diff --git a/apps/client/app/features/knowledge/api/knowledgeApi.test.ts b/apps/client/app/features/knowledge/api/knowledgeApi.test.ts
index e892cf9d9..d8d559448 100644
--- a/apps/client/app/features/knowledge/api/knowledgeApi.test.ts
+++ b/apps/client/app/features/knowledge/api/knowledgeApi.test.ts
@@ -371,6 +371,31 @@ describe('knowledgeApi safe failure logging', () => {
 });
 
 describe('knowledgeApi collection management', () => {
+  it('loads the route-safe Workflow Collection picker projection', async () => {
+    vi.mocked(apiClient.get).mockResolvedValueOnce({
+      data: {
+        collections: [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            safe_label: '사내 문서',
+          },
+        ],
+      },
+    });
+
+    const response = await knowledgeApi.getLLMSelectableKnowledgeCollections();
+
+    expect(apiClient.get).toHaveBeenCalledWith(
+      '/knowledge/llm-selectable-collections',
+    );
+    expect(response.collections).toEqual([
+      {
+        id: '11111111-1111-1111-1111-111111111111',
+        safe_label: '사내 문서',
+      },
+    ]);
+  });
+
   it('updates Knowledge Base safe metadata', async () => {
     vi.mocked(apiClient.patch).mockResolvedValueOnce({
       data: {
diff --git a/apps/client/app/features/knowledge/api/knowledgeApi.ts b/apps/client/app/features/knowledge/api/knowledgeApi.ts
index 1f5cbdbf6..2eb88201c 100644
--- a/apps/client/app/features/knowledge/api/knowledgeApi.ts
+++ b/apps/client/app/features/knowledge/api/knowledgeApi.ts
@@ -12,6 +12,8 @@ import {
   KnowledgeCollectionRoleBundle,
   KnowledgeCollectionResponse,
   KnowledgeCollectionListResponse,
+  KnowledgeCollectionLLMSelectableItem,
+  KnowledgeCollectionLLMSelectableResponse,
   KnowledgeCollectionItemResponse,
   KnowledgeCollectionItemsResponse,
   KnowledgeCollectionLinkCandidate,
@@ -174,6 +176,8 @@ export type {
   KnowledgeCollectionRoleBundle,
   KnowledgeCollectionResponse,
   KnowledgeCollectionListResponse,
+  KnowledgeCollectionLLMSelectableItem,
+  KnowledgeCollectionLLMSelectableResponse,
   KnowledgeCollectionItemResponse,
   KnowledgeCollectionItemsResponse,
   KnowledgeCollectionLinkCandidate,
@@ -335,6 +339,18 @@ export const knowledgeApi = {
     }
   },
 
+  // LLM 노드에서 route 권한으로 선택 가능한 Collection의 최소 projection 조회
+  getLLMSelectableKnowledgeCollections:
+    async (): Promise<KnowledgeCollectionLLMSelectableResponse> => {
+      try {
+        const response = await api.get('/knowledge/llm-selectable-collections');
+        return response.data;
+      } catch (error) {
+        logKnowledgeApiFailure('getLLMSelectableKnowledgeCollections', error);
+        throw error;
+      }
+    },
+
   // 지식 상세 조회
   getKnowledgeBase: async (
     id: string,
diff --git a/apps/client/app/features/knowledge/types/Knowledge.ts b/apps/client/app/features/knowledge/types/Knowledge.ts
index efde2a700..bae11096b 100644
--- a/apps/client/app/features/knowledge/types/Knowledge.ts
+++ b/apps/client/app/features/knowledge/types/Knowledge.ts
@@ -191,6 +191,15 @@ export interface KnowledgeCollectionListResponse {
   can_change_public_visibility: boolean;
 }
 
+export interface KnowledgeCollectionLLMSelectableItem {
+  id: string;
+  safe_label?: string | null;
+}
+
+export interface KnowledgeCollectionLLMSelectableResponse {
+  collections: KnowledgeCollectionLLMSelectableItem[];
+}
+
 export interface KnowledgeCollectionItemResponse {
   item_id: string;
   knowledge_base_id: string;
diff --git a/apps/client/app/features/workflow/components/deployment/SuccessStep.test.tsx b/apps/client/app/features/workflow/components/deployment/SuccessStep.test.tsx
index f4f15f901..a6d43f22a 100644
--- a/apps/client/app/features/workflow/components/deployment/SuccessStep.test.tsx
+++ b/apps/client/app/features/workflow/components/deployment/SuccessStep.test.tsx
@@ -14,6 +14,28 @@ afterEach(() => {
 });
 
 describe('SuccessStep', () => {
+  it('shows a non-blocking preflight warning after a successful deployment', () => {
+    render(
+      <SuccessStep
+        deploymentType="api"
+        onClose={vi.fn()}
+        result={{
+          success: true,
+          version: 1,
+          message:
+            '배포 전 검사 경고가 있습니다.\n실행 시 지식 후보가 제한될 수 있습니다.',
+        }}
+      />,
+    );
+
+    expect(screen.getByRole('status')).toHaveTextContent(
+      '배포 전 검사 경고가 있습니다.',
+    );
+    expect(screen.getByRole('status')).toHaveTextContent(
+      '실행 시 지식 후보가 제한될 수 있습니다.',
+    );
+  });
+
   it('distinguishes public chatbot link from authenticated internal run link', () => {
     render(
       <SuccessStep
diff --git a/apps/client/app/features/workflow/components/deployment/SuccessStep.tsx b/apps/client/app/features/workflow/components/deployment/SuccessStep.tsx
index c06d56d98..62edb3278 100644
--- a/apps/client/app/features/workflow/components/deployment/SuccessStep.tsx
+++ b/apps/client/app/features/workflow/components/deployment/SuccessStep.tsx
@@ -137,6 +137,15 @@ ${authHeader}  -d '{
       </div>
 
       <div className="p-6 space-y-6 max-h-[60vh] overflow-y-auto">
+        {result.message && (
+          <div
+            role="status"
+            className="whitespace-pre-line rounded-lg border border-amber-300 bg-amber-50 p-4 text-sm text-amber-900"
+          >
+            {result.message}
+          </div>
+        )}
+
         {/* Web App / Chatbot Share Link */}
         {result.webAppUrl && (
           <div className="border-2 border-blue-200 rounded-lg p-4 bg-blue-50">
diff --git a/apps/client/app/features/workflow/components/deployment/types.ts b/apps/client/app/features/workflow/components/deployment/types.ts
index 032edb903..414c2fb26 100644
--- a/apps/client/app/features/workflow/components/deployment/types.ts
+++ b/apps/client/app/features/workflow/components/deployment/types.ts
@@ -15,7 +15,7 @@ export interface DeploymentResult {
   isWorkflowNode?: boolean;
   input_schema?: InputSchema | null;
   output_schema?: OutputSchema | null;
-  message?: string; // Error message
+  message?: string; // Error or non-blocking preflight warning
   cronExpression?: string; // Schedule trigger용
   timezone?: string; // Schedule trigger용
   graph_snapshot?: any; // 노드 타입 확인용 (webhookTrigger 등)
diff --git a/apps/client/app/features/workflow/components/nodes/llm/components/LLMNodePanel.tsx b/apps/client/app/features/workflow/components/nodes/llm/components/LLMNodePanel.tsx
index 85b1b4511..14718f848 100644
--- a/apps/client/app/features/workflow/components/nodes/llm/components/LLMNodePanel.tsx
+++ b/apps/client/app/features/workflow/components/nodes/llm/components/LLMNodePanel.tsx
@@ -17,11 +17,6 @@ import {
 import { PromptWizardModal } from '../../../modals/PromptWizardModal';
 import { ModelSelectDropdown } from './ModelSelectDropdown';
 import { LLMParameterSidePanel } from './LLMParameterSidePanel';
-import {
-  fetchEligibleKnowledgeBases,
-  sanitizeSelectedKnowledgeBases,
-  isSameKnowledgeSelection,
-} from '@/app/features/workflow/utils/llmKnowledgeBaseSelection';
 import { resolveWorkflowWizardOrganizationId } from '@/app/features/workflow/utils/resolveWorkflowWizardOrganizationId';
 import {
   DraggedOutputVariable,
@@ -897,35 +892,6 @@ export function LLMNodePanel({
     void loadRoutingPolicy();
   }, [data.auto_model_routing, loadRoutingPolicy]);
 
-  useEffect(() => {
-    if (!data.knowledgeBases || data.knowledgeBases.length === 0) return;
-    let active = true;
-    const syncKnowledgeBases = async () => {
-      try {
-        const { bases, preserveSelectionIds = [] } =
-          await fetchEligibleKnowledgeBases();
-        if (!active) return;
-        const nextSelected = sanitizeSelectedKnowledgeBases(
-          data.knowledgeBases || [],
-          bases,
-          { preserveMissingIds: preserveSelectionIds },
-        );
-        if (
-          !isSameKnowledgeSelection(nextSelected, data.knowledgeBases || [])
-        ) {
-          updateNodeData(nodeId, { knowledgeBases: nextSelected });
-        }
-      } catch {
-        // 지식 베이스 동기화 실패는 노드 편집 자체를 막지 않습니다.
-      }
-    };
-
-    syncKnowledgeBases();
-    return () => {
-      active = false;
-    };
-  }, [data.knowledgeBases, nodeId, updateNodeData]);
-
   useEffect(() => {
     if (!activeHelp) return;
 
@@ -1435,7 +1401,7 @@ export function LLMNodePanel({
         </div>
       </CollapsibleSection>
 
-      {/* 2.5 지식 베이스 버튼 (지식 베이스 그룹 통합) */}
+      {/* 2.5 Knowledge 선택 버튼 */}
       <div className="my-2 group">
         <button
           type="button"
@@ -1451,7 +1417,8 @@ export function LLMNodePanel({
             window.dispatchEvent(event);
           }}
           className={`relative w-full py-4 px-5 rounded-xl border-2 border-dashed transition-all duration-300 flex items-center gap-4 active:scale-[0.98] ${
-            (data.knowledgeBases?.length ?? 0) > 0
+            (data.knowledgeBases?.length ?? 0) > 0 ||
+            (data.knowledgeCollections?.length ?? 0) > 0
               ? 'border-indigo-400 bg-indigo-50/80 text-indigo-800 shadow-sm hover:shadow-md hover:bg-indigo-50 hover:border-indigo-500'
               : 'border-gray-300 bg-gray-50/50 text-gray-600 hover:border-indigo-400 hover:bg-indigo-50/30 hover:text-indigo-700 hover:shadow-sm'
           }`}
@@ -1462,7 +1429,8 @@ export function LLMNodePanel({
           {/* 왼쪽 아이콘 (책) */}
           <div
             className={`p-2 rounded-lg transition-colors duration-300 ${
-              (data.knowledgeBases?.length ?? 0) > 0
+              (data.knowledgeBases?.length ?? 0) > 0 ||
+              (data.knowledgeCollections?.length ?? 0) > 0
                 ? 'bg-indigo-200 text-indigo-700'
                 : 'bg-gray-200 text-gray-500 group-hover:bg-indigo-100 group-hover:text-indigo-600'
             }`}
@@ -1473,17 +1441,21 @@ export function LLMNodePanel({
           {/* 텍스트 내용 */}
           <div className="flex flex-col items-start flex-1 gap-0.5">
             <span className="font-bold text-sm tracking-tight">
-              지식 베이스 설정
+              Knowledge 설정
             </span>
             <span
               className={`text-xs transition-colors duration-300 ${
-                (data.knowledgeBases?.length ?? 0) > 0
+                (data.knowledgeBases?.length ?? 0) > 0 ||
+                (data.knowledgeCollections?.length ?? 0) > 0
                   ? 'text-indigo-600 font-medium'
                   : 'text-gray-400 group-hover:text-indigo-500'
               }`}
             >
-              {(data.knowledgeBases?.length ?? 0) > 0
-                ? `${data.knowledgeBases!.length}개 그룹 연결됨`
+              {(data.knowledgeBases?.length ?? 0) > 0 ||
+              (data.knowledgeCollections?.length ?? 0) > 0
+                ? `고정 KB ${data.knowledgeBases?.length ?? 0}개 · Collection ${
+                    data.knowledgeCollections?.length ?? 0
+                  }개`
                 : 'LLM에 지식을 연결하세요'}
             </span>
           </div>
diff --git a/apps/client/app/features/workflow/components/nodes/llm/components/LLMReferenceSidePanel.tsx b/apps/client/app/features/workflow/components/nodes/llm/components/LLMReferenceSidePanel.tsx
index f5a1b7c84..ea968a322 100644
--- a/apps/client/app/features/workflow/components/nodes/llm/components/LLMReferenceSidePanel.tsx
+++ b/apps/client/app/features/workflow/components/nodes/llm/components/LLMReferenceSidePanel.tsx
@@ -6,12 +6,17 @@ import {
   knowledgeApi,
   KnowledgeBaseResponse,
   KnowledgeBaseDetailResponse,
+  KnowledgeCollectionLLMSelectableItem,
 } from '@/app/features/knowledge/api/knowledgeApi';
 import { LLMNodeData } from '../../../../types/Nodes';
 import {
   fetchEligibleKnowledgeBases,
+  fetchEligibleKnowledgeCollections,
   sanitizeSelectedKnowledgeBases,
+  sanitizeSelectedKnowledgeCollections,
   isSameKnowledgeSelection,
+  isSameKnowledgeCollectionSelection,
+  MAX_CONFIGURED_KNOWLEDGE_REFERENCES,
 } from '@/app/features/workflow/utils/llmKnowledgeBaseSelection';
 
 interface LLMReferenceSidePanelProps {
@@ -32,14 +37,17 @@ export function LLMReferenceSidePanel({
   onDataChange,
 }: LLMReferenceSidePanelProps) {
   const { updateNodeData } = useWorkflowStore();
-  const applyNodeData = useCallback((updates: Partial<LLMNodeData>) => {
-    if (readOnly) return;
-    if (onDataChange) {
-      onDataChange(updates);
-      return;
-    }
-    updateNodeData(nodeId, updates);
-  }, [nodeId, onDataChange, readOnly, updateNodeData]);
+  const applyNodeData = useCallback(
+    (updates: Partial<LLMNodeData>) => {
+      if (readOnly) return;
+      if (onDataChange) {
+        onDataChange(updates);
+        return;
+      }
+      updateNodeData(nodeId, updates);
+    },
+    [nodeId, onDataChange, readOnly, updateNodeData],
+  );
 
   // Knowledge base state
   const [knowledgeBases, setKnowledgeBases] = useState<KnowledgeBaseResponse[]>(
@@ -55,7 +63,14 @@ export function LLMReferenceSidePanel({
   );
   const [expandedIds, setExpandedIds] = useState<Set<string>>(new Set());
   const [hasLoadedBases, setHasLoadedBases] = useState(false);
-  const [preserveSelectionIds, setPreserveSelectionIds] = useState<string[]>([]);
+  const [knowledgeCollections, setKnowledgeCollections] = useState<
+    KnowledgeCollectionLLMSelectableItem[]
+  >([]);
+  const [collectionsLoading, setCollectionsLoading] = useState(false);
+  const [collectionsError, setCollectionsError] = useState<string | null>(null);
+  const [hasLoadedCollections, setHasLoadedCollections] = useState(false);
+  const [baseLimitError, setBaseLimitError] = useState(false);
+  const [collectionLimitError, setCollectionLimitError] = useState(false);
 
   // Selected knowledge bases from LLM node data
   const selectedKnowledgeBases = useMemo(
@@ -67,18 +82,61 @@ export function LLMReferenceSidePanel({
     return sanitizeSelectedKnowledgeBases(
       selectedKnowledgeBases,
       knowledgeBases,
-      { preserveMissingIds: preserveSelectionIds },
     );
-  }, [
-    hasLoadedBases,
-    knowledgeBases,
-    preserveSelectionIds,
-    selectedKnowledgeBases,
-  ]);
+  }, [hasLoadedBases, knowledgeBases, selectedKnowledgeBases]);
   const selectedIds = useMemo(
     () => new Set(effectiveSelectedKnowledgeBases.map((kb) => kb.id)),
     [effectiveSelectedKnowledgeBases],
   );
+  const selectedKnowledgeCollections = useMemo(
+    () => data.knowledgeCollections || [],
+    [data.knowledgeCollections],
+  );
+  const effectiveSelectedKnowledgeCollections = useMemo(() => {
+    if (!hasLoadedCollections) return selectedKnowledgeCollections;
+    return sanitizeSelectedKnowledgeCollections(
+      selectedKnowledgeCollections,
+      knowledgeCollections,
+    );
+  }, [
+    hasLoadedCollections,
+    knowledgeCollections,
+    selectedKnowledgeCollections,
+  ]);
+  const selectedCollectionIds = useMemo(
+    () => new Set(effectiveSelectedKnowledgeCollections.map((item) => item.id)),
+    [effectiveSelectedKnowledgeCollections],
+  );
+  const availableBaseIds = useMemo(
+    () => new Set(knowledgeBases.map((item) => item.id)),
+    [knowledgeBases],
+  );
+  const availableCollectionIds = useMemo(
+    () => new Set(knowledgeCollections.map((item) => item.id)),
+    [knowledgeCollections],
+  );
+  const unavailableKnowledgeBases = useMemo(
+    () =>
+      hasLoadedBases
+        ? effectiveSelectedKnowledgeBases.filter(
+            (item) => !availableBaseIds.has(item.id),
+          )
+        : [],
+    [availableBaseIds, effectiveSelectedKnowledgeBases, hasLoadedBases],
+  );
+  const unavailableKnowledgeCollections = useMemo(
+    () =>
+      hasLoadedCollections
+        ? effectiveSelectedKnowledgeCollections.filter(
+            (item) => !availableCollectionIds.has(item.id),
+          )
+        : [],
+    [
+      availableCollectionIds,
+      effectiveSelectedKnowledgeCollections,
+      hasLoadedCollections,
+    ],
+  );
 
   // Search settings
   const scoreThreshold = data.scoreThreshold ?? 0.5;
@@ -90,40 +148,88 @@ export function LLMReferenceSidePanel({
   const recommendedScoreRange: [number, number] = [0.3, 0.6];
   const recommendedTopKRange: [number, number] = [3, 8];
 
-  // Fetch knowledge bases on mount
+  // 각 picker는 독립적으로 로드해 한쪽 장애가 다른 선택 그룹을 막지 않게 합니다.
   useEffect(() => {
+    let active = true;
     const fetchBases = async () => {
       setLoading(true);
       setError(null);
       try {
-        const {
-          bases,
-          detailsById,
-          preserveSelectionIds: nextPreserveSelectionIds = [],
-        } = await fetchEligibleKnowledgeBases();
+        const { bases, detailsById } = await fetchEligibleKnowledgeBases();
+        if (!active) return;
         setKnowledgeBases(bases);
         setDetails((prev) => ({ ...prev, ...detailsById }));
-        setPreserveSelectionIds(nextPreserveSelectionIds);
         setHasLoadedBases(true);
-        const nextSelected = sanitizeSelectedKnowledgeBases(
-          selectedKnowledgeBases,
-          bases,
-          { preserveMissingIds: nextPreserveSelectionIds },
-        );
-        if (
-          !readOnly &&
-          !isSameKnowledgeSelection(nextSelected, selectedKnowledgeBases)
-        ) {
-          applyNodeData({ knowledgeBases: nextSelected });
-        }
       } catch {
+        if (!active) return;
         setError('지식을 불러오지 못했습니다.');
       } finally {
-        setLoading(false);
+        if (active) setLoading(false);
+      }
+    };
+
+    const fetchCollections = async () => {
+      setCollectionsLoading(true);
+      setCollectionsError(null);
+      try {
+        const collections = await fetchEligibleKnowledgeCollections();
+        if (!active) return;
+        setKnowledgeCollections(collections);
+        setHasLoadedCollections(true);
+      } catch {
+        if (!active) return;
+        setCollectionsError('Collection을 불러오지 못했습니다.');
+      } finally {
+        if (active) setCollectionsLoading(false);
       }
     };
-    fetchBases();
-  }, [applyNodeData, nodeId, readOnly, selectedKnowledgeBases]);
+
+    void fetchBases();
+    void fetchCollections();
+    return () => {
+      active = false;
+    };
+  }, [nodeId]);
+
+  // 성공한 refresh는 현재 허용된 후보의 display snapshot만 갱신합니다.
+  useEffect(() => {
+    if (!hasLoadedBases || readOnly) return;
+    const nextSelected = sanitizeSelectedKnowledgeBases(
+      selectedKnowledgeBases,
+      knowledgeBases,
+    );
+    if (!isSameKnowledgeSelection(nextSelected, selectedKnowledgeBases)) {
+      applyNodeData({ knowledgeBases: nextSelected });
+    }
+  }, [
+    applyNodeData,
+    hasLoadedBases,
+    knowledgeBases,
+    readOnly,
+    selectedKnowledgeBases,
+  ]);
+
+  useEffect(() => {
+    if (!hasLoadedCollections || readOnly) return;
+    const nextSelected = sanitizeSelectedKnowledgeCollections(
+      selectedKnowledgeCollections,
+      knowledgeCollections,
+    );
+    if (
+      !isSameKnowledgeCollectionSelection(
+        nextSelected,
+        selectedKnowledgeCollections,
+      )
+    ) {
+      applyNodeData({ knowledgeCollections: nextSelected });
+    }
+  }, [
+    applyNodeData,
+    hasLoadedCollections,
+    knowledgeCollections,
+    readOnly,
+    selectedKnowledgeCollections,
+  ]);
 
   // Toggle selection
   const toggleKnowledgeBase = (kb: KnowledgeBaseResponse) => {
@@ -133,11 +239,60 @@ export function LLMReferenceSidePanel({
     if (selectedIds.has(kb.id)) {
       next = current.filter((item) => item.id !== kb.id);
     } else {
+      if (current.length >= MAX_CONFIGURED_KNOWLEDGE_REFERENCES) {
+        setBaseLimitError(true);
+        return;
+      }
       next = [...current, { id: kb.id, name: kb.name }];
     }
+    setBaseLimitError(false);
     applyNodeData({ knowledgeBases: next });
   };
 
+  const removeKnowledgeBase = (id: string) => {
+    if (readOnly) return;
+    setBaseLimitError(false);
+    applyNodeData({
+      knowledgeBases: effectiveSelectedKnowledgeBases.filter(
+        (item) => item.id !== id,
+      ),
+    });
+  };
+
+  const toggleKnowledgeCollection = (
+    collection: KnowledgeCollectionLLMSelectableItem,
+  ) => {
+    if (readOnly) return;
+    const current = effectiveSelectedKnowledgeCollections;
+    let next;
+    if (selectedCollectionIds.has(collection.id)) {
+      next = current.filter((item) => item.id !== collection.id);
+    } else {
+      if (current.length >= MAX_CONFIGURED_KNOWLEDGE_REFERENCES) {
+        setCollectionLimitError(true);
+        return;
+      }
+      next = [
+        ...current,
+        collection.safe_label !== undefined && collection.safe_label !== null
+          ? { id: collection.id, safeLabel: collection.safe_label }
+          : { id: collection.id },
+      ];
+    }
+    setCollectionLimitError(false);
+    applyNodeData({ knowledgeCollections: next });
+  };
+
+  const removeKnowledgeCollection = (id: string) => {
+    if (readOnly) return;
+    setCollectionLimitError(false);
+    applyNodeData({
+      knowledgeCollections: effectiveSelectedKnowledgeCollections.filter(
+        (item) => item.id !== id,
+      ),
+    });
+  };
+
   // Toggle expand/collapse for document list
   const handleToggleExpand = async (kb: KnowledgeBaseResponse) => {
     const nextExpanded = new Set(expandedIds);
@@ -188,9 +343,9 @@ export function LLMReferenceSidePanel({
         <div className="flex items-center gap-2">
           <BookOpen className="w-4 h-4 text-indigo-600" />
           <div>
-            <h3 className="font-semibold text-gray-800 text-sm">지식 베이스</h3>
+            <h3 className="font-semibold text-gray-800 text-sm">Knowledge</h3>
             <p className="text-[10px] text-gray-500 mt-0.5">
-              LLM이 참조할 지식 베이스를 선택합니다
+              고정 KB와 동적으로 해석할 Collection을 선택합니다
             </p>
           </div>
         </div>
@@ -210,24 +365,66 @@ export function LLMReferenceSidePanel({
         <div className="space-y-3">
           <div className="flex items-center justify-between">
             <span className="text-sm font-medium text-gray-700">
-              지식 베이스 선택
+              고정 지식 베이스
             </span>
             <span className="text-xs text-gray-500">
-              선택됨:{' '}
               <span className="font-semibold text-indigo-600">
                 {selectedIds.size}
-              </span>
+              </span>{' '}
+              / {MAX_CONFIGURED_KNOWLEDGE_REFERENCES}
             </span>
           </div>
 
+          <p className="text-[11px] leading-4 text-gray-500">
+            선택한 KB를 실행 시 직접 검색합니다.
+          </p>
+
           {loading && (
             <div className="text-xs text-indigo-600 animate-pulse">
               불러오는 중...
             </div>
           )}
           {error && <div className="text-xs text-red-500">{error}</div>}
+          {error && effectiveSelectedKnowledgeBases.length > 0 && (
+            <div className="rounded border border-amber-200 bg-amber-50 p-2 text-xs text-amber-800">
+              기존 선택 {effectiveSelectedKnowledgeBases.length}개는 변경 없이
+              유지됩니다.
+            </div>
+          )}
+          {baseLimitError && (
+            <div className="text-xs text-red-500">
+              고정 지식 베이스는 최대 {MAX_CONFIGURED_KNOWLEDGE_REFERENCES}
+              개까지 선택할 수 있습니다.
+            </div>
+          )}
 
           <div className="flex flex-col gap-2 max-h-72 overflow-y-auto pr-1">
+            {unavailableKnowledgeBases.map((item) => (
+              <label
+                key={`unavailable-kb-${item.id}`}
+                className={`flex items-start gap-3 rounded-lg border border-amber-200 bg-amber-50 p-3 ${
+                  readOnly ? 'cursor-default' : 'cursor-pointer'
+                }`}
+              >
+                <input
+                  type="checkbox"
+                  checked
+                  disabled={readOnly}
+                  onChange={() => removeKnowledgeBase(item.id)}
+                  className="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                />
+                <span className="min-w-0">
+                  <span className="block text-sm font-semibold text-gray-800">
+                    사용할 수 없는 지식
+                  </span>
+                  <span className="block text-[11px] leading-4 text-amber-700">
+                    저장하려면 이 참조를 제거하거나 관리자에게 권한 복구를
+                    요청하세요.
+                  </span>
+                </span>
+              </label>
+            ))}
+
             {(knowledgeBases || []).map((kb) => {
               const isSelected = selectedIds.has(kb.id);
               const isExpanded = expandedIds.has(kb.id);
@@ -255,7 +452,12 @@ export function LLMReferenceSidePanel({
                     <input
                       type="checkbox"
                       checked={isSelected}
-                      disabled={readOnly}
+                      disabled={
+                        readOnly ||
+                        (!isSelected &&
+                          selectedIds.size >=
+                            MAX_CONFIGURED_KNOWLEDGE_REFERENCES)
+                      }
                       onChange={() => toggleKnowledgeBase(kb)}
                       className="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
                     />
@@ -359,6 +561,120 @@ export function LLMReferenceSidePanel({
           </div>
         </div>
 
+        {/* Knowledge Collection Selection */}
+        <div className="space-y-3 border-t border-gray-100 pt-4">
+          <div className="flex items-center justify-between">
+            <span className="text-sm font-medium text-gray-700">
+              지식 Collection
+            </span>
+            <span className="text-xs text-gray-500">
+              <span className="font-semibold text-indigo-600">
+                {selectedCollectionIds.size}
+              </span>{' '}
+              / {MAX_CONFIGURED_KNOWLEDGE_REFERENCES}
+            </span>
+          </div>
+          <p className="text-[11px] leading-4 text-gray-500">
+            Collection 구성원은 그래프에 복사하지 않고 실행할 때마다 현재 권한과
+            상태로 다시 해석합니다.
+          </p>
+
+          {collectionsLoading && (
+            <div className="text-xs text-indigo-600 animate-pulse">
+              불러오는 중...
+            </div>
+          )}
+          {collectionsError && (
+            <div className="text-xs text-red-500">{collectionsError}</div>
+          )}
+          {collectionsError &&
+            effectiveSelectedKnowledgeCollections.length > 0 && (
+              <div className="rounded border border-amber-200 bg-amber-50 p-2 text-xs text-amber-800">
+                기존 선택 {effectiveSelectedKnowledgeCollections.length}개는
+                변경 없이 유지됩니다.
+              </div>
+            )}
+          {collectionLimitError && (
+            <div className="text-xs text-red-500">
+              지식 Collection은 최대 {MAX_CONFIGURED_KNOWLEDGE_REFERENCES}개까지
+              선택할 수 있습니다.
+            </div>
+          )}
+
+          <div className="flex max-h-72 flex-col gap-2 overflow-y-auto pr-1">
+            {unavailableKnowledgeCollections.map((item) => (
+              <label
+                key={`unavailable-collection-${item.id}`}
+                className={`flex items-start gap-3 rounded-lg border border-amber-200 bg-amber-50 p-3 ${
+                  readOnly ? 'cursor-default' : 'cursor-pointer'
+                }`}
+              >
+                <input
+                  type="checkbox"
+                  checked
+                  disabled={readOnly}
+                  onChange={() => removeKnowledgeCollection(item.id)}
+                  className="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                />
+                <span className="min-w-0">
+                  <span className="block text-sm font-semibold text-gray-800">
+                    사용할 수 없는 Collection
+                  </span>
+                  <span className="block text-[11px] leading-4 text-amber-700">
+                    저장하려면 이 참조를 제거하거나 관리자에게 route 권한 복구를
+                    요청하세요.
+                  </span>
+                </span>
+              </label>
+            ))}
+
+            {knowledgeCollections.map((collection) => {
+              const isSelected = selectedCollectionIds.has(collection.id);
+              return (
+                <label
+                  key={collection.id}
+                  className={`flex items-start gap-3 rounded-lg border p-3 transition-colors ${
+                    readOnly ? 'cursor-default' : 'cursor-pointer'
+                  } ${
+                    isSelected
+                      ? 'border-indigo-500 bg-indigo-50'
+                      : 'border-gray-200 hover:border-indigo-200 hover:bg-gray-50'
+                  }`}
+                >
+                  <input
+                    type="checkbox"
+                    checked={isSelected}
+                    disabled={
+                      readOnly ||
+                      (!isSelected &&
+                        selectedCollectionIds.size >=
+                          MAX_CONFIGURED_KNOWLEDGE_REFERENCES)
+                    }
+                    onChange={() => toggleKnowledgeCollection(collection)}
+                    className="mt-0.5 h-4 w-4 rounded border-gray-300 text-indigo-600 focus:ring-indigo-500"
+                  />
+                  <span className="min-w-0">
+                    <span className="block truncate text-sm font-semibold text-gray-900">
+                      {collection.safe_label || '지식 Collection'}
+                    </span>
+                    <span className="block text-[11px] leading-4 text-gray-500">
+                      실행 시점에 사용 가능한 KB를 동적으로 선택합니다.
+                    </span>
+                  </span>
+                </label>
+              );
+            })}
+
+            {!collectionsLoading &&
+              knowledgeCollections.length === 0 &&
+              !collectionsError && (
+                <div className="rounded border border-dashed border-gray-300 bg-gray-50 p-3 text-sm text-gray-600">
+                  route 권한으로 선택할 수 있는 Collection이 없습니다.
+                </div>
+              )}
+          </div>
+        </div>
+
         {/* Search Settings */}
         <div className="space-y-4 border-t border-gray-100 pt-4">
           <span className="text-sm font-medium text-gray-700">검색 설정</span>
@@ -469,8 +785,8 @@ export function LLMReferenceSidePanel({
               비용 최적화
             </span>
             <p className="text-[11px] leading-4 text-gray-500">
-              직접 작성한 프롬프트는 유지하고, 검색으로 가져온 근거
-              context만 줄이거나 검증합니다.
+              직접 작성한 프롬프트는 유지하고, 검색으로 가져온 근거 context만
+              줄이거나 검증합니다.
             </p>
           </div>
 
@@ -491,8 +807,7 @@ export function LLMReferenceSidePanel({
                 중복 근거 제거
               </span>
               <span className="block text-[11px] leading-4 text-gray-500">
-                같은 내용이 반복 검색되면 가장 관련도 높은 근거만
-                사용합니다.
+                같은 내용이 반복 검색되면 가장 관련도 높은 근거만 사용합니다.
               </span>
             </span>
           </label>
@@ -516,9 +831,7 @@ export function LLMReferenceSidePanel({
                 const value = Number(rawValue);
                 applyNodeData({
                   retrievedContextMaxChars:
-                    rawValue === '' || Number.isNaN(value)
-                      ? undefined
-                      : value,
+                    rawValue === '' || Number.isNaN(value) ? undefined : value,
                 });
               }}
               className="w-full rounded-md border border-gray-200 px-3 py-2 text-xs text-gray-800 focus:border-indigo-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 disabled:bg-gray-100"
@@ -590,8 +903,9 @@ export function LLMReferenceSidePanel({
         <div className="rounded-lg bg-blue-50 border border-blue-200 p-3 space-y-1">
           <p className="text-xs font-medium text-blue-800">💡 사용 방법</p>
           <p className="text-[11px] text-blue-700">
-            선택한 지식 베이스에서 사용자 프롬프트를 기반으로 관련 문서를
-            검색하여 LLM에 컨텍스트로 제공합니다.
+            고정 KB와 실행 시점에 해석된 Collection 후보에서 관련 문서를 검색해
+            LLM에 컨텍스트로 제공합니다. Collection 선택만으로 하위 KB 사용
+            권한이 생기지는 않습니다.
           </p>
         </div>
       </div>
diff --git a/apps/client/app/features/workflow/config/nodeRegistry.tsx b/apps/client/app/features/workflow/config/nodeRegistry.tsx
index 40441c02d..6e21cd7c7 100644
--- a/apps/client/app/features/workflow/config/nodeRegistry.tsx
+++ b/apps/client/app/features/workflow/config/nodeRegistry.tsx
@@ -121,6 +121,7 @@ export const nodeRegistry: NodeDefinition[] = [
       referenced_variables: [],
       context_variable: '',
       knowledgeBases: [],
+      knowledgeCollections: [],
       topK: 3,
       scoreThreshold: 0.5,
       dedupeRetrievedContext: false,
diff --git a/apps/client/app/features/workflow/hooks/useDeployment.test.tsx b/apps/client/app/features/workflow/hooks/useDeployment.test.tsx
index f8f27bde3..73c953278 100644
--- a/apps/client/app/features/workflow/hooks/useDeployment.test.tsx
+++ b/apps/client/app/features/workflow/hooks/useDeployment.test.tsx
@@ -66,6 +66,8 @@ describe('useDeployment', () => {
         blocked_reason: null,
         affected_node_count: 0,
         affected_kb_count_bucket: '0',
+        affected_collection_count_bucket: '0',
+        candidate_budget_limited: false,
       },
       required_actions: [],
       warnings: [],
@@ -108,6 +110,8 @@ describe('useDeployment', () => {
         blocked_reason: 'private_kb_requires_execution_subject',
         affected_node_count: 1,
         affected_kb_count_bucket: '1',
+        affected_collection_count_bucket: '0',
+        candidate_budget_limited: false,
       },
       required_actions: [
         {
@@ -131,4 +135,37 @@ describe('useDeployment', () => {
     );
     expect(mockedWorkflowApi.createDeployment).not.toHaveBeenCalled();
   });
+
+  it('warning preflight deploys and returns a safe warning message', async () => {
+    mockedWorkflowApi.preflightDeployment.mockResolvedValueOnce({
+      status: 'warning',
+      audience: 'anonymous_public',
+      safe_summary: {
+        blocked_reason: 'knowledge_candidate_budget_limited',
+        affected_node_count: 1,
+        affected_kb_count_bucket: '0',
+        affected_collection_count_bucket: '1',
+        candidate_budget_limited: true,
+      },
+      required_actions: [
+        {
+          action: 'review_knowledge_candidate_selection',
+          label: 'KB와 Collection 선택을 검토하세요',
+        },
+      ],
+      warnings: ['knowledge_candidate_budget_limited'],
+      nodes: [],
+    });
+    const { result } = renderDeploymentHook();
+
+    let deploymentResult: Awaited<ReturnType<typeof result.current.handleDeploy>>;
+    await act(async () => {
+      deploymentResult = await result.current.handleDeploy('candidate warning');
+    });
+
+    expect(deploymentResult!.success).toBe(true);
+    expect(deploymentResult!.message).toContain('배포 전 검사 경고');
+    expect(deploymentResult!.message).toContain('최대 후보 수');
+    expect(mockedWorkflowApi.createDeployment).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/apps/client/app/features/workflow/hooks/useDeployment.ts b/apps/client/app/features/workflow/hooks/useDeployment.ts
index cd55c0a74..81017834d 100644
--- a/apps/client/app/features/workflow/hooks/useDeployment.ts
+++ b/apps/client/app/features/workflow/hooks/useDeployment.ts
@@ -124,6 +124,10 @@ export function useDeployment({
             message: formatDeploymentPreflightMessage(preflight),
           };
         }
+        const preflightWarning =
+          preflight.status === 'warning'
+            ? formatDeploymentPreflightMessage(preflight)
+            : undefined;
 
         const response = await workflowApi.createDeployment({
           app_id: activeWorkflow.appId,
@@ -144,6 +148,7 @@ export function useDeployment({
           input_schema: response.input_schema ?? null,
           output_schema: response.output_schema ?? null,
           graph_snapshot: { nodes }, // webhook trigger 감지용
+          message: preflightWarning,
         };
 
         if (deploymentType === 'webapp') {
diff --git a/apps/client/app/features/workflow/tests/costOptimizer/fr3-rag-cost-options.test.tsx b/apps/client/app/features/workflow/tests/costOptimizer/fr3-rag-cost-options.test.tsx
index f6b80548f..eaed6829c 100644
--- a/apps/client/app/features/workflow/tests/costOptimizer/fr3-rag-cost-options.test.tsx
+++ b/apps/client/app/features/workflow/tests/costOptimizer/fr3-rag-cost-options.test.tsx
@@ -29,12 +29,16 @@ vi.mock('@/app/features/knowledge/api/knowledgeApi', () => ({
 }));
 
 vi.mock('@/app/features/workflow/utils/llmKnowledgeBaseSelection', () => ({
+  MAX_CONFIGURED_KNOWLEDGE_REFERENCES: 20,
   fetchEligibleKnowledgeBases: vi.fn().mockResolvedValue({
     bases: [],
     detailsById: {},
   }),
+  fetchEligibleKnowledgeCollections: vi.fn().mockResolvedValue([]),
   sanitizeSelectedKnowledgeBases: (selected: unknown) => selected,
+  sanitizeSelectedKnowledgeCollections: (selected: unknown) => selected,
   isSameKnowledgeSelection: () => true,
+  isSameKnowledgeCollectionSelection: () => true,
 }));
 
 const baseData: LLMNodeData = {
@@ -306,7 +310,7 @@ describe('FR-003 RAG cost optimization options', () => {
     expect(
       await screen.findByText('지식을 불러오지 못했습니다.'),
     ).toBeInTheDocument();
-    expect(screen.getByText('선택됨:')).toBeInTheDocument();
+    expect(screen.getByText(/기존 선택/)).toBeInTheDocument();
     expect(screen.getAllByText('1').length).toBeGreaterThan(0);
     expect(updateNodeDataMock).not.toHaveBeenCalled();
   });
diff --git a/apps/client/app/features/workflow/tests/nodes/llm-node-panel-json-schema.test.tsx b/apps/client/app/features/workflow/tests/nodes/llm-node-panel-json-schema.test.tsx
index b5a842001..98df34914 100644
--- a/apps/client/app/features/workflow/tests/nodes/llm-node-panel-json-schema.test.tsx
+++ b/apps/client/app/features/workflow/tests/nodes/llm-node-panel-json-schema.test.tsx
@@ -70,9 +70,13 @@ vi.mock('../../components/nodes/ui/PropertyVisibilityToggle', () => ({
 }));
 
 vi.mock('@/app/features/workflow/utils/llmKnowledgeBaseSelection', () => ({
+  MAX_CONFIGURED_KNOWLEDGE_REFERENCES: 20,
   fetchEligibleKnowledgeBases: vi.fn(async () => []),
+  fetchEligibleKnowledgeCollections: vi.fn(async () => []),
   sanitizeSelectedKnowledgeBases: vi.fn((selected) => selected || []),
+  sanitizeSelectedKnowledgeCollections: vi.fn((selected) => selected || []),
   isSameKnowledgeSelection: vi.fn(() => true),
+  isSameKnowledgeCollectionSelection: vi.fn(() => true),
 }));
 
 const baseData = (): LLMNodeData => ({
diff --git a/apps/client/app/features/workflow/tests/nodes/llm-reference-side-panel.test.tsx b/apps/client/app/features/workflow/tests/nodes/llm-reference-side-panel.test.tsx
new file mode 100644
index 000000000..545e7c48b
--- /dev/null
+++ b/apps/client/app/features/workflow/tests/nodes/llm-reference-side-panel.test.tsx
@@ -0,0 +1,164 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import type { LLMNodeData } from '../../types/Nodes';
+import { LLMReferenceSidePanel } from '../../components/nodes/llm/components/LLMReferenceSidePanel';
+
+const knowledgeApiMock = vi.hoisted(() => ({
+  getLLMSelectableKnowledgeBases: vi.fn(),
+  getLLMSelectableKnowledgeCollections: vi.fn(),
+  getKnowledgeBase: vi.fn(),
+}));
+const updateNodeDataMock = vi.hoisted(() => vi.fn());
+
+vi.mock('@/app/features/knowledge/api/knowledgeApi', () => ({
+  knowledgeApi: knowledgeApiMock,
+}));
+
+vi.mock('@/app/features/workflow/store/useWorkflowStore', () => ({
+  useWorkflowStore: () => ({ updateNodeData: updateNodeDataMock }),
+}));
+
+const baseData = (updates: Partial<LLMNodeData> = {}): LLMNodeData => ({
+  title: 'LLM',
+  provider: 'openai',
+  model_id: 'model-1',
+  referenced_variables: [],
+  parameters: {},
+  ...updates,
+});
+
+const renderPanel = (data: LLMNodeData, onDataChange = vi.fn()) => {
+  render(
+    <LLMReferenceSidePanel
+      nodeId="llm-1"
+      data={data}
+      onClose={() => undefined}
+      embedded
+      onDataChange={onDataChange}
+    />,
+  );
+  return onDataChange;
+};
+
+describe('LLMReferenceSidePanel Knowledge selection', () => {
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('keeps saved refs on successful empty responses and hides stale labels', async () => {
+    knowledgeApiMock.getLLMSelectableKnowledgeBases.mockResolvedValueOnce([]);
+    knowledgeApiMock.getLLMSelectableKnowledgeCollections.mockResolvedValueOnce(
+      { collections: [] },
+    );
+    const onDataChange = renderPanel(
+      baseData({
+        knowledgeBases: [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            name: '노출하면 안 되는 KB 이름',
+          },
+        ],
+        knowledgeCollections: [
+          {
+            id: '22222222-2222-2222-2222-222222222222',
+            safeLabel: '노출하면 안 되는 Collection 이름',
+          },
+        ],
+      }),
+    );
+
+    expect(await screen.findByText('사용할 수 없는 지식')).toBeInTheDocument();
+    expect(
+      await screen.findByText('사용할 수 없는 Collection'),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText('노출하면 안 되는 KB 이름'),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByText('노출하면 안 되는 Collection 이름'),
+    ).not.toBeInTheDocument();
+    expect(onDataChange).not.toHaveBeenCalled();
+  });
+
+  it('stores a Collection reference without expanding members', async () => {
+    knowledgeApiMock.getLLMSelectableKnowledgeBases.mockResolvedValueOnce([]);
+    knowledgeApiMock.getLLMSelectableKnowledgeCollections.mockResolvedValueOnce(
+      {
+        collections: [
+          {
+            id: '33333333-3333-3333-3333-333333333333',
+            safe_label: '사내 문서',
+          },
+        ],
+      },
+    );
+    const onDataChange = renderPanel(baseData());
+
+    fireEvent.click(await screen.findByRole('checkbox', { name: /사내 문서/ }));
+
+    expect(onDataChange).toHaveBeenCalledWith({
+      knowledgeCollections: [
+        {
+          id: '33333333-3333-3333-3333-333333333333',
+          safeLabel: '사내 문서',
+        },
+      ],
+    });
+    expect(JSON.stringify(onDataChange.mock.calls)).not.toContain('members');
+  });
+
+  it('retains selections when either picker request fails', async () => {
+    knowledgeApiMock.getLLMSelectableKnowledgeBases.mockRejectedValueOnce(
+      new Error('private failure'),
+    );
+    knowledgeApiMock.getLLMSelectableKnowledgeCollections.mockRejectedValueOnce(
+      new Error('private failure'),
+    );
+    const onDataChange = renderPanel(
+      baseData({
+        knowledgeBases: [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            name: '기존 KB',
+          },
+        ],
+        knowledgeCollections: [{ id: '22222222-2222-2222-2222-222222222222' }],
+      }),
+    );
+
+    expect(
+      await screen.findByText('지식을 불러오지 못했습니다.'),
+    ).toBeInTheDocument();
+    expect(
+      await screen.findByText('Collection을 불러오지 못했습니다.'),
+    ).toBeInTheDocument();
+    expect(screen.getAllByText(/기존 선택 1개는/)).toHaveLength(2);
+    expect(onDataChange).not.toHaveBeenCalled();
+  });
+
+  it('disables a 21st Collection candidate at the independent 20-item limit', async () => {
+    const collections = Array.from({ length: 21 }, (_, index) => ({
+      id: `00000000-0000-0000-0000-${String(index).padStart(12, '0')}`,
+      safe_label: `Collection ${index + 1}`,
+    }));
+    knowledgeApiMock.getLLMSelectableKnowledgeBases.mockResolvedValueOnce([]);
+    knowledgeApiMock.getLLMSelectableKnowledgeCollections.mockResolvedValueOnce(
+      { collections },
+    );
+    renderPanel(
+      baseData({
+        knowledgeCollections: collections.slice(0, 20).map((item) => ({
+          id: item.id,
+          safeLabel: item.safe_label,
+        })),
+      }),
+    );
+
+    const twentyFirst = await screen.findByRole('checkbox', {
+      name: /Collection 21/,
+    });
+
+    await waitFor(() => expect(twentyFirst).toBeDisabled());
+  });
+});
diff --git a/apps/client/app/features/workflow/tests/utils/llmKnowledgeBaseSelection.test.ts b/apps/client/app/features/workflow/tests/utils/llmKnowledgeBaseSelection.test.ts
index 03c8bfaf7..afdbcb0e3 100644
--- a/apps/client/app/features/workflow/tests/utils/llmKnowledgeBaseSelection.test.ts
+++ b/apps/client/app/features/workflow/tests/utils/llmKnowledgeBaseSelection.test.ts
@@ -4,13 +4,16 @@ import { knowledgeApi } from '@/app/features/knowledge/api/knowledgeApi';
 import type { KnowledgeBaseDetailResponse } from '@/app/features/knowledge/types/Knowledge';
 import {
   fetchEligibleKnowledgeBases,
+  fetchEligibleKnowledgeCollections,
   sanitizeSelectedKnowledgeBases,
+  sanitizeSelectedKnowledgeCollections,
 } from '../../utils/llmKnowledgeBaseSelection';
 
 vi.mock('@/app/features/knowledge/api/knowledgeApi', () => ({
   knowledgeApi: {
     getKnowledgeBases: vi.fn(),
     getLLMSelectableKnowledgeBases: vi.fn(),
+    getLLMSelectableKnowledgeCollections: vi.fn(),
     getKnowledgeBase: vi.fn(),
   },
 }));
@@ -45,14 +48,18 @@ describe('llmKnowledgeBaseSelection', () => {
   });
 
   it('uses the permission-scoped LLM selectable API instead of owner-filtered legacy list/detail calls', async () => {
-    vi.mocked(knowledgeApi.getLLMSelectableKnowledgeBases).mockResolvedValueOnce([
+    vi.mocked(
+      knowledgeApi.getLLMSelectableKnowledgeBases,
+    ).mockResolvedValueOnce([
       readyDetail('kb-a', '사내 정책'),
       readyDetail('kb-b', '개발 규칙'),
     ]);
 
     const result = await fetchEligibleKnowledgeBases();
 
-    expect(knowledgeApi.getLLMSelectableKnowledgeBases).toHaveBeenCalledTimes(1);
+    expect(knowledgeApi.getLLMSelectableKnowledgeBases).toHaveBeenCalledTimes(
+      1,
+    );
     expect(knowledgeApi.getKnowledgeBases).not.toHaveBeenCalled();
     expect(knowledgeApi.getKnowledgeBase).not.toHaveBeenCalled();
     expect(result.bases.map((base) => base.id)).toEqual(['kb-a', 'kb-b']);
@@ -83,7 +90,9 @@ describe('llmKnowledgeBaseSelection', () => {
   });
 
   it('defensively excludes malformed or not-ready selectable API rows', async () => {
-    vi.mocked(knowledgeApi.getLLMSelectableKnowledgeBases).mockResolvedValueOnce([
+    vi.mocked(
+      knowledgeApi.getLLMSelectableKnowledgeBases,
+    ).mockResolvedValueOnce([
       readyDetail('kb-ready', '완료 KB'),
       {
         ...readyDetail('kb-pending', '처리 전 KB'),
@@ -111,7 +120,7 @@ describe('llmKnowledgeBaseSelection', () => {
     expect(Object.keys(result.detailsById)).toEqual(['kb-ready']);
   });
 
-  it('deduplicates selected knowledge bases, removes missing rows, and preserves transient ids when requested', () => {
+  it('deduplicates selected knowledge bases, refreshes current names, and preserves missing rows', () => {
     expect(
       sanitizeSelectedKnowledgeBases(
         [
@@ -130,11 +139,81 @@ describe('llmKnowledgeBaseSelection', () => {
             embedding_model: 'text-embedding-3-small',
           },
         ],
-        { preserveMissingIds: ['kb-transient'] },
       ),
     ).toEqual([
       { id: 'kb-ready', name: '최신 이름' },
       { id: 'kb-transient', name: '일시 장애 KB' },
+      { id: 'kb-missing', name: '삭제된 KB' },
+    ]);
+  });
+
+  it('uses the route-safe Collection picker and ignores malformed or duplicate rows', async () => {
+    const collectionId = '11111111-1111-1111-1111-111111111111';
+    vi.mocked(
+      knowledgeApi.getLLMSelectableKnowledgeCollections,
+    ).mockResolvedValueOnce({
+      collections: [
+        { id: collectionId, safe_label: '사내 문서' },
+        { id: collectionId, safe_label: '중복' },
+        { id: 'NOT-A-UUID', safe_label: '잘못된 항목' },
+        {
+          id: '22222222-2222-2222-2222-222222222222',
+          safe_label: '제어\u0000문자',
+        },
+        {
+          id: '33333333-3333-3333-3333-333333333333',
+          safe_label: null,
+        },
+      ],
+    });
+
+    const result = await fetchEligibleKnowledgeCollections();
+
+    expect(
+      knowledgeApi.getLLMSelectableKnowledgeCollections,
+    ).toHaveBeenCalledTimes(1);
+    expect(result).toEqual([
+      { id: collectionId, safe_label: '사내 문서' },
+      {
+        id: '33333333-3333-3333-3333-333333333333',
+        safe_label: null,
+      },
+    ]);
+  });
+
+  it('refreshes available Collection labels without deleting unavailable references', () => {
+    expect(
+      sanitizeSelectedKnowledgeCollections(
+        [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            safeLabel: '이전 이름',
+          },
+          {
+            id: '22222222-2222-2222-2222-222222222222',
+            safeLabel: '노출하면 안 되는 저장 이름',
+          },
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            safeLabel: '중복',
+          },
+        ],
+        [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            safe_label: '최신 안전 이름',
+          },
+        ],
+      ),
+    ).toEqual([
+      {
+        id: '11111111-1111-1111-1111-111111111111',
+        safeLabel: '최신 안전 이름',
+      },
+      {
+        id: '22222222-2222-2222-2222-222222222222',
+        safeLabel: '노출하면 안 되는 저장 이름',
+      },
     ]);
   });
 });
diff --git a/apps/client/app/features/workflow/tests/utils/validateWorkflowGraph.test.ts b/apps/client/app/features/workflow/tests/utils/validateWorkflowGraph.test.ts
index facecfc26..e203d8ad7 100644
--- a/apps/client/app/features/workflow/tests/utils/validateWorkflowGraph.test.ts
+++ b/apps/client/app/features/workflow/tests/utils/validateWorkflowGraph.test.ts
@@ -24,6 +24,106 @@ const draft = (nodes: AppNode[], edges: Edge[]): WorkflowDraftRequest => ({
 });
 
 describe('validateWorkflowGraph', () => {
+  it('accepts legacy direct-only, Collection-only, and mixed Knowledge references in nested graphs', () => {
+    const directId = '11111111-1111-1111-1111-111111111111';
+    const collectionId = '22222222-2222-2222-2222-222222222222';
+    const nestedLlm = {
+      ...node('nested-llm', 'llmNode', 'Nested LLM'),
+      data: {
+        title: 'Nested LLM',
+        knowledgeCollections: [{ id: collectionId, safeLabel: '사내 문서' }],
+      },
+    } as AppNode;
+    const container = {
+      ...node('loop', 'loopNode', 'Loop'),
+      data: {
+        title: 'Loop',
+        subGraph: { nodes: [nestedLlm], edges: [] },
+      },
+    } as AppNode;
+    const mixedLlm = {
+      ...node('llm', 'llmNode', 'LLM'),
+      data: {
+        title: 'LLM',
+        knowledgeBases: [{ id: directId, name: '' }],
+        knowledgeCollections: [{ id: collectionId }],
+      },
+    } as AppNode;
+    const legacyLlm = node('legacy-llm', 'llmNode', 'Legacy LLM');
+
+    const result = validateWorkflowGraph(
+      draft([mixedLlm, legacyLlm, container], []),
+    );
+
+    expect(result.ok).toBe(true);
+  });
+
+  it('rejects a 21st Knowledge reference without silently slicing either list', () => {
+    const references = Array.from({ length: 21 }, (_, index) => ({
+      id: `00000000-0000-0000-0000-${String(index).padStart(12, '0')}`,
+      safeLabel: `Collection ${index}`,
+    }));
+    const llm = {
+      ...node('llm', 'llmNode', 'LLM'),
+      data: { title: 'LLM', knowledgeCollections: references },
+    } as AppNode;
+
+    const result = validateWorkflowGraph(draft([llm], []));
+
+    expect(result.errors).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          code: 'KNOWLEDGE_REFERENCE_LIMIT_EXCEEDED',
+          nodeId: 'llm',
+        }),
+      ]),
+    );
+  });
+
+  it.each([
+    {
+      knowledgeBases: [
+        {
+          id: '11111111-1111-1111-1111-111111111111',
+          name: '정책',
+          forged: true,
+        },
+      ],
+    },
+    {
+      knowledgeCollections: [{ id: '11111111-1111-1111-1111-11111111111A' }],
+    },
+    {
+      knowledgeCollections: [
+        {
+          id: '11111111-1111-1111-1111-111111111111',
+          safeLabel: '잘못된\u0000이름',
+        },
+      ],
+    },
+    { knowledgeBases: null },
+  ])(
+    'rejects malformed Knowledge graph data without echoing values: %o',
+    (data) => {
+      const llm = {
+        ...node('llm', 'llmNode', 'LLM'),
+        data: { title: 'LLM', ...data },
+      } as AppNode;
+
+      const result = validateWorkflowGraph(draft([llm], []));
+
+      expect(result.errors).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({ code: 'KNOWLEDGE_REFERENCE_INVALID' }),
+        ]),
+      );
+      expect(JSON.stringify(result.errors)).not.toContain('정책');
+      expect(JSON.stringify(result.errors)).not.toContain(
+        '11111111-1111-1111-1111-11111111111A',
+      );
+    },
+  );
+
   it('rejects selectors for removed Slack raw outputs', () => {
     const slack = {
       ...node('slack', 'slackPostNode', 'Slack'),
@@ -343,7 +443,18 @@ describe('validateWorkflowGraph', () => {
       ...node('llm', 'llmNode', 'LLM'),
       data: {
         title: 'LLM',
-        knowledgeBases: [{ id: 'kb-1', name: '제품 정책' }],
+        knowledgeBases: [
+          {
+            id: '11111111-1111-1111-1111-111111111111',
+            name: '제품 정책',
+          },
+        ],
+        knowledgeCollections: [
+          {
+            id: '22222222-2222-2222-2222-222222222222',
+            safeLabel: '사내 문서',
+          },
+        ],
         topK: 4,
         scoreThreshold: 0.6,
         dedupeRetrievedContext: true,
@@ -379,7 +490,18 @@ describe('validateWorkflowGraph', () => {
 
     expect(result.graph.edges.map((edge) => edge.id)).toEqual(['good-edge']);
     expect(cleanedLlmNode?.data).toMatchObject({
-      knowledgeBases: [{ id: 'kb-1', name: '제품 정책' }],
+      knowledgeBases: [
+        {
+          id: '11111111-1111-1111-1111-111111111111',
+          name: '제품 정책',
+        },
+      ],
+      knowledgeCollections: [
+        {
+          id: '22222222-2222-2222-2222-222222222222',
+          safeLabel: '사내 문서',
+        },
+      ],
       topK: 4,
       scoreThreshold: 0.6,
       dedupeRetrievedContext: true,
diff --git a/apps/client/app/features/workflow/types/Deployment.ts b/apps/client/app/features/workflow/types/Deployment.ts
index e5a421d1d..b4bdc84c2 100644
--- a/apps/client/app/features/workflow/types/Deployment.ts
+++ b/apps/client/app/features/workflow/types/Deployment.ts
@@ -68,6 +68,8 @@ export interface DeploymentPreflightResponse {
     blocked_reason?: string | null;
     affected_node_count: number;
     affected_kb_count_bucket: string;
+    affected_collection_count_bucket?: string;
+    candidate_budget_limited?: boolean;
   };
   required_actions: DeploymentPreflightRequiredAction[];
   warnings: string[];
@@ -77,6 +79,8 @@ export interface DeploymentPreflightResponse {
     status: DeploymentPreflightStatus;
     reason_codes: string[];
     knowledge_base_count_bucket: string;
+    knowledge_collection_count_bucket?: string;
+    candidate_budget_limited?: boolean;
   }>;
 }
 
diff --git a/apps/client/app/features/workflow/types/Nodes.ts b/apps/client/app/features/workflow/types/Nodes.ts
index 7d9af831c..777af6bc3 100644
--- a/apps/client/app/features/workflow/types/Nodes.ts
+++ b/apps/client/app/features/workflow/types/Nodes.ts
@@ -140,6 +140,16 @@ export interface LLMVariable {
   value_selector: string[];
 }
 
