Agent Sessions is in private preview. The feature is enabled per workspace by the Orq.ai team and the API is not part of the public SDKs yet. Behavior and field names can still change.
Modes
Mandatory allowlists intersect. An empty mandatory allowlist means no restriction; it does not clear a lower-level list. If two non-empty allowlists have no common value, that field denies every value. Repository-prefix and CIDR intersections preserve only the narrower overlapping ranges.
Non-zero numeric limits use the smallest value. Egress uses the stricter mode and CIDR intersection. Plan, tool-call, and merge approvals use the stricter level.
trust_repository_agent_config is an AND, so any mandatory false disables it.
Effective policy
The control plane resolves policy when a session is created and again when a run starts. The resolved value is stored asAgentSession.effective_policy, shown read-only on the session detail page, and used for agents, models, templates, repositories, connections, concurrency, hours, builds, egress, approvals, and repository configuration trust.
Editing or deleting a bound profile schedules egress reconciliation for affected factories. Existing sessions keep their stored audit value until their next run, when the effective policy is recomputed.
Bindings
WorkspaceSettings.default_policy_profile_ids applies profiles to every factory in the workspace. Factory.policy_profile_ids adds ordered factory bindings. Loop.limits.policy_profile_id binds one profile to the sessions a loop starts; it is applied last as a mandatory ceiling (egress excluded) and can only tighten the result.
Factory-as-code supports top-level profiles[] and factory.policy_profile_ids. Terraform uses orq_policy_profile and the factory’s policy_profile_ids attribute.