From 3306e8120e1fdbdea7ffde586208d1947aa4b042 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Mar 2026 11:25:34 +0000
Subject: [PATCH 1/4] Initial plan


From 236e9e6ba549fc6267911b8f9cc8d4b9af0e2f2c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Mar 2026 12:08:10 +0000
Subject: [PATCH 2/4] Add special handling for Copilot inference access errors
 in agent failure reports

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../agent-performance-analyzer.lock.yml       |  14 ++
 .github/workflows/archie.lock.yml             |  14 ++
 .github/workflows/artifacts-summary.lock.yml  |  14 ++
 .github/workflows/auto-triage-issues.lock.yml |  14 ++
 .github/workflows/bot-detection.lock.yml      |  14 ++
 .github/workflows/brave.lock.yml              |  14 ++
 .../breaking-change-checker.lock.yml          |  14 ++
 .../workflows/chroma-issue-indexer.lock.yml   |  13 ++
 .github/workflows/ci-coach.lock.yml           |  14 ++
 .../cli-consistency-checker.lock.yml          |  14 ++
 .../workflows/code-scanning-fixer.lock.yml    |  14 ++
 .../copilot-cli-deep-research.lock.yml        |  14 ++
 .../copilot-pr-merged-report.lock.yml         |  14 ++
 .../copilot-pr-nlp-analysis.lock.yml          |  14 ++
 .../copilot-pr-prompt-analysis.lock.yml       |  14 ++
 .github/workflows/craft.lock.yml              |  14 ++
 .../daily-architecture-diagram.lock.yml       |  14 ++
 .../daily-assign-issue-to-user.lock.yml       |  14 ++
 .../workflows/daily-cli-performance.lock.yml  |  14 ++
 .../workflows/daily-compiler-quality.lock.yml |  14 ++
 .../daily-copilot-token-report.lock.yml       |  14 ++
 .github/workflows/daily-file-diet.lock.yml    |  14 ++
 .../daily-malicious-code-scan.lock.yml        |  14 ++
 .../daily-mcp-concurrency-analysis.lock.yml   |  14 ++
 .github/workflows/daily-news.lock.yml         |  14 ++
 .../daily-performance-summary.lock.yml        |  14 ++
 .../workflows/daily-repo-chronicle.lock.yml   |  14 ++
 .../workflows/daily-secrets-analysis.lock.yml |  14 ++
 .../daily-syntax-error-quality.lock.yml       |  14 ++
 .../daily-testify-uber-super-expert.lock.yml  |  14 ++
 .../workflows/daily-workflow-updater.lock.yml |  14 ++
 .github/workflows/dead-code-remover.lock.yml  |  14 ++
 .github/workflows/delight.lock.yml            |  14 ++
 .github/workflows/dev-hawk.lock.yml           |  14 ++
 .github/workflows/dev.lock.yml                |  14 ++
 .github/workflows/dictation-prompt.lock.yml   |  14 ++
 .../workflows/discussion-task-miner.lock.yml  |  14 ++
 .github/workflows/docs-noob-tester.lock.yml   |  14 ++
 .github/workflows/draft-pr-cleanup.lock.yml   |  14 ++
 .../example-custom-error-patterns.lock.yml    |  13 ++
 .../example-permissions-warning.lock.yml      |  13 ++
 .github/workflows/firewall-escape.lock.yml    |  14 ++
 .github/workflows/firewall.lock.yml           |  13 ++
 .github/workflows/grumpy-reviewer.lock.yml    |  14 ++
 .github/workflows/jsweep.lock.yml             |  14 ++
 .../workflows/layout-spec-maintainer.lock.yml |  14 ++
 .github/workflows/mcp-inspector.lock.yml      |  14 ++
 .github/workflows/mergefest.lock.yml          |  14 ++
 .github/workflows/metrics-collector.lock.yml  |  13 ++
 .../workflows/notion-issue-summary.lock.yml   |  14 ++
 .github/workflows/org-health-report.lock.yml  |  14 ++
 .github/workflows/pdf-summary.lock.yml        |  14 ++
 .github/workflows/plan.lock.yml               |  14 ++
 .github/workflows/portfolio-analyst.lock.yml  |  14 ++
 .../workflows/pr-nitpick-reviewer.lock.yml    |  14 ++
 .github/workflows/pr-triage-agent.lock.yml    |  14 ++
 .github/workflows/python-data-charts.lock.yml |  14 ++
 .github/workflows/q.lock.yml                  |  14 ++
 .github/workflows/refiner.lock.yml            |  14 ++
 .github/workflows/release.lock.yml            |  14 ++
 .github/workflows/repo-tree-map.lock.yml      |  14 ++
 .../repository-quality-improver.lock.yml      |  14 ++
 .github/workflows/research.lock.yml           |  14 ++
 .../workflows/security-compliance.lock.yml    |  14 ++
 .../workflows/slide-deck-maintainer.lock.yml  |  14 ++
 .github/workflows/smoke-copilot-arm.lock.yml  |  14 ++
 .github/workflows/smoke-multi-pr.lock.yml     |  14 ++
 .github/workflows/smoke-temporary-id.lock.yml |  14 ++
 .github/workflows/smoke-test-tools.lock.yml   |  14 ++
 .../workflows/smoke-workflow-call.lock.yml    |  14 ++
 .../workflows/stale-repo-identifier.lock.yml  |  14 ++
 .github/workflows/sub-issue-closer.lock.yml   |  14 ++
 .github/workflows/super-linter.lock.yml       |  14 ++
 .github/workflows/terminal-stylist.lock.yml   |  14 ++
 .../test-project-url-default.lock.yml         |  14 ++
 .github/workflows/test-workflow.lock.yml      |  13 ++
 .github/workflows/tidy.lock.yml               |  14 ++
 .../workflows/ubuntu-image-analyzer.lock.yml  |  14 ++
 .github/workflows/video-analyzer.lock.yml     |  14 ++
 .../weekly-editors-health-check.lock.yml      |  14 ++
 .../workflows/weekly-issue-summary.lock.yml   |  14 ++
 .../weekly-safe-outputs-spec-review.lock.yml  |  14 ++
 .github/workflows/workflow-generator.lock.yml |  14 ++
 .../workflow-health-manager.lock.yml          |  14 ++
 actions/setup/js/handle_agent_failure.cjs     |  30 ++++
 actions/setup/md/agent_failure_comment.md     |   2 +-
 actions/setup/md/agent_failure_issue.md       |   2 +-
 pkg/workflow/compiler_main_job.go             |  11 ++
 pkg/workflow/compiler_yaml_main_job.go        |  10 ++
 pkg/workflow/copilot_engine_execution.go      |  22 +++
 pkg/workflow/inference_access_error_test.go   | 142 ++++++++++++++++++
 pkg/workflow/notify_comment.go                |   6 +
 92 files changed, 1393 insertions(+), 2 deletions(-)
 create mode 100644 pkg/workflow/inference_access_error_test.go

