@@ -36,7 +36,7 @@ MODEL_PROVIDER=openai just evals
 SIMPLE_AGENT_MODEL=openai:gpt-4o REASONING_AGENT_MODEL=openai:gpt-4.1 just evals
 
 # override just one model
-REASONING_AGENT_MODEL=anthropic:claude-opus-4-1-20250805 just evals
+REASONING_AGENT_MODEL=anthropic:claude-opus-5 just evals
 ```
 
 Provider defaults:
 
@@ -13,7 +13,7 @@
         - Default for anthropic: "anthropic:claude-sonnet-4-5"
         - Default for openai: "openai:gpt-4.1"
 
-    EVALUATOR_MODEL: Override default evaluator model (default: "anthropic:claude-opus-4-1-20250805")
+    EVALUATOR_MODEL: Override default evaluator model (default: "anthropic:claude-opus-5")
 """
 
 import os
@@ -221,9 +221,7 @@ async def _evaluate(evaluation_prompt: str, agent_response: str) -> None:
         Raises:
             AssertionError: If evaluation fails, with explanation
         """
-        evaluator_model = os.getenv(
-            "EVALUATOR_MODEL", "anthropic:claude-opus-4-1-20250805"
-        )
+        evaluator_model = os.getenv("EVALUATOR_MODEL", "anthropic:claude-opus-5")
         evaluator = Agent(
             name="Response Evaluator",
             model=evaluator_model,
 
@@ -2,8 +2,6 @@
 
 from uuid import UUID
 
-from prefect.client.cloud import CloudUnauthorizedError
-
 from prefect_mcp_server import cloud_oauth
 from prefect_mcp_server._prefect_client.client import (
     get_prefect_client,
@@ -51,8 +49,13 @@ async def get_identity(workspace_id: UUID | None = None) -> IdentityResult:
     """Get identity and connection information for the current Prefect instance."""
     try:
         access_token = cloud_oauth.current_oauth_access_token()
-        if workspace_id is None and cloud_oauth.settings.enabled and access_token:
-            identity = await _get_cloud_oauth_identity(access_token)
+        if cloud_oauth.settings.enabled and access_token:
+            # OAuth tokens are workspace-scoped and cannot call account-level
+            # endpoints like /me/ or /accounts/{id}, so always describe the
+            # grant instead of fetching full Cloud identity.
+            identity = await _get_cloud_oauth_identity(
+                access_token, workspace_id=workspace_id
+            )
             return {
                 "success": True,
                 "identity": identity,
@@ -73,19 +76,7 @@ async def get_identity(workspace_id: UUID | None = None) -> IdentityResult:
                     workspace_id=workspace_id
                 ) as cloud_client:
                     # Get user info from /me/ endpoint
-                    try:
-                        me_data = await cloud_client.get("/me/")
-                    except CloudUnauthorizedError:
-                        if cloud_oauth.settings.enabled and access_token:
-                            identity = await _get_cloud_oauth_identity(
-                                access_token, workspace_id=workspace_id
-                            )
-                            return {
-                                "success": True,
-                                "identity": identity,
-                                "error": None,
-                            }
-                        raise
+                    me_data = await cloud_client.get("/me/")
 
                     user_info: UserInfo = {
                         "id": str(me_data.get("id")) if me_data.get("id") else None,
 
@@ -1,6 +1,7 @@
 """Rate limits inspection for Prefect Cloud."""
 
 from datetime import datetime, timedelta, timezone
+from uuid import UUID
 
 from prefect_mcp_server._prefect_client.client import (
     get_prefect_client,
@@ -37,20 +38,23 @@
 async def get_rate_limits(
     since: datetime | None = None,
     until: datetime | None = None,
+    workspace_id: UUID | None = None,
 ) -> RateLimitsResult:
     """Get rate limit usage for the Cloud account across all common operation groups.
 
     Args:
         since: Start time for usage data (defaults to 3 days ago)
         until: End time for usage data (defaults to 1 minute ago)
+        workspace_id: Workspace to resolve the account from (required in
+            Prefect Cloud OAuth mode)
 
     Returns:
         RateLimitsResult with grouped throttling periods showing which operation
         groups (runs, deployments, writing-logs, etc.) were throttled during each
         consecutive stretch of throttling
     """
     try:
-        async with get_prefect_client() as client:
+        async with get_prefect_client(workspace_id=workspace_id) as client:
             api_url = str(client.api_url)
 
             # Extract account_id from Cloud API URL
@@ -65,7 +69,9 @@ async def get_rate_limits(
             if until is None:
                 until = datetime.now(timezone.utc) - timedelta(minutes=1)
 
-            async with get_prefect_cloud_client() as cloud_client:
+            async with get_prefect_cloud_client(
+                workspace_id=workspace_id
+            ) as cloud_client:
                 # Query all keys in one request
                 params = {
                     "since": since.isoformat(),
 
@@ -500,6 +500,7 @@ async def get_object_schema(
 
 
 async def review_rate_limits(
+    workspace_id: WorkspaceId | None = None,
     since: Annotated[
         datetime | None,
         Field(
@@ -539,7 +540,9 @@ async def review_rate_limits(
         - Check recent throttling: review_rate_limits()
         - Custom time range: review_rate_limits(since="2025-09-30T00:00:00Z", until="2025-10-01T00:00:00Z")
     """
-    return await _prefect_client.get_rate_limits(since=since, until=until)
+    return await _prefect_client.get_rate_limits(
+        since=since, until=until, workspace_id=workspace_id
+    )
 
 
 CORE_TOOLS = (
 
@@ -7,7 +7,6 @@
 import pytest
 from fastmcp import Client
 from fastmcp.server.auth.providers.jwt import JWTVerifier
-from prefect.client.cloud import CloudUnauthorizedError
 from starlette.applications import Starlette
 from starlette.testclient import TestClient
 
@@ -130,25 +129,14 @@ async def test_get_identity_describes_oauth_grant_without_workspace() -> None:
     )
 
 
-async def test_get_identity_describes_service_account_oauth_grant_with_workspace() -> (
-    None
-):
+async def test_get_identity_with_workspace_never_calls_account_endpoints() -> None:
+    """OAuth tokens are workspace-scoped; account-level endpoints return 403."""
