diff --git a/apps/sim/app/api/billing/portal/route.ts b/apps/sim/app/api/billing/portal/route.ts
index 34807f0c6d..7c42728f72 100644
--- a/apps/sim/app/api/billing/portal/route.ts
+++ b/apps/sim/app/api/billing/portal/route.ts
@@ -1,11 +1,12 @@
 import { db } from '@sim/db'
 import { subscription as subscriptionTable, user } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, or } from 'drizzle-orm'
+import { and, eq, inArray, or } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 
 const logger = createLogger('BillingPortal')
@@ -45,7 +46,7 @@ export async function POST(request: NextRequest) {
           and(
             eq(subscriptionTable.referenceId, organizationId),
             or(
-              eq(subscriptionTable.status, 'active'),
+              inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES),
               eq(subscriptionTable.cancelAtPeriodEnd, true)
             )
           )
diff --git a/apps/sim/app/api/billing/route.ts b/apps/sim/app/api/billing/route.ts
index 1d79324305..3fbae3c1df 100644
--- a/apps/sim/app/api/billing/route.ts
+++ b/apps/sim/app/api/billing/route.ts
@@ -1,99 +1,15 @@
 import { db } from '@sim/db'
-import { member, userStats } from '@sim/db/schema'
+import { member } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { getSession } from '@/lib/auth'
+import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
 import { getSimplifiedBillingSummary } from '@/lib/billing/core/billing'
 import { getOrganizationBillingData } from '@/lib/billing/core/organization'
 import { dollarsToCredits } from '@/lib/billing/credits/conversion'
 import { getPlanTierCredits } from '@/lib/billing/plan-helpers'
 
-/**
- * Gets the effective billing blocked status for a user.
- * If user is in an org, also checks if the org owner is blocked.
- */
-async function getEffectiveBillingStatus(userId: string): Promise<{
-  billingBlocked: boolean
-  billingBlockedReason: 'payment_failed' | 'dispute' | null
-  blockedByOrgOwner: boolean
-}> {
-  // Check user's own status
-  const userStatsRows = await db
-    .select({
-      blocked: userStats.billingBlocked,
-      blockedReason: userStats.billingBlockedReason,
-    })
-    .from(userStats)
-    .where(eq(userStats.userId, userId))
-    .limit(1)
-
-  const userBlocked = userStatsRows.length > 0 ? !!userStatsRows[0].blocked : false
-  const userBlockedReason = userStatsRows.length > 0 ? userStatsRows[0].blockedReason : null
-
-  if (userBlocked) {
-    return {
-      billingBlocked: true,
-      billingBlockedReason: userBlockedReason,
-      blockedByOrgOwner: false,
-    }
-  }
-
-  // Check if user is in an org where owner is blocked
-  const memberships = await db
-    .select({ organizationId: member.organizationId })
-    .from(member)
-    .where(eq(member.userId, userId))
-
-  // Fetch all org owners in parallel
-  const ownerResults = await Promise.all(
-    memberships.map((m) =>
-      db
-        .select({ userId: member.userId })
-        .from(member)
-        .where(and(eq(member.organizationId, m.organizationId), eq(member.role, 'owner')))
-        .limit(1)
-    )
-  )
-
-  // Collect owner IDs that are not the current user
-  const otherOwnerIds = ownerResults
-    .filter((owners) => owners.length > 0 && owners[0].userId !== userId)
-    .map((owners) => owners[0].userId)
-
-  if (otherOwnerIds.length > 0) {
-    // Fetch all owner stats in parallel
-    const ownerStatsResults = await Promise.all(
-      otherOwnerIds.map((ownerId) =>
-        db
-          .select({
-            blocked: userStats.billingBlocked,
-            blockedReason: userStats.billingBlockedReason,
-          })
-          .from(userStats)
-          .where(eq(userStats.userId, ownerId))
-          .limit(1)
-      )
-    )
-
-    for (const stats of ownerStatsResults) {
-      if (stats.length > 0 && stats[0].blocked) {
-        return {
-          billingBlocked: true,
-          billingBlockedReason: stats[0].blockedReason,
-          blockedByOrgOwner: true,
-        }
-      }
-    }
-  }
-
-  return {
-    billingBlocked: false,
-    billingBlockedReason: null,
-    blockedByOrgOwner: false,
-  }
-}
-
 const logger = createLogger('UnifiedBillingAPI')
 
 /**
diff --git a/apps/sim/app/api/billing/switch-plan/route.ts b/apps/sim/app/api/billing/switch-plan/route.ts
index bf984a075a..b668335db2 100644
--- a/apps/sim/app/api/billing/switch-plan/route.ts
+++ b/apps/sim/app/api/billing/switch-plan/route.ts
@@ -5,12 +5,17 @@ import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
+import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
 import { isOrganizationOwnerOrAdmin } from '@/lib/billing/core/organization'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/plan'
 import { writeBillingInterval } from '@/lib/billing/core/subscription'
 import { getPlanType, isEnterprise, isOrgPlan } from '@/lib/billing/plan-helpers'
 import { getPlanByName } from '@/lib/billing/plans'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import {
+  hasUsableSubscriptionAccess,
+  hasUsableSubscriptionStatus,
+} from '@/lib/billing/subscriptions/utils'
 import { isBillingEnabled } from '@/lib/core/config/feature-flags'
 
 const logger = createLogger('SwitchPlan')
@@ -60,6 +65,11 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'No active subscription found' }, { status: 404 })
     }
 
+    const billingStatus = await getEffectiveBillingStatus(userId)
+    if (!hasUsableSubscriptionAccess(sub.status, billingStatus.billingBlocked)) {
+      return NextResponse.json({ error: 'An active subscription is required' }, { status: 400 })
+    }
+
     if (isEnterprise(sub.plan) || isEnterprise(targetPlanName)) {
       return NextResponse.json(
         { error: 'Enterprise plan changes must be handled via support' },
@@ -91,7 +101,7 @@ export async function POST(request: NextRequest) {
     const stripe = requireStripeClient()
     const stripeSubscription = await stripe.subscriptions.retrieve(sub.stripeSubscriptionId)
 
-    if (stripeSubscription.status !== 'active') {
+    if (!hasUsableSubscriptionStatus(stripeSubscription.status)) {
       return NextResponse.json({ error: 'Stripe subscription is not active' }, { status: 400 })
     }
 
diff --git a/apps/sim/app/api/logs/cleanup/route.ts b/apps/sim/app/api/logs/cleanup/route.ts
index 2293199c6b..25a0acabf5 100644
--- a/apps/sim/app/api/logs/cleanup/route.ts
+++ b/apps/sim/app/api/logs/cleanup/route.ts
@@ -1,9 +1,11 @@
 import { db } from '@sim/db'
 import { subscription, user, workflowExecutionLogs, workspace } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, inArray, lt, sql } from 'drizzle-orm'
+import { and, eq, inArray, isNull, lt } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { verifyCronAuth } from '@/lib/auth/internal'
+import { sqlIsPaid } from '@/lib/billing/plan-helpers'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { env } from '@/lib/core/config/env'
 import { snapshotService } from '@/lib/logs/execution/snapshot/service'
 import { isUsingCloudStorage, StorageService } from '@/lib/uploads'
@@ -29,9 +31,13 @@ export async function GET(request: NextRequest) {
       .from(user)
       .leftJoin(
         subscription,
-        sql`${user.id} = ${subscription.referenceId} AND ${subscription.status} = 'active' AND ${subscription.plan} IN ('pro', 'team', 'enterprise')`
+        and(
+          eq(user.id, subscription.referenceId),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES),
+          sqlIsPaid(subscription.plan)
+        )
       )
-      .where(sql`${subscription.id} IS NULL`)
+      .where(isNull(subscription.id))
 
     if (freeUsers.length === 0) {
       logger.info('No free users found for log cleanup')
diff --git a/apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts b/apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts
index d7b1df2a77..044f239d82 100644
--- a/apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts
+++ b/apps/sim/app/api/organizations/[id]/invitations/[invitationId]/route.ts
@@ -15,7 +15,7 @@ import {
   workspaceInvitation,
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getEmailSubject, renderInvitationEmail } from '@/components/emails'
@@ -23,8 +23,9 @@ import { AuditAction, AuditResourceType, recordAudit } from '@/lib/audit/log'
 import { getSession } from '@/lib/auth'
 import { hasAccessControlAccess } from '@/lib/billing'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
-import { isOrgPlan } from '@/lib/billing/plan-helpers'
+import { isOrgPlan, sqlIsPro } from '@/lib/billing/plan-helpers'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { syncWorkspaceEnvCredentials } from '@/lib/credentials/environment'
 import { sendEmail } from '@/lib/messaging/email/mailer'
@@ -320,7 +321,7 @@ export async function PUT(
             .where(
               and(
                 eq(subscriptionTable.referenceId, organizationId),
-                eq(subscriptionTable.status, 'active')
+                inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
               )
             )
             .limit(1)
@@ -338,8 +339,8 @@ export async function PUT(
               .where(
                 and(
                   eq(subscriptionTable.referenceId, userId),
-                  eq(subscriptionTable.status, 'active'),
-                  eq(subscriptionTable.plan, 'pro')
+                  inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES),
+                  sqlIsPro(subscriptionTable.plan)
                 )
               )
               .limit(1)
diff --git a/apps/sim/app/api/organizations/[id]/seats/route.ts b/apps/sim/app/api/organizations/[id]/seats/route.ts
index 0c3535df3f..6a2be6238c 100644
--- a/apps/sim/app/api/organizations/[id]/seats/route.ts
+++ b/apps/sim/app/api/organizations/[id]/seats/route.ts
@@ -1,13 +1,18 @@
 import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
+import { isOrganizationBillingBlocked } from '@/lib/billing/core/access'
 import { getPlanPricing } from '@/lib/billing/core/billing'
 import { isTeam } from '@/lib/billing/plan-helpers'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import {
+  hasUsableSubscriptionStatus,
+  USABLE_SUBSCRIPTION_STATUSES,
+} from '@/lib/billing/subscriptions/utils'
 import { isBillingEnabled } from '@/lib/core/config/feature-flags'
 
 const logger = createLogger('OrganizationSeatsAPI')
@@ -66,7 +71,12 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
     const subscriptionRecord = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     if (subscriptionRecord.length === 0) {
@@ -75,6 +85,10 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
 
     const orgSubscription = subscriptionRecord[0]
 
