Policy Configuration

Policy Model

Policies are distributed across three tiers (organization → department chain → user). The core principle: grants go by exception, security only tightens.

Each dimension has a default stance (allow or deny) that decides whether entries not explicitly declared are usable
On top of the default, you can add allow / deny exceptions entry by entry
Department and user exceptions can override exceptions declared by the organization (more specific rules win)

Default Stance and Exceptions

Dimension	Default	Description
models	allow	Everything available by default; narrow with deny
skills	allow	Everything available by default
plugins	allow	Everything available by default
experts	allow	Everything available by default
apiKeys	deny	Organization-built keys are only distributed when explicitly allowed
connectors	deny	Official/organization connectors must be explicitly allowed
upstream	On	Organization upstream master gate: once off, official providers are all unavailable
sandbox (cloud sandbox)	allow	Authorization-type cloud control: allowed by default; the organization can turn it off, and departments/users can open exceptions with more specific overrides (see below)

Cloud Sandbox Switch

The “Sandbox” card in policy configuration is a toggle-style cloud control that decides whether clients may use cloud execution:

Three tiers of more-specific overrides: allowed by default; the organization can turn it off entirely, and the department and user tiers can still open exceptions for individual departments/users as more specific overrides (they can be enabled even while the organization keeps it off)
Access point: when enabling, a broker access-point address is required (fillable only at organization level, distributed with the policy); reachability is probed automatically before saving — an unreachable point warns but can still be enabled
Two-way confirmation: enabling warns “clients can create and connect cloud sandboxes, cloud compute incurs consumption, and task data will leave this machine”; disabling warns “running cloud sandboxes will be stopped (environment and data preserved), and cloud tasks will be interrupted”
Client behavior: when not enabled (or the access point is not configured), the “Cloud” entry is hidden entirely on the client; established connections are not force-disconnected and running tasks are not interrupted

See Cloud for detailed behavior.

Connector Policy Dimensions

Sub-dimension	Description
official	Allow/deny official connectors
org	Allow/deny organization-private connectors
allowLocalCustom	Allow users to build local custom connectors
allowUnsignedPackage	Allow importing unsigned offline packages
tools.enabled	Master switch for connector tools
tools.write	Write-operation level
tools.highRisk	High-risk tool level

Merge Rules

Merge order: organization → department chain (root → leaf) → user.

Grant-type (models, skills, keys, connectors, sandbox): allow/deny exceptions entry by entry; department/user exceptions can override organization declarations (more specific wins; at the same granularity, deny wins)
Security-type (DLP, approval): can only tighten, never loosen — once a higher tier tightens, lower tiers cannot widen it
The model default stance can only be allow (deny narrows it after everything is visible); it cannot deny everything

Unconfigured = Everything Open

With no policy configured: models, skills, plugins, and experts are all available; apiKeys and connectors deny by default (they must be explicitly allowed to be distributed).

Reference Format

Models: official:<provider>/<model> or org:<apiKeyId>/<model>
Skills/plugins/experts: official:<slug> or org:<slug>

Final Policy Preview per User

The admin console provides a final policy preview for a selected user: the merged result plus the actual list of available models/skills/plugins.

Policy Validation

References to non-existent entries → rejected, not saved