Policy keys

Every setting Kodela reads through bin/policy: 166 keys in 19 groups (142 written by hand and 24 generated profile overrides, as bin/policy tunables --advanced lists them), with the scope each can be set at, its default, the values it accepts, whether a service must restart, and the rules that stop an organisation loosening what the host decided.

bin/policy tunables, as a tablefrom the main branch

Filter policy keys

Group

166 keys in 19 groups.

Every policy key, grouped: help, default, allowed values, scope, one-way rule and restart
Key	What it does	Default	Allowed values	Scope, rule and restart
Policy 10 keys
policy_profilePlatform floor profile	A floor under every organisation, repository and person: nobody resolves below it. Unset lets each scope choose, including looser than the default.	Defaultunset	Allowedunset · `open` · `metered` · `guarded` · `strict`	ScopePlatformFloorA floor for everyone: it can only make scopes stricter.No, read live
egress_enforceEgress enforcement	observe decides and logs but lets traffic through; deny acts on the decision. Nothing is blocked while this says observe, whatever the profile says.	Default`observe`	Allowed`observe` · `deny`	ScopePlatform · OrganisationDeny onlyAn organisation may move itself to deny, never back to observe under a host on deny.No, read live
idle_sweep_intervalIdle sweep interval (seconds)	How often idle workspaces are checked and suspended. Not the idle timeout itself. 0 suspends nothing and hides the countdown. Short intervals cost CPU.	Default`300`	AllowedInteger `0`–`86400`	ScopePlatformRestart the console
workspace_file_transferFile transfer	Whether files are copied between a laptop and the workspace, over every copy path: the console's Files pane, the browser IDE's Download and Upload, scp, sftp, rsync, ssh and ftp from the workspace terminal, and scp, sftp and rsync over desktop IDE attach. download is an exit the egress allowlist cannot see. Below `both`, GitHub is reached only through the git broker (authorised repositories read-write, public ones read-only), and GitHub release downloads and `upload.pypi.org` are refused; `both` also opens direct GitHub access. Files-pane transfers are audited; the browser IDE and attach copy apply a change at the workspace's next start, and an attach-copy refusal is logged only inside the workspace. It cannot stop code shown in an attached editor or terminal from leaving.	Default`off`	Allowed`off` · `download` · `upload` · `both`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_max_port_visibilityMax port visibility	The widest a developer may share a workspace port: owner-only, org, or public (a time-limited link). public is off until an operator raises this.	Default`org`	Allowed`owner-only` · `org` · `public`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_share_link_max_ttlMax share-link lifetime (s)	The longest a public-port share link may live, in seconds (5 minutes to 30 days). Developers' links are clamped to it.	Default`86400`	AllowedInteger `300`–`2592000`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_logs_containerDeveloper container logs	Whether developers see their workspace's container logs in the Logs pane.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_logs_egressDeveloper egress feed	Whether developers see their workspace's allowed and refused connections in the Logs pane.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_egress_show_hostsEgress shows destinations	Whether the developer egress feed shows the destination host, or only the decision, port and protocol.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
workspace_startup_tasksWorkspace startup tasks	Whether a workspace runs the startup commands its repository declares (devcontainer.json or workspace-tasks.json) and clones its dotfiles. Runs as the developer, inside the container.	Default`false`	Allowed`true` · `false`	ScopePlatformNo, read live
Workspace 6 keys
workspace_languages_allowedLanguages members may have installed in a workspace	Which language versions can be chosen when a workspace is created or edited: Node.js, Go, Rust, Java, .NET and Deno. The host downloads the version, checks the vendor's published checksum and copies it into the workspace, so the workspace reaches no new host. Package registries (crates, Maven, NuGet) still need the egress allowlist. Narrowing it stops new choices; versions already installed stay until the workspace's own list is edited.	Default`all`	Allowed`all`, `none`, or comma-separated language ids, e.g. node,go,rust	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
workspace_docker_allowedDocker an organisation's workspaces may be created with	The most Docker a new workspace may have, as an ordering: `full` also allows `managed`. `managed` runs real `docker` and `docker compose` through a per-workspace broker that refuses privileged containers, host namespaces, binds outside the workspace and unlisted registries. `full` runs the workspace's own Docker daemon; under the `privileged` runtime the egress firewall and the no-credentials guarantees no longer hold for that workspace. Not available on members' computers.	Default`off`	Allowed`off` · `managed` · `full`	ScopePlatform · OrganisationReplacesAn organisation may choose off or managed for itself; only a platform operator may allow full.No, read live
docker_full_runtimeHow this host runs a workspace with full Docker	What `full` Docker means on this host. `auto` is `sysbox` when the host's Docker lists the Sysbox runtime and `none` when it does not; it never means `privileged`. `none` refuses every full-Docker workspace. `privileged` hands host-root-equivalent power to anyone in the workspace, must be written by an operator, and every create is audited.	Default`auto`	Allowed`auto` · `sysbox` · `privileged` · `none`	ScopePlatformNo, read live
docker_registries_allowedRegistries a workspace's Docker may pull from	Registry hosts a managed-Docker workspace may pull or build from. An image with no host part is docker.io's. Anything else is refused by the Docker broker with a sentence naming this setting. Pulled images are one shared cache on the host, so a workspace can tell an image was already pulled.	Default`docker.io`, `ghcr.io`	AllowedComma-separated hostnames; a leading dot means 'and subdomains' (no scheme, path or port)	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
docker_max_containersContainers one managed-Docker workspace may run	How many containers the Docker broker lets one workspace hold at once. Each container's CPU and memory are capped at the workspace's own.	Default`8`	AllowedInteger `1`–`32`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
docker_egressWhether a workspace's containers reach the internet	`off`: containers a managed-Docker workspace starts reach its database and each other, and nothing else. `proxy`: they also get the workspace's own egress proxy, under the same allowlist. Image pulls are made by the host, under `docker_registries_allowed`, either way.	Default`off`	Allowed`off` · `proxy`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