+    if (await isOrganizationBillingBlocked(organizationId)) {
+      return NextResponse.json({ error: 'An active subscription is required' }, { status: 400 })
+    }
+
     // Only team plans support seat changes (not enterprise - those are handled manually)
     if (!isTeam(orgSubscription.plan)) {
       return NextResponse.json(
@@ -127,7 +141,7 @@ export async function PUT(request: NextRequest, { params }: { params: Promise<{
       orgSubscription.stripeSubscriptionId
     )
 
-    if (stripeSubscription.status !== 'active') {
+    if (!hasUsableSubscriptionStatus(stripeSubscription.status)) {
       return NextResponse.json({ error: 'Stripe subscription is not active' }, { status: 400 })
     }
 
diff --git a/apps/sim/app/api/users/me/subscription/[id]/transfer/route.ts b/apps/sim/app/api/users/me/subscription/[id]/transfer/route.ts
index 16a0023edf..fad7ddb9a8 100644
--- a/apps/sim/app/api/users/me/subscription/[id]/transfer/route.ts
+++ b/apps/sim/app/api/users/me/subscription/[id]/transfer/route.ts
@@ -5,7 +5,7 @@ import { and, eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getSession } from '@/lib/auth'
-import { hasActiveSubscription } from '@/lib/billing'
+import { hasPaidSubscription } from '@/lib/billing'
 
 const logger = createLogger('SubscriptionTransferAPI')
 
@@ -90,7 +90,7 @@ export async function POST(request: NextRequest, { params }: { params: Promise<{
     }
 
     // Check if org already has an active subscription (prevent duplicates)
-    if (await hasActiveSubscription(organizationId)) {
+    if (await hasPaidSubscription(organizationId)) {
       return NextResponse.json(
         { error: 'Organization already has an active subscription' },
         { status: 409 }
diff --git a/apps/sim/app/api/v1/admin/credits/route.ts b/apps/sim/app/api/v1/admin/credits/route.ts
index e2bdfbe079..93276f8afc 100644
--- a/apps/sim/app/api/v1/admin/credits/route.ts
+++ b/apps/sim/app/api/v1/admin/credits/route.ts
@@ -26,12 +26,16 @@
 import { db } from '@sim/db'
 import { organization, subscription, user, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import { nanoid } from 'nanoid'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
 import { addCredits } from '@/lib/billing/credits/balance'
 import { setUsageLimitForCredits } from '@/lib/billing/credits/purchase'
-import { getEffectiveSeats } from '@/lib/billing/subscriptions/utils'
+import { isOrgPlan, isPaid } from '@/lib/billing/plan-helpers'
+import {
+  ENTITLED_SUBSCRIPTION_STATUSES,
+  getEffectiveSeats,
+} from '@/lib/billing/subscriptions/utils'
 import { withAdminAuth } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -95,7 +99,7 @@ export const POST = withAdminAuth(async (request) => {
 
     const userSubscription = await getHighestPrioritySubscription(resolvedUserId)
 
-    if (!userSubscription || !['pro', 'team', 'enterprise'].includes(userSubscription.plan)) {
+    if (!userSubscription || !isPaid(userSubscription.plan)) {
       return badRequestResponse(
         'User must have an active Pro, Team, or Enterprise subscription to receive credits'
       )
@@ -106,7 +110,7 @@ export const POST = withAdminAuth(async (request) => {
     const plan = userSubscription.plan
     let seats: number | null = null
 
-    if (plan === 'team' || plan === 'enterprise') {
+    if (isOrgPlan(plan)) {
       entityType = 'organization'
       entityId = userSubscription.referenceId
 
@@ -123,7 +127,12 @@ export const POST = withAdminAuth(async (request) => {
       const [subData] = await db
         .select()
         .from(subscription)
-        .where(and(eq(subscription.referenceId, entityId), eq(subscription.status, 'active')))
+        .where(
+          and(
+            eq(subscription.referenceId, entityId),
+            inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+          )
+        )
         .limit(1)
 
       seats = getEffectiveSeats(subData)
diff --git a/apps/sim/app/api/v1/admin/organizations/[id]/route.ts b/apps/sim/app/api/v1/admin/organizations/[id]/route.ts
index 3d0373014e..5542d8b313 100644
--- a/apps/sim/app/api/v1/admin/organizations/[id]/route.ts
+++ b/apps/sim/app/api/v1/admin/organizations/[id]/route.ts
@@ -19,7 +19,8 @@
 import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, count, eq } from 'drizzle-orm'
+import { and, count, eq, inArray } from 'drizzle-orm'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -58,7 +59,12 @@ export const GET = withAdminAuthParams<RouteParams>(async (request, context) =>
       db
         .select()
         .from(subscription)
-        .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+        .where(
+          and(
+            eq(subscription.referenceId, organizationId),
+            inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+          )
+        )
         .limit(1),
     ])
 
diff --git a/apps/sim/app/api/v1/admin/users/[id]/billing/route.ts b/apps/sim/app/api/v1/admin/users/[id]/billing/route.ts
index 0caf2c655a..5e863c82ab 100644
--- a/apps/sim/app/api/v1/admin/users/[id]/billing/route.ts
+++ b/apps/sim/app/api/v1/admin/users/[id]/billing/route.ts
@@ -24,6 +24,7 @@ import { createLogger } from '@sim/logger'
 import { eq, or } from 'drizzle-orm'
 import { nanoid } from 'nanoid'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
+import { isOrgPlan } from '@/lib/billing/plan-helpers'
 import { withAdminAuthParams } from '@/app/api/v1/admin/middleware'
 import {
   badRequestResponse,
@@ -154,8 +155,7 @@ export const PATCH = withAdminAuthParams<RouteParams>(async (request, context) =
       .limit(1)
 
     const userSubscription = await getHighestPrioritySubscription(userId)
-    const isTeamOrEnterpriseMember =
-      userSubscription && ['team', 'enterprise'].includes(userSubscription.plan)
+    const isTeamOrEnterpriseMember = userSubscription && isOrgPlan(userSubscription.plan)
 
     const [orgMembership] = await db
       .select({ organizationId: member.organizationId })
diff --git a/apps/sim/app/api/v1/audit-logs/auth.ts b/apps/sim/app/api/v1/audit-logs/auth.ts
index 085884488e..b382e284be 100644
--- a/apps/sim/app/api/v1/audit-logs/auth.ts
+++ b/apps/sim/app/api/v1/audit-logs/auth.ts
@@ -8,8 +8,10 @@
 import { db } from '@sim/db'
 import { member, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import { NextResponse } from 'next/server'
+import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
+import { USABLE_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 
 const logger = createLogger('V1AuditLogsAuth')
 
@@ -57,6 +59,17 @@ export async function validateEnterpriseAuditAccess(userId: string): Promise<Aut
     }
   }
 
+  const billingStatus = await getEffectiveBillingStatus(userId)
+  if (billingStatus.billingBlocked) {
+    return {
+      success: false,
+      response: NextResponse.json(
+        { error: 'Active enterprise subscription required' },
+        { status: 403 }
+      ),
+    }
+  }
+
   const [orgSub, orgMembers] = await Promise.all([
     db
       .select({ id: subscription.id })
@@ -65,7 +78,7 @@ export async function validateEnterpriseAuditAccess(userId: string): Promise<Aut
         and(
           eq(subscription.referenceId, membership.organizationId),
           eq(subscription.plan, 'enterprise'),
-          eq(subscription.status, 'active')
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
         )
       )
       .limit(1),
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/credential-sets/credential-sets.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/credential-sets/credential-sets.tsx
index 3b207d3014..fe31cb51dd 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/credential-sets/credential-sets.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/credential-sets/credential-sets.tsx
@@ -24,7 +24,7 @@ import {
 import { GmailIcon, OutlookIcon } from '@/components/icons'
 import { Input as BaseInput } from '@/components/ui'
 import { useSession } from '@/lib/auth/auth-client'
-import { getSubscriptionStatus } from '@/lib/billing/client'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { cn } from '@/lib/core/utils/cn'
 import { getProviderDisplayName, type PollingProvider } from '@/lib/credential-sets/providers'
 import { quickValidateEmail } from '@/lib/messaging/email/validation'
@@ -58,8 +58,8 @@ export function CredentialSets() {
   const { data: subscriptionData } = useSubscriptionData()
 
   const activeOrganization = organizationsData?.activeOrganization
-  const subscriptionStatus = getSubscriptionStatus(subscriptionData?.data)
-  const hasTeamPlan = subscriptionStatus.isTeam || subscriptionStatus.isEnterprise
+  const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+  const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
   const userRole = getUserRole(activeOrganization, session?.user?.email)
   const isAdmin = userRole === 'admin' || userRole === 'owner'
   const canManageCredentialSets = hasTeamPlan && isAdmin && !!activeOrganization?.id
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx
index 3a1d93cfa2..415dd2668d 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/inbox/inbox.tsx
@@ -3,7 +3,7 @@
 import { ArrowRight } from 'lucide-react'
 import { useParams, useRouter } from 'next/navigation'
 import { Button } from '@/components/emcn'
-import { getPlanTierCredits, isEnterprise } from '@/lib/billing/plan-helpers'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { InboxEnableToggle } from '@/app/workspace/[workspaceId]/settings/components/inbox/inbox-enable-toggle'
 import { InboxSettingsTab } from '@/app/workspace/[workspaceId]/settings/components/inbox/inbox-settings-tab'
 import { InboxSkeleton } from '@/app/workspace/[workspaceId]/settings/components/inbox/inbox-skeleton'
@@ -21,23 +21,22 @@ export function Inbox() {
   const { data: subscriptionResponse, isLoading: isSubLoading } = useSubscriptionData({
     enabled: isBillingEnabled,
   })
-
-  const plan = subscriptionResponse?.data?.plan ?? null
-  const isMaxPlan = getPlanTierCredits(plan) >= 25000 || isEnterprise(plan)
+  const subscriptionAccess = getSubscriptionAccessState(subscriptionResponse?.data)
 
   if (isLoading || (isBillingEnabled && isSubLoading)) {
     return <InboxSkeleton />
   }
 