+export interface KnowledgeBaseNodeReference {
+  id: string;
+  name: string;
+}
+
+export interface KnowledgeCollectionNodeReference {
+  id: string;
+  safeLabel?: string;
+}
+
 export interface LLMNodeData extends BaseNodeData {
   provider: string;
   model_id: string;
@@ -193,7 +203,8 @@ export interface LLMNodeData extends BaseNodeData {
   };
 
   // 지식 (Knowledge) 통합 필드
-  knowledgeBases?: { id: string; name: string }[];
+  knowledgeBases?: KnowledgeBaseNodeReference[];
+  knowledgeCollections?: KnowledgeCollectionNodeReference[];
   scoreThreshold?: number;
   topK?: number;
   dedupeRetrievedContext?: boolean;
diff --git a/apps/client/app/features/workflow/utils/deploymentPreflightMessage.test.ts b/apps/client/app/features/workflow/utils/deploymentPreflightMessage.test.ts
new file mode 100644
index 000000000..18b07d4d9
--- /dev/null
+++ b/apps/client/app/features/workflow/utils/deploymentPreflightMessage.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from 'vitest';
+
+import type { DeploymentPreflightResponse } from '../types/Deployment';
+import { formatDeploymentPreflightMessage } from './deploymentPreflightMessage';
+
+function preflight(
+  overrides: Partial<DeploymentPreflightResponse['safe_summary']> = {},
+): DeploymentPreflightResponse {
+  return {
+    status: 'blocked',
+    audience: 'anonymous_public',
+    safe_summary: {
+      blocked_reason: 'private_collection_requires_execution_subject',
+      affected_node_count: 1,
+      affected_kb_count_bucket: '0',
+      affected_collection_count_bucket: '1',
+      candidate_budget_limited: false,
+      ...overrides,
+    },
+    required_actions: [
+      {
+        action: 'remove_private_collection_or_use_authenticated_run',
+        label: 'Private Collection을 제거하거나 인증 실행 경로를 사용하세요',
+      },
+    ],
+    warnings: [],
+    nodes: [],
+  };
+}
+
+describe('formatDeploymentPreflightMessage', () => {
+  it('Collection blocker를 identity 없이 표시한다', () => {
+    const message = formatDeploymentPreflightMessage(preflight());
+
+    expect(message).toContain('영향 Collection 수: 1');
+    expect(message).toContain('Private Collection을 제거');
+    expect(message).not.toContain('collection-id');
+  });
+
+  it('candidate budget 경고를 표시한다', () => {
+    const message = formatDeploymentPreflightMessage(
+      preflight({ candidate_budget_limited: true }),
+    );
+
+    expect(message).toContain('최대 후보 수로 제한될 수 있습니다');
+  });
+
+  it('이전 Gateway 응답에는 Collection 수를 임의 표시하지 않는다', () => {
+    const legacy = preflight({
+      affected_collection_count_bucket: undefined,
+      candidate_budget_limited: undefined,
+    });
+
+    const message = formatDeploymentPreflightMessage(legacy);
+
+    expect(message).not.toContain('undefined');
+    expect(message).not.toContain('영향 Collection 수');
+  });
+});
diff --git a/apps/client/app/features/workflow/utils/deploymentPreflightMessage.ts b/apps/client/app/features/workflow/utils/deploymentPreflightMessage.ts
index ca1a14a70..4cca989fc 100644
--- a/apps/client/app/features/workflow/utils/deploymentPreflightMessage.ts
+++ b/apps/client/app/features/workflow/utils/deploymentPreflightMessage.ts
@@ -6,13 +6,23 @@ export function formatDeploymentPreflightMessage(
   const reason =
     preflight.safe_summary.blocked_reason || 'deployment_preflight_blocked';
   const affected = preflight.safe_summary.affected_kb_count_bucket;
+  const affectedCollections =
+    preflight.safe_summary.affected_collection_count_bucket ?? '0';
   const actions = preflight.required_actions
     .map((action) => action.label)
     .filter(Boolean);
 
   return [
-    `배포 전 검사에서 차단되었습니다. (${reason})`,
+    preflight.status === 'warning'
+      ? `배포 전 검사 경고가 있습니다. (${reason})`
+      : `배포 전 검사에서 차단되었습니다. (${reason})`,
     affected !== '0' ? `영향 KB 수: ${affected}` : null,
+    affectedCollections !== '0'
+      ? `영향 Collection 수: ${affectedCollections}`
+      : null,
+    preflight.safe_summary.candidate_budget_limited
+      ? '실행 시 지식 후보가 최대 후보 수로 제한될 수 있습니다.'
+      : null,
     actions.length ? `필요 조치: ${actions.join(', ')}` : null,
   ]
     .filter(Boolean)
diff --git a/apps/client/app/features/workflow/utils/llmKnowledgeBaseSelection.ts b/apps/client/app/features/workflow/utils/llmKnowledgeBaseSelection.ts
index 34b6dbc9a..bf7c91aaa 100644
--- a/apps/client/app/features/workflow/utils/llmKnowledgeBaseSelection.ts
+++ b/apps/client/app/features/workflow/utils/llmKnowledgeBaseSelection.ts
@@ -2,31 +2,33 @@ import {
   knowledgeApi,
   KnowledgeBaseDetailResponse,
   KnowledgeBaseResponse,
+  KnowledgeCollectionLLMSelectableItem,
 } from '@/app/features/knowledge/api/knowledgeApi';
+import type {
+  KnowledgeBaseNodeReference,
+  KnowledgeCollectionNodeReference,
+} from '@/app/features/workflow/types/Nodes';
 
 /**
- * LLM 노드의 "지식" 선택/필터링 전용 유틸입니다.
- * 지식 탭에서 사용하는 그룹/문서 목록 로직과는 분리되어 있으며,
- * 그 로직을 재사용하거나 수정하지 않기 위해 별도 파일로 유지합니다.
- *
- * 이 유틸은 LLM 노드에서 아래 역할만 담당합니다.
- * - 완료된 retrieval-visible 문서가 있는 지식 베이스만 보여주기
- * - 외부에서 삭제된 베이스가 기존 선택에 남는 문제 정리
- * - 선택 목록의 이름/중복을 최신 상태로 정리
+ * Workflow Builder의 LLM Knowledge picker 전용 유틸입니다.
+ * 관리 화면의 Collection projection과 runtime resolver 결과는 사용하지 않습니다.
  */
-type KnowledgeBaseSelection = { id: string; name: string };
+export const MAX_CONFIGURED_KNOWLEDGE_REFERENCES = 20;
 
 type EligibleKnowledgeBasesResult = {
   bases: KnowledgeBaseResponse[];
   detailsById: Record<string, KnowledgeBaseDetailResponse>;
-  preserveSelectionIds?: string[];
 };
 
-type SanitizeSelectedKnowledgeBasesOptions = {
-  preserveMissingIds?: Iterable<string>;
-};
+const CANONICAL_UUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const isSafeDisplay = (value: string) =>
+  value.length <= 255 &&
+  !Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint < 32 || codePoint === 127;
+  });
 
-// LLM 노드에서 실제로 사용할 수 있는지 판단하기 위해 검색 가능한 완료 문서 수를 계산합니다.
 const getCompletedCount = (detail: KnowledgeBaseDetailResponse) => {
   const documents = Array.isArray(detail.documents) ? detail.documents : [];
   return documents.filter(
@@ -34,21 +36,26 @@ const getCompletedCount = (detail: KnowledgeBaseDetailResponse) => {
   ).length;
 };
 
-/**
- * LLM 노드에서 표시 가능한 지식 베이스만 가져옵니다.
- * - Gateway의 LLM 전용 후보 API가 active organization, KB use 권한,
- *   retrieval-visible completed chunk 기준을 적용합니다.
- * - client는 malformed payload 방어와 최신 이름/중복 정리만 수행합니다.
- */
+/** Gateway가 권한과 retrieval readiness를 적용한 direct KB 후보를 가져옵니다. */
 export const fetchEligibleKnowledgeBases =
   async (): Promise<EligibleKnowledgeBasesResult> => {
     const details = await knowledgeApi.getLLMSelectableKnowledgeBases();
     const detailsById: Record<string, KnowledgeBaseDetailResponse> = {};
     const eligibleBases: KnowledgeBaseResponse[] = [];
 
+    if (!Array.isArray(details)) return { bases: [], detailsById };
+
     details.forEach((detail) => {
+      if (
+        !detail ||
+        typeof detail !== 'object' ||
+        typeof detail.id !== 'string' ||
+        typeof detail.name !== 'string'
+      ) {
+        return;
+      }
       const completedCount = getCompletedCount(detail);
-      if (completedCount > 0) {
+      if (completedCount > 0 && !detailsById[detail.id]) {
         eligibleBases.push(detail);
         detailsById[detail.id] = detail;
       }
@@ -57,47 +64,96 @@ export const fetchEligibleKnowledgeBases =
     return { bases: eligibleBases, detailsById };
   };
 
+const isSelectableCollection = (
+  value: unknown,
+): value is KnowledgeCollectionLLMSelectableItem => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const item = value as Record<string, unknown>;
+  if (!CANONICAL_UUID_PATTERN.test(String(item.id ?? ''))) return false;
+  if (item.safe_label !== undefined && item.safe_label !== null) {
+    if (
+      typeof item.safe_label !== 'string' ||
+      !isSafeDisplay(item.safe_label)
+    ) {
+      return false;
+    }
+  }
+  return Object.keys(item).every((key) => key === 'id' || key === 'safe_label');
+};
+
+/** Gateway의 route-safe 최소 projection만 수용하고 malformed row는 무시합니다. */
+export const fetchEligibleKnowledgeCollections = async () => {
+  const response = await knowledgeApi.getLLMSelectableKnowledgeCollections();
+  const rawCollections = Array.isArray(response?.collections)
+    ? response.collections
+    : [];
+  const seen = new Set<string>();
+  return rawCollections.filter((item) => {
+    if (!isSelectableCollection(item) || seen.has(item.id)) return false;
+    seen.add(item.id);
+    return true;
+  });
+};
+
 /**
- * 기존 선택된 지식 베이스를 최신 상태로 정리합니다.
- * - 현재 목록에 없는 항목은 제거
- * - 일시 장애 등으로 보존 요청된 기존 선택 항목은 이름을 유지한 채 보존
- * - 중복 제거
- * - 이름은 최신 목록 기준으로 갱신
+ * 저장 참조를 자동 삭제하지 않고, 현재 후보에 있는 display snapshot만 갱신합니다.
+ * 중복은 첫 항목을 유지합니다.
  */
 export const sanitizeSelectedKnowledgeBases = (
-  selected: KnowledgeBaseSelection[],
+  selected: KnowledgeBaseNodeReference[],
   eligibleBases: KnowledgeBaseResponse[],
-  options: SanitizeSelectedKnowledgeBasesOptions = {},
 ) => {
-  const nameById = new Map(
-    eligibleBases.map((kb) => [kb.id, kb.name]),
-  );
-  const preserveMissingIds = new Set(options.preserveMissingIds ?? []);
+  const nameById = new Map(eligibleBases.map((kb) => [kb.id, kb.name]));
   const seen = new Set<string>();
-  const next: KnowledgeBaseSelection[] = [];
-
-  selected.forEach((kb) => {
-    const name = nameById.get(kb.id);
-    if (!name && !preserveMissingIds.has(kb.id)) return;
-    if (seen.has(kb.id)) return;
+  return selected.flatMap((kb) => {
+    if (seen.has(kb.id)) return [];
     seen.add(kb.id);
-    next.push({ id: kb.id, name: name ?? kb.name });
+    return [{ id: kb.id, name: nameById.get(kb.id) ?? kb.name }];
   });
-
-  return next;
 };
 
-/**
- * 선택 목록이 변경되었는지 판단하기 위한 순서/값 비교 헬퍼입니다.
- * LLM 노드의 불필요한 상태 업데이트를 줄이기 위해 사용합니다.
- */
-export const isSameKnowledgeSelection = (
-  a: KnowledgeBaseSelection[],
-  b: KnowledgeBaseSelection[],
+export const sanitizeSelectedKnowledgeCollections = (
+  selected: KnowledgeCollectionNodeReference[],
+  eligibleCollections: KnowledgeCollectionLLMSelectableItem[],
 ) => {
-  if (a.length !== b.length) return false;
-  for (let i = 0; i < a.length; i += 1) {
-    if (a[i].id !== b[i].id || a[i].name !== b[i].name) return false;
-  }
-  return true;
+  const labelById = new Map(
+    eligibleCollections.map((collection) => [
+      collection.id,
+      collection.safe_label ?? undefined,
+    ]),
+  );
+  const availableIds = new Set(
+    eligibleCollections.map((collection) => collection.id),
+  );
+  const seen = new Set<string>();
+  return selected.flatMap((collection) => {
+    if (seen.has(collection.id)) return [];
+    seen.add(collection.id);
+    if (!availableIds.has(collection.id)) return [collection];
+    const safeLabel = labelById.get(collection.id);
+    return [
+      safeLabel === undefined
+        ? { id: collection.id }
+        : { id: collection.id, safeLabel },
+    ];
+  });
 };
+
+export const isSameKnowledgeSelection = (
+  a: KnowledgeBaseNodeReference[],
+  b: KnowledgeBaseNodeReference[],
+) =>
+  a.length === b.length &&
+  a.every(
+    (item, index) => item.id === b[index]?.id && item.name === b[index]?.name,
+  );
+
+export const isSameKnowledgeCollectionSelection = (
+  a: KnowledgeCollectionNodeReference[],
+  b: KnowledgeCollectionNodeReference[],
+) =>
+  a.length === b.length &&
+  a.every(
+    (item, index) =>
+      item.id === b[index]?.id && item.safeLabel === b[index]?.safeLabel,
+  );
diff --git a/apps/client/app/features/workflow/utils/validateWorkflowGraph.ts b/apps/client/app/features/workflow/utils/validateWorkflowGraph.ts
index a8de3db7b..a83c1e8cc 100644
--- a/apps/client/app/features/workflow/utils/validateWorkflowGraph.ts
+++ b/apps/client/app/features/workflow/utils/validateWorkflowGraph.ts
@@ -11,6 +11,8 @@ export type GraphValidationIssueCode =
   | 'INVALID_CONDITION_SOURCE_HANDLE'
   | 'SLACK_LEGACY_CONFIGURATION'
   | 'SLACK_REMOVED_OUTPUT_SELECTOR'
+  | 'KNOWLEDGE_REFERENCE_INVALID'
+  | 'KNOWLEDGE_REFERENCE_LIMIT_EXCEEDED'
   | 'DUPLICATE_EDGE'
   | 'CYCLE_DETECTED';
 
@@ -47,6 +49,9 @@ const SOURCE_ONLY_NODE_TYPES = new Set([
   ...TRIGGER_NODE_TYPES,
 ]);
 const TERMINAL_NODE_TYPES = new Set(['answerNode', 'mailAcknowledgeNode']);
+const MAX_KNOWLEDGE_REFERENCES_PER_TYPE = 20;
+const CANONICAL_UUID_PATTERN =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
 const getNodeTitle = (node?: AppNode) => {
   const title = String(node?.data?.title || '').trim();
@@ -261,6 +266,86 @@ const getAllWorkflowNodes = (nodes: AppNode[]): AppNode[] => {
   return collected;
 };
 
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+
+const hasOnlyKeys = (value: Record<string, unknown>, allowed: Set<string>) =>
+  Object.keys(value).every((key) => allowed.has(key));
+
+const isSafeDisplay = (value: unknown) =>
+  typeof value === 'string' &&
+  value.length <= 255 &&
+  !Array.from(value).some((character) => {
+    const codePoint = character.codePointAt(0) ?? 0;
+    return codePoint < 32 || codePoint === 127;
+  });
+
+const getKnowledgeReferenceIssues = (
+  nodes: AppNode[],
+): GraphValidationIssue[] =>
+  getAllWorkflowNodes(nodes).flatMap((node) => {
+    if (node.type !== 'llmNode') return [];
+    const data = node.data as Record<string, unknown>;
+    const issues: GraphValidationIssue[] = [];
+
+    const validateList = (
+      key: 'knowledgeBases' | 'knowledgeCollections',
+      itemIsValid: (value: unknown) => boolean,
+    ) => {
+      if (!(key in data)) return;
+      const value = data[key];
+      if (!Array.isArray(value)) {
+        issues.push({
+          level: 'error',
+          code: 'KNOWLEDGE_REFERENCE_INVALID',
+          message: 'Knowledge 참조 형식이 올바르지 않습니다.',
+          nodeId: node.id,
+        });
+        return;
+      }
+      if (value.length > MAX_KNOWLEDGE_REFERENCES_PER_TYPE) {
+        issues.push({
+          level: 'error',
+          code: 'KNOWLEDGE_REFERENCE_LIMIT_EXCEEDED',
+          message: `Knowledge 참조는 유형별로 최대 ${MAX_KNOWLEDGE_REFERENCES_PER_TYPE}개까지 선택할 수 있습니다.`,
+          nodeId: node.id,
+        });
+        return;
+      }
+      if (!value.every(itemIsValid)) {
+        issues.push({
+          level: 'error',
+          code: 'KNOWLEDGE_REFERENCE_INVALID',
+          message: 'Knowledge 참조 형식이 올바르지 않습니다.',
+          nodeId: node.id,
+        });
+      }
+    };
+
+    validateList('knowledgeBases', (value) => {
+      if (!isRecord(value)) return false;
+      const keys = Object.keys(value);
+      return (
+        keys.length === 2 &&
+        hasOnlyKeys(value, new Set(['id', 'name'])) &&
+        CANONICAL_UUID_PATTERN.test(String(value.id ?? '')) &&
+        isSafeDisplay(value.name)
+      );
+    });
+    validateList('knowledgeCollections', (value) => {
+      if (!isRecord(value) || !('id' in value)) return false;
+      const keys = Object.keys(value);
+      return (
+        keys.length >= 1 &&
+        keys.length <= 2 &&
+        hasOnlyKeys(value, new Set(['id', 'safeLabel'])) &&
+        CANONICAL_UUID_PATTERN.test(String(value.id ?? '')) &&
+        (!('safeLabel' in value) || isSafeDisplay(value.safeLabel))
+      );
+    });
+    return issues;
+  });
+
 const getSlackCompatibilityIssues = (
   nodes: AppNode[],
 ): GraphValidationIssue[] =>
@@ -393,6 +478,7 @@ export const validateWorkflowGraph = (
 
   const allIssues = [
     ...directIssues,
+    ...getKnowledgeReferenceIssues(nodes),
     ...getSlackCompatibilityIssues(nodes),
     ...getRemovedSlackSelectorIssues(nodes),
     ...cycleIssue,
diff --git a/apps/gateway/adapters/db/deployment_preflight_repository.py b/apps/gateway/adapters/db/deployment_preflight_repository.py
index 549713970..41771925c 100644
--- a/apps/gateway/adapters/db/deployment_preflight_repository.py
+++ b/apps/gateway/adapters/db/deployment_preflight_repository.py
@@ -3,10 +3,12 @@
 import uuid
 from collections.abc import Iterable
 
+from sqlalchemy import and_, func
 from sqlalchemy.orm import Session
 
 from apps.gateway.application.deployment.models import (
     KnowledgeBaseSnapshot,
+    KnowledgeCollectionPreflightSnapshot,
     WorkflowNodeTargetSnapshot,
 )
 from apps.shared.db.models.app import App
@@ -16,6 +18,16 @@
     KnowledgeCollectionItem,
 )
 from apps.shared.db.models.workflow_deployment import DeploymentType, WorkflowDeployment
+from apps.shared.domain.knowledge_runtime_candidates import (
+    MAX_RUNTIME_CANDIDATE_BUDGET,
+)
+from apps.shared.services.knowledge_resource_eligibility import (
+    is_anonymous_public_knowledge_collection,
+    knowledge_base_operational_predicates,
+    knowledge_collection_anonymous_public_predicates,
+    knowledge_collection_operational_predicates,
+    retrieval_visible_chunk_exists,
+)
 
 
 class SqlAlchemyDeploymentPreflightRepository:
@@ -35,7 +47,8 @@ def get_active_knowledge_bases(
             .filter(
                 KnowledgeBase.id.in_(ids),
                 KnowledgeBase.organization_id == organization_id,
-                KnowledgeBase.lifecycle_state == "active",
+                *knowledge_base_operational_predicates(),
+                retrieval_visible_chunk_exists(),
             )
             .all()
         )
@@ -58,9 +71,20 @@ def get_public_runtime_eligible_knowledge_base_ids(
 
         items = (
             self.db.query(KnowledgeCollectionItem)
+            .join(
+                KnowledgeBase,
+                and_(
+                    KnowledgeBase.id == KnowledgeCollectionItem.knowledge_base_id,
+                    KnowledgeBase.organization_id
+                    == KnowledgeCollectionItem.organization_id,
+                ),
+            )
             .filter(
                 KnowledgeCollectionItem.organization_id == organization_id,
                 KnowledgeCollectionItem.knowledge_base_id.in_(ids),
+                KnowledgeBase.organization_id == organization_id,
+                *knowledge_base_operational_predicates(),
+                retrieval_visible_chunk_exists(),
             )
             .all()
         )
@@ -73,15 +97,14 @@ def get_public_runtime_eligible_knowledge_base_ids(
             .filter(
                 KnowledgeCollection.id.in_(collection_ids),
                 KnowledgeCollection.organization_id == organization_id,
-                KnowledgeCollection.lifecycle_state == "active",
+                *knowledge_collection_anonymous_public_predicates(),
             )
             .all()
         )
         public_collection_ids = {
             collection.id
             for collection in collections
-            if (getattr(collection, "safe_metadata", None) or {}).get("visibility")
-            == "public"
+            if is_anonymous_public_knowledge_collection(collection)
         }
         return {
             item.knowledge_base_id
@@ -89,6 +112,84 @@ def get_public_runtime_eligible_knowledge_base_ids(
             if item.collection_id in public_collection_ids
         }
 
+    def get_active_knowledge_collections(
+        self,
+        collection_ids: Iterable[uuid.UUID],
+        organization_id: uuid.UUID | None,
+    ) -> dict[uuid.UUID, KnowledgeCollectionPreflightSnapshot]:
+        ids = _dedupe_ids(collection_ids)
+        if not ids or organization_id is None:
+            return {}
+
+        collections = (
+            self.db.query(KnowledgeCollection)
+            .filter(
+                KnowledgeCollection.id.in_(ids),
+                KnowledgeCollection.organization_id == organization_id,
+                *knowledge_collection_operational_predicates(),
+            )
+            .all()
+        )
+        active_collection_ids = [collection.id for collection in collections]
+        if not active_collection_ids:
+            return {}
+
+        aggregate_rows = (
+            self.db.query(
+                KnowledgeCollectionItem.collection_id,
+                func.count(KnowledgeCollectionItem.knowledge_base_id),
+                func.count(KnowledgeBase.source_identity_id),
+            )
+            .join(
+                KnowledgeBase,
+                and_(
+                    KnowledgeBase.id
+                    == KnowledgeCollectionItem.knowledge_base_id,
+                    KnowledgeBase.organization_id
+                    == KnowledgeCollectionItem.organization_id,
+                ),
+            )
+            .filter(
+                KnowledgeCollectionItem.organization_id == organization_id,
+                KnowledgeCollectionItem.collection_id.in_(
+                    active_collection_ids
+                ),
+                KnowledgeBase.organization_id == organization_id,
+                *knowledge_base_operational_predicates(),
+                retrieval_visible_chunk_exists(),
+            )
+            .group_by(KnowledgeCollectionItem.collection_id)
+            .all()
+        )
+        aggregate_by_collection: dict[uuid.UUID, tuple[int, bool]] = {}
+        for collection_id, member_count, source_managed_count in aggregate_rows:
+            safe_member_count = min(
+                max(int(member_count or 0), 0),
+                MAX_RUNTIME_CANDIDATE_BUDGET + 1,
+            )
+            aggregate_by_collection[collection_id] = (
+                safe_member_count,
+                int(source_managed_count or 0) > 0,
+            )
+
+        result: dict[uuid.UUID, KnowledgeCollectionPreflightSnapshot] = {}
+        for collection in collections:
+            metadata = getattr(collection, "safe_metadata", None)
+            safe_metadata = metadata if isinstance(metadata, dict) else {}
+            member_count, has_source_managed_members = (
+                aggregate_by_collection.get(collection.id, (0, False))
+            )
+            result[collection.id] = KnowledgeCollectionPreflightSnapshot(
+                id=collection.id,
+                public=safe_metadata.get("visibility") == "public",
+                source_managed=(
+                    getattr(collection, "source_identity_id", None) is not None
+                ),
+                has_source_managed_members=has_source_managed_members,
+                candidate_member_count=member_count,
+            )
+        return result
+
     def get_workflow_node_target(
         self,
         app_id: uuid.UUID,
diff --git a/apps/gateway/api/v1/endpoints/knowledge.py b/apps/gateway/api/v1/endpoints/knowledge.py
index 601c284d8..88762810f 100644
--- a/apps/gateway/api/v1/endpoints/knowledge.py
+++ b/apps/gateway/api/v1/endpoints/knowledge.py
@@ -43,6 +43,10 @@
     KnowledgeCollectionService,
     KnowledgeCollectionServiceError,
 )
+from apps.gateway.services.knowledge_collection_picker_query_service import (
+    KnowledgeCollectionPickerQueryService,
+    KnowledgeCollectionPickerUnavailable,
+)
 from apps.gateway.services.knowledge_document_content_service import (
     KnowledgeDocumentContentService,
 )
@@ -90,6 +94,7 @@
     KnowledgeCollectionItemReorderRequest,
     KnowledgeCollectionItemsResponse,
     KnowledgeCollectionLinkCandidatesResponse,
+    KnowledgeCollectionLLMSelectableResponse,
     KnowledgeCollectionListResponse,
     KnowledgeCollectionPermissionGrantRequest,
     KnowledgeCollectionPermissionBundleGrantRequest,
@@ -512,6 +517,40 @@ def list_llm_selectable_knowledge_bases(
     )
 
 
+@router.get(
+    "/llm-selectable-collections",
+    response_model=KnowledgeCollectionLLMSelectableResponse,
+)
+def list_llm_selectable_knowledge_collections(
+    request: Request,
+    x_organization_id: str | None = Header(default=None, alias="X-Organization-Id"),
+    db: Session = Depends(get_db),
+    current_user: User = Depends(get_current_user),
+):
+    """Return only active Collections the current editor may route through."""
+
+    organization_id = resolve_active_organization_id(
+        db,
+        request,
+        x_organization_id,
+        current_user.id,
+    )
+    service = KnowledgeCollectionPickerQueryService(
+        db,
+        user_id=current_user.id,
+        organization_id=organization_id,
+    )
+    try:
+        return service.list_llm_selectable()
+    except KnowledgeCollectionPickerUnavailable:
+        raise_api_error(
+            request,
+            status.HTTP_503_SERVICE_UNAVAILABLE,
+            "knowledge.collection_picker_unavailable",
+            "Knowledge Collection candidates are temporarily unavailable.",
+        )
+
+
 @router.post("/candidates/resolve", response_model=KnowledgeCandidateResolution)
 def resolve_knowledge_candidates(
     candidate_request: KnowledgeCandidateResolveRequest,
diff --git a/apps/gateway/api/v1/endpoints/workflow.py b/apps/gateway/api/v1/endpoints/workflow.py
index ffb6eff11..b3612d001 100644
--- a/apps/gateway/api/v1/endpoints/workflow.py
+++ b/apps/gateway/api/v1/endpoints/workflow.py
@@ -56,6 +56,10 @@
 from apps.shared.domain.external_effect_error import (
     safe_external_effect_error_payload,
 )
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowKnowledgeReferenceError,
+    parse_workflow_knowledge_references,
+)
 from apps.shared.permissions import workflow_auth_state_allows
 from apps.workflow_engine.services.model_router import ModelCandidate, ModelRouter
 from apps.workflow_engine.services.model_routing_policy_refresh import (
@@ -3288,6 +3292,14 @@ def _run_cost_optimizer_candidate(
 
 
 def validate_execution_graph(graph: dict):
+    try:
+        parse_workflow_knowledge_references(graph)
+    except WorkflowKnowledgeReferenceError as exc:
+        raise HTTPException(
+            status_code=422,
+            detail={"code": exc.reason_code, "field": exc.field_path},
+        ) from exc
+
     nodes = graph.get("nodes") or []
     edges = graph.get("edges") or []
     node_map = {
@@ -3468,6 +3480,12 @@ def patch_model_routing_policy_endpoint(
     legacy_policy["refresh"] = legacy_refresh
     node_data["model_routing_policy"] = legacy_policy
     node["data"] = node_data
+    WorkflowService.validate_knowledge_references(
+        db,
+        next_graph,
+        user_id=current_user.id,
+        organization_id=workflow.organization_id,
+    )
     workflow.graph = next_graph
 
     policy = _get_model_routing_policy_for_workflow(db, workflow, node_id)
@@ -3783,11 +3801,18 @@ def apply_cost_optimizer_recommendations(
         SimpleNamespace(id=workflow.id, graph=current_graph),
         node_id,
     )
-    workflow.graph = _patch_cost_optimizer_candidate_graph(
+    next_graph = _patch_cost_optimizer_candidate_graph(
         current_graph,
         node_id,
         candidate_settings,
     )
+    WorkflowService.validate_knowledge_references(
+        db,
+        next_graph,
+        user_id=current_user.id,
+        organization_id=workflow.organization_id,
+    )
+    workflow.graph = next_graph
     db.commit()
     try:
         db.refresh(workflow)
@@ -4442,11 +4467,18 @@ def apply_cost_optimizer_candidate(
         SimpleNamespace(id=workflow.id, graph=current_graph),
         node_id,
     )
-    workflow.graph = _patch_cost_optimizer_candidate_graph(
+    next_graph = _patch_cost_optimizer_candidate_graph(
         current_graph,
         node_id,
         candidate_settings,
     )
+    WorkflowService.validate_knowledge_references(
+        db,
+        next_graph,
+        user_id=current_user.id,
+        organization_id=workflow.organization_id,
+    )
+    workflow.graph = next_graph
     if applied_candidate_row is not None:
         applied_at = datetime.now(timezone.utc)
         for candidate_row in comparison_candidate_rows:
diff --git a/apps/gateway/application/deployment/models.py b/apps/gateway/application/deployment/models.py
index 099d186a8..880c62957 100644
--- a/apps/gateway/application/deployment/models.py
+++ b/apps/gateway/application/deployment/models.py
@@ -18,6 +18,15 @@ class KnowledgeBaseSnapshot:
     source_managed: bool
 
 
+@dataclass(frozen=True)
+class KnowledgeCollectionPreflightSnapshot:
+    id: uuid.UUID
+    public: bool
+    source_managed: bool
+    has_source_managed_members: bool
+    candidate_member_count: int
+
+
 @dataclass(frozen=True)
 class WorkflowNodeTargetSnapshot:
     app_id: uuid.UUID
@@ -43,6 +52,8 @@ class PreflightNodeResult:
     status: PreflightStatus
     reason_codes: tuple[str, ...]
     knowledge_base_count_bucket: str
+    knowledge_collection_count_bucket: str
+    candidate_budget_limited: bool
 
 
 @dataclass(frozen=True)
@@ -50,6 +61,8 @@ class PreflightSummary:
     blocked_reason: str | None
     affected_node_count: int
     affected_kb_count_bucket: str
+    affected_collection_count_bucket: str
+    candidate_budget_limited: bool
 
 
 @dataclass(frozen=True)
diff --git a/apps/gateway/application/deployment/ports.py b/apps/gateway/application/deployment/ports.py
index 5a3b3e47e..bfafac4dd 100644
--- a/apps/gateway/application/deployment/ports.py
+++ b/apps/gateway/application/deployment/ports.py
@@ -4,7 +4,11 @@
 from collections.abc import Iterable, Mapping
 from typing import Protocol
 
-from .models import KnowledgeBaseSnapshot, WorkflowNodeTargetSnapshot
+from .models import (
+    KnowledgeBaseSnapshot,
+    KnowledgeCollectionPreflightSnapshot,
+    WorkflowNodeTargetSnapshot,
+)
 
 
 class DeploymentPreflightRepository(Protocol):
@@ -20,6 +24,12 @@ def get_public_runtime_eligible_knowledge_base_ids(
         organization_id: uuid.UUID | None,
     ) -> set[uuid.UUID]: ...
 
+    def get_active_knowledge_collections(
+        self,
+        collection_ids: Iterable[uuid.UUID],
+        organization_id: uuid.UUID | None,
+    ) -> Mapping[uuid.UUID, KnowledgeCollectionPreflightSnapshot]: ...
+
     def get_workflow_node_target(
         self,
         app_id: uuid.UUID,
diff --git a/apps/gateway/application/deployment/preflight.py b/apps/gateway/application/deployment/preflight.py
index 3026c0e04..c6f03669c 100644
--- a/apps/gateway/application/deployment/preflight.py
+++ b/apps/gateway/application/deployment/preflight.py
@@ -4,9 +4,19 @@
 from collections.abc import Mapping
 from dataclasses import dataclass, replace
 
+from apps.shared.domain.knowledge_runtime_candidates import (
+    MAX_RUNTIME_CANDIDATE_BUDGET,
+)
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowKnowledgeReferenceError,
+    parse_llm_knowledge_references,
+    parse_workflow_knowledge_references,
+)
+
 from .errors import DeploymentPreflightBlocked
 from .models import (
     DeploymentPreflightResult,
+    KnowledgeCollectionPreflightSnapshot,
     PreflightAudience,
     PreflightNodeResult,
     PreflightRequiredAction,
@@ -16,18 +26,34 @@
 from .ports import DeploymentPreflightRepository
 
 PUBLIC_REQUIRED_ACTIONS = {
+    "knowledge_reference_invalid": PreflightRequiredAction(
+        action="fix_invalid_knowledge_references",
+        label="잘못된 지식 참조 형식을 수정하세요",
+    ),
+    "knowledge_reference_limit_exceeded": PreflightRequiredAction(
+        action="reduce_knowledge_references",
+        label="LLM 노드의 지식 참조 수를 허용 범위로 줄이세요",
+    ),
     "private_kb_requires_execution_subject": PreflightRequiredAction(
         action="remove_private_kb_or_use_authenticated_run",
         label="Private KB를 제거하거나 인증 실행 경로를 사용하세요",
     ),
     "source_public_exposure_required": PreflightRequiredAction(
-        action="approve_source_public_exposure_or_remove_kb",
-        label="Source 공개 승인 정책을 추가하거나 해당 KB를 제거하세요",
+        action="approve_source_public_exposure_or_remove_reference",
+        label="Source 공개 승인 정책을 추가하거나 해당 지식 참조를 제거하세요",
     ),
     "knowledge_base_unavailable": PreflightRequiredAction(
         action="remove_unavailable_kb_reference",
         label="사용할 수 없는 KB 참조를 제거하세요",
     ),
+    "private_collection_requires_execution_subject": PreflightRequiredAction(
+        action="remove_private_collection_or_use_authenticated_run",
+        label="Private Collection을 제거하거나 인증 실행 경로를 사용하세요",
+    ),
+    "knowledge_collection_unavailable": PreflightRequiredAction(
+        action="remove_unavailable_collection_reference",
+        label="사용할 수 없는 Collection 참조를 제거하세요",
+    ),
     "workflow_node_target_unavailable": PreflightRequiredAction(
         action="fix_workflow_node_target_or_remove_reference",
         label="서브 모듈 대상 배포를 복구하거나 노드를 제거하세요",
@@ -43,9 +69,15 @@
         action="verify_parent_execution_subject",
         label="상위 워크플로우 실행 주체가 KB 권한을 제공하는지 확인하세요",
     ),
+    "knowledge_candidate_budget_limited": PreflightRequiredAction(
+        action="review_knowledge_candidate_selection",
+        label="실행 후보 제한을 고려해 KB와 Collection 선택을 검토하세요",
+    ),
 }
 
 NON_DOWNGRADABLE_REASON_CODES = {
+    "knowledge_reference_invalid",
+    "knowledge_reference_limit_exceeded",
     "workflow_node_target_unavailable",
     "workflow_node_cycle_detected",
 }
@@ -68,6 +100,8 @@ class _PreflightIssue:
     severity: PreflightStatus
     reason_code: str
     knowledge_base_count: int = 0
+    knowledge_collection_count: int = 0
+    candidate_budget_limited: bool = False
 
 
 class DeploymentPreflightUseCase:
@@ -95,8 +129,13 @@ def preview(
         graph_snapshot: dict,
         audience_hint: PreflightAudience | None = None,
         is_active: bool = True,
+        trusted_audience_override: PreflightAudience | None = None,
     ) -> DeploymentPreflightResult:
-        audience = self._effective_audience(deployment_type, audience_hint)
+        audience = self._effective_audience(
+            deployment_type,
+            audience_hint,
+            trusted_audience_override,
+        )
         issues = self._evaluate_graph(
             graph_snapshot,
             audience=audience,
@@ -133,7 +172,10 @@ def _effective_audience(
         self,
         deployment_type: str,
         audience_hint: PreflightAudience | None,
+        trusted_audience_override: PreflightAudience | None,
     ) -> PreflightAudience:
+        if trusted_audience_override == "authenticated_user":
+            return "authenticated_user"
         derived = self.server_derived_audience(deployment_type)
         if audience_hint == "anonymous_public":
             return "anonymous_public"
@@ -147,56 +189,78 @@ def _evaluate_graph(
         depth: int,
         visited_app_ids: set[uuid.UUID],
     ) -> list[_PreflightIssue]:
-        if not isinstance(graph_snapshot, dict):
-            return []
-        nodes = graph_snapshot.get("nodes")
-        if not isinstance(nodes, list):
-            return []
-
+        configuration_issue = self._graph_configuration_issue(graph_snapshot)
+        if configuration_issue is not None:
+            return [configuration_issue]
         issues: list[_PreflightIssue] = []
-        for node in nodes:
-            if not isinstance(node, dict):
-                continue
-            node_id = self._safe_node_id(node)
-            node_type = self._safe_node_type(node)
-            data = node.get("data")
-            if not isinstance(data, dict):
-                data = {}
-
-            kb_ids, invalid_count = self._extract_knowledge_base_ids(data)
-            if invalid_count:
-                issues.append(
-                    _PreflightIssue(
-                        node_id=node_id,
-                        node_type=node_type,
-                        severity=(
-                            "blocked" if audience == "anonymous_public" else "warning"
-                        ),
-                        reason_code="knowledge_base_unavailable",
-                        knowledge_base_count=invalid_count,
-                    )
-                )
-            if kb_ids:
-                issues.extend(
-                    self._evaluate_kb_references(
-                        kb_ids,
-                        node_id=node_id,
-                        node_type=node_type,
-                        audience=audience,
-                    )
-                )
-
-            if node_type == "workflowNode":
-                issues.extend(
-                    self._evaluate_workflow_node_target(
-                        data,
-                        node_id=node_id,
-                        node_type=node_type,
-                        audience=audience,
-                        depth=depth,
-                        visited_app_ids=visited_app_ids,
+        pending_graphs = [graph_snapshot]
+        while pending_graphs:
+            current_graph = pending_graphs.pop()
+            for node in current_graph.get("nodes", []):
+                node_id = self._safe_node_id(node)
+                node_type = self._safe_node_type(node)
+                data = node.get("data")
+                if not isinstance(data, dict):
+                    data = {}
+
+                if node_type == "llmNode":
+                    references = parse_llm_knowledge_references(data)
+                    direct_ids = list(references.direct_kb_ids)
+                    collection_ids = list(references.collection_ids)
+                    if direct_ids:
+                        issues.extend(
+                            self._evaluate_kb_references(
+                                direct_ids,
+                                node_id=node_id,
+                                node_type=node_type,
+                                audience=audience,
+                            )
+                        )
+                    collection_snapshots: Mapping[
+                        uuid.UUID, KnowledgeCollectionPreflightSnapshot
+                    ] = {}
+                    if collection_ids:
+                        collection_issues, collection_snapshots = (
+                            self._evaluate_collection_references(
+                                collection_ids,
+                                node_id=node_id,
+                                node_type=node_type,
+                                audience=audience,
+                            )
+                        )
+                        issues.extend(collection_issues)
+                    if self._candidate_budget_may_be_limited(
+                        direct_ids,
+                        collection_snapshots,
+                    ):
+                        issues.append(
+                            _PreflightIssue(
+                                node_id=node_id,
+                                node_type=node_type,
+                                severity="warning",
+                                reason_code="knowledge_candidate_budget_limited",
+                                knowledge_collection_count=len(
+                                    collection_snapshots
+                                ),
+                                candidate_budget_limited=True,
+                            )
+                        )
+
+                subgraph = data.get("subGraph")
+                if isinstance(subgraph, dict):
+                    pending_graphs.append(subgraph)
+
+                if node_type == "workflowNode":
+                    issues.extend(
+                        self._evaluate_workflow_node_target(
+                            data,
+                            node_id=node_id,
+                            node_type=node_type,
+                            audience=audience,
+                            depth=depth,
+                            visited_app_ids=visited_app_ids,
+                        )
                     )
-                )
         return issues
 
     def _evaluate_kb_references(
@@ -207,35 +271,49 @@ def _evaluate_kb_references(
         node_type: str,
         audience: PreflightAudience,
     ) -> list[_PreflightIssue]:
-        if audience == "workflow_node_inherited":
-            return [
+        kbs_by_id = self.repository.get_active_knowledge_bases(
+            kb_ids,
+            self.organization_id,
+        )
+        missing_count = sum(kb_id not in kbs_by_id for kb_id in kb_ids)
+        issues: list[_PreflightIssue] = []
+        if missing_count:
+            issues.append(
                 _PreflightIssue(
                     node_id=node_id,
                     node_type=node_type,
-                    severity="warning",
-                    reason_code="workflow_node_execution_subject_inherited",
-                    knowledge_base_count=len(kb_ids),
+                    severity="blocked",
+                    reason_code="knowledge_base_unavailable",
+                    knowledge_base_count=missing_count,
                 )
-            ]
+            )
+
+        active_ids = [kb_id for kb_id in kb_ids if kb_id in kbs_by_id]
+        if audience == "workflow_node_inherited":
+            if active_ids:
+                issues.append(
+                    _PreflightIssue(
+                        node_id=node_id,
+                        node_type=node_type,
+                        severity="warning",
+                        reason_code="workflow_node_execution_subject_inherited",
+                        knowledge_base_count=len(active_ids),
+                    )
+                )
+            return issues
         if audience == "authenticated_user":
-            return []
+            return issues
 
-        kbs_by_id = self.repository.get_active_knowledge_bases(
-            kb_ids,
-            self.organization_id,
-        )
         public_eligible_ids = (
             self.repository.get_public_runtime_eligible_knowledge_base_ids(
-                kb_ids,
+                active_ids,
                 self.organization_id,
             )
         )
         issue_counts: dict[str, int] = {}
-        for kb_id in kb_ids:
-            kb = kbs_by_id.get(kb_id)
-            if kb is None:
-                reason_code = "knowledge_base_unavailable"
-            elif kb_id not in public_eligible_ids:
+        for kb_id in active_ids:
+            kb = kbs_by_id[kb_id]
+            if kb_id not in public_eligible_ids:
                 reason_code = "private_kb_requires_execution_subject"
             elif kb.source_managed:
                 reason_code = "source_public_exposure_required"
@@ -243,16 +321,130 @@ def _evaluate_kb_references(
                 continue
             issue_counts[reason_code] = issue_counts.get(reason_code, 0) + 1
 
-        return [
-            _PreflightIssue(
-                node_id=node_id,
-                node_type=node_type,
+        issues.extend(
+            [
+                _PreflightIssue(
+                    node_id=node_id,
+                    node_type=node_type,
+                    severity="blocked",
+                    reason_code=reason_code,
+                    knowledge_base_count=count,
+                )
+                for reason_code, count in sorted(issue_counts.items())
+            ]
+        )
+        return issues
+
+    def _evaluate_collection_references(
+        self,
+        collection_ids: list[uuid.UUID],
+        *,
+        node_id: str | None,
+        node_type: str,
+        audience: PreflightAudience,
+    ) -> tuple[
+        list[_PreflightIssue],
+        Mapping[uuid.UUID, KnowledgeCollectionPreflightSnapshot],
+    ]:
+        collections_by_id = self.repository.get_active_knowledge_collections(
+            collection_ids,
+            self.organization_id,
+        )
+        missing_count = sum(
+            collection_id not in collections_by_id
+            for collection_id in collection_ids
+        )
+        issues: list[_PreflightIssue] = []
+        if missing_count:
+            issues.append(
+                _PreflightIssue(
+                    node_id=node_id,
+                    node_type=node_type,
+                    severity="blocked",
+                    reason_code="knowledge_collection_unavailable",
+                    knowledge_collection_count=missing_count,
+                )
+            )
+
+        active_ids = [
+            collection_id
+            for collection_id in collection_ids
+            if collection_id in collections_by_id
+        ]
+        if audience == "workflow_node_inherited":
+            if active_ids:
+                issues.append(
+                    _PreflightIssue(
+                        node_id=node_id,
+                        node_type=node_type,
+                        severity="warning",
+                        reason_code="workflow_node_execution_subject_inherited",
+                        knowledge_collection_count=len(active_ids),
+                    )
+                )
+            return issues, collections_by_id
+        if audience == "authenticated_user":
+            return issues, collections_by_id
+
+        issue_counts: dict[str, int] = {}
+        for collection_id in active_ids:
+            collection = collections_by_id[collection_id]
+            if not collection.public:
+                reason_code = "private_collection_requires_execution_subject"
+            elif (
+                collection.source_managed
+                or collection.has_source_managed_members
+            ):
+                reason_code = "source_public_exposure_required"
+            else:
+                continue
+            issue_counts[reason_code] = issue_counts.get(reason_code, 0) + 1
+        issues.extend(
+            [
+                _PreflightIssue(
+                    node_id=node_id,
+                    node_type=node_type,
+                    severity="blocked",
+                    reason_code=reason_code,
+                    knowledge_collection_count=count,
+                )
+                for reason_code, count in sorted(issue_counts.items())
+            ]
+        )
+        return issues, collections_by_id
+
+    @staticmethod
+    def _candidate_budget_may_be_limited(
+        direct_ids: list[uuid.UUID],
+        collections_by_id: Mapping[
+            uuid.UUID, KnowledgeCollectionPreflightSnapshot
+        ],
+    ) -> bool:
+        conservative_candidate_count = len(direct_ids) + sum(
+            max(snapshot.candidate_member_count, 0)
+            for snapshot in collections_by_id.values()
+        )
+        return conservative_candidate_count > MAX_RUNTIME_CANDIDATE_BUDGET
+
+    @staticmethod
+    def _graph_configuration_issue(
+        graph_snapshot: object,
+    ) -> _PreflightIssue | None:
+        try:
+            parse_workflow_knowledge_references(graph_snapshot)
+        except WorkflowKnowledgeReferenceError as exc:
+            reason_code = (
+                "knowledge_reference_limit_exceeded"
+                if exc.reason_code == "knowledge_reference_limit_exceeded"
+                else "knowledge_reference_invalid"
+            )
+            return _PreflightIssue(
+                node_id=None,
+                node_type="llmNode",
                 severity="blocked",
                 reason_code=reason_code,
-                knowledge_base_count=count,
             )
-            for reason_code, count in sorted(issue_counts.items())
-        ]
+        return None
 
     def _evaluate_workflow_node_target(
         self,
@@ -341,8 +533,21 @@ def _result(
         elif any(issue.severity == "warning" for issue in issues):
             status = "warning"
 
-        first_reason = next((issue.reason_code for issue in issues), None)
+        first_reason = next(
+            (
+                issue.reason_code
+                for issue in issues
+                if issue.severity == "blocked"
+            ),
+            next((issue.reason_code for issue in issues), None),
+        )
         affected_kb_count = sum(issue.knowledge_base_count for issue in issues)
+        affected_collection_count = sum(
+            issue.knowledge_collection_count for issue in issues
+        )
+        candidate_budget_limited = any(
+            issue.candidate_budget_limited for issue in issues
+        )
         warnings = tuple(
             dict.fromkeys(
                 issue.reason_code
@@ -357,6 +562,10 @@ def _result(
                 blocked_reason=first_reason,
                 affected_node_count=len(node_results),
                 affected_kb_count_bucket=self._bucket_count(affected_kb_count),
+                affected_collection_count_bucket=self._bucket_count(
+                    affected_collection_count
+                ),
+                candidate_budget_limited=candidate_budget_limited,
             ),
             required_actions=self._required_actions(issues),
             warnings=warnings,
@@ -389,6 +598,16 @@ def _node_results(
                     knowledge_base_count_bucket=self._bucket_count(
                         sum(issue.knowledge_base_count for issue in node_issues)
                     ),
+                    knowledge_collection_count_bucket=self._bucket_count(
+                        sum(
+                            issue.knowledge_collection_count
+                            for issue in node_issues
+                        )
+                    ),
+                    candidate_budget_limited=any(
+                        issue.candidate_budget_limited
+                        for issue in node_issues
+                    ),
                 )
             )
         return tuple(results)
@@ -420,24 +639,6 @@ def _downgrade_blocked_issues(
             for issue in issues
         ]
 
-    @staticmethod
-    def _extract_knowledge_base_ids(data: dict) -> tuple[list[uuid.UUID], int]:
-        raw_values = data.get("knowledgeBases")
-        if not isinstance(raw_values, list):
-            return [], 0
-
-        ids: list[uuid.UUID] = []
-        invalid_count = 0
-        for value in raw_values:
-            raw_id = value.get("id") if isinstance(value, dict) else value
-            parsed = DeploymentPreflightUseCase._uuid_or_none(raw_id)
-            if parsed is None:
-                invalid_count += 1
-                continue
-            if parsed not in ids:
-                ids.append(parsed)
-        return ids, invalid_count
-
     @staticmethod
     def _safe_node_id(node: dict) -> str | None:
         node_id = node.get("id")
diff --git a/apps/gateway/services/agent_builder_service.py b/apps/gateway/services/agent_builder_service.py
index 57f2e2fe6..c3e5236db 100644
--- a/apps/gateway/services/agent_builder_service.py
+++ b/apps/gateway/services/agent_builder_service.py
@@ -1860,6 +1860,12 @@ def apply_draft(
             )
 
         try:
+            WorkflowService.validate_knowledge_references(
+                self.db,
+                save_graph,
+                user_id=self.user.id,
+                organization_id=self.organization_id,
+            )
             WorkflowService.validate_mail_credential_references(
                 self.db,
                 save_graph,
diff --git a/apps/gateway/services/app_service.py b/apps/gateway/services/app_service.py
index e5b233ef6..1d9c2ad6f 100644
--- a/apps/gateway/services/app_service.py
+++ b/apps/gateway/services/app_service.py
@@ -1091,7 +1091,7 @@ def delete_app(db: Session, app_id: str, user_id: str):
     def _clean_graph_data(graph_snapshot: dict) -> dict:
         """
         그래프 스냅샷에서 민감 정보를 제거합니다.
-        (knowledgeBases, api_token, authConfig, password, email 등)
+        (knowledgeBases, knowledgeCollections, api_token, authConfig, password, email 등)
         """
         from apps.shared.domain.workflow_node_binding import (
             strip_workflow_node_bindings,
@@ -1110,6 +1110,7 @@ def _clean_graph_data(graph_snapshot: dict) -> dict:
 
             if node_type == "llmNode":
                 data.pop("knowledgeBases", None)
+                data.pop("knowledgeCollections", None)
             elif node_type == "githubNode":
                 data.pop("api_token", None)
             elif node_type == "httpRequestNode":
diff --git a/apps/gateway/services/deployment_service.py b/apps/gateway/services/deployment_service.py
index f5ac97b62..f4a39d390 100644
--- a/apps/gateway/services/deployment_service.py
+++ b/apps/gateway/services/deployment_service.py
@@ -119,6 +119,12 @@ def create_deployment(
             workflow.id,
             deployment_in.graph_snapshot,
         )
+        WorkflowService.validate_knowledge_references(
+            db,
+            graph_snapshot,
+            user_id=user_id,
+            organization_id=workflow.organization_id,
+        )
         graph_snapshot = DeploymentService.bind_workflow_node_targets(
             db,
             graph_snapshot,
diff --git a/apps/gateway/services/knowledge_base_query_service.py b/apps/gateway/services/knowledge_base_query_service.py
index 705eaa872..3758af7d9 100644
--- a/apps/gateway/services/knowledge_base_query_service.py
+++ b/apps/gateway/services/knowledge_base_query_service.py
@@ -42,6 +42,10 @@
     KnowledgeBaseResponse,
 )
 from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
+from apps.shared.services.knowledge_resource_eligibility import (
+    knowledge_base_operational_predicates,
+    retrieval_visible_chunk_exists,
+)
 from apps.shared.services.knowledge_schema_readiness import (
     check_knowledge_schema_readiness,
     table_has_column,
@@ -585,7 +589,8 @@ def list_llm_selectable(
             self.db.query(KnowledgeBase)
             .filter(
                 KnowledgeBase.organization_id == organization_id,
-                KnowledgeBase.lifecycle_state == "active",
+                *knowledge_base_operational_predicates(),
+                retrieval_visible_chunk_exists(),
             )
             .order_by(KnowledgeBase.created_at.desc())
             .all()
diff --git a/apps/gateway/services/knowledge_collection_picker_query_service.py b/apps/gateway/services/knowledge_collection_picker_query_service.py
new file mode 100644
index 000000000..35ec3a844
--- /dev/null
+++ b/apps/gateway/services/knowledge_collection_picker_query_service.py
@@ -0,0 +1,106 @@
+"""Route-authorized, disclosure-minimal Collection projection for Builder."""
+
+from __future__ import annotations
+
+import uuid
+
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.orm import Session, selectinload
+
+from apps.shared.db.models.knowledge import KnowledgeCollection
+from apps.shared.schemas.knowledge import (
+    KnowledgeCollectionLLMSelectableItem,
+    KnowledgeCollectionLLMSelectableResponse,
+)
+from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
+from apps.shared.services.knowledge_resource_eligibility import (
+    knowledge_collection_operational_predicates,
+)
+from apps.shared.services.knowledge_safe_text import safe_label_from_text
+
+MAX_LLM_SELECTABLE_COLLECTION_SCAN = 500
+
+
+class KnowledgeCollectionPickerUnavailable(RuntimeError):
+    """Sanitized infrastructure failure for the route-safe picker."""
+
+
+class KnowledgeCollectionPickerQueryService:
+    """List active Collections the current editor may route through.
+
+    This projection intentionally does not reuse Collection management responses:
+    it exposes neither raw names/descriptions nor child-derived facts/capabilities.
+    """
+
+    def __init__(
+        self,
+        db: Session,
+        *,
+        user_id: uuid.UUID,
+        organization_id: uuid.UUID,
+    ) -> None:
+        self.db = db
+        self.user_id = user_id
+        self.organization_id = organization_id
+        self.permission_helper = KnowledgePermissionHelper(
+            db,
+            user_id=user_id,
+            organization_id=organization_id,
+        )
+
+    def list_llm_selectable(self) -> KnowledgeCollectionLLMSelectableResponse:
+        try:
+            query = (
+                self.db.query(KnowledgeCollection)
+                .options(selectinload(KnowledgeCollection.source_identity))
+                .filter(
+                    KnowledgeCollection.organization_id == self.organization_id,
+                    *knowledge_collection_operational_predicates(),
+                )
+            )
+            query = self.permission_helper.scope_collection_query_for_action(
+                query,
+                "route",
+            )
+            collections = (
+                query
+                .order_by(
+                    KnowledgeCollection.created_at.desc(),
+                    KnowledgeCollection.id.asc(),
+                )
+                .limit(MAX_LLM_SELECTABLE_COLLECTION_SCAN)
+                .all()
+            )
+        except SQLAlchemyError as exc:
+            raise KnowledgeCollectionPickerUnavailable(
+                "knowledge_collection_picker_unavailable"
+            ) from exc
+
+        return KnowledgeCollectionLLMSelectableResponse(
+            collections=[
+                KnowledgeCollectionLLMSelectableItem(
+                    id=collection.id,
+                    safe_label=self._approved_safe_label(collection),
+                )
+                for collection in collections
+            ]
+        )
+
+    @staticmethod
+    def _approved_safe_label(collection: KnowledgeCollection) -> str | None:
+        source_identity = getattr(collection, "source_identity", None)
+        if getattr(collection, "source_identity_id", None) is not None:
+            if (
+                source_identity is None
+                or getattr(source_identity, "display_policy_state", None) != "approved"
+                or not getattr(source_identity, "is_active", False)
+            ):
+                return None
+            return safe_label_from_text(
+                getattr(source_identity, "safe_display_name", None)
+            )
+
+        safe_metadata = getattr(collection, "safe_metadata", None)
+        if not isinstance(safe_metadata, dict):
+            return None
+        return safe_label_from_text(safe_metadata.get("safe_label"))
diff --git a/apps/gateway/services/knowledge_collection_service.py b/apps/gateway/services/knowledge_collection_service.py
index 3d3835481..b37d96ee0 100644
--- a/apps/gateway/services/knowledge_collection_service.py
+++ b/apps/gateway/services/knowledge_collection_service.py
@@ -739,7 +739,10 @@ def update_visibility(
             )
         if (
             request.visibility == "public"
-            and self._collection_has_source_managed_items(collection.id)
+            and (
+                getattr(collection, "source_identity_id", None) is not None
+                or self._collection_has_source_managed_items(collection.id)
+            )
         ):
             raise KnowledgeCollectionServiceError(
                 409,
diff --git a/apps/gateway/services/knowledge_deployment_preflight_service.py b/apps/gateway/services/knowledge_deployment_preflight_service.py
index fa4e49d41..d2c114ecc 100644
--- a/apps/gateway/services/knowledge_deployment_preflight_service.py
+++ b/apps/gateway/services/knowledge_deployment_preflight_service.py
@@ -117,6 +117,12 @@ def _response_schema(result: DeploymentPreflightResult) -> DeploymentPreflightRe
             blocked_reason=result.safe_summary.blocked_reason,
             affected_node_count=result.safe_summary.affected_node_count,
             affected_kb_count_bucket=result.safe_summary.affected_kb_count_bucket,
+            affected_collection_count_bucket=(
+                result.safe_summary.affected_collection_count_bucket
+            ),
+            candidate_budget_limited=(
+                result.safe_summary.candidate_budget_limited
+            ),
         ),
         required_actions=[
             DeploymentPreflightRequiredAction(
@@ -133,6 +139,10 @@ def _response_schema(result: DeploymentPreflightResult) -> DeploymentPreflightRe
                 status=node.status,
                 reason_codes=list(node.reason_codes),
                 knowledge_base_count_bucket=node.knowledge_base_count_bucket,
+                knowledge_collection_count_bucket=(
+                    node.knowledge_collection_count_bucket
+                ),
+                candidate_budget_limited=node.candidate_budget_limited,
             )
             for node in result.nodes
         ],
diff --git a/apps/gateway/services/workflow_knowledge_reference_service.py b/apps/gateway/services/workflow_knowledge_reference_service.py
new file mode 100644
index 000000000..f0e680fa2
--- /dev/null
+++ b/apps/gateway/services/workflow_knowledge_reference_service.py
@@ -0,0 +1,197 @@
+"""Editable Workflow graph Knowledge reference authorization boundary."""
+
+from __future__ import annotations
+
+import uuid
+from dataclasses import dataclass
+
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.orm import Session
+
+from apps.shared.db.models.knowledge import (
+    KnowledgeBase,
+    KnowledgeCollection,
+)
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowNodeKnowledgeReferences,
+    aggregate_workflow_knowledge_reference_ids,
+    parse_workflow_knowledge_references,
+)
+from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
+from apps.shared.services.knowledge_resource_eligibility import (
+    knowledge_base_operational_predicates,
+    knowledge_collection_operational_predicates,
+    retrieval_visible_chunk_exists,
+)
+
+
+@dataclass(frozen=True, slots=True)
+class WorkflowKnowledgeReferenceUnavailable(Exception):
+    """Generic resource-policy failure without a resource identifier."""
+
+    field_path: str
+    reason_code: str = "knowledge_reference_unavailable"
+
+
+class WorkflowKnowledgeReferenceAuthorizationUnavailable(RuntimeError):
+    """Sanitized retryable database/authorization infrastructure failure."""
+
+
+class WorkflowKnowledgeReferenceService:
+    """Validate graph intent and current editor authorization before a write.
+
+    Collection children are deliberately not loaded here.  Invocation-time
+    child KB/source authorization belongs to the MBA-232 runtime resolver.
+    """
+
+    def __init__(
+        self,
+        db: Session,
+        *,
+        user_id: uuid.UUID,
+        organization_id: uuid.UUID,
+    ) -> None:
+        self.db = db
+        self.user_id = user_id
+        self.organization_id = organization_id
+        self.permission_helper = KnowledgePermissionHelper(
+            db,
+            user_id=user_id,
+            organization_id=organization_id,
+        )
+
+    def validate_editable_graph(
+        self,
+        graph: dict,
+    ) -> tuple[WorkflowNodeKnowledgeReferences, ...]:
+        parsed_nodes = parse_workflow_knowledge_references(graph)
+        self.validate_parsed_references(parsed_nodes)
+        return parsed_nodes
+
+    def validate_parsed_references(
+        self,
+        parsed_nodes: tuple[WorkflowNodeKnowledgeReferences, ...],
+    ) -> None:
+        """Authorize one structurally validated graph reference snapshot."""
+
+        direct_ids, collection_ids = aggregate_workflow_knowledge_reference_ids(
+            parsed_nodes
+        )
+        if not direct_ids and not collection_ids:
+            return
+
+        try:
+            direct_kbs = self._load_direct_kbs(direct_ids)
+            collections = self._load_collections(collection_ids)
+            direct_decisions = self.permission_helper.bulk_evaluate_kb_use(direct_kbs)
+            collection_decisions = (
+                self.permission_helper.bulk_evaluate_collection_action(
+                    collections,
+                    "route",
+                )
+            )
+            retrieval_ready_ids = self._retrieval_ready_ids(direct_ids)
+        except SQLAlchemyError as exc:
+            raise WorkflowKnowledgeReferenceAuthorizationUnavailable(
+                "knowledge_reference_authorization_unavailable"
+            ) from exc
+
+        direct_by_id = {kb.id: kb for kb in direct_kbs}
+        for direct_id in direct_ids:
+            decision = direct_decisions.get(direct_id)
+            if (
+                direct_id not in direct_by_id
+                or decision is None
+                or not decision.allowed
+                or direct_id not in retrieval_ready_ids
+            ):
+                raise WorkflowKnowledgeReferenceUnavailable(
+                    self._first_reference_path(
+                        parsed_nodes,
+                        reference_id=direct_id,
+                        collection=False,
+                    )
+                )
+
+        collection_by_id = {collection.id: collection for collection in collections}
+        for collection_id in collection_ids:
+            decision = collection_decisions.get(collection_id)
+            if (
+                collection_id not in collection_by_id
+                or decision is None
+                or not decision.allowed
+            ):
+                raise WorkflowKnowledgeReferenceUnavailable(
+                    self._first_reference_path(
+                        parsed_nodes,
+                        reference_id=collection_id,
+                        collection=True,
+                    )
+                )
+
+    def _load_direct_kbs(
+        self,
+        direct_ids: tuple[uuid.UUID, ...],
+    ) -> list[KnowledgeBase]:
+        if not direct_ids:
+            return []
+        return (
+            self.db.query(KnowledgeBase)
+            .filter(
+                KnowledgeBase.id.in_(direct_ids),
+                KnowledgeBase.organization_id == self.organization_id,
+                *knowledge_base_operational_predicates(),
+            )
+            .all()
+        )
+
+    def _load_collections(
+        self,
+        collection_ids: tuple[uuid.UUID, ...],
+    ) -> list[KnowledgeCollection]:
+        if not collection_ids:
+            return []
+        return (
+            self.db.query(KnowledgeCollection)
+            .filter(
+                KnowledgeCollection.id.in_(collection_ids),
+                KnowledgeCollection.organization_id == self.organization_id,
+                *knowledge_collection_operational_predicates(),
+            )
+            .all()
+        )
+
+    def _retrieval_ready_ids(
+        self,
+        direct_ids: tuple[uuid.UUID, ...],
+    ) -> set[uuid.UUID]:
+        if not direct_ids:
+            return set()
+        rows = (
+            self.db.query(KnowledgeBase.id)
+            .filter(
+                KnowledgeBase.id.in_(direct_ids),
+                KnowledgeBase.organization_id == self.organization_id,
+                *knowledge_base_operational_predicates(),
+                retrieval_visible_chunk_exists(),
+            )
+            .all()
+        )
+        return {row[0] for row in rows}
+
+    @staticmethod
+    def _first_reference_path(
+        parsed_nodes: tuple[WorkflowNodeKnowledgeReferences, ...],
+        *,
+        reference_id: uuid.UUID,
+        collection: bool,
+    ) -> str:
+        for node in parsed_nodes:
+            references = (
+                node.collection_references if collection else node.direct_references
+            )
+            field_name = "knowledgeCollections" if collection else "knowledgeBases"
+            for index, reference in enumerate(references):
+                if reference.id == reference_id:
+                    return f"{node.field_path}.{field_name}[{index}]"
+        return "graph.knowledgeReferences"
diff --git a/apps/gateway/services/workflow_service.py b/apps/gateway/services/workflow_service.py
index 35786e5f5..79848adae 100644
--- a/apps/gateway/services/workflow_service.py
+++ b/apps/gateway/services/workflow_service.py
@@ -20,6 +20,11 @@
     validate_mail_node_credential_boundary,
     validate_mail_processing_node_boundary,
 )
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowKnowledgeReferenceError,
+    aggregate_workflow_knowledge_reference_ids,
+    parse_workflow_knowledge_references,
+)
 from apps.shared.domain.slack_delivery import (
     SlackGraphBoundaryError,
     validate_slack_graph_boundary,
@@ -30,6 +35,11 @@
     get_effective_mail_credential_auth_state,
     has_mail_credential_permission,
 )
+from apps.gateway.services.workflow_knowledge_reference_service import (
+    WorkflowKnowledgeReferenceAuthorizationUnavailable,
+    WorkflowKnowledgeReferenceService,
+    WorkflowKnowledgeReferenceUnavailable,
+)
 
 
 class WorkflowService:
@@ -145,6 +155,13 @@ def save_draft(
                 detail="Workflow not found",  # 상세 메시지
             )
 