Egress 8 keys
egress_allowlistAllowed hosts	Hosts a workspace may reach when its profile allowlists egress. A leading dot means every subdomain. Build it from the observe-mode log, not by guessing.	Default`github.com`, `api.github.com`, `codeload.github.com`, `.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `api.anthropic.com`, `open-vsx.org`, `openvsx.eclipsecontent.org`	AllowedComma-separated hostnames; a leading dot means 'and subdomains' (no scheme, path or port)	ScopePlatform · OrganisationAdd onlyAn organisation's list is added to the host's: it can add hosts, never remove the host's.No, read live
egress_log_only_graceObserve-mode grace (days)	How many days the console keeps reminding you that egress is observing, not enforcing. 0 turns the reminder off. Changes nothing about traffic.	Default`7`	AllowedInteger `0`–`365`	ScopePlatformNo, read live
egress_proxy_hostProxy bind address	The address the egress proxy listens on: the gateway of the workspace network, reachable by containers and nothing off the host. Never 0.0.0.0.	Defaultthe workspace network's gateway	AllowedA hostname or IPv4 address on this host; not `0.0.0.0`, no scheme or port	ScopePlatformRestart the egress proxy
egress_proxy_portProxy port	The host port for the egress proxy. Keep it clear of the front door's ports.	Default`3128`	AllowedInteger `1024`–`65535`	ScopePlatformRestart the egress proxy
egress_identityWorkspace identity	required refuses any connection without its workspace's proxy credential, so every record names a workspace. optional records the rest as unidentified.	Default`optional`	Allowed`optional` · `required`	ScopePlatformNo, read live
egress_portsAllowed destination ports	Destination ports a tunnel may target. A real control: port 22 through a correct hostname allowlist is a working ssh session.	Default`443`, `80`	AllowedComma-separated TCP port numbers, e.g. 443,80	ScopePlatformNo, read live
egress_idle_timeoutTunnel idle timeout (seconds)	Seconds a silent tunnel stays open. Byte counts are written when a connection ends, so this bounds how long traffic goes unrecorded.	Default`600`	AllowedInteger `10`–`86400`	ScopePlatformNo, read live
egress_connect_timeoutUpstream connect timeout (seconds)	Seconds to wait for a destination to accept a connection before giving up, so a black-holed host fails visibly.	Default`15`	AllowedInteger `1`–`120`	ScopePlatformNo, read live
Git broker 5 keys
git_broker_enabledBroker enabled	On: workspaces on a brokered profile get no GitHub token; git asks the host-side broker over the workspace's own socket. Off returns a reusable token to disk.	Default`true`	Allowed`true` · `false`	ScopePlatformRestart the git broker
git_branch_patternAllowed ref pattern	The only refs a strict-profile workspace may push. {user} becomes the developer's slug; keep it, or one person can push over another's branch.	Default`feature/{user}/*`	AllowedA ref glob; {user} is replaced with the developer slug, e.g. feature/{user}/*	ScopePlatformNo, read live
git_token_ttlMinted token lifetime (seconds)	Lifetime of a minted GitHub App installation token, in seconds. GitHub caps it at one hour; shorter costs only an extra mint.	Default`3600`	AllowedInteger `300`–`3600`	ScopePlatformNo, read live
git_ticket_ttlProxy ticket lifetime (seconds)	Lifetime of the ticket the container is handed, in seconds. It is not a GitHub token and only the broker accepts it.	Default`300`	AllowedInteger `30`–`3600`	ScopePlatformNo, read live
git_validation_gate_enabledRequire a passing validation for every push	When on, the broker refuses a push unless its exact commit has a passing verdict from Validate this commit. Deleting a branch is refused while it is on.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
Identity 7 keys
sso_availableOrganisations may configure SSO	Whether organisations may configure an identity provider at all. Off stops SSO being offered without deleting any configuration.	Default`true`	Allowed`true` · `false`	ScopePlatformNo, read live
sso_default_providerProvider offered to new organisations	Pre-selects the provider on a new organisation's SSO settings. It fills in nothing else: issuer, client id and secret are the customer's.	Defaultunset	Allowedunset · `entra` · `google` · `oidc`	ScopePlatformNo, read live
sso_default_link_policyDefault account-linking policy	What a new organisation does when an SSO identity matches an existing email. domain: only in a proven domain. claim: only when the signed-in user links it. none: never.	Default`domain`	Allowed`domain` · `claim` · `none`	ScopePlatformNo, read live
signup_modeWho may create an account	Recorded, not yet enforced: there is no self-signup page, so accounts arrive only by invitation whatever this says. invite, approval and closed are the planned meanings.	Default`invite`	Allowed`invite` · `approval` · `closed`	ScopePlatformNo, read live
mail_driverHow outbound email is sent	none refuses to send, so reset and verification are unavailable. console prints to the log and is refused in production. smtp sends through the Outbound mail relay.	Default`none`	Allowed`none` · `console` · `smtp`	ScopePlatformNo, read live
identity_mail_per_address_per_hourIdentity messages per address per hour	How many invitation, verification and reset mails one address may receive in an hour. Counted whether or not the address has an account.	Default`3`	AllowedInteger `1`–`100`	ScopePlatformNo, read live
identity_mail_per_ip_per_hourIdentity messages per source address per hour	The same limit per requesting address. Behind a reverse proxy an office shares one bucket; raise it for bulk onboarding.	Default`20`	AllowedInteger `1`–`1000`	ScopePlatformNo, read live
Audit 4 keys
audit_enabledAudit logging	Records every broker operation and proxy decision. Turning it off also stops all identity mail, because the mail rate limits are counted from the trail.	Default`true`	Allowed`true` · `false`	ScopePlatformNo, read live
audit_retention_daysAudit retention (days)	How long audit records are kept before bin/audit-log rotate drops them. An organisation may keep its own records longer, never shorter.	Default`90`	AllowedInteger `1`–`3650`	ScopePlatform · OrganisationRaise onlyAn organisation may keep records longer than the platform, never shorter.No, read live
bulk_read_thresholdBulk-read threshold (files)	Reading more than this many files from the working tree in one window raises a signal. Set it above your largest legitimate build step.	Default`500`	AllowedInteger `10`–`100000`	ScopePlatformNo, read live
bulk_read_windowBulk-read window (seconds)	The window, in seconds, over which the bulk-read file count is measured.	Default`60`	AllowedInteger `5`–`3600`	ScopePlatformNo, read live
Quotas 1 key
