diff --git a/server/src/__tests__/company-skills-routes.test.ts b/server/src/__tests__/company-skills-routes.test.ts
index 32c3ef9961f..44f32b0e734 100644
--- a/server/src/__tests__/company-skills-routes.test.ts
+++ b/server/src/__tests__/company-skills-routes.test.ts
@@ -1259,7 +1259,7 @@ describe("company skill mutation permissions", () => {
     expect(res.status, JSON.stringify(res.body)).toBe(201);
     expect(mockReflectionCoachMutationGate.assertConsented).toHaveBeenCalledWith({
       companyId: "company-1",
-      actorAgentId: "agent-1",
+      actorAgentId: "55555555-5555-4555-8555-555555555555",
       actorRunId: "run-1",
       targetKeys: ["skill-import:https://github.com/vercel-labs/agent-browser"],
     });
diff --git a/server/src/routes/company-skills.ts b/server/src/routes/company-skills.ts
index 1f8c094090a..a25848387d9 100644
--- a/server/src/routes/company-skills.ts
+++ b/server/src/routes/company-skills.ts
@@ -120,7 +120,7 @@ export function companySkillRoutes(db: Db) {
     return targetKeys;
   }
 
-  async function assertCanMutateCompanySkills(req: Request, companyId: string, targetKeys: string[]) {
+  async function assertCanMutateCompanySkills(req: Request, companyId: string, targetKeys: string[] = []) {
     assertCompanyAccess(req, companyId);
     const decision = await access.decide({
       actor: req.actor,