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 48e1675df8..4733adae9a 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -272,6 +272,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -844,6 +845,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1184,6 +1197,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "agent-performance-analyzer"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index 02291319d4..a7d7353ecd 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -309,6 +309,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -686,6 +687,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1017,6 +1030,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "archie"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📊 *Diagram rendered by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🔧 *Workflow sync report by [{workflow_name}]({run_url}) for {repository}*\",\"footerWorkflowRecompileComment\":\"\\u003e 🔄 *Update from [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"📐 [{workflow_name}]({run_url}) is analyzing the architecture for this {event_type}...\",\"runSuccess\":\"🎨 [{workflow_name}]({run_url}) has completed the architecture visualization. ✅\",\"runFailure\":\"📐 [{workflow_name}]({run_url}) encountered an issue and could not complete the architecture diagram. Check the [run logs]({run_url}) for details.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index ec4138b588..808e5141ac 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -259,6 +259,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -641,6 +642,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -970,6 +983,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "artifacts-summary"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index 711ed21210..19bc11f1f2 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -272,6 +272,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -710,6 +711,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1040,6 +1053,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "auto-triage-issues"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index dc5cc28031..e43f8cc30f 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -273,6 +273,7 @@ jobs:
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -794,6 +795,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1007,6 +1020,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "bot-detection"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
         with:
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 3a8a782cc1..cab158036b 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -293,6 +293,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -673,6 +674,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1005,6 +1018,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "brave"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🦁 *Search results brought to you by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🔄 *Maintenance report by [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"🔍 Brave Search activated! [{workflow_name}]({run_url}) is venturing into the web on this {event_type}...\",\"runSuccess\":\"🦁 Mission accomplished! [{workflow_name}]({run_url}) has returned with the findings. Knowledge acquired! 🏆\",\"runFailure\":\"🔍 Search interrupted! [{workflow_name}]({run_url}) {status}. The web remains unexplored...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 48d0997b67..b5c239d4b4 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -261,6 +261,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -685,6 +686,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1016,6 +1029,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "breaking-change-checker"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e ⚠️ *Compatibility report by [{workflow_name}]({run_url})*{history_link}\",\"footerWorkflowRecompile\":\"\\u003e 🛠️ *Workflow maintenance by [{workflow_name}]({run_url}) for {repository}*\",\"runStarted\":\"🔬 Breaking Change Checker online! [{workflow_name}]({run_url}) is analyzing API compatibility on this {event_type}...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has reviewed all changes. Compatibility verdict delivered! 📋\",\"runFailure\":\"🔬 Analysis interrupted! [{workflow_name}]({run_url}) {status}. Compatibility status unknown...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/chroma-issue-indexer.lock.yml b/.github/workflows/chroma-issue-indexer.lock.yml
index 1f42f31f7b..31fc3bd885 100644
--- a/.github/workflows/chroma-issue-indexer.lock.yml
+++ b/.github/workflows/chroma-issue-indexer.lock.yml
@@ -248,6 +248,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: chromaissueindexer
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -419,6 +420,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index bd293d7b61..9a6af9a984 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -282,6 +282,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -738,6 +739,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1078,6 +1091,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "ci-coach"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index b7c3dbf74f..f69e17a027 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -250,6 +250,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -654,6 +655,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -982,6 +995,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "cli-consistency-checker"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index fefd661b70..94a3cb5246 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -263,6 +263,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -731,6 +732,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1078,6 +1091,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "code-scanning-fixer"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_campaigns: ${{ needs.push_repo_memory.outputs.validation_failed_campaigns }}
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index 76eab1b04e..49cbf5c236 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -271,6 +271,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -685,6 +686,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1024,6 +1037,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "copilot-cli-deep-research"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index 465a5ba068..330ca4e5af 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -280,6 +280,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -794,6 +795,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1140,6 +1153,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "copilot-pr-merged-report"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index 59acfc2e22..e128d2c261 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -293,6 +293,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -764,6 +765,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1120,6 +1133,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "copilot-pr-nlp-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 35958eaa12..2bed900ea3 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -288,6 +288,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -698,6 +699,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1044,6 +1057,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "copilot-pr-prompt-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 2383f7e1ff..1ec7e38b04 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -286,6 +286,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -708,6 +709,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1040,6 +1053,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "craft"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e ⚒️ *Crafted with care by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🛠️ Master Crafter at work! [{workflow_name}]({run_url}) is forging a new workflow on this {event_type}...\",\"runSuccess\":\"⚒️ Masterpiece complete! [{workflow_name}]({run_url}) has crafted your workflow. May it serve you well! 🎖️\",\"runFailure\":\"🛠️ Forge cooling down! [{workflow_name}]({run_url}) {status}. The anvil awaits another attempt...\"}"
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 3fefbd0e81..20ccb93a13 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -265,6 +265,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -756,6 +757,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1093,6 +1106,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-architecture-diagram"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index bed68e8f34..3e58aaa353 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -247,6 +247,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -669,6 +670,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -999,6 +1012,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-assign-issue-to-user"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
         with:
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index ef50721dfb..3473ed2b59 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -276,6 +276,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -863,6 +864,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1216,6 +1229,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-cli-performance"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 01ff33ccce..347eaff17c 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -268,6 +268,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -689,6 +690,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1028,6 +1041,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-compiler-quality"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 398945d3ec..3e67c68fe7 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -771,6 +772,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1130,6 +1143,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-copilot-token-report"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index 4a3085ad8e..80aaeb3eb6 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -269,6 +269,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -703,6 +704,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1034,6 +1047,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-file-diet"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 9a4883de0c..76be54dcd9 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -254,6 +254,7 @@ jobs:
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -677,6 +678,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -891,6 +904,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-malicious-code-scan"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
         with:
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index 5e31670554..46bfecabf6 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -267,6 +267,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -743,6 +744,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1081,6 +1094,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-mcp-concurrency-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "45"
         with:
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index 7c2c0f8bcf..5cb4e177c6 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -292,6 +292,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -832,6 +833,18 @@ jobs:
           S2STOKENS: true
           TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1192,6 +1205,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-news"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 89aa8d927b..223651618d 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1255,6 +1256,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1615,6 +1628,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-performance-summary"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 16fd6936bc..9152141358 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -273,6 +273,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -720,6 +721,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1069,6 +1082,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-repo-chronicle"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index a9325736b1..8bbb689402 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -258,6 +258,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -701,6 +702,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1033,6 +1046,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-secrets-analysis"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index 610e0e8fd7..3f82a295ea 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -257,6 +257,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -683,6 +684,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1014,6 +1027,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-syntax-error-quality"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index afa0149eb5..ba0b3822df 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -724,6 +725,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1065,6 +1078,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-testify-uber-super-expert"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 956213e30b..437cad86f0 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -251,6 +251,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -658,6 +659,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -991,6 +1004,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "daily-workflow-updater"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index 284f686f65..e0e1326cdb 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -269,6 +269,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -696,6 +697,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1033,6 +1046,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "dead-code-remover"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index 1cdce435ab..f07c7ee930 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -273,6 +273,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -765,6 +766,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1107,6 +1120,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "delight"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📊 *User experience analysis by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📊 Delight Agent starting! [{workflow_name}]({run_url}) is analyzing user-facing aspects for improvement opportunities...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has identified targeted improvements for user experience.\",\"runFailure\":\"⚠️ Analysis interrupted! [{workflow_name}]({run_url}) {status}. Please review the logs...\"}"
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index dadc0aac64..f3d0b303a3 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -285,6 +285,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -737,6 +738,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1067,6 +1080,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "dev-hawk"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🦅 *Observed from above by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🦅 Dev Hawk circles the sky! [{workflow_name}]({run_url}) is monitoring this {event_type} from above...\",\"runSuccess\":\"🦅 Hawk eyes report! [{workflow_name}]({run_url}) has completed reconnaissance. Intel delivered! 🎯\",\"runFailure\":\"🦅 Hawk down! [{workflow_name}]({run_url}) {status}. The skies grow quiet...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index f05eb3a328..6a39ee9988 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -247,6 +247,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -651,6 +652,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -979,6 +992,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "dev"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "30"
         with:
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index a51e10753a..0b88d6d39f 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -257,6 +257,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -664,6 +665,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -994,6 +1007,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "dictation-prompt"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index f6e7f5433d..7aa5c6204e 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -274,6 +274,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -740,6 +741,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1083,6 +1096,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "discussion-task-miner"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Task mining by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 Discussion Task Miner starting! [{workflow_name}]({run_url}) is scanning discussions for code quality improvements...\",\"runSuccess\":\"✅ Task mining complete! [{workflow_name}]({run_url}) has identified actionable code quality tasks. 📊\",\"runFailure\":\"⚠️ Task mining interrupted! [{workflow_name}]({run_url}) {status}. Please review the logs...\"}"
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index 240df75dfa..b3b16c9b46 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -682,6 +683,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1021,6 +1034,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "docs-noob-tester"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 13d78ff8c6..7a94c09ffd 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -249,6 +249,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -698,6 +699,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1028,6 +1041,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "draft-pr-cleanup"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🧹 Starting draft PR cleanup... [{workflow_name}]({run_url}) is reviewing draft PRs for staleness\",\"runSuccess\":\"✅ Draft PR cleanup complete! [{workflow_name}]({run_url}) has reviewed and processed stale drafts.\",\"runFailure\":\"❌ Draft PR cleanup failed! [{workflow_name}]({run_url}) {status}. Some draft PRs may not be processed.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml
index 98e1809c93..de87519f19 100644
--- a/.github/workflows/example-custom-error-patterns.lock.yml
+++ b/.github/workflows/example-custom-error-patterns.lock.yml
@@ -249,6 +249,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: examplecustomerrorpatterns
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -385,6 +386,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index f818d10e86..21c19d2cfc 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -232,6 +232,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: examplepermissionswarning
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -368,6 +369,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index f6d27827e2..db4a5a647e 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -291,6 +291,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -693,6 +694,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1042,6 +1055,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "firewall-escape"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index 7a7a22000a..3429585a99 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -234,6 +234,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: firewall
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -370,6 +371,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index e1493c1998..1881096254 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -301,6 +301,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -749,6 +750,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1086,6 +1099,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "grumpy-reviewer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 😤 *Reluctantly reviewed by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"😤 *sigh* [{workflow_name}]({run_url}) is begrudgingly looking at this {event_type}... This better be worth my time.\",\"runSuccess\":\"😤 Fine. [{workflow_name}]({run_url}) finished the review. It wasn't completely terrible. I guess. 🙄\",\"runFailure\":\"😤 Great. [{workflow_name}]({run_url}) {status}. As if my day couldn't get any worse...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 3b869a4103..f4d6f3d61a 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -266,6 +266,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -699,6 +700,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1040,6 +1053,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "jsweep"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 3f05c0bedd..99ac7da509 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -257,6 +257,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -699,6 +700,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1033,6 +1046,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "layout-spec-maintainer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 937893ba46..8351b3d97d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -328,6 +328,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1035,6 +1036,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1386,6 +1399,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "mcp-inspector"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index d9e766924a..0380d0429a 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -287,6 +287,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -706,6 +707,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1037,6 +1050,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "mergefest"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index abd086e0b8..3a2010462a 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -255,6 +255,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: metricscollector
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -468,6 +469,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 55ee908fe9..60ea69483e 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -262,6 +262,7 @@ jobs:
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -622,6 +623,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -834,6 +847,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "notion-issue-summary"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "5"
         with:
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 0fc544ddbd..53a9a7f254 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -282,6 +282,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -719,6 +720,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1066,6 +1079,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "org-health-report"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index a0dcc5a996..045d98543a 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -333,6 +333,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -770,6 +771,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1109,6 +1122,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "pdf-summary"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📄 *Summary compiled by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📖 Page by page! [{workflow_name}]({run_url}) is reading through this {event_type}...\",\"runSuccess\":\"📚 TL;DR ready! [{workflow_name}]({run_url}) has distilled the essence. Knowledge condensed! ✨\",\"runFailure\":\"📖 Reading interrupted! [{workflow_name}]({run_url}) {status}. The document remains unsummarized...\"}"
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index 630ac77ced..f306da9144 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -294,6 +294,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -746,6 +747,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1077,6 +1090,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "plan"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
         with:
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 35c80b9cab..0d0f413186 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -279,6 +279,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -800,6 +801,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1150,6 +1163,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "portfolio-analyst"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index bdc9ff760c..944831697f 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -331,6 +331,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -842,6 +843,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1181,6 +1194,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "pr-nitpick-reviewer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Meticulously inspected by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔬 Adjusting monocle... [{workflow_name}]({run_url}) is scrutinizing every pixel of this {event_type}...\",\"runSuccess\":\"🔍 Nitpicks catalogued! [{workflow_name}]({run_url}) has documented all the tiny details. Perfection awaits! ✅\",\"runFailure\":\"🔬 Lens cracked! [{workflow_name}]({run_url}) {status}. Some nitpicks remain undetected...\"}"
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index 5a29393af7..0af8c351c9 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -268,6 +268,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -749,6 +750,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1090,6 +1103,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "pr-triage-agent"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🔍 Starting PR triage analysis... [{workflow_name}]({run_url}) is categorizing and prioritizing agent-created PRs\",\"runSuccess\":\"✅ PR triage complete! [{workflow_name}]({run_url}) has analyzed and categorized PRs. Check the issue for detailed report.\",\"runFailure\":\"❌ PR triage failed! [{workflow_name}]({run_url}) {status}. Some PRs may not be triaged.\"}"
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index fc752917cc..e48e04794f 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -275,6 +275,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -788,6 +789,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1135,6 +1148,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "python-data-charts"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index ed13ad517b..667f94b1f0 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -350,6 +350,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -880,6 +881,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1220,6 +1233,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "q"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🎩 *Equipped by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔧 Pay attention, 007! [{workflow_name}]({run_url}) is preparing your gadgets for this {event_type}...\",\"runSuccess\":\"🎩 Mission equipment ready! [{workflow_name}]({run_url}) has optimized your workflow. Use wisely, 007! 🔫\",\"runFailure\":\"🔧 Technical difficulties! [{workflow_name}]({run_url}) {status}. Even Q Branch has bad days...\"}"
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 793e6681f7..66c9475908 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -290,6 +290,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -724,6 +725,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1056,6 +1069,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "refiner"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"runStarted\":\"🔍 Starting code refinement... [{workflow_name}]({run_url}) is analyzing PR #${{ github.event.pull_request.number }} for style alignment and security issues\",\"runSuccess\":\"✅ Refinement complete! [{workflow_name}]({run_url}) has created a PR with improvements for PR #${{ github.event.pull_request.number }}\",\"runFailure\":\"❌ Refinement failed! [{workflow_name}]({run_url}) {status} while processing PR #${{ github.event.pull_request.number }}\"}"
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 41345cae47..6a44c6bd90 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -269,6 +269,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -662,6 +663,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -990,6 +1003,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "release"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index caa87f4870..4bfdb1bb73 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -641,6 +642,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -971,6 +984,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "repo-tree-map"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index 6f17f091b3..a0daa4e4dd 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -272,6 +272,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -672,6 +673,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1009,6 +1022,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "repository-quality-improver"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 3cae79164f..e241dd1618 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -270,6 +270,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -666,6 +667,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           TAVILY_API_KEY: ${{ secrets.TAVILY_API_KEY }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -997,6 +1010,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "research"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index a8f50f0076..b00a6c94e4 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -295,6 +295,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -708,6 +709,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1047,6 +1060,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "security-compliance"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index a9fce096c7..1e004abd73 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -284,6 +284,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -759,6 +760,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1100,6 +1113,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "slide-deck-maintainer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index de2c8e5d55..0f2f8e3db0 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -321,6 +321,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1668,6 +1669,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -2018,6 +2031,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-copilot-arm"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📰 *BREAKING: Report filed by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"📰 BREAKING: [{workflow_name}]({run_url}) is now investigating this {event_type}. Sources say the story is developing...\",\"runSuccess\":\"📰 VERDICT: [{workflow_name}]({run_url}) has concluded. All systems operational. This is a developing story. 🎤\",\"runFailure\":\"📰 DEVELOPING STORY: [{workflow_name}]({run_url}) reports {status}. Our correspondents are investigating the incident...\"}"
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index 16d1e6e7a4..c9c6804ae1 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -294,6 +294,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -764,6 +765,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1096,6 +1109,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-multi-pr"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Multi PR smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing multiple PR creation...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully created multiple PRs.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to create multiple PRs. Check the logs.\"}"
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index c6b9143286..f877440974 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -289,6 +289,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -777,6 +778,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1108,6 +1121,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-temporary-id"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Temporary ID smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing temporary ID functionality...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed successfully. Temporary ID validation passed.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) encountered failures. Check the logs for details.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index 487ffb3463..c6a393c4c9 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -288,6 +288,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -680,6 +681,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1011,6 +1024,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-test-tools"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔧 *Tool validation by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔧 Starting tool validation... [{workflow_name}]({run_url}) is checking the agent container tools...\",\"runSuccess\":\"✅ All tools validated successfully! [{workflow_name}]({run_url}) confirms agent container is ready.\",\"runFailure\":\"❌ Tool validation failed! [{workflow_name}]({run_url}) detected missing tools: {status}\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "5"
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index db21a6e933..a611098148 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -259,6 +259,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -647,6 +648,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -978,6 +991,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-workflow-call"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔁 *workflow_call smoke test by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🔁 [{workflow_name}]({run_url}) is validating workflow_call checkout...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully validated workflow_call checkout.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to validate workflow_call checkout. Check the logs.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index f257617cd5..bcf1755c8a 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -295,6 +295,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -788,6 +789,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1134,6 +1147,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "stale-repo-identifier"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔍 *Analysis by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 Stale Repository Identifier starting! [{workflow_name}]({run_url}) is analyzing repository activity...\",\"runSuccess\":\"✅ Analysis complete! [{workflow_name}]({run_url}) has finished analyzing stale repositories.\",\"runFailure\":\"⚠️ Analysis interrupted! [{workflow_name}]({run_url}) {status}.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "45"
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 7f423aa16a..ab6cfc9d1d 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -253,6 +253,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -739,6 +740,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1070,6 +1083,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "sub-issue-closer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
         with:
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 49f4680353..4004e8ced7 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -276,6 +276,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -695,6 +696,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1031,6 +1044,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "super-linter"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
         with:
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 5a5ce3255c..ac371d608f 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -649,6 +650,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -979,6 +992,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "terminal-stylist"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index 53f57fa11b..f25d4a1263 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -245,6 +245,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -836,6 +837,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1164,6 +1177,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "test-project-url-default"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/test-workflow.lock.yml b/.github/workflows/test-workflow.lock.yml
index 1b4d1305c5..cd0669e82e 100644
--- a/.github/workflows/test-workflow.lock.yml
+++ b/.github/workflows/test-workflow.lock.yml
@@ -234,6 +234,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: testworkflow
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -370,6 +371,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 47095236ba..b49fa2f906 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -298,6 +298,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -791,6 +792,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1125,6 +1138,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "tidy"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index d82fdd806a..ea98e57696 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -263,6 +263,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -695,6 +696,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1029,6 +1042,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "ubuntu-image-analyzer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 7c8e15b479..b0cb2e2d59 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -266,6 +266,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -694,6 +695,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1023,6 +1036,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "video-analyzer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
         with:
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index adc95d8c78..67ded6bb6d 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -732,6 +733,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1076,6 +1089,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "weekly-editors-health-check"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index bfa23f6da8..22ef3ec9f2 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -278,6 +278,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -699,6 +700,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1048,6 +1061,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "weekly-issue-summary"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index d4b6039168..81cc6e1490 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -258,6 +258,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -653,6 +654,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -987,6 +1000,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "weekly-safe-outputs-spec-review"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 704772c89a..99c54101b6 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -284,6 +284,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -777,6 +778,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1107,6 +1120,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "workflow-generator"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}
           GH_AW_ASSIGNMENT_ERROR_COUNT: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index feb4102140..db1c6e9fef 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -276,6 +276,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -846,6 +847,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1187,6 +1200,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "workflow-health-manager"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_REPO_MEMORY_VALIDATION_FAILED_default: ${{ needs.push_repo_memory.outputs.validation_failed_default }}
           GH_AW_REPO_MEMORY_VALIDATION_ERROR_default: ${{ needs.push_repo_memory.outputs.validation_error_default }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/actions/setup/js/handle_agent_failure.cjs b/actions/setup/js/handle_agent_failure.cjs
index 4dbfaf46f6..c29107e06e 100644
--- a/actions/setup/js/handle_agent_failure.cjs
+++ b/actions/setup/js/handle_agent_failure.cjs
@@ -453,6 +453,26 @@ function buildTimeoutContext(isTimedOut, timeoutMinutes) {
   return ctx;
 }
 