+        WorkflowService.validate_knowledge_references(
+            db,
+            request,
+            user_id=user_id,
+            organization_id=workflow.organization_id,
+        )
+
         WorkflowService.validate_mail_credential_references(
             db,
             request,
@@ -185,6 +202,73 @@ def save_draft(
             "workflow_id": workflow_id,
         }
 
+    @staticmethod
+    def validate_knowledge_references(
+        db: Session,
+        request: WorkflowDraftRequest | Mapping[str, Any],
+        *,
+        user_id: str | UUID,
+        organization_id: UUID | None,
+    ) -> None:
+        graph = (
+            request.model_dump(mode="python")
+            if isinstance(request, WorkflowDraftRequest)
+            else dict(request)
+        )
+        try:
+            parsed_nodes = parse_workflow_knowledge_references(graph)
+            direct_ids, collection_ids = aggregate_workflow_knowledge_reference_ids(
+                parsed_nodes
+            )
+        except WorkflowKnowledgeReferenceError as exc:
+            raise HTTPException(
+                status_code=422,
+                detail={"code": exc.reason_code, "field": exc.field_path},
+            ) from exc
+
+        # Legacy workflows may not have organization scope. A graph with no
+        # Knowledge intent needs neither authorization context nor a DB query.
+        if not direct_ids and not collection_ids:
+            return
+
+        try:
+            user_uuid = uuid.UUID(str(user_id))
+            organization_uuid = uuid.UUID(str(organization_id))
+        except (TypeError, ValueError) as exc:
+            raise HTTPException(
+                status_code=422,
+                detail={
+                    "code": "knowledge_reference_context_invalid",
+                    "field": "graph",
+                },
+            ) from exc
+
+        service = WorkflowKnowledgeReferenceService(
+            db,
+            user_id=user_uuid,
+            organization_id=organization_uuid,
+        )
+        try:
+            service.validate_parsed_references(parsed_nodes)
+        except WorkflowKnowledgeReferenceError as exc:
+            raise HTTPException(
+                status_code=422,
+                detail={"code": exc.reason_code, "field": exc.field_path},
+            ) from exc
+        except WorkflowKnowledgeReferenceUnavailable as exc:
+            raise HTTPException(
+                status_code=403,
+                detail={"code": exc.reason_code, "field": exc.field_path},
+            ) from exc
+        except WorkflowKnowledgeReferenceAuthorizationUnavailable as exc:
+            raise HTTPException(
+                status_code=503,
+                detail={
+                    "code": "knowledge_reference_authorization_unavailable",
+                    "field": "graph.knowledgeReferences",
+                },
+            ) from exc
+
     @staticmethod
     def validate_mail_credential_references(
         db: Session,
diff --git a/apps/gateway/tests/adapters/db/test_deployment_preflight_repository.py b/apps/gateway/tests/adapters/db/test_deployment_preflight_repository.py
new file mode 100644
index 000000000..0232cdb47
--- /dev/null
+++ b/apps/gateway/tests/adapters/db/test_deployment_preflight_repository.py
@@ -0,0 +1,180 @@
+import uuid
+from types import SimpleNamespace
+
+from sqlalchemy.dialects import postgresql
+
+from apps.gateway.adapters.db.deployment_preflight_repository import (
+    SqlAlchemyDeploymentPreflightRepository,
+)
+from apps.shared.db.models.knowledge import KnowledgeBase
+
+
+class _Query:
+    def __init__(self, rows):
+        self.rows = rows
+        self.criteria = []
+        self.joins = []
+
+    def join(self, *args):
+        self.joins.append(args)
+        return self
+
+    def filter(self, *criteria):
+        self.criteria.extend(criteria)
+        return self
+
+    def group_by(self, *_args):
+        return self
+
+    def all(self):
+        return self.rows
+
+
+class _Db:
+    def __init__(self, *query_rows):
+        self.query_rows = list(query_rows)
+        self.queries = []
+
+    def query(self, *_args):
+        rows = self.query_rows.pop(0) if self.query_rows else []
+        query = _Query(rows)
+        self.queries.append(query)
+        return query
+
+
+def _compiled_criteria(query):
+    return " ".join(
+        str(
+            criterion.compile(
+                dialect=postgresql.dialect(),
+                compile_kwargs={"literal_binds": True},
+            )
+        )
+        for criterion in query.criteria
+    ).lower()
+
+
+def _compiled_join_on(query):
+    assert len(query.joins) == 1
+    target, on_clause = query.joins[0]
+    assert target is KnowledgeBase
+    return str(
+        on_clause.compile(
+            dialect=postgresql.dialect(),
+            compile_kwargs={"literal_binds": True},
+        )
+    )
+
+
+def _assert_active_runtime_eligible_kb_scope(query):
+    sql = _compiled_criteria(query)
+    assert "knowledge_bases.lifecycle_state = 'active'" in sql
+    assert "knowledge_bases.sync_state != 'source_deleted'" in sql
+    assert "documents.status = 'completed'" in sql
+    assert "document_chunks.document_version_id is null" in sql
+    assert (
+        "document_chunks.document_version_id = "
+        "knowledge_bases.active_document_version_id" in sql
+    )
+    assert "document_versions.status = 'ready'" in sql
+
+
+def test_direct_preflight_query_excludes_source_deleted_kb():
+    db = _Db([])
+    repository = SqlAlchemyDeploymentPreflightRepository(db)
+
+    result = repository.get_active_knowledge_bases(
+        [uuid.uuid4()],
+        uuid.uuid4(),
+    )
+
+    assert result == {}
+    _assert_active_runtime_eligible_kb_scope(db.queries[0])
+
+
+def test_public_runtime_preflight_query_excludes_source_deleted_membership():
+    db = _Db([])
+    repository = SqlAlchemyDeploymentPreflightRepository(db)
+
+    result = repository.get_public_runtime_eligible_knowledge_base_ids(
+        [uuid.uuid4()],
+        uuid.uuid4(),
+    )
+
+    assert result == set()
+    _assert_active_runtime_eligible_kb_scope(db.queries[0])
+    join_sql = _compiled_join_on(db.queries[0])
+    assert (
+        "knowledge_bases.id = knowledge_collection_items.knowledge_base_id"
+        in join_sql
+    )
+    assert (
+        "knowledge_bases.organization_id = "
+        "knowledge_collection_items.organization_id" in join_sql
+    )
+
+
+def test_public_runtime_preflight_excludes_source_managed_parent_collection():
+    knowledge_base_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    item = SimpleNamespace(
+        knowledge_base_id=knowledge_base_id,
+        collection_id=collection_id,
+    )
+    source_managed_collection = SimpleNamespace(
+        id=collection_id,
+        safe_metadata={"visibility": "public"},
+        source_identity_id=uuid.uuid4(),
+    )
+    db = _Db([item], [source_managed_collection])
+    repository = SqlAlchemyDeploymentPreflightRepository(db)
+
+    result = repository.get_public_runtime_eligible_knowledge_base_ids(
+        [knowledge_base_id],
+        uuid.uuid4(),
+    )
+
+    assert result == set()
+
+
+def test_collection_preflight_aggregate_excludes_source_deleted_members():
+    collection_id = uuid.uuid4()
+    collection = SimpleNamespace(
+        id=collection_id,
+        safe_metadata={},
+        source_identity_id=None,
+    )
+    db = _Db([collection], [])
+    repository = SqlAlchemyDeploymentPreflightRepository(db)
+
+    result = repository.get_active_knowledge_collections(
+        [collection_id],
+        uuid.uuid4(),
+    )
+
+    assert result[collection_id].candidate_member_count == 0
+    assert result[collection_id].has_source_managed_members is False
+    _assert_active_runtime_eligible_kb_scope(db.queries[1])
+    join_sql = _compiled_join_on(db.queries[1])
+    assert (
+        "knowledge_bases.id = knowledge_collection_items.knowledge_base_id"
+        in join_sql
+    )
+    assert (
+        "knowledge_bases.organization_id = "
+        "knowledge_collection_items.organization_id" in join_sql
+    )
+
+
+def test_collection_preflight_excludes_source_deleted_parent():
+    db = _Db([])
+    repository = SqlAlchemyDeploymentPreflightRepository(db)
+
+    assert repository.get_active_knowledge_collections(
+        [uuid.uuid4()],
+        uuid.uuid4(),
+    ) == {}
+
+    sql = _compiled_criteria(db.queries[0])
+    assert "knowledge_collections.lifecycle_state = 'active'" in sql
+    assert "knowledge_collections.sync_state != 'source_deleted'" in sql
diff --git a/apps/gateway/tests/adapters/db/test_deployment_preflight_repository_postgres.py b/apps/gateway/tests/adapters/db/test_deployment_preflight_repository_postgres.py
new file mode 100644
index 000000000..b5c74a753
--- /dev/null
+++ b/apps/gateway/tests/adapters/db/test_deployment_preflight_repository_postgres.py
@@ -0,0 +1,471 @@
+"""Opt-in PostgreSQL evidence for deployment preflight Knowledge predicates."""
+
+import os
+import subprocess
+import sys
+import uuid
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import pytest
+from sqlalchemy import create_engine, text
+from sqlalchemy.exc import OperationalError
+from sqlalchemy.orm import sessionmaker
+
+from apps.gateway.adapters.db.deployment_preflight_repository import (
+    SqlAlchemyDeploymentPreflightRepository,
+)
+from apps.gateway.services.knowledge_collection_picker_query_service import (
+    MAX_LLM_SELECTABLE_COLLECTION_SCAN,
+    KnowledgeCollectionPickerQueryService,
+)
+from apps.gateway.services.workflow_knowledge_reference_service import (
+    WorkflowKnowledgeReferenceService,
+    WorkflowKnowledgeReferenceUnavailable,
+)
+from apps.shared.db.models.knowledge import (
+    Document,
+    DocumentChunk,
+    KnowledgeBase,
+    KnowledgeCollection,
+    KnowledgeCollectionItem,
+)
+from apps.shared.db.models.organization import Organization
+from apps.shared.db.models.organization_membership import (
+    ORGANIZATION_AUTH_MEMBER,
+    ORGANIZATION_MEMBERSHIP_ACTIVE,
+    OrganizationMembership,
+)
+from apps.shared.db.models.team import UserKnowledgeCollectionPermission
+from apps.shared.db.models.user import User
+from apps.shared.tests.helpers.disposable_postgres import (
+    DisposablePostgresConfig,
+    DisposablePostgresConfigurationError,
+    quote_disposable_database_name,
+)
+
+ROOT_DIR = Path(__file__).resolve().parents[5]
+RUN_ENV = "NODEASE_RUN_DISPOSABLE_DB_TEST"
+DB_PREFIX = "mbased_preflight"
+
+
+def _run_alembic(database: str, config: DisposablePostgresConfig) -> None:
+    result = subprocess.run(
+        [
+            sys.executable,
+            "-m",
+            "alembic",
+            "-c",
+            "apps/shared/alembic.ini",
+            "upgrade",
+            "heads",
+        ],
+        cwd=ROOT_DIR,
+        env=config.subprocess_environment(database=database, root_dir=ROOT_DIR),
+        text=True,
+        encoding="utf-8",
+        errors="replace",
+        capture_output=True,
+        timeout=180,
+        check=False,
+    )
+    if result.returncode != 0:
+        pytest.fail(
+            f"alembic failed with exit code {result.returncode}; "
+            "stdout/stderr omitted to avoid leaking local configuration"
+        )
+
+
+@pytest.mark.skipif(
+    os.getenv(RUN_ENV) != "1",
+    reason=f"set {RUN_ENV}=1 to run disposable PostgreSQL preflight integration",
+)
+def test_save_and_preflight_queries_filter_deleted_and_cross_org_resources():
+    try:
+        config = DisposablePostgresConfig.from_environment()
+    except DisposablePostgresConfigurationError:
+        raise pytest.fail.Exception(
+            "disposable PostgreSQL connection settings are not safely configured",
+            pytrace=False,
+        ) from None
+
+    database = f"{DB_PREFIX}_{uuid.uuid4().hex[:12]}"
+    quoted_database = quote_disposable_database_name(database, prefix=DB_PREFIX)
+    admin_engine = create_engine(
+        config.database_url(config.maintenance_database),
+        isolation_level="AUTOCOMMIT",
+    )
+    database_created = False
+    engine = None
+    db = None
+
+    try:
+        with admin_engine.connect() as conn:
+            conn.execute(text(f"CREATE DATABASE {quoted_database}"))
+        database_created = True
+
+        engine = create_engine(config.database_url(database))
+        with engine.begin() as conn:
+            conn.execute(text("CREATE EXTENSION IF NOT EXISTS vector"))
+        engine.dispose()
+        engine = None
+
+        _run_alembic(database, config)
+        engine = create_engine(config.database_url(database))
+        db = sessionmaker(bind=engine, expire_on_commit=False)()
+
+        owner_id = uuid.uuid4()
+        member_id = uuid.uuid4()
+        owner = User(
+            id=owner_id,
+            email=f"preflight-{owner_id}@example.test",
+            name="Preflight owner",
+            social_provider="local",
+        )
+        member = User(
+            id=member_id,
+            email=f"picker-{member_id}@example.test",
+            name="Picker member",
+            social_provider="local",
+        )
+        db.add_all([owner, member])
+        db.flush()
+
+        organization_id = uuid.uuid4()
+        other_organization_id = uuid.uuid4()
+        db.add_all(
+            [
+                Organization(
+                    id=organization_id,
+                    name="Preflight organization",
+                    created_by=owner_id,
+                ),
+                Organization(
+                    id=other_organization_id,
+                    name="Other organization",
+                    created_by=owner_id,
+                ),
+            ]
+        )
+        db.flush()
+        db.add(
+            OrganizationMembership(
+                organization_id=organization_id,
+                user_id=member_id,
+                membership_state=ORGANIZATION_MEMBERSHIP_ACTIVE,
+                organization_auth_state=ORGANIZATION_AUTH_MEMBER,
+                invited_by=owner_id,
+            )
+        )
+        db.flush()
+
+        active_kb_id = uuid.uuid4()
+        deleted_kb_id = uuid.uuid4()
+        archived_kb_id = uuid.uuid4()
+        other_org_kb_id = uuid.uuid4()
+        db.add_all(
+            [
+                KnowledgeBase(
+                    id=active_kb_id,
+                    organization_id=organization_id,
+                    user_id=owner_id,
+                    name="Active KB",
+                    sync_state="manual",
+                    lifecycle_state="active",
+                ),
+                KnowledgeBase(
+                    id=deleted_kb_id,
+                    organization_id=organization_id,
+                    user_id=owner_id,
+                    name="Source deleted KB",
+                    sync_state="source_deleted",
+                    lifecycle_state="active",
+                ),
+                KnowledgeBase(
+                    id=archived_kb_id,
+                    organization_id=organization_id,
+                    user_id=owner_id,
+                    name="Archived KB",
+                    sync_state="manual",
+                    lifecycle_state="archived",
+                ),
+                KnowledgeBase(
+                    id=other_org_kb_id,
+                    organization_id=other_organization_id,
+                    user_id=owner_id,
+                    name="Other organization KB",
+                    sync_state="manual",
+                    lifecycle_state="active",
+                ),
+            ]
+        )
+        db.flush()
+
+        for index, knowledge_base_id in enumerate(
+            (
+                active_kb_id,
+                deleted_kb_id,
+                archived_kb_id,
+                other_org_kb_id,
+            )
+        ):
+            document = Document(
+                id=uuid.uuid4(),
+                knowledge_base_id=knowledge_base_id,
+                filename=f"ready-{index}.md",
+                status="completed",
+            )
+            db.add(document)
+            db.flush()
+            db.add(
+                DocumentChunk(
+                    id=uuid.uuid4(),
+                    document_id=document.id,
+                    knowledge_base_id=knowledge_base_id,
+                    content=f"retrieval-visible-{index}",
+                    embedding=[0.0] * 1536,
+                    chunk_index=0,
+                )
+            )
+        db.flush()
+
+        public_collection_id = uuid.uuid4()
+        deleted_only_collection_id = uuid.uuid4()
+        source_deleted_collection_id = uuid.uuid4()
+        db.add_all(
+            [
+                KnowledgeCollection(
+                    id=public_collection_id,
+                    organization_id=organization_id,
+                    name="Public mixed collection",
+                    safe_metadata={"visibility": "public"},
+                    created_by=owner_id,
+                ),
+                KnowledgeCollection(
+                    id=deleted_only_collection_id,
+                    organization_id=organization_id,
+                    name="Deleted only collection",
+                    safe_metadata={"visibility": "public"},
+                    created_by=owner_id,
+                ),
+                KnowledgeCollection(
+                    id=source_deleted_collection_id,
+                    organization_id=organization_id,
+                    name="Source deleted collection",
+                    sync_state="source_deleted",
+                    safe_metadata={"visibility": "public"},
+                    created_by=owner_id,
+                ),
+            ]
+        )
+        db.flush()
+        db.add_all(
+            [
+                KnowledgeCollectionItem(
+                    organization_id=organization_id,
+                    collection_id=public_collection_id,
+                    knowledge_base_id=active_kb_id,
+                ),
+                KnowledgeCollectionItem(
+                    organization_id=organization_id,
+                    collection_id=public_collection_id,
+                    knowledge_base_id=deleted_kb_id,
+                ),
+                KnowledgeCollectionItem(
+                    organization_id=organization_id,
+                    collection_id=public_collection_id,
+                    knowledge_base_id=archived_kb_id,
+                ),
+                KnowledgeCollectionItem(
+                    organization_id=organization_id,
+                    collection_id=public_collection_id,
+                    knowledge_base_id=other_org_kb_id,
+                ),
+                KnowledgeCollectionItem(
+                    organization_id=organization_id,
+                    collection_id=deleted_only_collection_id,
+                    knowledge_base_id=deleted_kb_id,
+                ),
+            ]
+        )
+        db.commit()
+
+        repository = SqlAlchemyDeploymentPreflightRepository(db)
+        save_service = WorkflowKnowledgeReferenceService(
+            db,
+            user_id=owner_id,
+            organization_id=organization_id,
+        )
+        save_loaded = save_service._load_direct_kbs(  # noqa: SLF001 - SQL evidence
+            (active_kb_id, deleted_kb_id, archived_kb_id, other_org_kb_id)
+        )
+        with pytest.raises(WorkflowKnowledgeReferenceUnavailable):
+            save_service.validate_editable_graph(
+                {
+                    "nodes": [
+                        {
+                            "id": "llm",
+                            "type": "llmNode",
+                            "data": {
+                                "knowledgeBases": [
+                                    {
+                                        "id": str(deleted_kb_id),
+                                        "name": "Source deleted",
+                                    }
+                                ]
+                            },
+                        }
+                    ]
+                }
+            )
+        with pytest.raises(WorkflowKnowledgeReferenceUnavailable):
+            save_service.validate_editable_graph(
+                {
+                    "nodes": [
+                        {
+                            "id": "llm",
+                            "type": "llmNode",
+                            "data": {
+                                "knowledgeCollections": [
+                                    {
+                                        "id": str(source_deleted_collection_id),
+                                        "safeLabel": "Source deleted",
+                                    }
+                                ]
+                            },
+                        }
+                    ]
+                }
+            )
+        direct = repository.get_active_knowledge_bases(
+            [active_kb_id, deleted_kb_id, archived_kb_id, other_org_kb_id],
+            organization_id,
+        )
+        public = repository.get_public_runtime_eligible_knowledge_base_ids(
+            [active_kb_id, deleted_kb_id, archived_kb_id, other_org_kb_id],
+            organization_id,
+        )
+        collections = repository.get_active_knowledge_collections(
+            [
+                public_collection_id,
+                deleted_only_collection_id,
+                source_deleted_collection_id,
+            ],
+            organization_id,
+        )
+
+        assert {row.id for row in save_loaded} == {active_kb_id}
+        assert set(direct) == {active_kb_id}
+        assert public == {active_kb_id}
+        assert source_deleted_collection_id not in collections
+        assert collections[public_collection_id].candidate_member_count == 1
+        assert collections[deleted_only_collection_id].candidate_member_count == 0
+        assert collections[public_collection_id].has_source_managed_members is False
+        assert (
+            collections[deleted_only_collection_id].has_source_managed_members
+            is False
+        )
+
+        oldest_allowed_id = uuid.uuid4()
+        oldest_allowed = KnowledgeCollection(
+            id=oldest_allowed_id,
+            organization_id=organization_id,
+            name="Oldest route-authorized collection",
+            safe_metadata={"safe_label": "Oldest allowed"},
+            created_by=owner_id,
+            created_at=datetime(2020, 1, 1, tzinfo=timezone.utc),
+        )
+        newer_denied = [
+            KnowledgeCollection(
+                id=uuid.uuid4(),
+                organization_id=organization_id,
+                name=f"Newer denied collection {index:03d}",
+                safe_metadata={"safe_label": f"Denied {index:03d}"},
+                created_by=owner_id,
+                created_at=(
+                    datetime(2030, 1, 1, tzinfo=timezone.utc)
+                    + timedelta(seconds=index)
+                ),
+            )
+            for index in range(MAX_LLM_SELECTABLE_COLLECTION_SCAN)
+        ]
+        db.add_all([oldest_allowed, *newer_denied])
+        db.flush()
+        db.add(
+            UserKnowledgeCollectionPermission(
+                grantee_organization_id=organization_id,
+                user_id=member_id,
+                assigned_by=owner_id,
+                knowledge_collection_id=oldest_allowed_id,
+                permission_action="route",
+            )
+        )
+        db.add(
+            UserKnowledgeCollectionPermission(
+                grantee_organization_id=organization_id,
+                user_id=member_id,
+                assigned_by=owner_id,
+                knowledge_collection_id=source_deleted_collection_id,
+                permission_action="route",
+            )
+        )
+        db.commit()
+
+        picker = KnowledgeCollectionPickerQueryService(
+            db,
+            user_id=member_id,
+            organization_id=organization_id,
+        )
+        scoped_response = picker.list_llm_selectable()
+        assert [item.id for item in scoped_response.collections] == [oldest_allowed_id]
+
+        db.add_all(
+            [
+                UserKnowledgeCollectionPermission(
+                    grantee_organization_id=organization_id,
+                    user_id=member_id,
+                    assigned_by=owner_id,
+                    knowledge_collection_id=collection.id,
+                    permission_action="route",
+                )
+                for collection in newer_denied
+            ]
+        )
+        db.commit()
+
+        capped_response = picker.list_llm_selectable()
+        assert len(capped_response.collections) == MAX_LLM_SELECTABLE_COLLECTION_SCAN
+        assert oldest_allowed_id not in {item.id for item in capped_response.collections}
+    except OperationalError:
+        raise pytest.fail.Exception(
+            "disposable PostgreSQL is unavailable or rejected the connection; "
+            "connection details omitted",
+            pytrace=False,
+        ) from None
+    finally:
+        if db is not None:
+            db.close()
+        if engine is not None:
+            engine.dispose()
+        if database_created:
+            try:
+                with admin_engine.connect() as conn:
+                    conn.execute(
+                        text(
+                            """
+                            SELECT pg_terminate_backend(pid)
+                            FROM pg_stat_activity
+                            WHERE datname = :database
+                              AND pid <> pg_backend_pid()
+                            """
+                        ),
+                        {"database": database},
+                    )
+                    conn.execute(text(f"DROP DATABASE IF EXISTS {quoted_database}"))
+            except OperationalError:
+                raise pytest.fail.Exception(
+                    "disposable PostgreSQL cleanup could not connect; "
+                    "connection details omitted",
+                    pytrace=False,
+                ) from None
+        admin_engine.dispose()
diff --git a/apps/gateway/tests/api/cost_optimizer/test_cost_optimizer_api.py b/apps/gateway/tests/api/cost_optimizer/test_cost_optimizer_api.py
index 2193fba4e..64cbe6d9c 100644
--- a/apps/gateway/tests/api/cost_optimizer/test_cost_optimizer_api.py
+++ b/apps/gateway/tests/api/cost_optimizer/test_cost_optimizer_api.py
@@ -10,6 +10,7 @@
 from apps.gateway.auth.dependencies import get_current_user
 from apps.gateway.api.v1.endpoints import workflow as workflow_endpoint
 from apps.gateway.main import app
+from apps.gateway.services.workflow_service import WorkflowService
 from apps.shared.db.models.cost_optimizer import (
     CostOptimizerCandidate,
     CostOptimizerExperiment,
@@ -3229,6 +3230,10 @@ def test_fr8_apply_candidate_updates_current_draft_target_llm_node(self):
                 "apps.gateway.api.v1.endpoints.workflow.LLMService.get_my_available_models",
                 return_value=_available_model_options("gpt-4.1-mini", "gpt-4.1"),
             ),
+            patch.object(
+                WorkflowService,
+                "validate_knowledge_references",
+            ) as validate_knowledge_references,
         ):
             response = self.client.patch(
                 f"/api/v1/workflows/{workflow_id}/llm-nodes/llm-triage"
@@ -3241,6 +3246,7 @@ def test_fr8_apply_candidate_updates_current_draft_target_llm_node(self):
             )
 
         assert response.status_code == 200
+        validate_knowledge_references.assert_called_once()
         ensure_builder.assert_called_once_with(
             db, SimpleNamespace(id=user_id), str(workflow_id), "write"
         )
@@ -3348,6 +3354,10 @@ def test_fr8_apply_candidate_without_knowledge_preserves_existing_rag_selection(
                 "apps.gateway.api.v1.endpoints.workflow.LLMService.get_my_available_models",
                 return_value=_available_model_options("gpt-4.1-mini"),
             ),
+            patch.object(
+                WorkflowService,
+                "validate_knowledge_references",
+            ) as validate_knowledge_references,
         ):
             response = self.client.patch(
                 f"/api/v1/workflows/{workflow_id}/llm-nodes/llm-triage"
@@ -3359,6 +3369,7 @@ def test_fr8_apply_candidate_without_knowledge_preserves_existing_rag_selection(
             )
 
         assert response.status_code == 200, response.json()
+        validate_knowledge_references.assert_called_once()
         target_data = workflow.graph["nodes"][0]["data"]
         assert target_data["model_id"] == "gpt-4.1-mini"
         assert target_data["parameters"] == {
diff --git a/apps/gateway/tests/api/test_active_organization_app_workflow.py b/apps/gateway/tests/api/test_active_organization_app_workflow.py
index 113fbf6ad..95486ab25 100644
--- a/apps/gateway/tests/api/test_active_organization_app_workflow.py
+++ b/apps/gateway/tests/api/test_active_organization_app_workflow.py
@@ -961,6 +961,13 @@ def test_owner_or_manager_without_membership_can_create_and_list_apps_and_workfl
 
 def test_active_member_can_manage_app_draft_after_creating_app(monkeypatch):
     _patch_audit(monkeypatch)
+    # Knowledge reference authorization is covered by its focused service/API
+    # tests; this route fake intentionally models only App/Workflow RBAC rows.
+    monkeypatch.setattr(
+        WorkflowService,
+        "validate_knowledge_references",
+        lambda *args, **kwargs: None,
+    )
     # App 생성 권한 판정(ADR-0016)은 전용 테스트에서 검증한다. 이 테스트의
     # 관심사는 생성 후 draft manage 권한이므로 생성 능력은 허용으로 고정한다.
     monkeypatch.setattr(
diff --git a/apps/gateway/tests/api/test_knowledge_collection_api.py b/apps/gateway/tests/api/test_knowledge_collection_api.py
index 680c5228b..90d972879 100644
--- a/apps/gateway/tests/api/test_knowledge_collection_api.py
+++ b/apps/gateway/tests/api/test_knowledge_collection_api.py
@@ -10,6 +10,7 @@
 from apps.gateway.services.knowledge_collection_service import (
     KnowledgeCollectionServiceError,
 )
+from apps.shared.schemas.knowledge import KnowledgeCollectionLLMSelectableResponse
 from apps.shared.schemas.knowledge import (
     KnowledgeCollectionResponse,
     KnowledgeCollectionVisibilityResponse,
@@ -120,6 +121,57 @@ def management_capabilities(self):
     assert body["can_change_public_visibility"] is True
 
 
+def test_collection_picker_uses_active_organization_and_minimal_projection(monkeypatch):
+    organization_id = uuid.uuid4()
+    user_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    captured = {}
+
+    monkeypatch.setattr(
+        knowledge_endpoint,
+        "resolve_active_organization_id",
+        lambda db, request, raw, current_user_id: organization_id,
+    )
+
+    class FakePicker:
+        def __init__(self, db, *, user_id, organization_id):
+            captured["user_id"] = user_id
+            captured["organization_id"] = organization_id
+
+        def list_llm_selectable(self):
+            return KnowledgeCollectionLLMSelectableResponse(
+                collections=[
+                    {"id": collection_id, "safe_label": "사내 문서"}
+                ]
+            )
+
+    monkeypatch.setattr(
+        knowledge_endpoint,
+        "KnowledgeCollectionPickerQueryService",
+        FakePicker,
+    )
+    app.dependency_overrides[knowledge_endpoint.get_db] = lambda: object()
+    app.dependency_overrides[get_current_user] = lambda: SimpleNamespace(id=user_id)
+    try:
+        response = TestClient(app).get(
+            "/api/v1/knowledge/llm-selectable-collections",
+            headers={"X-Organization-Id": str(organization_id)},
+        )
+    finally:
+        app.dependency_overrides = {}
+
+    assert response.status_code == 200
+    assert response.json() == {
+        "collections": [
+            {"id": str(collection_id), "safe_label": "사내 문서"}
+        ]
+    }
+    assert captured == {
+        "user_id": user_id,
+        "organization_id": organization_id,
+    }
+
+
 def test_collection_visibility_error_uses_safe_envelope(monkeypatch):
     organization_id = uuid.uuid4()
     user_id = uuid.uuid4()
diff --git a/apps/gateway/tests/application/deployment/test_preflight_use_case.py b/apps/gateway/tests/application/deployment/test_preflight_use_case.py
index 59f3d0d73..7afa96970 100644
--- a/apps/gateway/tests/application/deployment/test_preflight_use_case.py
+++ b/apps/gateway/tests/application/deployment/test_preflight_use_case.py
@@ -5,6 +5,7 @@
 from apps.gateway.application.deployment.errors import DeploymentPreflightBlocked
 from apps.gateway.application.deployment.models import (
     KnowledgeBaseSnapshot,
+    KnowledgeCollectionPreflightSnapshot,
     WorkflowNodeTargetSnapshot,
 )
 from apps.gateway.application.deployment.preflight import DeploymentPreflightUseCase
@@ -13,6 +14,9 @@
 class _Repository:
     def __init__(self) -> None:
         self.knowledge_bases: dict[uuid.UUID, KnowledgeBaseSnapshot] = {}
+        self.collections: dict[
+            uuid.UUID, KnowledgeCollectionPreflightSnapshot
+        ] = {}
         self.public_ids: set[uuid.UUID] = set()
         self.targets: dict[uuid.UUID, WorkflowNodeTargetSnapshot] = {}
         self.calls: list[tuple[str, uuid.UUID | None]] = []
@@ -29,6 +33,14 @@ def get_public_runtime_eligible_knowledge_base_ids(
         self.calls.append(("public", organization_id))
         return set(ids) & self.public_ids
 
+    def get_active_knowledge_collections(self, ids, organization_id):
+        self.calls.append(("collection", organization_id))
+        return {
+            item_id: self.collections[item_id]
+            for item_id in ids
+            if item_id in self.collections
+        }
+
     def get_workflow_node_target(self, app_id, organization_id):
         self.calls.append(("workflow_node", organization_id))
         return self.targets.get(app_id)
@@ -151,19 +163,301 @@ def test_source_managed_public_kb_remains_blocked():
     assert result.safe_summary.blocked_reason == "source_public_exposure_required"
 
 
+@pytest.mark.parametrize(
+    ("references", "expected_reason"),
+    [
+        ([{"id": "not-a-uuid"}], "knowledge_reference_invalid"),
+        (
+            [
+                {"id": str(uuid.uuid4())}
+                for _index in range(21)
+            ],
+            "knowledge_reference_limit_exceeded",
+        ),
+    ],
+)
+def test_malformed_or_over_limit_collection_graph_is_non_downgradable(
+    references,
+    expected_reason,
+):
+    repository = _Repository()
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=uuid.uuid4(),
+    ).preview(
+        deployment_type="api",
+        graph_snapshot=_collection_graph(references),
+        is_active=False,
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == expected_reason
+    assert repository.calls == []
+
+
+def test_anonymous_private_collection_is_blocked_with_collection_action():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=False,
+    )
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="api",
+        graph_snapshot=_collection_graph([{"id": str(collection_id)}]),
+    )
+
+    assert result.status == "blocked"
+    assert (
+        result.safe_summary.blocked_reason
+        == "private_collection_requires_execution_subject"
+    )
+    assert result.required_actions[0].action == (
+        "remove_private_collection_or_use_authenticated_run"
+    )
+    assert result.safe_summary.affected_collection_count_bucket == "1"
+
+
+def test_anonymous_public_manual_collection_passes():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=True,
+        candidate_member_count=3,
+    )
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="webhook",
+        graph_snapshot=_collection_graph([{"id": str(collection_id)}]),
+    )
+
+    assert result.status == "passed"
+    assert result.nodes == ()
+    assert repository.calls == [("collection", organization_id)]
+
+
+@pytest.mark.parametrize("source_managed_field", ["collection", "member"])
+def test_public_collection_with_source_managed_content_is_blocked_without_identity(
+    source_managed_field,
+):
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=True,
+        source_managed=source_managed_field == "collection",
+        has_source_managed_members=source_managed_field == "member",
+    )
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="chatbot",
+        graph_snapshot=_collection_graph(
+            [{"id": str(collection_id), "safeLabel": "Hidden source"}]
+        ),
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == "source_public_exposure_required"
+    assert str(collection_id) not in str(result)
+    assert "Hidden source" not in str(result)
+
+
+def test_collection_lifecycle_is_checked_for_authenticated_and_inherited_audience():
+    organization_id = uuid.uuid4()
+    active_collection_id = uuid.uuid4()
+    missing_collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[active_collection_id] = _collection_snapshot(
+        active_collection_id,
+        public=False,
+    )
+    use_case = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    )
+    graph = _collection_graph(
+        [
+            {"id": str(active_collection_id)},
+            {"id": str(missing_collection_id)},
+        ]
+    )
+
+    authenticated = use_case.preview(
+        deployment_type="api",
+        graph_snapshot=graph,
+        trusted_audience_override="authenticated_user",
+    )
+    inherited = use_case.preview(
+        deployment_type="workflow_node",
+        graph_snapshot=graph,
+    )
+
+    assert authenticated.status == "blocked"
+    assert authenticated.audience == "authenticated_user"
+    assert authenticated.safe_summary.blocked_reason == (
+        "knowledge_collection_unavailable"
+    )
+    assert inherited.status == "blocked"
+    assert inherited.warnings == ("workflow_node_execution_subject_inherited",)
+
+
+def test_collection_candidate_budget_warning_is_conservative_and_bucketed():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=True,
+        candidate_member_count=21,
+    )
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="api",
+        graph_snapshot=_collection_graph([{"id": str(collection_id)}]),
+    )
+
+    assert result.status == "warning"
+    assert result.safe_summary.candidate_budget_limited is True
+    assert result.nodes[0].candidate_budget_limited is True
+    assert result.nodes[0].knowledge_collection_count_bucket == "1"
+    assert result.warnings == ("knowledge_candidate_budget_limited",)
+    assert "21" not in str(result)
+
+
+def test_nested_loop_collection_is_evaluated_with_parent_audience():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=False,
+    )
+    graph = {
+        "nodes": [
+            {
+                "id": "loop-1",
+                "type": "loopNode",
+                "data": {
+                    "subGraph": _collection_graph(
+                        [{"id": str(collection_id)}]
+                    )
+                },
+            }
+        ],
+        "edges": [],
+    }
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="chatbot",
+        graph_snapshot=graph,
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == (
+        "private_collection_requires_execution_subject"
+    )
+
+
+def test_deep_nested_subgraphs_are_evaluated_without_recursive_stack_usage():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    repository = _Repository()
+    repository.collections[collection_id] = _collection_snapshot(
+        collection_id,
+        public=False,
+    )
+    graph = _collection_graph([{"id": str(collection_id)}])
+    for index in range(1_100):
+        graph = {
+            "nodes": [
+                {
+                    "id": f"loop-{index}",
+                    "type": "loopNode",
+                    "data": {"subGraph": graph},
+                }
+            ],
+            "edges": [],
+        }
+
+    result = DeploymentPreflightUseCase(
+        repository,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type="chatbot",
+        graph_snapshot=graph,
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == (
+        "private_collection_requires_execution_subject"
+    )
+
+
 def _llm_graph(kb_id: uuid.UUID) -> dict:
     return {
         "nodes": [
             {
                 "id": "llm-1",
                 "type": "llmNode",
-                "data": {"knowledgeBases": [{"id": str(kb_id)}]},
+                "data": {
+                    "knowledgeBases": [{"id": str(kb_id), "name": "KB"}]
+                },
             }
         ],
         "edges": [],
     }
 
 
+def _collection_graph(references: list[dict]) -> dict:
+    return {
+        "nodes": [
+            {
+                "id": "llm-1",
+                "type": "llmNode",
+                "data": {"knowledgeCollections": references},
+            }
+        ],
+        "edges": [],
+    }
+
+
+def _collection_snapshot(
+    collection_id: uuid.UUID,
+    *,
+    public: bool,
+    source_managed: bool = False,
+    has_source_managed_members: bool = False,
+    candidate_member_count: int = 0,
+) -> KnowledgeCollectionPreflightSnapshot:
+    return KnowledgeCollectionPreflightSnapshot(
+        id=collection_id,
+        public=public,
+        source_managed=source_managed,
+        has_source_managed_members=has_source_managed_members,
+        candidate_member_count=candidate_member_count,
+    )
+
+
 def _workflow_node_graph(app_id: uuid.UUID) -> dict:
     return {
         "nodes": [
diff --git a/apps/gateway/tests/services/test_app_service_permissions.py b/apps/gateway/tests/services/test_app_service_permissions.py
index e25d34e1b..d63b3d4b8 100644
--- a/apps/gateway/tests/services/test_app_service_permissions.py
+++ b/apps/gateway/tests/services/test_app_service_permissions.py
@@ -307,3 +307,58 @@ def test_clone_graph_cleanup_removes_workflow_node_binding_metadata():
     )
 
     assert "_nodease_runtime" not in cleaned
+
+
+def test_public_graph_cleanup_removes_kb_and_collection_refs_recursively():
+    direct_kb_id = str(uuid.uuid4())
+    collection_id = str(uuid.uuid4())
+    graph = {
+        "nodes": [
+            {
+                "id": "llm-root",
+                "type": "llmNode",
+                "data": {
+                    "knowledgeBases": [{"id": direct_kb_id, "name": "Private"}],
+                    "knowledgeCollections": [
+                        {"id": collection_id, "safeLabel": "Private group"}
+                    ],
+                    "user_prompt": "safe prompt",
+                },
+            },
+            {
+                "id": "loop-1",
+                "type": "loopNode",
+                "data": {
+                    "subGraph": {
+                        "nodes": [
+                            {
+                                "id": "llm-child",
+                                "type": "llmNode",
+                                "data": {
+                                    "knowledgeBases": [
+                                        {"id": direct_kb_id, "name": "Private"}
+                                    ],
+                                    "knowledgeCollections": [
+                                        {
+                                            "id": collection_id,
+                                            "safeLabel": "Private group",
+                                        }
+                                    ],
+                                },
+                            }
+                        ],
+                        "edges": [],
+                    }
+                },
+            },
+        ],
+        "edges": [],
+    }
+
+    cleaned = AppService._clean_graph_data(graph)
+    serialized = str(cleaned)
+
+    assert direct_kb_id not in serialized
+    assert collection_id not in serialized
+    assert "Private group" not in serialized
+    assert cleaned["nodes"][0]["data"]["user_prompt"] == "safe prompt"
diff --git a/apps/gateway/tests/services/test_deployment_preflight.py b/apps/gateway/tests/services/test_deployment_preflight.py
index 3c9d7af59..719e8b0b2 100644
--- a/apps/gateway/tests/services/test_deployment_preflight.py
+++ b/apps/gateway/tests/services/test_deployment_preflight.py
@@ -114,6 +114,7 @@ def test_preflight_allows_public_collection_kb_for_public_surface():
                     id=collection_id,
                     organization_id=organization_id,
                     lifecycle_state="active",
+                    source_identity_id=None,
                     safe_metadata={"visibility": "public"},
                 )
             ],
@@ -158,6 +159,7 @@ def test_preflight_blocks_source_managed_kb_even_if_collection_is_public():
                     id=collection_id,
                     organization_id=organization_id,
                     lifecycle_state="active",
+                    source_identity_id=None,
                     safe_metadata={"visibility": "public"},
                 )
             ],
@@ -176,6 +178,265 @@ def test_preflight_blocks_source_managed_kb_even_if_collection_is_public():
     assert result.safe_summary.blocked_reason == "source_public_exposure_required"
 
 
+@pytest.mark.parametrize("visibility", [None, "private"])
+def test_preflight_blocks_private_selected_collection(visibility):
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    safe_metadata = {} if visibility is None else {"visibility": visibility}
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata=safe_metadata,
+                )
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.API,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == (
+        "private_collection_requires_execution_subject"
+    )
+    assert result.safe_summary.affected_collection_count_bucket == "1"
+
+
+def test_preflight_allows_public_manual_selected_collection():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    kb_id = uuid.uuid4()
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata={"visibility": "public"},
+                )
+            ],
+            KnowledgeCollectionItem: [
+                _row(
+                    organization_id=organization_id,
+                    collection_id=collection_id,
+                    knowledge_base_id=kb_id,
+                )
+            ],
+            KnowledgeBase: [
+                _row(
+                    id=kb_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                )
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.CHATBOT,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "passed"
+    assert result.nodes == []
+
+
+def test_preflight_blocks_public_collection_with_source_managed_member():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    kb_id = uuid.uuid4()
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata={"visibility": "public"},
+                )
+            ],
+            KnowledgeCollectionItem: [
+                _row(
+                    organization_id=organization_id,
+                    collection_id=collection_id,
+                    knowledge_base_id=kb_id,
+                )
+            ],
+            KnowledgeBase: [
+                _row(
+                    id=kb_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=uuid.uuid4(),
+                )
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.WEBHOOK,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == "source_public_exposure_required"
+    assert str(collection_id) not in result.model_dump_json()
+    assert str(kb_id) not in result.model_dump_json()
+
+
+def test_collection_preflight_aggregate_excludes_cross_org_member_facts():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    kb_id = uuid.uuid4()
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata={"visibility": "public"},
+                )
+            ],
+            KnowledgeCollectionItem: [
+                _row(
+                    organization_id=organization_id,
+                    collection_id=collection_id,
+                    knowledge_base_id=kb_id,
+                )
+            ],
+            KnowledgeBase: [
+                _row(
+                    id=kb_id,
+                    organization_id=uuid.uuid4(),
+                    lifecycle_state="active",
+                    source_identity_id=uuid.uuid4(),
+                )
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.API,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "passed"
+
+
+def test_collection_preflight_returns_bucketed_candidate_budget_warning():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    kb_ids = [uuid.uuid4() for _index in range(21)]
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata={"visibility": "public"},
+                )
+            ],
+            KnowledgeCollectionItem: [
+                _row(
+                    organization_id=organization_id,
+                    collection_id=collection_id,
+                    knowledge_base_id=kb_id,
+                )
+                for kb_id in kb_ids
+            ],
+            KnowledgeBase: [
+                _row(
+                    id=kb_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                )
+                for kb_id in kb_ids
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.API,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "warning"
+    assert result.safe_summary.candidate_budget_limited is True
+    assert result.safe_summary.affected_collection_count_bucket == "1"
+    assert result.nodes[0].candidate_budget_limited is True
+    assert all(str(kb_id) not in result.model_dump_json() for kb_id in kb_ids)
+
+
+@pytest.mark.parametrize("collection_scope", ["cross_org", "archived"])
+def test_preflight_hides_unavailable_selected_collection(collection_scope):
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=(
+                        uuid.uuid4()
+                        if collection_scope == "cross_org"
+                        else organization_id
+                    ),
+                    lifecycle_state=(
+                        "archived"
+                        if collection_scope == "archived"
+                        else "active"
+                    ),
+                    source_identity_id=None,
+                    safe_metadata={"visibility": "public"},
+                )
+            ],
+        }
+    )
+
+    result = KnowledgeDeploymentPreflightService(
+        db,
+        organization_id=organization_id,
+    ).preview(
+        deployment_type=DeploymentType.API,
+        graph_snapshot=_collection_graph(collection_id),
+    )
+
+    assert result.status == "blocked"
+    assert result.safe_summary.blocked_reason == "knowledge_collection_unavailable"
+    assert str(collection_id) not in result.model_dump_json()
+
+
 @pytest.mark.parametrize("kb_scope", ["cross_org", "archived"])
 def test_preflight_hides_kb_outside_active_organization_scope(kb_scope):
     organization_id = uuid.uuid4()
@@ -557,6 +818,41 @@ def test_enforced_preflight_raises_409_error_envelope():
     assert exc_info.value.detail["error"]["code"] == "deployment.preflight.blocked"
 
 
+def test_enforced_collection_preflight_keeps_safe_409_envelope():
+    organization_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    db = _Db(
+        {
+            KnowledgeCollection: [
+                _row(
+                    id=collection_id,
+                    organization_id=organization_id,
+                    lifecycle_state="active",
+                    source_identity_id=None,
+                    safe_metadata={},
+                )
+            ]
+        }
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        KnowledgeDeploymentPreflightService(
+            db,
+            organization_id=organization_id,
+        ).enforce_active_publish(
+            deployment_type=DeploymentType.CHATBOT,
+            graph_snapshot=_collection_graph(collection_id),
+        )
+
+    assert exc_info.value.status_code == 409
+    detail = exc_info.value.detail["error"]
+    assert detail["code"] == "deployment.preflight.blocked"
+    assert detail["reason_code"] == (
+        "private_collection_requires_execution_subject"
+    )
+    assert str(collection_id) not in str(detail)
+
+
 def test_preflight_audience_classifies_every_deployment_type():
     assert {
         deployment_type: KnowledgeDeploymentPreflightService.server_derived_audience(
@@ -1190,7 +1486,24 @@ def _llm_graph(kb_id: uuid.UUID) -> dict:
             {
                 "id": "llm-1",
                 "type": "llmNode",
-                "data": {"knowledgeBases": [{"id": str(kb_id)}]},
+                "data": {
+                    "knowledgeBases": [{"id": str(kb_id), "name": "KB"}]
+                },
+            }
+        ],
+        "edges": [],
+    }
+
+
+def _collection_graph(collection_id: uuid.UUID) -> dict:
+    return {
+        "nodes": [
+            {
+                "id": "llm-1",
+                "type": "llmNode",
+                "data": {
+                    "knowledgeCollections": [{"id": str(collection_id)}]
+                },
             }
         ],
         "edges": [],
@@ -1224,6 +1537,15 @@ def __init__(self, rows_by_model=None, *, max_deployment_version=0):
         self.rolled_back = False
 
     def query(self, model, *rest):
+        if (
+            getattr(model, "class_", None) is KnowledgeCollectionItem
+            and getattr(model, "key", None) == "collection_id"
+            and rest
+        ):
+            return _CollectionAggregateQuery(
+                self.rows_by_model.setdefault(KnowledgeCollectionItem, []),
+                self.rows_by_model.setdefault(KnowledgeBase, []),
+            )
         if model in {
             App,
             Workflow,
@@ -1309,6 +1631,9 @@ def filter(self, *expressions):
         self.expressions.extend(expressions)
         return self
 
+    def join(self, *args, **kwargs):
+        return self
+
     def all(self):
         return [row for row in self.rows if self._matches(row)]
 
@@ -1330,6 +1655,53 @@ def _matches(self, row):
         )
 
 
+class _CollectionAggregateQuery:
+    def __init__(self, items, knowledge_bases):
+        self.items = items
+        self.knowledge_bases = knowledge_bases
+        self.expressions = []
+
+    def join(self, *args, **kwargs):
+        return self
+
+    def filter(self, *expressions):
+        self.expressions.extend(expressions)
+        return self
+
+    def group_by(self, *args, **kwargs):
+        return self
+
+    def all(self):
+        knowledge_bases_by_id = {
+            knowledge_base.id: knowledge_base
+            for knowledge_base in self.knowledge_bases
+        }
+        grouped: dict[uuid.UUID, list[SimpleNamespace]] = {}
+        for item in self.items:
+            knowledge_base = knowledge_bases_by_id.get(item.knowledge_base_id)
+            if knowledge_base is None:
+                continue
+            if not all(
+                _matches_expression(item, expression)
+                and _matches_expression(knowledge_base, expression)
+                for expression in self.expressions
+            ):
+                continue
+            grouped.setdefault(item.collection_id, []).append(knowledge_base)
+        return [
+            (
+                collection_id,
+                len(knowledge_bases),
+                sum(
+                    getattr(knowledge_base, "source_identity_id", None)
+                    is not None
+                    for knowledge_base in knowledge_bases
+                ),
+            )
+            for collection_id, knowledge_bases in grouped.items()
+        ]
+
+
 def _matches_expression(row, expression):
     if not hasattr(expression, "left"):
         return True
@@ -1354,6 +1726,8 @@ def _matches_expression(row, expression):
 def _right_value(right):
     if hasattr(right, "value"):
         return right.value
+    if str(right).lower() == "null":
+        return None
     if str(right).lower() == "true":
         return True
     if str(right).lower() == "false":
diff --git a/apps/gateway/tests/services/test_knowledge_base_query_service.py b/apps/gateway/tests/services/test_knowledge_base_query_service.py
index 4a4bc54fc..10c9a8d9d 100644
--- a/apps/gateway/tests/services/test_knowledge_base_query_service.py
+++ b/apps/gateway/tests/services/test_knowledge_base_query_service.py
@@ -3,6 +3,7 @@
 from types import SimpleNamespace
 
 import pytest
+from sqlalchemy.dialects import postgresql
 from sqlalchemy.exc import SQLAlchemyError
 
 from apps.gateway.services import knowledge_base_query_service as service_module
@@ -24,6 +25,7 @@
 class FakeKnowledgeQuery:
     def __init__(self, rows):
         self.rows = rows
+        self.filters = []
 
     def select_from(self, *_args, **_kwargs):
         return self
@@ -35,6 +37,7 @@ def outerjoin(self, *_args, **_kwargs):
         return self
 
     def filter(self, *_args, **_kwargs):
+        self.filters.extend(_args)
         return self
 
     def group_by(self, *_args, **_kwargs):
@@ -51,10 +54,25 @@ class FakeSelectableDb:
     def __init__(self, kbs):
         self.kbs = kbs
         self.query_entities = []
+        self.queries = []
 
     def query(self, *entities):
         self.query_entities.append(entities)
-        return FakeKnowledgeQuery(self.kbs)
+        query = FakeKnowledgeQuery(self.kbs)
+        self.queries.append(query)
+        return query
+
+
+def _compiled_filters(query) -> str:
+    return " ".join(
+        str(
+            criterion.compile(
+                dialect=postgresql.dialect(),
+                compile_kwargs={"literal_binds": True},
+            )
+        )
+        for criterion in query.filters
+    ).lower()
 
 
 class FakeAuthorizedListDb:
@@ -517,6 +535,23 @@ def bulk_evaluate_kb_use(self, kbs):
     assert response == []
 