max_workspacesWorkspaces per organisation	How many workspaces one organisation may hold at once. 0 means no limit. An operator sets it for an organisation; the organisation can read it, not change it.	Default`0`	AllowedInteger `0`–`10000`	ScopePlatform · Organisation (operator)Operator setsSet for an organisation by an operator; the organisation can only read it.No, read live
Placement 4 keys
personal_hosts_allowedMembers' own computers: granted by the operator	Whether a platform operator lets this organisation run workspaces on its members' own computers. There, internet access is observed, not enforced; DNS filtering is not enforced; the source on its disk is readable by whoever uses it; and Docker is not available. Tested end to end only on Windows.	Default`false`	Allowed`true` · `false`	ScopePlatform · Organisation (operator)Operator setsSet for an organisation by an operator; the organisation can only read it.No, read live
personal_hosts_enabledWorkspaces on members' own computers	The organisation's own switch for workspaces on members' computers. It can be turned on only while `personal_hosts_allowed` is granted; turning it off stops new workspaces there at once.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's, and it can be turned on only while an operator's grant holds.No, read live
cloud_hosts_allowedCloud machines: operator grant (reserved)	A reserved switch. No shipped feature reads it: workspaces on an organisation's own cloud machines are not built, so setting it changes nothing that runs.	Default`false`	Allowed`true` · `false`	ScopePlatform · Organisation (operator)Operator setsSet for an organisation by an operator; the organisation can only read it.No, read live
cloud_hosts_enabledCloud machines: organisation switch (reserved)	A reserved switch. No shipped feature reads it, so turning it on changes nothing that runs. It can be turned on only while `cloud_hosts_allowed` is granted.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
Agent autonomy 3 keys
agent_check_allowlistAuto-run these declared checks	Names of the project's own declared checks (test, lint, build) that may run in a turn without a card, and that the validation gate runs. Names only, never commands. Runs have no network.	Defaultempty	AllowedA comma-separated list of check names, e.g. test,lint	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
agent_profileAgent autonomy	How much the agent does without asking: supervised proposes only, assisted edits and runs declared checks, autonomous works within the turn budgets. Unset means assisted.	Defaultunset	Allowedunset · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationBoundedAn organisation's value is bounded by agent_profile_floor.No, read live
agent_profile_floorAgent autonomy floor	A ceiling on autonomy: no organisation or member resolves wider than this. It can narrow everyone and never widen anyone.	Defaultunset	Allowedunset · `supervised` · `assisted` · `autonomous`	ScopePlatformCeilingBounds every organisation and member; it can only narrow.No, read live
Agent chat 56 keys
project_rules_enabledRead the project's own rules file	Whether the agent reads the repository's AGENTS.md and .agents/rules files into the turn. Rules state conventions; they never grant a capability.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
chat_queue_enabledQueue a message during a turn	Whether a developer may queue a follow-up while a turn is still running, instead of waiting or interrupting.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
cost_meter_enabledReport what a turn cost	Records each turn's tokens, model and duration against the organisation, workspace and member. It measures only: no budget, no cap, no billing.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
edit_recovery_enabledRecover from a failed edit match	When an exact edit match fails, try a whitespace-normalised and then a bounded similarity match. The result always names the tier used.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
plan_approval_enabledApprove a plan before it runs	Lets a mode produce a plan that someone approves as a record. Approval covers exactly the listed steps; anything else still asks.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
agent_memory_enabledAgent memory for a workspace	Lets the agent keep short facts for one workspace between sessions. Memories expire, are bounded, listed and deletable, and never grant a capability.	Default`false`	Allowed`true` · `false`	ScopePlatform · Organisation · MemberOff winsAn organisation cannot turn it on while the platform has it off.No, read live
agent_skills_enabledSkills from the workspace repository	Offers the repository's .agents/skills to the agent, and the platform skills built into the workspace image under the same gate, each gated by the member's profile. Unavailable skills are listed with the reason. Nothing is fetched over the network.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
verify_loop_enabledHold a turn open until a check passes	Lets the agent keep working until a declared check passes, up to a hard attempt cap. It runs only checks already in `agent_check_allowlist`.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
verify_loop_max_attemptsAttempts the verification loop may make	How many times the verification loop may run a check before the turn is reported failed. 0 means the loop never runs.	Default`8`	AllowedInteger `0`–`8`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
subagent_max_per_turnSubagents one turn may start	How many subagents one turn may start. 0 means none, and the model is not offered the tool.	Default`2`	AllowedInteger `0`–`4`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
mcp_call_timeout_secondsMCP call timeout (seconds)	How long one MCP tool call may hold a turn open, in seconds.	Default`30`	AllowedInteger `1`–`30`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
mcp_result_max_charsMCP reply the model sees (characters)	How much of an MCP server's reply reaches the model, in characters.	Default`8000`	AllowedInteger `200`–`32000`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
subagent_max_stepsSteps one subagent may take	How many tool steps one subagent may take before it must answer.	Default`4`	AllowedInteger `1`–`8`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
subagent_result_max_charsSubagent answer returned (characters)	How much of a subagent's answer returns to the parent turn, in characters.	Default`4000`	AllowedInteger `200`–`16000`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
mcp_enabledMCP servers	Lets the agent reach MCP servers on the organisation's allowlist. Every connection dials through the egress proxy and appears in the egress log. No servers are bundled.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
browser_feedback_enabledBrowser sidecar reports into the turn	Whether screenshots and console errors from the workspace's browser sidecar are returned into the turn for the model to read.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
