AI policies

Default policy

Every organization has a default policy that applies to all users, groups, and service accounts with AI access. The default policy provides the base settings for all principals and lets you control the availability of AI-powered features at the organization level. Changing one of its settings also changes it for every custom policy that uses that default value. If a custom policy has set its own value for that setting instead, changing the default policy has no effect on it.

The default policy is automatically created for every organization, and all users and service accounts with AI access are automatically assigned to it. You can edit all of its settings, but you cannot delete or duplicate it, or change its principals.

Custom policies

To apply different settings to specific principals, you need to create custom policies. A custom policy inherits all its settings from the default policy. You customize only the settings you need. For most settings, you override the inherited value with your own. For list settings such as agents, you can also add your own items or disable the ones inherited from the default policy. Your changes apply only to the principals assigned to that custom policy, while the settings you don't change keep following the default policy when it changes. For more details, see Inherited, overridden and changed settings.

Inherited, overridden and changed settings

A custom policy inherits its settings from the default policy, so any changes to the default policy affect the inherited settings in the custom policy. When you set your own value for a setting, it becomes overridden, even if that value matches the current default policy value. An overridden setting no longer follows the default policy: its value doesn't change even if the default policy changes later.

A setting can have unsaved changes. If the current value of the setting differs from the last saved value, it is shown as changed until you save the policy. For details on how these states are shown while you edit a policy, see Setting state indicators.

Multiple policies assigned to a principal

Users, groups, and service accounts can be assigned to multiple policies: the default policy and one or multiple custom policies. In this case, the effective settings for the principal are calculated by merging the settings from all assigned policies according to the following rules:

• A setting that a custom policy doesn't define is inherited from the default policy.

• When a custom policy defines a setting differently from the default policy, and they contradict, the custom policy's value takes precedence. It overrides the default policy value for principals assigned to that custom policy.

• When multiple custom policies define conflicting values for the same setting, the restrictive value applies. A disabled item or toggle stays unavailable even if another assigned policy enables it.

• When the settings from multiple policies don't conflict, the settings are combined into the union of all values.

For agents, the All available agents toggle is resolved first, and the restrictive state wins: if at least one of the principal's assigned policies has All available agents turned off, the effective state is off. The effective set of agents is then merged only from the agents explicitly listed in the policies where All available agents is off, according to the rules above.

The following examples show how effective settings are calculated for a principal assigned to the default policy and one custom policy:

The following examples show how effective settings are calculated for a principal assigned to the default policy and two custom policies:

Managing policies