 
+def test_list_llm_selectable_query_excludes_source_deleted_and_not_ready_kbs():
+    db = FakeSelectableDb([])
+    service = KnowledgeBaseQueryService(db)
+
+    assert service.list_llm_selectable(
+        user_id=uuid.uuid4(),
+        organization_id=uuid.uuid4(),
+        schema_ready=True,
+    ) == []
+
+    sql = _compiled_filters(db.queries[0])
+    assert "knowledge_bases.lifecycle_state = 'active'" in sql
+    assert "knowledge_bases.sync_state != 'source_deleted'" in sql
+    assert "documents.status = 'completed'" in sql
+    assert "document_chunks.document_version_id = knowledge_bases.active_document_version_id" in sql
+
+
 def test_get_detail_raises_not_found_for_missing_or_hidden_kb():
     db = FakeDetailDb(None, [])
 
diff --git a/apps/gateway/tests/services/test_knowledge_collection_picker_query_service.py b/apps/gateway/tests/services/test_knowledge_collection_picker_query_service.py
new file mode 100644
index 000000000..0afb8b8f5
--- /dev/null
+++ b/apps/gateway/tests/services/test_knowledge_collection_picker_query_service.py
@@ -0,0 +1,210 @@
+import uuid
+from types import SimpleNamespace
+
+from sqlalchemy.dialects import postgresql
+
+from apps.gateway.services.knowledge_collection_picker_query_service import (
+    MAX_LLM_SELECTABLE_COLLECTION_SCAN,
+    KnowledgeCollectionPickerQueryService,
+)
+
+
+class _Query:
+    def __init__(self, rows):
+        self.rows = rows
+        self.filters = []
+        self.limit_value = None
+        self.events = []
+
+    def options(self, *_args):
+        self.events.append("options")
+        return self
+
+    def filter(self, *criteria):
+        self.events.append("filter")
+        self.filters.extend(criteria)
+        return self
+
+    def order_by(self, *_args):
+        self.events.append("order_by")
+        return self
+
+    def limit(self, value):
+        self.events.append("limit")
+        self.limit_value = value
+        return self
+
+    def all(self):
+        self.events.append("all")
+        if self.limit_value is None:
+            return self.rows
+        return self.rows[: self.limit_value]
+
+
+class _Db:
+    def __init__(self, rows):
+        self.query_value = _Query(rows)
+
+    def query(self, _model):
+        return self.query_value
+
+
+def _collection(*, organization_id, safe_metadata=None, source_identity=None):
+    return SimpleNamespace(
+        id=uuid.uuid4(),
+        organization_id=organization_id,
+        lifecycle_state="active",
+        name="RAW COLLECTION NAME",
+        description="RAW DESCRIPTION",
+        safe_metadata=safe_metadata or {},
+        source_identity_id=(uuid.uuid4() if source_identity is not None else None),
+        source_identity=source_identity,
+    )
+
+
+def _scope_to_ids(monkeypatch, service, allowed_ids):
+    allowed_ids = set(allowed_ids)
+
+    def _scope(query, action):
+        assert action == "route"
+        query.events.append("permission_scope")
+        query.rows = [row for row in query.rows if row.id in allowed_ids]
+        return query
+
+    monkeypatch.setattr(
+        service.permission_helper,
+        "scope_collection_query_for_action",
+        _scope,
+    )
+
+
+def _compiled_filters(query):
+    return " ".join(
+        str(
+            criterion.compile(
+                dialect=postgresql.dialect(),
+                compile_kwargs={"literal_binds": True},
+            )
+        )
+        for criterion in query.filters
+    ).lower()
+
+
+def test_picker_returns_only_route_allowed_minimal_projection(monkeypatch):
+    organization_id = uuid.uuid4()
+    allowed = _collection(
+        organization_id=organization_id,
+        safe_metadata={"safe_label": "사내 규정"},
+    )
+    denied = _collection(
+        organization_id=organization_id,
+        safe_metadata={"safe_label": "숨김 문서"},
+    )
+    db = _Db([allowed, denied])
+    service = KnowledgeCollectionPickerQueryService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=organization_id,
+    )
+    _scope_to_ids(monkeypatch, service, [allowed.id])
+
+    response = service.list_llm_selectable()
+
+    assert response.model_dump(mode="json") == {
+        "collections": [{"id": str(allowed.id), "safe_label": "사내 규정"}]
+    }
+    assert db.query_value.limit_value == MAX_LLM_SELECTABLE_COLLECTION_SCAN
+    assert len(db.query_value.filters) == 3
+    assert "knowledge_collections.sync_state != 'source_deleted'" in _compiled_filters(
+        db.query_value
+    )
+    assert db.query_value.events == [
+        "options",
+        "filter",
+        "permission_scope",
+        "order_by",
+        "limit",
+        "all",
+    ]
+    assert "RAW COLLECTION NAME" not in response.model_dump_json()
+    assert "RAW DESCRIPTION" not in response.model_dump_json()
+
+
+def test_source_managed_label_requires_active_approved_display_policy(monkeypatch):
+    organization_id = uuid.uuid4()
+    approved = _collection(
+        organization_id=organization_id,
+        source_identity=SimpleNamespace(
+            display_policy_state="approved",
+            is_active=True,
+            safe_display_name="공개 승인 라벨",
+        ),
+    )
+    unapproved = _collection(
+        organization_id=organization_id,
+        source_identity=SimpleNamespace(
+            display_policy_state="unreviewed",
+            is_active=True,
+            safe_display_name="노출 금지 라벨",
+        ),
+    )
+    db = _Db([approved, unapproved])
+    service = KnowledgeCollectionPickerQueryService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=organization_id,
+    )
+    _scope_to_ids(monkeypatch, service, [approved.id, unapproved.id])
+
+    response = service.list_llm_selectable()
+
+    assert [item.safe_label for item in response.collections] == [
+        "공개 승인 라벨",
+        None,
+    ]
+
+
+def test_permission_scope_is_applied_before_scan_limit(monkeypatch):
+    organization_id = uuid.uuid4()
+    denied_recent = [
+        _collection(organization_id=organization_id) for _ in range(500)
+    ]
+    allowed_older = _collection(
+        organization_id=organization_id,
+        safe_metadata={"safe_label": "older allowed"},
+    )
+    db = _Db([*denied_recent, allowed_older])
+    service = KnowledgeCollectionPickerQueryService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=organization_id,
+    )
+    _scope_to_ids(monkeypatch, service, [allowed_older.id])
+
+    response = service.list_llm_selectable()
+
+    assert [item.id for item in response.collections] == [allowed_older.id]
+    assert db.query_value.events.index("permission_scope") < db.query_value.events.index(
+        "limit"
+    )
+
+
+def test_permission_scoped_result_is_capped_at_scan_limit(monkeypatch):
+    organization_id = uuid.uuid4()
+    allowed = [
+        _collection(organization_id=organization_id) for _ in range(501)
+    ]
+    db = _Db(allowed)
+    service = KnowledgeCollectionPickerQueryService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=organization_id,
+    )
+    _scope_to_ids(monkeypatch, service, [row.id for row in allowed])
+
+    response = service.list_llm_selectable()
+
+    assert len(response.collections) == MAX_LLM_SELECTABLE_COLLECTION_SCAN
+    assert [item.id for item in response.collections] == [
+        row.id for row in allowed[:MAX_LLM_SELECTABLE_COLLECTION_SCAN]
+    ]
diff --git a/apps/gateway/tests/services/test_knowledge_collection_service.py b/apps/gateway/tests/services/test_knowledge_collection_service.py
index 8b5c9dee7..9b982e0fd 100644
--- a/apps/gateway/tests/services/test_knowledge_collection_service.py
+++ b/apps/gateway/tests/services/test_knowledge_collection_service.py
@@ -95,6 +95,7 @@ def _collection(collection_id=None):
         name="HR",
         description=None,
         is_system_managed=False,
+        source_identity_id=None,
         sync_state="manual",
         lifecycle_state="active",
         safe_metadata={},
@@ -420,6 +421,31 @@ def test_public_visibility_blocks_source_managed_items_without_approval_primitiv
     }
 
 
+def test_public_visibility_blocks_source_managed_collection_without_approval_primitive(
+    monkeypatch,
+):
+    service = _service(monkeypatch)
+    collection = _collection()
+    collection.source_identity_id = uuid.uuid4()
+    monkeypatch.setattr(service, "_collection_or_hidden", lambda collection_id: collection)
+    monkeypatch.setattr(service, "_require_org_manager", lambda: None)
+
+    with pytest.raises(KnowledgeCollectionServiceError) as exc_info:
+        service.update_visibility(
+            collection.id,
+            KnowledgeCollectionVisibilityRequest(
+                visibility="public",
+                acknowledged_public_runtime_exposure=True,
+            ),
+        )
+
+    assert exc_info.value.status_code == 409
+    assert exc_info.value.code == "policy.blocked"
+    assert exc_info.value.details == {
+        "policy_reason": "source_public_exposure_required"
+    }
+
+
 def test_public_visibility_sets_only_candidate_flag(monkeypatch):
     db = _FakeDb()
     service = _service(monkeypatch, db=db)
diff --git a/apps/gateway/tests/services/test_workflow_knowledge_reference_service.py b/apps/gateway/tests/services/test_workflow_knowledge_reference_service.py
new file mode 100644
index 000000000..ca946e0a9
--- /dev/null
+++ b/apps/gateway/tests/services/test_workflow_knowledge_reference_service.py
@@ -0,0 +1,324 @@
+import uuid
+from types import SimpleNamespace
+
+import pytest
+from fastapi import HTTPException
+from sqlalchemy.dialects import postgresql
+
+from apps.gateway.services.workflow_service import WorkflowService
+from apps.gateway.services.workflow_knowledge_reference_service import (
+    WorkflowKnowledgeReferenceService,
+    WorkflowKnowledgeReferenceUnavailable,
+)
+
+
+def _graph(kb_id, collection_id):
+    return {
+        "nodes": [
+            {
+                "id": "llm",
+                "type": "llmNode",
+                "data": {
+                    "knowledgeBases": [{"id": str(kb_id), "name": "KB"}],
+                    "knowledgeCollections": [
+                        {"id": str(collection_id), "safeLabel": "Collection"}
+                    ],
+                },
+            }
+        ]
+    }
+
+
+def _service(monkeypatch, *, allow_kb=True, allow_collection=True, ready=True):
+    organization_id = uuid.uuid4()
+    user_id = uuid.uuid4()
+    kb_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    service = WorkflowKnowledgeReferenceService(
+        None,
+        user_id=user_id,
+        organization_id=organization_id,
+    )
+    kb = SimpleNamespace(id=kb_id, organization_id=organization_id)
+    collection = SimpleNamespace(id=collection_id, organization_id=organization_id)
+    monkeypatch.setattr(service, "_load_direct_kbs", lambda ids: [kb])
+    monkeypatch.setattr(service, "_load_collections", lambda ids: [collection])
+    monkeypatch.setattr(
+        service,
+        "_retrieval_ready_ids",
+        lambda ids: {kb_id} if ready else set(),
+    )
+    monkeypatch.setattr(
+        service.permission_helper,
+        "bulk_evaluate_kb_use",
+        lambda kbs: {kb_id: SimpleNamespace(allowed=allow_kb)},
+    )
+    monkeypatch.setattr(
+        service.permission_helper,
+        "bulk_evaluate_collection_action",
+        lambda collections, action: {
+            collection_id: SimpleNamespace(allowed=allow_collection)
+        },
+    )
+    return service, kb_id, collection_id
+
+
+def test_editable_graph_checks_direct_use_readiness_and_collection_route(monkeypatch):
+    service, kb_id, collection_id = _service(monkeypatch)
+
+    parsed = service.validate_editable_graph(_graph(kb_id, collection_id))
+
+    assert len(parsed) == 1
+    assert parsed[0].direct_kb_ids == (kb_id,)
+    assert parsed[0].collection_ids == (collection_id,)
+
+
+@pytest.mark.parametrize(
+    ("allow_kb", "allow_collection", "ready", "expected_field"),
+    [
+        (False, True, True, "graph.nodes[0].data.knowledgeBases[0]"),
+        (True, True, False, "graph.nodes[0].data.knowledgeBases[0]"),
+        (True, False, True, "graph.nodes[0].data.knowledgeCollections[0]"),
+    ],
+)
+def test_unavailable_references_use_generic_code_and_index_path(
+    monkeypatch,
+    allow_kb,
+    allow_collection,
+    ready,
+    expected_field,
+):
+    service, kb_id, collection_id = _service(
+        monkeypatch,
+        allow_kb=allow_kb,
+        allow_collection=allow_collection,
+        ready=ready,
+    )
+
+    with pytest.raises(WorkflowKnowledgeReferenceUnavailable) as error:
+        service.validate_editable_graph(_graph(kb_id, collection_id))
+
+    assert error.value.reason_code == "knowledge_reference_unavailable"
+    assert error.value.field_path == expected_field
+    assert str(kb_id) not in str(error.value)
+    assert str(collection_id) not in str(error.value)
+
+
+def test_empty_graph_does_not_query_permission_or_collection_children(monkeypatch):
+    service = WorkflowKnowledgeReferenceService(
+        None,
+        user_id=uuid.uuid4(),
+        organization_id=uuid.uuid4(),
+    )
+    monkeypatch.setattr(
+        service,
+        "_load_direct_kbs",
+        lambda ids: pytest.fail("direct KB query must not run"),
+    )
+    monkeypatch.setattr(
+        service,
+        "_load_collections",
+        lambda ids: pytest.fail("Collection query must not run"),
+    )
+
+    assert service.validate_editable_graph({"nodes": []}) == ()
+
+
+@pytest.mark.parametrize(
+    "graph",
+    [
+        {"nodes": []},
+        {
+            "nodes": [
+                {
+                    "id": "llm",
+                    "type": "llmNode",
+                    "data": {"knowledgeBases": [], "knowledgeCollections": []},
+                }
+            ]
+        },
+        {
+            "nodes": [
+                {
+                    "id": "loop",
+                    "type": "loopNode",
+                    "data": {"subGraph": {"nodes": []}},
+                }
+            ]
+        },
+    ],
+)
+def test_workflow_service_skips_context_validation_for_graph_without_knowledge_refs(
+    monkeypatch,
+    graph,
+):
+    monkeypatch.setattr(
+        "apps.gateway.services.workflow_service.WorkflowKnowledgeReferenceService",
+        lambda *args, **kwargs: pytest.fail("authorization service must not be built"),
+    )
+
+    WorkflowService.validate_knowledge_references(
+        object(),
+        graph,
+        user_id="legacy-user-without-uuid",
+        organization_id=None,
+    )
+
+
+def test_workflow_service_still_rejects_malformed_empty_knowledge_shape_without_org():
+    graph = {
+        "nodes": [
+            {
+                "id": "llm",
+                "type": "llmNode",
+                "data": {
+                    "knowledgeBases": "not-a-list",
+                    "knowledgeCollections": [],
+                },
+            }
+        ]
+    }
+
+    with pytest.raises(HTTPException) as error:
+        WorkflowService.validate_knowledge_references(
+            object(),
+            graph,
+            user_id="legacy-user-without-uuid",
+            organization_id=None,
+        )
+
+    assert error.value.status_code == 422
+    assert error.value.detail == {
+        "code": "knowledge_reference_list_invalid",
+        "field": "graph.nodes[0].data.knowledgeBases",
+    }
+
+
+def test_workflow_service_requires_context_when_knowledge_reference_exists():
+    graph = {
+        "nodes": [
+            {
+                "id": "llm",
+                "type": "llmNode",
+                "data": {
+                    "knowledgeBases": [
+                        {"id": str(uuid.uuid4()), "name": "KB"}
+                    ],
+                    "knowledgeCollections": [],
+                },
+            }
+        ]
+    }
+
+    with pytest.raises(HTTPException) as error:
+        WorkflowService.validate_knowledge_references(
+            object(),
+            graph,
+            user_id=uuid.uuid4(),
+            organization_id=None,
+        )
+
+    assert error.value.status_code == 422
+    assert error.value.detail == {
+        "code": "knowledge_reference_context_invalid",
+        "field": "graph",
+    }
+
+
+class _CriteriaQuery:
+    def __init__(self, rows=()):
+        self.criteria = []
+        self.rows = list(rows)
+
+    def select_from(self, *_args):
+        return self
+
+    def join(self, *_args):
+        return self
+
+    def outerjoin(self, *_args):
+        return self
+
+    def filter(self, *criteria):
+        self.criteria.extend(criteria)
+        return self
+
+    def distinct(self):
+        return self
+
+    def all(self):
+        return self.rows
+
+
+class _CriteriaDb:
+    def __init__(self, rows=()):
+        self.queries = []
+        self.rows = rows
+
+    def query(self, *_args):
+        query = _CriteriaQuery(self.rows)
+        self.queries.append(query)
+        return query
+
+
+def _compiled_criteria(query):
+    return " ".join(
+        str(
+            criterion.compile(
+                dialect=postgresql.dialect(),
+                compile_kwargs={"literal_binds": True},
+            )
+        )
+        for criterion in query.criteria
+    )
+
+
+@pytest.mark.parametrize(
+    "method_name",
+    ["_load_direct_kbs", "_retrieval_ready_ids"],
+)
+def test_save_time_direct_kb_queries_exclude_source_deleted(method_name):
+    db = _CriteriaDb()
+    service = WorkflowKnowledgeReferenceService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=uuid.uuid4(),
+    )
+
+    result = getattr(service, method_name)((uuid.uuid4(),))
+
+    assert result == ([] if method_name == "_load_direct_kbs" else set())
+    sql = _compiled_criteria(db.queries[0])
+    assert "knowledge_bases.lifecycle_state = 'active'" in sql
+    assert "knowledge_bases.sync_state != 'source_deleted'" in sql
+    if method_name == "_retrieval_ready_ids":
+        assert "documents.status = 'completed'" in sql
+        assert "document_versions.status = 'ready'" in sql
+
+
+def test_save_time_collection_query_excludes_source_deleted_parent():
+    db = _CriteriaDb()
+    service = WorkflowKnowledgeReferenceService(
+        db,
+        user_id=uuid.uuid4(),
+        organization_id=uuid.uuid4(),
+    )
+
+    assert service._load_collections((uuid.uuid4(),)) == []
+
+    sql = _compiled_criteria(db.queries[0])
+    assert "knowledge_collections.lifecycle_state = 'active'" in sql
+    assert "knowledge_collections.sync_state != 'source_deleted'" in sql
+
+
+def test_retrieval_ready_ids_extracts_sqlalchemy_row_value():
+    knowledge_base_id = uuid.uuid4()
+    service = WorkflowKnowledgeReferenceService(
+        _CriteriaDb([(knowledge_base_id,)]),
+        user_id=uuid.uuid4(),
+        organization_id=uuid.uuid4(),
+    )
+
+    assert service._retrieval_ready_ids((knowledge_base_id,)) == {
+        knowledge_base_id
+    }
diff --git a/apps/shared/domain/workflow_knowledge_references.py b/apps/shared/domain/workflow_knowledge_references.py
new file mode 100644
index 000000000..a2ac8f8a5
--- /dev/null
+++ b/apps/shared/domain/workflow_knowledge_references.py
@@ -0,0 +1,236 @@
+"""Pure validation for Workflow LLM Knowledge graph references.
+
+The stored graph carries user configuration intent, not an authorization
+capability.  This module therefore validates and projects identifiers only; it
+does not import an ORM, framework, queue, or concrete runtime implementation.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass
+from typing import Any
+from uuid import UUID
+
+from apps.shared.domain.knowledge_runtime_candidates import (
+    MAX_RUNTIME_COLLECTION_REFERENCES,
+    MAX_RUNTIME_DIRECT_KB_REFERENCES,
+)
+
+MAX_KNOWLEDGE_REFERENCE_DISPLAY_LENGTH = 255
+
+
+class WorkflowKnowledgeReferenceError(ValueError):
+    """Fixed-code graph validation error that never echoes graph values."""
+
+    def __init__(self, reason_code: str, field_path: str) -> None:
+        self.reason_code = reason_code
+        self.field_path = field_path
+        super().__init__(reason_code)
+
+
+def _raise(reason_code: str, field_path: str) -> None:
+    raise WorkflowKnowledgeReferenceError(reason_code, field_path)
+
+
+def _canonical_uuid(value: object, *, field_path: str) -> UUID:
+    if not isinstance(value, str):
+        _raise("knowledge_reference_id_invalid", field_path)
+    try:
+        parsed = UUID(value)
+    except (AttributeError, TypeError, ValueError):
+        _raise("knowledge_reference_id_invalid", field_path)
+    if str(parsed) != value:
+        _raise("knowledge_reference_id_invalid", field_path)
+    return parsed
+
+
+def _display_value(
+    value: object,
+    *,
+    field_path: str,
+    required: bool,
+) -> str | None:
+    if value is None and not required:
+        return None
+    if not isinstance(value, str):
+        _raise("knowledge_reference_display_invalid", field_path)
+    if len(value) > MAX_KNOWLEDGE_REFERENCE_DISPLAY_LENGTH or any(
+        ord(character) < 32 or ord(character) == 127 for character in value
+    ):
+        _raise("knowledge_reference_display_invalid", field_path)
+    return value
+
+
+@dataclass(frozen=True, slots=True)
+class KnowledgeBaseGraphReference:
+    id: UUID
+    name: str
+
+
+@dataclass(frozen=True, slots=True)
+class KnowledgeCollectionGraphReference:
+    id: UUID
+    safe_label: str | None = None
+
+
+def _unique_ids(values: tuple[UUID, ...]) -> tuple[UUID, ...]:
+    return tuple(dict.fromkeys(values))
+
+
+@dataclass(frozen=True, slots=True)
+class WorkflowNodeKnowledgeReferences:
+    """Validated references for one LLM node without mutating its graph data."""
+
+    field_path: str
+    direct_references: tuple[KnowledgeBaseGraphReference, ...] = ()
+    collection_references: tuple[KnowledgeCollectionGraphReference, ...] = ()
+
+    @property
+    def direct_kb_ids(self) -> tuple[UUID, ...]:
+        return _unique_ids(tuple(item.id for item in self.direct_references))
+
+    @property
+    def collection_ids(self) -> tuple[UUID, ...]:
+        return _unique_ids(tuple(item.id for item in self.collection_references))
+
+    @property
+    def has_references(self) -> bool:
+        return bool(self.direct_references or self.collection_references)
+
+
+def _reference_list(
+    data: Mapping[str, Any],
+    *,
+    key: str,
+    field_path: str,
+    limit: int,
+) -> list[object]:
+    if key not in data:
+        return []
+    raw_items = data[key]
+    if not isinstance(raw_items, list):
+        _raise("knowledge_reference_list_invalid", f"{field_path}.{key}")
+    if len(raw_items) > limit:
+        _raise("knowledge_reference_limit_exceeded", f"{field_path}.{key}")
+    return raw_items
+
+
+def parse_llm_knowledge_references(
+    data: Mapping[str, Any],
+    *,
+    field_path: str = "data",
+) -> WorkflowNodeKnowledgeReferences:
+    """Validate one LLM node's additive direct-KB and Collection references."""
+
+    if not isinstance(data, Mapping):
+        _raise("knowledge_reference_data_invalid", field_path)
+
+    raw_direct = _reference_list(
+        data,
+        key="knowledgeBases",
+        field_path=field_path,
+        limit=MAX_RUNTIME_DIRECT_KB_REFERENCES,
+    )
+    direct: list[KnowledgeBaseGraphReference] = []
+    for index, raw_item in enumerate(raw_direct):
+        item_path = f"{field_path}.knowledgeBases[{index}]"
+        if not isinstance(raw_item, Mapping):
+            _raise("knowledge_reference_item_invalid", item_path)
+        if set(raw_item) != {"id", "name"}:
+            _raise("knowledge_reference_item_invalid", item_path)
+        direct.append(
+            KnowledgeBaseGraphReference(
+                id=_canonical_uuid(raw_item["id"], field_path=f"{item_path}.id"),
+                name=_display_value(
+                    raw_item["name"],
+                    field_path=f"{item_path}.name",
+                    required=True,
+                )
+                or "",
+            )
+        )
+
+    raw_collections = _reference_list(
+        data,
+        key="knowledgeCollections",
+        field_path=field_path,
+        limit=MAX_RUNTIME_COLLECTION_REFERENCES,
+    )
+    collections: list[KnowledgeCollectionGraphReference] = []
+    for index, raw_item in enumerate(raw_collections):
+        item_path = f"{field_path}.knowledgeCollections[{index}]"
+        if not isinstance(raw_item, Mapping):
+            _raise("knowledge_reference_item_invalid", item_path)
+        allowed_fields = {"id", "safeLabel"}
+        if "id" not in raw_item or not set(raw_item).issubset(allowed_fields):
+            _raise("knowledge_reference_item_invalid", item_path)
+        collections.append(
+            KnowledgeCollectionGraphReference(
+                id=_canonical_uuid(raw_item["id"], field_path=f"{item_path}.id"),
+                safe_label=_display_value(
+                    raw_item.get("safeLabel"),
+                    field_path=f"{item_path}.safeLabel",
+                    required=False,
+                ),
+            )
+        )
+
+    return WorkflowNodeKnowledgeReferences(
+        field_path=field_path,
+        direct_references=tuple(direct),
+        collection_references=tuple(collections),
+    )
+
+
+def parse_workflow_knowledge_references(
+    graph: Mapping[str, Any],
+) -> tuple[WorkflowNodeKnowledgeReferences, ...]:
+    """Validate Knowledge references in root and nested Loop subgraphs."""
+
+    if not isinstance(graph, Mapping):
+        _raise("workflow_graph_invalid", "graph")
+
+    results: list[WorkflowNodeKnowledgeReferences] = []
+    pending: list[tuple[Mapping[str, Any], str]] = [(graph, "graph")]
+    while pending:
+        current_graph, graph_path = pending.pop()
+        nodes = current_graph.get("nodes", [])
+        if not isinstance(nodes, list):
+            _raise("workflow_graph_invalid", f"{graph_path}.nodes")
+        for index, node in enumerate(nodes):
+            node_path = f"{graph_path}.nodes[{index}]"
+            if not isinstance(node, Mapping):
+                _raise("workflow_graph_invalid", node_path)
+            data = node.get("data")
+            if node.get("type") == "llmNode":
+                if not isinstance(data, Mapping):
+                    _raise("knowledge_reference_data_invalid", f"{node_path}.data")
+                results.append(
+                    parse_llm_knowledge_references(
+                        data,
+                        field_path=f"{node_path}.data",
+                    )
+                )
+            if not isinstance(data, Mapping):
+                continue
+            subgraph = data.get("subGraph")
+            if subgraph is None:
+                continue
+            if not isinstance(subgraph, Mapping):
+                _raise("workflow_graph_invalid", f"{node_path}.data.subGraph")
+            pending.append((subgraph, f"{node_path}.data.subGraph"))
+    return tuple(results)
+
+
+def aggregate_workflow_knowledge_reference_ids(
+    parsed_nodes: tuple[WorkflowNodeKnowledgeReferences, ...],
+) -> tuple[tuple[UUID, ...], tuple[UUID, ...]]:
+    """Return first-occurrence IDs across a graph for bulk authorization."""
+
+    direct: list[UUID] = []
+    collections: list[UUID] = []
+    for node in parsed_nodes:
+        direct.extend(node.direct_kb_ids)
+        collections.extend(node.collection_ids)
+    return _unique_ids(tuple(direct)), _unique_ids(tuple(collections))
diff --git a/apps/shared/schemas/deployment.py b/apps/shared/schemas/deployment.py
index 9a86bfdb3..85da23960 100644
--- a/apps/shared/schemas/deployment.py
+++ b/apps/shared/schemas/deployment.py
@@ -42,6 +42,8 @@ class DeploymentPreflightSummary(BaseModel):
     blocked_reason: Optional[str] = None
     affected_node_count: int = 0
     affected_kb_count_bucket: str = "0"
+    affected_collection_count_bucket: str = "0"
+    candidate_budget_limited: bool = False
 
 
 class DeploymentPreflightRequiredAction(BaseModel):
@@ -55,6 +57,8 @@ class DeploymentPreflightNodeResult(BaseModel):
     status: DeploymentPreflightStatus
     reason_codes: list[str] = Field(default_factory=list)
     knowledge_base_count_bucket: str = "0"
+    knowledge_collection_count_bucket: str = "0"
+    candidate_budget_limited: bool = False
 
 
 class DeploymentPreflightResponse(BaseModel):
diff --git a/apps/shared/schemas/knowledge.py b/apps/shared/schemas/knowledge.py
index 57df9c91f..58bb5670d 100644
--- a/apps/shared/schemas/knowledge.py
+++ b/apps/shared/schemas/knowledge.py
@@ -142,6 +142,17 @@ class KnowledgeCollectionListResponse(BaseModel):
     can_change_public_visibility: bool = False
 
 
+class KnowledgeCollectionLLMSelectableItem(BaseModel):
+    id: UUID
+    safe_label: str | None = None
+
+
+class KnowledgeCollectionLLMSelectableResponse(BaseModel):
+    collections: list[KnowledgeCollectionLLMSelectableItem] = Field(
+        default_factory=list
+    )
+
+
 class KnowledgeCollectionItemLinkRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
diff --git a/apps/shared/services/knowledge_permission_service.py b/apps/shared/services/knowledge_permission_service.py
index ea21295c6..7e300fd3f 100644
--- a/apps/shared/services/knowledge_permission_service.py
+++ b/apps/shared/services/knowledge_permission_service.py
@@ -30,7 +30,7 @@
     get_organization_auth_state,
     has_active_organization_membership,
 )
-from sqlalchemy import and_, or_
+from sqlalchemy import and_, exists, false, or_
 from sqlalchemy.orm import Session, load_only
 
 COLLECTION_PERMISSION_ACTIONS = {"read", "route", "manage", "sync"}
@@ -189,6 +189,45 @@ def bulk_evaluate_collection_action(
                 )
         return decisions
 
+    def scope_collection_query_for_action(self, query: Any, action: str) -> Any:
+        """Apply effective Collection authorization before ordering and limits."""
+        if action not in COLLECTION_PERMISSION_ACTIONS:
+            return query.filter(false())
+
+        organization_auth_state = self._organization_auth_state()
+        if organization_auth_state == AUTH_STATE_MANAGER:
+            return query
+        if organization_auth_state != ORGANIZATION_AUTH_MEMBER:
+            return query.filter(false())
+
+        direct_permission_exists = exists().where(
+            and_(
+                UserKnowledgeCollectionPermission.knowledge_collection_id
+                == KnowledgeCollection.id,
+                UserKnowledgeCollectionPermission.user_id == self.user_id,
+                UserKnowledgeCollectionPermission.grantee_organization_id
+                == self.organization_id,
+                UserKnowledgeCollectionPermission.permission_action == action,
+            )
+        )
+        team_permission_exists = exists().where(
+            and_(
+                TeamKnowledgeCollectionPermission.knowledge_collection_id
+                == KnowledgeCollection.id,
+                TeamKnowledgeCollectionPermission.grantee_organization_id
+                == self.organization_id,
+                TeamKnowledgeCollectionPermission.permission_action == action,
+                TeamMembership.team_id
+                == TeamKnowledgeCollectionPermission.team_id,
+                TeamMembership.user_id == self.user_id,
+                TeamMembership.grantee_organization_id == self.organization_id,
+                Team.organization_id == self.organization_id,
+                Team.id == TeamKnowledgeCollectionPermission.team_id,
+                Team.is_active.is_(True),
+            )
+        )
+        return query.filter(or_(direct_permission_exists, team_permission_exists))
+
     def evaluate_kb_use(self, kb: KnowledgeBase) -> KnowledgePermissionDecision:
         if not self._kb_in_scope(kb):
             return self._denied(reason_code="resource.hidden")
diff --git a/apps/shared/services/knowledge_resource_eligibility.py b/apps/shared/services/knowledge_resource_eligibility.py
new file mode 100644
index 000000000..e3abf1e9e
--- /dev/null
+++ b/apps/shared/services/knowledge_resource_eligibility.py
@@ -0,0 +1,131 @@
+"""Canonical database predicates for routable Knowledge resources."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from apps.shared.db.models.knowledge import (
+    Document,
+    DocumentChunk,
+    DocumentVersion,
+    KnowledgeBase,
+    KnowledgeCollection,
+)
+from sqlalchemy import and_, or_, select
+from sqlalchemy.sql.elements import ColumnElement
+
+ACTIVE_LIFECYCLE_STATE = "active"
+SOURCE_DELETED_SYNC_STATE = "source_deleted"
+_MISSING_SOURCE_IDENTITY = object()
+
+
+def knowledge_base_operational_predicates() -> tuple[ColumnElement[bool], ...]:
+    """Return the canonical SQL scope for a routable Knowledge Base."""
+
+    return (
+        KnowledgeBase.lifecycle_state == ACTIVE_LIFECYCLE_STATE,
+        KnowledgeBase.sync_state != SOURCE_DELETED_SYNC_STATE,
+    )
+
+
+def knowledge_collection_operational_predicates() -> tuple[
+    ColumnElement[bool], ...
+]:
+    """Return the canonical SQL scope for a routable Knowledge Collection."""
+
+    return (
+        KnowledgeCollection.lifecycle_state == ACTIVE_LIFECYCLE_STATE,
+        KnowledgeCollection.sync_state != SOURCE_DELETED_SYNC_STATE,
+    )
+
+
+def knowledge_collection_anonymous_public_predicates() -> tuple[
+    ColumnElement[bool], ...
+]:
+    """Return the current fail-closed anonymous public Collection scope."""
+
+    return (
+        *knowledge_collection_operational_predicates(),
+        KnowledgeCollection.source_identity_id.is_(None),
+        KnowledgeCollection.safe_metadata["visibility"].astext == "public",
+    )
+
+
+def retrieval_visible_chunk_exists() -> ColumnElement[bool]:
+    """Return a correlated EXISTS predicate for a retrieval-visible chunk."""
+
+    return (
+        select(DocumentChunk.id)
+        .select_from(DocumentChunk)
+        .join(
+            Document,
+            and_(
+                Document.id == DocumentChunk.document_id,
+                Document.knowledge_base_id == DocumentChunk.knowledge_base_id,
+            ),
+        )
+        .outerjoin(
+            DocumentVersion,
+            and_(
+                DocumentVersion.id == DocumentChunk.document_version_id,
+                DocumentVersion.knowledge_base_id
+                == DocumentChunk.knowledge_base_id,
+                DocumentVersion.organization_id == KnowledgeBase.organization_id,
+            ),
+        )
+        .where(
+            DocumentChunk.knowledge_base_id == KnowledgeBase.id,
+            Document.status == "completed",
+            or_(
+                and_(
+                    KnowledgeBase.active_document_version_id.is_(None),
+                    DocumentChunk.document_version_id.is_(None),
+                ),
+                and_(
+                    KnowledgeBase.active_document_version_id.is_not(None),
+                    DocumentChunk.document_version_id
+                    == KnowledgeBase.active_document_version_id,
+                    DocumentVersion.status == "ready",
+                ),
+            ),
+        )
+        .exists()
+    )
+
+
+def is_operational_knowledge_resource(resource: Any) -> bool:
+    """Apply the same lifecycle/sync rule to an already-loaded resource."""
+
+    return (
+        getattr(resource, "lifecycle_state", None) == ACTIVE_LIFECYCLE_STATE
+        and getattr(resource, "sync_state", None) != SOURCE_DELETED_SYNC_STATE
+    )
+
+
+def is_anonymous_public_knowledge_collection(resource: Any) -> bool:
+    """Apply the anonymous public Collection scope to an already-loaded row."""
+
+    safe_metadata = getattr(resource, "safe_metadata", None)
+    source_identity_id = getattr(
+        resource,
+        "source_identity_id",
+        _MISSING_SOURCE_IDENTITY,
+    )
+    return (
+        is_operational_knowledge_resource(resource)
+        and isinstance(safe_metadata, dict)
+        and safe_metadata.get("visibility") == "public"
+        and source_identity_id is None
+    )
+
+
+__all__ = [
+    "ACTIVE_LIFECYCLE_STATE",
+    "SOURCE_DELETED_SYNC_STATE",
+    "is_anonymous_public_knowledge_collection",
+    "is_operational_knowledge_resource",
+    "knowledge_base_operational_predicates",
+    "knowledge_collection_anonymous_public_predicates",
+    "knowledge_collection_operational_predicates",
+    "retrieval_visible_chunk_exists",
+]
diff --git a/apps/shared/services/tracing/metadata.py b/apps/shared/services/tracing/metadata.py
index a9b4b0a3d..83958b629 100644
--- a/apps/shared/services/tracing/metadata.py
+++ b/apps/shared/services/tracing/metadata.py
@@ -237,6 +237,7 @@
         "insufficiency_reason",
         "knowledge_base_id",
         "authorized_kb_count",
+        "authorized_kb_count_bucket",
         "permission_filter_applied",
         "latency_ms",
         "partial_result",
@@ -252,6 +253,7 @@
         "safe_exclusion_summary",
         "score_summary",
         "selected_kb_count",
+        "selected_kb_count_bucket",
         "source_tier_policy",
         "source_tier_used",
         "stored_result_count",
@@ -285,6 +287,7 @@
     "chunk_id",
     "parent_chunk_id",
     "rank",
+    "evidence_rank",
     "knowledge_base_id",
     "metadata_summary",
     "hierarchy_path",
@@ -414,7 +417,15 @@ def sanitize_rag_metadata(cls, value: Any) -> Any:
                 if item
             ]
         if isinstance(safe_value, dict):
-            return cls._filter_allowed_dict(safe_value, RAG_RESULT_FIELDS)
+            filtered = cls._filter_allowed_dict(safe_value, RAG_RESULT_FIELDS)
+            evidence_rank = filtered.get("evidence_rank")
+            if evidence_rank is not None and (
+                isinstance(evidence_rank, bool)
+                or not isinstance(evidence_rank, int)
+                or evidence_rank < 1
+            ):
+                filtered.pop("evidence_rank", None)
+            return filtered
         return None
 
     @classmethod
diff --git a/apps/shared/tests/db/test_knowledge_runtime_snapshot_disposable_postgres.py b/apps/shared/tests/db/test_knowledge_runtime_snapshot_disposable_postgres.py
index 4afbd090f..1439eb519 100644
--- a/apps/shared/tests/db/test_knowledge_runtime_snapshot_disposable_postgres.py
+++ b/apps/shared/tests/db/test_knowledge_runtime_snapshot_disposable_postgres.py
@@ -92,6 +92,7 @@ def _create_schema(engine) -> None:
         CREATE TABLE knowledge_collections (
             id UUID PRIMARY KEY,
             organization_id UUID NOT NULL,
+            source_identity_id UUID NULL,
             lifecycle_state VARCHAR(50) NOT NULL,
             sync_state VARCHAR(50) NOT NULL,
             is_system_managed BOOLEAN NOT NULL,
@@ -736,6 +737,45 @@ def test_repeatable_read_snapshot_does_not_mix_concurrent_membership_change(
         ).scalar_one() == probe_id
 
 
+@pytest.mark.skipif(
+    os.getenv(RUN_ENV) != "1",
+    reason=f"set {RUN_ENV}=1 to run disposable Knowledge public policy evidence",
+)
+def test_anonymous_snapshot_excludes_source_managed_public_collection(
+    disposable_snapshot_database,
+):
+    engine = disposable_snapshot_database
+    organization_id, collection_id, _knowledge_base_id = (
+        _seed_ready_public_collection(engine)
+    )
+    with engine.begin() as connection:
+        connection.execute(
+            text(
+                "UPDATE knowledge_collections "
+                "SET source_identity_id = :source_identity_id "
+                "WHERE organization_id = :organization_id "
+                "AND id = :collection_id"
+            ),
+            {
+                "source_identity_id": uuid4(),
+                "organization_id": organization_id,
+                "collection_id": collection_id,
+            },
+        )
+    session_factory = sessionmaker(bind=engine, autoflush=False, expire_on_commit=False)
+    request = KnowledgeRuntimeCandidateRequest(
+        audience=AnonymousPublicAudience(organization_id=organization_id),
+        collection_ids=(collection_id,),
+    )
+
+    snapshot = PostgresKnowledgeRuntimeCandidateSnapshotAdapter(
+        session_factory=session_factory
+    ).load_snapshot(request)
+
+    assert snapshot.collection_streams == ()
+    assert snapshot.policy_excluded_count == 1
+
+
 @pytest.mark.skipif(
     os.getenv(RUN_ENV) != "1",
     reason=f"set {RUN_ENV}=1 to run disposable Knowledge bounded scan evidence",
diff --git a/apps/shared/tests/domain/test_workflow_knowledge_references.py b/apps/shared/tests/domain/test_workflow_knowledge_references.py
new file mode 100644
index 000000000..e7c5dcb4a
--- /dev/null
+++ b/apps/shared/tests/domain/test_workflow_knowledge_references.py
@@ -0,0 +1,238 @@
+from uuid import UUID
+
+import pytest
+
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowKnowledgeReferenceError,
+    aggregate_workflow_knowledge_reference_ids,
+    parse_llm_knowledge_references,
+    parse_workflow_knowledge_references,
+)
+
+
+KB_1 = "00000000-0000-0000-0000-000000000001"
+KB_2 = "00000000-0000-0000-0000-000000000002"
+COLLECTION_1 = "10000000-0000-0000-0000-000000000001"
+ALPHA_UUID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+
+
+def _llm_data(**overrides):
+    data = {
+        "knowledgeBases": [{"id": KB_1, "name": "규칙"}],
+        "knowledgeCollections": [
+            {"id": COLLECTION_1, "safeLabel": "사내 문서"}
+        ],
+    }
+    data.update(overrides)
+    return data
+
+
+def _assert_error(data, reason_code, field_path):
+    with pytest.raises(WorkflowKnowledgeReferenceError) as error:
+        parse_llm_knowledge_references(data)
+    assert error.value.reason_code == reason_code
+    assert error.value.field_path == field_path
+    assert KB_1 not in str(error.value)
+
+
+def test_legacy_direct_only_and_missing_collection_field_are_valid():
+    parsed = parse_llm_knowledge_references(
+        {"knowledgeBases": [{"id": KB_1, "name": ""}]}
+    )
+
+    assert parsed.direct_kb_ids == (UUID(KB_1),)
+    assert parsed.collection_ids == ()
+    assert parsed.direct_references[0].name == ""
+
+
+def test_collection_only_and_mixed_references_are_valid_without_mode():
+    collection_only = parse_llm_knowledge_references(
+        {"knowledgeCollections": [{"id": COLLECTION_1}]}
+    )
+    mixed = parse_llm_knowledge_references(_llm_data())
+
+    assert collection_only.has_references is True
+    assert collection_only.collection_references[0].safe_label is None
+    assert mixed.direct_kb_ids == (UUID(KB_1),)
+    assert mixed.collection_ids == (UUID(COLLECTION_1),)
+
+
+@pytest.mark.parametrize("key", ["knowledgeBases", "knowledgeCollections"])
+@pytest.mark.parametrize("value", [None, "bad", {}, 1, True])
+def test_reference_lists_must_be_explicit_lists(key, value):
+    _assert_error(
+        {key: value},
+        "knowledge_reference_list_invalid",
+        f"data.{key}",
+    )
+
+
+@pytest.mark.parametrize("key", ["knowledgeBases", "knowledgeCollections"])
+@pytest.mark.parametrize("value", [None, "bad", 1, True])
+def test_reference_items_must_be_objects(key, value):
+    _assert_error(
+        {key: [value]},
+        "knowledge_reference_item_invalid",
+        f"data.{key}[0]",
+    )
+
+
+def test_direct_and_collection_item_shapes_are_strict():
+    _assert_error(
+        {"knowledgeBases": [{"id": KB_1, "name": "ok", "extra": True}]},
+        "knowledge_reference_item_invalid",
+        "data.knowledgeBases[0]",
+    )
+    _assert_error(
+        {"knowledgeCollections": [{"safeLabel": "missing id"}]},
+        "knowledge_reference_item_invalid",
+        "data.knowledgeCollections[0]",
+    )
+    _assert_error(
+        {"knowledgeCollections": [{"id": COLLECTION_1, "name": "raw"}]},
+        "knowledge_reference_item_invalid",
+        "data.knowledgeCollections[0]",
+    )
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "",
+        "not-a-uuid",
+        "00000000000000000000000000000001",
+        ALPHA_UUID.upper(),
+        "{00000000-0000-0000-0000-000000000001}",
+        1,
+        True,
+    ],
+)
+def test_reference_ids_must_be_canonical_uuid_strings(value):
+    _assert_error(
+        {"knowledgeBases": [{"id": value, "name": "safe"}]},
+        "knowledge_reference_id_invalid",
+        "data.knowledgeBases[0].id",
+    )
+
+
+@pytest.mark.parametrize("field,value", [("name", None), ("name", 1)])
+def test_direct_display_name_is_required_string(field, value):
+    _assert_error(
+        {"knowledgeBases": [{"id": KB_1, field: value}]},
+        "knowledge_reference_display_invalid",
+        "data.knowledgeBases[0].name",
+    )
+
+
+@pytest.mark.parametrize("display", ["line\nbreak", "tab\tvalue", "x\x00y"])
+def test_display_snapshots_reject_control_characters(display):
+    _assert_error(
+        {"knowledgeCollections": [{"id": COLLECTION_1, "safeLabel": display}]},
+        "knowledge_reference_display_invalid",
+        "data.knowledgeCollections[0].safeLabel",
+    )
+
+
+def test_display_length_boundary_is_strict():
+    parse_llm_knowledge_references(
+        {"knowledgeCollections": [{"id": COLLECTION_1, "safeLabel": "가" * 255}]}
+    )
+    _assert_error(
+        {"knowledgeCollections": [{"id": COLLECTION_1, "safeLabel": "가" * 256}]},
+        "knowledge_reference_display_invalid",
+        "data.knowledgeCollections[0].safeLabel",
+    )
+
+
+@pytest.mark.parametrize("key", ["knowledgeBases", "knowledgeCollections"])
+def test_each_reference_list_has_an_independent_twenty_item_limit(key):
+    if key == "knowledgeBases":
+        item = {"id": KB_1, "name": "safe"}
+    else:
+        item = {"id": COLLECTION_1}
+    parse_llm_knowledge_references({key: [item] * 20})
+    _assert_error(
+        {key: [item] * 21},
+        "knowledge_reference_limit_exceeded",
+        f"data.{key}",
+    )
+
+
+def test_duplicates_remain_configured_but_runtime_ids_are_first_deduplicated():
+    parsed = parse_llm_knowledge_references(
+        {
+            "knowledgeBases": [
+                {"id": KB_1, "name": "first"},
+                {"id": KB_2, "name": "second"},
+                {"id": KB_1, "name": "duplicate"},
+            ]
+        }
+    )
+
+    assert len(parsed.direct_references) == 3
+    assert parsed.direct_kb_ids == (UUID(KB_1), UUID(KB_2))
+
+
+def test_root_and_nested_loop_graphs_are_validated_and_aggregated():
+    graph = {
+        "nodes": [
+            {"id": "root", "type": "llmNode", "data": _llm_data()},
+            {
+                "id": "loop",
+                "type": "loopNode",
+                "data": {
+                    "subGraph": {
+                        "nodes": [
+                            {
+                                "id": "nested",
+                                "type": "llmNode",
+                                "data": {
+                                    "knowledgeBases": [
+                                        {"id": KB_2, "name": "nested"},
+                                        {"id": KB_1, "name": "duplicate"},
+                                    ]
+                                },
+                            }
+                        ]
+                    }
+                },
+            },
+        ]
+    }
+
+    parsed = parse_workflow_knowledge_references(graph)
+    direct, collections = aggregate_workflow_knowledge_reference_ids(parsed)
+
+    assert len(parsed) == 2
+    assert direct == (UUID(KB_1), UUID(KB_2))
+    assert collections == (UUID(COLLECTION_1),)
+
+
+def test_nested_error_uses_index_path_without_echoing_node_identity():
+    graph = {
+        "nodes": [
+            {
+                "id": "secret-node-id",
+                "type": "loopNode",
+                "data": {
+                    "subGraph": {
+                        "nodes": [
+                            {
+                                "id": "hidden-llm-id",
+                                "type": "llmNode",
+                                "data": {"knowledgeCollections": None},
+                            }
+                        ]
+                    }
+                },
+            }
+        ]
+    }
+
+    with pytest.raises(WorkflowKnowledgeReferenceError) as error:
+        parse_workflow_knowledge_references(graph)
+
+    assert error.value.field_path == (
+        "graph.nodes[0].data.subGraph.nodes[0].data.knowledgeCollections"
+    )
+    assert "secret-node-id" not in str(error.value)
diff --git a/apps/shared/tests/services/test_knowledge_permission_runtime_bulk.py b/apps/shared/tests/services/test_knowledge_permission_runtime_bulk.py
index 589ae4c49..e7b35d2a0 100644
--- a/apps/shared/tests/services/test_knowledge_permission_runtime_bulk.py
+++ b/apps/shared/tests/services/test_knowledge_permission_runtime_bulk.py
@@ -3,9 +3,16 @@
 from uuid import UUID
 
 import pytest
+from apps.shared.db.models.knowledge import KnowledgeCollection
 from apps.shared.db.models.organization_membership import ORGANIZATION_AUTH_MEMBER
-from apps.shared.permissions import AUTH_STATE_MANAGER, AUTH_STATE_OPERATOR
+from apps.shared.permissions import (
+    AUTH_STATE_MANAGER,
+    AUTH_STATE_NONE,
+    AUTH_STATE_OPERATOR,
+)
 from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
+from sqlalchemy.dialects import postgresql
+from sqlalchemy.orm import Session
 
 ORG_ID = UUID(int=100)
 USER_ID = UUID(int=101)
@@ -61,6 +68,26 @@ def _collection_has_action(self, collection_id, action):
         raise AssertionError("bulk evaluation must not call the single-row path")
 
 
+class _CollectionScopeHelper(KnowledgePermissionHelper):
+    def __init__(self, *, auth_state):
+        super().__init__(Session(), user_id=USER_ID, organization_id=ORG_ID)
+        self.auth_state = auth_state
+
+    def _organization_auth_state(self):
+        return self.auth_state
+
+
+def _collection_scope_sql(helper, action="route"):
+    query = helper.db.query(KnowledgeCollection)
+    scoped = helper.scope_collection_query_for_action(query, action)
+    return str(
+        scoped.statement.compile(
+            dialect=postgresql.dialect(),
+            compile_kwargs={"literal_binds": True},
+        )
+    )
+
+
 def test_bulk_collection_route_uses_one_bulk_permission_projection():
     collections = [_collection(1), _collection(2)]
     helper = _BulkCollectionHelper()
@@ -99,6 +126,50 @@ def test_bulk_collection_invalid_action_is_fixed_safe_denial():
     assert helper.bulk_calls == []
 
 
+def test_collection_query_scope_manager_does_not_require_permission_rows():
+    sql = _collection_scope_sql(
+        _CollectionScopeHelper(auth_state=AUTH_STATE_MANAGER)
+    ).lower()
+
+    assert "user_knowledge_collection_permissions" not in sql
+    assert "team_knowledge_collection_permissions" not in sql
+
+
+def test_collection_query_scope_member_accepts_direct_or_active_team_route():
+    sql = _collection_scope_sql(
+        _CollectionScopeHelper(auth_state=ORGANIZATION_AUTH_MEMBER)
+    ).lower()
+
+    assert "user_knowledge_collection_permissions" in sql
+    assert "team_knowledge_collection_permissions" in sql
+    assert "team_memberships" in sql
+    assert "teams" in sql
+    assert "permission_action = 'route'" in sql
+    assert str(USER_ID) in sql
+    assert str(ORG_ID) in sql
+    assert "teams.is_active is true" in sql
+
+
+def test_collection_query_scope_non_member_fails_closed():
+    sql = _collection_scope_sql(
+        _CollectionScopeHelper(auth_state=AUTH_STATE_NONE)
+    ).lower()
+
+    assert "where false" in sql
+    assert "user_knowledge_collection_permissions" not in sql
+
+
+def test_collection_query_scope_invalid_action_fails_closed_before_auth_lookup():
+    helper = _CollectionScopeHelper(auth_state=AUTH_STATE_MANAGER)
+    helper._organization_auth_state = lambda: (_ for _ in ()).throw(
+        AssertionError("invalid action must not evaluate organization authorization")
+    )
+
+    sql = _collection_scope_sql(helper, action="content").lower()
+
+    assert "where false" in sql
+
+
 class _SourceActionHelper(KnowledgePermissionHelper):
     def __init__(self, provenance, *, evaluation_time=None):
         super().__init__(
diff --git a/apps/shared/tests/services/test_knowledge_resource_eligibility.py b/apps/shared/tests/services/test_knowledge_resource_eligibility.py
new file mode 100644
index 000000000..b6a95b512
--- /dev/null
+++ b/apps/shared/tests/services/test_knowledge_resource_eligibility.py
@@ -0,0 +1,110 @@
+from types import SimpleNamespace
+
+from apps.shared.db.models.knowledge import KnowledgeBase, KnowledgeCollection
+from apps.shared.services.knowledge_resource_eligibility import (
+    is_anonymous_public_knowledge_collection,
+    is_operational_knowledge_resource,
+    knowledge_base_operational_predicates,
+    knowledge_collection_anonymous_public_predicates,
+    knowledge_collection_operational_predicates,
+    retrieval_visible_chunk_exists,
+)
+from sqlalchemy import select
+from sqlalchemy.dialects import postgresql
+
+
+def _postgres_sql(statement) -> str:
+    return str(
+        statement.compile(
+            dialect=postgresql.dialect(),
+            compile_kwargs={"literal_binds": True},
+        )
+    ).lower()
+
+
+def test_operational_predicates_share_lifecycle_and_source_deleted_boundary():
+    kb_sql = _postgres_sql(
+        select(KnowledgeBase.id).where(*knowledge_base_operational_predicates())
+    )
+    collection_sql = _postgres_sql(
+        select(KnowledgeCollection.id).where(
+            *knowledge_collection_operational_predicates()
+        )
+    )
+
+    assert "knowledge_bases.lifecycle_state = 'active'" in kb_sql
+    assert "knowledge_bases.sync_state != 'source_deleted'" in kb_sql
+    assert "knowledge_collections.lifecycle_state = 'active'" in collection_sql
+    assert "knowledge_collections.sync_state != 'source_deleted'" in collection_sql
+
+
+def test_anonymous_public_collection_predicates_include_source_and_visibility_gate():
+    sql = _postgres_sql(
+        select(KnowledgeCollection.id).where(
+            *knowledge_collection_anonymous_public_predicates()
+        )
+    )
+
+    assert "knowledge_collections.lifecycle_state = 'active'" in sql
+    assert "knowledge_collections.sync_state != 'source_deleted'" in sql
+    assert "knowledge_collections.source_identity_id is null" in sql
+    assert "knowledge_collections.safe_metadata" in sql
+    assert "= 'public'" in sql
+
+
+def test_retrieval_visible_chunk_predicate_covers_versioned_and_legacy_paths():
+    sql = _postgres_sql(
+        select(KnowledgeBase.id).where(retrieval_visible_chunk_exists())
+    )
+
+    assert "exists" in sql
+    assert "documents.status = 'completed'" in sql
+    assert "knowledge_bases.active_document_version_id is null" in sql
+    assert "document_chunks.document_version_id is null" in sql
+    assert "document_chunks.document_version_id = knowledge_bases.active_document_version_id" in sql
+    assert "document_versions.status = 'ready'" in sql
+    assert "document_versions.organization_id = knowledge_bases.organization_id" in sql
+
+
+def test_loaded_resource_boundary_allows_stale_snapshot_but_not_deleted_source():
+    active_stale = SimpleNamespace(lifecycle_state="active", sync_state="stale")
+    source_deleted = SimpleNamespace(
+        lifecycle_state="active",
+        sync_state="source_deleted",
+    )
+    archived = SimpleNamespace(lifecycle_state="archived", sync_state="manual")
+
+    assert is_operational_knowledge_resource(active_stale) is True
+    assert is_operational_knowledge_resource(source_deleted) is False
+    assert is_operational_knowledge_resource(archived) is False
+
+
+def test_loaded_anonymous_public_collection_is_manual_public_and_fail_closed():
+    manual_public = SimpleNamespace(
+        lifecycle_state="active",
+        sync_state="manual",
+        source_identity_id=None,
+        safe_metadata={"visibility": "public"},
+    )
+    source_managed = SimpleNamespace(
+        lifecycle_state="active",
+        sync_state="synced",
+        source_identity_id="opaque-source",
+        safe_metadata={"visibility": "public"},
+    )
+    missing_source_state = SimpleNamespace(
+        lifecycle_state="active",
+        sync_state="manual",
+        safe_metadata={"visibility": "public"},
+    )
+    private = SimpleNamespace(
+        lifecycle_state="active",
+        sync_state="manual",
+        source_identity_id=None,
+        safe_metadata={"visibility": "private"},
+    )
+
+    assert is_anonymous_public_knowledge_collection(manual_public) is True
+    assert is_anonymous_public_knowledge_collection(source_managed) is False
+    assert is_anonymous_public_knowledge_collection(missing_source_state) is False
+    assert is_anonymous_public_knowledge_collection(private) is False
diff --git a/apps/shared/tests/services/test_tracing_metadata.py b/apps/shared/tests/services/test_tracing_metadata.py
index 83ed507c3..144a50231 100644
--- a/apps/shared/tests/services/test_tracing_metadata.py
+++ b/apps/shared/tests/services/test_tracing_metadata.py
@@ -2,6 +2,7 @@
 from datetime import datetime, timezone
 from types import SimpleNamespace
 
+import pytest
 from apps.shared.schemas.tracing import TraceDetailSchema, TraceSummarySchema
 from apps.shared.services.tracing.metadata import TraceMetadataSanitizer
 from apps.shared.services.tracing.query import TraceQueryService
@@ -185,6 +186,7 @@ def test_rag_metadata_preserves_payload_reference_and_summarizes_evidence():
                         "document_id": "doc-1",
                         "filename": "sensitive-title.pdf",
                         "rank": 1,
+                        "evidence_rank": 1,
                         "similarity_score": 0.9,
                         "score": 0.91,
                         "token_count": 210,
@@ -216,6 +218,27 @@ def test_rag_metadata_preserves_payload_reference_and_summarizes_evidence():
     assert "/private/source/path" not in str(metadata)
 