agent_vcs_enabledAgent git and pull requests	The parent switch for agent git: branch, commit, push and open a pull request. The six git capabilities below grant nothing while this is off.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
vcs_read_min_profilegit.read: read the repository	The narrowest agent profile that may read branches, log, status and diff, or off for nobody.	Default`supervised`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_write_min_profilegit.write: change tracked files	The narrowest profile that may stage, unstage or discard changes to tracked files. It can only narrow the existing file-write rules.	Default`assisted`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_commit_min_profilegit.commit: commit locally	The narrowest profile that may make a local commit. Nothing leaves the host.	Default`assisted`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_branch_min_profilegit.branch: create a branch	The narrowest profile that may create a local branch. The agent never deletes or moves an existing branch.	Default`assisted`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_push_min_profilegit.push: push to the remote	The narrowest profile that may push through the git broker. Off until an organisation says otherwise. The agent never force-pushes or deletes a ref.	Default`off`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_pr_min_profilegithub.pr.create: open a pull request	The narrowest profile that may open a pull request for a branch it pushed. The request is made by the broker; the credential never leaves it.	Default`off`	Allowed`off` · `supervised` · `assisted` · `autonomous`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
vcs_max_pushes_per_turnPushes one turn may make	How many times one turn may push. 0 means no turn pushes.	Default`1`	AllowedInteger `0`–`4`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
subagent_parallel_maxSubagents that may run at once	How many of a turn's subagents run at once. 1 is sequential.	Default`1`	AllowedInteger `1`–`4`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
subagent_rolesSubagent roles this organisation allows	Which subagent kinds a turn may start: retrieval and review, both read-only. Naming a role that does not exist grants nothing.	Default`retrieval,review`	AllowedComma-separated roles: `retrieval`, `review`	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
scheduler_dispatch_enabledScheduler dispatch	Whether the scheduler may dispatch an organisation's ready tasks to a coding runtime, not only a person in chat. Every dispatch passes the pre-dispatch gate and is recorded first.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
chat_dispatch_enabledRun a coding agent from chat	Whether a chat message may start a real coding agent (Claude Code or Codex) in the workspace. Off, selecting a runtime prepares a proposal and starts nothing.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
subagents_enabledSubagents with their own context	Whether a turn may start a retrieval or review subagent with its own context. A subagent inherits the parent's profile and never exceeds it.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationOff winsAn organisation cannot turn it on while the platform has it off.No, read live
agent_cmd_max_concurrentApproved commands running at once	How many approved checks may run at once on the host. An organisation may hold fewer for itself.	Default`2`	AllowedInteger `1`–`16`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.Restart the console
chat_replay_charsHow much conversation the chat model is replayed (characters)	How much earlier conversation is replayed to the chat model each turn, in characters, oldest dropped first.	Default`48000`	AllowedInteger `4000`–`400000`	ScopePlatform · Organisation · MemberLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
chat_run_context_charsHow much context a chat-started run is given (characters)	The context budget for a chat-started run: repository briefing, project rules, a slice of the conversation and the message. Only the conversation is trimmed.	Default`24000`	AllowedInteger `2000`–`100000`	ScopePlatform · Organisation · MemberLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
live_run_max_concurrentHow many live agent runs one member may have at once	How many live agent runs one member may have at once in an organisation.	Default`2`	AllowedInteger `1`–`12`	ScopePlatform · Organisation · MemberLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
live_run_max_secondsHow long a live agent run may take (seconds)	The wall-clock ceiling on one live coding-agent run, in seconds (1 minute to 1 hour). A run stopped by it records what it spent.	Default`900`	AllowedInteger `60`–`3600`	ScopePlatform · Organisation · MemberLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
command_approval_scopeWhen a command asks for approval	push-and-production asks only for acts whose effect is elsewhere (push, PR, publish, deploy). ladder asks for anything outside `bash_allowlist`. Neither permits what is refused.	Default`push-and-production`	Allowed`push-and-production` · `ladder`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
workspace_main_pane_minPixels the main pane keeps when the side panel is dragged	Pixels the main pane keeps when the side panel is dragged wider. A comfort bound, not a security one.	Default`640`	AllowedInteger `320`–`2400`	ScopePlatform · Organisation · MemberReplacesAn organisation's own value replaces the platform's.No, read live
chat_approval_bindingDoes the chat approval card bind what it showed?	advisory shows and records the approval card. binding also recomputes it at start and refuses a run whose capabilities changed since it was shown.	Default`advisory`	Allowed`advisory` · `binding`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
chat_approval_approverWho approves a chat run	self lets the requester approve a run inside their own profile. second-person requires a distinct named approver. It bites only when the card binds.	Default`self`	Allowed`self` · `second-person`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
chat_session_max_minutesHow long a chat session grant may last (minutes)	How long a chat session grant to start agent runs lasts, in minutes. It expires so nobody has to remember to revoke it.	Default`240`	AllowedInteger `5`–`240`	ScopePlatform · Organisation · MemberLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
project_boundaryHow the agent treats paths outside the bound project	What the agent may touch outside the bound repository. confine refuses. ask lets reads through and parks writes for approval. open removes the fence.	Default`ask`	Allowed`confine` · `ask` · `open`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
dispatch_max_turnsTurns an unattended agent run may take	How many tool calls a scheduler-dispatched agent run may make. A run that hits it stops and reports an error, so too low looks like a failure.	Default`20`	AllowedInteger `1`–`60`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