+/**
+ * Build a context string when the Copilot CLI failed due to the token lacking inference access.
+ * @param {boolean} hasInferenceAccessError - Whether an inference access error was detected
+ * @returns {string} Formatted context string, or empty string if no error
+ */
+function buildInferenceAccessErrorContext(hasInferenceAccessError) {
+  if (!hasInferenceAccessError) {
+    return "";
+  }
+
+  let ctx = "\n**🔑 Inference Access Denied**: The Copilot CLI failed because the token does not have access to inference.";
+  ctx += " This can happen when:\n\n";
+  ctx += "- Your organization has restricted Copilot access\n";
+  ctx += "- The `COPILOT_GITHUB_TOKEN` does not have a valid Copilot subscription\n";
+  ctx += "- Required policies have not been enabled by your administrator\n\n";
+  ctx += "To resolve this, verify that the `COPILOT_GITHUB_TOKEN` secret belongs to an account with an active Copilot subscription and check your [Copilot settings](https://github.com/settings/copilot).\n\n";
+
+  return ctx;
+}
+
 /**
  * Handle agent job failure by creating or updating a failure tracking issue
  * This script is called from the conclusion job when the agent job has failed
@@ -476,6 +496,7 @@ async function main() {
     const codePushFailureCount = process.env.GH_AW_CODE_PUSH_FAILURE_COUNT || "0";
     const checkoutPRSuccess = process.env.GH_AW_CHECKOUT_PR_SUCCESS || "";
     const timeoutMinutes = process.env.GH_AW_TIMEOUT_MINUTES || "";
+    const inferenceAccessError = process.env.GH_AW_INFERENCE_ACCESS_ERROR === "true";
 