-  if (isBillingEnabled && !isMaxPlan) {
+  if (isBillingEnabled && !subscriptionAccess.hasUsableMaxAccess) {
     return (
       <div className='flex h-full flex-col items-center justify-center gap-[16px] py-[80px]'>
         <div className='text-center'>
           <h3 className='font-medium text-[16px] text-[var(--text-primary)]'>
-            Sim Mailer requires a Max plan
+            Sim Mailer requires an active Max plan
           </h3>
           <p className='mt-[6px] text-[14px] text-[var(--text-muted)]'>
-            Upgrade to Max to receive tasks via email and let Sim work on your behalf.
+            Upgrade to Max and ensure billing is active to receive tasks via email and let Sim work
+            on your behalf.
           </p>
         </div>
         <Button
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/subscription/subscription.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/subscription/subscription.tsx
index 22f8e4f23d..75f75889bd 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/subscription/subscription.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/subscription/subscription.tsx
@@ -39,7 +39,11 @@ import {
   isPro,
   isTeam,
 } from '@/lib/billing/plan-helpers'
-import { getEffectiveSeats } from '@/lib/billing/subscriptions/utils'
+import {
+  getEffectiveSeats,
+  hasPaidSubscriptionStatus,
+  hasUsableSubscriptionAccess,
+} from '@/lib/billing/subscriptions/utils'
 import { cn } from '@/lib/core/utils/cn'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { getUserRole } from '@/lib/workspaces/organization/utils'
@@ -306,7 +310,9 @@ export function Subscription() {
     isPro: isPro(subscriptionData?.data?.plan),
     isTeam: isTeam(subscriptionData?.data?.plan),
     isEnterprise: isEnterprise(subscriptionData?.data?.plan),
-    isPaid: isPaid(subscriptionData?.data?.plan) && subscriptionData?.data?.status === 'active',
+    isPaid:
+      isPaid(subscriptionData?.data?.plan) &&
+      hasPaidSubscriptionStatus(subscriptionData?.data?.status),
     plan: subscriptionData?.data?.plan || 'free',
     status: subscriptionData?.data?.status || 'inactive',
     seats: getEffectiveSeats(subscriptionData?.data),
@@ -364,7 +370,7 @@ export function Subscription() {
     isTeamAdmin &&
     organizationBillingData?.data
       ? organizationBillingData.data.minimumBillingAmount
-      : getPlanTierDollars(subscription.plan)
+      : getPlanTierCredits(subscription.plan) / CREDIT_MULTIPLIER
 
   const effectiveUsageLimit =
     (subscription.isTeam || subscription.isEnterprise) &&
@@ -468,8 +474,12 @@ export function Subscription() {
   }
   const badgeConfig = getBadgeConfig()
 
+  const hasUsablePaidAccess = subscription.isPaid
+    ? hasUsableSubscriptionAccess(subscription.status, isBlocked)
+    : false
+
   const onDemandState: 'hidden' | 'enable' | 'disable' = (() => {
-    if (!subscription.isPaid || !permissions.canEditUsageLimit || isBlocked) return 'hidden'
+    if (!hasUsablePaidAccess || !permissions.canEditUsageLimit) return 'hidden'
     return isOnDemandActive ? 'disable' : 'enable'
   })()
 
@@ -751,7 +761,9 @@ export function Subscription() {
                         ? `Switch to ${isAnnual ? 'Annual' : 'Monthly'}`
                         : subscription.isTeam
                           ? 'Upgrade Team'
-                          : 'Upgrade'
+                          : subscription.isFree
+                            ? 'Get started'
+                            : 'Upgrade'
                   }
                   onButtonClick={
                     isOnMax
@@ -916,7 +928,7 @@ export function Subscription() {
           {subscription.isPaid && permissions.canViewUsageInfo && (
             <CreditBalance
               balance={subscriptionData?.data?.creditBalance ?? 0}
-              canPurchase={permissions.canEditUsageLimit}
+              canPurchase={hasUsablePaidAccess && permissions.canEditUsageLimit}
               entityType={
                 subscription.isTeam || subscription.isEnterprise ? 'organization' : 'user'
               }
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
index f108879177..0c8e0243a4 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/team-management/team-management.tsx
@@ -4,6 +4,7 @@ import { useCallback, useEffect, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { Skeleton, type TagItem } from '@/components/emcn'
 import { useSession } from '@/lib/auth/auth-client'
+import { getSubscriptionAccessState } from '@/lib/billing/client/utils'
 import { getPlanTierCredits, getPlanTierDollars } from '@/lib/billing/plan-helpers'
 import { checkEnterprisePlan } from '@/lib/billing/subscriptions/utils'
 import {
@@ -45,8 +46,9 @@ export function TeamManagement() {
   const activeOrganization = organizationsData?.activeOrganization
 
   const { data: userSubscriptionData } = useSubscriptionData()
-  const hasTeamPlan = userSubscriptionData?.data?.isTeam ?? false
-  const hasEnterprisePlan = userSubscriptionData?.data?.isEnterprise ?? false
+  const subscriptionAccess = getSubscriptionAccessState(userSubscriptionData?.data)
+  const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
+  const hasEnterprisePlan = subscriptionAccess.hasUsableEnterpriseAccess
 
   const {
     data: organization,
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts b/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
index 9ec049a209..de0eb6206b 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
+++ b/apps/sim/app/workspace/[workspaceId]/settings/navigation.ts
@@ -58,6 +58,7 @@ export interface NavigationItem {
   hideWhenBillingDisabled?: boolean
   requiresTeam?: boolean
   requiresEnterprise?: boolean
+  requiresMax?: boolean
   requiresHosted?: boolean
   selfHostedOverride?: boolean
   requiresSuperUser?: boolean
@@ -135,6 +136,7 @@ export const allNavigationItems: NavigationItem[] = [
     label: 'Sim Mailer',
     icon: Send,
     section: 'system',
+    requiresMax: true,
     requiresHosted: true,
     selfHostedOverride: isInboxEnabled,
   },
@@ -143,6 +145,7 @@ export const allNavigationItems: NavigationItem[] = [
     label: 'Email Polling',
     icon: Mail,
     section: 'system',
+    requiresTeam: true,
     requiresHosted: true,
     selfHostedOverride: isCredentialSetsEnabled,
   },
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
index 43b0ee3631..6db7465bc9 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/credential-selector/credential-selector.tsx
@@ -4,7 +4,7 @@ import { createElement, useCallback, useEffect, useMemo, useState } from 'react'
 import { ExternalLink, Users } from 'lucide-react'
 import { useParams } from 'next/navigation'
 import { Button, Combobox } from '@/components/emcn/components'
-import { getSubscriptionStatus } from '@/lib/billing/client'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
 import { getPollingProviderFromOAuth } from '@/lib/credential-sets/providers'
 import { writePendingCredentialCreateRequest } from '@/lib/credentials/client-state'
@@ -64,8 +64,8 @@ export function CredentialSelector({
   const { data: organizationsData } = useOrganizations()
   const { data: subscriptionData } = useSubscriptionData({ enabled: isBillingEnabled })
   const activeOrganization = organizationsData?.activeOrganization
-  const subscriptionStatus = getSubscriptionStatus(subscriptionData?.data)
-  const hasTeamPlan = subscriptionStatus.isTeam || subscriptionStatus.isEnterprise
+  const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+  const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
   const canUseCredentialSets = supportsCredentialSets && hasTeamPlan && !!activeOrganization?.id
 
   const { data: credentialSets = [] } = useCredentialSets(
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
index f1312bf596..db86ce8e9c 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/settings-sidebar/settings-sidebar.tsx
@@ -5,7 +5,7 @@ import { useQueryClient } from '@tanstack/react-query'
 import { useParams, usePathname, useRouter } from 'next/navigation'
 import { ChevronDown, Skeleton, Tooltip } from '@/components/emcn'
 import { useSession } from '@/lib/auth/auth-client'
-import { getSubscriptionStatus } from '@/lib/billing/client'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
 import { isHosted } from '@/lib/core/config/feature-flags'
 import { cn } from '@/lib/core/utils/cn'
 import { getUserRole } from '@/lib/workspaces/organization'
@@ -59,9 +59,9 @@ export function SettingsSidebar({
   const isOwner = userRole === 'owner'
   const isAdmin = userRole === 'admin'
   const isOrgAdminOrOwner = isOwner || isAdmin
-  const subscriptionStatus = getSubscriptionStatus(subscriptionData?.data)
-  const hasTeamPlan = subscriptionStatus.isTeam || subscriptionStatus.isEnterprise
-  const hasEnterprisePlan = subscriptionStatus.isEnterprise
+  const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+  const hasTeamPlan = subscriptionAccess.hasUsableTeamAccess
+  const hasEnterprisePlan = subscriptionAccess.hasUsableEnterpriseAccess
 
   const isSuperUser = session?.user?.role === 'admin'
 
@@ -74,62 +74,60 @@ export function SettingsSidebar({
   }, [userId, ssoProvidersData?.providers, isLoadingSSO])
 
   const navigationItems = useMemo(() => {
-    return allNavigationItems.filter((item) => {
+    return allNavigationItems.flatMap((item) => {
       if (item.hideWhenBillingDisabled && !isBillingEnabled) {
-        return false
+        return []
       }
 
       if (item.id === 'template-profile') {
-        return false
+        return []
       }
       if (item.id === 'apikeys' && permissionConfig.hideApiKeysTab) {
-        return false
+        return []
       }
       if (item.id === 'mcp' && permissionConfig.disableMcpTools) {
-        return false
+        return []
       }
       if (item.id === 'custom-tools' && permissionConfig.disableCustomTools) {
-        return false
+        return []
       }
       if (item.id === 'skills' && permissionConfig.disableSkills) {
-        return false
+        return []
       }
 
       if (item.selfHostedOverride && !isHosted) {
         if (item.id === 'sso') {
           const hasProviders = (ssoProvidersData?.providers?.length ?? 0) > 0
-          return !hasProviders || isSSOProviderOwner === true
+          return !hasProviders || isSSOProviderOwner === true ? [{ ...item, disabled: false }] : []
         }
-        return true
-      }
-
-      if (item.requiresTeam && (!hasTeamPlan || !isOrgAdminOrOwner)) {
-        return false
-      }
-
-      if (item.requiresEnterprise && (!hasEnterprisePlan || !isOrgAdminOrOwner)) {
-        return false
+        return [{ ...item, disabled: false }]
       }
 
       if (item.requiresHosted && !isHosted) {
-        return false
+        return []
       }
 
       const superUserModeEnabled = generalSettings?.superUserModeEnabled ?? false
       const effectiveSuperUser = isSuperUser && superUserModeEnabled
       if (item.requiresSuperUser && !effectiveSuperUser) {
-        return false
+        return []
       }
 
       if (item.requiresAdminRole && !isSuperUser) {
-        return false
+        return []
       }
 