subagent_dispatch_tierModel tier an unattended subagent uses	The model tier a scheduler-dispatched subagent runs on: lite, economy or power.	Default`economy`	Allowed`lite` · `economy` · `power`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
bash_allowlistShell commands the agent may run without asking	Command prefixes the agent may run without asking, matched on tokens. Anything else goes to an approval card. A platform floor (sudo, docker, force-push and others) always wins.	Defaultempty	AllowedCommand prefixes, e.g. `npm test`, `pytest`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
bash_denylistShell commands this organisation refuses outright	Command prefixes this organisation refuses outright, even when the allowlist would permit them. The deny list beats the allow list.	Defaultempty	AllowedCommand prefixes, e.g. `npm test`, `pytest`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
bash_remember_approvalsRemember a command after it is approved once	After a command is approved once in a conversation, run it again there without asking. Scoped to one conversation; the platform floor is unaffected.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
auto_approve_low_riskApprove low-risk work automatically	Grants low-risk planning or execution approvals by rule, with no person. The record names the rule as approver. It cannot reach normal, high or critical work.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
chat_images_enabledMembers may attach images to chat messages	Lets members attach images to chat messages. Images go to the model provider as they are: text credentials are redacted, secrets in a screenshot are not.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
chat_files_enabledMembers may attach files to chat messages	Lets members attach PDFs and text or code files, up to 5 MB each. A text file goes to the model as text, cut at 100,000 characters, and is refused if it carries a credential. A PDF goes to Claude as a document and cannot be checked for secrets; while personal-data masking is on, PDFs are refused. The audit records name, type, size and fingerprint, never the content.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
dispatch_may_start_appA dispatched run may leave the application running	After a dispatched run, start the project's declared start command so the app keeps running. That process outlives the run and nobody is watching it.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
codex_container_sandboxCodex sandbox inside a workspace container	The sandbox a containerised Codex run uses. workspace-write fails inside Docker's default seccomp profile, which is why the default reads looser.	Default`danger-full-access`	Allowed`workspace-write` · `danger-full-access`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
runtime_allowlistRuntimes this organisation permits	Which coding runtimes an organisation's developers may pick. Empty means every runtime the platform offers.	Defaultempty	AllowedComma-separated runtime names, e.g. claude,codex; empty means no organisation-level narrowing	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
acp_agentsACP agents this platform offers	The ACP agents offered on this host: id, label and the command launched. Only an operator may set it, because the command runs with the server's authority.	Default`claude-acp` (Claude Code over ACP)	AllowedA JSON list of `{"id","label","command"}`; `[]` offers ACP to nobody	ScopePlatformNo, read live
acp_agent_allowlistACP agents this organisation permits	Which of the platform's ACP agents this organisation permits, by id. Empty means all of them.	Defaultempty	AllowedComma-separated ACP agent ids, e.g. claude-acp,gemini-acp; empty means every agent this platform offers	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
acp_agentThis member's ACP agent	The ACP agent one member's runs use. Empty inherits the organisation's choice. It names an allowed id and never carries a command.	Defaultunset	AllowedOne ACP agent id, e.g. claude-acp; empty means inherit the organisation's choice	ScopePlatform · Organisation · MemberPick from listA member's choice from what the organisation allows; anything else is dropped.No, read live
acp_model_allowlistACP models this organisation permits	Which of an ACP agent's own models this organisation permits, in the agent's own names. Empty means every model the agent offers. Not the same list as `ai_platform_model`.	Defaultempty	AllowedComma-separated ACP model ids in the agent's own names, e.g. opus,haiku; empty means every model the agent offers	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
acp_modelThis member's ACP model	The ACP model one member's runs use. Empty inherits the agent's own current model.	Defaultunset	AllowedOne ACP model id in the agent's own names, e.g. opus; empty means inherit the organisation's choice	ScopePlatform · Organisation · MemberPick from listA member's choice from what the organisation allows; anything else is dropped.No, read live
AI agents 23 keys
member_credentials_enabledMembers may register their own brokered credential	Would let a member register a personal credential with the credential broker. The console part exists; the live credential path does not, so turning it on changes nothing that runs.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_mask_personal_dataMask personal data sent to AI models	Replaces email addresses, phone numbers and payment card numbers with a marker in what the organisation's chat sends to the model and in the chat history kept. A card number is masked only when its digits pass the Luhn check. An agent run in a workspace terminal is not covered.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_in_apps_enabledApps may call AI models through the platform	Records whether code in a workspace (the app, not the agent) may call Claude or OpenAI through the brokers on the organisation's API-key credential. It does not block a request.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
workspace_portal_api_enabledAgents in a workspace may manage its owners' workspaces	Lets an agent in a workspace list, start and stop its owners' workspaces in this organisation through the portal broker. Every call is audited.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
catalogue_skillsCatalogue skills offered	Which optional catalogue skills agents are offered: skill names, @developer, @assistant, * or none. It records the decision: the files stay in the image, and an agent reading the directory can still see them. Takes effect at the workspace's next start.	Default`@developer`	AllowedSkill names, @developer, @assistant, * for all, or none	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_agents_enabledAI agents enabled	Whether the console's AI agent chat is available at all. Off shows 'disabled by administrator' to every developer.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationTighten onlyAn organisation may narrow it for itself, never widen past the host.No, read live
