@ const fetchSourceMaps = async () => {
     groupSourceMaps();
   } catch (error: any) {
     console.error("Error fetching source maps:", error);
-    forbidden.value = error?.response?.status === 403;
+    forbidden.value = forbiddenState(error);
     sourceMaps.value = [];
     groupedSourceMaps.value = [];
   } finally {
diff --git a/web/src/views/SyntheticMonitoring.spec.ts b/web/src/views/SyntheticMonitoring.spec.ts
index a3b4d0d383..7437a3ec3f 100644
--- a/web/src/views/SyntheticMonitoring.spec.ts
+++ b/web/src/views/SyntheticMonitoring.spec.ts
@@ -474,6 +474,15 @@ describe("SyntheticMonitoring", () => {
       expect(tabElements).toHaveLength(4);
     });
 
+    it("sits the section tabs in a lock-exempt container, so they stay live on a license-locked page", () => {
+      wrapper = mountPage();
+      const tabsWrapper = wrapper.find('[data-test="synthetic-monitoring-header-tabs"]');
+      expect(tabsWrapper.element.closest("[data-feature-lock-exempt]")).not.toBeNull();
+      const newCheck = wrapper.find('[data-test="synthetic-monitoring-new-check-btn"]');
+      expect(newCheck.exists()).toBe(true);
+      expect(newCheck.element.closest("[data-feature-lock-exempt]")).toBeNull();
+    });
+
     it("hides the Private Locations tab when private locations are unavailable", () => {
       // Private locations are served by agents deployed inside the customer's
       // network, which is the one enterprise part of synthetics. An OSS build
@@ -621,6 +630,26 @@ describe("SyntheticMonitoring", () => {
       expect(mockStatusPagesList).toHaveBeenCalledTimes(1);
     });
 
+    it("flags the status pages list as license-denied on a 40001 403", async () => {
+      mockStatusPagesList.mockRejectedValueOnce({
+        response: { status: 403, data: { code: 40001, error_detail: "synthetics" } },
+      });
+      mockRoute.query.section = "status-pages";
+      wrapper = mountPage();
+      await flushPromises();
+      expect((wrapper.vm as any).statusPagesForbidden).toEqual(["synthetics"]);
+    });
+
+    it("flags the private locations list as license-denied on a 40001 403", async () => {
+      mockRoute.query.section = "private";
+      mockServiceGetLocations.mockRejectedValueOnce({
+        response: { status: 403, data: { code: 40001, error_detail: "synthetics" } },
+      });
+      wrapper = mountPage();
+      await flushPromises();
+      expect((wrapper.vm as any).locationsForbidden).toEqual(["synthetics"]);
+    });
+
     it("lazy-loads private locations when the tab is reached through the URL", async () => {
       wrapper = mountPage();
       await flushPromises();
diff --git a/web/src/views/SyntheticMonitoring.vue b/web/src/views/SyntheticMonitoring.vue
index 685baf66e6..b52e3450f9 100644
--- a/web/src/views/SyntheticMonitoring.vue
+++ b/web/src/views/SyntheticMonitoring.vue
@@ -74,28 +74,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </template>
 
     <template #header-tabs>
-      <OTabs
-        :model-value="activeSection"
-        align="left"
-        @change="activeSection = $event as SyntheticsSection"
-      >
-        <OTab name="checks">
-          <OIcon name="radar" size="sm" />
-          <span>{{ t("synthetics.tabs.checks") }}</span>
-        </OTab>
-        <OTab v-if="privateLocationsEnabled" name="private">
-          <OIcon name="location-on" size="sm" />
-          <span>{{ t("synthetics.tabs.private") }}</span>
-        </OTab>
-        <OTab name="status-pages">
-          <OIcon name="monitor-heart" size="sm" />
-          <span>{{ t("statusPages.tabTitle") }}</span>
-        </OTab>
-        <OTab name="variables">
-          <OIcon name="data-object" size="sm" />
-          <span>{{ t("synthetics.tabs.variables") }}</span>
-        </OTab>
-      </OTabs>
+      <!-- Section navigation stays live on a license-locked page; the actions inside each section stay locked. -->
+      <FeatureLockExempt class="contents">
+        <OTabs
+          :model-value="activeSection"
+          align="left"
+          @change="activeSection = $event as SyntheticsSection"
+        >
+          <OTab name="checks">
+            <OIcon name="radar" size="sm" />
+            <span>{{ t("synthetics.tabs.checks") }}</span>
+          </OTab>
+          <OTab v-if="privateLocationsEnabled" name="private">
+            <OIcon name="location-on" size="sm" />
+            <span>{{ t("synthetics.tabs.private") }}</span>
+          </OTab>
+          <OTab name="status-pages">
+            <OIcon name="monitor-heart" size="sm" />
+            <span>{{ t("statusPages.tabTitle") }}</span>
+          </OTab>
+          <OTab name="variables">
+            <OIcon name="data-object" size="sm" />
+            <span>{{ t("synthetics.tabs.variables") }}</span>
+          </OTab>
+        </OTabs>
+      </FeatureLockExempt>
     </template>
     <!-- CONTENT AREA: sidebar + main -->
     <div class="flex flex-1 overflow-hidden max-md:flex-col">
@@ -116,6 +119,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         v-if="privateLocationsEnabled && activeSection === 'private'"
         :locations="privateLocations"
         :loading="locationsLoading"
+        :forbidden="locationsForbidden"
         @refresh="loadPrivateLocations"
         @copy-setup="openSetupDrawer"
         @delete="confirmDeleteLocation"
@@ -290,6 +294,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         v-if="activeSection === 'status-pages'"
         :pages="statusPages"
         :loading="statusPagesLoading"
+        :forbidden="statusPagesForbidden"
         :timezone="store.state.timezone"
         @refresh="loadStatusPages"
         @new-page="showCreateStatusPage = true"
@@ -513,6 +518,7 @@ import OButton from "@/lib/core/Button/OButton.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
@@ -561,6 +567,7 @@ import {
   statusPageEditRoute,
 } from "@/utils/synthetics/routes";
 import { getFoldersListByType } from "@/utils/commons";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import { useConfirmDialog } from "@/composables/useConfirmDialog";
 import useBreakpoint from "@/composables/useBreakpoint";
@@ -755,7 +762,7 @@ const loading = monitorsList.isPending;
 // A 403 lands in the query's error rather than a loader's catch, so derive the no-access state from it.
 const forbidden = computed(() => {
   const e: any = monitorsList.error.value;
-  return e?.status === 403 || e?.response?.status === 403;
+  return forbiddenState(e) || e?.status === 403;
 });
 // Request in flight, with rows still on screen — the refresh button's
 // spinner. `loading` stays for the skeleton, which only a cold read wants.
@@ -1122,13 +1129,17 @@ const setupData = ref<AgentSetup | null>(null);
 const showDeleteLocation = ref(false);
 const locationToDelete = ref<SyntheticLocation | null>(null);
 
