diff --git a/cli/src/commands/flow/flow.ts b/cli/src/commands/flow/flow.ts
index b8eec79924..9c5be03631 100644
--- a/cli/src/commands/flow/flow.ts
+++ b/cli/src/commands/flow/flow.ts
@@ -72,10 +72,10 @@ export async function pushFlow(
   const preserveFields: Partial<OpenFlowWPath> = {};
   if (permissionedAsContext?.userIsAdminOrDeployer) {
     if (flow) {
-      // Updating: preserve the remote's on_behalf_of_email
-      preserveFields.preserve_on_behalf_of = true;
+      // Updating: preserve the remote's on_behalf_of_email (only if it has one)
       if (flow.on_behalf_of_email) {
         preserveFields.on_behalf_of_email = flow.on_behalf_of_email;
+        preserveFields.preserve_on_behalf_of = true;
       }
     } else {
       // Creating: apply defaultPermissionedAs rule if one matches
diff --git a/cli/src/commands/script/script.ts b/cli/src/commands/script/script.ts
index d1ad8b78fe..9dbbb04747 100644
--- a/cli/src/commands/script/script.ts
+++ b/cli/src/commands/script/script.ts
@@ -429,10 +429,10 @@ export async function handleFile(
     // Add preserve flags for permissioned_as
     if (permissionedAsContext?.userIsAdminOrDeployer) {
       if (remote) {
-        // Updating: preserve the remote's on_behalf_of_email
-        requestBodyCommon.preserve_on_behalf_of = true;
+        // Updating: preserve the remote's on_behalf_of_email (only if it has one)
         if (remote.on_behalf_of_email) {
           requestBodyCommon.on_behalf_of_email = remote.on_behalf_of_email;
+          requestBodyCommon.preserve_on_behalf_of = true;
         }
       } else {
         // Creating: apply defaultPermissionedAs rule if one matches
diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index c80cce5caf..d49b2bbc7e 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -538,6 +538,7 @@ function ZipFSElement(
   resourceTypeToFormatExtension: Record<string, string>,
   resourceTypeToIsFileset: Record<string, boolean>,
   ignoreCodebaseChanges: boolean,
+  stripOnBehalfOf: boolean,
 ): DynFSElement {
   async function _internal_file(
     p: string,
@@ -622,6 +623,10 @@ function ZipFSElement(
               };
             }
 
+            if (stripOnBehalfOf) {
+              delete (flow as any).on_behalf_of_email;
+            }
+
             yield {
               isDirectory: false,
               path: path.join(finalPath, "flow.yaml"),
@@ -894,6 +899,9 @@ function ZipFSElement(
             if (ignoreCodebaseChanges && parsed["codebase"]) {
               parsed["codebase"] = undefined;
             }
+            if (stripOnBehalfOf) {
+              delete parsed["on_behalf_of_email"];
+            }
             return useYaml
               ? yamlStringify(parsed, yamlOptions)
               : JSON.stringify(parsed, null, 2);
@@ -1844,6 +1852,7 @@ export async function pull(
     resourceTypeToFormatExtension,
     resourceTypeToIsFileset,
     true,
+    parseFloat(opts.version ?? "0") >= 0.1,
   );
 
   const local = !opts.stateful
@@ -2373,6 +2382,7 @@ export async function push(
     resourceTypeToFormatExtension,
     resourceTypeToIsFileset,
     false,
+    parseFloat(opts.version ?? "0") >= 0.1,
   );
 
   const local = await FSFSElement(path.join(process.cwd(), ""), codebases, false);
@@ -2573,7 +2583,7 @@ export async function push(
 
     // Build permissioned_as context (only when respectVirtualUserPermissions is enabled)
     let permissionedAsContext: PermissionedAsContext | undefined = undefined;
-    if (opts.respectVirtualUserPermissions) {
+    if (opts.version && parseFloat(opts.version) >= 0.1) {
       const user = await wmill.whoami({ workspace: workspace.workspaceId });
       const userIsAdminOrDeployer =
         user.is_admin || (user.groups ?? []).includes("wm_deployers");
@@ -2910,10 +2920,13 @@ export async function push(
                   });
                   break;
                 case "resource":
+                  console.log("ASDASDASDSAD")
+                  log.error("Deleting resourceee");
                   await wmill.deleteResource({
                     workspace: workspaceId,
                     path: removeSuffix(target, ".resource.json"),
                   });
+                  log.error("no reach here right?")
                   break;
                 case "resource-type":
                   await wmill.deleteResourceType({
@@ -3052,6 +3065,7 @@ export async function push(
                   break;
                 }
                 case "variable":
+                  log.error("Deleting variableeee");
                   await wmill.deleteVariable({
                     workspace: workspaceId,
                     path: removeSuffix(target, ".variable.json"),
diff --git a/cli/src/core/conf.ts b/cli/src/core/conf.ts
index cff71fefd6..c405fe323e 100644
--- a/cli/src/core/conf.ts
+++ b/cli/src/core/conf.ts
@@ -104,7 +104,7 @@ export interface SyncOptions {
   lint?: boolean;
   locksRequired?: boolean;
   defaultPermissionedAs?: PermissionedAsRule[];
-  respectVirtualUserPermissions?: boolean;
+  version?: string;
 }
 
 export interface Codebase {
@@ -353,7 +353,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
       | "includeSettings"
       | "includeKey"
       | "nonDottedPaths"
-      | "respectVirtualUserPermissions"
+      | "version"
     >
   >
 > = {
@@ -377,7 +377,7 @@ export const DEFAULT_SYNC_OPTIONS: Readonly<
   includeKey: false,
   skipWorkspaceDependencies: false,
   nonDottedPaths: false,
-  respectVirtualUserPermissions: true,
+  version: "0.1",
 } as const;
 
 export async function mergeConfigWithConfigFile<T>(