     // Collect repo-memory validation errors from all memory configurations
     const repoMemoryValidationErrors = [];
@@ -499,6 +520,7 @@ async function main() {
     core.info(`Create discussion error count: ${createDiscussionErrorCount}`);
     core.info(`Code push failure count: ${codePushFailureCount}`);
     core.info(`Checkout PR success: ${checkoutPRSuccess}`);
+    core.info(`Inference access error: ${inferenceAccessError}`);
 
     // Check if the agent timed out
     const isTimedOut = agentConclusion === "timed_out";
@@ -664,6 +686,9 @@ async function main() {
         // Build timeout context
         const timeoutContext = buildTimeoutContext(isTimedOut, timeoutMinutes);
 
+        // Build inference access error context
+        const inferenceAccessErrorContext = buildInferenceAccessErrorContext(inferenceAccessError);
+
         // Create template context
         const templateContext = {
           run_url: runUrl,
@@ -684,6 +709,7 @@ async function main() {
           missing_safe_outputs_context: missingSafeOutputsContext,
           timeout_context: timeoutContext,
           fork_context: forkContext,
+          inference_access_error_context: inferenceAccessErrorContext,
         };
 
         // Render the comment template
@@ -780,6 +806,9 @@ async function main() {
         // Build timeout context
         const timeoutContext = buildTimeoutContext(isTimedOut, timeoutMinutes);
 
+        // Build inference access error context
+        const inferenceAccessErrorContext = buildInferenceAccessErrorContext(inferenceAccessError);
+
         // Create template context with sanitized workflow name
         const templateContext = {
           workflow_name: sanitizedWorkflowName,
@@ -801,6 +830,7 @@ async function main() {
           missing_safe_outputs_context: missingSafeOutputsContext,
           timeout_context: timeoutContext,
           fork_context: forkContext,
+          inference_access_error_context: inferenceAccessErrorContext,
         };
 
         // Render the issue template
diff --git a/actions/setup/md/agent_failure_comment.md b/actions/setup/md/agent_failure_comment.md
index 15bd389e17..e7d992bd46 100644
--- a/actions/setup/md/agent_failure_comment.md
+++ b/actions/setup/md/agent_failure_comment.md
@@ -1,3 +1,3 @@
 Agent job [{run_id}]({run_url}) failed.
 
-{secret_verification_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
+{secret_verification_context}{inference_access_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
diff --git a/actions/setup/md/agent_failure_issue.md b/actions/setup/md/agent_failure_issue.md
index 855b88698e..481c79f845 100644
--- a/actions/setup/md/agent_failure_issue.md
+++ b/actions/setup/md/agent_failure_issue.md
@@ -4,7 +4,7 @@
 **Branch:** {branch}  
 **Run:** {run_url}{pull_request_info}
 
-{secret_verification_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
+{secret_verification_context}{inference_access_error_context}{assignment_errors_context}{create_discussion_errors_context}{code_push_failure_context}{repo_memory_validation_context}{missing_data_context}{missing_safe_outputs_context}{timeout_context}{fork_context}
 
 ### Action Required
 
diff --git a/pkg/workflow/compiler_main_job.go b/pkg/workflow/compiler_main_job.go
index b42b6159a5..0bb6ffd04b 100644
--- a/pkg/workflow/compiler_main_job.go
+++ b/pkg/workflow/compiler_main_job.go
@@ -155,6 +155,17 @@ func (c *Compiler) buildMainJob(data *WorkflowData, activationJobCreated bool) (
 		compilerMainJobLog.Print("Skipped checkout_pr_success output (workflow lacks contents read access)")
 	}
 
+	// Add inference_access_error output for Copilot engine only
+	// This output is set by the detect-inference-error step when the Copilot CLI
+	// fails due to a token with invalid access to inference (policy access denied)
+	engine, engineErr := c.getAgenticEngine(data.AI)
+	if engineErr == nil {
+		if _, ok := engine.(*CopilotEngine); ok {
+			outputs["inference_access_error"] = "${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}"
+			compilerMainJobLog.Print("Added inference_access_error output (Copilot engine)")
+		}
+	}
+
 	// Build job-level environment variables for safe outputs
 	var env map[string]string
 	if data.SafeOutputs != nil {
diff --git a/pkg/workflow/compiler_yaml_main_job.go b/pkg/workflow/compiler_yaml_main_job.go
index 41cbaaa9c8..f42a238d46 100644
--- a/pkg/workflow/compiler_yaml_main_job.go
+++ b/pkg/workflow/compiler_yaml_main_job.go
@@ -269,6 +269,16 @@ func (c *Compiler) generateMainJobSteps(yaml *strings.Builder, data *WorkflowDat
 	compilerYamlLog.Printf("Generating engine execution steps for %s", engine.GetID())
 	c.generateEngineExecutionSteps(yaml, data, engine, logFileFull)
 
+	// Add inference access error detection step for Copilot engine
+	// This step detects when the Copilot CLI fails due to the token lacking inference access
+	// It must run in the main job (not threat detection job) to avoid step ID conflicts
+	if _, ok := engine.(*CopilotEngine); ok {
+		detectionStep := generateInferenceAccessErrorDetectionStep()
+		for _, line := range detectionStep {
+			yaml.WriteString(line + "\n")
+		}
+	}
+
 	// Mark that we've completed agent execution - step order validation starts from here
 	compilerYamlLog.Print("Marking agent execution as complete for step order tracking")
 	c.stepOrderTracker.MarkAgentExecutionComplete()
diff --git a/pkg/workflow/copilot_engine_execution.go b/pkg/workflow/copilot_engine_execution.go
index d9c33c59c8..87618bba69 100644
--- a/pkg/workflow/copilot_engine_execution.go
+++ b/pkg/workflow/copilot_engine_execution.go
@@ -387,6 +387,28 @@ COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"
 	return steps
 }
 
+// generateInferenceAccessErrorDetectionStep generates a step that detects if the Copilot CLI
+// failed due to a token with invalid access to inference (policy access denied error).
+// The step always runs and checks the agent stdio log for known error patterns.
+func generateInferenceAccessErrorDetectionStep() GitHubActionStep {
+	var step []string
+
+	step = append(step, "      - name: Detect inference access error")
+	step = append(step, "        id: detect-inference-error")
+	step = append(step, "        if: always()")
+	step = append(step, "        continue-on-error: true")
+	step = append(step, "        run: |")
+	step = append(step, "          LOG_FILE=\"/tmp/gh-aw/agent-stdio.log\"")
+	step = append(step, "          if [ -f \"$LOG_FILE\" ] && grep -qE \"Access denied by policy settings|invalid access to inference\" \"$LOG_FILE\"; then")
+	step = append(step, "            echo \"Detected inference access error in agent log\"")
+	step = append(step, "            echo \"inference_access_error=true\" >> \"$GITHUB_OUTPUT\"")
+	step = append(step, "          else")
+	step = append(step, "            echo \"inference_access_error=false\" >> \"$GITHUB_OUTPUT\"")
+	step = append(step, "          fi")
+
+	return GitHubActionStep(step)
+}
+
 // extractAddDirPaths extracts all directory paths from copilot args that follow --add-dir flags
 func extractAddDirPaths(args []string) []string {
 	var dirs []string
diff --git a/pkg/workflow/inference_access_error_test.go b/pkg/workflow/inference_access_error_test.go
new file mode 100644
index 0000000000..dcdc4136c5
--- /dev/null
+++ b/pkg/workflow/inference_access_error_test.go
@@ -0,0 +1,142 @@
+//go:build !integration
+
+package workflow
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/github/gh-aw/pkg/stringutil"
+	"github.com/github/gh-aw/pkg/testutil"
+)
+
+// TestInferenceAccessErrorDetectionStep tests that a Copilot engine workflow includes
+// the detect-inference-error step in the agent job.
+func TestInferenceAccessErrorDetectionStep(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-inference-access-error-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: copilot
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that agent job has detect-inference-error step
+	if !strings.Contains(lockStr, "id: detect-inference-error") {
+		t.Error("Expected agent job to have detect-inference-error step")
+	}
+
+	// Check that the detection step uses the correct log file path
+	if !strings.Contains(lockStr, "LOG_FILE=\"/tmp/gh-aw/agent-stdio.log\"") {
+		t.Error("Expected detect-inference-error step to check agent-stdio.log")
+	}
+
+	// Check that the agent job exposes inference_access_error output
+	if !strings.Contains(lockStr, "inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}") {
+		t.Error("Expected agent job to have inference_access_error output")
+	}
+}
+
+// TestInferenceAccessErrorInConclusionJob tests that the conclusion job receives the inference access error
+// env var when the Copilot engine is used.
+func TestInferenceAccessErrorInConclusionJob(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-inference-access-error-conclusion-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: copilot
+safe-outputs:
+  add-comment:
+    max: 5
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that conclusion job receives inference access error from agent job
+	if !strings.Contains(lockStr, "GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}") {
+		t.Error("Expected conclusion job to receive inference_access_error from agent job")
+	}
+}
+
+// TestInferenceAccessErrorNotInNonCopilotEngine tests that non-Copilot engines
+// do NOT include the detect-inference-error step.
+func TestInferenceAccessErrorNotInNonCopilotEngine(t *testing.T) {
+	testDir := testutil.TempDir(t, "test-inference-access-error-claude-*")
+	workflowFile := filepath.Join(testDir, "test-workflow.md")
+
+	workflow := `---
+on: workflow_dispatch
+engine: claude
+---
+
+Test workflow`
+
+	if err := os.WriteFile(workflowFile, []byte(workflow), 0644); err != nil {
+		t.Fatalf("Failed to write test workflow: %v", err)
+	}
+
+	compiler := NewCompiler()
+	if err := compiler.CompileWorkflow(workflowFile); err != nil {
+		t.Fatalf("Failed to compile workflow: %v", err)
+	}
+
+	// Read the generated lock file
+	lockFile := stringutil.MarkdownToLockFile(workflowFile)
+	lockContent, err := os.ReadFile(lockFile)
+	if err != nil {
+		t.Fatalf("Failed to read lock file: %v", err)
+	}
+
+	lockStr := string(lockContent)
+
+	// Check that non-Copilot engines do NOT have the detect-inference-error step
+	if strings.Contains(lockStr, "id: detect-inference-error") {
+		t.Error("Expected non-Copilot engine to NOT have detect-inference-error step")
+	}
+
+	// Check that non-Copilot engines do NOT have the inference_access_error output
+	if strings.Contains(lockStr, "inference_access_error:") {
+		t.Error("Expected non-Copilot engine to NOT have inference_access_error output")
+	}
+}
diff --git a/pkg/workflow/notify_comment.go b/pkg/workflow/notify_comment.go
index 95e5b7bbd8..cae1935cd2 100644
--- a/pkg/workflow/notify_comment.go
+++ b/pkg/workflow/notify_comment.go
@@ -143,6 +143,12 @@ func (c *Compiler) buildConclusionJob(data *WorkflowData, mainJobName string, sa
 		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.%s.outputs.checkout_pr_success }}\n", mainJobName))
 	}
 