+const locationsForbidden = ref<ForbiddenState>(false);
+
 async function loadPrivateLocations() {
   locationsLoading.value = true;
+  locationsForbidden.value = false;
   try {
     const res = await syntheticsService.getLocations(orgIdentifier.value);
     const all: SyntheticLocation[] = (res.data as any).locations ?? [];
     privateLocations.value = all.filter((l) => l.kind === "private");
   } catch (err) {
+    locationsForbidden.value = forbiddenState(err);
     console.error("[synthetics] failed to load private locations", err);
   } finally {
     locationsLoading.value = false;
@@ -1180,15 +1191,18 @@ async function deleteLocation() {
 // ── Status pages tab ───────────────────────────────────────────────────
 const statusPages = ref<StatusPageListItem[]>([]);
 const statusPagesLoading = ref(false);
+const statusPagesForbidden = ref<ForbiddenState>(false);
 const showCreateStatusPage = ref(false);
 
 async function loadStatusPages() {
   if (!orgIdentifier.value) return;
   statusPagesLoading.value = true;
+  statusPagesForbidden.value = false;
   try {
     const res = await statusPagesService.list(orgIdentifier.value);
     statusPages.value = (res.data as any).pages ?? [];
   } catch (err) {
+    statusPagesForbidden.value = forbiddenState(err);
     console.error("[status-pages] failed to load", err);
   } finally {
     statusPagesLoading.value = false;
diff --git a/web/src/views/UsageTab.spec.ts b/web/src/views/UsageTab.spec.ts
index 7034da9f64..5caa74575e 100644
--- a/web/src/views/UsageTab.spec.ts
+++ b/web/src/views/UsageTab.spec.ts
@@ -459,6 +459,56 @@ describe("UsageTab", () => {
       expect(wrapper.exists()).toBe(true);
     });
   });
+  describe("explore links under a license lock", () => {
+    let originalZoConfig: Record<string, unknown>;
+
+    beforeEach(() => {
+      originalZoConfig = { ...store.state.zoConfig };
+    });
+
+    afterEach(() => {
+      store.commit("setConfig", originalZoConfig);
+    });
+
+    const link = (signal: string) => wrapper.find(`[data-test="home-usage-tab-explore-${signal}"]`);
+
+    it("keeps a locked row a link and swaps its chevron for a gold lock", async () => {
+      wrapper = mountUsageTab();
+      await flushPromises();
+      // the tab refreshes /config on mount, so the license state lands after it
+      store.commit("setConfig", { ...store.state.zoConfig, features: { metrics: "locked" } });
+      await flushPromises();
+
+      expect(link("metrics").element.tagName).toBe("A");
+      expect(link("metrics").attributes("aria-disabled")).toBeUndefined();
+      expect(wrapper.find('[data-test="home-usage-tab-explore-metrics-lock"]').exists()).toBe(true);
+      expect(link("metrics").find(".sr-only").text()).toContain("Locked: needs");
+      expect(link("logs").element.tagName).toBe("A");
+      expect(wrapper.find('[data-test="home-usage-tab-explore-logs-lock"]').exists()).toBe(false);
+    });
+
+    it("locks the Alerts view button with the reason as its label", async () => {
+      wrapper = mountUsageTab();
+      await flushPromises();
+      store.commit("setConfig", { ...store.state.zoConfig, features: { alerts: "locked" } });
+      await flushPromises();
+
+      const btn = wrapper.findComponent('[data-test="home-usage-tab-view-alerts-btn"]');
+      expect(String(btn.props("ariaLabel"))).toContain("Locked: needs");
+    });
+
+    it("renders every signal as a link when none is locked", async () => {
+      wrapper = mountUsageTab();
+      await flushPromises();
+
+      for (const signal of ["logs", "traces", "metrics"]) {
+        expect(link(signal).element.tagName).toBe("A");
+      }
+      const icons = wrapper.findAllComponents(".OIcon-stub").map((i) => i.props("name"));
+      expect(icons).not.toContain("lock");
+    });
+  });
+
   describe("summary failure with the empty-data flag on", () => {
     let originalZoConfig: Record<string, unknown>;
 