     workspace = cloud_oauth.WorkspaceRef(
         account_id=ACCOUNT_ID,
         account_handle="acme",
         workspace_id=WORKSPACE_ID,
         workspace_handle="prod",
     )
-    mock_client = AsyncMock()
-    mock_client.api_url = (
-        f"https://api.prefect.cloud/api/accounts/{ACCOUNT_ID}/workspaces/{WORKSPACE_ID}"
-    )
-    mock_cloud_client = AsyncMock()
-    mock_cloud_client.get = AsyncMock(
-        side_effect=CloudUnauthorizedError(
-            "Only users (not service accounts) can access this endpoint."
-        )
-    )
 
     with (
         patch(
@@ -172,12 +160,11 @@ async def test_get_identity_describes_service_account_oauth_grant_with_workspace
             AsyncMock(return_value=[workspace]),
         ) as mock_list_authorized_workspaces,
     ):
-        mock_get_client.return_value.__aenter__.return_value = mock_client
-        mock_get_cloud_client.return_value.__aenter__.return_value = mock_cloud_client
-        mock_get_cloud_client.return_value.__aexit__.return_value = None
-
         result = await get_identity(workspace_id=WORKSPACE_ID)
 
+    mock_get_client.assert_not_called()
+    mock_get_cloud_client.assert_not_called()
+
     assert result["success"] is True
     assert result["identity"] == {
         "api_url": "https://api.prefect.cloud",
 
@@ -2,8 +2,12 @@
 
 from datetime import datetime, timezone
 from unittest.mock import AsyncMock, patch
+from uuid import UUID
+
+from fastmcp import Client
 
 from prefect_mcp_server._prefect_client.rate_limits import get_rate_limits
+from prefect_mcp_server.server import build_prefect_mcp_server
 
 
 async def test_get_rate_limits_empty_response() -> None:
@@ -816,3 +820,56 @@ async def test_get_rate_limits_handles_errors() -> None:
     assert result["account_id"] is None
     assert result["summary"] is None
     assert result["throttling_periods"] is None
+
+
+async def test_get_rate_limits_passes_workspace_id_to_clients() -> None:
+    """workspace_id must reach both clients so OAuth mode can scope the request."""
+    workspace_id = UUID("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")
+
+    mock_client = AsyncMock()
+    mock_client.api_url = (
+        f"https://api.prefect.cloud/api/accounts/abc-123/workspaces/{workspace_id}"
+    )
+
+    mock_cloud_client = AsyncMock()
+    mock_cloud_client.get = AsyncMock(
+        return_value={
+            "account": "abc-123",
+            "since": "2025-09-30T00:00:00Z",
+            "until": "2025-10-01T00:00:00Z",
+            "minutes": [],
+            "keys": {},
+        }
+    )
+
+    with (
+        patch(
+            "prefect_mcp_server._prefect_client.rate_limits.get_prefect_client"
+        ) as mock_get_client,
+        patch(
+            "prefect_mcp_server._prefect_client.rate_limits.get_prefect_cloud_client"
+        ) as mock_get_cloud_client,
+    ):
+        mock_get_client.return_value.__aenter__.return_value = mock_client
+        mock_get_cloud_client.return_value.__aenter__.return_value = mock_cloud_client
+        mock_get_cloud_client.return_value.__aexit__.return_value = None
+
+        result = await get_rate_limits(workspace_id=workspace_id)
+
+    assert result["success"] is True
+    mock_get_client.assert_called_once_with(workspace_id=workspace_id)
+    mock_get_cloud_client.assert_called_once_with(workspace_id=workspace_id)
+
+
+async def test_review_rate_limits_tool_accepts_workspace_id() -> None:
+    """The MCP tool schema must expose workspace_id for OAuth mode."""
+    server = build_prefect_mcp_server(
+        include_docs_proxy=False,
+        include_cloud_tools=True,
+    )
+
+    async with Client(server) as client:
+        tools = {tool.name: tool for tool in await client.list_tools()}
+
+    schema = tools["review_rate_limits"].inputSchema
+    assert "workspace_id" in schema["properties"]