-      return true
+      const disabled =
+        (item.requiresTeam && (!hasTeamPlan || !isOrgAdminOrOwner)) ||
+        (item.requiresEnterprise && (!hasEnterprisePlan || !isOrgAdminOrOwner)) ||
+        (item.requiresMax && !subscriptionAccess.hasUsableMaxAccess)
+
+      return [{ ...item, disabled }]
     })
   }, [
     hasTeamPlan,
     hasEnterprisePlan,
+    subscriptionAccess.hasUsableMaxAccess,
     isOrgAdminOrOwner,
     isSSOProviderOwner,
     ssoProvidersData?.providers?.length,
@@ -252,9 +250,13 @@ export function SettingsSidebar({
                   {sectionItems.map((item) => {
                     const Icon = item.icon
                     const active = activeSection === item.id
+                    const disabled = Boolean(item.disabled)
                     const itemClassName = cn(
-                      'group mx-[2px] flex h-[30px] items-center gap-[8px] rounded-[8px] px-[8px] text-[14px] hover:bg-[var(--surface-active)]',
-                      active && 'bg-[var(--surface-active)]'
+                      'group mx-[2px] flex h-[30px] items-center gap-[8px] rounded-[8px] px-[8px] text-[14px]',
+                      disabled
+                        ? 'cursor-not-allowed opacity-50'
+                        : 'hover:bg-[var(--surface-active)]',
+                      active && !disabled && 'bg-[var(--surface-active)]'
                     )
                     const content = (
                       <>
@@ -278,9 +280,11 @@ export function SettingsSidebar({
                       <button
                         type='button'
                         className={itemClassName}
+                        disabled={disabled}
                         onMouseEnter={() => handlePrefetch(item.id)}
                         onFocus={() => handlePrefetch(item.id)}
                         onClick={() =>
+                          !disabled &&
                           router.replace(getSettingsHref({ section: item.id as SettingsSection }), {
                             scroll: false,
                           })
diff --git a/apps/sim/ee/access-control/components/access-control.tsx b/apps/sim/ee/access-control/components/access-control.tsx
index f91ceaff1d..083b7be68d 100644
--- a/apps/sim/ee/access-control/components/access-control.tsx
+++ b/apps/sim/ee/access-control/components/access-control.tsx
@@ -25,7 +25,8 @@ import {
 } from '@/components/emcn'
 import { Input as BaseInput } from '@/components/ui'
 import { useSession } from '@/lib/auth/auth-client'
-import { getSubscriptionStatus } from '@/lib/billing/client'
+import { getSubscriptionAccessState } from '@/lib/billing/client'
+import { isBillingEnabled } from '@/lib/core/config/feature-flags'
 import type { PermissionGroupConfig } from '@/lib/permission-groups/types'
 import { getUserColor } from '@/lib/workspaces/colors'
 import { getUserRole } from '@/lib/workspaces/organization'
@@ -242,8 +243,8 @@ export function AccessControl() {
   const { data: subscriptionData, isPending: subLoading } = useSubscriptionData()
 
   const activeOrganization = organizationsData?.activeOrganization
-  const subscriptionStatus = getSubscriptionStatus(subscriptionData?.data)
-  const hasEnterprisePlan = subscriptionStatus.isEnterprise
+  const subscriptionStatus = getSubscriptionAccessState(subscriptionData?.data)
+  const hasEnterprisePlan = subscriptionStatus.hasUsableEnterpriseAccess
   const userRole = getUserRole(activeOrganization, session?.user?.email)
   const isOwner = userRole === 'owner'
   const isAdmin = userRole === 'admin'
@@ -685,6 +686,30 @@ export function AccessControl() {
     return <AccessControlSkeleton />
   }
 
+  if (isBillingEnabled && !canManage) {
+    if (!activeOrganization) {
+      return (
+        <div className='flex h-full items-center justify-center text-[14px] text-[var(--text-muted)]'>
+          You must be part of an organization to manage Access Control.
+        </div>
+      )
+    }
+    if (!hasEnterprisePlan) {
+      return (
+        <div className='flex h-full items-center justify-center text-[14px] text-[var(--text-muted)]'>
+          Access Control is available on Enterprise plans only.
+        </div>
+      )
+    }
+    if (!isOrgAdminOrOwner) {
+      return (
+        <div className='flex h-full items-center justify-center text-[14px] text-[var(--text-muted)]'>
+          Only organization owners and admins can manage Access Control settings.
+        </div>
+      )
+    }
+  }
+
   if (viewingGroup) {
     return (
       <>
diff --git a/apps/sim/ee/sso/components/sso-settings.tsx b/apps/sim/ee/sso/components/sso-settings.tsx
index abb7f120d6..e4dcd4c28e 100644
--- a/apps/sim/ee/sso/components/sso-settings.tsx
+++ b/apps/sim/ee/sso/components/sso-settings.tsx
@@ -5,7 +5,7 @@ import { createLogger } from '@sim/logger'
 import { Check, ChevronDown, Clipboard, Eye, EyeOff } from 'lucide-react'
 import { Button, Combobox, Input, Skeleton, Switch, Textarea } from '@/components/emcn'
 import { useSession } from '@/lib/auth/auth-client'
-import { getSubscriptionStatus } from '@/lib/billing/client/utils'
+import { getSubscriptionAccessState } from '@/lib/billing/client/utils'
 import { isBillingEnabled } from '@/lib/core/config/feature-flags'
 import { cn } from '@/lib/core/utils/cn'
 import { getBaseUrl } from '@/lib/core/utils/urls'
@@ -76,8 +76,8 @@ export function SSO() {
   const isOwner = userRole === 'owner'
   const isAdmin = userRole === 'admin'
   const canManageSSO = isOwner || isAdmin
-  const subscriptionStatus = getSubscriptionStatus(subscriptionData?.data)
-  const hasEnterprisePlan = subscriptionStatus.isEnterprise
+  const subscriptionAccess = getSubscriptionAccessState(subscriptionData?.data)
+  const hasEnterprisePlan = subscriptionAccess.hasUsableEnterpriseAccess
 
   const isSSOProviderOwner =
     !isBillingEnabled && userId ? providers.some((p: any) => p.userId === userId) : null
diff --git a/apps/sim/hooks/queries/organization.ts b/apps/sim/hooks/queries/organization.ts
index 3b08ee0de4..b5f634cf06 100644
--- a/apps/sim/hooks/queries/organization.ts
+++ b/apps/sim/hooks/queries/organization.ts
@@ -2,6 +2,7 @@ import { createLogger } from '@sim/logger'
 import { keepPreviousData, useMutation, useQuery, useQueryClient } from '@tanstack/react-query'
 import { client } from '@/lib/auth/auth-client'
 import { isEnterprise, isTeam } from '@/lib/billing/plan-helpers'
+import { hasPaidSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
 
 const logger = createLogger('OrganizationQueries')
 
@@ -87,10 +88,10 @@ async function fetchOrganizationSubscription(orgId: string, _signal?: AbortSigna
   }
 
   const teamSubscription = response.data?.find(
-    (sub: any) => sub.status === 'active' && isTeam(sub.plan)
+    (sub: any) => hasPaidSubscriptionStatus(sub.status) && isTeam(sub.plan)
   )
   const enterpriseSubscription = response.data?.find(
-    (sub: any) => isEnterprise(sub.plan) || sub.plan === 'enterprise-plus'
+    (sub: any) => hasPaidSubscriptionStatus(sub.status) && isEnterprise(sub.plan)
   )
   const activeSubscription = enterpriseSubscription || teamSubscription
 
diff --git a/apps/sim/lib/auth/auth.ts b/apps/sim/lib/auth/auth.ts
index bd514245ea..5e26f46288 100644
--- a/apps/sim/lib/auth/auth.ts
+++ b/apps/sim/lib/auth/auth.ts
@@ -45,6 +45,7 @@ import {
 } from '@/lib/billing/organization'
 import { isOrgPlan, isTeam } from '@/lib/billing/plan-helpers'
 import { getPlans, resolvePlanFromStripeSubscription } from '@/lib/billing/plans'
+import { hasPaidSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
 import { syncSeatsFromStripeQuantity } from '@/lib/billing/validation/seat-management'
 import { handleChargeDispute, handleDisputeClosed } from '@/lib/billing/webhooks/disputes'
 import { handleManualEnterpriseSubscription } from '@/lib/billing/webhooks/enterprise'
@@ -2999,7 +3000,7 @@ export const auth = betterAuth({
                 .where(eq(schema.subscription.referenceId, user.id))
 
               const hasTeamPlan = dbSubscriptions.some(
-                (sub) => sub.status === 'active' && isOrgPlan(sub.plan)
+                (sub) => hasPaidSubscriptionStatus(sub.status) && isOrgPlan(sub.plan)
               )
 
               return hasTeamPlan
diff --git a/apps/sim/lib/billing/authorization.ts b/apps/sim/lib/billing/authorization.ts
index 88317f9ad1..c84353cc76 100644
--- a/apps/sim/lib/billing/authorization.ts
+++ b/apps/sim/lib/billing/authorization.ts
@@ -2,7 +2,7 @@ import { db } from '@sim/db'
 import * as schema from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
-import { hasActiveSubscription } from '@/lib/billing'
+import { hasPaidSubscription } from '@/lib/billing'
 
 const logger = createLogger('BillingAuthorization')
 