diff --git a/web/src/views/UsageTab.vue b/web/src/views/UsageTab.vue
index fce9bd1c80..5ea454709d 100644
--- a/web/src/views/UsageTab.vue
+++ b/web/src/views/UsageTab.vue
@@ -208,35 +208,50 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
                 />
               </router-link>
-              <router-link
+              <OTooltip
                 v-if="canView('dashboards')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'dashboards',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-dashboards-card"
+                :content="lockedReason('dashboards')"
+                :disabled="!isLocked('dashboards')"
               >
-                <span
-                  class="rounded-default bg-icon-chip-warning-bg text-icon-chip-warning-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
+                <router-link
+                  class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
+                  :to="{
+                    name: 'dashboards',
+                    query: { org_identifier: store.state.selectedOrganization?.identifier },
+                  }"
+                  data-test="home-usage-tab-dashboards-card"
                 >
-                  <OIcon name="dashboard" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("home.dashboardTitle")
-                }}</OTruncatedText>
-                <span
-                  class="text-text-heading text-sm font-semibold tabular-nums"
-                  data-test="home-usage-tab-dashboards-count"
-                  >{{ animatedDashboardCount || summary.dashboard_count }}</span
-                >
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
+                  <span
+                    class="rounded-default bg-icon-chip-warning-bg text-icon-chip-warning-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
+                    aria-hidden="true"
+                  >
+                    <OIcon name="dashboard" size="sm" />
+                  </span>
+                  <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
+                    t("home.dashboardTitle")
+                  }}</OTruncatedText>
+                  <span
+                    class="text-text-heading text-sm font-semibold tabular-nums"
+                    data-test="home-usage-tab-dashboards-count"
+                    >{{ animatedDashboardCount || summary.dashboard_count }}</span
+                  >
+                  <template v-if="isLocked('dashboards')">
+                    <OIcon
+                      name="lock"
+                      size="xs"
+                      class="text-icon-locked shrink-0"
+                      data-test="home-usage-tab-dashboards-card-lock"
+                    />
+                    <span class="sr-only">{{ lockedReason("dashboards") }}</span>
+                  </template>
+                  <OIcon
+                    v-else
+                    name="chevron-right"
+                    size="sm"
+                    class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
+                  />
+                </router-link>
+              </OTooltip>
             </nav>
           </template>
 