ai_platform_membersMembers who may use the platform model	Which members may use the organisation's platform model. Empty means every member.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
ai_member_provider_denylistMembers who may not use their own AI provider	Members who may not chat through a personal provider key even where the organisation allows it.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_members_claudeMembers who may use Claude	Which members may use the Claude provider. Empty means every member.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
ai_members_codexMembers who may use OpenAI (Codex)	Which members may use the OpenAI (Codex) provider. Empty means every member.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
ai_members_geminiMembers who may use Google AI (Gemini)	Which members may use the Google Gemini provider. Empty means every member.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
ai_members_antigravityMembers who may use Google Antigravity (agy)	Which members may use Google Antigravity, whose account the platform signed in for. Empty means every member.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationNarrow onlyNarrows what is offered; naming something not offered grants nothing.No, read live
ai_chat_retention_daysChat transcript retention (days)	How long a workspace's chat transcript is kept. 0 means no time limit; the 200-turn cap applies either way. A retention control, not deletion on demand.	Default`0`	AllowedInteger `0`–`3650`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_max_stepsSteps one chat turn may take	How many tool round-trips one chat turn may take. 0 inherits the platform's value, and the platform ceiling always applies on top.	Default`0`	AllowedInteger `0`–`60`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
ai_max_tool_callsTool calls one chat turn may make	How many reads, edits and commands one chat turn may make in total. 0 inherits the platform's value.	Default`0`	AllowedInteger `0`–`200`	ScopePlatform · OrganisationLower onlyAn organisation may lower it for itself, never above the platform's value.No, read live
ai_platform_modelPlatform models offered to members	Model names offered to members through the platform's own Anthropic credential. Empty means not offered: there is no 'on' without a named model.	Defaultempty	AllowedModel names such as claude-sonnet-5, comma separated; empty to withhold every model	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_member_providersMembers may use their own AI provider	Whether members may add their own provider key. Off makes existing personal providers unusable, not merely un-addable.	Default`true`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_allowed_providersAllowed provider hosts	Provider API hosts a developer's key may point at. Empty means any host; the egress allowlist still applies to the traffic.	Defaultempty	AllowedComma-separated hostnames; a leading dot means 'and subdomains' (no scheme, path or port)	ScopePlatformNo, read live
ai_local_networksLocal provider networks	Extra private ranges that count as a local model server: plain http, no key, dialled directly rather than through the egress proxy. Loopback always counts.	Defaultempty	AllowedComma-separated private CIDR ranges, e.g. `198.51.100.0/24` in your own addressing	ScopePlatformNo, read live
ai_user_denylistDisabled users	Developers, by email, for whom the AI agent is off even while it is on for everyone else.	Defaultempty	AllowedComma-separated email addresses	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
ai_tier_liteLite tier default model	The model the Lite tier uses when a developer's provider has not mapped it.	Default`gpt-4o-mini`	AllowedA non-empty string	ScopePlatformNo, read live
ai_tier_economyEconomy tier default model	The model the Economy tier uses when a developer's provider has not mapped it.	Default`claude-sonnet-4-20250514`	AllowedA non-empty string	ScopePlatformNo, read live
ai_tier_powerPower tier default model	The model the Power tier uses when a developer's provider has not mapped it.	Default`claude-opus-4-1`	AllowedA non-empty string	ScopePlatformNo, read live
Claude proxy 6 keys
claude_proxy_enabledClaude proxy enabled	Points workspaces at the host-side Claude proxy, which adds the Anthropic credential so it never enters a container.	Default`false`	Allowed`true` · `false`	ScopePlatformRestart the Claude proxy
claude_proxy_portClaude proxy port	The host port for the Claude proxy.	Default`8071`	AllowedInteger `1024`–`65535`	ScopePlatformRestart the Claude proxy
claude_proxy_hostClaude proxy bind address	The address the Claude proxy listens on: the workspace network's gateway. Never 0.0.0.0, because this listener adds the real credential.	Defaultthe workspace network's gateway	AllowedA hostname or IPv4 address on this host; not `0.0.0.0`, no scheme or port	ScopePlatformRestart the Claude proxy
claude_proxy_timeoutUpstream timeout (seconds)	Seconds the proxy waits on one read from the Anthropic API. Per read, so long streaming answers are not cut off.	Default`600`	AllowedInteger `30`–`3600`	ScopePlatformNo, read live
claude_rate_limit_per_hourRequests per workspace per hour	Refuse a workspace's Claude requests past this many in an hour. 0 means no limit. Size it from claude-proxy usage first.	Default`0`	AllowedInteger `0`–`100000`	ScopePlatformNo, read live
claude_rate_limit_tokens_per_dayTokens per workspace per day	Refuse a workspace's Claude requests once its tokens for the UTC day reach this. 0 means no limit. Checked between requests, so one may finish over.	Default`0`	AllowedInteger `0`–`1000000000`	ScopePlatformNo, read live
Key broker 6 keys
key_broker_enabledKey broker enabled	Points workspaces at the host-side key broker, which adds the OpenAI credential so it never enters a container. key-broker providers lists which tools use it.	Default`false`	Allowed`true` · `false`	ScopePlatformRestart the key broker
key_broker_portKey broker port	The host port for the key broker. Keep it clear of the Claude proxy's port.	Default`8072`	AllowedInteger `1024`–`65535`	ScopePlatformRestart the key broker
key_broker_hostKey broker bind address	The address the key broker listens on: the workspace network's gateway. Never 0.0.0.0.	Defaultthe workspace network's gateway	AllowedA hostname or IPv4 address on this host; not `0.0.0.0`, no scheme or port	ScopePlatformRestart the key broker
key_broker_timeoutUpstream timeout (seconds)	Seconds the broker waits on one read from the provider. Per read, not per request.	Default`600`	AllowedInteger `30`–`3600`	ScopePlatformNo, read live
key_broker_rate_limit_per_hourRequests per workspace per hour	Refuse a workspace's requests to one provider past this many in an hour. 0 means no limit.	Default`0`	AllowedInteger `0`–`100000`	ScopePlatformNo, read live