@@ -24,7 +24,7 @@ export async function authorizeSubscriptionReference(
   }
 
   // Only block duplicate subscriptions during upgrade/checkout, not cancel/restore/list
-  if (action === 'upgrade-subscription' && (await hasActiveSubscription(referenceId))) {
+  if (action === 'upgrade-subscription' && (await hasPaidSubscription(referenceId))) {
     logger.warn('Blocking checkout - active subscription already exists for organization', {
       userId,
       referenceId,
diff --git a/apps/sim/lib/billing/client/index.ts b/apps/sim/lib/billing/client/index.ts
index b088805946..55927afbf2 100644
--- a/apps/sim/lib/billing/client/index.ts
+++ b/apps/sim/lib/billing/client/index.ts
@@ -14,6 +14,7 @@ export {
   getDaysRemainingInPeriod,
   getFilledPillColor,
   getRemainingBudget,
+  getSubscriptionAccessState,
   getSubscriptionStatus,
   getUsage,
   isAtLeastPro,
diff --git a/apps/sim/lib/billing/client/upgrade.ts b/apps/sim/lib/billing/client/upgrade.ts
index 5c278dd7fa..08d58f5277 100644
--- a/apps/sim/lib/billing/client/upgrade.ts
+++ b/apps/sim/lib/billing/client/upgrade.ts
@@ -3,6 +3,7 @@ import { createLogger } from '@sim/logger'
 import { useQueryClient } from '@tanstack/react-query'
 import { client, useSession, useSubscription } from '@/lib/auth/auth-client'
 import { buildPlanName, isOrgPlan } from '@/lib/billing/plan-helpers'
+import { hasPaidSubscriptionStatus } from '@/lib/billing/subscriptions/utils'
 import { organizationKeys } from '@/hooks/queries/organization'
 
 const logger = createLogger('SubscriptionUpgrade')
@@ -41,7 +42,7 @@ export function useSubscriptionUpgrade() {
         const listResult = await client.subscription.list()
         allSubscriptions = listResult.data || []
         const activePersonalSub = allSubscriptions.find(
-          (sub: any) => sub.status === 'active' && sub.referenceId === userId
+          (sub: any) => hasPaidSubscriptionStatus(sub.status) && sub.referenceId === userId
         )
         currentSubscriptionId = activePersonalSub?.id
       } catch (_e) {
@@ -67,7 +68,9 @@ export function useSubscriptionUpgrade() {
             // Check if this org already has an active team subscription
             const existingTeamSub = allSubscriptions.find(
               (sub: any) =>
-                sub.status === 'active' && sub.referenceId === existingOrg.id && isOrgPlan(sub.plan)
+                hasPaidSubscriptionStatus(sub.status) &&
+                sub.referenceId === existingOrg.id &&
+                isOrgPlan(sub.plan)
             )
 
             if (existingTeamSub) {
diff --git a/apps/sim/lib/billing/client/utils.ts b/apps/sim/lib/billing/client/utils.ts
index f84ad868bd..206af4d5bd 100644
--- a/apps/sim/lib/billing/client/utils.ts
+++ b/apps/sim/lib/billing/client/utils.ts
@@ -4,7 +4,8 @@
  */
 
 import { DEFAULT_FREE_CREDITS } from '@/lib/billing/constants'
-import { isFree, isPro } from '@/lib/billing/plan-helpers'
+import { getPlanTierCredits, isEnterprise, isFree, isPro } from '@/lib/billing/plan-helpers'
+import { hasUsableSubscriptionAccess } from '@/lib/billing/subscriptions/utils'
 import { USAGE_PILL_COLORS } from './consts'
 import type { BillingStatus, SubscriptionData, UsageData } from './types'
 
@@ -38,6 +39,27 @@ export function getSubscriptionStatus(
   }
 }
 
+export function getSubscriptionAccessState(
+  subscriptionData: Partial<SubscriptionData> | null | undefined
+) {
+  const status = getSubscriptionStatus(subscriptionData)
+  const billingBlocked = Boolean(subscriptionData?.billingBlocked)
+  const hasUsablePaidAccess = hasUsableSubscriptionAccess(status.status, billingBlocked)
+  const hasUsableTeamAccess = hasUsablePaidAccess && (status.isTeam || status.isEnterprise)
+  const hasUsableEnterpriseAccess = hasUsablePaidAccess && status.isEnterprise
+  const hasUsableMaxAccess =
+    hasUsablePaidAccess && (getPlanTierCredits(status.plan) >= 25000 || isEnterprise(status.plan))
+
+  return {
+    ...status,
+    billingBlocked,
+    hasUsablePaidAccess,
+    hasUsableTeamAccess,
+    hasUsableEnterpriseAccess,
+    hasUsableMaxAccess,
+  }
+}
+
 /**
  * Get usage data from subscription data
  * Validates and sanitizes all numeric values to prevent crashes from malformed data
diff --git a/apps/sim/lib/billing/core/access.ts b/apps/sim/lib/billing/core/access.ts
new file mode 100644
index 0000000000..944b89478b
--- /dev/null
+++ b/apps/sim/lib/billing/core/access.ts
@@ -0,0 +1,105 @@
+import { db } from '@sim/db'
+import { member, userStats } from '@sim/db/schema'
+import { and, eq } from 'drizzle-orm'
+
+export interface EffectiveBillingStatus {
+  billingBlocked: boolean
+  billingBlockedReason: 'payment_failed' | 'dispute' | null
+  blockedByOrgOwner: boolean
+}
+
+/**
+ * Gets the effective billing blocked status for a user.
+ * If the user belongs to an organization, also checks whether the org owner is blocked.
+ */
+export async function getEffectiveBillingStatus(userId: string): Promise<EffectiveBillingStatus> {
+  const userStatsRows = await db
+    .select({
+      blocked: userStats.billingBlocked,
+      blockedReason: userStats.billingBlockedReason,
+    })
+    .from(userStats)
+    .where(eq(userStats.userId, userId))
+    .limit(1)
+
+  const userBlocked = userStatsRows.length > 0 ? !!userStatsRows[0].blocked : false
+  const userBlockedReason = userStatsRows.length > 0 ? userStatsRows[0].blockedReason : null
+
+  if (userBlocked) {
+    return {
+      billingBlocked: true,
+      billingBlockedReason: userBlockedReason,
+      blockedByOrgOwner: false,
+    }
+  }
+
+  const memberships = await db
+    .select({ organizationId: member.organizationId })
+    .from(member)
+    .where(eq(member.userId, userId))
+
+  const ownerResults = await Promise.all(
+    memberships.map((m) =>
+      db
+        .select({ userId: member.userId })
+        .from(member)
+        .where(and(eq(member.organizationId, m.organizationId), eq(member.role, 'owner')))
+        .limit(1)
+    )
+  )
+
+  const otherOwnerIds = ownerResults
+    .filter((owners) => owners.length > 0 && owners[0].userId !== userId)
+    .map((owners) => owners[0].userId)
+
+  if (otherOwnerIds.length > 0) {
+    const ownerStatsResults = await Promise.all(
+      otherOwnerIds.map((ownerId) =>
+        db
+          .select({
+            blocked: userStats.billingBlocked,
+            blockedReason: userStats.billingBlockedReason,
+          })
+          .from(userStats)
+          .where(eq(userStats.userId, ownerId))
+          .limit(1)
+      )
+    )
+
+    for (const stats of ownerStatsResults) {
+      if (stats.length > 0 && stats[0].blocked) {
+        return {
+          billingBlocked: true,
+          billingBlockedReason: stats[0].blockedReason,
+          blockedByOrgOwner: true,
+        }
+      }
+    }
+  }
+
+  return {
+    billingBlocked: false,
+    billingBlockedReason: null,
+    blockedByOrgOwner: false,
+  }
+}
+
+export async function isOrganizationBillingBlocked(organizationId: string): Promise<boolean> {
+  const [owner] = await db
+    .select({ userId: member.userId })
+    .from(member)
+    .where(and(eq(member.organizationId, organizationId), eq(member.role, 'owner')))
+    .limit(1)
+
+  if (!owner) {
+    return false
+  }
+
+  const [ownerStats] = await db
+    .select({ blocked: userStats.billingBlocked })
+    .from(userStats)
+    .where(eq(userStats.userId, owner.userId))
+    .limit(1)
+
+  return !!ownerStats?.blocked
+}
diff --git a/apps/sim/lib/billing/core/billing.ts b/apps/sim/lib/billing/core/billing.ts
index ab5cf367e7..2edb18f4af 100644
--- a/apps/sim/lib/billing/core/billing.ts
+++ b/apps/sim/lib/billing/core/billing.ts
@@ -1,6 +1,6 @@
 import { db } from '@sim/db'
 import { member, organization, subscription, user, userStats } from '@sim/db/schema'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
 import {
   getBillingInterval,
   getHighestPrioritySubscription,
@@ -19,7 +19,12 @@ import {
   isPro,
   isTeam,
 } from '@/lib/billing/plan-helpers'
-import { getFreeTierLimit, getPlanPricing } from '@/lib/billing/subscriptions/utils'
+import {
+  ENTITLED_SUBSCRIPTION_STATUSES,
+  getFreeTierLimit,
+  getPlanPricing,
+  hasPaidSubscriptionStatus,
+} from '@/lib/billing/subscriptions/utils'
 import { Decimal, toDecimal, toNumber } from '@/lib/billing/utils/decimal'
 
 export { getPlanPricing }
@@ -36,7 +41,12 @@ export async function getOrganizationSubscription(organizationId: string) {
     const orgSubs = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     return orgSubs.length > 0 ? orgSubs[0] : null
@@ -299,10 +309,11 @@ export async function getSimplifiedBillingSummary(
 
     // Determine subscription type flags
     const plan = subscription?.plan || 'free'
-    const planIsPaid = isPaid(plan)
-    const planIsPro = isPro(plan)
-    const planIsTeam = isTeam(plan)
-    const planIsEnterprise = isEnterprise(plan)
+    const hasPaidEntitlement = hasPaidSubscriptionStatus(subscription?.status)
+    const planIsPaid = hasPaidEntitlement && isPaid(plan)
+    const planIsPro = hasPaidEntitlement && isPro(plan)
+    const planIsTeam = hasPaidEntitlement && isTeam(plan)
+    const planIsEnterprise = hasPaidEntitlement && isEnterprise(plan)
 
     if (organizationId) {
       // Organization billing summary
diff --git a/apps/sim/lib/billing/core/organization.ts b/apps/sim/lib/billing/core/organization.ts
index 2067fc36af..c025e722b6 100644
--- a/apps/sim/lib/billing/core/organization.ts
+++ b/apps/sim/lib/billing/core/organization.ts
@@ -1,11 +1,17 @@
 import { db } from '@sim/db'
 import { member, organization, subscription, user, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq } from 'drizzle-orm'
+import { and, eq, inArray } from 'drizzle-orm'
+import { isOrganizationBillingBlocked } from '@/lib/billing/core/access'
 import { getPlanPricing } from '@/lib/billing/core/billing'
 import { computeDailyRefreshConsumed } from '@/lib/billing/credits/daily-refresh'
 import { getPlanTierDollars, isEnterprise, isPaid, isTeam } from '@/lib/billing/plan-helpers'
-import { getEffectiveSeats, getFreeTierLimit } from '@/lib/billing/subscriptions/utils'
+import {
+  ENTITLED_SUBSCRIPTION_STATUSES,
+  getEffectiveSeats,
+  getFreeTierLimit,
+  hasUsableSubscriptionStatus,
+} from '@/lib/billing/subscriptions/utils'
 
 const logger = createLogger('OrganizationBilling')
 
