diff --git a/frontend/src/lib/components/FlowBuilder.svelte b/frontend/src/lib/components/FlowBuilder.svelte
index f533fcc1f0..73ce91083d 100644
--- a/frontend/src/lib/components/FlowBuilder.svelte
+++ b/frontend/src/lib/components/FlowBuilder.svelte
@@ -18,7 +18,13 @@
 		linkedAgentToolsVersion,
 		migrateLinkedAgentToolsScope
 	} from '$lib/components/flows/linkedAgentToolsStore.svelte'
-	import { enterpriseLicense, userStore, userWorkspaces, usedTriggerKinds } from '$lib/stores'
+	import {
+		enterpriseLicense,
+		userStore,
+		userWorkspaces,
+		usedTriggerKinds,
+		workspaceStore
+	} from '$lib/stores'
 	import {
 		generateRandomString,
 		orderedJsonStringify,
@@ -552,15 +558,14 @@
 				// One lookup for the whole list: an agent lives in a folder, and the groups and admin
 				// flag that answer for it are per workspace, so the nav user would answer for the wrong
 				// membership when a session editor operates on another workspace.
-				const user = await getUserExt(opWorkspace ?? '').catch(() => undefined)
+				const user =
+					(await getUserExt(opWorkspace ?? '')) ??
+					(opWorkspace === $workspaceStore ? $userStore : undefined)
 				const operatorSettings = $userWorkspaces.find(
 					(w) => w.id === opWorkspace
 				)?.operator_settings
 				agentCanWrite = Object.fromEntries(
-					draftAgents.map((a) => [
-						a.path,
-						agentDraftCanWrite(a, user ?? $userStore ?? undefined, operatorSettings)
-					])
+					draftAgents.map((a) => [a.path, agentDraftCanWrite(a, user, operatorSettings)])
 				)
 				// The path is passed, so a draft that renames the agent is refused here too: a rename is
 				// the agent editor's to deploy, and this dialog lists the agent under the path the flow
diff --git a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
index 2f94e086ad..0d4fb03704 100644
--- a/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
+++ b/frontend/src/lib/components/apps/editor/InWorkspaceAppViewer.svelte
@@ -18,7 +18,7 @@
 	import type { Item } from '$lib/utils'
 	import { Button } from '$lib/components/common'
 	import { AppService, OpenAPI } from '$lib/gen'
-	import { userStore, type UserExt } from '$lib/stores'
+	import { userStore, workspaceStore, type UserExt } from '$lib/stores'
 	import { getUserExt } from '$lib/user'
 	import { ExternalLink, Pen } from 'lucide-svelte'
 	import { page } from '$app/state'
@@ -254,7 +254,7 @@
 			<PublicApp
 				{app}
 				{workspace}
-				user={appUser ?? $userStore}
+				user={appUser ?? (workspace === $workspaceStore ? $userStore : undefined)}
 				{notExists}
 				{noPermission}
 				jwtError={false}
diff --git a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
index d60c2262ec..86b2ea57ed 100644
--- a/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppInlineScriptRunnable.svelte
@@ -28,7 +28,6 @@
 	import LogViewer from '$lib/components/LogViewer.svelte'
 	import DisplayResult from '$lib/components/DisplayResult.svelte'
 	import RunButton from '$lib/components/RunButton.svelte'
-	import { userStore } from '$lib/stores'
 	import { isHubFlowPath } from '$lib/utils'
 	import { sendUserToast } from '$lib/toast'
 	import { rawAppPreviewModules } from './utils'
@@ -156,15 +155,15 @@
 	function getCtxValue(expr: string): any {
 		switch (expr) {
 			case 'username':
-				return $userStore?.username ?? ''
+				return actingUser?.username ?? ''
 			case 'email':
-				return $userStore?.email ?? ''
+				return actingUser?.email ?? ''
 			case 'groups':
 				return actingUser?.groups ?? []
 			case 'workspace':
 				return opWs ?? ''
 			case 'author':
-				return $userStore?.email ?? '' // In editor, author is the current user
+				return actingUser?.email ?? '' // In editor, author is the current user
 			default:
 				return ''
 		}