diff --git a/apis/core.oam.dev/v1alpha1/envbinding_types.go b/apis/core.oam.dev/v1alpha1/envbinding_types.go
index 2313017cf..33858ce99 100644
--- a/apis/core.oam.dev/v1alpha1/envbinding_types.go
+++ b/apis/core.oam.dev/v1alpha1/envbinding_types.go
@@ -117,6 +117,9 @@ type PlacementDecision struct {
 
 // String encode placement decision
 func (in PlacementDecision) String() string {
+	if in.Namespace == "" {
+		return in.Cluster
+	}
 	return in.Cluster + "/" + in.Namespace
 }
 
diff --git a/pkg/auth/round_trippers_test.go b/pkg/auth/round_trippers_test.go
index 4b514e6a7..999c0b6a1 100644
--- a/pkg/auth/round_trippers_test.go
+++ b/pkg/auth/round_trippers_test.go
@@ -65,21 +65,21 @@ func TestImpersonatingRoundTripper(t *testing.T) {
 				return ContextWithUserInfo(ctx, app)
 			},
 			expectedUser:  "system:serviceaccount:vela-system:default",
-			expectedGroup: []string{},
+			expectedGroup: nil,
 		},
 		"without service account and app": {
 			ctxFn: func(ctx context.Context) context.Context {
 				return ContextWithUserInfo(ctx, nil)
 			},
 			expectedUser:  "",
-			expectedGroup: []string{},
+			expectedGroup: nil,
 		},
 		"without service account": {
 			ctxFn: func(ctx context.Context) context.Context {
 				return ContextWithUserInfo(ctx, &v1beta1.Application{})
 			},
 			expectedUser:  AuthenticationDefaultUser,
-			expectedGroup: []string{},
+			expectedGroup: nil,
 		},
 		"with user and groups": {
 			ctxFn: func(ctx context.Context) context.Context {
diff --git a/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler_test.go b/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler_test.go
index 2778e6ef5..a31027d59 100644
--- a/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler_test.go
+++ b/pkg/webhook/core.oam.dev/v1alpha2/application/mutating_handler_test.go
@@ -29,8 +29,8 @@ import (
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
-	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/v1beta1"
+	"github.com/oam-dev/kubevela/apis/types"
 	"github.com/oam-dev/kubevela/pkg/features"
 	"github.com/oam-dev/kubevela/pkg/oam"
 )
@@ -40,7 +40,7 @@ var _ = Describe("Test Application Mutator", func() {
 	var mutatingHandler *MutatingHandler
 
 	BeforeEach(func() {
-		mutatingHandler = &MutatingHandler{}
+		mutatingHandler = &MutatingHandler{skipUsers: []string{types.VelaCoreName}}
 		Expect(mutatingHandler.InjectDecoder(decoder)).Should(BeNil())
 	})
 
@@ -55,7 +55,7 @@ var _ = Describe("Test Application Mutator", func() {
 		Expect(utilfeature.DefaultMutableFeatureGate.Set(fmt.Sprintf("%s=true", features.AuthenticateApplication))).Should(Succeed())
 		resp := mutatingHandler.Handle(ctx, admission.Request{
 			AdmissionRequest: admissionv1.AdmissionRequest{
-				UserInfo: authv1.UserInfo{Groups: []string{common.Group}},
+				UserInfo: authv1.UserInfo{Username: types.VelaCoreName},
 			}})
 		Expect(resp.Allowed).Should(BeTrue())
 		Expect(resp.Patches).Should(BeNil())
diff --git a/pkg/workflow/providers/multicluster/deploy.go b/pkg/workflow/providers/multicluster/deploy.go
index d937db6c8..4c7697247 100644
--- a/pkg/workflow/providers/multicluster/deploy.go
+++ b/pkg/workflow/providers/multicluster/deploy.go
@@ -208,7 +208,7 @@ func applyComponents(apply oamProvider.ComponentApply, healthCheck oamProvider.C
 	var reasons []string
 	for i, res := range results {
 		if res.err != nil {
-			errs = append(errs, res.err)
+			errs = append(errs, fmt.Errorf("error encountered in cluster %s: %w", todoTasks[i].placement.Cluster, res.err))
 		}
 		if !res.healthy {
 			allHealthy = false
diff --git a/test/e2e-multicluster-test/multicluster_test.go b/test/e2e-multicluster-test/multicluster_test.go
index 26399af02..27608f02b 100644
--- a/test/e2e-multicluster-test/multicluster_test.go
+++ b/test/e2e-multicluster-test/multicluster_test.go
@@ -328,9 +328,11 @@ var _ = Describe("Test multicluster scenario", func() {
 			envs[0].Placement.ClusterSelector.Name = WorkerClusterName
 			bs, err = json.Marshal(&v1alpha1.EnvBindingSpec{Envs: []v1alpha1.EnvConfig{envs[0]}})
 			Expect(err).Should(Succeed())
-			Expect(k8sClient.Get(hubCtx, namespacedName, app)).Should(Succeed())
-			app.Spec.Policies[0].Properties.Raw = bs
-			Expect(k8sClient.Update(hubCtx, app)).Should(Succeed())
+			Eventually(func(g Gomega) {
+				g.Expect(k8sClient.Get(hubCtx, namespacedName, app)).Should(Succeed())
+				app.Spec.Policies[0].Properties.Raw = bs
+				g.Expect(k8sClient.Update(hubCtx, app)).Should(Succeed())
+			}, 15*time.Second).Should(Succeed())
 			Eventually(func(g Gomega) {
 				deploys := &appsv1.DeploymentList{}
 				g.Expect(k8sClient.List(hubCtx, deploys, client.InNamespace(testNamespace))).Should(Succeed())