diff --git a/server/src/__tests__/tool-access-policy-service.test.ts b/server/src/__tests__/tool-access-policy-service.test.ts
index 525f05db57d..45ffe0cd8f2 100644
--- a/server/src/__tests__/tool-access-policy-service.test.ts
+++ b/server/src/__tests__/tool-access-policy-service.test.ts
@@ -1105,7 +1105,8 @@ describeEmbeddedPostgres("tool access policy service", () => {
       .where(eq(toolInvocations.id, invocation.id));
     expect(await svc.decide(input)).toMatchObject({ decision: "rate_limited" });
     expect(invocation.policyExplanation?.consumedRateAdmissions).toEqual([
-      { policyId: ratePolicy.id, versionHash: expect.stringMatching(/^[a-f0-9]{64}$/) },
+      { policyId: ratePolicy.id, versionHash: expect.stringMatching(/^[a-f0-9]{64}$/),
+        bucketKey: `${ratePolicy.id}:agent:${input.actor.agentId}|tool:send_email` },
     ]);
     const counters = await db.select().from(toolRateLimitCounters);
     expect(await svc.decide(input, { admittedInvocationId: invocation.id })).toMatchObject({ allowed: true });
diff --git a/server/src/services/tool-access/catalog/default-access.ts b/server/src/services/tool-access/catalog/default-access.ts
index 408a33d9b14..c9a459dfafc 100644
--- a/server/src/services/tool-access/catalog/default-access.ts
+++ b/server/src/services/tool-access/catalog/default-access.ts
@@ -1,4 +1,3 @@
-import { connectionActorUserId } from "../actor.js";
 import { lockManagedAppPolicies, lockToolAssignmentAgents } from "../assignment-locks.js";
 import type { ActorInfo, ToolAccessMutationDb } from "../types.js";
 import { and, eq, inArray } from "drizzle-orm";
@@ -112,7 +111,9 @@ export function createCatalogDefaultAccess(db: Db) {
             ? (input.actor.actorId ?? null)
             : null,
         createdByUserId:
-          connectionActorUserId(input.actor),
+          input.actor?.actorType === "user"
+            ? (input.actor.actorId ?? null)
+            : null,
       });
     } else if (resetToRecommendedDefaults) {
       // Removing an app may retain its profile row when another record still
@@ -162,7 +163,9 @@ export function createCatalogDefaultAccess(db: Db) {
             ? (input.actor.actorId ?? null)
             : null,
         createdByUserId:
-          connectionActorUserId(input.actor),
+          input.actor?.actorType === "user"
+            ? (input.actor.actorId ?? null)
+            : null,
       });
     }
 
@@ -296,7 +299,9 @@ export function createCatalogDefaultAccess(db: Db) {
                 ? (input.actor.actorId ?? null)
                 : null,
             createdByUserId:
-              connectionActorUserId(input.actor),
+              input.actor?.actorType === "user"
+                ? (input.actor.actorId ?? null)
+                : null,
           })
           .returning();
         results.push(toPolicy(created));