# AI policies

> For the complete documentation index, see [llms.txt](https://www.jetbrains.com/help/air/llms.txt).

An AI policy is a set of access settings that controls which [AI tools](ai-policies-configure.html#tools-tab), [agents](ai-agents.html), [MCP servers](air-gov-mcp-servers.html), and [BYOK providers](ai-providers.html) are available to [users](users.html), [groups](groups.html), and [service accounts](service-accounts.html) in your organization.

> **Note:**
> This is a paid feature. For more information, see [Plans and pricing](plans-and-pricing.html).

A policy also defines the [credit limit](ai-policies-configure.html#credit-limit) that applies to the users and service accounts under it.

On the AI policies page in Air Governance, you can create, configure, assign, duplicate, and delete policies.

> **Note:**
> Viewing the page  requires the [View AI settings](roles.html#permissions_view_ai_settings) permission.  Managing AI policies  requires the [Manage AI settings](roles.html#permissions_manage_ai_settings) or [Manage organization](roles.html#permissions_manage_org) permission.

## Default policy

Your organization has a single default policy that applies to all users, groups, and service accounts with [AI access](ai-access.html). The default policy provides the base settings for all [principals](ai-governance.html#principal) and lets you control the availability of AI-powered features at the organization level. Changing one of its settings also changes it for every custom policy that uses that default value. If a custom policy has set its own value for that setting instead, changing the default policy has no effect on it. To make the principals assigned to that custom policy follow the default policy value again, [revert the setting](ai-policies-configure.html#setting-state-indicators) in the custom policy.

The default policy is automatically created for every organization, and all users and service accounts with AI access are automatically assigned to it. You can edit all of its settings, but you cannot delete or duplicate it, or change its principals.

## Custom policies

To apply different settings to specific principals, you need to create custom policies. To change a setting for all principals, edit the [default policy](#default-policy) instead. A custom policy inherits all its settings from the default policy. You customize only the settings you need. For most settings, you override the inherited value with your own. For list settings such as agents and MCP servers, you can also add your own items or disable the ones inherited from the default policy. Your changes apply only to the principals assigned to that custom policy, while the settings you don't change keep following the default policy when it changes. For more details, see [Inherited, overridden, and changed settings](#setting-states).

> **Note:**
> Currently, you cannot specify a different [AI provider](ai-policies-configure.html#general-tab) in a custom policy.

## Inherited, overridden, and changed settings

A custom policy inherits its settings from the default policy, so any changes to the default policy affect the inherited settings in the custom policy. When you set your own value for a setting, it becomes overridden, even if that value matches the current default policy value. An overridden setting no longer follows the default policy: its value doesn't change even if the default policy changes later.

A setting can have unsaved changes. If the current value of the setting differs from the last saved value, it is shown as changed until you save the policy. For details on how these states are shown while you edit a policy, see [Setting state indicators](ai-policies-configure.html#setting-state-indicators).

## Multiple policies assigned to a principal

Users, groups, and service accounts can be assigned to multiple policies: the default policy and one or more custom policies. In this case, the effective settings for the principal are calculated by merging the settings from all assigned policies according to the following rules:

* A custom policy [inherits](#setting-states) the default policy values for settings that are not defined in that custom policy.

* Settings that are defined in a custom policy [override](#setting-states) the default policy values, even if the custom policy value is less restrictive. Only those settings are overridden: all other settings still follow the default policy, unless another assigned custom policy defines them.

* If multiple custom policies define conflicting values for the same setting, the more restrictive value applies, except for the [credit limit](#policy-credit-limits).

* Non-conflicting values from multiple policies are combined into the union of all values.

For agents, the [All available agents](ai-policies-configure.html#agents-tab) toggle is resolved first, according to the rules above: if at least one of the principal's custom policies turns All available agents off, the effective state is off. JetBrains Console then combines the agent lists of all policies where the toggle is off, including the default policy, and skips the lists of the policies where it is on. If an agent is disabled in at least one custom policy, it is not available to principals, even if another policy enables it.