+	// Pass inference access error output for Copilot engine
+	// This detects when the Copilot CLI fails due to the token lacking inference access
+	if _, ok := engine.(*CopilotEngine); ok {
+		agentFailureEnvVars = append(agentFailureEnvVars, fmt.Sprintf("          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.%s.outputs.inference_access_error }}\n", mainJobName))
+	}
+
 	// Pass assignment error outputs from safe_outputs job if assign-to-agent is configured
 	if data.SafeOutputs != nil && data.SafeOutputs.AssignToAgent != nil {
 		agentFailureEnvVars = append(agentFailureEnvVars, "          GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}\n")

From 18eb2443b437a66450ccf2438663a9ab3484d411 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Mar 2026 12:50:10 +0000
Subject: [PATCH 3/4] Refactor: move inference error script to sh/ and text to
 md/

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../agent-performance-analyzer.lock.yml       |  9 +------
 .../workflows/agent-persona-explorer.lock.yml | 14 +++++++++++
 .github/workflows/archie.lock.yml             |  9 +------
 .github/workflows/artifacts-summary.lock.yml  |  9 +------
 .github/workflows/auto-triage-issues.lock.yml |  9 +------
 .github/workflows/brave.lock.yml              |  9 +------
 .../breaking-change-checker.lock.yml          |  9 +------
 .github/workflows/ci-coach.lock.yml           |  9 +------
 .github/workflows/ci-doctor.lock.yml          | 14 +++++++++++
 .../cli-consistency-checker.lock.yml          |  9 +------
 .../workflows/code-scanning-fixer.lock.yml    |  9 +------
 .github/workflows/code-simplifier.lock.yml    | 14 +++++++++++
 .github/workflows/contribution-check.lock.yml | 14 +++++++++++
 .../copilot-cli-deep-research.lock.yml        |  9 +------
 .../copilot-pr-merged-report.lock.yml         |  9 +------
 .../copilot-pr-nlp-analysis.lock.yml          |  9 +------
 .../copilot-pr-prompt-analysis.lock.yml       |  9 +------
 .github/workflows/craft.lock.yml              |  9 +------
 .../daily-architecture-diagram.lock.yml       |  9 +------
 .../daily-assign-issue-to-user.lock.yml       |  9 +------
 .../workflows/daily-cli-performance.lock.yml  |  9 +------
 .../workflows/daily-cli-tools-tester.lock.yml | 14 +++++++++++
 .../workflows/daily-compiler-quality.lock.yml |  9 +------
 .../daily-copilot-token-report.lock.yml       |  9 +------
 .github/workflows/daily-file-diet.lock.yml    |  9 +------
 .../workflows/daily-firewall-report.lock.yml  | 14 +++++++++++
 .../daily-malicious-code-scan.lock.yml        |  9 +------
 .../daily-mcp-concurrency-analysis.lock.yml   |  9 +------
 .github/workflows/daily-news.lock.yml         |  9 +------
 .../daily-performance-summary.lock.yml        |  9 +------
 .github/workflows/daily-regulatory.lock.yml   | 14 +++++++++++
 .../workflows/daily-repo-chronicle.lock.yml   |  9 +------
 .../workflows/daily-secrets-analysis.lock.yml |  9 +------
 .github/workflows/daily-semgrep-scan.lock.yml | 14 +++++++++++
 .../daily-syntax-error-quality.lock.yml       |  9 +------
 .github/workflows/daily-team-status.lock.yml  | 14 +++++++++++
 .../daily-testify-uber-super-expert.lock.yml  |  9 +------
 .../workflows/daily-workflow-updater.lock.yml |  9 +------
 .github/workflows/dead-code-remover.lock.yml  |  9 +------
 .github/workflows/delight.lock.yml            |  9 +------
 .github/workflows/dependabot-burner.lock.yml  | 14 +++++++++++
 .../workflows/dependabot-go-checker.lock.yml  | 14 +++++++++++
 .github/workflows/dev-hawk.lock.yml           |  9 +------
 .github/workflows/dev.lock.yml                |  9 +------
 .github/workflows/dictation-prompt.lock.yml   |  9 +------
 .../workflows/discussion-task-miner.lock.yml  |  9 +------
 .github/workflows/docs-noob-tester.lock.yml   |  9 +------
 .github/workflows/draft-pr-cleanup.lock.yml   |  9 +------
 .github/workflows/firewall-escape.lock.yml    |  9 +------
 .github/workflows/firewall.lock.yml           |  9 +------
 .../workflows/functional-pragmatist.lock.yml  | 14 +++++++++++
 .../github-remote-mcp-auth-test.lock.yml      | 14 +++++++++++
 .../workflows/glossary-maintainer.lock.yml    | 14 +++++++++++
 .github/workflows/gpclean.lock.yml            | 14 +++++++++++
 .github/workflows/grumpy-reviewer.lock.yml    |  9 +------
 .github/workflows/hourly-ci-cleaner.lock.yml  | 14 +++++++++++
 .github/workflows/issue-monster.lock.yml      | 14 +++++++++++
 .github/workflows/issue-triage-agent.lock.yml | 14 +++++++++++
 .github/workflows/jsweep.lock.yml             |  9 +------
 .../workflows/layout-spec-maintainer.lock.yml |  9 +------
 .github/workflows/mcp-inspector.lock.yml      |  9 +------
 .github/workflows/mergefest.lock.yml          |  9 +------
 .github/workflows/metrics-collector.lock.yml  |  9 +------
 .github/workflows/org-health-report.lock.yml  |  9 +------
 .github/workflows/pdf-summary.lock.yml        |  9 +------
 .github/workflows/plan.lock.yml               |  9 +------
 .github/workflows/poem-bot.lock.yml           | 14 +++++++++++
 .github/workflows/portfolio-analyst.lock.yml  |  9 +------
 .../workflows/pr-nitpick-reviewer.lock.yml    |  9 +------
 .github/workflows/pr-triage-agent.lock.yml    |  9 +------
 .github/workflows/python-data-charts.lock.yml |  9 +------
 .github/workflows/q.lock.yml                  |  9 +------
 .github/workflows/refiner.lock.yml            |  9 +------
 .github/workflows/release.lock.yml            |  9 +------
 .../workflows/repo-audit-analyzer.lock.yml    | 14 +++++++++++
 .github/workflows/repo-tree-map.lock.yml      |  9 +------
 .../repository-quality-improver.lock.yml      |  9 +------
 .github/workflows/research.lock.yml           |  9 +------
 .../workflows/security-compliance.lock.yml    |  9 +------
 .github/workflows/security-review.lock.yml    | 14 +++++++++++
 .../workflows/slide-deck-maintainer.lock.yml  |  9 +------
 .github/workflows/smoke-copilot-arm.lock.yml  |  9 +------
 .github/workflows/smoke-copilot.lock.yml      | 14 +++++++++++
 .../smoke-create-cross-repo-pr.lock.yml       | 14 +++++++++++
 .github/workflows/smoke-multi-pr.lock.yml     |  9 +------
 .github/workflows/smoke-project.lock.yml      | 14 +++++++++++
 .github/workflows/smoke-temporary-id.lock.yml |  9 +------
 .github/workflows/smoke-test-tools.lock.yml   |  9 +------
 .../smoke-update-cross-repo-pr.lock.yml       | 14 +++++++++++
 .../workflows/smoke-workflow-call.lock.yml    |  9 +------
 .../workflows/stale-repo-identifier.lock.yml  |  9 +------
 .github/workflows/sub-issue-closer.lock.yml   |  9 +------
 .github/workflows/super-linter.lock.yml       |  9 +------
 .../workflows/technical-doc-writer.lock.yml   | 14 +++++++++++
 .github/workflows/terminal-stylist.lock.yml   |  9 +------
 .github/workflows/test-dispatcher.lock.yml    | 14 +++++++++++
 .../test-project-url-default.lock.yml         |  9 +------
 .github/workflows/tidy.lock.yml               |  9 +------
 .../workflows/ubuntu-image-analyzer.lock.yml  |  9 +------
 .github/workflows/video-analyzer.lock.yml     |  9 +------
 .../weekly-editors-health-check.lock.yml      |  9 +------
 .../workflows/weekly-issue-summary.lock.yml   |  9 +------
 .../weekly-safe-outputs-spec-review.lock.yml  |  9 +------
 .github/workflows/workflow-generator.lock.yml |  9 +------
 .../workflow-health-manager.lock.yml          |  9 +------
 .../workflows/workflow-normalizer.lock.yml    | 14 +++++++++++
 .../workflow-skill-extractor.lock.yml         | 14 +++++++++++
 actions/setup/js/handle_agent_failure.cjs     | 11 +++-----
 actions/setup/md/inference_access_error.md    |  9 +++++++
 .../setup/sh/detect_inference_access_error.sh | 25 +++++++++++++++++++
 pkg/workflow/copilot_engine_execution.go      |  9 +------
 pkg/workflow/inference_access_error_test.go   |  6 ++---
 112 files changed, 525 insertions(+), 643 deletions(-)
 create mode 100644 actions/setup/md/inference_access_error.md
 create mode 100644 actions/setup/sh/detect_inference_access_error.sh

