diff --git a/server/control-plane-store.mjs b/server/control-plane-store.mjs
index cfffe80..96ff929 100644
--- a/server/control-plane-store.mjs
+++ b/server/control-plane-store.mjs
@@ -168,7 +168,7 @@ export function createControlPlaneStore({ projectRoot }) {
   async function updateClient(clientId, payload, identity) {
     const data = readData();
     const actor = resolveActor(data, identity);
-    const client = findById(data.clients, clientId, "client");
+    const client = findClientById(data, clientId);
 
     client.type = pickEnum(payload?.type, clientTypes, client.type);
     client.name = optionalString(payload?.name, client.name);
@@ -332,7 +332,7 @@ export function createControlPlaneStore({ projectRoot }) {
   async function deleteClient(clientId, identity) {
     const data = readData();
     const actor = resolveActor(data, identity);
-    const client = findById(data.clients, clientId, "client");
+    const client = findClientById(data, clientId);
 
     if (data.clients.length <= 1) {
       throw new Error("Cannot delete the last client");
@@ -1564,16 +1564,12 @@ export function createControlPlaneStore({ projectRoot }) {
     const serviceId = requireString(payload?.serviceId, "serviceId");
     const moduleId = pickEnum(payload?.moduleId, serviceModuleIds, "codex_agents");
     const enabled = payload?.enabled === true;
-    const client = findById(data.clients, clientId, "client");
+    const client = findClientById(data, clientId);
     const user = findById(data.users, userId, "user");
     const service = findById(data.services, serviceId, "service");
 
     const existingEntitlement = data.serviceModuleEntitlements.find(
-      (entitlement) =>
-        entitlement.clientId === client.id &&
-        entitlement.userId === user.id &&
-        entitlement.serviceId === service.id &&
-        entitlement.moduleId === moduleId
+      (entitlement) => entitlement.userId === user.id && entitlement.serviceId === service.id && entitlement.moduleId === moduleId
     );
 
     let entitlement = null;
@@ -1583,13 +1579,13 @@ export function createControlPlaneStore({ projectRoot }) {
         existingEntitlement ??
         {
           id: uniqueId(data.serviceModuleEntitlements, "svc_module", `${client.id}-${service.slug}-${user.email}-${moduleId}`),
-          clientId: client.id,
           userId: user.id,
           serviceId: service.id,
           moduleId,
           createdByUserId: actor.id,
           createdAt: now,
         };
+      entitlement.clientId = client.id;
       entitlement.enabled = true;
       entitlement.updatedAt = now;
 
@@ -1598,13 +1594,7 @@ export function createControlPlaneStore({ projectRoot }) {
       }
     } else {
       data.serviceModuleEntitlements = data.serviceModuleEntitlements.filter(
-        (candidate) =>
-          !(
-            candidate.clientId === client.id &&
-            candidate.userId === user.id &&
-            candidate.serviceId === service.id &&
-            candidate.moduleId === moduleId
-          )
+        (candidate) => !(candidate.userId === user.id && candidate.serviceId === service.id && candidate.moduleId === moduleId)
       );
     }
 
diff --git a/server/dev-server.mjs b/server/dev-server.mjs
index 80b6433..38c6b2f 100644
--- a/server/dev-server.mjs
+++ b/server/dev-server.mjs
@@ -2581,14 +2581,10 @@ function resolveUserServiceModules(data, user, serviceSlug, clientId) {
     return { codex_agents: true };
   }
 
-  const normalizedClientId = normalizeOptionalText(clientId);
-  if (!normalizedClientId) return {};
-
   return Object.fromEntries(
     (data.serviceModuleEntitlements ?? [])
       .filter(
         (entitlement) =>
-          entitlement.clientId === normalizedClientId &&
           entitlement.userId === user.id &&
           entitlement.serviceId === service.id &&
           entitlement.enabled
@@ -3287,9 +3283,7 @@ function scopeControlPlaneData(data, scope) {
       return false;
     }),
     exceptions: data.exceptions.filter((exception) => userIds.has(exception.userId)),
-    serviceModuleEntitlements: data.serviceModuleEntitlements.filter(
-      (entitlement) => clientIds.has(entitlement.clientId) && userIds.has(entitlement.userId)
-    ),
+    serviceModuleEntitlements: data.serviceModuleEntitlements.filter((entitlement) => userIds.has(entitlement.userId)),
     taskManagerMemberships: data.taskManagerMemberships.filter(
       (membership) => clientIds.has(membership.clientId) && userIds.has(membership.userId)
     ),
diff --git a/src/app/LauncherApp.tsx b/src/app/LauncherApp.tsx
index 9168bc6..bc632b2 100644
--- a/src/app/LauncherApp.tsx
+++ b/src/app/LauncherApp.tsx
@@ -520,7 +520,7 @@ export function LauncherApp() {
   }
 
   function handleSetServiceModuleEntitlement(command: SetServiceModuleEntitlementCommand) {
-    const entitlementKey = `${command.clientId}:${command.userId}:${command.serviceId}:${command.moduleId}`;
+    const entitlementKey = `${command.userId}:${command.serviceId}:${command.moduleId}`;
 
     if (pendingServiceModuleEntitlements[entitlementKey]) {
       return;
diff --git a/src/widgets/admin-overlay/AdminOverlay.tsx b/src/widgets/admin-overlay/AdminOverlay.tsx
index 7be9314..60b741a 100644
--- a/src/widgets/admin-overlay/AdminOverlay.tsx
+++ b/src/widgets/admin-overlay/AdminOverlay.tsx
@@ -4826,14 +4826,13 @@ function accessCellKey(userId: string, serviceId: string): string {
   return `${userId}:${serviceId}`;
 }
 
-function serviceModuleEntitlementKey(clientId: string, userId: string, serviceId: string, moduleId: ServiceModuleId): string {
-  return `${clientId}:${userId}:${serviceId}:${moduleId}`;
+function serviceModuleEntitlementKey(_clientId: string, userId: string, serviceId: string, moduleId: ServiceModuleId): string {
+  return `${userId}:${serviceId}:${moduleId}`;
 }
 
-function hasServiceModuleEntitlement(data: LauncherData, clientId: string, userId: string, serviceId: string, moduleId: ServiceModuleId): boolean {
+function hasServiceModuleEntitlement(data: LauncherData, _clientId: string, userId: string, serviceId: string, moduleId: ServiceModuleId): boolean {
   return data.serviceModuleEntitlements.some(
     (entitlement) =>
-      entitlement.clientId === clientId &&
       entitlement.userId === userId &&
       entitlement.serviceId === serviceId &&
       entitlement.moduleId === moduleId &&