 
+def test_rag_result_sanitizer_keeps_global_evidence_rank_only_by_allowlist():
+    metadata = TraceMetadataSanitizer.sanitize_rag_metadata(
+        {
+            "evidence_rank": 2,
+            "rank": 1,
+            "child_kb_rank": 1,
+        }
+    )
+
+    assert metadata == {"evidence_rank": 2, "rank": 1}
+
+
+@pytest.mark.parametrize("invalid_rank", [0, -1, True, 1.5, "1"])
+def test_rag_result_sanitizer_drops_invalid_global_evidence_rank(invalid_rank):
+    metadata = TraceMetadataSanitizer.sanitize_rag_metadata(
+        {"evidence_rank": invalid_rank, "score": 0.9}
+    )
+
+    assert metadata == {"score": 0.9}
+
+
 def test_rag_span_metadata_preserves_evidence_summary_fields_only():
     metadata = TraceMetadataSanitizer.sanitize_span_metadata(
         "llmNode",
@@ -232,7 +255,9 @@ def test_rag_span_metadata_preserves_evidence_summary_fields_only():
                 "retrieval_strategy": "permission_scoped_hierarchical_hybrid",
                 "rag_mode": "explicit_kb",
                 "authorized_kb_count": 2,
+                "authorized_kb_count_bucket": "2-10",
                 "selected_kb_count": 1,
+                "selected_kb_count_bucket": "1",
                 "retrieved_chunk_count": 3,
                 "context_token_estimate": 123,
                 "permission_filter_applied": True,
@@ -262,7 +287,9 @@ def test_rag_span_metadata_preserves_evidence_summary_fields_only():
     )
     assert metadata["rag"]["rag_mode"] == "explicit_kb"
     assert metadata["rag"]["authorized_kb_count"] == 2
+    assert metadata["rag"]["authorized_kb_count_bucket"] == "2-10"
     assert metadata["rag"]["selected_kb_count"] == 1
+    assert metadata["rag"]["selected_kb_count_bucket"] == "1"
     assert metadata["rag"]["retrieved_chunk_count"] == 3
     assert metadata["rag"]["context_token_estimate"] == 123
     assert metadata["rag"]["permission_filter_applied"] is True
diff --git a/apps/workflow_engine/adapters/knowledge_runtime_candidates.py b/apps/workflow_engine/adapters/knowledge_runtime_candidates.py
index 0b01e6ae1..15af30ca9 100644
--- a/apps/workflow_engine/adapters/knowledge_runtime_candidates.py
+++ b/apps/workflow_engine/adapters/knowledge_runtime_candidates.py
@@ -27,6 +27,13 @@
     KnowledgeRuntimeCandidateSnapshot,
 )
 from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
+from apps.shared.services.knowledge_resource_eligibility import (
+    is_anonymous_public_knowledge_collection,
+    is_operational_knowledge_resource,
+    knowledge_base_operational_predicates,
+    knowledge_collection_anonymous_public_predicates,
+    knowledge_collection_operational_predicates,
+)
 
 
 SessionFactory = Callable[[], Session]
@@ -167,7 +174,7 @@ def _load_snapshot_in_transaction(
             allowed_collection_ids = tuple(
                 collection.id
                 for collection in configured_collections
-                if self._collection_is_public(collection)
+                if is_anonymous_public_knowledge_collection(collection)
             )
         else:
             raise KnowledgeRuntimeCandidateSnapshotError("snapshot_audience_invalid")
@@ -364,6 +371,7 @@ def _load_selected_collections(
                         KnowledgeCollection.organization_id,
                         KnowledgeCollection.lifecycle_state,
                         KnowledgeCollection.sync_state,
+                        KnowledgeCollection.source_identity_id,
                         KnowledgeCollection.is_system_managed,
                         KnowledgeCollection.safe_metadata,
                     )
@@ -371,7 +379,7 @@ def _load_selected_collections(
                 .where(
                     KnowledgeCollection.id.in_(bounded_ids),
                     KnowledgeCollection.organization_id == organization_id,
-                    KnowledgeCollection.lifecycle_state == "active",
+                    *knowledge_collection_operational_predicates(),
                 )
             )
             .scalars()
@@ -503,8 +511,7 @@ def _load_candidate_kbs(
                 .where(
                     KnowledgeBase.id.in_(bounded_ids),
                     KnowledgeBase.organization_id == organization_id,
-                    KnowledgeBase.lifecycle_state == "active",
-                    KnowledgeBase.sync_state != "source_deleted",
+                    *knowledge_base_operational_predicates(),
                 )
             )
             .scalars()
@@ -618,9 +625,7 @@ def _load_public_direct_kb_ids(
                     KnowledgeCollectionItem.organization_id == organization_id,
                     KnowledgeCollectionItem.knowledge_base_id.in_(bounded_ids),
                     KnowledgeCollection.organization_id == organization_id,
-                    KnowledgeCollection.lifecycle_state == "active",
-                    KnowledgeCollection.safe_metadata["visibility"].astext
-                    == "public",
+                    *knowledge_collection_anonymous_public_predicates(),
                 )
                 .distinct()
             )
@@ -653,15 +658,7 @@ def _collection_is_in_scope(
             collection is not None
             and getattr(collection, "id", None) == expected_id
             and getattr(collection, "organization_id", None) == organization_id
-            and getattr(collection, "lifecycle_state", None) == "active"
-        )
-
-    @staticmethod
-    def _collection_is_public(collection: Any) -> bool:
-        safe_metadata = getattr(collection, "safe_metadata", None)
-        return (
-            isinstance(safe_metadata, dict)
-            and safe_metadata.get("visibility") == "public"
+            and is_operational_knowledge_resource(collection)
         )
 
     @staticmethod
@@ -675,8 +672,7 @@ def _kb_is_in_scope(
             kb is not None
             and getattr(kb, "id", None) == expected_id
             and getattr(kb, "organization_id", None) == organization_id
-            and getattr(kb, "lifecycle_state", None) == "active"
-            and getattr(kb, "sync_state", None) != "source_deleted"
+            and is_operational_knowledge_resource(kb)
         )
 
     @staticmethod
diff --git a/apps/workflow_engine/services/model_router.py b/apps/workflow_engine/services/model_router.py
index 209989b45..2643dbcfb 100644
--- a/apps/workflow_engine/services/model_router.py
+++ b/apps/workflow_engine/services/model_router.py
@@ -489,7 +489,10 @@ def infer_runtime_context(
         )
         routing_context = getattr(node_data, "model_routing_context", None)
         routing_context = routing_context if isinstance(routing_context, dict) else {}
-        knowledge_enabled = bool(getattr(node_data, "knowledgeBases", None))
+        knowledge_enabled = bool(
+            getattr(node_data, "knowledgeBases", None)
+            or getattr(node_data, "knowledgeCollections", None)
+        )
         output_format = cls._output_format_name(
             getattr(node_data, "output_format", None)
         )
diff --git a/apps/workflow_engine/services/model_routing_policy_refresh_task.py b/apps/workflow_engine/services/model_routing_policy_refresh_task.py
index d3e5e8361..90b3e7abc 100644
--- a/apps/workflow_engine/services/model_routing_policy_refresh_task.py
+++ b/apps/workflow_engine/services/model_routing_policy_refresh_task.py
@@ -233,7 +233,10 @@ def _safe_node_summary(node_data: dict[str, Any]) -> dict[str, Any]:
         return {
             "output_format": output_format.get("type") or "text",
             "schema_required": bool(output_format.get("schema")),
-            "knowledge_enabled": bool(node_data.get("knowledgeBases")),
+            "knowledge_enabled": bool(
+                node_data.get("knowledgeBases")
+                or node_data.get("knowledgeCollections")
+            ),
             "has_fallback_model": bool(node_data.get("fallback_model_id")),
             "model_routing_context": node_data.get("model_routing_context") or {},
         }
diff --git a/apps/workflow_engine/tests/adapters/test_postgres_knowledge_runtime_candidate_adapter.py b/apps/workflow_engine/tests/adapters/test_postgres_knowledge_runtime_candidate_adapter.py
index f941eccc7..e2e7976fe 100644
--- a/apps/workflow_engine/tests/adapters/test_postgres_knowledge_runtime_candidate_adapter.py
+++ b/apps/workflow_engine/tests/adapters/test_postgres_knowledge_runtime_candidate_adapter.py
@@ -5,6 +5,7 @@
 
 import pytest
 from sqlalchemy.dialects import postgresql
+
 from apps.shared.domain.knowledge_runtime_candidates import (
     AnonymousPublicAudience,
     AuthenticatedAudience,
@@ -27,11 +28,20 @@
 KB_5 = UUID(int=304)
 
 
-def _collection(collection_id, *, visibility="private", organization_id=ORG_ID):
+def _collection(
+    collection_id,
+    *,
+    visibility="private",
+    organization_id=ORG_ID,
+    sync_state="manual",
+    source_managed=False,
+):
     return SimpleNamespace(
         id=collection_id,
         organization_id=organization_id,
         lifecycle_state="active",
+        sync_state=sync_state,
+        source_identity_id=UUID(int=901) if source_managed else None,
         safe_metadata={"visibility": visibility},
     )
 
@@ -523,6 +533,70 @@ def test_anonymous_collection_visibility_is_exact_and_fail_closed(metadata):
     assert not any(event[0] == "memberships" for event in adapter.read_events)
 
 
+@pytest.mark.parametrize("source_identity_state", ["managed", "missing"])
+def test_anonymous_source_managed_collection_is_excluded_before_membership_scan(
+    source_identity_state,
+):
+    session = _FakeSession()
+    collection = _collection(
+        COLLECTION_A,
+        visibility="public",
+        source_managed=True,
+    )
+    if source_identity_state == "missing":
+        del collection.source_identity_id
+    adapter = _FixtureAdapter(
+        session,
+        collections=[collection],
+        memberships=[(COLLECTION_A, KB_1)],
+        kbs=[_kb(KB_1)],
+        ready={KB_1},
+    )
+    request = KnowledgeRuntimeCandidateRequest(
+        audience=AnonymousPublicAudience(organization_id=ORG_ID),
+        collection_ids=(COLLECTION_A,),
+    )
+
+    snapshot = adapter.load_snapshot(request)
+
+    assert snapshot.collection_streams == ()
+    assert snapshot.policy_excluded_count == 1
+    assert not any(event[0] == "memberships" for event in adapter.read_events)
+
+
+def test_authenticated_source_managed_collection_keeps_route_and_kb_use_policy():
+    session = _FakeSession()
+    helper = _PermissionHelper(routed={COLLECTION_A}, usable={KB_1})
+    adapter = _FixtureAdapter(
+        session,
+        collections=[
+            _collection(
+                COLLECTION_A,
+                visibility="public",
+                source_managed=True,
+            )
+        ],
+        memberships=[(COLLECTION_A, KB_1)],
+        kbs=[_kb(KB_1)],
+        ready={KB_1},
+        permission_helper=helper,
+    )
+    request = KnowledgeRuntimeCandidateRequest(
+        audience=AuthenticatedAudience(
+            organization_id=ORG_ID,
+            user_id=USER_ID,
+        ),
+        collection_ids=(COLLECTION_A,),
+    )
+
+    snapshot = adapter.load_snapshot(request)
+
+    assert snapshot.collection_streams[0].collection_id == COLLECTION_A
+    assert snapshot.collection_streams[0].eligible_kb_ids == (KB_1,)
+    assert helper.collection_calls == [((COLLECTION_A,), "route")]
+    assert helper.kb_calls == [(KB_1,)]
+
+
 def test_snapshot_excludes_cross_org_archived_and_source_deleted_facts():
     session = _FakeSession()
     helper = _PermissionHelper(
@@ -557,6 +631,30 @@ def test_snapshot_excludes_cross_org_archived_and_source_deleted_facts():
     assert helper.kb_calls == []
 
 
+def test_snapshot_excludes_source_deleted_collection_before_permission_or_membership():
+    session = _FakeSession()
+    helper = _PermissionHelper(routed={COLLECTION_A}, usable={KB_1})
+    adapter = _FixtureAdapter(
+        session,
+        collections=[_collection(COLLECTION_A, sync_state="source_deleted")],
+        memberships=[(COLLECTION_A, KB_1)],
+        kbs=[_kb(KB_1)],
+        ready={KB_1},
+        permission_helper=helper,
+    )
+    request = KnowledgeRuntimeCandidateRequest(
+        audience=AuthenticatedAudience(ORG_ID, USER_ID),
+        collection_ids=(COLLECTION_A,),
+    )
+
+    snapshot = adapter.load_snapshot(request)
+
+    assert snapshot.collection_streams == ()
+    assert snapshot.policy_excluded_count == 1
+    assert helper.collection_calls == []
+    assert not any(event[0] == "memberships" for event in adapter.read_events)
+
+
 def test_scan_limit_is_preserved_as_safe_snapshot_signal():
     session = _FakeSession()
     helper = _PermissionHelper(routed={COLLECTION_A}, usable={KB_1})
@@ -695,6 +793,9 @@ def test_snapshot_queries_do_not_select_raw_collection_or_kb_text_fields():
     assert "knowledge_collections.name" not in collection_sql
     assert "knowledge_collections.description" not in collection_sql
     assert "source_connector_ref" not in collection_sql
+    assert "knowledge_collections.source_identity_id" in collection_sql
+    assert "knowledge_collections.lifecycle_state =" in collection_sql
+    assert "knowledge_collections.sync_state !=" in collection_sql
 
     adapter._load_candidate_kbs(db, ORG_ID, (KB_1,))
     kb_sql = str(db.statement.compile(dialect=postgresql.dialect())).lower()
@@ -702,6 +803,14 @@ def test_snapshot_queries_do_not_select_raw_collection_or_kb_text_fields():
     assert "knowledge_bases.description" not in kb_sql
     assert "knowledge_bases.safe_metadata" not in kb_sql
 
+    adapter._load_public_direct_kb_ids(db, ORG_ID, (KB_1,))
+    public_direct_sql = str(
+        db.statement.compile(dialect=postgresql.dialect())
+    ).lower()
+    assert "knowledge_collections.lifecycle_state =" in public_direct_sql
+    assert "knowledge_collections.sync_state !=" in public_direct_sql
+    assert "knowledge_collections.source_identity_id is null" in public_direct_sql
+
 
 def test_session_factory_failure_does_not_expose_partial_snapshot():
     def fail_session_factory():
diff --git a/apps/workflow_engine/tests/nodes/test_llm_node_runtime.py b/apps/workflow_engine/tests/nodes/test_llm_node_runtime.py
index dc3377e18..7fa26db6f 100644
--- a/apps/workflow_engine/tests/nodes/test_llm_node_runtime.py
+++ b/apps/workflow_engine/tests/nodes/test_llm_node_runtime.py
@@ -5,6 +5,7 @@
 """
 
 import json
+import logging
 import pathlib
 import sys
 import uuid
@@ -26,6 +27,20 @@
     SourceType,
 )
 from apps.shared.db.models.llm import LLMModel  # noqa: E402
+from apps.shared.domain.workflow_knowledge_references import (  # noqa: E402
+    WorkflowKnowledgeReferenceError,
+)
+from apps.shared.domain.knowledge_runtime_candidates import (  # noqa: E402
+    AnonymousPublicAudience,
+    AuthenticatedAudience,
+    KnowledgeCollectionCandidateStream,
+    KnowledgeRuntimeCandidate,
+    KnowledgeRuntimeCandidateProvenance,
+    KnowledgeRuntimeCandidateRequest,
+    KnowledgeRuntimeCandidateResolution,
+    KnowledgeRuntimeCandidateSnapshot,
+    resolve_knowledge_runtime_candidates,
+)
 from apps.shared.schemas.rag import ChunkPreview  # noqa: E402
 from apps.shared.services.rag_evidence_policy import RAGEvidenceDecision  # noqa: E402
 from apps.shared.services.tracing.metadata import TraceMetadataSanitizer  # noqa: E402
@@ -44,6 +59,7 @@
     MAX_RAG_CHUNKS_PER_KB,
     MAX_RAG_RETRIEVAL_KBS,
     KnowledgeBaseRef,
+    KnowledgeCollectionRef,
     LLMNodeData,
     LLMVariable,
 )
@@ -54,6 +70,12 @@
     WorkflowRAGFanoutResult,
     WorkflowRAGSearchResult,
 )
+from apps.workflow_engine.application.runtime_retrieval.knowledge_candidates import (  # noqa: E402
+    KnowledgeRuntimeCandidateInfrastructureError,
+)
+from apps.workflow_engine.workflow.errors import (  # noqa: E402
+    NonRetryableWorkflowError,
+)
 
 
 class DummyClient:
@@ -113,6 +135,48 @@ def invoke_sync(self, messages, **kwargs):
         }
 
 
+@pytest.fixture(autouse=True)
+def _inject_default_runtime_candidate_resolver(monkeypatch):
+    class DefaultRuntimeCandidateResolver:
+        def resolve(self, request: KnowledgeRuntimeCandidateRequest):
+            return resolve_knowledge_runtime_candidates(
+                request,
+                KnowledgeRuntimeCandidateSnapshot(
+                    eligible_direct_kb_ids=request.direct_kb_ids,
+                ),
+            )
+
+    default_resolver = DefaultRuntimeCandidateResolver()
+    monkeypatch.setattr(
+        LLMNode,
+        "_get_knowledge_runtime_candidate_resolver",
+        lambda self: self.execution_context.get(
+            "knowledge_runtime_candidate_resolver",
+            default_resolver,
+        ),
+    )
+
+
+
+class CapturingRuntimeCandidateResolver:
+    def __init__(
+        self,
+        snapshot: KnowledgeRuntimeCandidateSnapshot | None = None,
+        error: Exception | None = None,
+    ):
+        self.snapshot = snapshot or KnowledgeRuntimeCandidateSnapshot()
+        self.error = error
+        self.calls: list[KnowledgeRuntimeCandidateRequest] = []
+
+    def resolve(
+        self,
+        request: KnowledgeRuntimeCandidateRequest,
+    ):
+        self.calls.append(request)
+        if self.error is not None:
+            raise self.error
+        return resolve_knowledge_runtime_candidates(request, self.snapshot)
+
 def _patch_rag_gevent_inline(monkeypatch, node):
     """RAG fanout unit test에서 gevent 의존성 없이 bounded path를 동기 실행한다."""
 
@@ -221,23 +285,22 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
+    allowed_ids = tuple(uuid.UUID(str(kb_id)) for kb_id in knowledge_base_ids)
 
-        def evaluate_kb_use(self, kb):
-            return SimpleNamespace(
-                allowed=True,
-                external_reason_code="allowed",
-                effective_auth_state="manager",
+    class FakeKnowledgeRuntimeCandidateResolver:
+        def resolve(self, request: KnowledgeRuntimeCandidateRequest):
+            return resolve_knowledge_runtime_candidates(
+                request,
+                KnowledgeRuntimeCandidateSnapshot(
+                    eligible_direct_kb_ids=allowed_ids,
+                ),
             )
 
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
-
+    resolver = FakeKnowledgeRuntimeCandidateResolver()
     monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
+        LLMNode,
+        "_get_knowledge_runtime_candidate_resolver",
+        lambda _self: resolver,
     )
     return FakeDb()
 
@@ -1594,13 +1657,19 @@ def test_knowledge_trace_metadata_excludes_chunk_content():
         metadata={"source": "kb"},
     )
 
-    metadata = node._knowledge_trace_metadata("kb-1", chunk)  # noqa: SLF001 - 테스트용
+    metadata = node._knowledge_trace_metadata(  # noqa: SLF001 - 테스트용
+        "kb-1",
+        chunk,
+        evidence_rank=1,
+    )
 
     assert metadata["page_number"] == 3
     assert metadata["knowledge_base_id"] == "kb-1"
     assert metadata["chunk_id"] == str(chunk_id)
     assert metadata["parent_chunk_id"] == str(parent_chunk_id)
     assert metadata["score"] == 0.92
+    assert metadata["rank"] == 1
+    assert metadata["evidence_rank"] == 1
     assert metadata["token_count"] == 120
     assert metadata["metadata_summary"] == {
         "classification": "internal",
@@ -1620,6 +1689,42 @@ def test_knowledge_trace_metadata_excludes_chunk_content():
     assert "Sensitive title" not in str(metadata)
 
 
+def test_collection_trace_metadata_omits_child_resource_lineage_identifiers():
+    node = LLMNode.__new__(LLMNode)
+    chunk = ChunkPreview(
+        chunk_id=uuid.uuid4(),
+        parent_chunk_id=uuid.uuid4(),
+        content="검색 원문",
+        document_id=uuid.uuid4(),
+        filename="guide.md",
+        page_number=2,
+        similarity_score=0.93,
+        rank=1,
+        token_count=80,
+        metadata_summary={"classification": "internal"},
+        hierarchy_path=["Guide"],
+    )
+
+    metadata = node._knowledge_trace_metadata(  # noqa: SLF001 - redaction contract
+        str(uuid.uuid4()),
+        chunk,
+        evidence_rank=2,
+        include_resource_identity=False,
+    )
+
+    assert "knowledge_base_id" not in metadata
+    assert "document_id" not in metadata
+    assert "chunk_id" not in metadata
+    assert "parent_chunk_id" not in metadata
+    assert "rank" not in metadata
+    assert metadata["evidence_rank"] == 2
+    assert metadata["page_number"] == 2
+    assert metadata["similarity_score"] == 0.93
+    assert metadata["token_count"] == 80
+    assert metadata["metadata_summary"] == {"classification": "internal"}
+    assert metadata["hierarchy_path"] == ["Guide"]
+
+
 def test_rag_retrieval_trace_payload_uses_redacted_contract():
     node = LLMNode.__new__(LLMNode)
     node.id = "llm-1"
@@ -1708,7 +1813,7 @@ def test_llm_node_rag_no_evidence_skips_llm_call(monkeypatch):
     monkeypatch.setattr(
         LLMNode,
         "_execute_knowledge_search",
-        lambda self, query, db_session: WorkflowRAGSearchResult(
+        lambda self, query, db_session, *, candidate_resolution=None: WorkflowRAGSearchResult(
             context="",
             metadata=[],
             evidence_decision=decision,
@@ -1748,7 +1853,9 @@ def test_llm_node_rag_operational_failure_uses_safe_no_result(monkeypatch):
     client = DummyClient()
     node._client_override = client  # noqa: SLF001 - 테스트용 주입
 
-    def raise_retrieval_error(self, query, db_session):
+    def raise_retrieval_error(
+        self, query, db_session, *, candidate_resolution=None
+    ):
         raise RuntimeError("vector store unavailable")
 
     monkeypatch.setattr(LLMNode, "_execute_knowledge_search", raise_retrieval_error)
@@ -1761,7 +1868,7 @@ def raise_retrieval_error(self, query, db_session):
     assert result["metadata"]["rag"]["insufficiency_reason"] == "operational_error"
 
 
-def test_llm_node_rag_options_are_capped_during_validation():
+def test_llm_node_rejects_over_limit_kbs_without_silent_slicing():
     data = LLMNodeData(
         title="LLM",
         provider="openai",
@@ -1774,10 +1881,12 @@ def test_llm_node_rag_options_are_capped_during_validation():
         ],
     )
 
-    data.validate()
+    with pytest.raises(WorkflowKnowledgeReferenceError) as error:
+        data.validate()
 
+    assert error.value.reason_code == "knowledge_reference_limit_exceeded"
     assert data.topK == MAX_RAG_CHUNKS_PER_KB
-    assert len(data.knowledgeBases) == MAX_RAG_RETRIEVAL_KBS
+    assert len(data.knowledgeBases) == MAX_RAG_RETRIEVAL_KBS + 5
 
 
 def test_llm_node_rag_partial_retrieval_failure_uses_safe_partial_result(
@@ -1802,19 +1911,6 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def evaluate_kb_use(self, kb):
-            return SimpleNamespace(
-                allowed=True,
-                external_reason_code="allowed",
-                effective_auth_state="operator",
-            )
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
 
     class FakeRetrievalService:
         def __init__(self, db, user_id, organization_id=None):
@@ -1835,10 +1931,6 @@ def search_documents_sync(self, query, *, knowledge_base_id, **kwargs):
                 )
             ]
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -1903,19 +1995,6 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="operator",
-                )
-                for kb in kbs
-            }
 
     class FakeRetrievalService:
         def __init__(self, db, user_id, organization_id=None):
@@ -1935,10 +2014,6 @@ def search_documents_sync(self, query, *, threshold, **kwargs):
                 )
             ]
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -1996,19 +2071,6 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def evaluate_kb_use(self, kb):
-            return SimpleNamespace(
-                allowed=True,
-                external_reason_code="allowed",
-                effective_auth_state="operator",
-            )
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
 
     class FakeRetrievalService:
         def __init__(self, db, user_id, organization_id=None):
@@ -2039,10 +2101,6 @@ def search_documents_sync(self, query, *, knowledge_base_id, **kwargs):
                 )
             ]
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -2103,19 +2161,6 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="operator",
-                )
-                for kb in kbs
-            }
 
     class FakeRetrievalService:
         def __init__(self, db, user_id, organization_id=None):
@@ -2146,10 +2191,6 @@ def search_documents_sync(self, query, *, knowledge_base_id, **kwargs):
                 )
             ]
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -2234,19 +2275,6 @@ class FakeDb:
         def query(self, model):
             return FakeQuery(model)
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="operator",
-                )
-                for kb in kbs
-            }
 
     class FakeEmbeddingClient:
         def embed_sync(self, query):
@@ -2266,10 +2294,6 @@ def search_documents_sync(self, query, *, knowledge_base_id, query_vector=None,
                 )
             ]
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -2606,24 +2630,7 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def evaluate_kb_use(self, kb):
-            return SimpleNamespace(
-                allowed=True,
-                external_reason_code="allowed",
-                effective_auth_state="operator",
-            )
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.record_audit",
         lambda **kwargs: None,
@@ -2740,11 +2747,6 @@ def test_llm_node_rag_pii_evidence_blocks_llm_context(monkeypatch):
             },
         },
     )
-    monkeypatch.setattr(
-        node,
-        "_authorized_runtime_kb_ids",
-        lambda *args, **kwargs: [str(kb_id)],
-    )
     policy_block_calls = []
     monkeypatch.setattr(
         node,
@@ -2826,11 +2828,6 @@ def test_llm_node_rag_pii_evidence_fail_node_raises(monkeypatch):
             },
         },
     )
-    monkeypatch.setattr(
-        node,
-        "_authorized_runtime_kb_ids",
-        lambda *args, **kwargs: [str(kb_id)],
-    )
     policy_block_calls = []
     monkeypatch.setattr(
         node,
@@ -2907,6 +2904,11 @@ def test_llm_node_rag_policy_block_audit_uses_canonical_action(monkeypatch):
     ("audit_method", "expected_action", "call_kwargs"),
     [
         ("_record_rag_retrieve_audit", "rag.retrieve", {}),
+        (
+            "_record_rag_collection_retrieve_audit",
+            "rag.retrieve",
+            {"candidate_count": 1, "result_count": 1},
+        ),
         (
             "_record_rag_policy_block_audit",
             "policy.block",
@@ -2992,7 +2994,11 @@ def test_interactive_rag_audit_uses_execution_subject_not_credential_principal(
 
 @pytest.mark.parametrize(
     "audit_method",
-    ("_record_rag_retrieve_audit", "_record_rag_policy_block_audit"),
+    (
+        "_record_rag_retrieve_audit",
+        "_record_rag_collection_retrieve_audit",
+        "_record_rag_policy_block_audit",
+    ),
 )
 def test_rag_audit_omits_unscoped_invalid_organization(monkeypatch, audit_method):
     node = LLMNode.__new__(LLMNode)
@@ -3010,6 +3016,12 @@ def test_rag_audit_omits_unscoped_invalid_organization(monkeypatch, audit_method
 
     if audit_method == "_record_rag_retrieve_audit":
         getattr(node, audit_method)(uuid.uuid4(), str(uuid.uuid4()), 1)
+    elif audit_method == "_record_rag_collection_retrieve_audit":
+        getattr(node, audit_method)(
+            uuid.uuid4(),
+            candidate_count=1,
+            result_count=1,
+        )
     else:
         getattr(node, audit_method)(uuid.uuid4(), reason_code="pii_policy_blocked")
 
@@ -3095,6 +3107,104 @@ def fake_search(**kwargs):
     assert len(result.results) == len(kb_ids)
 
 
+def test_precomputed_fanout_log_uses_bucketed_candidate_count(monkeypatch, caplog):
+    node = LLMNode.__new__(LLMNode)
+    kb_ids = [str(uuid.uuid4()) for _ in range(3)]
+    expected = WorkflowRAGFanoutResult(results=[], failed_count=0)
+    monkeypatch.setattr(
+        node,
+        "_run_rag_retrieval_fanout_sequential",
+        lambda **kwargs: expected,
+    )
+
+    with caplog.at_level(
+        logging.INFO,
+        logger="apps.workflow_engine.workflow.nodes.llm.llm_node",
+    ):
+        result = node._run_rag_retrieval_fanout(  # noqa: SLF001 - safe log contract
+            query="query",
+            fallback_db_session=object(),
+            user_id=uuid.uuid4(),
+            organization_id=uuid.uuid4(),
+            knowledge_base_ids=kb_ids,
+            top_k=3,
+            threshold=0.5,
+            query_vectors_by_kb={kb_id: [0.1] for kb_id in kb_ids},
+        )
+
+    assert result is expected
+    log_text = " ".join(caplog.messages)
+    assert "kb_count_bucket=2-10" in log_text
+    assert "kb_count=3" not in log_text
+
+
+def test_query_vector_precompute_log_uses_only_count_buckets(monkeypatch, caplog):
+    organization_id = uuid.uuid4()
+    user_id = uuid.uuid4()
+    kb_ids = [uuid.uuid4() for _ in range(3)]
+    kb_rows = [
+        SimpleNamespace(id=kb_id, embedding_model="embedding-model")
+        for kb_id in kb_ids
+    ]
+
+    class Query:
+        def __init__(self, model):
+            self.model = model
+
+        def filter(self, *_criteria):
+            return self
+
+        def all(self):
+            return kb_rows if self.model is KnowledgeBase else []
+
+        def first(self):
+            return SimpleNamespace(type="embedding")
+
+    class Db:
+        def query(self, model):
+            return Query(model)
+
+    node = LLMNode(
+        "llm-1",
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+        ),
+    )
+    monkeypatch.setattr(
+        LLMService,
+        "get_client_for_user",
+        lambda *args, **kwargs: SimpleNamespace(embed_sync=lambda query: [0.1]),
+    )
+
+    with caplog.at_level(
+        logging.INFO,
+        logger="apps.workflow_engine.workflow.nodes.llm.llm_node",
+    ):
+        vectors, failed_count, precomputed = node._precompute_rag_query_vectors_by_kb(  # noqa: SLF001 - safe log contract
+            Db(),
+            query="query",
+            user_id=user_id,
+            organization_id=organization_id,
+            knowledge_base_ids=[str(kb_id) for kb_id in kb_ids],
+        )
+
+    assert set(vectors) == {str(kb_id) for kb_id in kb_ids}
+    assert failed_count == 0
+    assert precomputed is True
+    log_text = " ".join(caplog.messages)
+    assert "kb_count_bucket=2-10" in log_text
+    assert "model_count_bucket=1" in log_text
+    assert "vector_kb_count_bucket=2-10" in log_text
+    assert "failed_count_bucket=0" in log_text
+    assert "kb_count=3" not in log_text
+    assert "model_count=1" not in log_text
+    assert "vector_kb_count=3" not in log_text
+    assert "failed_count=0" not in log_text
+
+
 def test_llm_node_rag_single_kb_uses_bounded_pool(monkeypatch):
     node = LLMNode(
         "llm-1",
@@ -3211,19 +3321,6 @@ class FakeDb:
         def query(self, *args, **kwargs):
             return FakeQuery()
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def evaluate_kb_use(self, kb):
-            return SimpleNamespace(
-                allowed=True,
-                external_reason_code="allowed",
-                effective_auth_state="operator",
-            )
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
 
     class FakeRetrievalService:
         def __init__(self, db, user_id, organization_id=None):
@@ -3232,10 +3329,6 @@ def __init__(self, db, user_id, organization_id=None):
         def search_documents_sync(self, *args, **kwargs):
             raise RuntimeError("vector store unavailable")
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
     monkeypatch.setattr(
         "apps.workflow_engine.workflow.nodes.llm.llm_node.RetrievalService",
         FakeRetrievalService,
@@ -3758,697 +3851,452 @@ def test_workflow_llm_service_requires_runtime_organization_scope(organization_i
     assert exc.value.organization_id is None
 
 
-def test_knowledge_search_without_execution_subject_searches_public_collection_kbs(
+
+def test_runtime_candidate_resolver_receives_authenticated_mixed_request_and_orders_fanout(
     monkeypatch,
 ):
     user_id = uuid.uuid4()
     organization_id = uuid.uuid4()
-    public_kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            item = SimpleNamespace(knowledge_base_id=public_kb_id)
-            collection = SimpleNamespace(safe_metadata={"visibility": "public"})
-            kb = SimpleNamespace(id=public_kb_id)
-            return [(item, collection, kb)]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(public_kb_id), name="Public KB"),
-        ],
+    direct_kb_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    child_kb_a = uuid.uuid4()
+    child_kb_b = uuid.uuid4()
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(
+            eligible_direct_kb_ids=(direct_kb_id,),
+            collection_streams=(
+                KnowledgeCollectionCandidateStream(
+                    collection_id=collection_id,
+                    eligible_kb_ids=(child_kb_a, child_kb_b),
+                ),
+            ),
+        )
     )
+    captured_kb_ids = []
     node = LLMNode(
         "llm-1",
-        data,
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+            knowledgeBases=[
+                KnowledgeBaseRef(id=str(direct_kb_id), name="Direct"),
+            ],
+            knowledgeCollections=[
+                KnowledgeCollectionRef(
+                    id=str(collection_id),
+                    safeLabel="Collection",
+                ),
+            ],
+        ),
         execution_context={
             "user_id": str(user_id),
             "organization_id": str(organization_id),
+            "execution_subject": {
+                "subject_type": "user",
+                "subject_id": str(user_id),
+            },
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
+    monkeypatch.setattr(
+        node,
+        "_precompute_rag_query_vectors_by_kb",
+        lambda *args, **kwargs: ({}, 0, False),
+    )
+    monkeypatch.setattr(
+        node,
+        "_run_rag_retrieval_fanout",
+        lambda **kwargs: (
+            captured_kb_ids.extend(kwargs["knowledge_base_ids"])
+            or WorkflowRAGFanoutResult(results=[], failed_count=0)
+        ),
+    )
 
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(
-            results=[
-                (
-                    str(public_kb_id),
-                    [
-                        ChunkPreview(
-                            chunk_id=uuid.uuid4(),
-                            content="public policy",
-                            document_id=uuid.uuid4(),
-                            filename="public.md",
-                            similarity_score=0.9,
-                            score=0.9,
-                            metadata_summary={},
-                        )
-                    ],
-                )
-            ],
-            failed_count=0,
-        )
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-    monkeypatch.setattr(node, "_record_rag_retrieve_audit", lambda *args, **kwargs: None)
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
+    result = node._execute_knowledge_search("query", db_session=object())  # noqa: SLF001
 
-    assert captured_authorized_kbs == [str(public_kb_id)]
-    assert result.should_invoke_llm is True
-    assert "public policy" in result.context
+    assert len(resolver.calls) == 1
+    request = resolver.calls[0]
+    assert isinstance(request.audience, AuthenticatedAudience)
+    assert request.audience.organization_id == organization_id
+    assert request.audience.user_id == user_id
+    assert request.direct_kb_ids == (direct_kb_id,)
+    assert request.collection_ids == (collection_id,)
+    assert captured_kb_ids == [
+        str(direct_kb_id),
+        str(child_kb_a),
+        str(child_kb_b),
+    ]
+    assert result.trace_summary["routing_mode"] == "mixed"
 
 
-def test_knowledge_search_without_execution_subject_excludes_private_collection_kbs(
-    monkeypatch,
-):
+def test_collection_evidence_redacts_child_identity_and_aggregates_audit(monkeypatch):
     user_id = uuid.uuid4()
     organization_id = uuid.uuid4()
-    private_kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            item = SimpleNamespace(knowledge_base_id=private_kb_id)
-            collection = SimpleNamespace(safe_metadata={})
-            kb = SimpleNamespace(id=private_kb_id)
-            return [(item, collection, kb)]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(private_kb_id), name="Private KB"),
-        ],
+    direct_kb_id = uuid.uuid4()
+    direct_document_id = uuid.uuid4()
+    direct_chunk_id = uuid.uuid4()
+    collection_id = uuid.uuid4()
+    child_kb_id = uuid.uuid4()
+    child_kb_b_id = uuid.uuid4()
+    child_document_id = uuid.uuid4()
+    child_document_b_id = uuid.uuid4()
+    child_chunk_id = uuid.uuid4()
+    child_chunk_b_id = uuid.uuid4()
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(
+            eligible_direct_kb_ids=(direct_kb_id,),
+            collection_streams=(
+                KnowledgeCollectionCandidateStream(
+                    collection_id=collection_id,
+                    eligible_kb_ids=(child_kb_id, child_kb_b_id),
+                ),
+            ),
+        )
     )
     node = LLMNode(
         "llm-1",
-        data,
-        execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-        },
-    )
-
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(results=[], failed_count=0)
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert captured_authorized_kbs == []
-    assert result.should_invoke_llm is False
-    assert result.evidence_decision.insufficiency_reason == "no_evidence"
-
-
-def test_knowledge_search_without_execution_subject_excludes_source_managed_public_kbs(
-    monkeypatch,
-):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    source_managed_kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            item = SimpleNamespace(knowledge_base_id=source_managed_kb_id)
-            collection = SimpleNamespace(safe_metadata={"visibility": "public"})
-            kb = SimpleNamespace(
-                id=source_managed_kb_id,
-                source_identity_id=uuid.uuid4(),
-            )
-            return [(item, collection, kb)]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(source_managed_kb_id), name="Source KB"),
-        ],
-    )
-    node = LLMNode(
-        "llm-1",
-        data,
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+            knowledgeBases=[
+                KnowledgeBaseRef(id=str(direct_kb_id), name="Direct"),
+            ],
+            knowledgeCollections=[
+                KnowledgeCollectionRef(id=str(collection_id), safeLabel="Collection"),
+            ],
+        ),
         execution_context={
             "user_id": str(user_id),
             "organization_id": str(organization_id),
+            "workflow_id": str(uuid.uuid4()),
+            "workflow_run_id": str(uuid.uuid4()),
+            "execution_subject": {
+                "subject_type": "user",
+                "subject_id": str(user_id),
+            },
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
-
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(results=[], failed_count=0)
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert captured_authorized_kbs == []
-    assert result.should_invoke_llm is False
-    assert result.evidence_decision.insufficiency_reason == "no_evidence"
-
-
-def test_knowledge_search_requires_execution_subject_for_private_runtime_path():
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB"),
-        ],
+    direct_chunk = ChunkPreview(
+        chunk_id=direct_chunk_id,
+        content="direct evidence",
+        document_id=direct_document_id,
+        filename="direct.md",
+        similarity_score=0.96,
+        score=0.96,
+        rank=1,
+        metadata_summary={"classification": "internal"},
     )
-    node = LLMNode(
-        "llm-1",
-        data,
-        execution_context={"organization_id": str(uuid.uuid4())},
+    collection_chunk = ChunkPreview(
+        chunk_id=child_chunk_id,
+        content="collection evidence",
+        document_id=child_document_id,
+        filename="collection.md",
+        similarity_score=0.95,
+        score=0.95,
+        rank=1,
+        metadata_summary={"classification": "internal"},
     )
-
-    with pytest.raises(PermissionError, match="credential user"):
-        node._execute_knowledge_search("query", db_session=object())  # noqa: SLF001
-
-
-def test_knowledge_search_rejects_malformed_execution_subject():
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB"),
-        ],
+    collection_chunk_b = ChunkPreview(
+        chunk_id=child_chunk_b_id,
+        content="second collection evidence",
+        document_id=child_document_b_id,
+        filename="collection-b.md",
+        similarity_score=0.94,
+        score=0.94,
+        rank=1,
+        metadata_summary={"classification": "internal"},
     )
-    node = LLMNode(
-        "llm-1",
-        data,
-        execution_context={
-            "execution_subject": "not-a-subject-object",
-            "organization_id": str(uuid.uuid4()),
-        },
+    audit_calls = []
+    monkeypatch.setattr(
+        node,
+        "_precompute_rag_query_vectors_by_kb",
+        lambda *args, **kwargs: ({}, 0, False),
+    )
+    monkeypatch.setattr(
+        node,
+        "_run_rag_retrieval_fanout",
+        lambda **kwargs: WorkflowRAGFanoutResult(
+            results=[
+                (str(direct_kb_id), [direct_chunk]),
+                (str(child_kb_id), [collection_chunk]),
+                (str(child_kb_b_id), [collection_chunk_b]),
+            ],
+            failed_count=0,
+        ),
+    )
+    monkeypatch.setattr(
+        "apps.workflow_engine.workflow.nodes.llm.llm_node.record_audit",
+        lambda **kwargs: audit_calls.append(kwargs),
     )
 
-    with pytest.raises(PermissionError, match="execution subject"):
-        node._execute_knowledge_search("query", db_session=object())  # noqa: SLF001
-
+    result = node._execute_knowledge_search("query", db_session=object())  # noqa: SLF001
+    trace_payload = node._rag_retrieval_trace_payload(  # noqa: SLF001
+        result.metadata,
+        evidence_decision=result.evidence_decision,
+        runtime_summary=result.trace_summary,
+    )
 
-def test_knowledge_search_does_not_fallback_to_user_id_without_execution_subject():
-    user_id = uuid.uuid4()
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB"),
-        ],
+    direct_metadata = next(
+        item
+        for item in result.metadata
+        if item.get("knowledge_base_id") == str(direct_kb_id)
     )
-    node = LLMNode(
-        "llm-1",
-        data,
-        execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(uuid.uuid4()),
+    collection_metadata = [
+        item for item in result.metadata if "knowledge_base_id" not in item
+    ]
+    assert direct_metadata["document_id"] == str(direct_document_id)
+    assert direct_metadata["chunk_id"] == str(direct_chunk_id)
+    assert direct_metadata["rank"] == 1
+    assert direct_metadata["evidence_rank"] == 1
+    assert [item["evidence_rank"] for item in collection_metadata] == [2, 3]
+    assert all("document_id" not in item for item in collection_metadata)
+    assert all("chunk_id" not in item for item in collection_metadata)
+    assert all("parent_chunk_id" not in item for item in collection_metadata)
+    assert all("rank" not in item for item in collection_metadata)
+
+    direct_audit = next(
+        call for call in audit_calls if call["target_type"] == "knowledge_base"
+    )
+    collection_audit = next(
+        call for call in audit_calls if call["target_type"] == "workflow_node"
+    )
+    assert direct_audit["target_id"] == str(direct_kb_id)
+    assert collection_audit["target_id"] == "llm-1"
+    assert collection_audit["metadata"]["retrieval_mode"] == "collection"
+    assert collection_audit["metadata"]["candidate_count_bucket"] == "2-10"
+    assert collection_audit["metadata"]["result_count_bucket"] == "2-10"
+    assert "evidence_rank" not in collection_audit["metadata"]
+    assert "authorized_kb_count" not in trace_payload
+    assert "selected_kb_count" not in trace_payload
+    assert "fanout_concurrency" not in trace_payload
+    assert trace_payload["authorized_kb_count_bucket"] == "2-10"
+    assert trace_payload["selected_kb_count_bucket"] == "2-10"
+
+    durable_output = json.dumps(
+        {
+            "result_metadata": result.metadata,
+            "trace": trace_payload,
+            "audit": audit_calls,
         },
+        ensure_ascii=False,
+        default=str,
     )
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            item = SimpleNamespace(knowledge_base_id=uuid.uuid4())
-            collection = SimpleNamespace(safe_metadata={})
-            kb = SimpleNamespace(id=item.knowledge_base_id)
-            return [(item, collection, kb)]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert result.should_invoke_llm is False
-    assert result.evidence_decision.insufficiency_reason == "no_evidence"
+    assert str(collection_id) not in durable_output
+    assert str(child_kb_id) not in durable_output
+    assert str(child_document_id) not in durable_output
+    assert str(child_document_b_id) not in durable_output
+    assert str(child_chunk_id) not in durable_output
+    assert str(child_chunk_b_id) not in durable_output
+    assert str(child_kb_b_id) not in durable_output
+    assert str(direct_kb_id) in durable_output
 
 
-def test_knowledge_search_uses_execution_subject_for_acl_and_actor_for_retrieval(
+def test_llm_run_resolves_candidates_once_and_reuses_resolution_for_search(
     monkeypatch,
 ):
-    actor_user_id = uuid.uuid4()
-    execution_subject_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
     kb_id = uuid.uuid4()
-    authorization_calls = []
-    fanout_calls = []
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[KnowledgeBaseRef(id=str(kb_id), name="KB")],
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(
+            eligible_direct_kb_ids=(kb_id,),
+        )
     )
+    captured_resolutions = []
     node = LLMNode(
         "llm-1",
-        data,
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+            knowledgeBases=[KnowledgeBaseRef(id=str(kb_id), name="KB")],
+        ),
         execution_context={
-            "user_id": str(actor_user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(execution_subject_id),
-            },
+            "organization_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
+    client = DummyClient()
+    node._client_override = client  # noqa: SLF001
 
-    def fake_authorized_runtime_kb_ids(
+    def fake_search(
+        query,
         db_session,
         *,
-        user_id,
-        organization_id,
-        knowledge_base_ids,
+        candidate_resolution=None,
     ):
-        authorization_calls.append(
-            {
-                "user_id": user_id,
-                "organization_id": organization_id,
-                "knowledge_base_ids": knowledge_base_ids,
-            }
+        captured_resolutions.append(candidate_resolution)
+        return WorkflowRAGSearchResult(
+            context="",
+            metadata=[],
+            evidence_decision=RAGEvidenceDecision(
+                evidence_sufficient=False,
+                insufficiency_reason="no_evidence",
+            ),
+            should_invoke_llm=False,
+            answer_override=RAG_NO_EVIDENCE_MESSAGE,
         )
-        return [str(kb_id)]
 
-    def fake_fanout(**kwargs):
-        fanout_calls.append(kwargs)
-        return WorkflowRAGFanoutResult(results=[], failed_count=0, timeout_count=0)
+    monkeypatch.setattr(node, "_execute_knowledge_search", fake_search)
 
-    monkeypatch.setattr(
-        node,
-        "_authorized_runtime_kb_ids",
-        fake_authorized_runtime_kb_ids,
-    )
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-    monkeypatch.setattr(node, "_record_rag_retrieve_audit", lambda *args, **kwargs: None)
-
-    result = node._execute_knowledge_search("query", db_session=object())  # noqa: SLF001
+    result = node._run({})  # noqa: SLF001
 
-    assert authorization_calls[0]["user_id"] == execution_subject_id
-    assert fanout_calls[0]["user_id"] == actor_user_id
-    assert result.evidence_decision.insufficiency_reason == "no_evidence"
+    assert len(resolver.calls) == 1
+    assert len(captured_resolutions) == 1
+    assert captured_resolutions[0].candidates[0].knowledge_base_id == kb_id
+    assert client.calls == []
+    assert result["text"] == RAG_NO_EVIDENCE_MESSAGE
 
 
-def test_knowledge_search_filters_denied_kbs_before_retrieval(monkeypatch):
+def test_runtime_candidate_resolver_uses_anonymous_audience_without_explicit_subject():
     user_id = uuid.uuid4()
     organization_id = uuid.uuid4()
-    allowed_kb_id = uuid.uuid4()
-    denied_kb_id = uuid.uuid4()
-    fanout_calls = []
-    audit_calls = []
-    helper_init = {}
-
-    class FakeQuery:
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            return [
-                SimpleNamespace(id=allowed_kb_id),
-                SimpleNamespace(id=denied_kb_id),
-            ]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            helper_init["user_id"] = user_id
-            helper_init["organization_id"] = organization_id
-
-        def evaluate_kb_use(self, kb):
-            if kb.id == allowed_kb_id:
-                return SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="manager",
-                )
-            if kb.id == denied_kb_id:
-                return SimpleNamespace(
-                    allowed=False,
-                    external_reason_code="permission.denied",
-                    effective_auth_state="none",
-                )
-            raise AssertionError(f"unexpected kb: {kb.id}")
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
-
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.record_resource_permission_denied",
-        lambda **kwargs: audit_calls.append(kwargs),
-    )
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(allowed_kb_id), name="Allowed"),
-            KnowledgeBaseRef(id=str(denied_kb_id), name="Denied"),
-        ],
+    collection_id = uuid.uuid4()
+    child_kb_id = uuid.uuid4()
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(
+            collection_streams=(
+                KnowledgeCollectionCandidateStream(
+                    collection_id=collection_id,
+                    eligible_kb_ids=(child_kb_id,),
+                ),
+            ),
+        )
     )
     node = LLMNode(
         "llm-1",
-        data,
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+            knowledgeCollections=[
+                KnowledgeCollectionRef(id=str(collection_id), safeLabel="Public"),
+            ],
+        ),
         execution_context={
             "user_id": str(user_id),
             "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
-            "workflow_id": str(uuid.uuid4()),
-            "workflow_run_id": str(uuid.uuid4()),
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
 
-    monkeypatch.setattr(
-        node,
-        "_run_rag_retrieval_fanout",
-        lambda **kwargs: fanout_calls.append(kwargs["knowledge_base_ids"])
-        or WorkflowRAGFanoutResult(results=[], failed_count=0),
-    )
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
+    resolution = node._resolve_runtime_knowledge_candidates()  # noqa: SLF001
 
-    assert helper_init["organization_id"] == organization_id
-    assert helper_init["user_id"] == user_id
-    assert fanout_calls == [[str(allowed_kb_id)]]
-    assert result.answer_override == RAG_NO_EVIDENCE_MESSAGE
-    assert audit_calls[0]["resource_id"] == str(denied_kb_id)
-    assert audit_calls[0]["effective_auth_state"] == "none"
-    assert audit_calls[0]["organization_id"] == organization_id
+    assert len(resolver.calls) == 1
+    assert isinstance(resolver.calls[0].audience, AnonymousPublicAudience)
+    assert resolver.calls[0].audience.organization_id == organization_id
+    assert [candidate.knowledge_base_id for candidate in resolution.candidates] == [
+        child_kb_id
+    ]
 
 
-def test_knowledge_search_continues_with_allowed_evidence_when_selected_kb_denied(
+def test_collection_only_zero_candidates_skips_retrieval_embedding_and_provider(
     monkeypatch,
 ):
-    user_id = uuid.uuid4()
-    credential_principal_id = uuid.uuid4()
     organization_id = uuid.uuid4()
-    allowed_kb_id = uuid.uuid4()
-    denied_kb_id = uuid.uuid4()
-    fanout_calls = []
-    denied_audit_calls = []
-    retrieve_audit_calls = []
-
-    class FakeQuery:
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            return [
-                SimpleNamespace(id=allowed_kb_id),
-                SimpleNamespace(id=denied_kb_id),
-            ]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def evaluate_kb_use(self, kb):
-            if kb.id == allowed_kb_id:
-                return SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="manager",
-                )
-            if kb.id == denied_kb_id:
-                return SimpleNamespace(
-                    allowed=False,
-                    external_reason_code="permission.denied",
-                    effective_auth_state="none",
-                )
-            raise AssertionError(f"unexpected kb: {kb.id}")
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {kb.id: self.evaluate_kb_use(kb) for kb in kbs}
-
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.record_resource_permission_denied",
-        lambda **kwargs: denied_audit_calls.append(kwargs),
-    )
-
-    data = LLMNodeData(
-        title="LLM",
-        provider="openai",
-        model_id="gpt-4o",
-        user_prompt="user",
-        knowledgeBases=[
-            KnowledgeBaseRef(id=str(allowed_kb_id), name="Allowed"),
-            KnowledgeBaseRef(id=str(denied_kb_id), name="Denied"),
-        ],
+    collection_id = uuid.uuid4()
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(policy_excluded_count=2)
     )
+    client = DummyClient()
     node = LLMNode(
         "llm-1",
-        data,
+        LLMNodeData(
+            title="LLM",
+            provider="openai",
+            model_id="gpt-4o",
+            user_prompt="query",
+            knowledgeCollections=[
+                KnowledgeCollectionRef(
+                    id=str(collection_id),
+                    safeLabel="Hidden label",
+                ),
+            ],
+        ),
         execution_context={
-            "user_id": str(user_id),
             "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
-            "credential_principal": {
-                "subject_type": "user",
-                "subject_id": str(credential_principal_id),
-            },
-            "workflow_id": str(uuid.uuid4()),
-            "workflow_run_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
-
-    def fake_fanout(**kwargs):
-        fanout_calls.append(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(
-            results=[
-                (
-                    str(allowed_kb_id),
-                    [
-                        _chunk_preview(
-                            "개발자 커밋 컨벤션은 feat/fix/docs 타입을 사용합니다.",
-                            filename="commit-convention.md",
-                        )
-                    ],
-                )
-            ],
-            failed_count=0,
-        )
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
+    node._client_override = client  # noqa: SLF001
     monkeypatch.setattr(
         node,
-        "_record_rag_retrieve_audit",
-        lambda *args, **kwargs: retrieve_audit_calls.append(args),
+        "_precompute_rag_query_vectors_by_kb",
+        lambda *args, **kwargs: pytest.fail("embedding must not run"),
+    )
+    monkeypatch.setattr(
+        node,
+        "_run_rag_retrieval_fanout",
+        lambda **kwargs: pytest.fail("retrieval must not run"),
     )
 
-    result = node._execute_knowledge_search("commit convention", db_session=FakeDb())  # noqa: SLF001
-
-    assert fanout_calls == [[str(allowed_kb_id)]]
-    assert denied_audit_calls[0]["resource_id"] == str(denied_kb_id)
-    assert result.should_invoke_llm is True
-    assert result.answer_override is None
-    assert "커밋 컨벤션" in result.context
-    assert result.trace_summary["authorized_kb_count"] == 1
-    assert result.trace_summary["selected_kb_count"] == 1
-    assert result.metadata[0]["knowledge_base_id"] == str(allowed_kb_id)
-    assert retrieve_audit_calls[0][0] == user_id
-    assert retrieve_audit_calls[0][0] != credential_principal_id
-    assert retrieve_audit_calls[0][1] == str(allowed_kb_id)
-
-
-def test_knowledge_search_fails_closed_when_runtime_permission_revoked(monkeypatch):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    kb_id = uuid.uuid4()
-    retrieval_calls = []
-    audit_calls = []
-
-    class FakeQuery:
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            return [SimpleNamespace(id=kb_id)]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
-
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=False,
-                    external_reason_code="source.revoked",
-                    effective_auth_state="revoked",
-                )
-                for kb in kbs
-            }
+    result = node._run({})  # noqa: SLF001
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
+    assert len(resolver.calls) == 1
+    assert client.calls == []
+    assert result["text"] == RAG_NO_EVIDENCE_MESSAGE
+    assert result["cost"] == 0.0
+    assert result["metadata"]["rag"]["candidate_resolution_status"] == (
+        "safe_no_result"
     )
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.record_resource_permission_denied",
-        lambda **kwargs: audit_calls.append(kwargs),
+    safe_output = json.dumps(
+        {
+            "result": result,
+            "trace": node._trace_payloads,  # noqa: SLF001
+        },
+        ensure_ascii=False,
+        default=str,
     )
+    assert str(collection_id) not in safe_output
+    assert "Hidden label" not in safe_output
+
+
+def test_zero_candidates_fail_node_is_fixed_non_retryable_failure():
+    resolver = CapturingRuntimeCandidateResolver()
     node = LLMNode(
         "llm-1",
         LLMNodeData(
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
-            knowledgeBases=[KnowledgeBaseRef(id=str(kb_id), name="KB")],
+            user_prompt="query",
+            ragFailurePolicy="fail_node",
+            knowledgeCollections=[
+                KnowledgeCollectionRef(id=str(uuid.uuid4()), safeLabel="Collection"),
+            ],
         ),
         execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
-        },
-    )
-    monkeypatch.setattr(
-        node,
-        "_run_rag_retrieval_fanout",
-        lambda **kwargs: retrieval_calls.append(kwargs["knowledge_base_ids"])
-        or WorkflowRAGFanoutResult(results=[], failed_count=0),
-    )
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert retrieval_calls == [[]]
-    assert result.should_invoke_llm is False
-    assert result.answer_override == RAG_NO_EVIDENCE_MESSAGE
-    assert audit_calls[0]["resource_id"] == str(kb_id)
-    assert audit_calls[0]["effective_auth_state"] == "revoked"
-    assert audit_calls[0]["organization_id"] == organization_id
-
-
-@pytest.mark.parametrize(
-    ("external_reason_code", "effective_auth_state"),
-    [
-        ("source.stale", "stale"),
-        ("source.unmapped", "unmapped"),
-        ("source.ambiguous", "ambiguous"),
-        ("source.unverified", "unverified"),
-    ],
-)
-def test_knowledge_search_fails_closed_for_unfresh_source_acl_states(
-    monkeypatch,
-    external_reason_code,
-    effective_auth_state,
-):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    kb_id = uuid.uuid4()
-    retrieval_calls = []
-    audit_calls = []
-
-    class FakeQuery:
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            return [SimpleNamespace(id=kb_id)]
+            "organization_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": resolver,
+        },
+    )
+    client = DummyClient()
+    node._client_override = client  # noqa: SLF001
 
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
+    with pytest.raises(
+        NonRetryableWorkflowError,
+        match=r"knowledge_candidates\.safe_no_result",
+    ):
+        node._run({})  # noqa: SLF001
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
+    assert len(resolver.calls) == 1
+    assert client.calls == []
 
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=False,
-                    external_reason_code=external_reason_code,
-                    effective_auth_state=effective_auth_state,
-                )
-                for kb in kbs
-            }
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
-    )
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.record_resource_permission_denied",
-        lambda **kwargs: audit_calls.append(kwargs),
+def test_empty_rendered_rag_query_never_invokes_provider():
+    kb_id = uuid.uuid4()
+    resolver = CapturingRuntimeCandidateResolver(
+        KnowledgeRuntimeCandidateSnapshot(
+            eligible_direct_kb_ids=(kb_id,),
+        )
     )
     node = LLMNode(
         "llm-1",
@@ -4456,82 +4304,29 @@ def bulk_evaluate_kb_use(self, kbs):
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
+            system_prompt="system",
+            user_prompt="{{ missing_query }}",
             knowledgeBases=[KnowledgeBaseRef(id=str(kb_id), name="KB")],
         ),
         execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
+            "organization_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
-    monkeypatch.setattr(
-        node,
-        "_run_rag_retrieval_fanout",
-        lambda **kwargs: retrieval_calls.append(kwargs["knowledge_base_ids"])
-        or WorkflowRAGFanoutResult(results=[], failed_count=0),
-    )
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert retrieval_calls == [[]]
-    assert result.should_invoke_llm is False
-    assert result.answer_override == RAG_NO_EVIDENCE_MESSAGE
-    assert audit_calls[0]["resource_id"] == str(kb_id)
-    assert audit_calls[0]["effective_auth_state"] == effective_auth_state
-    assert audit_calls[0]["organization_id"] == organization_id
-
-
-def test_knowledge_search_excludes_inactive_kbs_before_permission_check(monkeypatch):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    archived_kb_id = uuid.uuid4()
-    retrieval_calls = []
-
-    class FakeQuery:
-        def __init__(self):
-            self.filter_texts = []
-
-        def filter(self, *args, **kwargs):
-            self.filter_texts.extend(str(arg) for arg in args)
-            return self
-
-        def all(self):
-            has_active_filter = any(
-                "knowledge_bases.lifecycle_state" in filter_text
-                for filter_text in self.filter_texts
-            )
-            if has_active_filter:
-                return []
-            return [SimpleNamespace(id=archived_kb_id, lifecycle_state="archived")]
-
-    class FakeDb:
-        def __init__(self):
-            self.query_obj = FakeQuery()
+    client = DummyClient()
+    node._client_override = client  # noqa: SLF001
 
-        def query(self, *args, **kwargs):
-            return self.query_obj
+    result = node._run({})  # noqa: SLF001
 