@@ -252,150 +267,47 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               {{ t("home.explore") }}
             </div>
             <nav class="flex flex-col">
-              <router-link
-                v-if="canView('logs')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'logs',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-logs"
+              <OTooltip
+                v-for="row in exploreRows"
+                :key="row.name"
+                :content="lockedReason(row.feature)"
+                :disabled="!isLocked(row.feature)"
               >
-                <span
-                  class="rounded-default bg-icon-chip-success-bg text-icon-chip-success-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
+                <router-link
+                  class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
+                  :to="{
+                    name: row.name,
+                    query: { org_identifier: store.state.selectedOrganization?.identifier },
+                  }"
+                  :data-test="`home-usage-tab-explore-${row.test}`"
                 >
-                  <OIcon name="search" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("menu.search")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
-              <router-link
-                v-if="canView('traces')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'traces',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-traces"
-              >
-                <span
-                  class="rounded-default bg-icon-chip-primary-bg text-icon-chip-primary-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
-                >
-                  <OIcon name="account-tree" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("menu.traces")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
-              <router-link
-                v-if="canView('metrics')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'metrics',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-metrics"
-              >
-                <span
-                  class="rounded-default bg-icon-chip-success-bg text-icon-chip-success-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
-                >
-                  <OIcon name="bar-chart" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("menu.metrics")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
-              <router-link
-                v-if="canView('RUM')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'RUM',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-rum"
-              >
-                <span
-                  class="rounded-default bg-icon-chip-primary-bg text-icon-chip-primary-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
-                >
-                  <OIcon name="devices" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  raw("RUM")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
-              <router-link
-                v-if="canView('incidentList')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'incidentList',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-incidents"
-              >
-                <span
-                  class="rounded-default bg-icon-chip-warning-bg text-icon-chip-warning-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
-                >
-                  <OIcon name="notifications-active" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("menu.incidents")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
-              <router-link
-                v-if="canView('reports')"
-                class="group rounded-default hover:bg-table-row-hover-bg -mx-2 flex items-center gap-2.5 px-2 py-2 text-inherit no-underline transition-colors"
-                :to="{
-                  name: 'reports',
-                  query: { org_identifier: store.state.selectedOrganization?.identifier },
-                }"
-                data-test="home-usage-tab-explore-reports"
-              >
-                <span
-                  class="rounded-default bg-icon-chip-warning-bg text-icon-chip-warning-text inline-flex h-8 w-8 shrink-0 items-center justify-center"
-                  aria-hidden="true"
-                >
-                  <OIcon name="description" size="sm" />
-                </span>
-                <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
-                  t("menu.report")
-                }}</OTruncatedText>
-                <OIcon
-                  name="chevron-right"
-                  size="sm"
-                  class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
-                />
-              </router-link>
+                  <span
+                    class="rounded-default inline-flex h-8 w-8 shrink-0 items-center justify-center"
+                    :class="row.chip"
+                    aria-hidden="true"
+                  >
+                    <OIcon :name="row.icon" size="sm" />
+                  </span>
+                  <OTruncatedText class="text-text-body flex-1 text-sm font-medium">{{
+                    row.label
+                  }}</OTruncatedText>
+                  <template v-if="isLocked(row.feature)">
+                    <OIcon
+                      name="lock"
+                      size="xs"
+                      class="text-icon-locked shrink-0"
+                      :data-test="`home-usage-tab-explore-${row.test}-lock`"
+                    />
+                    <span class="sr-only">{{ lockedReason(row.feature) }}</span>
+                  </template>
+                  <OIcon
+                    v-else
+                    name="chevron-right"
+                    size="sm"
+                    class="text-text-disabled group-hover:text-text-secondary shrink-0 transition-transform group-hover:translate-x-0.5"
+                  />
+                </router-link>
+              </OTooltip>
             </nav>
           </template>
         </aside>
@@ -420,11 +332,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               variant="ghost"
               size="icon-circle"
               class="relative"
-              :aria-label="t('home.viewButton')"
-              :title="t('home.viewButton')"
+              :aria-label="viewLabel('alerts')"
+              :title="viewLabel('alerts')"
               data-test="home-usage-tab-view-alerts-btn"
             >
-              <OIcon name="arrow-forward" size="sm" />
+              <OIcon
+                :name="isLocked('alerts') ? 'lock' : 'arrow-forward'"
+                size="sm"
+                :class="{ 'text-icon-locked': isLocked('alerts') }"
+              />
               <router-link
                 exact
                 :to="{
@@ -432,7 +348,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   query: { org_identifier: store.state.selectedOrganization?.identifier },
                 }"
                 class="absolute inset-0"
-                :aria-label="t('home.viewButton')"
+                :aria-label="viewLabel('alerts')"
               ></router-link>
             </OButton>
           </div>
@@ -486,11 +402,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               variant="ghost"
               size="icon-circle"
               class="relative"
-              :aria-label="t('home.viewButton')"
-              :title="t('home.viewButton')"
+              :aria-label="viewLabel('pipelines')"
+              :title="viewLabel('pipelines')"
               data-test="home-usage-tab-view-pipelines-btn"
             >
-              <OIcon name="arrow-forward" size="sm" />
+              <OIcon
+                :name="isLocked('pipelines') ? 'lock' : 'arrow-forward'"
+                size="sm"
+                :class="{ 'text-icon-locked': isLocked('pipelines') }"
+              />
               <router-link
                 exact
                 :to="{
@@ -498,7 +418,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   query: { org_identifier: store.state.selectedOrganization?.identifier },
                 }"
                 class="absolute inset-0"
-                :aria-label="t('home.viewButton')"
+                :aria-label="viewLabel('pipelines')"
               ></router-link>
             </OButton>
           </div>
@@ -570,7 +490,8 @@ import { configFullQuery } from "@/services/config.queries";
 import { orgSummaryQuery } from "@/services/organizations.queries";
 import { queryClient } from "@/composables/query/queryClient";
 import { computed, onMounted, onUnmounted, ref, watch } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import { useStore } from "vuex";
 import { useRouter } from "vue-router";
 import config from "@/aws-exports";
@@ -592,10 +513,80 @@ import KpiCardRow from "@/components/common/KpiCardRow.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import HomeNoDataState from "@/views/HomeNoDataState.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { useLicenseLocks } from "@/composables/useFeatureLock";
 
 const { t } = useI18nTyped();
 const store = useStore();
 const router = useRouter();
+const { isLocked, lockedReason } = useLicenseLocks();
+
+const viewLabel = (feature: string) =>
+  isLocked(feature) ? lockedReason(feature) : t("home.viewButton");
+
+interface ExploreRow {
+  name: string;
+  test: string;
+  feature: string;
+  icon: IconName;
+  chip: string;
+  label: I18nText;
+}
+
+const exploreRows = computed(() =>
+  (
+    [
+      {
+        name: "logs",
+        test: "logs",
+        feature: "logs",
+        icon: "search",
+        chip: "bg-icon-chip-success-bg text-icon-chip-success-text",
+        label: t("menu.search"),
+      },
+      {
+        name: "traces",
+        test: "traces",
+        feature: "traces",
+        icon: "account-tree",
+        chip: "bg-icon-chip-primary-bg text-icon-chip-primary-text",
+        label: t("menu.traces"),
+      },
+      {
+        name: "metrics",
+        test: "metrics",
+        feature: "metrics",
+        icon: "bar-chart",
+        chip: "bg-icon-chip-success-bg text-icon-chip-success-text",
+        label: t("menu.metrics"),
+      },
+      {
+        name: "RUM",
+        test: "rum",
+        feature: "rum",
+        icon: "devices",
+        chip: "bg-icon-chip-primary-bg text-icon-chip-primary-text",
+        label: raw("RUM"),
+      },
+      {
+        name: "incidentList",
+        test: "incidents",
+        feature: "incidents",
+        icon: "notifications-active",
+        chip: "bg-icon-chip-warning-bg text-icon-chip-warning-text",
+        label: t("menu.incidents"),
+      },
+      {
+        name: "reports",
+        test: "reports",
+        feature: "reports",
+        icon: "description",
+        chip: "bg-icon-chip-warning-bg text-icon-chip-warning-text",
+        label: t("menu.report"),
+      },
+    ] as ExploreRow[]
+  ).filter((row) => canView(row.name)),
+);
 