@@ -18,7 +24,12 @@ async function getOrganizationSubscription(organizationId: string) {
     const orgSubs = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     return orgSubs.length > 0 ? orgSubs[0] : null
@@ -237,6 +248,13 @@ export async function updateOrganizationUsageLimit(
       return { success: false, error: 'No active subscription found' }
     }
 
+    if (
+      !hasUsableSubscriptionStatus(subscription.status) ||
+      (await isOrganizationBillingBlocked(organizationId))
+    ) {
+      return { success: false, error: 'An active subscription is required to edit usage limits' }
+    }
+
     // Enterprise plans have fixed usage limits that cannot be changed
     if (isEnterprise(subscription.plan)) {
       return {
diff --git a/apps/sim/lib/billing/core/plan.ts b/apps/sim/lib/billing/core/plan.ts
index 6224b0986e..efed6996b3 100644
--- a/apps/sim/lib/billing/core/plan.ts
+++ b/apps/sim/lib/billing/core/plan.ts
@@ -2,14 +2,19 @@ import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq, inArray } from 'drizzle-orm'
-import { checkEnterprisePlan, checkProPlan, checkTeamPlan } from '@/lib/billing/subscriptions/utils'
+import {
+  checkEnterprisePlan,
+  checkProPlan,
+  checkTeamPlan,
+  ENTITLED_SUBSCRIPTION_STATUSES,
+} from '@/lib/billing/subscriptions/utils'
 
 const logger = createLogger('PlanLookup')
 
 export type HighestPrioritySubscription = Awaited<ReturnType<typeof getHighestPrioritySubscription>>
 
 /**
- * Get the highest priority active subscription for a user
+ * Get the highest priority paid subscription for a user.
  * Priority: Enterprise > Team > Pro > Free
  */
 export async function getHighestPrioritySubscription(userId: string) {
@@ -17,7 +22,12 @@ export async function getHighestPrioritySubscription(userId: string) {
     const personalSubs = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, userId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, userId),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+        )
+      )
 
     const memberships = await db
       .select({ organizationId: member.organizationId })
@@ -41,7 +51,10 @@ export async function getHighestPrioritySubscription(userId: string) {
           .select()
           .from(subscription)
           .where(
-            and(inArray(subscription.referenceId, validOrgIds), eq(subscription.status, 'active'))
+            and(
+              inArray(subscription.referenceId, validOrgIds),
+              inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+            )
           )
       }
     }
diff --git a/apps/sim/lib/billing/core/subscription.ts b/apps/sim/lib/billing/core/subscription.ts
index ff435a085e..e7c08e76f6 100644
--- a/apps/sim/lib/billing/core/subscription.ts
+++ b/apps/sim/lib/billing/core/subscription.ts
@@ -1,7 +1,8 @@
 import { db } from '@sim/db'
 import { member, subscription, user, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, sql } from 'drizzle-orm'
+import { and, eq, inArray, sql } from 'drizzle-orm'
+import { getEffectiveBillingStatus, isOrganizationBillingBlocked } from '@/lib/billing/core/access'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/plan'
 import { getUserUsageLimit } from '@/lib/billing/core/usage'
 import {
@@ -14,8 +15,11 @@ import {
   checkEnterprisePlan,
   checkProPlan,
   checkTeamPlan,
+  ENTITLED_SUBSCRIPTION_STATUSES,
   getFreeTierLimit,
   getPerUserMinimumLimit,
+  hasUsableSubscriptionAccess,
+  USABLE_SUBSCRIPTION_STATUSES,
 } from '@/lib/billing/subscriptions/utils'
 import type { UserSubscriptionState } from '@/lib/billing/types'
 import {
@@ -63,17 +67,22 @@ export async function writeBillingInterval(
 }
 
 /**
- * Check if a referenceId (user ID or org ID) has an active subscription
- * Used for duplicate subscription prevention
+ * Check if a referenceId (user ID or org ID) has a paid subscription row.
+ * Used for duplicate subscription prevention and transfer safety.
  *
  * Fails closed: returns true on error to prevent duplicate creation
  */
-export async function hasActiveSubscription(referenceId: string): Promise<boolean> {
+export async function hasPaidSubscription(referenceId: string): Promise<boolean> {
   try {
     const [activeSub] = await db
       .select({ id: subscription.id })
       .from(subscription)
-      .where(and(eq(subscription.referenceId, referenceId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, referenceId),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     return !!activeSub
@@ -189,13 +198,18 @@ export async function isEnterpriseOrgAdminOrOwner(userId: string): Promise<boole
       return false
     }
 
+    const billingStatus = await getEffectiveBillingStatus(userId)
+    if (billingStatus.billingBlocked) {
+      return false
+    }
+
     const [orgSub] = await db
       .select()
       .from(subscription)
       .where(
         and(
           eq(subscription.referenceId, memberRecord.organizationId),
-          eq(subscription.status, 'active')
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
         )
       )
       .limit(1)
@@ -248,13 +262,18 @@ export async function isTeamOrgAdminOrOwner(userId: string): Promise<boolean> {
       return false
     }
 
+    const billingStatus = await getEffectiveBillingStatus(userId)
+    if (billingStatus.billingBlocked) {
+      return false
+    }
+
     const [orgSub] = await db
       .select()
       .from(subscription)
       .where(
         and(
           eq(subscription.referenceId, memberRecord.organizationId),
-          eq(subscription.status, 'active')
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
         )
       )
       .limit(1)
@@ -293,10 +312,19 @@ export async function isOrganizationOnTeamOrEnterprisePlan(
       return true
     }
 
+    if (await isOrganizationBillingBlocked(organizationId)) {
+      return false
+    }
+
     const [orgSub] = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     return !!orgSub && (checkTeamPlan(orgSub) || checkEnterprisePlan(orgSub))
@@ -320,10 +348,19 @@ export async function isOrganizationOnEnterprisePlan(organizationId: string): Pr
       return true
     }
 
+    if (await isOrganizationBillingBlocked(organizationId)) {
+      return false
+    }
+
     const [orgSub] = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     return !!orgSub && checkEnterprisePlan(orgSub)
@@ -413,6 +450,8 @@ export async function hasInboxAccess(userId: string): Promise<boolean> {
     }
     const sub = await getHighestPrioritySubscription(userId)
     if (!sub) return false
+    const billingStatus = await getEffectiveBillingStatus(userId)
+    if (!hasUsableSubscriptionAccess(sub.status, billingStatus.billingBlocked)) return false
     return getPlanTierCredits(sub.plan) >= 25000 || checkEnterprisePlan(sub)
   } catch (error) {
     logger.error('Error checking inbox access', { error, userId })
diff --git a/apps/sim/lib/billing/core/usage.ts b/apps/sim/lib/billing/core/usage.ts
index a822c332fb..d5154e80a0 100644
--- a/apps/sim/lib/billing/core/usage.ts
+++ b/apps/sim/lib/billing/core/usage.ts
@@ -7,6 +7,7 @@ import {
   renderFreeTierUpgradeEmail,
   renderUsageThresholdEmail,
 } from '@/components/emails'
+import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
 import {
   getHighestPrioritySubscription,
   type HighestPrioritySubscription,
@@ -25,6 +26,8 @@ import {
   getFreeTierLimit,
   getPerUserMinimumLimit,
   getPlanPricing,
+  hasPaidSubscriptionStatus,
+  hasUsableSubscriptionAccess,
 } from '@/lib/billing/subscriptions/utils'
 import type { BillingData, UsageData, UsageLimitInfo } from '@/lib/billing/types'
 import { Decimal, toDecimal, toNumber } from '@/lib/billing/utils/decimal'
@@ -338,6 +341,11 @@ export async function updateUserUsageLimit(
       return { success: false, error: 'Free plan users cannot edit usage limits' }
     }
 
+    const billingStatus = await getEffectiveBillingStatus(userId)
+    if (!hasUsableSubscriptionAccess(subscription.status, billingStatus.billingBlocked)) {
+      return { success: false, error: 'An active subscription is required to edit usage limits' }
+    }
+
     const minimumLimit = getPerUserMinimumLimit(subscription)
 
     logger.info('Applying plan-based validation', {
@@ -501,7 +509,7 @@ export async function syncUsageLimitsFromSubscription(userId: string): Promise<v
     ? toNumber(toDecimal(currentStats.currentUsageLimit))
     : 0
 