-    class FakeKnowledgePermissionHelper:
-        def __init__(self, db, *, user_id, organization_id):
-            pass
+    assert len(resolver.calls) == 1
+    assert client.calls == []
+    assert result["text"] == RAG_NO_EVIDENCE_MESSAGE
 
-        def bulk_evaluate_kb_use(self, kbs):
-            return {
-                kb.id: SimpleNamespace(
-                    allowed=True,
-                    external_reason_code="allowed",
-                    effective_auth_state="manager",
-                )
-                for kb in kbs
-            }
 
-    monkeypatch.setattr(
-        "apps.workflow_engine.workflow.nodes.llm.llm_node.KnowledgePermissionHelper",
-        FakeKnowledgePermissionHelper,
+def test_runtime_candidate_infrastructure_error_bypasses_rag_failure_policy():
+    resolver = CapturingRuntimeCandidateResolver(
+        error=KnowledgeRuntimeCandidateInfrastructureError()
     )
     node = LLMNode(
         "llm-1",
@@ -4539,41 +4334,34 @@ def bulk_evaluate_kb_use(self, kbs):
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
-            knowledgeBases=[KnowledgeBaseRef(id=str(archived_kb_id), name="KB")],
+            user_prompt="query",
+            ragFailurePolicy="safe_no_result",
+            knowledgeBases=[
+                KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB"),
+            ],
         ),
         execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
+            "organization_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
-    monkeypatch.setattr(
-        node,
-        "_run_rag_retrieval_fanout",
-        lambda **kwargs: retrieval_calls.append(kwargs["knowledge_base_ids"])
-        or WorkflowRAGFanoutResult(results=[], failed_count=0),
-    )
-    db = FakeDb()
+    node._client_override = DummyClient()  # noqa: SLF001
 
-    result = node._execute_knowledge_search("query", db_session=db)  # noqa: SLF001
+    with pytest.raises(
+        KnowledgeRuntimeCandidateInfrastructureError,
+        match="knowledge_candidate_resolver_unavailable",
+    ):
+        node._run({})  # noqa: SLF001
 
-    assert any(
-        "knowledge_bases.lifecycle_state" in filter_text
-        for filter_text in db.query_obj.filter_texts
-    )
-    assert retrieval_calls == [[]]
-    assert result.should_invoke_llm is False
-    assert result.answer_override == RAG_NO_EVIDENCE_MESSAGE
+    assert len(resolver.calls) == 1
+    assert resolver.calls[0].audience.kind == "anonymous_public"
 
 
-def test_knowledge_search_rejects_invalid_kb_id_before_retrieval():
-    class ExplodingDb:
-        def query(self, *args, **kwargs):  # pragma: no cover - fail-fast guard
-            raise AssertionError("database should not be queried for invalid KB IDs")
+def test_untyped_resolver_failure_is_sanitized_as_retryable_infrastructure():
+    class ExplodingResolver:
+        def resolve(self, request):
+            raise ValueError("raw database detail must not escape")
 
     node = LLMNode(
         "llm-1",
@@ -4581,130 +4369,111 @@ def query(self, *args, **kwargs):  # pragma: no cover - fail-fast guard
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
-            knowledgeBases=[KnowledgeBaseRef(id="not-a-uuid", name="Invalid")],
+            user_prompt="query",
+            knowledgeBases=[KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB")],
         ),
         execution_context={
-            "user_id": str(uuid.uuid4()),
             "organization_id": str(uuid.uuid4()),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(uuid.uuid4()),
-            },
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": ExplodingResolver(),
         },
     )
+    node._client_override = DummyClient()  # noqa: SLF001
 
-    with pytest.raises(PermissionError, match="Knowledge Base is unavailable"):
-        node._execute_knowledge_search("query", db_session=ExplodingDb())  # noqa: SLF001
+    with pytest.raises(KnowledgeRuntimeCandidateInfrastructureError) as error:
+        node._run({})  # noqa: SLF001
 
+    assert str(error.value) == "knowledge_candidate_resolver_unavailable"
+    assert "database" not in str(error.value)
 
-def test_knowledge_search_deduplicates_selected_kb_ids_before_fanout(monkeypatch):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-    fake_db = _patch_allowed_knowledge_permissions(monkeypatch, [kb_id])
 
+def test_malformed_resolver_result_fails_before_retrieval_or_provider():
+    selected_kb_id = uuid.uuid4()
+    unrelated_kb_id = uuid.uuid4()
+
+    class MalformedResolver:
+        def resolve(self, request):
+            return KnowledgeRuntimeCandidateResolution(
+                status="resolved",
+                candidates=(
+                    KnowledgeRuntimeCandidate(
+                        knowledge_base_id=unrelated_kb_id,
+                        provenance=KnowledgeRuntimeCandidateProvenance(
+                            kind="direct"
+                        ),
+                    ),
+                ),
+                routing_mode="direct",
+                configured_direct_count_bucket="1",
+                configured_collection_count_bucket="0",
+                eligible_candidate_count_bucket="1",
+                selected_candidate_count_bucket="1",
+                policy_excluded_count_bucket="0",
+                budget_limited=False,
+                scan_limited=False,
+                warning_codes=(),
+                reason_code=None,
+            )
+
+    client = DummyClient()
     node = LLMNode(
         "llm-1",
         LLMNodeData(
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
+            user_prompt="query",
             knowledgeBases=[
-                KnowledgeBaseRef(id=str(kb_id), name="KB"),
-                KnowledgeBaseRef(id=str(kb_id), name="KB duplicate"),
+                KnowledgeBaseRef(id=str(selected_kb_id), name="Selected"),
             ],
         ),
         execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
+            "organization_id": str(uuid.uuid4()),
+            "db": object(),
+            "knowledge_runtime_candidate_resolver": MalformedResolver(),
         },
     )
+    node._client_override = client  # noqa: SLF001
 
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(results=[], failed_count=0)
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-
-    result = node._execute_knowledge_search("query", db_session=fake_db)  # noqa: SLF001
-
-    assert captured_authorized_kbs == [str(kb_id)]
-    assert result.should_invoke_llm is False
-
-
-def test_knowledge_search_without_subject_excludes_source_managed_public_kb(
-    monkeypatch,
-):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    source_managed_kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
+    with pytest.raises(
+        NonRetryableWorkflowError,
+        match="knowledge_runtime_candidate_resolution_invalid",
+    ):
+        node._run({})  # noqa: SLF001
 
-        def all(self):
-            item = SimpleNamespace(knowledge_base_id=source_managed_kb_id)
-            collection = SimpleNamespace(safe_metadata={"visibility": "public"})
-            kb = SimpleNamespace(
-                id=source_managed_kb_id,
-                source_identity_id=uuid.uuid4(),
-            )
-            return [(item, collection, kb)]
+    assert client.calls == []
 
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
 
+def test_runtime_candidate_rejects_malformed_explicit_execution_subject():
+    resolver = CapturingRuntimeCandidateResolver()
     node = LLMNode(
         "llm-1",
         LLMNodeData(
             title="LLM",
             provider="openai",
             model_id="gpt-4o",
-            user_prompt="user",
+            user_prompt="query",
             knowledgeBases=[
-                KnowledgeBaseRef(id=str(source_managed_kb_id), name="Source KB")
+                KnowledgeBaseRef(id=str(uuid.uuid4()), name="KB"),
             ],
         ),
         execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
+            "organization_id": str(uuid.uuid4()),
+            "execution_subject": {
+                "subject_type": "service_account",
+                "subject_id": str(uuid.uuid4()),
+            },
+            "knowledge_runtime_candidate_resolver": resolver,
         },
     )
 
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        if not kwargs["knowledge_base_ids"]:
-            return WorkflowRAGFanoutResult(results=[], failed_count=0)
-        return WorkflowRAGFanoutResult(
-            results=[
-                (
-                    str(source_managed_kb_id),
-                    [_chunk_preview("source managed public content")],
-                )
-            ],
-            failed_count=0,
-        )
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
+    with pytest.raises(
+        NonRetryableWorkflowError,
+        match="knowledge_runtime_audience_invalid",
+    ):
+        node._resolve_runtime_knowledge_candidates()  # noqa: SLF001
 
-    assert captured_authorized_kbs == []
-    assert result.should_invoke_llm is False
-    assert result.evidence_decision.insufficiency_reason == "no_evidence"
+    assert resolver.calls == []
 
 
 def test_workflow_llm_node_applies_selected_kb_chunks_to_llm_prompt(monkeypatch):
@@ -5331,88 +5100,6 @@ def search_documents_sync(self, *args, **kwargs):
     assert "첫 번째 LLM 전용 근거" not in second_prompt
 
 
-@pytest.mark.parametrize("trigger_mode", ["schedule", "webhook", "api_secret"])
-def test_non_interactive_rag_without_subject_uses_public_only_candidates(
-    monkeypatch,
-    trigger_mode,
-):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    public_kb_id = uuid.uuid4()
-    private_kb_id = uuid.uuid4()
-    source_managed_kb_id = uuid.uuid4()
-    captured_authorized_kbs = []
-
-    class FakeQuery:
-        def join(self, *args, **kwargs):
-            return self
-
-        def filter(self, *args, **kwargs):
-            return self
-
-        def all(self):
-            return [
-                (
-                    SimpleNamespace(knowledge_base_id=public_kb_id),
-                    SimpleNamespace(safe_metadata={"visibility": "public"}),
-                    SimpleNamespace(id=public_kb_id, source_identity_id=None),
-                ),
-                (
-                    SimpleNamespace(knowledge_base_id=private_kb_id),
-                    SimpleNamespace(safe_metadata={}),
-                    SimpleNamespace(id=private_kb_id, source_identity_id=None),
-                ),
-                (
-                    SimpleNamespace(knowledge_base_id=source_managed_kb_id),
-                    SimpleNamespace(safe_metadata={"visibility": "public"}),
-                    SimpleNamespace(
-                        id=source_managed_kb_id,
-                        source_identity_id=uuid.uuid4(),
-                    ),
-                ),
-            ]
-
-    class FakeDb:
-        def query(self, *args, **kwargs):
-            return FakeQuery()
-
-    node = LLMNode(
-        "llm-1",
-        LLMNodeData(
-            title="LLM",
-            provider="openai",
-            model_id="gpt-4o",
-            user_prompt="query",
-            knowledgeBases=[
-                KnowledgeBaseRef(id=str(public_kb_id), name="Public"),
-                KnowledgeBaseRef(id=str(private_kb_id), name="Private"),
-                KnowledgeBaseRef(id=str(source_managed_kb_id), name="Source"),
-            ],
-        ),
-        execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "trigger_mode": trigger_mode,
-        },
-    )
-
-    def fake_fanout(**kwargs):
-        captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-        return WorkflowRAGFanoutResult(
-            results=[(str(public_kb_id), [_chunk_preview("공개 근거")])],
-            failed_count=0,
-        )
-
-    monkeypatch.setattr(node, "_run_rag_retrieval_fanout", fake_fanout)
-    monkeypatch.setattr(node, "_record_rag_retrieve_audit", lambda *args, **kwargs: None)
-
-    result = node._execute_knowledge_search("query", db_session=FakeDb())  # noqa: SLF001
-
-    assert captured_authorized_kbs == [str(public_kb_id)]
-    assert "공개 근거" in result.context
-    assert result.should_invoke_llm is True
-
-
 @pytest.mark.parametrize(
     "exception",
     [
@@ -5527,54 +5214,6 @@ def test_knowledge_search_partial_timeout_trace_summary_is_safe(monkeypatch):
     assert "Timeout" not in str(result.trace_summary)
 
 
-def test_knowledge_search_caps_kbs_after_deduping_and_preserves_order(monkeypatch):
-    user_id = uuid.uuid4()
-    organization_id = uuid.uuid4()
-    kb_ids = [uuid.uuid4() for _ in range(MAX_RAG_RETRIEVAL_KBS + 3)]
-    captured_authorized_kbs = []
-    fake_db = _patch_allowed_knowledge_permissions(monkeypatch, kb_ids)
-
-    node = LLMNode(
-        "llm-1",
-        LLMNodeData(
-            title="LLM",
-            provider="openai",
-            model_id="gpt-4o",
-            user_prompt="query",
-            knowledgeBases=[
-                KnowledgeBaseRef(id=str(kb_ids[0]), name="Duplicate"),
-                *[
-                    KnowledgeBaseRef(id=str(kb_id), name=f"KB {index}")
-                    for index, kb_id in enumerate(kb_ids)
-                ],
-            ],
-        ),
-        execution_context={
-            "user_id": str(user_id),
-            "organization_id": str(organization_id),
-            "execution_subject": {
-                "subject_type": "user",
-                "subject_id": str(user_id),
-            },
-        },
-    )
-    monkeypatch.setattr(
-        node,
-        "_run_rag_retrieval_fanout",
-        lambda **kwargs: (
-            captured_authorized_kbs.extend(kwargs["knowledge_base_ids"])
-            or WorkflowRAGFanoutResult(results=[], failed_count=0)
-        ),
-    )
-
-    result = node._execute_knowledge_search("query", db_session=fake_db)  # noqa: SLF001
-
-    assert captured_authorized_kbs == [
-        str(kb_id) for kb_id in kb_ids[:MAX_RAG_RETRIEVAL_KBS]
-    ]
-    assert result.should_invoke_llm is False
-
-
 def test_workflow_llm_node_ignores_stale_kb_display_name_at_runtime(monkeypatch):
     user_id = uuid.uuid4()
     organization_id = uuid.uuid4()
@@ -5706,6 +5345,8 @@ def search_documents_sync(self, *args, **kwargs):
     assert context.count("중복 근거입니다.") == 1
     assert "고유 근거입니다." in context
     assert len(metadata) == 2
+    assert [item["rank"] for item in metadata] == [1, 3]
+    assert [item["evidence_rank"] for item in metadata] == [1, 2]
 
 
 def test_knowledge_search_limits_retrieved_context_chars(monkeypatch):
diff --git a/apps/workflow_engine/tests/services/test_model_router.py b/apps/workflow_engine/tests/services/test_model_router.py
index ead842f68..c2ae26f31 100644
--- a/apps/workflow_engine/tests/services/test_model_router.py
+++ b/apps/workflow_engine/tests/services/test_model_router.py
@@ -1000,3 +1000,22 @@ def test_runtime_context_does_not_classify_domain_keywords_by_itself():
     assert context.schema_required is True
     assert context.output_format == "json"
     assert "keywords" not in context.as_metadata()
+
+
+def test_runtime_context_treats_collection_only_node_as_knowledge_enabled():
+    context = ModelRouter.infer_runtime_context(
+        {"message": "사내 문서를 확인해 주세요."},
+        SimpleNamespace(
+            model_id="gpt-4.1-mini",
+            fallback_model_id=None,
+            knowledgeBases=[],
+            knowledgeCollections=[{"id": str(uuid4())}],
+            output_format={"type": "text"},
+            system_prompt="",
+            user_prompt="",
+            assistant_prompt="",
+            task_type="generate",
+        ),
+    )
+
+    assert context.knowledge_enabled is True
diff --git a/apps/workflow_engine/tests/services/test_model_routing_policy_refresh_task.py b/apps/workflow_engine/tests/services/test_model_routing_policy_refresh_task.py
index f4afd05a0..e023b7bae 100644
--- a/apps/workflow_engine/tests/services/test_model_routing_policy_refresh_task.py
+++ b/apps/workflow_engine/tests/services/test_model_routing_policy_refresh_task.py
@@ -146,3 +146,19 @@ def test_persisted_refresh_prefers_current_model_for_judge_when_available():
         )
         == "gpt-4.1"
     )
+
+
+def test_safe_node_summary_treats_collection_only_node_as_knowledge_enabled():
+    from apps.workflow_engine.services.model_routing_policy_refresh_task import (
+        PersistedModelRoutingPolicyRefreshService,
+    )
+
+    summary = PersistedModelRoutingPolicyRefreshService._safe_node_summary(
+        {
+            "knowledgeBases": [],
+            "knowledgeCollections": [{"id": str(uuid4())}],
+            "output_format": {"type": "text"},
+        }
+    )
+
+    assert summary["knowledge_enabled"] is True
diff --git a/apps/workflow_engine/tests/test_knowledge_runtime_candidate_composition.py b/apps/workflow_engine/tests/test_knowledge_runtime_candidate_composition.py
index f961f5dc1..ac618eae8 100644
--- a/apps/workflow_engine/tests/test_knowledge_runtime_candidate_composition.py
+++ b/apps/workflow_engine/tests/test_knowledge_runtime_candidate_composition.py
@@ -1,4 +1,5 @@
 import ast
+import uuid
 from pathlib import Path
 
 from apps.workflow_engine.adapters.knowledge_runtime_candidates import (
@@ -10,6 +11,10 @@
 from apps.workflow_engine.composition.runtime_retrieval import (
     build_knowledge_runtime_candidate_resolver,
 )
+from apps.workflow_engine.workflow.core.runtime_dependencies import (
+    WorkflowRuntimeDependencies,
+)
+from apps.workflow_engine.workflow.core.workflow_engine import WorkflowEngine
 
 
 def test_composition_builds_runtime_resolver_without_opening_session():
@@ -32,6 +37,64 @@ def session_factory():
     assert calls == []
 
 
+def test_engine_injects_resolver_only_into_knowledge_llm_node():
+    class FakeResolver:
+        def resolve(self, request):  # pragma: no cover - binding-only test
+            raise AssertionError("resolver must not run during composition")
+
+    resolver = FakeResolver()
+    collection_id = uuid.uuid4()
+    engine = WorkflowEngine(
+        graph={
+            "nodes": [
+                {
+                    "id": "start-1",
+                    "type": "startNode",
+                    "position": {"x": 0, "y": 0},
+                    "data": {"title": "Start"},
+                },
+                {
+                    "id": "llm-1",
+                    "type": "llmNode",
+                    "position": {"x": 200, "y": 0},
+                    "data": {
+                        "title": "LLM",
+                        "provider": "openai",
+                        "model_id": "gpt-4o",
+                        "user_prompt": "query",
+                        "knowledgeCollections": [
+                            {
+                                "id": str(collection_id),
+                                "safeLabel": "Collection",
+                            }
+                        ],
+                    },
+                },
+            ],
+            "edges": [
+                {
+                    "id": "edge-1",
+                    "source": "start-1",
+                    "target": "llm-1",
+                }
+            ],
+        },
+        runtime_dependencies=WorkflowRuntimeDependencies(
+            knowledge_runtime_candidate_resolver=resolver,
+        ),
+    )
+
+    assert (
+        engine.node_instances["llm-1"]._knowledge_runtime_candidate_resolver
+        is resolver
+    )
+    assert not hasattr(
+        engine.node_instances["start-1"],
+        "_knowledge_runtime_candidate_resolver",
+    )
+    assert "knowledge_runtime_candidate_resolver" not in engine.execution_context
+
+
 def _imported_modules(path: Path) -> set[str]:
     tree = ast.parse(path.read_text(encoding="utf-8"))
     modules = set()
@@ -60,6 +123,23 @@ def test_runtime_candidate_layers_never_import_gateway():
         ), path
 
 
+def test_llm_runtime_does_not_restore_gateway_or_legacy_authorization_imports():
+    root = Path(__file__).resolve().parents[3]
+    llm_node_path = (
+        root / "apps/workflow_engine/workflow/nodes/llm/llm_node.py"
+    )
+    imported_modules = _imported_modules(llm_node_path)
+    source = llm_node_path.read_text(encoding="utf-8")
+
+    assert not any(
+        module == "apps.gateway" or module.startswith("apps.gateway.")
+        for module in imported_modules
+    )
+    assert "KnowledgePermissionHelper" not in source
+    assert "KnowledgeCollectionItem" not in source
+    assert "KnowledgeCollection," not in source
+
+
 def test_pure_candidate_policy_has_no_framework_or_runtime_imports():
     root = Path(__file__).resolve().parents[3]
     policy_path = root / "apps/shared/domain/knowledge_runtime_candidates.py"
diff --git a/apps/workflow_engine/workflow/core/runtime_dependencies.py b/apps/workflow_engine/workflow/core/runtime_dependencies.py
new file mode 100644
index 000000000..a1aa9bcd2
--- /dev/null
+++ b/apps/workflow_engine/workflow/core/runtime_dependencies.py
@@ -0,0 +1,21 @@
+"""In-memory dependencies composed for one Workflow Engine instance."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from apps.workflow_engine.application.runtime_retrieval.knowledge_candidates import (
+    KnowledgeRuntimeCandidateResolver,
+)
+
+
+@dataclass(frozen=True, slots=True)
+class WorkflowRuntimeDependencies:
+    """Dependencies that must never be copied into a queued execution context."""
+
+    knowledge_runtime_candidate_resolver: KnowledgeRuntimeCandidateResolver | None = (
+        None
+    )
+
+
+__all__ = ["WorkflowRuntimeDependencies"]
diff --git a/apps/workflow_engine/workflow/core/workflow_engine.py b/apps/workflow_engine/workflow/core/workflow_engine.py
index 63edb2558..ac8cc3cfc 100644
--- a/apps/workflow_engine/workflow/core/workflow_engine.py
+++ b/apps/workflow_engine/workflow/core/workflow_engine.py
@@ -43,6 +43,9 @@
 )
 from apps.workflow_engine.workflow.core.workflow_logger import WorkflowLogger
 from apps.workflow_engine.workflow.core.workflow_node_factory import NodeFactory
+from apps.workflow_engine.workflow.core.runtime_dependencies import (
+    WorkflowRuntimeDependencies,
+)
 from apps.workflow_engine.workflow.errors import (
     NonRetryableWorkflowError,
     WorkflowNodeConfigurationError,
@@ -71,6 +74,7 @@ def __init__(
         workflow_node_bindings: tuple[WorkflowNodeBinding, ...] | None = None,
         binding_container_path: tuple[tuple[str, str], ...] = (),
         task_deadline: float | None = None,
+        runtime_dependencies: WorkflowRuntimeDependencies | None = None,
     ):
         """
         WorkflowEngine 초기화
@@ -143,6 +147,32 @@ def __init__(
         self.execution_context.pop("db", None)
         if "db_session_factory" not in self.execution_context:
             self.execution_context["db_session_factory"] = self._default_session_factory
+        knowledge_enabled = any(
+            schema.type == "llmNode"
+            and bool(
+                (schema.data or {}).get("knowledgeBases")
+                or (schema.data or {}).get("knowledgeCollections")
+            )
+            for schema in self.node_schemas.values()
+        )
+        self.runtime_dependencies = (
+            runtime_dependencies or WorkflowRuntimeDependencies()
+        )
+        if (
+            knowledge_enabled
+            and self.runtime_dependencies.knowledge_runtime_candidate_resolver is None
+        ):
+            from apps.workflow_engine.composition.runtime_retrieval import (
+                build_knowledge_runtime_candidate_resolver,
+            )
+
+            self.runtime_dependencies = WorkflowRuntimeDependencies(
+                knowledge_runtime_candidate_resolver=(
+                    build_knowledge_runtime_candidate_resolver(
+                        session_factory=self.execution_context["db_session_factory"]
+                    )
+                )
+            )
 
         # [PERF] 그래프 구조 사전 계산
         self.adjacency_list = {}
@@ -213,6 +243,7 @@ def cleanup(self):
         self._node_submit_ordinals.clear()
         self._external_effect_sensitive_node_ids.clear()
         self.workflow_node_bindings = ()
+        self.runtime_dependencies = WorkflowRuntimeDependencies()
 
     def execute(self) -> Dict[str, Any]:
         """
@@ -1279,7 +1310,9 @@ def _build_node_instances(self):
 
             try:
                 self.node_instances[node_id] = NodeFactory.create(
-                    schema, context=self.execution_context
+                    schema,
+                    context=self.execution_context,
+                    runtime_dependencies=self.runtime_dependencies,
                 )
             except NotImplementedError as e:
                 raise NotImplementedError(
diff --git a/apps/workflow_engine/workflow/core/workflow_node_factory.py b/apps/workflow_engine/workflow/core/workflow_node_factory.py
index a3288e333..242607d86 100644
--- a/apps/workflow_engine/workflow/core/workflow_node_factory.py
+++ b/apps/workflow_engine/workflow/core/workflow_node_factory.py
@@ -1,6 +1,10 @@
 from typing import Dict
 
 from apps.shared.schemas.workflow import NodeSchema
+from apps.shared.domain.workflow_knowledge_references import (
+    WorkflowKnowledgeReferenceError,
+    parse_llm_knowledge_references,
+)
 from apps.shared.domain.mail_credential import (
     validate_mail_node_credential_boundary,
     validate_mail_processing_node_boundary,
@@ -49,6 +53,10 @@
     VariableExtractionNode,
     VariableExtractionNodeData,
 )
+from apps.workflow_engine.workflow.errors import NonRetryableWorkflowError
+from apps.workflow_engine.workflow.core.runtime_dependencies import (
+    WorkflowRuntimeDependencies,
+)
 
 
 class NodeFactory:
@@ -81,7 +89,11 @@ class NodeFactory:
     }
 
     @staticmethod
-    def create(schema: NodeSchema, context: Dict = None) -> Node:
+    def create(
+        schema: NodeSchema,
+        context: Dict = None,
+        runtime_dependencies: WorkflowRuntimeDependencies | None = None,
+    ) -> Node:
         """
         NodeSchema로부터 적절한 Node 인스턴스를 생성
 
@@ -105,9 +117,20 @@ def create(schema: NodeSchema, context: Dict = None) -> Node:
             validate_mail_node_credential_boundary(schema.data)
         elif schema.type in {"gmailDraftNode", "mailAcknowledgeNode"}:
             validate_mail_processing_node_boundary(schema.type, schema.data)
+        elif schema.type == "llmNode":
+            try:
+                parse_llm_knowledge_references(schema.data)
+            except WorkflowKnowledgeReferenceError as exc:
+                raise NonRetryableWorkflowError(exc.reason_code) from exc
 
         NodeClass, DataClass = NodeFactory.NODE_REGISTRY[schema.type]
         data = DataClass(**schema.data)
         node = NodeClass(schema.id, data, execution_context=context)
+        if schema.type == "llmNode" and runtime_dependencies is not None:
+            resolver = (
+                runtime_dependencies.knowledge_runtime_candidate_resolver
+            )
+            if resolver is not None:
+                node.bind_knowledge_runtime_candidate_resolver(resolver)
         node.runtime_node_type = schema.type
         return node
diff --git a/apps/workflow_engine/workflow/nodes/llm/__init__.py b/apps/workflow_engine/workflow/nodes/llm/__init__.py
index ade251416..982af2365 100644
--- a/apps/workflow_engine/workflow/nodes/llm/__init__.py
+++ b/apps/workflow_engine/workflow/nodes/llm/__init__.py
@@ -1,4 +1,4 @@
-from .entities import LLMNodeData
+from .entities import KnowledgeCollectionRef, LLMNodeData
 from .llm_node import LLMNode
 
-__all__ = ["LLMNode", "LLMNodeData"]
+__all__ = ["KnowledgeCollectionRef", "LLMNode", "LLMNodeData"]
diff --git a/apps/workflow_engine/workflow/nodes/llm/entities.py b/apps/workflow_engine/workflow/nodes/llm/entities.py
index 7c1e808a0..4d2313065 100644
--- a/apps/workflow_engine/workflow/nodes/llm/entities.py
+++ b/apps/workflow_engine/workflow/nodes/llm/entities.py
@@ -1,7 +1,14 @@
 from typing import Any, Dict, List, Literal, Optional
 
-from pydantic import BaseModel, Field
-
+from pydantic import BaseModel, ConfigDict, Field
+
+from apps.shared.domain.knowledge_runtime_candidates import (
+    MAX_RUNTIME_COLLECTION_REFERENCES,
+    MAX_RUNTIME_DIRECT_KB_REFERENCES,
+)
+from apps.shared.domain.workflow_knowledge_references import (
+    parse_llm_knowledge_references,
+)
 from apps.workflow_engine.workflow.nodes.base.entities import BaseNodeData
 
 
@@ -18,15 +25,25 @@ class LLMVariable(BaseModel):
 
 
 class KnowledgeBaseRef(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
     id: str
     name: str
 
 
+class KnowledgeCollectionRef(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    id: str
+    safeLabel: Optional[str] = None
+
+
 EvidenceSufficiencyPolicy = Literal["minimum_evidence", "strict_citation"]
 RAGFailurePolicy = Literal["safe_no_result", "fail_node"]
 SourceTierPolicy = Literal["tie_break", "off"]
 QueryRewriteMode = Literal["off", "template", "llm_assisted"]
-MAX_RAG_RETRIEVAL_KBS = 20
+MAX_RAG_RETRIEVAL_KBS = MAX_RUNTIME_DIRECT_KB_REFERENCES
+MAX_RAG_COLLECTIONS = MAX_RUNTIME_COLLECTION_REFERENCES
 MAX_RAG_CHUNKS_PER_KB = 8
 MAX_RAG_QUERY_REWRITE_TEMPLATE_LENGTH = 512
 
@@ -72,6 +89,10 @@ class LLMNodeData(BaseNodeData):
         default_factory=list,
         description="검색할 지식 베이스 목록",
     )
+    knowledgeCollections: List[KnowledgeCollectionRef] = Field(
+        default_factory=list,
+        description="실행 시점에 멤버십을 해석할 지식 컬렉션 목록",
+    )
     scoreThreshold: float = Field(default=0.5, description="유사도 점수 임계값")
     topK: int = Field(default=3, description="상위 K개 문서 반환")
     dedupeRetrievedContext: bool = Field(
@@ -174,8 +195,18 @@ def validate(self) -> None:
             self.topK = 1
         if self.topK > MAX_RAG_CHUNKS_PER_KB:
             self.topK = MAX_RAG_CHUNKS_PER_KB
-        if len(self.knowledgeBases) > MAX_RAG_RETRIEVAL_KBS:
-            self.knowledgeBases = self.knowledgeBases[:MAX_RAG_RETRIEVAL_KBS]
+        parse_llm_knowledge_references(
+            {
+                "knowledgeBases": [
+                    reference.model_dump(mode="python")
+                    for reference in self.knowledgeBases
+                ],
+                "knowledgeCollections": [
+                    reference.model_dump(mode="python")
+                    for reference in self.knowledgeCollections
+                ],
+            }
+        )
 
         if self.queryRewriteMode == "llm_assisted":
             raise ValueError("llm_assisted query rewrite는 아직 사용할 수 없습니다.")
diff --git a/apps/workflow_engine/workflow/nodes/llm/llm_node.py b/apps/workflow_engine/workflow/nodes/llm/llm_node.py
index 6b126267e..1501eb495 100644
--- a/apps/workflow_engine/workflow/nodes/llm/llm_node.py
+++ b/apps/workflow_engine/workflow/nodes/llm/llm_node.py
@@ -10,16 +10,18 @@
 
 from apps.shared.audit.actions import AuditAction
 from apps.shared.audit.logger import record_audit
-from apps.shared.db.models.knowledge import (
-    KnowledgeBase,
-    KnowledgeCollection,
-    KnowledgeCollectionItem,
-)
+from apps.shared.db.models.knowledge import KnowledgeBase
 from apps.shared.db.models.llm import LLMModel
 from apps.shared.db.models.workflow_run import RunStatus, WorkflowNodeRun, WorkflowRun
+from apps.shared.domain.knowledge_runtime_candidates import (
+    AnonymousPublicAudience,
+    AuthenticatedAudience,
+    KnowledgeRuntimeCandidateConfigurationError,
+    KnowledgeRuntimeCandidateRequest,
+    KnowledgeRuntimeCandidateResolution,
+)
 from apps.shared.db.session import SessionLocal  # 임시 세션 생성용
 from apps.shared.schemas.rag import ChunkPreview
-from apps.shared.services.knowledge_permission_service import KnowledgePermissionHelper
 from apps.shared.services.permission_audit import (
     record_resource_permission_denied,
     record_system_resource_permission_denied,
@@ -51,12 +53,16 @@
     ModelRoutingUnavailableError,
 )
 from apps.workflow_engine.services.retrieval import RetrievalService
+from apps.workflow_engine.application.runtime_retrieval.knowledge_candidates import (
+    KnowledgeRuntimeCandidateInfrastructureError,
+    KnowledgeRuntimeCandidateResolver,
+)
+from apps.workflow_engine.workflow.errors import NonRetryableWorkflowError
 
 from ..base.node import Node
 from .entities import (
     MAX_RAG_CHUNKS_PER_KB,
     MAX_RAG_QUERY_REWRITE_TEMPLATE_LENGTH,
-    MAX_RAG_RETRIEVAL_KBS,
     LLMNodeData,
 )
 
@@ -345,6 +351,13 @@ class LLMNode(Node[LLMNodeData]):
 
     node_type = "llmNode"
 
+    def bind_knowledge_runtime_candidate_resolver(
+        self,
+        resolver: KnowledgeRuntimeCandidateResolver,
+    ) -> None:
+        """Bind an in-memory resolver without serializing it in execution context."""
+        self._knowledge_runtime_candidate_resolver = resolver
+
     def _resolve_model_routing_policy(
         self, inputs: Dict[str, Any], db_session=None
     ) -> tuple[str, Optional[str], Optional[dict]]:
@@ -483,11 +496,55 @@ def _run(self, inputs: Dict[str, Any]) -> Dict[str, Any]:
         temp_session = None
         client_override = getattr(self, "_client_override", None)
         selected_credential_id = None
-        if not client_override or self.data.knowledgeBases or self.data.auto_model_routing:
+        knowledge_enabled = bool(
+            self.data.knowledgeBases or self.data.knowledgeCollections
+        )
+        if not client_override or knowledge_enabled or self.data.auto_model_routing:
             db_session, should_close_session = self._borrow_db_session()
             if should_close_session:
                 temp_session = db_session
 
+        candidate_resolution: KnowledgeRuntimeCandidateResolution | None = None
+        if knowledge_enabled:
+            try:
+                candidate_resolution = self._resolve_runtime_knowledge_candidates()
+            except Exception:
+                if temp_session is not None:
+                    temp_session.close()
+                raise
+            if not candidate_resolution.candidates:
+                knowledge_result = self._knowledge_candidate_safe_no_result(
+                    candidate_resolution
+                )
+                self._trace_payloads = [
+                    {
+                        "payload_kind": "rag.retrieval",
+                        "payload": self._rag_retrieval_trace_payload(
+                            [],
+                            evidence_decision=knowledge_result.evidence_decision,
+                            runtime_summary=knowledge_result.trace_summary,
+                        ),
+                        "scope": "span",
+                    }
+                ]
+                if temp_session is not None:
+                    temp_session.close()
+                if self.data.ragFailurePolicy == "fail_node":
+                    raise NonRetryableWorkflowError(
+                        candidate_resolution.reason_code
+                        or "knowledge_candidates.safe_no_result"
+                    )
+                return {
+                    "text": RAG_NO_EVIDENCE_MESSAGE,
+                    "usage": {},
+                    "model": self.data.model_id,
+                    "cost": 0.0,
+                    "metadata": {
+                        "knowledge_search": None,
+                        "rag": self._rag_result_metadata(knowledge_result),
+                    },
+                }
+
         selected_model_id, fallback_model_id, model_routing_metadata = (
             self._resolve_model_routing_policy(inputs, db_session)
         )
@@ -619,15 +676,29 @@ def _run(self, inputs: Dict[str, Any]) -> Dict[str, Any]:
             knowledge_context = ""
             knowledge_metadata = []
             knowledge_result: WorkflowRAGSearchResult | None = None
-            if self.data.knowledgeBases and len(self.data.knowledgeBases) > 0:
+            if knowledge_enabled:
                 try:
                     # User Prompt를 검색 쿼리로 사용 (렌더링 후)
                     if rendered_user_prompt:
                         knowledge_result = self._execute_knowledge_search(
-                            query=rendered_user_prompt, db_session=db_session
+                            query=rendered_user_prompt,
+                            db_session=db_session,
+                            candidate_resolution=candidate_resolution,
                         )
                         knowledge_context = knowledge_result.context
                         knowledge_metadata = knowledge_result.metadata
+                    else:
+                        knowledge_result = self._knowledge_candidate_safe_no_result(
+                            candidate_resolution
+                        )
+                        if self.data.ragFailurePolicy == "fail_node":
+                            raise NonRetryableWorkflowError(
+                                "knowledge_runtime_query_empty"
+                            )
+                except KnowledgeRuntimeCandidateInfrastructureError:
+                    raise
+                except NonRetryableWorkflowError:
+                    raise
                 except PermissionError:
                     raise
                 except Exception as exc:
@@ -1276,7 +1347,11 @@ def _pick_summary_model(self, session, fallback_model: str) -> str:
         return fallback_model
 
     def _execute_knowledge_search(
-        self, query: str, db_session
+        self,
+        query: str,
+        db_session,
+        *,
+        candidate_resolution: KnowledgeRuntimeCandidateResolution | None = None,
     ) -> WorkflowRAGSearchResult:
         """
         연결된 지식 베이스에서 문서를 검색합니다.
@@ -1297,8 +1372,20 @@ def _execute_knowledge_search(
                 "RAG retrieval requires an active organization context."
             ) from exc
 
-        kb_ids = list(dict.fromkeys(kb.id for kb in self.data.knowledgeBases if kb.id))
-        kb_ids = kb_ids[:MAX_RAG_RETRIEVAL_KBS]
+        resolution = (
+            candidate_resolution
+            if candidate_resolution is not None
+            else self._resolve_runtime_knowledge_candidates()
+        )
+        candidate_summary = self._knowledge_candidate_trace_summary(resolution)
+        candidate_kind_by_kb_id = {
+            str(candidate.knowledge_base_id): candidate.provenance.kind
+            for candidate in resolution.candidates
+        }
+        bucket_kb_counts = "collection" in candidate_kind_by_kb_id.values()
+        kb_ids = list(candidate_kind_by_kb_id)
+        if not kb_ids:
+            return self._knowledge_candidate_safe_no_result(resolution)
         top_k = min(self.data.topK or 3, MAX_RAG_CHUNKS_PER_KB)
         threshold = (
             0.5 if self.data.scoreThreshold is None else self.data.scoreThreshold
@@ -1309,25 +1396,19 @@ def _execute_knowledge_search(
 
         all_chunks: List[tuple[str, ChunkPreview]] = []
         rag_result_counts: list[tuple[str, int]] = []
-        authorized_kb_ids = self._authorized_runtime_kb_ids(
-            db_session,
-            user_id=execution_subject_user_id,
-            organization_id=organization_uuid,
-            knowledge_base_ids=kb_ids,
-        )
         query_vectors_by_kb, embedding_failed_count, precomputed_vectors = (
             self._precompute_rag_query_vectors_by_kb(
                 db_session,
                 query=search_query,
                 user_id=credential_user_id,
                 organization_id=organization_uuid,
-                knowledge_base_ids=authorized_kb_ids,
+                knowledge_base_ids=kb_ids,
             )
         )
-        fanout_kb_ids = authorized_kb_ids
+        fanout_kb_ids = kb_ids
         if precomputed_vectors:
             fanout_kb_ids = [
-                kb_id for kb_id in authorized_kb_ids if kb_id in query_vectors_by_kb
+                kb_id for kb_id in kb_ids if kb_id in query_vectors_by_kb
             ]
 
         fanout = self._run_rag_retrieval_fanout(
@@ -1370,7 +1451,15 @@ def _execute_knowledge_search(
         top_chunks = candidate_chunks[:top_k] if top_k else candidate_chunks
 
         metadata_list = [
-            self._knowledge_trace_metadata(kb_id, chunk) for kb_id, chunk in top_chunks
+            self._knowledge_trace_metadata(
+                kb_id,
+                chunk,
+                evidence_rank=evidence_rank,
+                include_resource_identity=(
+                    candidate_kind_by_kb_id.get(kb_id) == "direct"
+                ),
+            )
+            for evidence_rank, (kb_id, chunk) in enumerate(top_chunks, start=1)
         ]
         selected_chunks = [chunk for _kb_id, chunk in top_chunks]
         evidence_policy = RAGEvidencePolicy()
@@ -1381,17 +1470,19 @@ def _execute_knowledge_search(
         evidence_decision = self._rag_decision_with_operational_failures(
             evidence_decision,
             fanout.failed_count,
-            successful_candidate_count=len(authorized_kb_ids) - fanout.failed_count,
+            successful_candidate_count=len(kb_ids) - fanout.failed_count,
         )
         trace_summary = self._rag_runtime_trace_summary(
-            authorized_kb_count=len(authorized_kb_ids),
+            authorized_kb_count=len(kb_ids),
             retrieved_chunk_count=len(top_chunks),
             selected_kb_count=len({kb_id for kb_id, _chunk in top_chunks}),
             context_chunks=selected_chunks,
             fanout=fanout,
             query_rewrite_applied=query_rewrite_applied,
             query_rewrite_strategy=query_rewrite_strategy,
+            bucket_kb_counts=bucket_kb_counts,
         )
+        trace_summary.update(candidate_summary)
         policy_block_reason = blocked_evidence_reason_for_chunks(selected_chunks)
         if policy_block_reason:
             # 정책상 외부 LLM에 전달할 수 없는 evidence는 근거 충분성과 무관하게 차단한다.
@@ -1400,7 +1491,7 @@ def _execute_knowledge_search(
                 reason_code=policy_block_reason,
             )
             blocked_trace_summary = self._rag_runtime_trace_summary(
-                authorized_kb_count=len(authorized_kb_ids),
+                authorized_kb_count=len(kb_ids),
                 retrieved_chunk_count=0,
                 selected_kb_count=0,
                 context_chunks=[],
@@ -1411,7 +1502,9 @@ def _execute_knowledge_search(
                 ),
                 query_rewrite_applied=query_rewrite_applied,
                 query_rewrite_strategy=query_rewrite_strategy,
+                bucket_kb_counts=bucket_kb_counts,
             )
+            blocked_trace_summary.update(candidate_summary)
             blocked_trace_summary["safe_exclusion_summary"] = {
                 "policy_filtered": True,
                 "reason_code": policy_block_reason,
@@ -1437,11 +1530,23 @@ def _execute_knowledge_search(
                 answer_override=self._rag_safe_no_result_answer(evidence_decision),
                 trace_summary=blocked_trace_summary,
             )
+        collection_candidate_count = 0
+        collection_result_count = 0
         for kb_id, result_count in rag_result_counts:
-            self._record_rag_retrieve_audit(
+            if candidate_kind_by_kb_id.get(kb_id) == "direct":
+                self._record_rag_retrieve_audit(
+                    execution_subject_user_id,
+                    kb_id,
+                    result_count,
+                )
+                continue
+            collection_candidate_count += 1
+            collection_result_count += result_count
+        if collection_candidate_count:
+            self._record_rag_collection_retrieve_audit(
                 execution_subject_user_id,
-                kb_id,
-                result_count,
+                candidate_count=collection_candidate_count,
+                result_count=collection_result_count,
             )
         if not evidence_decision.evidence_sufficient:
             if self.data.ragFailurePolicy == "fail_node":
@@ -1502,8 +1607,9 @@ def _run_rag_retrieval_fanout(
 
         if query_vectors_by_kb is not None:
             logger.info(
-                "[LLMNode] RAG fanout uses precomputed query vectors: kb_count=%s",
-                len(knowledge_base_ids),
+                "[LLMNode] RAG fanout uses precomputed query vectors: "
+                "kb_count_bucket=%s",
+                self._bucket_count(len(knowledge_base_ids)),
             )
             return self._run_rag_retrieval_fanout_sequential(
                 query=query,
@@ -1779,11 +1885,13 @@ def _precompute_rag_query_vectors_by_kb(
                 query_vectors_by_kb[kb_id] = query_vector
 
         logger.info(
-            "[LLMNode] RAG query vector precompute completed: kb_count=%s model_count=%s vector_kb_count=%s failed_count=%s",
-            len(knowledge_base_ids),
-            len(model_to_kb_ids),
-            len(query_vectors_by_kb),
-            failed_count,
+            "[LLMNode] RAG query vector precompute completed: "
+            "kb_count_bucket=%s model_count_bucket=%s "
+            "vector_kb_count_bucket=%s failed_count_bucket=%s",
+            self._bucket_count(len(knowledge_base_ids)),
+            self._bucket_count(len(model_to_kb_ids)),
+            self._bucket_count(len(query_vectors_by_kb)),
+            self._bucket_count(failed_count),
         )
         return query_vectors_by_kb, failed_count, True
 
@@ -1836,6 +1944,7 @@ def _rag_runtime_trace_summary(
         fanout: WorkflowRAGFanoutResult,
         query_rewrite_applied: bool,
         query_rewrite_strategy: str,
+        bucket_kb_counts: bool,
     ) -> Dict[str, Any]:
         safe_exclusion_summary: Dict[str, Any] = {}
         if fanout.failed_count:
@@ -1847,11 +1956,9 @@ def _rag_runtime_trace_summary(
                 fanout.timeout_count
             )
 
-        return {
+        summary = {
             "retrieval_strategy": "permission_scoped_hierarchical_hybrid",
             "rag_mode": "explicit_kb",
-            "authorized_kb_count": authorized_kb_count,
-            "selected_kb_count": selected_kb_count,
             "retrieved_chunk_count": retrieved_chunk_count,
             "context_token_estimate": self._rag_context_token_estimate(context_chunks),
             "permission_filter_applied": True,
@@ -1859,12 +1966,29 @@ def _rag_runtime_trace_summary(
             "query_rewrite_applied": query_rewrite_applied,
             "query_rewrite_strategy": query_rewrite_strategy,
             "source_tier_policy": getattr(self.data, "sourceTierPolicy", "tie_break"),
-            "fanout_concurrency": min(
-                MAX_RAG_FANOUT_CONCURRENCY,
-                max(authorized_kb_count, 1),
-            ),
             "fanout_timeout_seconds": RAG_FANOUT_AGGREGATE_TIMEOUT_SECONDS,
         }
+        if bucket_kb_counts:
+            summary.update(
+                {
+                    "authorized_kb_count_bucket": self._bucket_count(
+                        authorized_kb_count
+                    ),
+                    "selected_kb_count_bucket": self._bucket_count(selected_kb_count),
+                }
+            )
+        else:
+            summary.update(
+                {
+                    "authorized_kb_count": authorized_kb_count,
+                    "selected_kb_count": selected_kb_count,
+                    "fanout_concurrency": min(
+                        MAX_RAG_FANOUT_CONCURRENCY,
+                        max(authorized_kb_count, 1),
+                    ),
+                }
+            )
+        return summary
 
     @staticmethod
     def _rag_context_token_estimate(chunks: List[ChunkPreview]) -> int:
@@ -1884,6 +2008,206 @@ def _rag_context_token_estimate(chunks: List[ChunkPreview]) -> int:
             total += max(1, len(getattr(chunk, "content", "") or "") // 4)
         return total
 
+    def _get_knowledge_runtime_candidate_resolver(
+        self,
+    ) -> KnowledgeRuntimeCandidateResolver:
+        resolver = getattr(
+            self,
+            "_knowledge_runtime_candidate_resolver",
+            None,
+        )
+        if resolver is None or not callable(getattr(resolver, "resolve", None)):
+            raise KnowledgeRuntimeCandidateInfrastructureError()
+        return resolver
+
+    def _resolve_runtime_knowledge_candidates(
+        self,
+    ) -> KnowledgeRuntimeCandidateResolution:
+        try:
+            organization_id = uuid.UUID(
+                str(self.execution_context.get("organization_id"))
+            )
+        except (TypeError, ValueError):
+            raise NonRetryableWorkflowError(
+                "knowledge_runtime_organization_invalid"
+            ) from None
+
+        try:
+            execution_subject_user_id = self._resolve_rag_execution_subject()
+        except PermissionError:
+            raise NonRetryableWorkflowError(
+                "knowledge_runtime_audience_invalid"
+            ) from None
+
+        audience = (
+            AuthenticatedAudience(
+                organization_id=organization_id,
+                user_id=execution_subject_user_id,
+            )
+            if execution_subject_user_id is not None
+            else AnonymousPublicAudience(organization_id=organization_id)
+        )
+        try:
+            request = KnowledgeRuntimeCandidateRequest(
+                audience=audience,
+                direct_kb_ids=tuple(
+                    uuid.UUID(reference.id)
+                    for reference in self.data.knowledgeBases
+                ),
+                collection_ids=tuple(
+                    uuid.UUID(reference.id)
+                    for reference in self.data.knowledgeCollections
+                ),
+            )
+        except KnowledgeRuntimeCandidateConfigurationError as exc:
+            raise NonRetryableWorkflowError(exc.reason_code) from None
+        except (TypeError, ValueError):
+            raise NonRetryableWorkflowError(
+                "knowledge_runtime_reference_invalid"
+            ) from None
+
+        try:
+            result = self._get_knowledge_runtime_candidate_resolver().resolve(
+                request
+            )
+        except KnowledgeRuntimeCandidateConfigurationError as exc:
+            raise NonRetryableWorkflowError(exc.reason_code) from None
+        except KnowledgeRuntimeCandidateInfrastructureError:
+            raise
+        except Exception:
+            raise KnowledgeRuntimeCandidateInfrastructureError() from None
+
+        if not isinstance(result, KnowledgeRuntimeCandidateResolution):
+            raise NonRetryableWorkflowError(
+                "knowledge_runtime_candidate_resolution_invalid"
+            )
+        self._validate_knowledge_runtime_candidate_resolution(request, result)
+        return result
+
+    @staticmethod
+    def _validate_knowledge_runtime_candidate_resolution(
+        request: KnowledgeRuntimeCandidateRequest,
+        resolution: KnowledgeRuntimeCandidateResolution,
+    ) -> None:
+        invalid_reason = "knowledge_runtime_candidate_resolution_invalid"
+        candidates = resolution.candidates
+        if not isinstance(candidates, tuple):
+            raise NonRetryableWorkflowError(invalid_reason)
+        if len(candidates) > request.candidate_budget:
+            raise NonRetryableWorkflowError(invalid_reason)
+
+        seen: set[uuid.UUID] = set()
+        provenance_kinds: set[str] = set()
+        for candidate in candidates:
+            knowledge_base_id = getattr(candidate, "knowledge_base_id", None)
+            provenance = getattr(candidate, "provenance", None)
+            kind = getattr(provenance, "kind", None)
+            collection_id = getattr(provenance, "collection_id", None)
+            if not isinstance(knowledge_base_id, uuid.UUID):
+                raise NonRetryableWorkflowError(invalid_reason)
+            if knowledge_base_id in seen:
+                raise NonRetryableWorkflowError(invalid_reason)
+            seen.add(knowledge_base_id)
+            if kind == "direct":
+                if (
+                    knowledge_base_id not in request.direct_kb_ids
+                    or collection_id is not None
+                ):
+                    raise NonRetryableWorkflowError(invalid_reason)
+            elif kind == "collection":
+                if collection_id not in request.collection_ids:
+                    raise NonRetryableWorkflowError(invalid_reason)
+            else:
+                raise NonRetryableWorkflowError(invalid_reason)
+            provenance_kinds.add(kind)
+
+        expected_status = "resolved" if candidates else "safe_no_result"
+        expected_mode = (
+            "mixed"
+            if provenance_kinds == {"direct", "collection"}
+            else "direct"
+            if provenance_kinds == {"direct"}
+            else "collection"
+            if provenance_kinds == {"collection"}
+            else "none"
+        )
+        safe_buckets = {"0", "1", "2-10", "11-100", "100+"}
+        bucket_values = (
+            resolution.configured_direct_count_bucket,
+            resolution.configured_collection_count_bucket,
+            resolution.eligible_candidate_count_bucket,
+            resolution.selected_candidate_count_bucket,
+            resolution.policy_excluded_count_bucket,
+        )
+        if (
+            resolution.status != expected_status
+            or resolution.routing_mode != expected_mode
+            or any(
+                not isinstance(bucket, str) or bucket not in safe_buckets
+                for bucket in bucket_values
+            )
+            or not isinstance(resolution.budget_limited, bool)
+            or not isinstance(resolution.scan_limited, bool)
+            or not isinstance(resolution.warning_codes, tuple)
+            or any(
+                not isinstance(code, str)
+                or code
+                not in {"candidate_budget_limited", "candidate_scan_limited"}
+                for code in resolution.warning_codes
+            )
+            or resolution.reason_code
+            != (
+                None
+                if candidates
+                else "knowledge_candidates.safe_no_result"
+            )
+        ):
+            raise NonRetryableWorkflowError(invalid_reason)
+
+    def _knowledge_candidate_safe_no_result(
+        self,
+        resolution: KnowledgeRuntimeCandidateResolution,
+    ) -> WorkflowRAGSearchResult:
+        return WorkflowRAGSearchResult(
+            context="",
+            metadata=[],
+            evidence_decision=RAGEvidenceDecision(
+                evidence_sufficient=False,
+                insufficiency_reason="no_evidence",
+            ),
+            should_invoke_llm=False,
+            answer_override=RAG_NO_EVIDENCE_MESSAGE,
+            trace_summary=self._knowledge_candidate_trace_summary(resolution),
+        )
+
+    @staticmethod
+    def _knowledge_candidate_trace_summary(
+        resolution: KnowledgeRuntimeCandidateResolution,
+    ) -> Dict[str, Any]:
+        return {
+            "candidate_resolution_status": resolution.status,
+            "routing_mode": resolution.routing_mode,
+            "configured_direct_count_bucket": (
+                resolution.configured_direct_count_bucket
+            ),
+            "configured_collection_count_bucket": (
+                resolution.configured_collection_count_bucket
+            ),
+            "eligible_candidate_count_bucket": (
+                resolution.eligible_candidate_count_bucket
+            ),
+            "selected_candidate_count_bucket": (
+                resolution.selected_candidate_count_bucket
+            ),
+            "policy_excluded_count_bucket": (
+                resolution.policy_excluded_count_bucket
+            ),
+            "candidate_budget_limited": resolution.budget_limited,
+            "candidate_scan_limited": resolution.scan_limited,
+            "candidate_warning_codes": list(resolution.warning_codes),
+            "candidate_reason_code": resolution.reason_code,
+        }
+
     def _resolve_rag_execution_subject(self) -> uuid.UUID | None:
         # Workflow owner나 builder 권한으로 조용히 대체하지 않는다.
         # 현재 runtime은 user execution subject만 지원하며 service account는 후속 gate다.
@@ -1940,112 +2264,6 @@ def _is_system_schedule_execution(self) -> bool:
             and task_id.startswith("schedule:")
         )
 
-    def _authorized_runtime_kb_ids(
-        self,
-        db_session,
-        *,
-        user_id: uuid.UUID | None,
-        organization_id: uuid.UUID,
-        knowledge_base_ids: List[str],
-    ) -> List[str]:
-        parsed_ids = []
-        for kb_id in knowledge_base_ids:
-            try:
-                parsed_ids.append(uuid.UUID(str(kb_id)))
-            except (TypeError, ValueError) as exc:
-                raise PermissionError("Knowledge Base is unavailable.") from exc
-
-        if not parsed_ids:
-            return []
-
-        if user_id is None:
-            return self._public_runtime_kb_ids(
-                db_session,
-                organization_id=organization_id,
-                knowledge_base_ids=parsed_ids,
-            )
-
-        rows = (
-            db_session.query(KnowledgeBase)
-            .filter(
-                KnowledgeBase.id.in_(parsed_ids),
-                KnowledgeBase.organization_id == organization_id,
-                KnowledgeBase.lifecycle_state == "active",
-            )
-            .all()
-        )
-        kbs_by_id = {row.id: row for row in rows}
-        helper = KnowledgePermissionHelper(
-            db_session,
-            user_id=user_id,
-            organization_id=organization_id,
-        )
-
-        authorized_ids: List[str] = []
-        decisions = helper.bulk_evaluate_kb_use(
-            [kbs_by_id[kb_id] for kb_id in parsed_ids if kb_id in kbs_by_id]
-        )
-        for kb_id in parsed_ids:
-            kb = kbs_by_id.get(kb_id)
-            if kb is None:
-                # Stale deployment snapshots can contain KBs that were later deleted
-                # or made inactive. Hide them from retrieval instead of failing the
-                # whole LLM node and leaking resource state to the user.
-                continue
-            decision = decisions.get(kb.id)
-            if decision is None or not decision.allowed:
-                self._record_knowledge_permission_denied(
-                    user_id,
-                    str(kb_id),
-                    getattr(decision, "effective_auth_state", "unknown")
-                    if decision
-                    else "unknown",
-                    organization_id,
-                )
-                continue
-            authorized_ids.append(str(kb_id))
-        return authorized_ids
-
-    def _public_runtime_kb_ids(
-        self,
-        db_session,
-        *,
-        organization_id: uuid.UUID,
-        knowledge_base_ids: List[uuid.UUID],
-    ) -> List[str]:
-        rows = (
-            db_session.query(KnowledgeCollectionItem, KnowledgeCollection, KnowledgeBase)
-            .join(
-                KnowledgeCollection,
-                KnowledgeCollection.id == KnowledgeCollectionItem.collection_id,
-            )
-            .join(
-                KnowledgeBase,
-                KnowledgeBase.id == KnowledgeCollectionItem.knowledge_base_id,
-            )
-            .filter(
-                KnowledgeCollectionItem.organization_id == organization_id,
-                KnowledgeCollectionItem.knowledge_base_id.in_(knowledge_base_ids),
-                KnowledgeCollection.organization_id == organization_id,
-                KnowledgeCollection.lifecycle_state == "active",
-                KnowledgeBase.organization_id == organization_id,
-                KnowledgeBase.lifecycle_state == "active",
-            )
-            .all()
-        )
-        public_kb_ids: set[uuid.UUID] = set()
-        for item, collection, kb in rows:
-            safe_metadata = getattr(collection, "safe_metadata", None) or {}
-            source_identity_id = getattr(kb, "source_identity_id", None)
-            # ADR-0018/ADR-0020 require source-managed KB public runtime exposure
-            # to pass a separate source/connector approval gate. Until that
-            # approval primitive exists in runtime, fail closed for anonymous
-            # public-only runs.
-            if safe_metadata.get("visibility") == "public" and source_identity_id is None:
-                public_kb_ids.add(item.knowledge_base_id)
-
-        return [str(kb_id) for kb_id in knowledge_base_ids if kb_id in public_kb_ids]
-
     def _rag_safe_no_result_answer(
         self,
         evidence_decision: RAGEvidenceDecision,
@@ -2240,6 +2458,39 @@ def _record_rag_retrieve_audit(
             metadata=metadata,
         )
 
+    def _record_rag_collection_retrieve_audit(
+        self,
+        user_id: uuid.UUID | None,
+        *,
+        candidate_count: int,
+        result_count: int,
+    ) -> None:
+        """Record Collection retrieval without persisting child resource lineage."""
+        organization_id = self._canonical_audit_organization_id()
+        if organization_id is None:
+            return
+        metadata = {
+            "workflow_id": self.execution_context.get("workflow_id"),
+            "workflow_run_id": self.execution_context.get("workflow_run_id"),
+            "node_id": self.id,
+            "organization_id": organization_id,
+            "retrieval_mode": "collection",
+            "candidate_count_bucket": self._bucket_count(candidate_count),
+            "result_count_bucket": self._bucket_count(result_count),
+            "policy_result": "allow",
+        }
+        is_user_actor = user_id is not None and not self._is_system_schedule_execution()
+        record_audit(
+            action=AuditAction.RAG_RETRIEVE,
+            category="action",
+            actor_id=user_id if is_user_actor else None,
+            actor_type="user" if is_user_actor else "system",
+            target_type="workflow_node",
+            target_id=self.id,
+            status="success",
+            metadata=metadata,
+        )
+
     def _record_rag_policy_block_audit(
         self,
         user_id: uuid.UUID | None,
@@ -2283,27 +2534,6 @@ def _canonical_audit_organization_id(self) -> str | None:
             logger.warning("RAG audit omitted invalid organization context")
             return None
 