 const summary = ref<any>([]);
 const no_data_ingest = ref(false);
diff --git a/web/src/views/alerts/AlertDetail.spec.ts b/web/src/views/alerts/AlertDetail.spec.ts
index c955fee6f7..79f27bcbe1 100644
--- a/web/src/views/alerts/AlertDetail.spec.ts
+++ b/web/src/views/alerts/AlertDetail.spec.ts
@@ -597,6 +597,33 @@ describe("AlertDetail — anomaly alerts", () => {
     wrapper = await mountView({ alert: makeSimpleAlert() });
     expect(wrapper.find('[data-test="alerts-alertdetail-tab-charts"]').exists()).toBe(false);
   });
+
+  it("locks the charts tab and Edit while anomaly_detection is license-locked", async () => {
+    store.state.zoConfig.features = { anomaly_detection: "locked" };
+    try {
+      wrapper = await mountView({ alert: makeAnomalyAlert() });
+      expect(wrapper.find('[data-test="alerts-alertdetail-anomaly-license-denied"]').exists()).toBe(
+        true,
+      );
+      expect(wrapper.findComponent({ name: "AnomalyDetectionChart" }).exists()).toBe(false);
+      const edit = wrapper.find('[data-test="alerts-alertdetail-edit"]');
+      expect(edit.attributes("disabled")).toBeDefined();
+      expect(wrapper.find('[data-test="alerts-alertdetail-edit-lock"]').exists()).toBe(true);
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
+
+  it("keeps Edit open on a scheduled alert while anomaly_detection is license-locked", async () => {
+    store.state.zoConfig.features = { anomaly_detection: "locked" };
+    try {
+      wrapper = await mountView({ alert: makeSimpleAlert() });
+      const edit = wrapper.find('[data-test="alerts-alertdetail-edit"]');
+      expect(edit.attributes("disabled")).toBeUndefined();
+    } finally {
+      delete store.state.zoConfig.features;
+    }
+  });
 });
 
 describe("AlertDetail — Acknowledge and Mute in the header (MK-1, MK-2)", () => {
diff --git a/web/src/views/alerts/AlertDetail.vue b/web/src/views/alerts/AlertDetail.vue
index 4ce221cd21..ec536ba1c6 100644
--- a/web/src/views/alerts/AlertDetail.vue
+++ b/web/src/views/alerts/AlertDetail.vue
@@ -101,8 +101,23 @@
         :groups="firingGroups"
         @changed="onAckMuteChanged"
       />
+      <OTooltip v-if="!notFound && editAnomalyLocked" :content="anomalyLockedReason">
+        <span class="inline-flex">
+          <OButton variant="outline" size="sm-action" disabled data-test="alerts-alertdetail-edit">
+            <template #icon-left>
+              <OIcon
+                name="lock"
+                class="lock-chip"
+                size="sm"
+                data-test="alerts-alertdetail-edit-lock"
+              />
+            </template>
+            {{ t("alerts.edit") }}
+          </OButton>
+        </span>
+      </OTooltip>
       <OButton
-        v-if="!notFound"
+        v-else-if="!notFound"
         variant="outline"
         size="sm-action"
         icon-left="edit"
@@ -258,6 +273,8 @@
             name="charts"
             :label="t('alerts.anomaly.chartsTab')"
             icon="bar-chart"
+            :suffix-icon="anomalyLocked ? 'lock' : undefined"
+            :tooltip="anomalyLocked ? anomalyLockedReason : undefined"
             data-test="alerts-alertdetail-tab-charts"
           />
           <OTab name="history" :label="t('alerts.history')" icon="history" />
@@ -292,7 +309,12 @@
              repeat the same non-answer on every line. -->
           <OTabPanel v-if="isAnomalyAlert" name="charts" stretch>
             <OContent class="h-full overflow-y-auto py-4">
-              <AnomalyDetectionChart v-if="alert" :alert="alert" :anomaly-id="alertId" />
+              <LicenseDeniedState
+                v-if="anomalyLocked"
+                :features="['anomaly_detection']"
+                data-test="alerts-alertdetail-anomaly-license-denied"
+              />
+              <AnomalyDetectionChart v-else-if="alert" :alert="alert" :anomaly-id="alertId" />
             </OContent>
           </OTabPanel>
 
@@ -390,6 +412,9 @@ import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
 import OTabPanels from "@/lib/navigation/Tabs/OTabPanels.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import LicenseDeniedState from "@/components/common/LicenseDeniedState.vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
 import type { StatItem } from "@/lib/data/StatStrip/OStatStrip.types";
 import alertsService from "@/services/alerts";
 import { alertAcksQuery, alertsListQuery } from "@/services/alerts.queries";
@@ -422,6 +447,8 @@ const { t } = useI18nTyped();
 const route = useRoute();
 const router = useRouter();
 const store = useStore();
+const { locked: anomalyLocked, lockedReason: anomalyLockedReason } =
+  useLicenseLock("anomaly_detection");
 
