diff --git a/ops/gcp_leoclean_runtime_role.sql b/ops/gcp_leoclean_runtime_role.sql
index 7ee4e94..aab283b 100644
--- a/ops/gcp_leoclean_runtime_role.sql
+++ b/ops/gcp_leoclean_runtime_role.sql
@@ -800,8 +800,11 @@ begin
 end
 $function$;
 
--- Revoke default PUBLIC execute, grant only to runtime, then transfer ownership.
-revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) from public;
+-- Strip all ACLs (including default PUBLIC and creator execute), grant only
+-- runtime, then transfer ownership. The owner transfer leaves the creator's
+-- stale explicit entry if not revoked first.
+revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
+  from public, leoclean_kb_runtime, leoclean_kb_stage_owner, current_user;
 grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
   to leoclean_kb_runtime;
 alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)