-  if (!subscription || subscription.status !== 'active') {
+  if (!subscription || !hasPaidSubscriptionStatus(subscription.status)) {
     // Downgraded to free
     await db
       .update(userStats)
diff --git a/apps/sim/lib/billing/credits/balance.ts b/apps/sim/lib/billing/credits/balance.ts
index 47faf19797..1c2c84f02e 100644
--- a/apps/sim/lib/billing/credits/balance.ts
+++ b/apps/sim/lib/billing/credits/balance.ts
@@ -2,8 +2,10 @@ import { db } from '@sim/db'
 import { member, organization, userStats } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq, sql } from 'drizzle-orm'
+import { getEffectiveBillingStatus } from '@/lib/billing/core/access'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
 import { isOrgPlan, isPro, isTeam } from '@/lib/billing/plan-helpers'
+import { hasUsableSubscriptionAccess } from '@/lib/billing/subscriptions/utils'
 import { Decimal, toDecimal, toFixedString, toNumber } from '@/lib/billing/utils/decimal'
 
 const logger = createLogger('CreditBalance')
@@ -179,7 +181,11 @@ export async function deductFromCredits(userId: string, cost: number): Promise<D
 
 export async function canPurchaseCredits(userId: string): Promise<boolean> {
   const subscription = await getHighestPrioritySubscription(userId)
-  if (!subscription || subscription.status !== 'active') {
+  if (!subscription) {
+    return false
+  }
+  const billingStatus = await getEffectiveBillingStatus(userId)
+  if (!hasUsableSubscriptionAccess(subscription.status, billingStatus.billingBlocked)) {
     return false
   }
   // Enterprise users must contact support to purchase credits
diff --git a/apps/sim/lib/billing/index.ts b/apps/sim/lib/billing/index.ts
index 1896089795..c8dd1d6c4f 100644
--- a/apps/sim/lib/billing/index.ts
+++ b/apps/sim/lib/billing/index.ts
@@ -11,8 +11,8 @@ export {
   getHighestPrioritySubscription as getActiveSubscription,
   getUserSubscriptionState as getSubscriptionState,
   hasAccessControlAccess,
-  hasActiveSubscription,
   hasCredentialSetsAccess,
+  hasPaidSubscription,
   hasSSOAccess,
   isEnterpriseOrgAdminOrOwner,
   isEnterprisePlan as hasEnterprisePlan,
diff --git a/apps/sim/lib/billing/organization.ts b/apps/sim/lib/billing/organization.ts
index b828ba1f96..cc75af8337 100644
--- a/apps/sim/lib/billing/organization.ts
+++ b/apps/sim/lib/billing/organization.ts
@@ -8,7 +8,7 @@ import {
 } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq } from 'drizzle-orm'
-import { hasActiveSubscription } from '@/lib/billing'
+import { hasPaidSubscription } from '@/lib/billing'
 import { getPlanPricing } from '@/lib/billing/core/billing'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import { isTeam } from '@/lib/billing/plan-helpers'
@@ -162,7 +162,7 @@ export async function ensureOrganizationForTeamSubscription(
     const membership = existingMembership[0]
     if (membership.role === 'owner' || membership.role === 'admin') {
       // Check if org already has an active subscription (prevent duplicates)
-      if (await hasActiveSubscription(membership.organizationId)) {
+      if (await hasPaidSubscription(membership.organizationId)) {
         logger.error('Organization already has an active subscription', {
           userId,
           organizationId: membership.organizationId,
diff --git a/apps/sim/lib/billing/organizations/membership.ts b/apps/sim/lib/billing/organizations/membership.ts
index 2a917beaa1..424f8c0714 100644
--- a/apps/sim/lib/billing/organizations/membership.ts
+++ b/apps/sim/lib/billing/organizations/membership.ts
@@ -17,8 +17,9 @@ import {
 import { createLogger } from '@sim/logger'
 import { and, eq, inArray, isNull, ne, or, sql } from 'drizzle-orm'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
-import { isOrgPlan } from '@/lib/billing/plan-helpers'
+import { isOrgPlan, sqlIsPro } from '@/lib/billing/plan-helpers'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import { validateSeatAvailability } from '@/lib/billing/validation/seat-management'
 
 const logger = createLogger('OrganizationMembership')
@@ -123,8 +124,8 @@ export async function restoreUserProSubscription(userId: string): Promise<Restor
       .where(
         and(
           eq(subscriptionTable.referenceId, userId),
-          eq(subscriptionTable.status, 'active'),
-          eq(subscriptionTable.plan, 'pro')
+          inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES),
+          sqlIsPro(subscriptionTable.plan)
         )
       )
       .limit(1)
@@ -408,7 +409,7 @@ export async function addUserToOrganization(params: AddMemberParams): Promise<Ad
       .where(
         and(
           eq(subscriptionTable.referenceId, organizationId),
-          eq(subscriptionTable.status, 'active')
+          inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
         )
       )
       .limit(1)
@@ -436,8 +437,8 @@ export async function addUserToOrganization(params: AddMemberParams): Promise<Ad
           .where(
             and(
               eq(subscriptionTable.referenceId, userId),
-              eq(subscriptionTable.status, 'active'),
-              eq(subscriptionTable.plan, 'pro')
+              inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES),
+              sqlIsPro(subscriptionTable.plan)
             )
           )
           .limit(1)
@@ -619,11 +620,14 @@ export async function removeUserFromOrganization(
           const orgPaidSubs = await db
             .select()
             .from(subscriptionTable)
-            .where(eq(subscriptionTable.status, 'active'))
+            .where(
+              and(
+                inArray(subscriptionTable.referenceId, orgIds),
+                inArray(subscriptionTable.status, ENTITLED_SUBSCRIPTION_STATUSES)
+              )
+            )
 
-          hasAnyPaidTeam = orgPaidSubs.some(
-            (s) => orgIds.includes(s.referenceId) && isOrgPlan(s.plan)
-          )
+          hasAnyPaidTeam = orgPaidSubs.some((s) => isOrgPlan(s.plan))
         }
 
         if (!hasAnyPaidTeam) {
diff --git a/apps/sim/lib/billing/plan-helpers.ts b/apps/sim/lib/billing/plan-helpers.ts
index 7bce474eb3..0031bf3dff 100644
--- a/apps/sim/lib/billing/plan-helpers.ts
+++ b/apps/sim/lib/billing/plan-helpers.ts
@@ -10,6 +10,8 @@
  * and map to their original dollar amounts ($20 / $40).
  */
 
+import type { AnyColumn } from 'drizzle-orm'
+import { eq, like, or, type SQL } from 'drizzle-orm'
 import {
   CREDIT_TIERS,
   DEFAULT_PRO_TIER_COST_LIMIT,
@@ -113,6 +115,22 @@ export function getValidPlanNames(type: 'pro' | 'team'): string[] {
  * @example getDisplayPlanName('team_6000') => 'Pro for Teams'
  * @example getDisplayPlanName('pro') => 'Legacy Pro'
  */
+/**
+ * SQL-level plan filters for Drizzle queries.
+ * These are the SQL equivalents of the JS helpers above.
+ */
+export function sqlIsPro(column: AnyColumn): SQL | undefined {
+  return or(eq(column, 'pro'), like(column, 'pro_%'))
+}
+
+export function sqlIsTeam(column: AnyColumn): SQL | undefined {
+  return or(eq(column, 'team'), like(column, 'team_%'))
+}
+
+export function sqlIsPaid(column: AnyColumn): SQL | undefined {
+  return or(sqlIsPro(column)!, sqlIsTeam(column)!, eq(column, 'enterprise'))
+}
+
 export function getDisplayPlanName(plan: string | null | undefined): string {
   if (!plan || isFree(plan)) return 'Free'
   if (isEnterprise(plan)) return 'Enterprise'
diff --git a/apps/sim/lib/billing/subscriptions/utils.test.ts b/apps/sim/lib/billing/subscriptions/utils.test.ts
new file mode 100644
index 0000000000..6a02f4e8ef
--- /dev/null
+++ b/apps/sim/lib/billing/subscriptions/utils.test.ts
@@ -0,0 +1,45 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import {
+  canEditUsageLimit,
+  checkEnterprisePlan,
+  checkProPlan,
+  checkTeamPlan,
+  hasPaidSubscriptionStatus,
+  hasUsableSubscriptionAccess,
+  hasUsableSubscriptionStatus,
+} from '@/lib/billing/subscriptions/utils'
+
+describe('billing subscription status helpers', () => {
+  it('treats past_due as paid entitlement but not usable access', () => {
+    expect(hasPaidSubscriptionStatus('active')).toBe(true)
+    expect(hasPaidSubscriptionStatus('past_due')).toBe(true)
+    expect(hasPaidSubscriptionStatus('canceled')).toBe(false)
+
+    expect(hasUsableSubscriptionStatus('active')).toBe(true)
+    expect(hasUsableSubscriptionStatus('past_due')).toBe(false)
+    expect(hasUsableSubscriptionStatus('incomplete')).toBe(false)
+
+    expect(hasUsableSubscriptionAccess('active', false)).toBe(true)
+    expect(hasUsableSubscriptionAccess('active', true)).toBe(false)
+    expect(hasUsableSubscriptionAccess('past_due', false)).toBe(false)
+  })
+
+  it('keeps paid plan checks true for past_due subscriptions', () => {
+    expect(checkProPlan({ plan: 'pro_4000', status: 'past_due' })).toBe(true)
+    expect(checkTeamPlan({ plan: 'team_8000', status: 'past_due' })).toBe(true)
+    expect(checkEnterprisePlan({ plan: 'enterprise', status: 'past_due' })).toBe(true)
+  })
+
+  it('only allows usage limit editing for active usable subscriptions', () => {
+    expect(canEditUsageLimit({ plan: 'pro_4000', status: 'active' })).toBe(true)
+    expect(canEditUsageLimit({ plan: 'team_8000', status: 'active' })).toBe(true)
+
+    expect(canEditUsageLimit({ plan: 'pro_4000', status: 'past_due' })).toBe(false)
+    expect(canEditUsageLimit({ plan: 'team_8000', status: 'past_due' })).toBe(false)
+    expect(canEditUsageLimit({ plan: 'enterprise', status: 'active' })).toBe(false)
+    expect(canEditUsageLimit({ plan: 'free', status: 'active' })).toBe(false)
+  })
+})
diff --git a/apps/sim/lib/billing/subscriptions/utils.ts b/apps/sim/lib/billing/subscriptions/utils.ts
index d5ddbe3322..3b26fe2a4e 100644
--- a/apps/sim/lib/billing/subscriptions/utils.ts
+++ b/apps/sim/lib/billing/subscriptions/utils.ts
@@ -16,6 +16,38 @@ import {
 import type { EnterpriseSubscriptionMetadata } from '@/lib/billing/types'
 import { env } from '@/lib/core/config/env'
 