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 4733adae9a..8d8483d093 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -849,14 +849,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 4440a4fc80..d331a4a6eb 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -273,6 +273,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -731,6 +732,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1068,6 +1081,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "agent-persona-explorer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index a7d7353ecd..1c414264c6 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -691,14 +691,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 808e5141ac..a0667676f8 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -646,14 +646,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index 19bc11f1f2..94e910e658 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -715,14 +715,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index cab158036b..8736a9b66c 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -678,14 +678,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index b5c239d4b4..e725893275 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -690,14 +690,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index 9a6af9a984..82ab8db186 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -743,14 +743,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 8a807a6930..561cbb2e28 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -302,6 +302,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -879,6 +880,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1223,6 +1236,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "ci-doctor"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🩺 *Diagnosis provided by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🏥 CI Doctor reporting for duty! [{workflow_name}]({run_url}) is examining the patient on this {event_type}...\",\"runSuccess\":\"🩺 Examination complete! [{workflow_name}]({run_url}) has delivered the diagnosis. Prescription issued! 💊\",\"runFailure\":\"🏥 Medical emergency! [{workflow_name}]({run_url}) {status}. Doctor needs assistance...\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index f69e17a027..7f073dedfa 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -659,14 +659,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index 94a3cb5246..3b5bdcfefe 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -736,14 +736,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 6543689800..70f847a59d 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -270,6 +270,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -676,6 +677,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1010,6 +1023,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "code-simplifier"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index 87368e69a4..e06e4fb760 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -730,6 +731,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1061,6 +1074,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "contribution-check"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index 49cbf5c236..5b92415359 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -690,14 +690,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index 330ca4e5af..aa493f9305 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -799,14 +799,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index e128d2c261..71a9269863 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -769,14 +769,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 2bed900ea3..5fd903ed7c 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -703,14 +703,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 1ec7e38b04..cfb26fee7d 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -713,14 +713,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 20ccb93a13..1e12b098d9 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -761,14 +761,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 3e58aaa353..f1e852ffbb 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -674,14 +674,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 3473ed2b59..43f6d3fde0 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -868,14 +868,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index e30eb8943b..d920eabe27 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -256,6 +256,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -726,6 +727,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1055,6 +1068,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-cli-tools-tester"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "60"
         with:
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 347eaff17c..1acc394c46 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -694,14 +694,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 3e67c68fe7..39acbcd949 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -776,14 +776,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index 80aaeb3eb6..4ea82a371e 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -708,14 +708,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index e1cf3ce0da..651620e5f6 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -276,6 +276,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -789,6 +790,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1139,6 +1152,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-firewall-report"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 76be54dcd9..ef1951e0d3 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -682,14 +682,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index 46bfecabf6..3874821ec5 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -748,14 +748,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index 5cb4e177c6..8b78868b06 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -837,14 +837,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 223651618d..16b56a04b5 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1260,14 +1260,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index dce69f783b..2927a6adac 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -268,6 +268,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1177,6 +1178,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1520,6 +1533,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-regulatory"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 9152141358..985e746b62 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -725,14 +725,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index 8bbb689402..ad1e902383 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -706,14 +706,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index c788c47912..8565fab821 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -261,6 +261,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -696,6 +697,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1025,6 +1038,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-semgrep-scan"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index 3f82a295ea..0f337ac12e 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -688,14 +688,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 2ffe68a0a0..d125742c2d 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -271,6 +271,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -674,6 +675,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1012,6 +1025,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "daily-team-status"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "10"
         with:
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index ba0b3822df..0bdd71b302 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -729,14 +729,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 437cad86f0..f6ac055d06 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -663,14 +663,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index e0e1326cdb..c60fac0395 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -701,14 +701,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index f07c7ee930..503c2097da 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -770,14 +770,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index bbe5327962..bb680025b7 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -256,6 +256,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -659,6 +660,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -988,6 +1001,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "dependabot-burner"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 4ee7c77a55..de3fa99860 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -255,6 +255,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -700,6 +701,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1029,6 +1042,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "dependabot-go-checker"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index f3d0b303a3..a330998b21 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -742,14 +742,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 6a39ee9988..3b209009f4 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -656,14 +656,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 0b88d6d39f..975875750b 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -669,14 +669,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index 7aa5c6204e..74d0717039 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -745,14 +745,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index b3b16c9b46..40e794d87f 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -687,14 +687,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 7a94c09ffd..feb8c3a86a 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -703,14 +703,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index db4a5a647e..248ffbd52e 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -698,14 +698,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index 3429585a99..722a8e968a 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -375,14 +375,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index 7346271295..4c2f140a4a 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -264,6 +264,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -670,6 +671,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1004,6 +1017,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "functional-pragmatist"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index dde07cf569..22f056a089 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -259,6 +259,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -649,6 +650,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -979,6 +992,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "github-remote-mcp-auth-test"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index e816daf89d..a5a942d3d6 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -279,6 +279,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -742,6 +743,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1080,6 +1093,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "glossary-maintainer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index 0264b50e0c..fdf83bc020 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -261,6 +261,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -680,6 +681,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1016,6 +1029,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "gpclean"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "30"
         with:
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 1881096254..b5bf0d1b10 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -754,14 +754,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 87788dbadb..a66382cc73 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -720,6 +721,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1103,6 +1116,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "hourly-ci-cleaner"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 063b9396d4..60bf7a5fb9 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -695,6 +696,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1026,6 +1039,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "issue-monster"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_ASSIGNMENT_ERRORS: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_errors }}
           GH_AW_ASSIGNMENT_ERROR_COUNT: ${{ needs.safe_outputs.outputs.assign_to_agent_assignment_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🍪 *Om nom nom by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🍪 ISSUE! ISSUE! [{workflow_name}]({run_url}) hungry for issues on this {event_type}! Om nom nom...\",\"runSuccess\":\"🍪 YUMMY! [{workflow_name}]({run_url}) ate the issues! That was DELICIOUS! Me want MORE! 😋\",\"runFailure\":\"🍪 Aww... [{workflow_name}]({run_url}) {status}. No cookie for monster today... 😢\"}"
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 8042326bc6..434cf6f354 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -260,6 +260,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -643,6 +644,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -973,6 +986,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "issue-triage-agent"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "5"
         with:
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index f4d6f3d61a..2067743dec 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -704,14 +704,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 99ac7da509..b132454ae2 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -704,14 +704,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 8351b3d97d..b3525a4000 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1040,14 +1040,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 0380d0429a..ac6c4ff06e 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -711,14 +711,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 3a2010462a..2af80b0450 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -473,14 +473,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 53a9a7f254..dbfa3e101a 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -724,14 +724,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index 045d98543a..0f2e60fcf0 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -775,14 +775,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index f306da9144..dddecaed66 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -751,14 +751,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 5b9a945c65..8809cd7881 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -322,6 +322,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1347,6 +1348,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1700,6 +1713,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "poem-bot"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 0d0f413186..2184c8fda6 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -805,14 +805,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 944831697f..0eedf8b449 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -847,14 +847,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index 0af8c351c9..3e5f2f61cc 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -754,14 +754,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index e48e04794f..232850c445 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -793,14 +793,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 667f94b1f0..d79a5e05da 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -885,14 +885,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 66c9475908..06374cc4e8 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -729,14 +729,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 6a44c6bd90..4e1d9e5e9d 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -667,14 +667,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index 9e19c23f25..5c35c7b3ca 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -273,6 +273,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -665,6 +666,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1005,6 +1018,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "repo-audit-analyzer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index 4bfdb1bb73..4cf74f39af 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -646,14 +646,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index a0daa4e4dd..3bf4bc780c 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -677,14 +677,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index e241dd1618..d3e4a0de3d 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -671,14 +671,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index b00a6c94e4..5f8ebb199e 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -713,14 +713,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index d80367d94d..80ed2ad4d7 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -302,6 +302,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -828,6 +829,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1165,6 +1178,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "security-review"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔒 *Security review by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔍 [{workflow_name}]({run_url}) is analyzing this {event_type} for security implications...\",\"runSuccess\":\"🔒 [{workflow_name}]({run_url}) completed the security review.\",\"runFailure\":\"⚠️ [{workflow_name}]({run_url}) {status} during security review.\"}"
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "15"
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 1e004abd73..7758979dc1 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -764,14 +764,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index 0f2f8e3db0..1ac3ee4a6f 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -1673,14 +1673,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 5d51948d8f..e34346d1ec 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -323,6 +323,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1712,6 +1713,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -2062,6 +2075,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-copilot"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📰 *BREAKING: Report filed by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"📰 BREAKING: [{workflow_name}]({run_url}) is now investigating this {event_type}. Sources say the story is developing...\",\"runSuccess\":\"📰 VERDICT: [{workflow_name}]({run_url}) has concluded. All systems operational. This is a developing story. 🎤\",\"runFailure\":\"📰 DEVELOPING STORY: [{workflow_name}]({run_url}) reports {status}. Our correspondents are investigating the incident...\"}"
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index 94420e61a8..21b3408afe 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -295,6 +295,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -822,6 +823,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1154,6 +1167,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "smoke-create-cross-repo-pr"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🔬 *Cross-repo smoke test by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"🔬 [{workflow_name}]({run_url}) is testing cross-repo PR creation in githubnext/gh-aw-side-repo...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully created a cross-repo PR in githubnext/gh-aw-side-repo!\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to create a cross-repo PR: {status}\"}"
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index c9c6804ae1..72e044db4b 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -769,14 +769,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index e55ab57a04..20b0ba0942 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -293,6 +293,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -1157,6 +1158,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1489,6 +1502,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "smoke-project"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 🧪 *Project smoke test report by [{workflow_name}]({run_url})*{history_link}\",\"appendOnlyComments\":true,\"runStarted\":\"🧪 [{workflow_name}]({run_url}) is now testing project operations...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) completed successfully. All project operations validated.\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) encountered failures. Check the logs for details.\"}"
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index f877440974..0ecc291293 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -782,14 +782,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index c6a393c4c9..2df8b63f85 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -685,14 +685,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index 36df2565bb..763ac968fc 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -302,6 +302,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -817,6 +818,18 @@ jobs:
           GITHUB_WORKSPACE: ${{ github.workspace }}
           S2STOKENS: true
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1156,6 +1169,7 @@ jobs:
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
           GH_AW_WORKFLOW_ID: "smoke-update-cross-repo-pr"
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📜 *Cross-repo PR update smoke test by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"📜 [{workflow_name}]({run_url}) is adding the next Odyssey line to githubnext/gh-aw-side-repo PR #1...\",\"runSuccess\":\"✅ [{workflow_name}]({run_url}) successfully updated the cross-repo PR with a new Odyssey line!\",\"runFailure\":\"❌ [{workflow_name}]({run_url}) failed to update the cross-repo PR: {status}\"}"
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index a611098148..c99de4eb02 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -652,14 +652,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index bcf1755c8a..a0453b84be 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -793,14 +793,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index ab6cfc9d1d..15107642bc 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -744,14 +744,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 4004e8ced7..66961ded9d 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -700,14 +700,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 0bc89370f6..b821f75a87 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -281,6 +281,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -795,6 +796,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1144,6 +1157,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "technical-doc-writer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CODE_PUSH_FAILURE_ERRORS: ${{ needs.safe_outputs.outputs.code_push_failure_errors }}
           GH_AW_CODE_PUSH_FAILURE_COUNT: ${{ needs.safe_outputs.outputs.code_push_failure_count }}
           GH_AW_SAFE_OUTPUT_MESSAGES: "{\"footer\":\"\\u003e 📝 *Documentation by [{workflow_name}]({run_url})*{history_link}\",\"runStarted\":\"✍️ The Technical Writer begins! [{workflow_name}]({run_url}) is documenting this {event_type}...\",\"runSuccess\":\"📝 Documentation complete! [{workflow_name}]({run_url}) has written the docs. Clear as crystal! ✨\",\"runFailure\":\"✍️ Writer's block! [{workflow_name}]({run_url}) {status}. The page remains blank...\"}"
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index ac371d608f..48366c6417 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -654,14 +654,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index d21a9ee864..6e2bfe9aa1 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -246,6 +246,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -593,6 +594,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -921,6 +934,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "test-dispatcher"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "20"
         with:
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index f25d4a1263..27b62f572b 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -841,14 +841,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index b49fa2f906..d4879a419a 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -796,14 +796,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index ea98e57696..e53328e60c 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -700,14 +700,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index b0cb2e2d59..0ff6e90d19 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -699,14 +699,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index 67ded6bb6d..92f22aa0d9 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -737,14 +737,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 22ef3ec9f2..bd15d5c13e 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -704,14 +704,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 81cc6e1490..613827aed9 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -658,14 +658,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 99c54101b6..ef5078f57d 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -782,14 +782,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index db1c6e9fef..aed687915c 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -851,14 +851,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index 7c9f27a7ca..a6be647eca 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -262,6 +262,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -732,6 +733,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1064,6 +1077,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "workflow-normalizer"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_GROUP_REPORTS: "false"
           GH_AW_TIMEOUT_MINUTES: "30"
         with:
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index f522d23ff4..6ae3da338f 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -261,6 +261,7 @@ jobs:
       detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
       detection_success: ${{ steps.detection_conclusion.outputs.success }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
@@ -736,6 +737,18 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: |
+          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+            echo "Detected inference access error in agent log"
+            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+          fi
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
@@ -1066,6 +1079,7 @@ jobs:
           GH_AW_WORKFLOW_ID: "workflow-skill-extractor"
           GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
           GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
           GH_AW_CREATE_DISCUSSION_ERRORS: ${{ needs.safe_outputs.outputs.create_discussion_errors }}
           GH_AW_CREATE_DISCUSSION_ERROR_COUNT: ${{ needs.safe_outputs.outputs.create_discussion_error_count }}
           GH_AW_GROUP_REPORTS: "false"
diff --git a/actions/setup/js/handle_agent_failure.cjs b/actions/setup/js/handle_agent_failure.cjs
index c29107e06e..704ac97ae1 100644
--- a/actions/setup/js/handle_agent_failure.cjs
+++ b/actions/setup/js/handle_agent_failure.cjs
@@ -463,14 +463,9 @@ function buildInferenceAccessErrorContext(hasInferenceAccessError) {
     return "";
   }
 