key_broker_rate_limit_tokens_per_dayTokens per workspace per day	Refuse a workspace's requests to one provider once its tokens for the UTC day reach this. 0 means no limit.	Default`0`	AllowedInteger `0`–`1000000000`	ScopePlatformNo, read live
Portal broker 2 keys
portal_broker_portPortal broker port	The host port for the portal broker, the channel a workspace uses to list, start and stop its owners' workspaces. The egress firewall must list it.	Default`8075`	AllowedInteger `1024`–`65535`	ScopePlatformRestart the portal broker
portal_broker_hostPortal broker bind address	The address the portal broker listens on: the workspace network's gateway. Never 0.0.0.0.	Defaultthe workspace network's gateway	AllowedA hostname or IPv4 address on this host; not `0.0.0.0`, no scheme or port	ScopePlatformRestart the portal broker
Desktop IDE 1 key
ide_attach_enabledDevelopers may attach a local IDE over ssh	Turning it on lets developers copy the source code to their own machines: desktop VS Code, JetBrains Gateway or ssh attach, and file-transfer rules cannot stop what an editor or terminal shows. Applies to workspaces created after the change. Turning it off stops new attach tokens at once, but a token already issued works until it expires (up to 12 hours); deleting a developer's registered keys cuts their next connection at once.	Default`false`	Allowed`true` · `false`	ScopePlatform · OrganisationReplacesAn organisation's own value replaces the platform's.No, read live
Profile overrides: open 6 keys
profile.open.egressegress	Whether this profile's workspaces reach the internet directly (open) or through the allowlisted proxy. Changes what the named profile means on this host.	Default`open`	Allowed`open` · `allowlist`	ScopePlatform (advanced)No, read live
profile.open.git_credentialgit credential	Whether a GitHub token sits in the container, or git asks the host-side broker. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `broker`	ScopePlatform (advanced)No, read live
profile.open.branch_policybranch policy	Whether pushes are held to `git_branch_pattern`. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
profile.open.claude_credentialclaude credential	Whether the Anthropic credential sits in the container, or stays on the host behind the Claude proxy. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.open.codex_credentialcodex credential	Whether the OpenAI credential sits in the container, or stays on the host behind the key broker. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.open.bulk_read_detectionbulk read detection	Whether a bulk read of the working tree raises a signal. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
Profile overrides: metered 6 keys
profile.metered.egressegress	Whether this profile's workspaces reach the internet directly (open) or through the allowlisted proxy. Changes what the named profile means on this host.	Default`allowlist`	Allowed`open` · `allowlist`	ScopePlatform (advanced)No, read live
profile.metered.git_credentialgit credential	Whether a GitHub token sits in the container, or git asks the host-side broker. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `broker`	ScopePlatform (advanced)No, read live
profile.metered.branch_policybranch policy	Whether pushes are held to `git_branch_pattern`. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
profile.metered.claude_credentialclaude credential	Whether the Anthropic credential sits in the container, or stays on the host behind the Claude proxy. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.metered.codex_credentialcodex credential	Whether the OpenAI credential sits in the container, or stays on the host behind the key broker. Changes what the named profile means on this host.	Default`container`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.metered.bulk_read_detectionbulk read detection	Whether a bulk read of the working tree raises a signal. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
Profile overrides: guarded 6 keys
profile.guarded.egressegress	Whether this profile's workspaces reach the internet directly (open) or through the allowlisted proxy. Changes what the named profile means on this host.	Default`allowlist`	Allowed`open` · `allowlist`	ScopePlatform (advanced)No, read live
profile.guarded.git_credentialgit credential	Whether a GitHub token sits in the container, or git asks the host-side broker. Changes what the named profile means on this host.	Default`broker`	Allowed`container` · `broker`	ScopePlatform (advanced)No, read live
profile.guarded.branch_policybranch policy	Whether pushes are held to `git_branch_pattern`. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
profile.guarded.claude_credentialclaude credential	Whether the Anthropic credential sits in the container, or stays on the host behind the Claude proxy. Changes what the named profile means on this host.	Default`proxy`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.guarded.codex_credentialcodex credential	Whether the OpenAI credential sits in the container, or stays on the host behind the key broker. Changes what the named profile means on this host.	Default`proxy`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.guarded.bulk_read_detectionbulk read detection	Whether a bulk read of the working tree raises a signal. Changes what the named profile means on this host.	Default`false`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
Profile overrides: strict 6 keys
profile.strict.egressegress	Whether this profile's workspaces reach the internet directly (open) or through the allowlisted proxy. Changes what the named profile means on this host.	Default`allowlist`	Allowed`open` · `allowlist`	ScopePlatform (advanced)No, read live
profile.strict.git_credentialgit credential	Whether a GitHub token sits in the container, or git asks the host-side broker. Changes what the named profile means on this host.	Default`broker`	Allowed`container` · `broker`	ScopePlatform (advanced)No, read live
profile.strict.branch_policybranch policy	Whether pushes are held to `git_branch_pattern`. Changes what the named profile means on this host.	Default`true`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live
profile.strict.claude_credentialclaude credential	Whether the Anthropic credential sits in the container, or stays on the host behind the Claude proxy. Changes what the named profile means on this host.	Default`proxy`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.strict.codex_credentialcodex credential	Whether the OpenAI credential sits in the container, or stays on the host behind the key broker. Changes what the named profile means on this host.	Default`proxy`	Allowed`container` · `proxy`	ScopePlatform (advanced)No, read live
profile.strict.bulk_read_detectionbulk read detection	Whether a bulk read of the working tree raises a signal. Changes what the named profile means on this host.	Default`true`	Allowed`true` · `false`	ScopePlatform (advanced)No, read live