+export const ENTITLED_SUBSCRIPTION_STATUSES = ['active', 'past_due'] as const
+
+export const USABLE_SUBSCRIPTION_STATUSES = ['active'] as const
+
+/**
+ * Returns true when a subscription should still count as a paid plan entitlement.
+ */
+export function hasPaidSubscriptionStatus(status: string | null | undefined): boolean {
+  return ENTITLED_SUBSCRIPTION_STATUSES.includes(
+    status as (typeof ENTITLED_SUBSCRIPTION_STATUSES)[number]
+  )
+}
+
+/**
+ * Returns true when a subscription status is usable for product access.
+ */
+export function hasUsableSubscriptionStatus(status: string | null | undefined): boolean {
+  return USABLE_SUBSCRIPTION_STATUSES.includes(
+    status as (typeof USABLE_SUBSCRIPTION_STATUSES)[number]
+  )
+}
+
+/**
+ * Returns true when a subscription is usable for product access.
+ */
+export function hasUsableSubscriptionAccess(
+  status: string | null | undefined,
+  billingBlocked: boolean | null | undefined
+): boolean {
+  return hasUsableSubscriptionStatus(status) && !billingBlocked
+}
+
 /**
  * Get the free tier limit from env or fallback to default
  */
@@ -45,7 +77,7 @@ export function getEnterpriseTierLimitPerSeat(): number {
 }
 
 export function checkEnterprisePlan(subscription: any): boolean {
-  return isEnterprise(subscription?.plan) && subscription?.status === 'active'
+  return isEnterprise(subscription?.plan) && hasPaidSubscriptionStatus(subscription?.status)
 }
 
 /**
@@ -81,11 +113,11 @@ export function getEffectiveSeats(subscription: any): number {
 }
 
 export function checkProPlan(subscription: any): boolean {
-  return isPro(subscription?.plan) && subscription?.status === 'active'
+  return isPro(subscription?.plan) && hasPaidSubscriptionStatus(subscription?.status)
 }
 
 export function checkTeamPlan(subscription: any): boolean {
-  return isTeam(subscription?.plan) && subscription?.status === 'active'
+  return isTeam(subscription?.plan) && hasPaidSubscriptionStatus(subscription?.status)
 }
 
 /**
@@ -96,7 +128,7 @@ export function checkTeamPlan(subscription: any): boolean {
  * @returns The per-user minimum limit in dollars
  */
 export function getPerUserMinimumLimit(subscription: any): number {
-  if (!subscription || subscription.status !== 'active') {
+  if (!subscription || !hasPaidSubscriptionStatus(subscription.status)) {
     return getFreeTierLimit()
   }
 
@@ -124,7 +156,7 @@ export function getPerUserMinimumLimit(subscription: any): number {
  * @returns Whether the user can edit their usage limits
  */
 export function canEditUsageLimit(subscription: any): boolean {
-  if (!subscription || subscription.status !== 'active') {
+  if (!subscription || !hasUsableSubscriptionStatus(subscription.status)) {
     return false // Free plan users cannot edit limits
   }
 
diff --git a/apps/sim/lib/billing/threshold-billing.ts b/apps/sim/lib/billing/threshold-billing.ts
index 46e1defdec..8e59b429f3 100644
--- a/apps/sim/lib/billing/threshold-billing.ts
+++ b/apps/sim/lib/billing/threshold-billing.ts
@@ -4,6 +4,7 @@ import { createLogger } from '@sim/logger'
 import { and, eq, inArray, sql } from 'drizzle-orm'
 import type Stripe from 'stripe'
 import { DEFAULT_OVERAGE_THRESHOLD } from '@/lib/billing/constants'
+import { getEffectiveBillingStatus, isOrganizationBillingBlocked } from '@/lib/billing/core/access'
 import { calculateSubscriptionOverage, getPlanPricing } from '@/lib/billing/core/billing'
 import { getHighestPrioritySubscription } from '@/lib/billing/core/subscription'
 import { computeDailyRefreshConsumed } from '@/lib/billing/credits/daily-refresh'
@@ -15,6 +16,10 @@ import {
   isTeam,
 } from '@/lib/billing/plan-helpers'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import {
+  hasUsableSubscriptionAccess,
+  USABLE_SUBSCRIPTION_STATUSES,
+} from '@/lib/billing/subscriptions/utils'
 import { env } from '@/lib/core/config/env'
 
 const logger = createLogger('ThresholdBilling')
@@ -109,8 +114,12 @@ export async function checkAndBillOverageThreshold(userId: string): Promise<void
     const threshold = OVERAGE_THRESHOLD
 
     const userSubscription = await getHighestPrioritySubscription(userId)
+    const billingStatus = await getEffectiveBillingStatus(userId)
 
-    if (!userSubscription || userSubscription.status !== 'active') {
+    if (
+      !userSubscription ||
+      !hasUsableSubscriptionAccess(userSubscription.status, billingStatus.billingBlocked)
+    ) {
       logger.debug('No active subscription for threshold billing', { userId })
       return
     }
@@ -288,12 +297,22 @@ export async function checkAndBillOrganizationOverageThreshold(
   try {
     const threshold = OVERAGE_THRESHOLD
 
+    if (await isOrganizationBillingBlocked(organizationId)) {
+      logger.debug('Organization billing blocked for threshold billing', { organizationId })
+      return
+    }
+
     logger.debug('Starting organization threshold billing check', { organizationId, threshold })
 
     const orgSubscriptions = await db
       .select()
       .from(subscription)
-      .where(and(eq(subscription.referenceId, organizationId), eq(subscription.status, 'active')))
+      .where(
+        and(
+          eq(subscription.referenceId, organizationId),
+          inArray(subscription.status, USABLE_SUBSCRIPTION_STATUSES)
+        )
+      )
       .limit(1)
 
     if (orgSubscriptions.length === 0) {
diff --git a/apps/sim/lib/billing/webhooks/subscription.ts b/apps/sim/lib/billing/webhooks/subscription.ts
index faab26fcc5..50ab341978 100644
--- a/apps/sim/lib/billing/webhooks/subscription.ts
+++ b/apps/sim/lib/billing/webhooks/subscription.ts
@@ -1,13 +1,14 @@
 import { db } from '@sim/db'
 import { member, organization, subscription } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { and, eq, ne } from 'drizzle-orm'
+import { and, eq, inArray, ne } from 'drizzle-orm'
 import { calculateSubscriptionOverage } from '@/lib/billing/core/billing'
-import { hasActiveSubscription } from '@/lib/billing/core/subscription'
+import { hasPaidSubscription } from '@/lib/billing/core/subscription'
 import { syncUsageLimitsFromSubscription } from '@/lib/billing/core/usage'
 import { restoreUserProSubscription } from '@/lib/billing/organizations/membership'
 import { isEnterprise, isPaid, isPro, isTeam } from '@/lib/billing/plan-helpers'
 import { requireStripeClient } from '@/lib/billing/stripe-client'
+import { ENTITLED_SUBSCRIPTION_STATUSES } from '@/lib/billing/subscriptions/utils'
 import {
   getBilledOverageForSubscription,
   resetUsageForSubscription,
@@ -67,7 +68,7 @@ async function cleanupOrganizationSubscription(organizationId: string): Promise<
   // Check if other active subscriptions still point to this org
   // Note: The subscription being deleted is already marked as 'canceled' by better-auth
   // before this handler runs, so we only find truly active ones
-  if (await hasActiveSubscription(organizationId)) {
+  if (await hasPaidSubscription(organizationId)) {
     logger.info('Skipping organization deletion - other active subscriptions exist', {
       organizationId,
     })
@@ -119,7 +120,7 @@ export async function handleSubscriptionCreated(subscriptionData: {
       .where(
         and(
           eq(subscription.referenceId, subscriptionData.referenceId),
-          eq(subscription.status, 'active'),
+          inArray(subscription.status, ENTITLED_SUBSCRIPTION_STATUSES),
           ne(subscription.id, subscriptionData.id) // Exclude current subscription
         )
       )
diff --git a/apps/sim/lib/core/rate-limiter/rate-limiter.ts b/apps/sim/lib/core/rate-limiter/rate-limiter.ts
index 60d786d9ad..6550496cb9 100644
--- a/apps/sim/lib/core/rate-limiter/rate-limiter.ts
+++ b/apps/sim/lib/core/rate-limiter/rate-limiter.ts
@@ -1,4 +1,5 @@
 import { createLogger } from '@sim/logger'
+import { isOrgPlan } from '@/lib/billing/plan-helpers'
 import { createStorageAdapter, type RateLimitStorageAdapter } from './storage'
 import {
   getRateLimit,
@@ -40,8 +41,7 @@ export class RateLimiter {
   private getRateLimitKey(userId: string, subscription: SubscriptionInfo | null): string {
     if (!subscription) return userId
 
-    const plan = subscription.plan as SubscriptionPlan
-    if ((plan === 'team' || plan === 'enterprise') && subscription.referenceId !== userId) {
+    if (isOrgPlan(subscription.plan) && subscription.referenceId !== userId) {
       return subscription.referenceId
     }
 
diff --git a/apps/sim/lib/webhooks/processor.ts b/apps/sim/lib/webhooks/processor.ts
index 4860402669..2561b2d794 100644
--- a/apps/sim/lib/webhooks/processor.ts
+++ b/apps/sim/lib/webhooks/processor.ts
@@ -1,10 +1,10 @@
 import { db, webhook, workflow, workflowDeploymentVersion } from '@sim/db'
-import { credentialSet, subscription } from '@sim/db/schema'
+import { credentialSet } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
 import { and, eq, isNull, or } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { v4 as uuidv4 } from 'uuid'
-import { checkEnterprisePlan, checkTeamPlan } from '@/lib/billing/subscriptions/utils'
+import { isOrganizationOnTeamOrEnterprisePlan } from '@/lib/billing/core/subscription'
 import { getInlineJobQueue, getJobQueue, shouldExecuteInline } from '@/lib/core/async-jobs'
 import type { AsyncExecutionCorrelation } from '@/lib/core/async-jobs/types'
 import { isProd } from '@/lib/core/config/feature-flags'
@@ -90,20 +90,7 @@ async function verifyCredentialSetBilling(credentialSetId: string): Promise<{
     return { valid: false, error: 'Credential set not found' }
   }
 
-  const [orgSub] = await db
-    .select()
-    .from(subscription)
-    .where(and(eq(subscription.referenceId, set.organizationId), eq(subscription.status, 'active')))
-    .limit(1)
-
-  if (!orgSub) {
-    return {
-      valid: false,
-      error: 'Credential sets require a Team or Enterprise plan. Please upgrade to continue.',
-    }
-  }
-
-  const hasTeamPlan = checkTeamPlan(orgSub) || checkEnterprisePlan(orgSub)
+  const hasTeamPlan = await isOrganizationOnTeamOrEnterprisePlan(set.organizationId)
   if (!hasTeamPlan) {
     return {
       valid: false,