-  let ctx = "\n**🔑 Inference Access Denied**: The Copilot CLI failed because the token does not have access to inference.";
-  ctx += " This can happen when:\n\n";
-  ctx += "- Your organization has restricted Copilot access\n";
-  ctx += "- The `COPILOT_GITHUB_TOKEN` does not have a valid Copilot subscription\n";
-  ctx += "- Required policies have not been enabled by your administrator\n\n";
-  ctx += "To resolve this, verify that the `COPILOT_GITHUB_TOKEN` secret belongs to an account with an active Copilot subscription and check your [Copilot settings](https://github.com/settings/copilot).\n\n";
-
-  return ctx;
+  const templatePath = "/opt/gh-aw/prompts/inference_access_error.md";
+  const template = fs.readFileSync(templatePath, "utf8");
+  return "\n" + template;
 }
 
 /**
diff --git a/actions/setup/md/inference_access_error.md b/actions/setup/md/inference_access_error.md
new file mode 100644
index 0000000000..3e3c5e9e79
--- /dev/null
+++ b/actions/setup/md/inference_access_error.md
@@ -0,0 +1,9 @@
+
+**🔑 Inference Access Denied**: The Copilot CLI failed because the token does not have access to inference. This can happen when:
+
+- Your organization has restricted Copilot access
+- The `COPILOT_GITHUB_TOKEN` does not have a valid Copilot subscription
+- Required policies have not been enabled by your administrator
+
+To resolve this, verify that the `COPILOT_GITHUB_TOKEN` secret belongs to an account with an active Copilot subscription and check your [Copilot settings](https://github.com/settings/copilot).
+
diff --git a/actions/setup/sh/detect_inference_access_error.sh b/actions/setup/sh/detect_inference_access_error.sh
new file mode 100644
index 0000000000..ee29943491
--- /dev/null
+++ b/actions/setup/sh/detect_inference_access_error.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+#
+# detect_inference_access_error.sh - Detect Copilot CLI inference access errors
+#
+# Checks the agent stdio log for known error patterns that indicate the
+# COPILOT_GITHUB_TOKEN does not have valid access to inference (e.g., the
+# "Access denied by policy settings" error emitted by the Copilot CLI).
+#
+# Sets the GitHub Actions output variable:
+#   inference_access_error=true   if the error pattern is found
+#   inference_access_error=false  otherwise
+#
+# Exit codes:
+#   0 - Always succeeds (uses continue-on-error in the workflow step)
+
+set -euo pipefail
+
+LOG_FILE="/tmp/gh-aw/agent-stdio.log"
+
+if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
+  echo "Detected inference access error in agent log"
+  echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
+else
+  echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
+fi
diff --git a/pkg/workflow/copilot_engine_execution.go b/pkg/workflow/copilot_engine_execution.go
index 87618bba69..f3b45baafe 100644
--- a/pkg/workflow/copilot_engine_execution.go
+++ b/pkg/workflow/copilot_engine_execution.go
@@ -397,14 +397,7 @@ func generateInferenceAccessErrorDetectionStep() GitHubActionStep {
 	step = append(step, "        id: detect-inference-error")
 	step = append(step, "        if: always()")
 	step = append(step, "        continue-on-error: true")
-	step = append(step, "        run: |")
-	step = append(step, "          LOG_FILE=\"/tmp/gh-aw/agent-stdio.log\"")
-	step = append(step, "          if [ -f \"$LOG_FILE\" ] && grep -qE \"Access denied by policy settings|invalid access to inference\" \"$LOG_FILE\"; then")
-	step = append(step, "            echo \"Detected inference access error in agent log\"")
-	step = append(step, "            echo \"inference_access_error=true\" >> \"$GITHUB_OUTPUT\"")
-	step = append(step, "          else")
-	step = append(step, "            echo \"inference_access_error=false\" >> \"$GITHUB_OUTPUT\"")
-	step = append(step, "          fi")
+	step = append(step, "        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh")
 
 	return GitHubActionStep(step)
 }
diff --git a/pkg/workflow/inference_access_error_test.go b/pkg/workflow/inference_access_error_test.go
index dcdc4136c5..64385ab64f 100644
--- a/pkg/workflow/inference_access_error_test.go
+++ b/pkg/workflow/inference_access_error_test.go
@@ -48,9 +48,9 @@ Test workflow`
 		t.Error("Expected agent job to have detect-inference-error step")
 	}
 