 const alertId = computed(() => String(route.params.alert_id || ""));
 const orgId = computed(() => store.state.selectedOrganization?.identifier);
@@ -529,13 +556,17 @@ const backTarget = computed(() => ({
 // Plain row-click still lands here — only the EDIT action diverts to the SLO
 // page — so this page has to describe an alert with no stream and no query.
 const isSloAlertView = computed(() => isSloAlert(alert.value));
+// Anomaly configs and SLO alerts are edited on anomaly-detection pages.
+const editAnomalyLocked = computed(
+  () => anomalyLocked.value && (isAnomalyAlert.value || isSloAlertView.value),
+);
 const sloId = computed(() => sloIdOf(alert.value));
 // The alert GET carries `slo_condition` but not the SLO's NAME, which is the
 // one thing a human recognises. One extra fetch; failure degrades to the id.
 const sloName = ref("");
 
 const fetchSloName = async () => {
-  if (!orgId.value || !sloId.value) return;
+  if (!orgId.value || !sloId.value || anomalyLocked.value) return;
   try {
     const res = await sloService.get(orgId.value, sloId.value);
     sloName.value = res.data?.name || "";
diff --git a/web/src/views/slos/SloList.vue b/web/src/views/slos/SloList.vue
index 6c0d379191..4984d5bf16 100644
--- a/web/src/views/slos/SloList.vue
+++ b/web/src/views/slos/SloList.vue
@@ -58,7 +58,7 @@
     <!-- SLOs share the ALERT folder namespace (there is no FolderType::Slos),
          so `type="alerts"` is not a copy-paste slip — it is what makes a
          "payments" folder hold that team's alerts and its SLOs together. -->
-    <template #sidebar>
+    <template v-if="!anomalyLocked" #sidebar>
       <FolderList type="alerts" :drawer-on-mobile="false" @update:activeFolderId="onFolderChange" />
     </template>
 
@@ -72,6 +72,7 @@
       :loading="loading"
       :loading-reset-key="activeFolderId"
       :error="error"
+      :forbidden="forbidden"
       :page-size="pageSize"
       :page-size-options="[25, 50, 100]"
       :sort-by="sortBy"
@@ -549,6 +550,8 @@ import { slosQuery } from "@/services/slos.queries";
 // stays off the query layer and calls the endpoint directly.
 import sloService from "@/services/slos";
 import { computed, onMounted, ref, nextTick, watch } from "vue";
+import { useLicenseLock } from "@/composables/useFeatureLock";
+import { forbiddenState, type ForbiddenState } from "@/utils/featureGate";
 import { useDowntimesEnabled } from "@/composables/downtimes/useDowntimesEnabled";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import { useRoute, useRouter } from "vue-router";
@@ -616,10 +619,13 @@ const store = useStore();
 const readOrg = ref<string>(store.state.selectedOrganization?.identifier ?? "");
 const readFolder = ref<string | undefined>(undefined);
 
+// SLOs are licensed under anomaly detection; a locked license reads nothing and says so.
+const { locked: anomalyLocked } = useLicenseLock("anomaly_detection");
+
 const slosList = useQuery(() =>
   // Held until the folder resolves: the reactive key would otherwise fetch an unscoped list first.
   Object.assign(slosQuery(readOrg.value, readFolder.value), {
-    enabled: !!readOrg.value && readFolder.value !== undefined,
+    enabled: !!readOrg.value && readFolder.value !== undefined && !anomalyLocked.value,
   }),
 );
 
@@ -627,7 +633,8 @@ const slosList = useQuery(() =>
 // scope repaints these rows with no wiring here.
 const rows = computed<SloListItem[]>(() => (slosList.data.value ?? []) as SloListItem[]);
 