> **Note:**
> The [credit limit](ai-policies-configure.html#credit-limit) is the only setting for which a conflict between custom policies is resolved by the highest value rather than the most restrictive one. For information on the priority of the credit limit in a custom policy over other limits, see [Credit limit sources](ai-credit-limits.html#credit-limit-sources).

The following examples show how effective settings are calculated for a principal assigned to the default policy and one custom policy:

| Use case | Default policy | Custom policy | Effective settings |
| --- | --- | --- | --- |
| Grant access to specific users | Third-party AI providers are disabled. | Third-party AI providers are enabled. | Third-party AI providers are enabled. The custom policy value overrides the default policy value. |
| Extend the default set | Claude Agent is allowed. | Junie is added. | Both Claude Agent and Junie are available. The two policies are combined. |
| Reduce the default set | Claude Agent is allowed. | Claude Agent is explicitly disabled. | Claude Agent is unavailable. The custom policy value overrides the default policy value. |

The following examples show how effective settings are calculated for a principal assigned to the default policy and two custom policies:

| Use case | Default policy | Custom policy A | Custom policy B | Effective settings |
| --- | --- | --- | --- | --- |
| Resolve a conflict between custom policies | Claude Agent is allowed. | Claude Agent is allowed (the inherited state is kept). | Claude Agent is explicitly disabled. | Claude Agent is unavailable for a principal assigned to both A and B. The more restrictive setting wins. |
| Combine settings from custom policies | Claude Agent is allowed. | Junie is added. | Codex is added. | Claude Agent, Junie, and Codex are all available. Non-conflicting settings from all assigned policies are combined. |
| Resolve different All available agents states | All available agents is on. | All available agents is on (the inherited state is kept). | All available agents is off, and the agent list is reduced to Claude Agent only. | Only Claude Agent is available for a principal assigned to both A and B. The toggle resolves to off because policy B turns it off, so only the agents explicitly listed in the policies where the toggle is off are merged. |

## Managing policies

Procedure: Create a new policy

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, make sure your role has the necessary [permissions](roles.html#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. In the upper right corner, click Add policy.

3. In the New policy dialog, specify a policy name and, optionally, a description.

4. Click Add.

5. On the policy page, [configure the policy settings](ai-policies-configure.html) and [assign users, groups, and service accounts](ai-policies-assign.html) to the policy.

6. In the upper right corner, click Save.

The policy is created and listed in the AI policies table.

Procedure: Duplicate a policy

Duplicating a policy creates a separate copy of the source policy's settings. Like any custom policy, the duplicate policy inherits the settings it doesn't define from the default policy.

> **Note:**
> You cannot duplicate the [default policy](#default-policy).

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, make sure your role has the necessary [permissions](roles.html#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. In the table, click ![Ellipsis icon](images/union.svg) next to the target policy, and select Duplicate policy.

If you are on the policy page, click ![Ellipsis icon](images/union.svg) in the upper right corner and select Duplicate policy.

3. In the dialog, specify a new policy name and, optionally, a description.

4. Click Duplicate.

5. On the policy page, [configure the policy settings](ai-policies-configure.html) and [assign users, groups, and service accounts](ai-policies-assign.html) to it, since the principal assignments from the source policy are not copied.

6. In the upper right corner, click Save.

The policy is created and listed in the AI policies table.

Procedure: Delete a policy

> **Warning:**
> Deleting a policy will cause the effective settings to be recalculated. If users, groups, or service accounts have no other policies assigned (besides the default policy), only the default policy settings apply.

> **Note:**
> You cannot delete the [default policy](#default-policy).

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, make sure your role has the necessary [permissions](roles.html#permissions)[permissions](https://www.jetbrains.com/help/air/roles.html#permissions).

2. In the table, click ![Ellipsis icon](images/union.svg) next to the target policy, and select Delete policy.

If you are on the policy page, click ![Ellipsis icon](images/union.svg) in the upper right corner and select Delete policy.

3. In the dialog, specify the policy name to confirm the deletion and click Delete.

A success message appears in the lower right corner once the policy is deleted.