diff --git a/cli/src/commands/sync/sync.ts b/cli/src/commands/sync/sync.ts
index d49b2bbc7e..6dab7c88bf 100644
--- a/cli/src/commands/sync/sync.ts
+++ b/cli/src/commands/sync/sync.ts
@@ -119,7 +119,10 @@ async function resolveEffectiveSyncOptions(
   promotion?: string,
   branchOverride?: string,
 ): Promise<SyncOptions> {
-  return await getEffectiveSettings(localConfig, promotion, false, false, branchOverride);
+  return await getEffectiveSettings(localConfig, promotion, false, false, branchOverride, {
+    workspaceId: workspace.workspaceId,
+    remote: workspace.remote,
+  });
 }
 
 type DynFSElement = {
@@ -2920,13 +2923,10 @@ export async function push(
                   });
                   break;
                 case "resource":
-                  console.log("ASDASDASDSAD")
-                  log.error("Deleting resourceee");
                   await wmill.deleteResource({
                     workspace: workspaceId,
                     path: removeSuffix(target, ".resource.json"),
                   });
-                  log.error("no reach here right?")
                   break;
                 case "resource-type":
                   await wmill.deleteResourceType({
@@ -3065,7 +3065,6 @@ export async function push(
                   break;
                 }
                 case "variable":
-                  log.error("Deleting variableeee");
                   await wmill.deleteVariable({
                     workspace: workspaceId,
                     path: removeSuffix(target, ".variable.json"),
diff --git a/cli/src/core/conf.ts b/cli/src/core/conf.ts
index c405fe323e..f49d501276 100644
--- a/cli/src/core/conf.ts
+++ b/cli/src/core/conf.ts
@@ -509,7 +509,8 @@ export async function getEffectiveSettings(
   promotion?: string,
   skipBranchValidation?: boolean,
   suppressLogs?: boolean,
-  branchOverride?: string
+  branchOverride?: string,
+  targetWorkspace?: { workspaceId: string; remote: string },
 ): Promise<SyncOptions> {
   // Start with top-level settings from config
   const { gitBranches, ...topLevelSettings } = config;
@@ -597,5 +598,27 @@ export async function getEffectiveSettings(
     );
   }
 
+  // If a target workspace is provided, resolve defaultPermissionedAs from the
+  // branch config that matches it (rules are workspace-specific)
+  if (targetWorkspace && gitBranches) {
+    const matchingEntry = Object.entries(gitBranches).find(
+      ([_, branchConfig]) =>
+        branchConfig.workspaceId === targetWorkspace.workspaceId &&
+        branchConfig.baseUrl === targetWorkspace.remote
+    );
+    if (matchingEntry) {
+      const [, branchConfig] = matchingEntry;
+      if (branchConfig.defaultPermissionedAs) {
+        effective.defaultPermissionedAs = branchConfig.defaultPermissionedAs;
+      } else {
+        // Matching branch has no rules — fall back to root-level
+        effective.defaultPermissionedAs = topLevelSettings.defaultPermissionedAs;
+      }
+    } else {
+      // No branch matches the target workspace — use root-level rules
+      effective.defaultPermissionedAs = topLevelSettings.defaultPermissionedAs;
+    }
+  }
+
   return effective;
 }