Three-Tier Policies
Policy Dimensions
| Dimension | Meaning | Values |
|---|---|---|
| upstream.enabled | Use official upstream | Boolean (default true) |
| models.allowed | Model allowlist | * or reference list |
| models.default | Default model | Must be in allowed |
| skills | Skill toggles | * or toggle table |
| plugins | Plugin toggles | * or toggle table |
| experts | Expert toggles | * or toggle table |
| apiKeys | Org key allowlist | Key ID list |
Merge Order
Org → Department chain (root → leaf) → UserProgressively restrictive: lower tiers can only narrow, never widen. Parent disables cannot be overridden.
Default = Allow All
No policy configured = fully open (upstream enabled, * allowed). Desktop behavior unchanged when not connected to the server.
Reference Format
- Models:
official:<provider>/<model>ororg:<apiKeyId>/<model> - Skills/plugins/experts:
official:<slug>ororg:<slug>
Final Policy Preview
Admin console provides a per-user final policy preview showing the merged result and actual available items.
Validation
- Default not in allowed → rejected
- Non-existent references → rejected