-const loading = slosList.isPending;
+// A disabled query stays pending forever, so a locked list must not read that as loading.
+const loading = computed(() => !anomalyLocked.value && slosList.isPending.value);
 // A request in flight while rows stay on screen — the refresh button's spinner.
 // `loading` is the skeleton, which only a cold read wants.
 const fetching = slosList.isFetching;
@@ -638,7 +645,11 @@ const lastUpdatedAt = slosList.dataUpdatedAt;
 // query's error and nothing else, so the table used to render an empty list
 // with no explanation.
 const loadError = ref<string | null>(null);
+const forbidden = computed<ForbiddenState>(() =>
+  anomalyLocked.value ? ["anomaly_detection"] : forbiddenState(slosList.error.value),
+);
 const error = computed<string | null>(() => {
+  if (forbidden.value) return null;
   if (loadError.value) return loadError.value;
   const e = slosList.error.value as any;
   if (!e) return null;
@@ -1000,7 +1011,7 @@ const refresh = () => load(null, undefined, true);
 // fall back to the current org and active folder — the folder-change path is the
 // only caller that passes a folder the refs have not caught up with yet.
 async function load(orgId?: string | null, folderId?: string, force = false) {
-  if (!org.value) return;
+  if (!org.value || anomalyLocked.value) return;
   loadError.value = null;
   // sometimes the folder id might not be updated so passed via
   // query params.
diff --git a/web/src/views/slos/SloListLicense.spec.ts b/web/src/views/slos/SloListLicense.spec.ts
new file mode 100644
index 0000000000..fea3b52143
--- /dev/null
+++ b/web/src/views/slos/SloListLicense.spec.ts
@@ -0,0 +1,98 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
+import { mount, flushPromises } from "@vue/test-utils";
+
+vi.mock("@/services/slos", () => ({
+  default: { list: vi.fn(), delete: vi.fn(), move: vi.fn(), setEnabled: vi.fn() },
+}));
+vi.mock("@/services/alerts", () => ({ default: { list_by_slo: vi.fn() } }));
+
+import SloList from "@/views/slos/SloList.vue";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import router from "@/test/unit/helpers/router";
+import sloService from "@/services/slos";
+import { queryClient } from "@/composables/query/queryClient";
+
+async function mountList() {
+  const wrapper = mount(SloList, {
+    global: {
+      plugins: [i18n, store, router],
+      stubs: {
+        FolderList: { template: '<div data-test="stub-folder-list"></div>' },
+        SelectFolderDropDown: true,
+      },
+    },
+  });
+  await flushPromises();
+  // OTable holds its skeleton for a minimum time before it shows an empty or forbidden state.
+  await new Promise((r) => setTimeout(r, 75));
+  await flushPromises();
+  return wrapper;
+}
+
+describe("SloList license gating", () => {
+  let wrapper: any;
+
+  beforeEach(() => {
+    queryClient.clear();
+    vi.clearAllMocks();
+    (router as any).currentRoute.value.query = {};
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    delete (store.state as any).zoConfig.features;
+  });
+
+  it("reads nothing and shows the license state while anomaly_detection is locked", async () => {
+    (store.state as any).zoConfig.features = { anomaly_detection: "locked" };
+    wrapper = await mountList();
+
+    expect(sloService.list).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-test="stub-folder-list"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="o2-table-forbidden"]').exists()).toBe(true);
+    expect(wrapper.text()).not.toContain("Retry");
+  });
+
+  it("shows the license state, not the raw error, when the list is license-denied", async () => {
+    vi.mocked(sloService.list).mockRejectedValue({
+      response: {
+        status: 403,
+        data: {
+          code: 40001,
+          message: "Features not included in your license: anomaly_detection",
+          error_detail: "anomaly_detection",
+        },
+      },
+    });
+    wrapper = await mountList();
+
+    expect((wrapper.vm as any).forbidden).toEqual(["anomaly_detection"]);
+    expect((wrapper.vm as any).error).toBeNull();
+    expect(wrapper.text()).not.toContain("Features not included in your license");
+  });
+
+  it("reads the list while anomaly_detection is enabled", async () => {
+    vi.mocked(sloService.list).mockResolvedValue({ data: { list: [] } } as any);
+    wrapper = await mountList();
+
+    expect(sloService.list).toHaveBeenCalled();
+    expect(wrapper.find('[data-test="stub-folder-list"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="o2-table-forbidden"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/views/synthetics/MonitorRuns.vue b/web/src/views/synthetics/MonitorRuns.vue
index 1c23292a2a..f5629d0e32 100644
--- a/web/src/views/synthetics/MonitorRuns.vue
+++ b/web/src/views/synthetics/MonitorRuns.vue
@@ -87,14 +87,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
     <!-- ── Tabs ──────────────────────────────────────────────────────── -->
     <template v-else>
-      <OTabs v-model="activeTab" class="px-page-edge border-border-default shrink-0 border-b">
-        <OTab name="overview" data-test="monitor-runs-tab-overview">
-          {{ t("synthetics.runs.tabOverview") }}
-        </OTab>
-        <OTab v-if="isBrowser" name="steps" data-test="monitor-runs-tab-steps">
-          {{ t("synthetics.runs.tabSteps") }}
-        </OTab>
-      </OTabs>
+      <FeatureLockExempt class="contents">
+        <OTabs v-model="activeTab" class="px-page-edge border-border-default shrink-0 border-b">
+          <OTab name="overview" data-test="monitor-runs-tab-overview">
+            {{ t("synthetics.runs.tabOverview") }}
+          </OTab>
+          <OTab v-if="isBrowser" name="steps" data-test="monitor-runs-tab-steps">
+            {{ t("synthetics.runs.tabSteps") }}
+          </OTab>
+        </OTabs>
+      </FeatureLockExempt>
 