-    def _record_knowledge_permission_denied(
-        self,
-        user_id: uuid.UUID,
-        knowledge_base_id: str,
-        effective_auth_state: str,
-        organization_id: uuid.UUID,
-    ) -> None:
-        record_resource_permission_denied(
-            user_id=user_id,
-            resource_type="knowledge_base",
-            resource_id=knowledge_base_id,
-            action="use",
-            effective_auth_state=effective_auth_state,
-            organization_id=organization_id,
-            metadata={
-                "workflow_id": self.execution_context.get("workflow_id"),
-                "workflow_run_id": self.execution_context.get("workflow_run_id"),
-                "node_id": self.id,
-            },
-        )
-
     def _require_runtime_organization_id(
         self,
         user_id: uuid.UUID,
@@ -2385,25 +2615,37 @@ def _record_llm_runtime_permission_denied(
             record_resource_permission_denied(user_id=user_id, **audit_kwargs)
 
     def _knowledge_trace_metadata(
-        self, knowledge_base_id: str, chunk: ChunkPreview
+        self,
+        knowledge_base_id: str,
+        chunk: ChunkPreview,
+        *,
+        evidence_rank: int | None = None,
+        include_resource_identity: bool = True,
     ) -> Dict[str, Any]:
         """추적 메타데이터에는 redaction-safe evidence 요약만 남깁니다."""
         metadata_summary = self._safe_rag_metadata_summary(chunk.metadata_summary)
         metadata = {
-            "knowledge_base_id": str(knowledge_base_id),
-            "chunk_id": str(chunk.chunk_id) if chunk.chunk_id else None,
-            "parent_chunk_id": (
-                str(chunk.parent_chunk_id) if chunk.parent_chunk_id else None
-            ),
-            "document_id": str(chunk.document_id),
             "page_number": chunk.page_number,
             "similarity_score": chunk.similarity_score,
             "score": chunk.score if chunk.score is not None else chunk.similarity_score,
-            "rank": chunk.rank,
             "token_count": chunk.token_count,
             "metadata_summary": metadata_summary,
             "hierarchy_path": chunk.hierarchy_path or [],
         }
+        if evidence_rank is not None:
+            metadata["evidence_rank"] = evidence_rank
+        if include_resource_identity:
+            metadata.update(
+                {
+                    "rank": chunk.rank,
+                    "knowledge_base_id": str(knowledge_base_id),
+                    "chunk_id": str(chunk.chunk_id) if chunk.chunk_id else None,
+                    "parent_chunk_id": (
+                        str(chunk.parent_chunk_id) if chunk.parent_chunk_id else None
+                    ),
+                    "document_id": str(chunk.document_id),
+                }
+            )
         if metadata_summary.get("hierarchy_fallback"):
             metadata["hierarchy_fallback"] = True
         return metadata
diff --git a/docs/architecture.md b/docs/architecture.md
index ca526dc70..2d9ce7db2 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -28,7 +28,7 @@ Security Alert MVP는 [ADR-0028](decisions/ADR-0028-security-alert-detection-and
 | Security Alert Admin Service | Gateway application/service boundary | organization owner/manager 전용 alert 조회·상태 변경, safe evidence projection, lifecycle audit transaction을 제공한다 |
 | Security Alert Notification Projection | Gateway/Client notification boundary | 영속 alert를 source of truth로 두고 Sidebar summary와 `notifications.changed` 재조회 신호를 제공한다 |
 
-Knowledge 통합 목표 구조에서는 Gateway/Shared/Workflow Engine 경계에 다음 domain service를 둔다. 아래 항목은 현재 구현 컴포넌트 전체가 아니라 [ADR-0014](decisions/ADR-0014-knowledge-base-document-atom-and-collection-boundary.md), [ADR-0015](decisions/ADR-0015-knowledge-skill-context-routing-boundary.md), [ADR-0017](decisions/ADR-0017-knowledge-integration-provisional-implementation-baseline.md), [ADR-0020](decisions/ADR-0020-knowledge-mcp-incremental-sync-boundary.md), [ADR-0036](decisions/ADR-0036-knowledge-runtime-candidate-resolution.md)의 target component다.
+Knowledge 통합 목표 구조에서는 Gateway/Shared/Workflow Engine 경계에 다음 domain service를 둔다. 아래 항목은 현재 구현 컴포넌트 전체가 아니라 [ADR-0014](decisions/ADR-0014-knowledge-base-document-atom-and-collection-boundary.md), [ADR-0015](decisions/ADR-0015-knowledge-skill-context-routing-boundary.md), [ADR-0017](decisions/ADR-0017-knowledge-integration-provisional-implementation-baseline.md), [ADR-0020](decisions/ADR-0020-knowledge-mcp-incremental-sync-boundary.md), [ADR-0036](decisions/ADR-0036-knowledge-runtime-candidate-resolution.md), [ADR-0039](decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md)의 target component다.
 
 | 구성요소 | 책임 |
 | --- | --- |
@@ -40,7 +40,9 @@ Knowledge 통합 목표 구조에서는 Gateway/Shared/Workflow Engine 경계에
 | Knowledge Normalizer / Ingestion Pipeline | source item을 redacted canonical text와 document version artifact로 변환하고, indexing 성공 후 active version finalization을 수행한다. |
 | Knowledge Permission Helper | collection route 권한, KB `use`, source ACL freshness/requester authorization을 bulk 평가한다. Router, Builder, Workflow LLM node runtime은 permission row를 직접 조합하지 않는다. |
 | Knowledge Administration Application | KB object/property authorization, owner migration/bootstrap, organization-scoped domain delegation, self-escalation policy, lifecycle와 transaction-bound audit를 조율한다. Domain 관리 권한은 KB content/Collection route에 합산하지 않는다 ([ADR-0034](decisions/ADR-0034-knowledge-delegated-administration-and-rbac-boundary.md)). |
-| Workflow Runtime Knowledge Candidate Resolver | Shared pure policy와 Workflow Engine `runtime_retrieval` use case/port, PostgreSQL adapter로 direct KB와 명시 selected Collection을 current audience 기준 재평가한다. Invocation마다 `REPEATABLE READ, READ ONLY` snapshot을 사용하고 Gateway Builder resolver를 import하지 않는다. API/graph/LLM wiring은 MBA-233 범위다 ([ADR-0036](decisions/ADR-0036-knowledge-runtime-candidate-resolution.md)). |
+| Workflow Runtime Knowledge Candidate Resolver | Shared pure policy와 Workflow Engine `runtime_retrieval` use case/port, PostgreSQL adapter로 direct KB와 명시 selected Collection을 current audience 기준 재평가한다. Invocation마다 `REPEATABLE READ, READ ONLY` snapshot을 사용하고 Gateway Builder resolver를 import하지 않는다. MBA-232가 resolver seam을 구현했고 MBA-233은 additive graph/Builder/preflight/LLM retrieval wiring을 연결한다 ([ADR-0036](decisions/ADR-0036-knowledge-runtime-candidate-resolution.md), [ADR-0039](decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md)). |
+| Workflow Knowledge Reference Service | Gateway editable-graph write에서 direct KB effective `use`/source gate와 selected Collection `route`를 current editor 기준으로 재검증한다. Collection child를 열거하거나 runtime capability를 발급하지 않고 graph/success audit transaction 앞에서 fail-closed한다. |
+| Route-safe Collection Picker | active organization에서 active lifecycle이고 `sync_state != source_deleted`인 Collection 중 current editor가 `route` 가능한 UUID와 approved safe label만 Builder에 제공한다. Collection management projection이나 runtime resolver를 재사용하지 않는다. |
 | Collection Router / Retrieval Orchestrator | 권한 helper가 허용한 safe candidate set에서 collection/KB를 선택하고, metadata-aware/hierarchical retrieval 결과를 merge/rerank한다. |
 | Knowledge Skill Registry | Workflow Builder가 LLM node의 RAG 옵션을 구성할 때 사용할 provider-neutral Skill, version, visibility, freshness/eval 상태를 관리하는 target component다. Skill은 권한 source나 source of truth가 아니다. |
 | Skill Context Loader | 후속 target component로, 빌더 단계에서 safe skill metadata와 필요한 checklist/body를 gate 통과 후 점진적으로 로드한다. MBA-145 Agent Builder MVP는 Knowledge Skill body/checklist를 prompt context로 직접 로드하지 않고 ADR-0017 기본 RAG option 후보와 KB safe metadata만 사용한다. Raw skill body, hidden source reference, raw source title/path/url은 Builder input으로 제공하지 않는다. |
@@ -157,10 +159,11 @@ Package 기준:
 초기 pilot과 이후 package 규칙:
 
 - Gateway deployment scaffold 다음 단계로 deployment preflight pilot을 실제 이관했다.
-- `apps/gateway/application/deployment/`는 framework-independent result/error, repository port, graph/audience policy와 use case를 소유한다.
-- `apps/gateway/adapters/db/deployment_preflight_repository.py`는 SQLAlchemy model/query를 pure snapshot으로 변환한다.
+- `apps/gateway/application/deployment/`는 framework-independent result/error, repository port, graph/audience policy와 use case를 소유한다. MBA-233에서는 shared strict Knowledge-reference parser를 사용해 direct KB와 selected Collection을 함께 검사하고, embedded subgraph는 반복 순회하며 workflow-node target graph는 기존 bounded target recursion으로 검사한다.
+- `apps/gateway/adapters/db/deployment_preflight_repository.py`는 SQLAlchemy model/query를 pure snapshot으로 변환한다. Collection preflight query는 selected IDs와 active organization에 한정하고 active member/source 여부를 aggregate하되 child ID를 application result로 반환하지 않는다.
 - `apps/gateway/composition/deployment.py`는 concrete repository와 use case만 조립하고 정책을 판단하지 않는다.
-- `apps/gateway/services/knowledge_deployment_preflight_service.py`는 기존 caller 호환 facade로서 application result를 shared response schema로, typed blocked error를 기존 HTTP 409 envelope으로 변환한다.
+- `apps/gateway/services/knowledge_deployment_preflight_service.py`는 기존 caller 호환 facade로서 application result를 shared response schema로, typed blocked error를 기존 HTTP 409 envelope으로 변환한다. 응답은 KB/Collection count bucket과 candidate-budget boolean만 추가하며 resource/member identity를 포함하지 않는다.
+- Deployment preflight는 runtime capability를 발급하지 않는다. Builder picker, saved display snapshot, preflight pass 뒤에도 Workflow Engine의 MBA-232 resolver가 각 Knowledge-enabled LLM invocation에서 current audience와 lifecycle/permission/source/readiness를 다시 평가한다.
 - `apps/gateway/application/access_management/`는 actor 중심 organization access 조회·단일 mutation policy, command/result/error와 capability별 port를 소유한다.
 - `apps/gateway/adapters/db/access_management_*`와 `apps/gateway/adapters/audit/*`는 SQLAlchemy projection/mutation/lock, transaction-bound audit와 management reason redaction을 구현한다. `apps/gateway/composition/access_management.py`가 이를 조립한다.
 - 기존 member/team/user-direct/App 생성 권한 경로는 일괄 이동하지 않고 같은 subject lock protocol과 transaction-bound audit을 사용하는 compatibility path로 보강한다. 기존 authorization, response/status와 latent-row 정책은 유지한다.
diff --git a/docs/data_model.md b/docs/data_model.md
index b713da3bf..f047605be 100644
--- a/docs/data_model.md
+++ b/docs/data_model.md
@@ -310,6 +310,13 @@ project/endpoint boundary.
 | created_at / updated_at | DATETIME | NOT NULL |
 
 - UNIQUE `(id, organization_id)` — user direct permission의 복합 FK 대상.
+- MBA-233 LLM node data는 `knowledgeBases`와 additive `knowledgeCollections` reference
+  목록을 함께 저장할 수 있다. 각 item은 canonical UUID와 bounded display snapshot만
+  가지며 display 값은 permission/routing/source 판단에 사용하지 않는다.
+- `knowledgeCollections`는 Collection membership snapshot이 아니다. 실행 시점에
+  current Collection item/permission을 MBA-232 resolver가 다시 읽으므로 이 field를
+  위해 새 relation, migration 또는 `llm_node_versions` column을 추가하지 않는다
+  ([ADR-0039](decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md)).
 
 #### `workflow_budgets`
 
@@ -339,7 +346,7 @@ workflow 단위 월간 LLM 예산 ([features/budget-management](features/budget-
 | app_id | UUID | NOT NULL, FK→apps.id (CASCADE) |
 | version | INTEGER | NOT NULL |
 | type | VARCHAR(13) | NOT NULL — deployment type (api/webapp/widget/mcp/workflow_node/schedule/webhook/chatbot) |
-| graph_snapshot | JSONB | NOT NULL — 배포 시점 graph 고정본. MBA-190 이후 server가 계산한 WorkflowNode target deployment ID/version/snapshot-hash internal binding을 포함할 수 있으며 public graph 응답에서는 제거 |
+| graph_snapshot | JSONB | NOT NULL — 배포 시점 graph 고정본. MBA-190 이후 server가 계산한 WorkflowNode target deployment ID/version/snapshot-hash internal binding을 포함할 수 있다. MBA-233 LLM node의 `knowledgeBases`/`knowledgeCollections` configured intent도 보존하되 public graph 응답에서는 internal binding과 두 Knowledge reference 목록을 제거한다 |
 | config / input_schema / output_schema | JSONB | NULL |
 | description | VARCHAR | NULL |
 | created_by | UUID | NOT NULL, FK→users.id |
diff --git a/docs/decisions/ADR-0036-knowledge-runtime-candidate-resolution.md b/docs/decisions/ADR-0036-knowledge-runtime-candidate-resolution.md
index b9d6e462a..cb4cbc581 100644
--- a/docs/decisions/ADR-0036-knowledge-runtime-candidate-resolution.md
+++ b/docs/decisions/ADR-0036-knowledge-runtime-candidate-resolution.md
@@ -82,6 +82,10 @@ semantic discovery는 수행하지 않는다.
   한다. 누락, 다른 값, malformed 값은 private로 취급한다.
 - Direct KB도 active public Collection에 현재 연결되어 있어야 한다.
 - Manual active/ready KB만 public candidate가 될 수 있다.
+- Source-managed Collection은 별도 source/connector public exposure approval store가 현재
+  구현되어 있지 않으므로 public visibility와 manual child KB가 있어도 fail-closed
+  제외한다. Collection source identity projection이 누락된 상태도 허용으로 해석하지
+  않는다.
 - Source-managed KB는 별도 source/connector public exposure approval store가 현재
   구현되어 있지 않으므로 public Collection에 연결되어 있어도 fail-closed 제외한다.
 - Anonymous path는 Team/User Collection/KB permission, domain permission, 로그인
diff --git a/docs/decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md b/docs/decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md
new file mode 100644
index 000000000..efde90534
--- /dev/null
+++ b/docs/decisions/ADR-0039-knowledge-workflow-collection-routing-integration.md
@@ -0,0 +1,172 @@
+# ADR-0039: Workflow Knowledge Collection 라우팅 통합
+
+Status: Accepted
+
+Related ADRs: [ADR-0018](ADR-0018-workflow-rag-anonymous-public-only-runtime.md), [ADR-0019](ADR-0019-agent-builder-preview-apply-save-boundary.md), [ADR-0022](ADR-0022-incremental-hexagonal-architecture-adoption.md), [ADR-0034](ADR-0034-knowledge-delegated-administration-and-rbac-boundary.md), [ADR-0036](ADR-0036-knowledge-runtime-candidate-resolution.md)
+
+## Context
+
+MBA-232는 direct Knowledge Base와 명시 selected Knowledge Collection을 current
+execution audience 기준으로 해석하는 pure policy, Workflow Engine application
+use case/port, PostgreSQL `REPEATABLE READ, READ ONLY` adapter와 composition을
+구현했다. 그러나 현재 LLM node graph는 `knowledgeBases`만 저장하고, Builder,
+Gateway save/preflight, LLM runtime과 retrieval fan-out은 MBA-232 resolver를 호출하지
+않는다.
+
+기존 Worker는 모르는 Pydantic field를 무시할 수 있다. 따라서 Client가
+`knowledgeCollections`를 먼저 저장하면 구 Worker가 Collection-only LLM node를
+Knowledge 비활성 node로 실행하고 근거 없는 provider 호출을 할 수 있다. 또한
+Collection 관리 목록의 `read/manage` projection을 picker에 재사용하거나 저장된 label,
+Client capability, preflight 결과를 실행 권한으로 사용하면 Collection `route`, child KB
+`use`, source authorization 책임이 섞인다.
+
+## Options
+
+1. 저장 시 Collection child를 `knowledgeBases`로 정적 확장한다.
+2. Gateway Builder candidate resolver를 Worker에서 호출하거나 import한다.
+3. Graph에는 direct KB와 selected Collection intent를 별도로 저장하고 Builder/save,
+   preflight, runtime마다 자기 audience와 책임에 맞는 검증을 수행한다.
+
+## Decision
+
+선택지 3을 채택한다.
+
+### Additive graph contract
+
+- LLM node data는 기존 `knowledgeBases`와 새 `knowledgeCollections`를 함께 가질 수
+  있다. 두 목록은 상호 배타적인 mode가 아니다.
+- `knowledgeBases` item은 canonical UUID `id`와 legacy display snapshot `name`,
+  `knowledgeCollections` item은 canonical UUID `id`와 optional `safeLabel`만 가진다.
+- 각 목록의 최대 configured reference는 20개다. 21번째 reference, malformed object,
+  non-canonical UUID, 허용되지 않은 field와 control character가 있는 display 값은
+  저장·실행·배포 전에 거부하고 silent slicing이나 자동 삭제를 하지 않는다.
+- Display snapshot은 최대 255자이고 UI round-trip에만 사용한다. Permission, source,
+  routing, audit와 trace 판단은 server-loaded UUID resource만 사용한다.
+- Collection membership은 graph에 materialize하지 않는다. 기존 `workflows.graph`와
+  `workflow_deployments.graph_snapshot` JSONB 안의 additive field이므로 MBA-233에서 DB
+  migration이나 `llm_node_versions` column을 추가하지 않는다.
+
+### Builder picker와 save authorization
+
+- Direct KB picker는 기존 active-organization, active lifecycle,
+  `sync_state != source_deleted`, effective KB `use`, source gate와
+  retrieval-selectable 조건을 통과한 `/knowledge/llm-selectable`을 사용한다.
+- Collection picker는 별도 authenticated endpoint를 사용하고, active organization의
+  active lifecycle이며 `sync_state != source_deleted`인 Collection 중 current editor가
+  Collection `route`를 가진 항목만 반환한다.
+  Response는 UUID와 display-policy-approved optional safe label만 허용한다.
+- Collection 관리 목록의 `read/manage/sync`, Knowledge domain 관리 action, raw name,
+  description, child ID/count, source metadata와 permission row를 picker authority나
+  response로 사용하지 않는다.
+- 모든 editable graph persistence path는 structural validation 뒤 current editor 기준
+  direct KB effective `use`와 selected Collection `route`를 다시 확인한다. Direct
+  source-managed KB는 기존 source authorization gate도 통과해야 한다. Direct KB와
+  selected Collection은 active lifecycle이고 `sync_state != source_deleted`여야 하며,
+  direct KB는 retrieval-visible completed chunk를 가져야 한다.
+- Save authorization은 Collection child를 열거하거나 child KB/source permission을
+  평가하지 않는다. Child authorization은 invocation-time MBA-232 resolver가 소유한다.
+- Graph와 success audit write는 기존 transaction 안에서 원자적으로 처리한다. 권한
+  read 뒤 동시 revoke가 commit되어 configuration intent가 남을 수 있어도 저장 결과를
+  runtime capability나 lease로 재사용하지 않고 다음 invocation에서 다시 평가한다.
+- 저장된 reference가 picker에서 사라지면 Client는 순서와 reference를 자동 삭제하지
+  않고 generic unavailable 상태로 표시한다. 새 저장은 해당 reference를 제거하거나
+  권한이 복구될 때까지 generic error로 차단한다.
+
+### Deployment preflight
+
+- Preflight는 두 목록의 shape/limit와 selected resource의 organization/lifecycle/sync,
+  direct KB retrieval-visible readiness, deployment type에서 server-derived한 audience
+  정책을 검증한다.
+- Anonymous surface는 private Collection/KB와 public exposure primitive가 없는
+  source-managed content를 active deployment에 올리지 못한다.
+- `workflow_node_inherited`는 owner나 credential principal로 대체하지 않고 inherited
+  subject warning을 반환한다.
+- Preflight는 child ID, hidden identity, exact denied count를 반환하거나 runtime
+  capability를 발급하지 않는다. Candidate budget 초과 가능성은 bucket과
+  `candidate_budget_limited`의 보수적 warning으로만 표현한다.
+- Runtime은 preflight 성공 여부와 무관하게 invocation 시점에 다시 resolve한다.
+
+### Workflow runtime wiring
+
+- Direct-only, Collection-only, mixed Knowledge configuration은 모두 MBA-232
+  `KnowledgeRuntimeCandidateResolver`를 LLM invocation마다 정확히 한 번 호출한다.
+- Execution audience는 server-verified organization과 explicit user
+  `execution_subject` 또는 `AnonymousPublicAudience`로만 만든다. Workflow owner,
+  builder, deployment owner, app creator, credential principal과 `user_id`를 Knowledge
+  audience로 fallback하지 않는다.
+- Resolver가 반환한 ordered canonical KB ID만 기존 bounded retrieval fan-out에
+  전달한다. Direct와 여러 Collection에서 중복된 KB는 한 번만 검색한다.
+- `source_deleted` parent Collection은 route permission이나 남아 있는 membership과
+  무관하게 invocation snapshot에서 제외한다.
+- Policy상 candidate 0개는 retrieval/embedding/provider를 호출하지 않는 safe
+  no-result다. Resolver infrastructure failure는 `ragFailurePolicy`로 정상 empty
+  result로 낮추지 않고 raw exception 없는 retryable workflow failure로 전파한다.
+- Resolver 이후 일부 authorized KB retrieval timeout은 기존 bounded partial-result와
+  evidence sufficiency policy가 처리한다. 근거가 충분하지 않으면 ungrounded provider
+  호출을 하지 않는다.
+- LLM node는 Collection membership, Collection permission과 child KB permission SQL을
+  직접 실행하지 않는다. MBA-232 adapter가 유일한 runtime candidate authorization
+  경계다.
+
+### Graph consumers and projection
+
+- Agent Builder, cost optimizer, model-routing refresh, compare/copy/import와 deployment
+  snapshot은 operation이 Collection selection을 명시적으로 편집하지 않는 한
+  `knowledgeCollections`를 그대로 보존한다.
+- Agent Builder의 현재 recommendation은 direct KB만 materialize하며 Collection을
+  자동 선택하지 않는다.
+- Pre-execution Knowledge sync는 explicit `knowledgeBases`만 처리한다. Collection
+  children을 미리 확장하거나 live connector를 호출하지 않는다.
+- Public app/deployment graph projection은 `knowledgeBases`와
+  `knowledgeCollections`를 모두 제거한다.
+
+### Observability and failure projection
+
+- Durable trace/log/audit에는 routing mode, configured/selected count bucket,
+  budget/scan limited flag, partial/failure bucket, fixed reason code와 latency만 추가할
+  수 있다.
+- Collection ID/name, provenance Collection ID, hidden KB ID, child list/count, raw graph,
+  query, source path/URL/title/ACL, credential, prompt/completion과 provider raw payload를
+  새로 저장하거나 response/SSE error에 포함하지 않는다.
+- Policy exclusion은 hidden resource별 denial audit을 만들지 않는다. 기존 authorized
+  KB retrieval audit과 generic request-scoped policy/audit boundary는 유지한다.
+
+### Rollout and rollback
+
+- 새 graph field를 노출하기 전에 모든 Workflow Worker를 MBA-233 code로 배포하고 구
+  task를 drain한다. 그 다음 Gateway save/preflight를 배포하고 Client selector를
+  마지막에 노출한다.
+- Rollback은 Client 노출 중지, Gateway write 중지, queue drain, Worker rollback의
+  역순이다. Collection graph를 구 Worker가 소비할 수 있는 동안에는 rollback을
+  완료한 것으로 보지 않는다.
+- 현재 일반 Worker capability registry가 없으므로 자동 version negotiation을
+  구현됐다고 주장하지 않는다. 기존 direct-only graph는 additive field 부재를 빈
+  Collection 목록으로 해석해 호환한다.
+
+## Consequences
+
+장점:
+
+- 사용자는 direct KB와 관리자가 묶은 Collection을 같은 LLM node에서 명시적으로
+  조합할 수 있다.
+- Builder visibility, save authorization, deployment preflight와 runtime authorization이
+  서로 capability를 재사용하지 않는다.
+- Dynamic Collection membership과 permission 변경이 graph rewrite 없이 다음
+  invocation에 반영된다.
+- 구 graph는 유지하면서 silent truncation과 구 Worker의 ungrounded 실행을 차단한다.
+
+비용:
+
+- Shared, Gateway, Client, Workflow Engine과 deployment preflight의 graph consumer를
+  모두 분류하고 테스트해야 한다.
+- Worker-first drain이 필요하며 현재는 자동 capability negotiation이 없다.
+- Invocation마다 MBA-232 snapshot query 비용이 발생한다.
+
+## Follow-up
+
+- Query-aware organization-wide Collection discovery와 Agent Builder Collection 자동
+  추천은 별도 이슈다.
+- Service account/operator Knowledge audience, live source authorization/cache와 source
+  public exposure store는 각각 별도 결정이 필요하다.
+- Hierarchical chunking, reranking, query rewrite와 retrieval quality tuning은 이 ADR의
+  graph/routing 통합 범위가 아니다.
diff --git a/docs/decisions/README.md b/docs/decisions/README.md
index add590890..44786a29c 100644
--- a/docs/decisions/README.md
+++ b/docs/decisions/README.md
@@ -55,9 +55,10 @@ ADR 본문은 작성 시점의 결정 과정을 보존하는 기록 문서다. `
 | [ADR-0033](ADR-0033-conversation-memory-contract-completion.md) | Accepted | Conversation Memory 계약 공백 보정 | Runtime provenance에 활성 control dependency를 포함하고 ProviderExecutionCapability authority를 LLM Credentials로 고정한다. 초기 session surface에서 Workflow Editor test를 제외하며 Access Grant V1은 standalone rotation/grace 없이 즉시 replacement/revoke한다. 현재 target 설계이며 legacy Memory 구현 완료를 의미하지 않는다. |
 | [ADR-0034](ADR-0034-knowledge-delegated-administration-and-rbac-boundary.md) | Accepted | Knowledge 위임 관리와 KB RBAC 경계 | MBA-231은 owner를 귀속 정보로 전환하고 KB object/property action, Team/User Knowledge domain delegation, self-escalation 차단, transaction-bound audit, public exposure·hard delete 조직 관리자 경계를 구현한다. |
 | [ADR-0035](ADR-0035-external-effect-idempotency-boundary.md) | Accepted | Workflow external effect 멱등성 경계 | 모든 실행 표면의 stable execution/node invocation identity와 compare variant 분리, operation 변경 우회를 막는 stable effect slot, 독립 DB session을 사용하는 durable attempt, 같은 execution 재진입과 claim loser 처리, 고정 replay deadline, supported operation에만 적용하는 versioned HMAC key, canonical JSON 최대 65,536-byte replay result와 변경 불가능한 provider contract profile을 확정했다. MBA-190 시점 Generic HTTP mutation과 Slack은 replay `unknown`, GitHub issue comment는 `unsupported`인 보수적 baseline을 구현했으며, 현재 Slack provider 계약은 ADR-0037이 보정한다. |
-| [ADR-0036](ADR-0036-knowledge-runtime-candidate-resolution.md) | Accepted | Knowledge runtime candidate resolution 경계 | MBA-232 target은 direct KB와 명시 selected Collection을 execution audience 기준으로 재평가하는 pure policy, Workflow Engine use case/port, PostgreSQL repeatable-read read-only adapter다. API/graph/Builder/preflight/LLM wiring은 MBA-233 범위이며 MBA-232 code 반영 여부는 구현 커밋에서 갱신한다. |
+| [ADR-0036](ADR-0036-knowledge-runtime-candidate-resolution.md) | Accepted | Knowledge runtime candidate resolution 경계 | MBA-232는 direct KB와 명시 selected Collection을 execution audience 기준으로 재평가하는 pure policy, Workflow Engine use case/port, PostgreSQL repeatable-read read-only adapter와 실제 PostgreSQL snapshot/동시성 검증을 구현했다. Graph/Builder/preflight/LLM wiring은 [ADR-0039](ADR-0039-knowledge-workflow-collection-routing-integration.md)이 소유한다. |
 | [ADR-0037](ADR-0037-slack-dedicated-delivery-boundary.md) | Accepted | Slack 전용 전달과 외부 부수효과 경계 | Slack API/Webhook을 전용 operation과 strict response parser로 분리한다. Provider replay는 `unknown`으로 유지하고 성공 safe projection만 durable result로 재사용하며, `429`와 outcome-unknown은 자동 replay하지 않는다. 기존 `slack.http.request.v1`은 과거 attempt 해석용으로 보존한다. |
 | [ADR-0038](ADR-0038-workflow-aware-adaptive-routing.md) | Accepted | Workflow-Aware Adaptive Routing | 채택된 목표는 운영/Replay evidence, Hard Gate, 적합성 분석, 품질 gate와 결정론적 optimizer를 통과한 후보만 active policy에 반영하는 것이다. 현재 코드는 policy/runtime/trace 기반까지 구현됐고 Replay evidence 연결과 optimizer는 FR-011 진행중이다. |
+| [ADR-0039](ADR-0039-knowledge-workflow-collection-routing-integration.md) | Accepted | Workflow Knowledge Collection 라우팅 통합 | MBA-233은 additive `knowledgeCollections` graph, route-safe Builder picker, save-time `use`/`route` 재검증, deployment preflight와 MBA-232 resolver의 LLM/retrieval 연결을 구현한다. Worker-first drain 뒤 Client를 노출하고 public projection과 durable observability에서 Collection identity를 제거한다. |
 
 ## 참고 보고서
 
diff --git a/docs/features/deployment/api_spec.md b/docs/features/deployment/api_spec.md
index 6fa6270c3..1a1cb2ecd 100644
--- a/docs/features/deployment/api_spec.md
+++ b/docs/features/deployment/api_spec.md
@@ -1,7 +1,7 @@
 # Deployment API Spec
 
 Status: Draft
-Verified Against: TBD
+Verified Against: `feature/mba-233 @ b4ff694f`
 
 ## Endpoints
 
@@ -58,21 +58,23 @@ Conversation-capable target snapshot은 별도 server-derived metadata로 immuta
 
 Preview response uses `200 OK` even when blocked:
 