-	// Check that the detection step uses the correct log file path
-	if !strings.Contains(lockStr, "LOG_FILE=\"/tmp/gh-aw/agent-stdio.log\"") {
-		t.Error("Expected detect-inference-error step to check agent-stdio.log")
+	// Check that the detection step calls the shell script
+	if !strings.Contains(lockStr, "bash /opt/gh-aw/actions/detect_inference_access_error.sh") {
+		t.Error("Expected detect-inference-error step to call detect_inference_access_error.sh")
 	}
 
 	// Check that the agent job exposes inference_access_error output

From ae2d974190d55158c6f3fc7a5befb70cd68732bd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 3 Mar 2026 13:05:28 +0000
Subject: [PATCH 4/4] Update wasm golden files for inference access error
 detection step

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .github/workflows/agent-persona-explorer.lock.yml        | 9 +--------
 .github/workflows/bot-detection.lock.yml                 | 9 +--------
 .github/workflows/chroma-issue-indexer.lock.yml          | 9 +--------
 .github/workflows/ci-doctor.lock.yml                     | 9 +--------
 .github/workflows/code-simplifier.lock.yml               | 9 +--------
 .github/workflows/contribution-check.lock.yml            | 9 +--------
 .github/workflows/daily-cli-tools-tester.lock.yml        | 9 +--------
 .github/workflows/daily-firewall-report.lock.yml         | 9 +--------
 .github/workflows/daily-regulatory.lock.yml              | 9 +--------
 .github/workflows/daily-semgrep-scan.lock.yml            | 9 +--------
 .github/workflows/daily-team-status.lock.yml             | 9 +--------
 .github/workflows/dependabot-burner.lock.yml             | 9 +--------
 .github/workflows/dependabot-go-checker.lock.yml         | 9 +--------
 .github/workflows/example-custom-error-patterns.lock.yml | 9 +--------
 .github/workflows/example-permissions-warning.lock.yml   | 9 +--------
 .github/workflows/functional-pragmatist.lock.yml         | 9 +--------
 .github/workflows/github-remote-mcp-auth-test.lock.yml   | 9 +--------
 .github/workflows/glossary-maintainer.lock.yml           | 9 +--------
 .github/workflows/gpclean.lock.yml                       | 9 +--------
 .github/workflows/hourly-ci-cleaner.lock.yml             | 9 +--------
 .github/workflows/issue-monster.lock.yml                 | 9 +--------
 .github/workflows/issue-triage-agent.lock.yml            | 9 +--------
 .github/workflows/notion-issue-summary.lock.yml          | 9 +--------
 .github/workflows/poem-bot.lock.yml                      | 9 +--------
 .github/workflows/repo-audit-analyzer.lock.yml           | 9 +--------
 .github/workflows/security-review.lock.yml               | 9 +--------
 .github/workflows/smoke-copilot.lock.yml                 | 9 +--------
 .github/workflows/smoke-create-cross-repo-pr.lock.yml    | 9 +--------
 .github/workflows/smoke-project.lock.yml                 | 9 +--------
 .github/workflows/smoke-update-cross-repo-pr.lock.yml    | 9 +--------
 .github/workflows/technical-doc-writer.lock.yml          | 9 +--------
 .github/workflows/test-dispatcher.lock.yml               | 9 +--------
 .github/workflows/test-workflow.lock.yml                 | 9 +--------
 .github/workflows/workflow-normalizer.lock.yml           | 9 +--------
 .github/workflows/workflow-skill-extractor.lock.yml      | 9 +--------
 .../TestWasmGolden_CompileFixtures/basic-copilot.golden  | 6 ++++++
 .../TestWasmGolden_CompileFixtures/smoke-copilot.golden  | 6 ++++++
 .../TestWasmGolden_CompileFixtures/with-imports.golden   | 6 ++++++
 38 files changed, 53 insertions(+), 280 deletions(-)

diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index d331a4a6eb..2d9ff804b7 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -736,14 +736,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index e43f8cc30f..5a837fcc7f 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -799,14 +799,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/chroma-issue-indexer.lock.yml b/.github/workflows/chroma-issue-indexer.lock.yml
index 31fc3bd885..d39ed96242 100644
--- a/.github/workflows/chroma-issue-indexer.lock.yml
+++ b/.github/workflows/chroma-issue-indexer.lock.yml
@@ -424,14 +424,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 561cbb2e28..412b5498c8 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -884,14 +884,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 70f847a59d..2c2fe08b79 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -681,14 +681,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index e06e4fb760..226ad4b284 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -735,14 +735,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index d920eabe27..e0b817f449 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -731,14 +731,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 651620e5f6..3f97157749 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -794,14 +794,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 2927a6adac..c1200b66bb 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -1182,14 +1182,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index 8565fab821..017417c327 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -701,14 +701,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index d125742c2d..f4d49fcc69 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -679,14 +679,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index bb680025b7..8218ff9ca6 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -664,14 +664,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index de3fa99860..5e7613481d 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -705,14 +705,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/example-custom-error-patterns.lock.yml b/.github/workflows/example-custom-error-patterns.lock.yml
index de87519f19..aa7032a68e 100644
--- a/.github/workflows/example-custom-error-patterns.lock.yml
+++ b/.github/workflows/example-custom-error-patterns.lock.yml
@@ -390,14 +390,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index 21c19d2cfc..5d97100406 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -373,14 +373,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index 4c2f140a4a..782a089e45 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -675,14 +675,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 22f056a089..f481124517 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -654,14 +654,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index a5a942d3d6..57ad91bb7f 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -747,14 +747,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index fdf83bc020..a54cb009a9 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -685,14 +685,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index a66382cc73..3590ea5e22 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -725,14 +725,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 60bf7a5fb9..2511140d03 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -700,14 +700,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 434cf6f354..61806c8758 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -648,14 +648,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 60ea69483e..fa7d6eb982 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -627,14 +627,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 8809cd7881..e4e7969795 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -1352,14 +1352,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index 5c35c7b3ca..170b30b1ba 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -670,14 +670,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 80ed2ad4d7..4ab8184939 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -833,14 +833,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index e34346d1ec..43f2fd5769 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -1717,14 +1717,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index 21b3408afe..56e94aa4b0 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -827,14 +827,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index 20b0ba0942..35389a592e 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -1162,14 +1162,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index 763ac968fc..ab7cc45c8f 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -822,14 +822,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index b821f75a87..e98ae1790b 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -800,14 +800,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index 6e2bfe9aa1..09020b1f0b 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -598,14 +598,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/test-workflow.lock.yml b/.github/workflows/test-workflow.lock.yml
index cd0669e82e..1fd342ffe9 100644
--- a/.github/workflows/test-workflow.lock.yml
+++ b/.github/workflows/test-workflow.lock.yml
@@ -375,14 +375,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index a6be647eca..ac84e0c20b 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -737,14 +737,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index 6ae3da338f..aff550a0cb 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -741,14 +741,7 @@ jobs:
         id: detect-inference-error
         if: always()
         continue-on-error: true
-        run: |
-          LOG_FILE="/tmp/gh-aw/agent-stdio.log"
-          if [ -f "$LOG_FILE" ] && grep -qE "Access denied by policy settings|invalid access to inference" "$LOG_FILE"; then
-            echo "Detected inference access error in agent log"
-            echo "inference_access_error=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "inference_access_error=false" >> "$GITHUB_OUTPUT"
-          fi
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
index 9dc9dbb4d6..e07fb7a088 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/basic-copilot.golden
@@ -210,6 +210,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: basiccopilot
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -346,6 +347,11 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
index 20bc093ce4..35af96580d 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -298,6 +298,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: smokecopilot
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -523,6 +524,11 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
diff --git a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
index 7294711652..9f7ae5a7d3 100644
--- a/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
+++ b/pkg/workflow/testdata/wasm_golden/TestWasmGolden_CompileFixtures/with-imports.golden
@@ -213,6 +213,7 @@ jobs:
       GH_AW_WORKFLOW_ID_SANITIZED: withimports
     outputs:
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      inference_access_error: ${{ steps.detect-inference-error.outputs.inference_access_error || 'false' }}
       model: ${{ needs.activation.outputs.model }}
     steps:
       - name: Checkout actions folder
@@ -349,6 +350,11 @@ jobs:
           GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
           GITHUB_WORKSPACE: ${{ github.workspace }}
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect inference access error
+        id: detect-inference-error
+        if: always()
+        continue-on-error: true
+        run: bash /opt/gh-aw/actions/detect_inference_access_error.sh
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}