       <div class="min-h-0 flex-1">
         <OTabPanels v-model="activeTab" grow scroll="y" class="h-full min-h-0">
@@ -1126,6 +1128,7 @@ import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTabPanels from "@/lib/navigation/Tabs/OTabPanels.vue";
 import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import OCard from "@/lib/core/Card/OCard.vue";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
diff --git a/web/src/views/synthetics/PrivateLocations.vue b/web/src/views/synthetics/PrivateLocations.vue
index b145fed5bf..6c749fe358 100644
--- a/web/src/views/synthetics/PrivateLocations.vue
+++ b/web/src/views/synthetics/PrivateLocations.vue
@@ -22,6 +22,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :columns="columns"
       row-key="id"
       :loading="loading"
+      :forbidden="forbidden"
       pagination="client"
       :page-size="pageSize"
       :page-size-options="[10, 20, 50]"
@@ -230,6 +231,7 @@ import { useRouter } from "vue-router";
 import { useStore } from "vuex";
 import { raw, useI18nTyped } from "@/types/i18n";
 import OTable from "@/lib/core/Table/OTable.vue";
+import type { ForbiddenState } from "@/utils/featureGate";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
@@ -249,6 +251,7 @@ import { syntheticsPrivateLocationRoute } from "@/utils/synthetics/routes";
 const props = defineProps<{
   locations: SyntheticLocation[];
   loading: boolean;
+  forbidden?: ForbiddenState;
 }>();
 const emit = defineEmits<{
   (e: "refresh"): void;
diff --git a/web/src/views/synthetics/RunDetail.vue b/web/src/views/synthetics/RunDetail.vue
index 0de8ae7c56..8cb572f4a7 100644
--- a/web/src/views/synthetics/RunDetail.vue
+++ b/web/src/views/synthetics/RunDetail.vue
@@ -176,26 +176,28 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <!-- Steps and Evidence are siblings, not stacked. Stacking them pushed
              a 158-row event list above the step table and broke the drawer's
              scroll: OTabPanels owns the scroll container (`grow scroll="y"`). -->
-        <OTabs
-          v-if="!loading"
-          v-model="detailTab"
-          class="border-border-default mt-2 shrink-0 border-b px-2"
-        >
-          <OTab name="steps" data-test="synthetics-run-detail-tab-steps">
-            {{ t("synthetics.runs.tabSteps") }}
-            <OBadge variant="default" size="sm">{{ steps.length }}</OBadge>
-            <OBadge
-              v-if="skippedStepCount > 0"
-              variant="default"
-              size="sm"
-              data-test="synthetics-run-detail-skipped-count"
-              >{{ t("synthetics.runDetail.skippedCount", { n: skippedStepCount }) }}</OBadge
-            >
-          </OTab>
-          <OTab name="evidence" data-test="synthetics-run-detail-tab-evidence">
-            {{ t("synthetics.runDetail.evidenceSection") }}
-          </OTab>
-        </OTabs>
+        <FeatureLockExempt class="contents">
+          <OTabs
+            v-if="!loading"
+            v-model="detailTab"
+            class="border-border-default mt-2 shrink-0 border-b px-2"
+          >
+            <OTab name="steps" data-test="synthetics-run-detail-tab-steps">
+              {{ t("synthetics.runs.tabSteps") }}
+              <OBadge variant="default" size="sm">{{ steps.length }}</OBadge>
+              <OBadge
+                v-if="skippedStepCount > 0"
+                variant="default"
+                size="sm"
+                data-test="synthetics-run-detail-skipped-count"
+                >{{ t("synthetics.runDetail.skippedCount", { n: skippedStepCount }) }}</OBadge
+              >
+            </OTab>
+            <OTab name="evidence" data-test="synthetics-run-detail-tab-evidence">
+              {{ t("synthetics.runDetail.evidenceSection") }}
+            </OTab>
+          </OTabs>
+        </FeatureLockExempt>
 
         <div class="min-h-0 flex-1">
           <OTabPanels v-model="detailTab" grow scroll="y" class="h-full min-h-0">
@@ -704,6 +706,7 @@ import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
 import OTabPanels from "@/lib/navigation/Tabs/OTabPanels.vue";
 import OTabPanel from "@/lib/navigation/Tabs/OTabPanel.vue";
+import FeatureLockExempt from "@/components/common/FeatureLockExempt.vue";
 import {
   buildAttemptViews,
   effectiveSelector,
diff --git a/web/src/views/synthetics/status-pages/StatusPageImageField.vue b/web/src/views/synthetics/status-pages/StatusPageImageField.vue
index 16681fecf7..4e0a4418df 100644
--- a/web/src/views/synthetics/status-pages/StatusPageImageField.vue
+++ b/web/src/views/synthetics/status-pages/StatusPageImageField.vue
@@ -22,7 +22,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         v-if="locked"
         name="lock"
         size="xs"
-        class="text-warning-600"
+        class="lock-chip"
         aria-hidden="true"
         :data-test="`${dataTest}-lock`"
       />
diff --git a/web/src/views/synthetics/status-pages/StatusPagesList.vue b/web/src/views/synthetics/status-pages/StatusPagesList.vue
index ee75be8513..e1561fa0f2 100644
--- a/web/src/views/synthetics/status-pages/StatusPagesList.vue
+++ b/web/src/views/synthetics/status-pages/StatusPagesList.vue
@@ -20,6 +20,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :columns="columns"
       :data="filteredPages"
       :loading="loading"
+      :forbidden="forbidden"
       pagination="client"
       :page-size="20"
       :page-size-options="[20, 50, 100]"
@@ -183,7 +184,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <OIcon
                   name="lock"
                   size="xs"
-                  class="ms-auto"
+                  class="lock-chip ms-auto"
                   aria-hidden="true"
                   :data-test="`status-pages-post-update-lock-${(row as any).id}`"
                 />
@@ -204,7 +205,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <OIcon
                   name="lock"
                   size="xs"
-                  class="ms-auto"
+                  class="lock-chip ms-auto"
                   aria-hidden="true"
                   :data-test="`status-pages-view-updates-lock-${(row as any).id}`"
                 />
@@ -235,7 +236,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 <OIcon
                   name="lock"
                   size="xs"
-                  class="ms-auto"
+                  class="lock-chip ms-auto"
                   aria-hidden="true"
                   :data-test="`status-pages-domains-lock-${(row as any).id}`"
                 />
@@ -283,6 +284,7 @@ import { computed, ref } from "vue";
 import config from "@/aws-exports";
 import { raw, useI18nTyped } from "@/types/i18n";
 import OTable from "@/lib/core/Table/OTable.vue";
+import type { ForbiddenState } from "@/utils/featureGate";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import { COL } from "@/lib/core/Table/OTable.types";
 import OInput from "@/lib/forms/Input/OInput.vue";
@@ -306,9 +308,10 @@ const props = withDefaults(
   defineProps<{
     pages: StatusPageListItem[];
     loading?: boolean;
+    forbidden?: ForbiddenState;
     timezone?: string;
   }>(),
-  { loading: false, timezone: "UTC" },
+  { loading: false, forbidden: false, timezone: "UTC" },
 );
 
 const emit = defineEmits<{