No key matches. Try part of a key name, such as egress or ttl, or clear the group.

Type to filter, pick a group, or press a key's name to build the bin/policy command for it. Every key has its own address, so /docs/reference/policy-keys/#git_validation_gate_enabled opens this table on that row. The table is complete with scripts off.

Where a key can be set

A key is set at one of three scopes. Anything not set at a scope falls through to the one above it, and the platform default sits at the top.

Platform: The host's own value. Only an operator on the host, or in the operator console's Settings, sets it. Every key has one.
Organisation: 93 keys can be set for one organisation, by its admins in the organisation console or by an operator with --scope tenant. Three more, max_workspaces, personal_hosts_allowed and cloud_hosts_allowed, only an operator sets for it, so the Organisation scope filter shows 96. The one-way rules below decide how far a value may move from the platform's.
Member: 9 keys can be set for one person in one organisation. A member's value can only be tighter than the organisation's, except the two agent choices, which pick from the organisation's allowed list.

There is no workspace scope for keys. Security profiles (open, metered, guarded, strict) can also be stated per repository and per user; keys cannot. A workspace takes its organisation's values and its owner's member values.

Read and set a key

bin/policy is the one place settings are resolved. The console writes the same records, so a value set on the host shows in the console and the other way round. Each set reads its value back and says what now applies; a key that needs a restart says so, for example set git_broker_enabled = True (restart git-broker for this to take effect).

on the host

# every key, its live value and where that value came from
$ bin/policy tunables
$ bin/policy tunables --group "Git broker" --json
$ bin/policy tunables --advanced          # include the 24 profile overrides

# platform
$ bin/policy get --key egress_enforce
$ bin/policy set --key egress_enforce --value deny

# one organisation
$ bin/policy set --scope tenant --target acme --key audit_retention_days --value 365
$ bin/policy get-for --tenant acme --key audit_retention_days

# one member of one organisation
$ bin/policy set --scope org-user --tenant acme --target dev@example.test \
    --key live_run_max_seconds --value 600

# clear an organisation's value, so it falls back to the platform's
$ bin/policy set --scope tenant --target acme --key audit_retention_days --value ''

# preview any write
$ bin/policy set --key git_token_ttl --value 1800 --dry-run

Lists are comma-separated in one argument: --value 'registry.npmjs.org,.pypi.org'. Booleans are true or false. A value the key does not accept is refused with the expected form, for example invalid value for git_token_ttl: '90' - want an integer from 300 to 3600.

One-way rules

Settings resolve strictest-wins: an organisation can constrain itself further, and it cannot loosen what the host decided. Where a key has a direction, the rule is applied when the value is read, not only when it is written, so a restored backup or a hand-edited file cannot get round it.

Floor

policy_profile raises every scope to at least its profile. agent_profile_floor caps how wide any organisation's agent autonomy may be.

Raise only

audit_retention_days: an organisation may keep its records longer than the platform's 90 days, never shorter. Deleting records sooner is an anti-forensic act.

Lower only

17 ceilings, such as live_run_max_seconds, agent_cmd_max_concurrent and ai_max_steps. An organisation may lower them at any time and never raise them past the platform.

Tighten only

File transfer, port visibility, share-link lifetime, project boundary, the developer log switches and the AI chat switch. The organisation console refuses a wider value and names the host's.

Off wins

14 agent feature switches, from project_rules_enabled to chat_dispatch_enabled. While the platform has one off, no organisation can turn it on.

Deny only

egress_enforce: an organisation may move itself to deny under a host in observe, never the other way.

Add only

egress_allowlist: an organisation's hosts are added to the host's list. It can add what its people need and remove nothing the platform relies on.

Narrow only

Runtime, ACP agent and model lists, subagent roles and the per-provider member lists. A name the platform does not offer is dropped, never granted.

Operator sets

max_workspaces and the two placement grants, personal_hosts_allowed and cloud_hosts_allowed, are set for an organisation by an operator. The organisation can read them and cannot change them. Full Docker is the same shape: an organisation may set workspace_docker_allowed to off or managed, and only an operator may allow full.

The host CLI speaks with operator authority. bin/policy set --scope tenant on the host skips the console's tighten-only refusals, although the read-time clamps above still apply. Use it for operator decisions, and let organisation admins use their console.

The four profiles

A profile names a posture so an admin picks an intent rather than assembling one. It can be stated at platform, organisation, repository, user and member scope, and the strictest one stated wins, in the order open < metered < guarded < strict. The platform default is guarded. The 24 profile.* keys above let an operator change what a profile means on this host.

What each profile turns on by default
Control	open	metered	guarded	strict
`egress`	open	allowlist	allowlist	allowlist
`git_credential`	container	container	broker	broker
`branch_policy`	false	false	false	true
`claude_credential`	container	container	proxy	proxy
`codex_credential`	container	container	proxy	proxy
`bulk_read_detection`	false	false	false	true

on the host

$ bin/policy profiles
$ bin/policy set --scope tenant --target acme --profile strict
$ bin/policy resolve --user dev@example.test --repo acme/api --tenant acme

An allowlist in the profile is not enforcement on its own. Egress is refused only when the resolved profile allowlists it and egress_enforce is deny; in observe, every decision is logged and the traffic still goes.

Troubleshooting

invalid value for <key>: … - want …

The value does not match the key's form. The sentence ends with what the key accepts; the Allowed column above says the same.

unknown setting: <key>

The name is not in the registry. Search the table above; keys use underscores, and profile overrides are profile.<name>.<control>.

--scope user cannot hold a tunable - only a profile

Keys live at platform, organisation (--scope tenant) or member (--scope org-user). Repository and user scopes hold profiles only.

this host has '<key>' turned off, so an organisation cannot turn it on

An off-wins switch. An operator turns it on for the platform first; then the organisation can.

this platform allows at most … a customer may lower this for itself and never raise it

A lower-only ceiling. Ask an operator to raise the platform value, or set a smaller number.

<key> is set FOR a tenant by a platform operator

An organisation tried to set its own quota or placement grant. Those are operator-only.

A value is set, and nothing changes

Check where it came from with bin/policy tunables (the bracket names the source), and whether the key needs a service restart: the Scope column says which one.

What it does not do yet

No workspace-level keys. Settings stop at the member. A single workspace cannot be given its own value.
No history view. Every change is written to the policy audit stream with its before and after, but there is no diff screen; read it with bin/audit-log query --stream policy.
Some switches are ahead of their feature. member_credentials_enabled changes what the console offers and nothing that runs. cloud_hosts_allowed and cloud_hosts_enabled have no shipped feature behind them: workspaces on an organisation's own cloud machines are not built. Keys marked off by default stay off until an admin turns them on.
Some keys record a decision and do not enforce it. ai_in_apps_enabled does not block a request, and catalogue_skills does not hide the catalogue files from an agent that reads the image.
Workspace startup tasks are platform-wide. workspace_startup_tasks has no per-organisation value yet.

Governance docs Every command Egress docs

Generated from the key registry in bin/policy on the main branch, 4 Oct 2026 (orxy V1.7.2.2). Help text is rewritten for reading; the defaults and allowed values are the registry's own.