-When `is_active=false`, preview reflects inactive-save context by returning activation blockers as `status="warning"` while keeping safe reason codes and required actions. Create with `is_active=true` and later activation/toggle still use blocking `409` enforcement.
+When `is_active=false`, preview reflects inactive-save context by returning audience/lifecycle activation blockers as `status="warning"` while keeping safe reason codes and required actions. Malformed or over-limit Knowledge reference configuration and existing workflow-node structural errors remain blocked. Create with `is_active=true` and later activation/toggle use blocking `409` enforcement.
 
 ```json
 {
   "status": "blocked",
   "audience": "anonymous_public",
   "safe_summary": {
-    "blocked_reason": "private_kb_requires_execution_subject",
+    "blocked_reason": "private_collection_requires_execution_subject",
     "affected_node_count": 1,
-    "affected_kb_count_bucket": "1"
+    "affected_kb_count_bucket": "0",
+    "affected_collection_count_bucket": "1",
+    "candidate_budget_limited": false
   },
   "required_actions": [
     {
-      "action": "remove_private_kb_or_use_authenticated_run",
-      "label": "Private KB를 제거하거나 인증 실행 경로를 사용하세요"
+      "action": "remove_private_collection_or_use_authenticated_run",
+      "label": "Private Collection을 제거하거나 인증 실행 경로를 사용하세요"
     }
   ],
   "warnings": [],
@@ -81,8 +83,10 @@ When `is_active=false`, preview reflects inactive-save context by returning acti
       "node_id": "llm-1",
       "node_type": "llmNode",
       "status": "blocked",
-      "reason_codes": ["private_kb_requires_execution_subject"],
-      "knowledge_base_count_bucket": "1"
+      "reason_codes": ["private_collection_requires_execution_subject"],
+      "knowledge_base_count_bucket": "0",
+      "knowledge_collection_count_bucket": "1",
+      "candidate_budget_limited": false
     }
   ]
 }
@@ -96,7 +100,39 @@ When `is_active=false`, preview reflects inactive-save context by returning acti
 | `warning` | 저장은 가능하지만 활성화 전 확인이 필요한 비차단 이슈 있음 |
 | `blocked` | 활성 deployment surface에 올릴 수 없음 |
 
-Response는 hidden KB id/name/path, exact denied count, raw source metadata, raw exception을 포함하지 않는다.
+Preflight가 해석하는 LLM node graph field는 다음 두 목록이다.
+
+- `knowledgeBases`: 최대 20개의 `{ "id": "<canonical-uuid>", "name": "<bounded-display>" }` 객체
+- `knowledgeCollections`: 최대 20개의 `{ "id": "<canonical-uuid>", "safeLabel": "<optional-bounded-display>" }` 객체
+
+Display field는 응답 표시 snapshot일 뿐 authorization이나 routing 입력이 아니다. 목록이 아닌 값, 허용되지 않은 field, non-canonical UUID, control character, 21번째 항목은 fixed configuration reason으로 차단한다.
+
+Additive safe result fields:
+
+| Field | Meaning |
+| --- | --- |
+| `safe_summary.affected_collection_count_bucket` | 이슈에 포함된 Collection 수의 안전한 bucket. 실제 hidden membership 수가 아님 |
+| `safe_summary.candidate_budget_limited` | direct configured refs와 selected Collection active-member aggregate상 runtime 후보 20개 제한 가능성 |
+| `nodes[].knowledge_collection_count_bucket` | 해당 node 이슈의 안전한 Collection count bucket |
+| `nodes[].candidate_budget_limited` | 해당 node의 보수적 후보 제한 가능성 |
+
+MBA-233 Knowledge reason/action code는 다음과 같다.
+
+| Reason code | Status | Required action |
+| --- | --- | --- |
+| `knowledge_reference_invalid` | blocked | `fix_invalid_knowledge_references` |
+| `knowledge_reference_limit_exceeded` | blocked | `reduce_knowledge_references` |
+| `knowledge_base_unavailable` | blocked 또는 inactive warning | `remove_unavailable_kb_reference` |
+| `knowledge_collection_unavailable` | blocked 또는 inactive warning | `remove_unavailable_collection_reference` |
+| `private_kb_requires_execution_subject` | blocked 또는 inactive warning | `remove_private_kb_or_use_authenticated_run` |
+| `private_collection_requires_execution_subject` | blocked 또는 inactive warning | `remove_private_collection_or_use_authenticated_run` |
+| `source_public_exposure_required` | blocked 또는 inactive warning | `approve_source_public_exposure_or_remove_reference` |
+| `knowledge_candidate_budget_limited` | warning | `review_knowledge_candidate_selection` |
+| `workflow_node_execution_subject_inherited` | warning | `verify_parent_execution_subject` |
+
+`knowledge_candidate_budget_limited`만 있는 preview는 `status="warning"`이며 active create를 차단하지 않는다. Runtime의 실제 candidate resolution이 current permission, membership, lifecycle, readiness, source policy와 dedupe를 다시 적용하므로 preflight boolean은 capability나 exact count가 아니다.
+
+Response는 hidden KB/Collection/child id, name, label, path, exact denied/member count, raw graph/source metadata, raw exception을 포함하지 않는다. Public graph projection은 root와 embedded subgraph의 두 Knowledge reference 배열도 제거한다.
 
 ### Create / Activation Blocking
 
@@ -106,6 +142,8 @@ Response는 hidden KB id/name/path, exact denied count, raw source metadata, raw
 
 Public `type="chatbot"`은 항상 `public_chatbot` audience로 preflight하므로 private KB 후보가 있으면 activation이 차단된다. 별도 authenticated internal Chatbot surface는 public Chatbot audience를 완화하거나 login cookie를 public route에 선택적으로 붙이는 방식으로 제공하지 않는다. 해당 기능은 별도 deployment access policy와 runtime/session namespace가 구현된 뒤 독립 preflight를 사용한다.
 
+Selected Collection 검사는 selected ID와 active organization으로 범위를 제한하고 active lifecycle과 `sync_state != source_deleted`를 요구한다. Missing, inactive, deleted, source-deleted, cross-organization Collection은 존재 여부를 구분하지 않고 `knowledge_collection_unavailable`로 처리한다. Direct KB는 같은 lifecycle/sync 경계와 retrieval-visible completed chunk readiness를 통과해야 한다. Anonymous-public surface에서 active private Collection은 차단되며, public Collection 자체 또는 active member가 source-managed이면 별도 public source exposure primitive가 없는 현재 구현에서 fail-closed한다. Child ID나 exact membership count는 preflight port/result로 전달하지 않는다.
+
 Conversation Memory target activation은 explicit input/output mapping, node Memory policy, immutable deployment/snapshot binding, Memory contract/storage generation과 capable Worker routing을 함께 검사한다. Schedule/webhook/API batch, workflow-node direct run과 일반 authenticated deployment run은 target session을 암묵적으로 생성하지 않는다.
 
 Schedule records and scheduler jobs are created only for active `type="schedule"` deployments. A `scheduleTrigger` node inside any other deployment type, including `workflow_node`, does not create a schedule surface.
@@ -193,7 +231,9 @@ Blocking preflight failure:
         "safe_summary": {
           "blocked_reason": "private_kb_requires_execution_subject",
           "affected_node_count": 1,
-          "affected_kb_count_bucket": "1"
+          "affected_kb_count_bucket": "1",
+          "affected_collection_count_bucket": "0",
+          "candidate_budget_limited": false
         }
       }
     }
diff --git a/docs/features/deployment/component_spec.md b/docs/features/deployment/component_spec.md
index ed3e435e9..e0b38e5b2 100644
--- a/docs/features/deployment/component_spec.md
+++ b/docs/features/deployment/component_spec.md
@@ -1,7 +1,7 @@
 # Deployment Component Spec
 
 Status: Draft
-Verified Against: TBD
+Verified Against: `feature/mba-233 @ 90da2f84`
 
 ## Screens
 
@@ -12,6 +12,8 @@ Verified Against: TBD
 
 - `DeploymentFlowModal` calls `POST /api/v1/deployments/preflight` before active create.
 - If preview returns `blocked`, deployment creation is not attempted and the existing error step displays safe reason labels and required actions.
+- If preview returns `warning`, deployment creation continues. The successful deployment result carries only the formatted safe warning, and `SuccessStep` displays it in an amber text banner with `role="status"`.
+- Collection preflight copy may show affected Collection count bucket and candidate-budget-limited boolean. It never renders selected Collection/child identifiers, labels, membership, or exact hidden counts.
 - Existing activation toggle controls surface `deployment.preflight.blocked` responses without showing hidden KB identity.
 - Active delete controls do not need preflight display in MBA-176 because delete no longer auto-promotes another deployment.
 - Target Conversation Memory preflight snapshot includes immutable deployment version/snapshot hash, conversation mapping and node Memory policy version, contract/storage generation and required Worker capability. Runtime revalidates the same binding and never resolves an existing session through the latest active deployment pointer.
@@ -54,13 +56,14 @@ Verified Against: TBD
 
 - `checking`: Preflight/create request in progress.
 - `passed`: Preflight 통과 후 create를 계속 진행한다.
-- `warning`: 현재 UI는 별도 warning panel을 표시하지 않고 create를 계속 진행한다.
+- `warning`: Create를 계속 진행하고 성공 화면에 non-blocking preflight warning을 표시한다.
 - `blocked`: 활성 배포 생성/전환 불가. Error step 또는 toggle error message로 표시한다.
 - `error`: 네트워크 또는 validation error. Hidden resource detail을 표시하지 않는다.
 
 ## Interactions
 
 - Preview endpoint의 blocked response는 API 오류가 아니라 검사 결과로 처리하며, active create 요청을 보내지 않는다.
+- Preview endpoint의 warning response는 active create를 계속하고 성공 결과에 safe warning text를 결합한다. Candidate budget warning을 배포 실패로 바꾸지 않는다.
 - `is_active=false` 저장은 blocked preview가 있더라도 허용할 수 있지만, 현재 deployment modal은 active create만 제공한다.
 - Active create 또는 activation toggle에서 `409 deployment.preflight.blocked`가 오면 error/blocked message로 safe reason과 required actions를 보여준다.
 - Workflow-node 대상은 node 설정의 target app 기준으로 검사된다는 점을 내부 상태에서 유지한다. UI copy는 workflow id나 hidden target identity를 노출하지 않는다.
@@ -68,4 +71,5 @@ Verified Against: TBD
 ## Accessibility
 
 - Preflight status는 색상만으로 구분하지 않고 text label을 제공한다.
+- 성공 화면의 non-blocking warning은 `role="status"`와 text reason/action을 제공한다.
 - Required action list는 keyboard focus 순서 안에 있어야 하며, hidden KB id/name/path를 포함하지 않는다.
diff --git a/docs/features/deployment/requirements.md b/docs/features/deployment/requirements.md
index d3ddd7cc9..b54bbf381 100644
--- a/docs/features/deployment/requirements.md
+++ b/docs/features/deployment/requirements.md
@@ -2,6 +2,7 @@
 
 Status: Draft
 Related Features: workflow, llm-credentials, audit-tracing, knowledge, chatbot-deployment, conversation-memory
+Verified Against: `feature/mba-233 @ b4ff694f`
 
 ## Purpose
 
@@ -16,8 +17,9 @@ Webhook capture helper는 public webhook 실행 표면이 아니라 로그인한
 ## User Stories
 
 - 빌더로서, 배포를 활성화하기 전에 현재 workflow snapshot이 실제 실행 표면에서 사용할 수 없는 private KB를 참조하는지 알고 싶다.
+- 빌더로서, 직접 선택한 KB와 Collection을 함께 사용하더라도 배포 전에 Collection의 현재 lifecycle·공개 범위·source 정책과 후보 제한 가능성을 안전하게 확인하고 싶다.
 - 운영자로서, public/API/webhook/schedule/chatbot 실행에서 사용자 주체가 없을 때 private KB가 owner 권한으로 조용히 사용되지 않기를 원한다.
-- 감사자로서, 배포 실행 표면별로 RAG 접근 경계가 명시되어 있고 실패 시 hidden KB id/name/count가 노출되지 않기를 원한다.
+- 감사자로서, 배포 실행 표면별로 RAG 접근 경계가 명시되어 있고 실패 시 hidden KB/Collection/child id, name, exact count가 노출되지 않기를 원한다.
 
 ## Functional Requirements
 
@@ -74,6 +76,14 @@ Webhook capture helper는 public webhook 실행 표면이 아니라 로그인한
 - DEP-REQ-051 (Target Memory): Public `chatbot` activation은 public-only audience로 preflight하고 private KB 후보를 계속 차단해야 한다. 별도 authenticated internal Chatbot 기능은 public route의 audience나 optional authentication을 완화하는 방식이 아니라 별도 runtime policy, access permission과 deployment/session namespace를 가져야 한다.
 - DEP-REQ-052 (Target Memory): Public browser Chatbot의 exact Origin/embed/CSP allowlist는 deployment-owned versioned config여야 하며 client hint, wildcard 또는 environment fallback이 enforcement를 완화하지 않아야 한다. 이 config contract가 구현되기 전 browser session surface를 허용해서는 안 된다.
 - DEP-REQ-053 (Target Memory): Deployment runtime은 execution subject, credential principal, billing principal과 audit actor를 별도로 서버에서 파생해야 한다. App/deployment creator를 subject 또는 public audit actor로 합성하지 않아야 하며 Conversation Access Grant는 session 접근에만 사용해야 한다.
+- DEP-REQ-054 (MBA-233): Deployment preflight는 LLM node의 `knowledgeBases`와 `knowledgeCollections`를 동일한 shared strict parser로 검사한다. 각 목록은 최대 20개이며 canonical UUID와 허용된 display field shape만 받는다. malformed 또는 over-limit graph는 inactive preview에서도 warning으로 낮추지 않는 configuration blocker다.
+- DEP-REQ-055 (MBA-233): Preflight repository는 명시적으로 선택된 ID와 active organization에 한정해 active lifecycle과 `sync_state != source_deleted`인 KB/Collection을 검사하고, direct KB에는 save-time과 같은 retrieval-visible completed chunk readiness를 적용한다. Anonymous-public surface는 private Collection을 차단하고, 별도 public source exposure primitive가 없는 동안 source-managed Collection 또는 active source-managed member가 있는 public Collection도 `source_public_exposure_required`로 차단한다.
+- DEP-REQ-056 (MBA-233): `workflow_node` preflight는 current owner/creator/credential을 subject로 합성하지 않고 inherited-subject warning을 반환한다. Embedded `subGraph`와 bound workflow-node target graph에도 같은 strict reference와 audience 규칙을 적용하며, embedded graph 순회는 비정상적인 깊이에서도 호출 스택에 의존하지 않는다.
+- DEP-REQ-057 (MBA-233): Candidate budget preflight는 selected Collection의 same-organization active member aggregate만 내부적으로 사용하고 child ID를 application result나 API에 반환하지 않는다. Direct configured count와 bounded aggregate가 runtime 후보 예산 20을 넘을 수 있으면 `knowledge_candidate_budget_limited` warning과 bucket/boolean만 반환한다. Collection overlap으로 인한 보수적 과대 경고는 허용하지만 exact unique/hidden count를 노출해서는 안 된다.
+- DEP-REQ-058 (MBA-233): `knowledge_candidate_budget_limited`는 non-blocking warning이다. Client는 active create를 계속하고 성공 화면에 fixed reason/action과 bucket 기반 경고를 text로 표시한다. `blocked` 결과에서는 create를 호출하지 않는다.
+- DEP-REQ-059 (MBA-233): Preflight 통과, Builder picker 결과, saved display label은 runtime capability가 아니다. Workflow Engine은 각 Knowledge-enabled LLM invocation에서 current execution audience로 candidate resolver를 다시 호출하고, 이후 revoke/lifecycle/membership/source 변경을 현재 상태로 반영한다.
+- DEP-REQ-060 (MBA-233): Public graph projection은 root와 embedded subgraph의 LLM node에서 `knowledgeBases`와 `knowledgeCollections`를 모두 제거한다. Preflight 응답과 409 envelope은 fixed reason/action, node type/id, count bucket과 제한 boolean만 포함하고 Collection/child identity, label, raw graph/source/exception을 포함하지 않는다.
+- DEP-REQ-061 (MBA-233): Client-supplied `audience`는 anonymous-public surface를 authenticated로 완화할 수 없다. `authenticated_user` override는 server-owned application boundary에서만 사용할 수 있고 현재 public deployment endpoint는 이를 전달하지 않는다.
 
 ## Runtime Audience Matrix
 
diff --git a/docs/features/deployment/test_cases.md b/docs/features/deployment/test_cases.md
index c7d4cc76d..cc1324680 100644
--- a/docs/features/deployment/test_cases.md
+++ b/docs/features/deployment/test_cases.md
@@ -1,13 +1,17 @@
 # Deployment Test Cases
 
 Status: Draft
-Verified Against: TBD
+Verified Against: `feature/mba-233 @ b4ff694f`
 
 ## Unit Tests
 
 - Deployment application package는 FastAPI, SQLAlchemy, DB model, concrete adapter/service/composition module을 import하지 않는다.
 - Pure preflight use case는 repository port snapshot만으로 결과를 만들고 active blocker는 HTTPException이 아닌 typed `DeploymentPreflightBlocked`를 반환한다. Compatibility facade만 이를 기존 409 envelope으로 mapping한다.
-- Preflight graph scanner는 LLM node RAG 옵션의 explicit/materialized KB 후보를 찾고 unsupported shape는 safe warning 또는 blocked reason으로 낮춘다.
+- Preflight graph scanner는 shared strict parser로 root/embedded LLM node의 direct KB와 Collection 목록을 검사한다. Malformed shape와 20개 초과는 active/inactive 여부와 무관한 fixed non-downgradable blocker다.
+- Embedded `subGraph` 순회는 반복 방식이며 호출 스택보다 깊은 입력에서도 같은 Collection audience policy를 적용한다.
+- Selected Collection repository projection은 selected IDs, active organization, active lifecycle, `sync_state != source_deleted`로 제한하고 same-organization active/retrieval-visible KB aggregate만 계산한다. Direct KB preflight도 retrieval-visible completed chunk가 없는 KB를 generic unavailable로 처리한다. Child ID를 application result로 반환하거나 Collection별 N+1 query를 만들지 않는다.
+- Anonymous-public preflight는 private Collection과 source-managed Collection/member를 fail-closed하고, public manual Collection은 통과시킨다. Missing/inactive/cross-org는 하나의 generic unavailable code로 처리한다.
+- Candidate budget 가능성은 bucket/boolean warning으로만 반환되고 active create를 차단하지 않는다. Client success step은 warning을 text status로 표시한다.
 - Runtime audience resolver는 `api`, `webapp`, `widget`, `chatbot`, `mcp`, `schedule`, `webhook`를 anonymous public-only로 판정한다.
 - `workflow_node` direct public/API/webhook/authenticated run execution is rejected. Subworkflow audience resolver는 parent execution subject를 상속하고, subject가 없으면 anonymous public-only로 판정한다.
 - Workflow-node target resolver는 `workflowNode.data.appId`를 사용하고 `workflowId`로 target app을 찾지 않는다.
@@ -16,6 +20,7 @@ Verified Against: TBD
 - Workflow-node target unavailable, cycle, depth cap 초과는 `workflow_node_inherited` audience나 inactive preview에서도 warning으로 낮추지 않고 blocked로 유지한다.
 - Scheduler service는 active `type=schedule` deployment만 로드/실행하고, non-schedule deployment id로 job이 호출되면 dispatch하지 않는다.
 - Preflight response sanitizer는 hidden KB id/name/path, exact denied count, raw source metadata, raw exception을 제거한다.
+- Preflight response/409/public graph projection은 Collection/child ID, label, membership, exact count와 두 Knowledge reference 배열을 노출하지 않는다.
 - Central deployment runtime policy matrix는 public info, authenticated run/run-info, API secret run, webhook run, schedule run, workflow-node child run surface별 허용 deployment type을 고정하고 unknown surface/type을 fail-closed로 거부한다. 기본 policy는 불변 객체이며 composition dependency로 교체 주입할 수 있지만 환경변수나 전역 mutation으로 확장할 수 없다.
 - Schedule occurrence key/state/reason/settings helper는 DB/framework 없이 테스트하고 naive datetime, unknown state/reason, mutable settings input을 fail-closed한다.
 - Schedule application use case는 access-management command/model/port/recorder와 FastAPI/Celery/SQLAlchemy query를 import하지 않는다. Schedule 전용 audit port를 사용하고 concrete Gateway UnitOfWork만 composition에서 주입한다.
@@ -98,6 +103,7 @@ Verified Against: TBD
 - Preflight preview는 workflow deploy/manage 권한 없이는 호출할 수 없다.
 - Organization member이지만 KB `use` 권한이 없는 사용자의 private KB 후보는 authenticated run에서는 denied 또는 unavailable로 표시되고, anonymous deployment에서는 blocked로 표시된다.
 - Client-supplied `audience` hint는 create/activation의 server-derived audience 차단을 완화하지 못한다.
+- `authenticated_user` application override가 명시된 내부 use-case 테스트 외에는 public deployment service가 authenticated override를 전달하지 않는다.
 - System schedule의 LLM credential permission denial은 credential principal을 user audit actor로 사용하지 않고 system actor로 기록한다.
 - Terminal cleanup은 retention을 지난 일반 dead-letter와 검토 완료 `execution_outcome_unknown` claim을 정리하지만, `outcome_reviewed_at`이 null인 `execution_outcome_unknown` claim은 보존한다.
 - `disabled` mode는 BackgroundScheduler job 또는 legacy direct enqueue를 만들지 않는다. Schedule 실행이 필요한 환경은 drain 검증 없이 fallback하지 않고 `claim` mode activation 절차를 사용한다.
@@ -106,6 +112,9 @@ Verified Against: TBD
 
 - workflow-node target active deployment가 없으면 safe blocked/warning reason을 반환하고 target app hidden identity를 노출하지 않는다.
 - workflow-node 순환 또는 depth cap 초과는 safe blocked reason으로 닫는다.
+- 1,100단계 embedded subgraph도 recursive stack error 없이 검사하고 최하위 Collection blocker를 반환한다.
+- Direct-only, Collection-only, mixed preflight 결과는 기존 KB bucket을 보존하면서 additive Collection bucket/limit flag를 반환한다.
+- Warning-only preflight 뒤 create가 정확히 한 번 호출되고 성공 결과에 safe warning이 표시되며, blocked preflight 뒤에는 create가 호출되지 않는다.
 - workflow-node target이 현재 활성화 후보 app을 다시 참조하면 기존 active deployment가 아니라 candidate graph 기준으로 순환을 감지한다.
 - 일부 authorized KB의 operational failure는 Knowledge partial-result 정책으로만 표시하고 preflight permission denial과 섞지 않는다.
 - Conversation-capable activation preflight는 input/output mapping, node Memory policy, immutable deployment version/snapshot hash, contract/storage generation과 Worker capability 누락을 각각 fail-closed 한다.
diff --git a/docs/features/knowledge/api_spec.md b/docs/features/knowledge/api_spec.md
index 152222b4b..35ae9c517 100644
--- a/docs/features/knowledge/api_spec.md
+++ b/docs/features/knowledge/api_spec.md
@@ -8,7 +8,7 @@ Status: Draft
 | Method | Path | 목적 | 권한 경계 |
 | --- | --- | --- | --- |
 | GET | `/api/v1/knowledge` | 현재 KB 목록 | Active organization에서 KB `read`가 허용된 active KB만 반환하고 unauthorized row/count는 생략한다 |
-| GET | `/api/v1/knowledge/llm-selectable` | Workflow LLM node RAG picker용 KB 후보 목록 | `X-Organization-Id` active organization 필수. active organization 안에서 caller가 KB `use` 권한을 가진 KB만 반환한다. 반환 후보는 retrieval-visible `completed` document chunk가 1개 이상 있어야 하며, runtime은 실행 시점 execution subject 기준으로 다시 권한을 평가한다 |
+| GET | `/api/v1/knowledge/llm-selectable` | Workflow LLM node RAG picker용 KB 후보 목록 | `X-Organization-Id` active organization 필수. active lifecycle이고 `sync_state != source_deleted`이며 caller가 KB `use` 권한을 가진 KB만 반환한다. 반환 후보는 retrieval-visible `completed` document chunk가 1개 이상 있어야 하며, runtime은 실행 시점 execution subject 기준으로 다시 권한을 평가한다 |
 | POST | `/api/v1/knowledge` | 빈 KB 생성 | Active organization에 KB, 생성자의 user-direct `manager`, canonical audit를 한 transaction에서 생성한다. 필수 schema가 준비되지 않으면 `503 knowledge.schema_not_ready`로 fail-closed 처리한다 |
 | GET | `/api/v1/knowledge/{kb_id}` | 현재 KB 상세와 문서 상태 | Active organization + KB `read`. Detail capability는 `can_read/use/write/read_content/manage`와 파생 UI flag로 반환한다 |
 | GET | `/api/v1/knowledge/{kb_id}/documents/{document_id}/edit-config` | Document preview/process 설정 복원 | Active organization + KB `write`. Bounded property/aggregate/serialized-size allowlist만 반환하고 read detail과 encrypted source config를 재사용하지 않는다. 성공 응답은 `Cache-Control: no-store`다 |
@@ -126,6 +126,72 @@ Membership은 configured Collection별 ordered LATERAL cap을 먼저 적용한 b
 intermediate relation에서 round-robin ranking한다. Source-policy/provenance expiry는 같은
 transaction에서 한 번 읽은 `transaction_timestamp()`를 전체 invocation에 재사용한다.
 
+### MBA-233 Workflow Builder Collection Picker
+
+`GET /api/v1/knowledge/llm-selectable-collections`는 authenticated Workflow Builder
+전용 route-safe projection이다. Collection 관리 목록이나 MBA-232 runtime resolver
+response를 재사용하지 않는다.
+
+Request context:
+
+| 항목 | 규칙 |
+| --- | --- |
+| Authentication | 로그인 사용자 필수 |
+| Organization | `X-Organization-Id`로 해석한 active organization |
+| Permission | active lifecycle이고 `sync_state != source_deleted`인 Collection에 대한 current user effective `route` |
+
+서버는 organization/lifecycle과 effective `route`를 SQL query scope에 먼저 적용한 뒤
+최신순 최대 500개를 반환한다. Unauthorized 최근 row를 먼저 500개로 자른 뒤
+authorization하지 않는다. 따라서 500개보다 오래된 authorized Collection도 authorized
+result cap 안에 있으면 후보에 포함된다.
+
+Response:
+
+```json
+{
+  "collections": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "safe_label": "사내 문서"
+    }
+  ]
+}
+```
+
+`safe_label`은 optional이며 approved safe metadata에 값이 없거나 display policy를
+통과하지 못하면 `null`이다. Response에는 raw Collection name/description,
+organization ID, lifecycle/source/system-managed field, member KB ID, exact child count,
+permission row/capability, hidden/unavailable total을 포함하지 않는다. `read`, `manage`,
+`sync` 또는 Knowledge domain action만 있고 `route`가 없는 Collection은 반환하지 않는다.
+다른 organization, inactive/archived/deleted 또는 `source_deleted` Collection은 존재
+여부를 구분하지 않고 생략한다. Schema/DB failure는 raw SQL/exception 없이 fixed safe
+error envelope로 닫는다.
+
+### MBA-233 Editable Graph Reference Authorization
+
+Workflow draft save, Agent Builder apply, optimizer/model-routing graph persistence는
+graph structural validation 뒤 current editor와 active organization으로 Knowledge
+reference를 다시 authorize한다.
+
+| Reference | Save-time gate |
+| --- | --- |
+| Direct KB | same organization, active, `sync_state != source_deleted`, retrieval-selectable, effective KB `use`, applicable materialized source authorization |
+| Selected Collection | same organization, active, `sync_state != source_deleted`, effective Collection `route` |
+
+Collection child membership/KB/source authorization은 save-time에 열거하지 않는다.
+Graph에 direct KB와 Collection reference가 모두 없으면 구조 검증 뒤 authorization context와
+DB permission query를 생략하여 organization이 없는 legacy non-RAG draft 저장을 유지한다.
+Malformed Knowledge field는 이 short-circuit 전에 거부한다.
+Reference 하나라도 실패하면 전체 write와 success audit을 commit하지 않는다. Hidden,
+cross-organization, missing, inactive, revoked와 denied 상태는 외부에서 구분하지 않는
+`knowledge_reference_unavailable` 계열 fixed code와 safe field path만 반환하며 UUID,
+label, raw graph와 permission reason을 echo하지 않는다. Permission query/DB failure는
+retryable safe infrastructure error이고 partial graph를 만들지 않는다.
+
+Save authorization result, picker item과 preflight 결과는 capability/token이 아니다.
+Direct execute/stream graph는 같은 structural contract를 통과하고 invocation-time
+MBA-232 resolver로 current audience를 authorize한다.
+
 ### KB Permission Endpoints
 
 MBA-176의 Knowledge 직접 권한 API는 Organization resource permission surface와 같은 응답 envelope를 사용한다. KB 권한은 organization membership의 대체물이 아니며, active organization member에게만 effective permission으로 적용된다.
@@ -445,9 +511,9 @@ MVP에서 public/private visibility 전환은 organization manager만 허용한
 
 `safe_metadata["visibility"] == "public"`은 anonymous public-only runtime의 collection candidate inclusion flag다. 인증 사용자 KB `use`, source ACL requester authorization, final evidence policy를 대체하지 않는다.
 
-Source-managed KB가 anonymous public-only 후보가 되려면 collection public visibility와 별도 source/connector public exposure approval을 모두 통과해야 한다. Approval row는 `approval_scope`, scope별 target id, `approved_by`, `approved_at`, `expires_at`, `source_identity_id` 또는 connector/source target, `revocation_behavior`, reverification cadence, explicit acknowledgement를 저장해야 한다. `approval_scope`와 target field가 일치하지 않거나 expiry/reverification/revocation 조건이 빠진 broad connector-wide approval은 public-only 후보에서 제외한다.
+Source-managed Collection 또는 source-managed KB가 anonymous public-only 후보가 되려면 collection public visibility와 별도 source/connector public exposure approval을 모두 통과해야 한다. Approval row는 `approval_scope`, scope별 target id, `approved_by`, `approved_at`, `expires_at`, `source_identity_id` 또는 connector/source target, `revocation_behavior`, reverification cadence, explicit acknowledgement를 저장해야 한다. `approval_scope`와 target field가 일치하지 않거나 expiry/reverification/revocation 조건이 빠진 broad connector-wide approval은 public-only 후보에서 제외한다.
 
-MBA-176에서 source/connector public exposure approval primitive가 아직 구현되지 않은 경우, source-managed KB는 public collection에 연결되어 있어도 anonymous public-only 후보로 승격하지 않는다. Deployment preflight와 runtime availability preview는 이를 warning이 아니라 `source_public_exposure_required` blocked reason으로 반환한다.
+MBA-176에서 source/connector public exposure approval primitive가 아직 구현되지 않은 경우, source-managed Collection은 manual child KB만 포함해도 anonymous candidate stream을 만들지 않고 source-managed KB도 public collection에 연결되어 있어도 anonymous public-only 후보로 승격하지 않는다. Deployment preflight와 runtime availability preview는 이를 warning이 아니라 `source_public_exposure_required` blocked reason으로 반환한다.
 
 ### Workflow Runtime RAG Execution Subject
 
@@ -571,6 +637,15 @@ A/B 테스트, 비용 최적화, trace side panel은 다음 redaction-safe summa
 | `insufficiency_reason` | `no_evidence`, `low_score`, `insufficient_citation`, `policy_filtered`, `operational_partial` 같은 safe reason class |
 | `query_rewrite_applied` | Query rewrite 적용 여부 |
 | `query_rewrite_strategy` | `template`, `llm_assisted` 같은 safe strategy summary. Raw rewritten query는 포함하지 않는다 |
+
+Collection-derived candidate가 하나라도 있는 실행은 `authorized_kb_count`와
+`selected_kb_count` exact 값을 생략하고 각각의 `_bucket` field만 저장한다. Candidate
+수에서 유도되는 actual `fanout_concurrency`도 생략한다. Collection-derived evidence는
+child KB별 결과 경계를 재구성할 수 있는 per-KB `rank`도 생략한다. 대신 최종 전역
+정렬·dedupe·top-k 이후 1부터 부여한 `evidence_rank`는 result와 품질 trace에 저장할 수
+있다. 이 값은 해당 invocation의 최종 evidence 순서이며 child KB 경계를 뜻하지 않는다.
+Direct-only 실행은 current user가
+명시적으로 선택하고 authorization된 KB의 기존 exact operational summary를 유지할 수 있다.
 | `source_tier_used` | Authorized evidence 안에서 사용한 safe source tier summary |
 | `evidence_count` / `min_score_bucket` | 실제 evidence 기준 count와 bucketed score summary. Hidden/denied count는 포함하지 않는다 |
 | `skill_id` / `skill_version` | 사용한 Knowledge Skill 식별자와 version. 표시 가능 여부는 skill display policy를 따른다 |
@@ -592,7 +667,7 @@ A/B 테스트, 비용 최적화, trace side panel은 다음 redaction-safe summa
 | Collection sync/remediation | `collection.sync` 또는 organization/admin operation policy. Raw content access를 의미하지 않는다 |
 | Raw content/export | Dedicated raw/compliance endpoint only. Raw/compliance permission, source-managed KB의 fresh source ACL, retention/legal-hold/purge check, response 전 raw access audit이 필요하다. 최종 enum 이름은 RBAC ADR에서 확정한다 |
 
-Response summary와 citation은 KB id, document version id, chunk id, citation id, optional collection id, rank/score, hierarchy path, safe filename/display label, safe metadata summary, policy result, partial marker, bucketed count, retryability, opaque correlation/request id 같은 redaction-safe field만 포함할 수 있다.
+Response summary와 citation은 허용된 KB/document version/chunk identity, citation id, direct KB-local `rank`, 최종 `evidence_rank`, score, hierarchy path, safe filename/display label, safe metadata summary, policy result, partial marker, bucketed count, retryability, opaque correlation/request id 같은 redaction-safe field만 포함할 수 있다. Collection-derived evidence에는 child identity, optional collection id, KB-local `rank`를 포함하지 않는다.
 
 Raw source id/url/path/title, raw source ACL, raw principal, raw source exception, raw query, raw rewritten query, raw answer, raw prompt/completion, raw provider response, raw skill body, hidden skill source reference, content preview, credential value는 durable audit/trace/usage metadata에 저장하지 않는다. `content_preview`는 user-facing response 전용이며 redacted/capped 상태로만 반환하고 durable summary에서 제외한다. Raw artifact를 활성화하더라도 dedicated raw/compliance flow에서만 노출하며 Agent answer, retrieval context, prompt construction, SSE stream에는 사용하지 않는다. Raw/compliance access audit은 safe reference, decision, reason code, retention/legal-hold summary, request/correlation identifier만 저장한다.
 
@@ -624,5 +699,5 @@ Safe no-result/insufficient-evidence response는 `status`, `evidence_sufficient=
 - Multi-KB 또는 collection-routed answer는 `trace_payloads.rag_answer_run_id`나 `llm_usage_logs.rag_answer_run_id`를 추가하지 않는다.
 - Standalone Agent answer lifecycle은 [ADR-0013](../../decisions/ADR-0013-rag-answer-trace-usage-correlation-boundary.md)에 따라 `rag.answer.*`와 `rag_answer_runs`를 사용한다.
 - Workflow runtime RAG evidence는 계속 `trace_payloads.payload_kind='rag.retrieval'`를 사용할 수 있다. Standalone answer는 summary/citation을 RAG-owned record에 저장한다.
-- Trace side panel에는 RAG strategy summary, citation id, KB id, document version id, chunk id, rank/score, safe metadata summary, token/cost/latency summary만 표시한다. 권한 없는 문서명/ID, raw source metadata, raw content, raw prompt/completion은 표시하지 않는다.
+- Trace side panel에는 RAG strategy summary, citation id, 허용된 KB/document version/chunk identity, direct KB-local rank, 최종 evidence rank/score, safe metadata summary, token/cost/latency summary만 표시한다. Collection-derived evidence에는 child identity와 KB-local rank를 표시하지 않는다. 권한 없는 문서명/ID, raw source metadata, raw content, raw prompt/completion은 표시하지 않는다.
 - Skill usage summary는 workflow draft, LLM node의 RAG 옵션, workflow test run, RAG strategy comparison에서 skill id, skill version, freshness state, eval status, safe source tier, safe provenance refs만 포함할 수 있다. Raw skill body, raw source title/path/url, hidden source refs는 표시하지 않는다.
diff --git a/docs/features/knowledge/component_spec.md b/docs/features/knowledge/component_spec.md
index 594c70fcc..f3ca13ba8 100644
--- a/docs/features/knowledge/component_spec.md
+++ b/docs/features/knowledge/component_spec.md
@@ -71,6 +71,27 @@ authorization infrastructure failure는 partial candidate를 반환하지 않는
 whole-resolution failure다. Budget cap은 successful safe warning이며 downstream
 retrieval timeout과 구분한다.
 
+### MBA-233 Workflow Collection Routing Integration
+
+| Component | 책임 | 금지 |
+| --- | --- | --- |
+| Shared Workflow Knowledge Reference Parser | 두 graph list의 shape, canonical UUID, display snapshot, per-list 20 cap을 pure validation하고 configured order/deduped ID를 제공한다 | Graph mutation, silent slicing, permission/DB 조회 |
+| Route-safe Collection Query Service | active organization/lifecycle, non-source-deleted sync state와 current editor effective `route`를 SQL query scope에 먼저 적용하고, authorized result를 정렬·제한한 뒤 UUID와 optional safe label만 projection한다 | 권한 확인 전 row cap, Management response 재사용, raw name/description/child count, runtime authorization |
+| Workflow Knowledge Reference Service | Editable graph write 전에 direct KB active/non-source-deleted/retrieval-visible/effective `use`/source gate와 Collection active/non-source-deleted/`route`를 current editor로 검증하고 whole-write failure를 반환한다. Reference 없는 legacy graph는 구조 검증 뒤 authorization query를 생략한다 | Collection child expansion, saved label/Client capability 신뢰, runtime lease 발급 |
+| Deployment Preflight | 두 list의 structure, lifecycle/sync eligibility, direct KB retrieval-visible readiness와 server-derived audience/public gate를 재귀 graph에 적용하고 safe bucket/action을 반환한다 | Child ID/exact hidden count 공개, preflight를 runtime capability로 재사용 |
+| Workflow LLM Integration | explicit execution audience와 두 configured ID list로 MBA-232 resolver를 invocation당 한 번 호출하고 ordered KB ID를 Retrieval Orchestrator에 전달한다 | Gateway resolver import, LLM node 내부 permission SQL, owner/credential fallback |
+| Public/Observability Projector | public graph에서 두 reference list를 제거한다. Explicit direct KB의 기존 authorized lineage와 KB-local rank는 유지할 수 있다. Collection-derived evidence는 child KB/document/chunk identity와 KB-local rank를 제거하고 최종 병합 evidence rank만 result/quality trace에 남기며, audit은 node-level count bucket으로 집계한다 | Collection identity/provenance, child resource identity/rank, raw graph/query/source/provider payload 저장 |
+
+Builder는 고정 KB와 Knowledge Collection을 별도 selector group으로 표시한다. 각 group은
+독립 `n/20` limit을 가지며 Collection membership이 실행 시점에 다시 계산된다는 설명을
+표시한다. Picker에서 사라진 saved item은 generic unavailable chip으로 보존하고
+사용자가 제거하거나 권한이 복구되기 전 새 저장을 차단한다. Builder 안에서
+Collection 생성/삭제/permission/membership을 관리하지 않는다.
+
+Agent Builder와 optimizer는 기존 Collection selection을 보존하지만 자동으로 새
+Collection을 추천하거나 선택하지 않는다. Runtime sync는 explicit direct KB만 처리하고
+Collection child는 MBA-232 materialized provenance/readiness 결과를 사용한다.
+
 Conversation Memory target adapter는 Knowledge Permission Helper의 bulk 결과를 `decision`, `principal_kind`, opaque `authorization_decision_revision`, `resource_revision`, `policy_revision`, `evaluated_at` contract로 투영한다. Source-managed KB의 source ACL revision은 decision revision에 반영한다. Lifecycle, KB permission, source ACL 중 필요한 revision이 없으면 allow를 추정하지 않고 `unknown`을 반환한다. Anonymous public audience에는 subject ID/revision을 합성하지 않는다.
 
 Retrieval Orchestrator는 최종 evidence와 함께 KB/document version, organization, sensitivity와 authorization-safe reference를 `RuntimeDataDependencyEnvelope`로 발급한다. Raw title/path/URL/content/ACL은 envelope에 포함하지 않는다. Client나 Workflow node가 canonical Knowledge dependency를 발급할 수 없고, V1에서는 answer content에 영향을 준 모든 Knowledge dependency를 필수로 취급한다.
@@ -193,7 +214,7 @@ Purge는 일반 KB lifecycle state가 아니다. Retention/legal-hold purge, raw
 1. Workflow runtime이 run context에서 execution subject를 resolve한다. Interactive run은 request user를 subject로 전달할 수 있다.
 2. Execution subject가 있으면 Knowledge Permission Helper가 해당 subject 기준으로 KB permission과 source ACL/requester authorization을 평가한다.
 3. Execution subject가 없으면 Workflow owner, deployment owner, builder, `user_id`를 silent fallback으로 쓰지 않는다. Runtime은 anonymous public-only로 낮추고, active public collection에 연결된 active KB만 candidate로 남긴다.
-4. Public collection은 `KnowledgeCollection.safe_metadata["visibility"] == "public"`으로 판정한다. 누락 또는 다른 값은 private로 취급한다. Source-managed KB는 Public Exposure Policy Store의 valid source/connector public exposure approval도 통과해야 candidate로 남는다. MBA-176에서 approval primitive가 없으면 source-managed public 후보는 warning이 아니라 `source_public_exposure_required` blocked state로 표시한다.
+4. Public collection은 `KnowledgeCollection.safe_metadata["visibility"] == "public"`으로 판정한다. 누락 또는 다른 값은 private로 취급한다. Source-managed Collection과 source-managed KB는 Public Exposure Policy Store의 valid source/connector public exposure approval도 통과해야 candidate로 남는다. Approval primitive가 없는 현재 anonymous runtime은 `source_identity_id`가 있는 Collection을 child KB 유형과 무관하게 fail-closed 제외하며, source-managed public 후보는 warning이 아니라 `source_public_exposure_required` blocked state로 표시한다.
 5. Workflow가 Knowledge Skill을 사용할 경우 skill visibility, freshness/eval, safe metadata gate도 execution subject가 있을 때 같은 subject 기준으로 평가한다. Anonymous public-only runtime은 skill 선택만으로 private KB 후보를 넓힐 수 없다.
 6. `general`, `permission_scoped`, `task_aware` 등 모든 운영 RAG mode는 subject 기반 gate 또는 anonymous public-only gate와 final evidence gate를 통과한다.
 7. Retrieval strategy, query rewrite, source tier, skill 차이는 gate 이후 authorized/public evidence를 얼마나 넓게 또는 정밀하게 선택하는지에만 영향을 준다.
diff --git a/docs/features/knowledge/requirements.md b/docs/features/knowledge/requirements.md
index fab99f0df..3a6c7300c 100644
--- a/docs/features/knowledge/requirements.md
+++ b/docs/features/knowledge/requirements.md
@@ -18,9 +18,9 @@ Workflow canvas에는 독립형 RAG 실행 노드를 도입하지 않는다. Kno
 - Standalone RAG Agent answer와 trace/usage correlation 경계는 [ADR-0013](../../decisions/ADR-0013-rag-answer-trace-usage-correlation-boundary.md)를 따른다.
 - Knowledge Skill은 [ADR-0015](../../decisions/ADR-0015-knowledge-skill-context-routing-boundary.md)에 따른 provider-neutral target artifact이며, 현재 구현 완료 상태가 아니다.
 - 현재 `documents.meta_info`는 current metadata convention의 source of truth다.
-- Workflow LLM node RAG에서 `execution_subject`가 없으면 현재 MVP는 private KB retrieval을 실패시키는 대신 anonymous public-only로 낮춘다. Public-only 후보는 active Knowledge Collection의 `safe_metadata["visibility"] == "public"`에 연결된 active KB로 제한하고, source-managed KB는 별도 source/connector public exposure approval도 통과해야 한다. MBA-176 범위에서 이 approval primitive가 구현되어 있지 않으면 source-managed public 후보는 warning이 아니라 `source_public_exposure_required` blocked로 처리한다.
+- Workflow LLM node RAG에서 `execution_subject`가 없으면 현재 MVP는 private KB retrieval을 실패시키는 대신 anonymous public-only로 낮춘다. Public-only 후보는 active Knowledge Collection의 `safe_metadata["visibility"] == "public"`에 연결된 active KB로 제한하고, source-managed Collection과 source-managed KB는 별도 source/connector public exposure approval도 통과해야 한다. MBA-176 범위에서 이 approval primitive가 구현되어 있지 않으면 source-managed public 후보는 warning이 아니라 `source_public_exposure_required` blocked로 처리한다.
 - 현재 Gateway `KnowledgeCandidateResolver`는 Builder recommendation/deployment preview용이다. Collection scope 생략 시 route-safe subset 또는 직접 권한 KB fallback을 사용할 수 있으며 Workflow runtime authorization primitive가 아니다. MBA-232 runtime resolver는 명시 selected Collection만 받고 organization-wide fallback을 금지하며 Workflow Engine application/adapter 경계가 소유한다.
-- MBA-232 source-managed authenticated candidate는 현재 DB에 materialize된 `SourceAuthorizationProvenance`만 사용한다. Live connector authorization과 runtime source cache는 이 단계에 구현하지 않는다. Source public exposure primitive가 없으므로 MBA-232 anonymous public-only resolver는 source-managed KB를 모두 fail-closed 제외한다.
+- MBA-232 source-managed authenticated candidate는 현재 DB에 materialize된 `SourceAuthorizationProvenance`만 사용한다. Live connector authorization과 runtime source cache는 이 단계에 구현하지 않는다. Source public exposure primitive가 없으므로 MBA-232 anonymous public-only resolver는 source-managed Collection과 source-managed KB를 모두 fail-closed 제외한다. Source-managed Collection은 manual child KB만 포함해도 anonymous candidate stream을 만들지 않는다.
 - 목표 cutover 전까지 공식 문서는 현재 동작과 목표 모델을 분리해 읽어야 한다.
 
 ## Target Model
@@ -68,7 +68,7 @@ Workflow canvas에는 독립형 RAG 실행 노드를 도입하지 않는다. Kno
 - FR-035m (MBA-241): KB detail/direct document response와 progress SSE는 persisted `error_message` 또는 `processing_current_step` 원문을 반환하지 않는다. Public status별 fixed message와 generic safe failure만 사용하며 legacy `str(exception)` 값도 response, SSE, toast input, audit, log로 재노출하지 않는다.
 - FR-035n (MBA-241): Domain permission revoke는 organization, subject type/id, action을 모두 predicate로 사용하고 existing row를 `FOR UPDATE`로 직렬화한다. 동일 grant에 대한 동시 revoke는 하나만 delete/audit commit하고 나머지는 idempotent unchanged여야 하며 audit failure는 delete를 rollback하고 다른 organization row에는 영향이 없어야 한다.
 - FR-036: Source ACL facts는 Source Authorization Provenance로 materialize하고, permission helper가 mbased KB permission gate와 source ACL/requester authorization gate를 분리해 effective result를 반환한다. Router/retrieval은 permission row를 직접 조합하지 않는다.
-- FR-037: Retrieval과 citation은 citation id, KB id, document version id, chunk id, optional safe source reference, rank, score, safe metadata summary를 반환한다. Raw source content, raw prompt/completion, credential 원문은 audit/trace/usage metadata에 저장하지 않는다.
+- FR-037: Retrieval과 citation은 citation id, 허용된 KB/document version/chunk identity, optional safe source reference, direct KB-local `rank`, 최종 병합 결과의 `evidence_rank`, score, safe metadata summary를 반환할 수 있다. Collection-derived evidence는 child identity와 KB-local `rank`를 생략하고 정렬·dedupe·top-k 이후의 전역 `evidence_rank`만 반환한다. Raw source content, raw prompt/completion, credential 원문은 audit/trace/usage metadata에 저장하지 않는다.
 - FR-038: `document_chunks.content`, embedding input, retrieval-visible text artifact는 redacted canonical text에서 생성한다. Raw source content는 RAG/embedding/prompt에 사용하지 않으며, organization/source policy가 opt-in한 경우에만 protected raw artifact로 분리 저장할 수 있다 ([ADR-0014](../../decisions/ADR-0014-knowledge-base-document-atom-and-collection-boundary.md)).
 - FR-039: Server-side URL fetch, connector preview/test, crawler/sitemap/API connector, DB/SSH/SaaS/object-storage probe는 중앙 outbound egress boundary와 protocol adapter safety policy를 통과해야 한다.
 - FR-040: Partial operational failure는 권한/source ACL failure와 구분한다. 일부 authorized KB retrieval 실패는 safe partial result로 표시할 수 있지만, permission/source ACL/final evidence failure는 evidence 제외 또는 resource-hidden response로 fail-closed한다.
@@ -111,7 +111,7 @@ Workflow canvas에는 독립형 RAG 실행 노드를 도입하지 않는다. Kno
 - FR-073: Runtime source authorization은 `check_access_batch(subject_ref, source_item_refs[])`를 우선 사용해야 한다. Batch 미지원 source는 bounded concurrency, per-call timeout, aggregate timeout을 적용한 single `check_access` fallback만 허용하고, runtime authorization primitive가 없으면 private source-managed KB retrieval은 fail-closed다.
 - FR-074: Runtime access cache는 short-lived여야 하며 organization, connector, protected source identity, source item 또는 document version, execution subject, mapping epoch, source ACL freshness epoch, operation을 key에 포함해야 한다. Subject-level `allowed` 결과를 다른 source item에 재사용해서는 안 된다.
 - FR-075: Live-linked mode는 requester-scoped source-side search API가 있거나 source-side search 결과가 opaque source ref만 반환되고 runtime source authorization 이후에만 title/snippet/count/score 같은 metadata가 노출될 때만 검색 후보가 된다. Broad service account search 결과를 먼저 받고 unauthorized metadata를 사후 제거하는 방식은 기본 구현으로 금지한다.
-- FR-076: Source-managed KB를 anonymous public-only 후보로 포함하려면 collection public visibility approval과 별도 source/connector public exposure approval을 모두 통과해야 한다. Public exposure approval은 bounded `approval_scope`와 target field consistency를 검증하고, invalid scope/target row는 public-only 후보에서 제외해야 한다. MBA-176에서는 public exposure approval primitive가 구현되지 않은 source-managed 후보를 `source_public_exposure_required` blocked로 처리한다.
+- FR-076: Source-managed Collection 또는 source-managed KB를 anonymous public-only 후보로 포함하려면 collection public visibility approval과 별도 source/connector public exposure approval을 모두 통과해야 한다. Public exposure approval은 bounded `approval_scope`와 target field consistency를 검증하고, invalid scope/target row는 public-only 후보에서 제외해야 한다. MBA-176에서는 public exposure approval primitive가 구현되지 않은 source-managed 후보를 `source_public_exposure_required` blocked로 처리한다.
 - FR-077: 외부 source artifact는 egress guard를 통과해도 trusted content가 아니다. Knowledge ingestion은 지원 file type/content type allowlist, macro/script/embedded object/executable 차단, archive depth/expanded-size/file-count cap, parser sandbox 또는 least-privilege worker, malware/content scan hook을 redacted canonical text 생성 전에 적용해야 한다. Scan failure, timeout, unsupported type, active content detection은 indexing-visible artifact를 만들지 않고 fail-closed 또는 remediation으로 처리한다.
 - FR-078: Knowledge Base archive/delete lifecycle mutation은 endpoint에서 직접 permission cleanup, storage cleanup, retrieval exclusion, audit orchestration을 조합하지 않고 lifecycle service boundary를 통과해야 한다. Hard delete는 해당 KB를 참조하는 `team_knowledge_permissions`와 `user_knowledge_permissions` direct grant row를 같은 transaction에서 먼저 정리해 legacy organization mismatch row를 포함한 orphan permission이나 FK failure를 남기지 않아야 한다. FR-048의 cleanup outbox/reconciler가 구현되기 전 MBA-182 current hard-delete baseline에서는 기존 best-effort physical storage cleanup을 lifecycle service 안에서 유지할 수 있지만, storage path/raw exception을 API나 durable log에 노출하면 안 되며 이 baseline을 target cleanup architecture로 간주하지 않는다. Durable lifecycle audit/outbox, idempotent cleanup retry, dead-letter/redrive cutover는 MBA-184에서 구현한다.
 - FR-079: Generic resource permission routing에서 `resource_type="knowledge_base"`는 workflow 또는 LLM credential fallback으로 흐르지 않아야 한다. Gateway registry/service boundary가 resource type별 target model, organization lookup, effective auth resolver, team/user permission table mapping을 소유하고 schema enum과의 contract를 테스트로 고정한다.
@@ -130,6 +130,16 @@ Workflow canvas에는 독립형 RAG 실행 노드를 도입하지 않는다. Kno
 - FR-092 (MBA-232): `KnowledgeCollectionItem`은 lifecycle object가 아니다. Present row는 linked, unlink/missing은 membership 없음이며 Collection과 child KB lifecycle/readiness를 독립적으로 평가한다.
 - FR-093 (MBA-232): Candidate policy exclusion은 identity를 노출하지 않는 safe omission이고 0개는 `safe_no_result`다. DB/session/snapshot/repository/authorization infrastructure failure는 이미 평가한 후보를 반환하지 않는 whole-resolution retryable safe failure이며 retrieval/provider 호출 전에 끝나야 한다. Partial authorized-KB retrieval timeout은 downstream Retrieval Orchestrator/MBA-233 범위다.
 - FR-094 (MBA-232): Shared에는 framework/ORM/runtime concrete import가 없는 immutable contract와 pure merge policy만 두고 Workflow Engine `runtime_retrieval` application use case/port와 PostgreSQL adapter/composition이 concrete resolution을 소유한다. Gateway API, graph schema, Builder/preflight, LLM node와 retrieval wiring은 MBA-233 전까지 변경하지 않는다.
+- FR-095 (MBA-233): LLM node graph는 기존 `knowledgeBases`와 additive `knowledgeCollections`를 함께 저장할 수 있어야 한다. 각 목록은 최대 20개 canonical UUID reference이며 21번째, malformed object, non-canonical UUID, unknown field와 invalid display snapshot을 silent truncation·자동 삭제 없이 저장/실행/배포 전에 거부해야 한다. Collection membership은 graph에 정적 materialize하지 않는다.
+- FR-096 (MBA-233): Builder Collection picker는 active organization에서 active lifecycle이고 `sync_state != source_deleted`인 Collection 중 current editor가 `route` 가능한 항목만 별도 endpoint에서 받아야 한다. Scan/result cap은 effective `route` authorization을 SQL scope에 적용한 뒤 평가하여 최근 unauthorized row가 오래된 authorized Collection을 밀어내지 않아야 한다. Response는 UUID와 display-policy-approved optional safe label만 포함하고 management `read/manage/sync`, domain action, raw name/description, child identity/count, source metadata와 Client capability를 authority로 사용하지 않아야 한다.
+- FR-097 (MBA-233): Editable graph persistence는 current editor 기준으로 direct KB의 active/non-source-deleted/retrieval-selectable/effective `use`와 applicable source authorization, selected Collection의 active/non-source-deleted `route`를 server에서 다시 확인해야 한다. `source_deleted` KB는 과거 ready chunk/version이 남아 있어도 retrieval-selectable이 아니며 `source_deleted` parent Collection도 남아 있는 route grant/membership과 무관하게 unavailable이다. Knowledge reference가 전혀 없는 legacy graph는 nullable organization context 때문에 저장이 차단되지 않지만 malformed Knowledge field는 계속 구조 검증에서 거부한다. 실패한 reference가 하나라도 있으면 graph와 success audit을 원자적으로 저장하지 않고 generic safe error로 닫아야 하며 Collection child를 save-time에 열거하거나 authorize하지 않아야 한다.
+- FR-098 (MBA-233): 저장 시 권한 판정 결과는 runtime capability나 lease가 아니다. 권한 read 뒤 동시 revoke가 commit되어 configuration intent가 남아도 다음 invocation은 MBA-232 resolver로 current permission/source state를 다시 평가해야 한다. Picker에서 사라진 saved reference는 Client가 generic unavailable 상태로 보존하되 새 저장은 제거 또는 권한 복구 전까지 차단한다.
+- FR-099 (MBA-233): Deployment preflight는 direct KB와 selected Collection의 shape/limit, organization/lifecycle/sync eligibility와 server-derived deployment audience를 검증해야 한다. Direct KB에는 save-time과 같은 retrieval-visible completed chunk readiness를 적용하고, direct KB, public membership, Collection candidate aggregate에서 `source_deleted` 또는 retrieval-invisible KB를 제외하며 `source_deleted` parent Collection도 제외하여 runtime resolver와 같은 후보 경계를 유지한다. Anonymous surface의 private resource와 source public exposure primitive가 없는 source-managed content는 active deployment를 차단하고, workflow-node inherited audience는 owner/credential fallback 없이 warning 처리한다. Child identity와 exact hidden/denied count는 반환하지 않는다.
+- FR-100 (MBA-233): Direct-only, Collection-only, mixed LLM invocation은 MBA-232 resolver를 정확히 한 번 호출하고 ordered canonical candidate KB만 기존 bounded retrieval fan-out에 전달해야 한다. Candidate 0개는 embedding/retrieval/provider 호출 없는 safe no-result이며 resolver infrastructure failure는 `ragFailurePolicy`로 낮추지 않는 sanitized retryable whole-invocation failure다.
+- FR-101 (MBA-233): LLM node runtime은 Collection membership/permission 또는 child KB permission SQL을 직접 실행하지 않아야 한다. Execution audience는 server-verified organization과 explicit user execution subject 또는 anonymous public audience만 사용하고 workflow owner, builder, deployment owner, app creator, credential principal과 `user_id`를 Knowledge subject로 fallback하지 않아야 한다.
+- FR-102 (MBA-233): Agent Builder, cost optimizer, compare/copy/import, model-routing refresh와 deployment snapshot은 명시적으로 Collection selection을 편집하지 않는 한 `knowledgeCollections`를 보존해야 한다. 현재 Agent Builder recommendation은 direct KB만 materialize하고 Collection을 자동 선택하지 않으며 pre-execution sync는 explicit direct KB만 처리한다.
+- FR-103 (MBA-233): Public app/deployment graph projection은 `knowledgeBases`와 `knowledgeCollections`를 모두 제거해야 한다. Direct KB evidence는 기존 authorized lineage projection과 KB-local `rank`를 유지할 수 있다. Collection에서 동적으로 유래한 evidence는 result/durable trace/audit에 child KB/document/chunk ID나 KB-local `rank`를 저장하지 않으며, result와 품질 trace에는 정렬·dedupe·top-k 이후의 전역 `evidence_rank`만 저장할 수 있다. Audit은 노드 단위 candidate/result count bucket으로 집계한다. Durable trace/log/audit에는 routing mode, count bucket, limit/failure flag와 fixed safe reason만 허용하고 Collection/hidden KB identity, child structure, raw graph/query/source/credential/provider payload를 추가하지 않아야 한다.
+- FR-104 (MBA-233): `knowledgeCollections`는 기존 graph JSONB의 additive field이며 MBA-233에서 새 DB relation, `llm_node_versions` column 또는 static membership snapshot을 추가하지 않는다. 새 field는 Worker-first 배포와 queue drain 뒤 Gateway write, Client 순서로 노출하고 rollback은 역순으로 수행해야 한다.
 
 ## Policies And Edge Cases
 
@@ -162,7 +172,7 @@ Workflow canvas에는 독립형 RAG 실행 노드를 도입하지 않는다. Kno
 - Destructive reset/reindex, legacy multi-document KB split/backfill, existing `team_knowledge_permissions`/RAG answer reference handling은 G1 data-preservation gate 승인 후에만 진행한다.
 - A/B 테스트나 비용 최적화 UI에서 `general RAG` baseline을 보여줄 때도 권한 없는 문서가 prompt, citation, trace, audit에 들어가면 안 된다. 보안상 안전하지 않은 baseline은 운영 실행이 아니라 historical, simulated, admin-only, 또는 이미 execution subject에게 허용된 resource 안의 비교로 제한한다.
 - 일반 사용자와 workflow 작성자 화면에는 권한/정책상 제외된 문서명, KB id, source path/url/title, 정확한 제외 개수를 표시하지 않는다. 필요한 경우 `권한/정책상 제외된 내부 문서 일부`, bucketed count, safe reason summary 같은 낮은 해상도의 표현만 사용한다.
-- Trace side panel과 A/B 비교 화면은 RAG mode, retrieval strategy, citation id, KB id, document version id, chunk id, rank/score, safe metadata summary, token/cost/latency summary만 표시한다. Raw chunk content, raw source title/path/url, raw prompt/completion/provider response, 권한 없는 문서명/ID는 표시하지 않는다.
+- Trace side panel과 A/B 비교 화면은 RAG mode, retrieval strategy, citation id, 허용된 KB/document version/chunk identity, direct KB-local rank, 최종 evidence rank/score, safe metadata summary, token/cost/latency summary만 표시한다. Collection-derived evidence에는 child identity와 KB-local rank를 표시하지 않는다. Raw chunk content, raw source title/path/url, raw prompt/completion/provider response, 권한 없는 문서명/ID는 표시하지 않는다.
 - Knowledge/RAG는 collection permission의 action 의미와 retrieval access pattern을 정의한다. MBA-105 임시 baseline은 `team_knowledge_collection_permissions`와 `user_knowledge_collection_permissions`를 사용한다. 장기 permission enum integration, inheritance/override behavior, 공통 permission helper 구현은 Auth/RBAC 도메인에서 ADR 또는 RBAC 문서로 확정한다.
 - Skill은 source of truth가 아니라 source-of-truth 선택 절차다. 최종 citation/evidence는 KB/document version/chunk/ADR/decision record 같은 source-of-truth resource를 가리켜야 한다.
 - Skill metadata가 먼저 로드되는 Builder UX/API를 만들더라도 전역 metadata 선노출은 금지한다. Builder에는 authorization-scoped safe skill metadata만 전달하고, skill hint는 실행 시점 permission helper 결과와 교집합 처리한다.
diff --git a/docs/features/knowledge/test_cases.md b/docs/features/knowledge/test_cases.md
index 2e3b8fc5c..2729dbe5f 100644
--- a/docs/features/knowledge/test_cases.md
+++ b/docs/features/knowledge/test_cases.md
@@ -74,7 +74,7 @@ Status: Draft
 - Active ready version 또는 documented completed-document unversioned legacy chunk fallback만 ready다. Archived/deleted/source_deleted/non-ready/pre-finalized 후보는 identity 없이 제외한다.
 - Authenticated source-managed KB는 active/fresh/unexpired/matching materialized `SourceAuthorizationProvenance`가 필요하다. Missing/inactive/stale/unmapped/ambiguous/unverified/revoked/denied/unknown/expired/organization-requester-KB-source mismatch는 fail-closed다.
 - MBA-232 adapter는 connector client, HTTP client, `check_access_batch`, single `check_access`, runtime source authorization cache를 0회 호출한다.
-- Anonymous selected Collection child는 active public Collection의 active/ready manual KB만 허용한다. Direct manual KB도 하나 이상의 active public Collection membership이 필요하다. Source public exposure primitive가 없는 동안 source-managed KB는 public membership과 authenticated provenance가 있어도 모두 제외한다.
+- Anonymous selected Collection child는 active public manual Collection의 active/ready manual KB만 허용한다. Direct manual KB도 하나 이상의 active public manual Collection membership이 필요하다. Source public exposure primitive가 없는 동안 source-managed Collection은 manual child만 포함해도 membership scan 전에 제외하고, source-managed KB는 public membership과 authenticated provenance가 있어도 모두 제외한다. Collection source identity field가 projection에서 누락되거나 malformed이면 anonymous path는 fail-closed다.
 - PostgreSQL adapter는 fresh transaction의 첫 query 전에 `REPEATABLE READ, READ ONLY`를 적용한다. Path-scoped PostgreSQL CI의 two-transaction test에서 resolver 시작 뒤 membership/Collection route/KB use/organization membership/source provenance/Collection lifecycle/KB lifecycle 변경이 commit되어도 current invocation은 한 snapshot만 보고 다음 invocation이 변경을 본다.
 - Source-policy/provenance expiry는 timezone-aware PostgreSQL transaction timestamp 하나로 전체 invocation을 평가한다. KB 순회 중 wall clock이 만료 경계를 지나도 같은 invocation에서 서로 다른 evaluation time을 사용하면 테스트 실패다.
 - Snapshot/repository/authorization infrastructure exception은 fixed safe retryable whole-resolution failure다. 이미 평가한 candidate partial set, raw SQL/exception, identifier, source metadata, exact count를 반환하거나 retrieval/provider mock을 호출하면 테스트 실패다.
@@ -82,6 +82,73 @@ Status: Draft
 - Query count는 candidate/Collection 수에 비례하는 N+1이 아니고 selected 20 Collections/5,000 membership fixture에서도 scan/memory/result가 bounded하고 fair해야 한다. Membership SQL은 Collection별 LATERAL cap을 global window보다 먼저 적용하고 outer `LIMIT`만으로 boundedness를 주장하지 않는다.
 - Shared pure policy는 SQLAlchemy/FastAPI/Celery/Gateway/Workflow Engine concrete package를 import하지 않고 Workflow Engine runtime retrieval production code는 `apps.gateway.*`를 import하지 않는다.
 
+## MBA-233 Workflow Collection Routing Integration Tests
+
+- Legacy direct-only graph, Collection-only graph와 mixed graph가 Shared/Gateway/Worker/
+  Client validator에서 같은 pass/fail 결과를 사용한다. 각 list의 19/20은 성공하고
+  21은 silent slicing 없이 실패한다. Malformed/non-canonical UUID, unknown item field,
+  overlong/control display snapshot과 raw object echo를 거부한다.
+- Route-safe Collection picker는 user-direct/active-Team/organization-manager effective
+  `route` positive case와 read/manage/sync/domain-only, inactive membership, revoked,
+  cross-organization, archived/deleted negative case를 검증한다. Response는 UUID와 optional
+  approved safe label만 가지며 child/source/permission/hidden count를 포함하지 않는다.
+  최근 unauthorized Collection 500개 뒤에 authorized Collection이 있는 fixture와 authorized
+  Collection 501개 fixture로 permission scope가 limit보다 먼저 적용되고 authorized 결과가
+  500개로 제한되는 순서를 검증한다.
+- Draft/Agent Builder/optimizer/model-routing graph save는 direct KB effective `use`와
+  source authorization, Collection `route`를 current editor로 다시 검증한다. 하나라도
+  stale/forged/denied/cross-org이면 partial graph/success audit 없이 whole-write를
+  rollback하고 safe generic error만 반환한다. Knowledge reference가 없는 root/nested legacy
+  graph는 null organization/invalid legacy user identifier로 permission service를 만들지 않지만,
+  malformed empty-list shape는 422 구조 오류로 유지한다. 과거 completed chunk가 남은
+  `source_deleted` direct KB와 route grant/membership이 남은 `source_deleted` parent
+  Collection은 picker, save, preflight와 runtime 모두 거부한다.
+- Collection route는 있지만 child KB/source access가 전부 denied인 graph는 save할 수
+  있고 runtime에서 zero candidate/no provider로 닫힌다. Save-time에 child membership이나
+  source를 query하면 테스트 실패다.
+- PostgreSQL coordinated revoke/save test는 revoke가 authorization read 전에 commit되면
+  save가 실패함을 보이고, read 뒤 revoke 경합으로 configuration intent가 남더라도
+  다음 MBA-232 invocation이 current permission으로 제외하며 save capability를 재사용하지
+  않음을 검증한다.
+- Deployment preview/create/activation/toggle과 nested workflow-node graph는 두 list를
+  검증한다. Anonymous private Collection/direct KB와 source public exposure primitive가
+  없는 source-managed content는 fixed blocker이고 hidden child ID/count를 반환하지 않는다.
+  Direct/public-membership/Collection aggregate query 모두 `source_deleted` KB를 제외하는
+  PostgreSQL predicate를 사용하고 direct KB에는 retrieval-visible completed chunk
+  readiness를 적용하며 runtime resolver eligibility와 어긋나면 테스트 실패다.
+  빠른 SQL compile test는 INNER JOIN 대상/조직 ON 조건/lifecycle/sync predicate를 검증하고,
+  opt-in disposable PostgreSQL test는 active, source-deleted, archived, cross-organization,
+  organization-mismatched membership이 실제 반환 집합과 candidate count에서 올바르게
+  포함·제외되는지 migration 적용 스키마에서 검증한다. 같은 실제 DB 테스트에서 최근
+  unauthorized 500개 뒤의 authorized Collection과 501개 authorized 결과 cap도 검증한다.
+  Source-deleted parent Collection은 route permission이 남아 있어도 picker cap, save,
+  preflight와 runtime candidate stream 어느 곳에도 포함되지 않아야 한다.
+- 모든 production execution surface는 same resolver dependency를 주입한다. Direct-only,
+  Collection-only와 mixed invocation은 resolver를 정확히 한 번 호출하며 ordered canonical
+  candidate마다 retrieval을 최대 한 번 실행한다.
+- Resolver policy zero-result와 insufficient evidence는 embedding/retrieval/provider를
+  호출하지 않는다. Resolver infrastructure exception은 safe retryable workflow failure로
+  Celery retry되고 `ragFailurePolicy=safe_no_result`로 낮아지지 않는다. Retry/redelivery는
+  fresh snapshot을 열 수 있지만 exactly-once provider 호출을 주장하지 않는다.
+- Agent Builder/optimizer/compare/copy/import/model routing/deployment snapshot은 unrelated
+  edit에서 `knowledgeCollections`를 보존한다. Pre-execution sync는 direct KB만 처리하고
+  Collection child를 열거하거나 connector를 호출하지 않는다.
+- Public app/deployment graph는 두 reference list를 제거한다. API/SSE/error/log/trace/audit
+  fixture는 Collection ID/name/provenance, hidden KB ID, raw graph/query/source/credential/
+  provider payload가 없고 safe bucket/fixed code만 있음을 검증한다. Mixed successful
+  retrieval에서는 explicit direct KB의 기존 KB/chunk/document lineage는 유지하지만
+  Collection-derived evidence의 child KB/chunk/document ID와 per-KB rank는 result metadata, durable trace,
+  audit 어디에도 나타나지 않는다. 최종 정렬·dedupe·top-k 이후의 `evidence_rank`는 direct와
+  Collection-derived result/quality trace에 1부터 연속해서 나타나며 child KB별로 재시작하지
+  않는다. Collection retrieval audit은 node target과 count bucket만
+  포함한다. Collection-only/mixed trace는 authorized/selected KB exact count와 그 값에서
+  유도되는 actual fan-out concurrency를 저장하지 않고 count bucket만 남긴다.
+  Query-vector/fan-out INFO log도 KB/model/vector/failure exact count 대신 bucket만 기록한다.
+  Anonymous/system actor와 invalid organization audit 경계도 같은 redaction을 쓴다.
+- Worker-first canary는 구 task drain 뒤 Gateway write와 Client를 순서대로 노출하고,
+  rollback은 Client/Gateway write 중지와 drain 뒤 Worker를 되돌린다. 구 Worker가
+  Collection graph를 소비할 수 있는 상태에서는 rollout/rollback acceptance가 실패다.
+
 ## Knowledge Base API Tests
 
 - KB create는 blank name을 DB insert 전에 거부하고 safe validation reason code만 반환한다.
diff --git a/docs/features/workflow/api_spec.md b/docs/features/workflow/api_spec.md
index 64e2f5fac..728db22fe 100644
--- a/docs/features/workflow/api_spec.md
+++ b/docs/features/workflow/api_spec.md
@@ -22,6 +22,52 @@ Workflow test stream은 별도 계약 전 Conversation Memory session을 자동
 
 ## Request And Response Models
 
+### MBA-233 LLM Knowledge reference graph contract
+
+LLM node `data`는 다음 두 configured reference list를 함께 가질 수 있다.
+
+```json
+{
+  "knowledgeBases": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "name": "직접 선택 KB"
+    }
+  ],
+  "knowledgeCollections": [
+    {
+      "id": "00000000-0000-0000-0000-000000000000",
+      "safeLabel": "사내 문서"
+    }
+  ]
+}
+```
+
+- Field 부재는 빈 목록과 같다. Direct-only legacy graph는 그대로 유효하다.
+- 각 목록은 최대 20개다. 21번째는 `knowledge_reference_limit_exceeded`로 거부하며
+  server와 Client 모두 silent slicing을 하지 않는다.
+- Item은 canonical UUID string `id`와 해당 type의 display field만 허용한다.
+  `knowledgeBases.name`은 legacy 호환을 위해 빈 문자열을 허용하지만 string이어야
+  하고, `knowledgeCollections.safeLabel`은 optional string이다. Present display field는
+  255자 이하이고 control character를 포함할 수 없다.
+- Unknown item field, non-object item, duplicate field shape, malformed/non-canonical UUID는
+  fixed validation code와 safe field path로 거부한다. Error는 item value, label과 raw
+  graph를 echo하지 않는다.
+- Display field는 Builder snapshot이며 authorization/routing/audit/trace input이 아니다.
+  Duplicate reference는 stored graph에서 자동 삭제하지 않고 runtime request에서 첫
+  canonical occurrence만 사용한다.
+
+`PUT /api/v1/workflows/{workflow_id}/draft`, Agent Builder apply-save와 graph를 저장하는
+optimizer/model-routing path는 위 structural contract와 Knowledge API의 save-time
+reference authorization을 모두 적용한다. Direct execute/stream은 structural validation을
+통과하고 current invocation audience로 MBA-232 resolver를 호출한다.
+
+Deployment preflight result는 기존 safe summary에 additive
+`knowledge_collection_count_bucket`과 `candidate_budget_limited`를 포함할 수 있다.
+Reason/action은 fixed allowlist만 사용하며 Collection/child UUID, label, exact hidden count,
+permission/source detail을 반환하지 않는다. Malformed/over-limit graph와 anonymous
+private/source-public-exposure 위반은 active publish에서 non-downgradable blocker다.
+
 ### Workflow run actor compatibility
 
 Workflow run list/detail 또는 node execution log가 run actor를 포함하는 경우 `user_id`는 `UUID | null`이다. Null은 canonical schedule claim에서 내부 입력 `schedule`이 저장 계약 `trigger_mode="scheduler"`로 정규화된 system execution에서만 허용한다. Client는 null을 App creator로 대체하지 않고 actor를 표시하는 화면에서는 `System`으로 표현한다. Manual/API/webhook 등 기존 user-attributed run의 non-null 계약은 유지한다.
diff --git a/docs/features/workflow/component_spec.md b/docs/features/workflow/component_spec.md
index 0fef29ec1..e5380d8ec 100644
--- a/docs/features/workflow/component_spec.md
+++ b/docs/features/workflow/component_spec.md
@@ -50,6 +50,28 @@ V1 canonical envelope은 값 dependency와 활성 control dependency의 합집
 
 Main generation과 Memory summary provider adapter는 Workflow admission 안에서 provider effect 없는 server-issued attempt reference를 먼저 만든 뒤 LLM Credentials domain의 authoritative port에서 해당 invocation/admission/attempt에 binding된 opaque capability identity/revision을 받는다. 상세 schema, credential principal과 permission decision revision은 [LLM Credentials API Spec](../llm-credentials/api_spec.md#target-provider-execution-capability-contract)이 소유한다. Runtime은 capability identity/revision을 Memory context lease, budget reservation, provider attempt와 usage reconciliation에 그대로 전달하고 client/Access Grant/owner 값으로 scope를 바꾸거나 credential principal을 합성하지 않는다.
 
+## MBA-233 LLM Knowledge Selection And Runtime
+
+- `LLMNodePanel`과 `LLMReferenceSidePanel`은 “고정 지식 베이스”와 “지식
+  Collection”을 분리해 표시하고 각 목록의 `n / 20` 상태를 독립적으로 관리한다.
+- Direct KB는 `/knowledge/llm-selectable`, Collection은
+  `/knowledge/llm-selectable-collections`의 route-safe projection에서 선택한다.
+- Saved item이 current picker response에 없으면 generic unavailable 상태로 보존한다.
+  Picker load failure와 성공한 empty response를 구분하며 어느 경우에도 자동 삭제하지
+  않는다.
+- LLM node의 Knowledge-enabled 상태는 두 목록 중 하나라도 non-empty이면 true다.
+  Collection-only node도 RAG evidence/failure controls를 사용할 수 있다.
+- Gateway save는 Client validation을 신뢰하지 않고 current editor direct KB `use`와
+  Collection `route`를 재검증한다. Save denial은 hidden resource identity 없이
+  제거/권한 복구가 필요하다는 generic action만 표시한다.
+- Workflow Engine은 runtime dependency로 주입된 MBA-232 resolver를 direct-only,
+  Collection-only, mixed invocation에 한 번 사용한다. Resolver zero-result와 evidence
+  insufficient는 provider 호출 전 safe 결과로 종료하고 infrastructure failure는 Celery
+  retry 경계로 전달한다.
+- Agent Builder, cost optimizer, compare/apply와 model-routing refresh는 unrelated edit에서
+  `knowledgeCollections`를 보존한다. Public app graph와 실행 로그 option projection은
+  Collection identity를 표시하지 않는다.
+
 ## Screens
 
 - Workflow Builder 화면: 캔버스, 노드 라이브러리, 상단 액션, 테스트 실행 사이드바, 하단 캔버스 도구를 포함한다.
diff --git a/docs/features/workflow/requirements.md b/docs/features/workflow/requirements.md
index 40a0b4439..6f4deb1f6 100644
--- a/docs/features/workflow/requirements.md
+++ b/docs/features/workflow/requirements.md
@@ -96,6 +96,15 @@ FR-048 기존 실행 계약 보존: Draft/test·Compare·stream publisher는 DB
 - FR-050 (MBA-190): Generic HTTP `GET` 기존 read 경로도 FR-035의 trace/log 비노출 규칙을 적용해 raw request/response payload를 durable trace에 남겨서는 안 된다. 기존 `status/data/headers` node output과 safe `host`/`path`/method/status/size/latency metadata는 유지해야 한다.
 - FR-051 (MBA-190): WorkflowNode binding 생성 시에는 target이 해당 app의 current active deployment이고 child surface에서 허용되는 type인지 확인해야 한다. Binding 소비 시에는 exact deployment row, app/workflow/organization provenance, 허용 type, version과 snapshot hash를 검증해야 한다. 새 child D2 활성화로 bound D1이 자동 비활성화된 경우에는 D1의 `is_active`나 app pointer와 D1의 일치를 요구하지 않고 기존 parent snapshot/command가 D1을 계속 사용해야 한다. 다만 app의 `active_deployment_id`가 null이거나 같은 app의 실제 active deployment row로 해석되지 않는 전체 비활성/불일치 상태는 kill switch로 보고 provider 전에 실패해야 하며 현재 pointer의 deployment로 bound graph를 대체해서는 안 된다. Bound row 삭제 또는 provenance/type/hash 불일치도 provider 전에 실패해야 한다.
 - FR-052 (MBA-218): ADR-0037 적용 이후 `slackPostNode`는 FR-029/FR-036/FR-042/FR-047의 MBA-190 Slack 호환 baseline을 현재 실행 계약으로 사용하지 않고 전용 data/node/adapter를 사용해야 한다. API mode는 `slack.chat.post_message.v1`, Webhook mode는 `slack.incoming_webhook.post.v1`을 선택하며 두 profile의 provider replay는 `unknown`, safe result reuse는 `supported`여야 한다. 기존 `slack.http.request.v1`은 과거 attempt 해석용으로 등록 상태를 유지해야 한다. 성공 projection은 `status`, `delivery_status`, `delivery_mode`와 API mode의 검증된 `message_ref`만 허용하고 같은 stable slot 재진입은 provider 호출 없이 이를 재사용해야 한다. API 성공은 HTTP `200` JSON `ok=true`와 유효한 `ts`, Webhook 성공은 HTTP `200`과 정확한 `ok`를 모두 요구한다. 확인된 rejection과 `429`는 `failed_before_effect + stop`, partial effect 가능 오류·미확인 `ok=false`·malformed success·redirect·write/read timeout·응답 유실·`5xx`는 `effect_outcome_unknown + stop`이어야 하며 `Retry-After`를 포함한 어떤 Slack provider 실패도 자동 replay하지 않아야 한다. Template은 실제 사용된 등록 변수의 단순 치환만 허용하고 JSON template 값은 구조를 바꾸지 못하게 escape해야 한다. API endpoint는 고정하고 Webhook은 exact commercial URL만 허용하며 arbitrary method/header/body/timeout을 request source로 사용하지 않아야 한다. 제거된 `data`/`headers` 및 Webhook `message_ref` selector는 Client/deployment/runtime에서 fail-closed하고, token/webhook URL/message/raw response와 `message_ref` 원문은 public graph/log/trace에 저장하지 않아야 한다.
+- FR-053 (MBA-233): LLM node data는 `knowledgeBases`와 additive `knowledgeCollections`를 동시에 지원하고 각 목록을 최대 20개로 strict validation해야 한다. 구 graph에서 Collection field 부재는 빈 목록이며 over-limit reference를 slice하거나 unknown reference field를 무시해서는 안 된다.
+- FR-054 (MBA-233): Workflow Builder는 고정 Knowledge Base와 실행 시 membership을 해석하는 Knowledge Collection을 별도 그룹과 독립 `n/20` count로 표시해야 한다. Collection 관리/권한/child 편집은 Builder가 아니라 Knowledge 관리 화면의 책임이며 stale selection은 generic unavailable로 표시하고 자동 삭제하지 않아야 한다.
+- FR-055 (MBA-233): Draft save, Agent Builder apply, optimizer/model-routing graph mutation은 server-side structural validation과 current editor의 direct KB `use`/Collection `route` 재검증을 우회하지 않아야 한다. 저장된 label과 Client capability는 권한이 아니며 실패는 partial graph 또는 success audit을 만들지 않아야 한다.
+- FR-056 (MBA-233): Deployment preview/create/activation/toggle은 direct KB와 selected Collection을 server-derived audience로 preflight하고 private/anonymous 또는 source-public-exposure 차단을 safe reason/action과 bucket으로만 반환해야 한다. Preflight 성공은 runtime authorization capability가 아니다.
+- FR-057 (MBA-233): 모든 production Workflow execution surface와 nested Loop/WorkflowNode는 같은 MBA-232 resolver dependency를 LLM node에 전달해야 한다. Knowledge configuration이 있으면 invocation마다 resolver를 한 번 호출하고 direct/Collection duplicate KB를 한 번만 retrieval해야 한다.
+- FR-058 (MBA-233): Resolver policy zero-result 또는 insufficient evidence는 LLM provider를 호출하지 않아야 한다. Resolver infrastructure failure는 raw 원인 없는 retryable workflow failure로 Celery retry 경계에 전달하고, authorized candidate resolution 이후 일부 retrieval failure만 기존 partial-result/evidence policy를 적용해야 한다.
+- FR-059 (MBA-233): Agent Builder, cost optimizer, compare, copy/import, model routing policy와 deployment snapshot은 operation이 Collection selection을 명시적으로 변경하지 않는 한 `knowledgeCollections`를 round-trip해야 한다. Public graph와 durable trace/log projection은 두 Knowledge reference 목록과 Collection identity를 제거해야 한다.
+- FR-060 (MBA-233): Pre-execution Knowledge sync는 explicit `knowledgeBases`만 대상으로 하고 Collection membership을 resolver 전에 확장하거나 live connector를 호출하지 않아야 한다. Source-managed Collection child는 MBA-232의 materialized provenance/readiness gate를 따른다.
+- FR-061 (MBA-233): 새 Collection graph는 모든 Worker가 MBA-233를 실행하고 기존 task를 drain한 뒤에만 Gateway/Client에서 저장 가능해야 한다. 자동 Worker capability negotiation이 없는 현재 구현은 Worker-first 배포 절차와 역순 rollback evidence를 요구한다.
 
 
 ### 1. 실행 편의성
diff --git a/docs/features/workflow/test_cases.md b/docs/features/workflow/test_cases.md
index 84f435c24..a5ae03449 100644
--- a/docs/features/workflow/test_cases.md
+++ b/docs/features/workflow/test_cases.md
@@ -437,6 +437,31 @@ Frontend 공통 그래프 검증은 catalog v2의 incoming/outgoing 금지 정
 - Missing execution subject는 anonymous public-only 결과를 반환하고 workflow owner fallback을 만들지 않는다. Ambiguous execution subject는 private retrieval fail-closed로 처리한다.
 - LLM node의 RAG 옵션은 Builder-time skill selection과 runtime data access 권한을 분리한다.
 
+## MBA-233 Workflow Knowledge Collection Tests
+
+- Builder는 direct KB와 Collection을 별도 group으로 선택하고 각각 20개 cap을 적용한다.
+  Collection-only/mixed graph가 save/reload 뒤 ID, configured order와 bounded display
+  snapshot을 보존한다.
+- Current picker에서 사라진 saved reference는 stale label 대신 generic unavailable로
+  남고 picker failure/empty response가 selection을 자동 삭제하지 않는다. 새 save가
+  server authorization에 실패하면 hidden identity 없이 제거/권한 복구 action을 표시한다.
+- Client validation을 우회한 malformed/over-limit graph는 draft save, direct stream,
+  deployment와 Worker NodeFactory에서 provider 실행 전 거부된다.
+- Agent Builder apply, cost optimizer candidate/apply/compare, model routing refresh와 graph
+  copy path는 기존 `knowledgeCollections`를 보존하고 Collection을 자동 추천하지 않는다.
+- `knowledgeBases` 또는 `knowledgeCollections` 중 하나라도 있으면 model router와 LLM
+  runtime은 Knowledge-enabled로 판정한다. Collection-only node는 MBA-232 resolver 결과를
+  기존 bounded retrieval/evidence path에 전달한다.
+- Authenticated execution은 explicit user subject, subject 부재는 anonymous public
+  audience를 사용한다. Credential principal/owner/builder가 Collection route를 가져도
+  execution subject가 denied이면 candidate를 얻지 못한다.
+- Resolver zero-result는 LLM provider를 호출하지 않고 infrastructure failure는 retryable
+  task failure다. Authorized resolution 뒤 일부 retrieval timeout만 partial-result policy를
+  사용할 수 있다.
+- Public graph, node option display, trace/log/audit/error/SSE는 Collection identity와 child
+  structure를 노출하지 않는다. Runtime trace는 routing mode와 count/limit/failure safe
+  summary만 허용한다.
+
 ## API Tests
 
 - 로그인 LLM node의 RAG 옵션 실행 요청은 Knowledge service에 `execution_subject=current_user`를 전달한다.