> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy profiles

> Reuse recommended defaults and mandatory governance ceilings across agent factories.

Beta

> [!NOTE]
>
> **Agent Sessions** is in private preview. The feature is enabled per workspace by the **Orq.ai** team and the API is not part of the public SDKs yet. Behavior and field names can still change.

Policy profiles let workspace administrators maintain one policy and bind it to several factories. Manage them under **Settings** > **Governance** > **Policy profiles**, then select profiles in a factory's policy settings.

## Modes

| Mode | Behavior |
| - | - |
| **Recommended** | Fills only fields the factory inline policy has not set. Workspace defaults resolve first, followed by the factory's selected profile order. |
| **Mandatory** | Applies after inline and recommended values and can only tighten the result. Creating or editing one requires the workspace Admin role. |

Mandatory allowlists intersect. An empty mandatory allowlist means no restriction; it does not clear a lower-level list. If two non-empty allowlists have no common value, that field denies every value. Repository-prefix and CIDR intersections preserve only the narrower overlapping ranges.

Non-zero numeric limits use the smallest value. Egress uses the stricter mode and CIDR intersection. Plan, tool-call, and merge approvals use the stricter level. `trust_repository_agent_config` is an AND, so any mandatory `false` disables it.

## Effective policy

The control plane resolves policy when a session is created and again when a run starts. The resolved value is stored as `AgentSession.effective_policy`, shown read-only on the session detail page, and used for agents, models, templates, repositories, connections, concurrency, hours, builds, egress, approvals, and repository configuration trust.

Editing or deleting a bound profile schedules egress reconciliation for affected factories. Existing sessions keep their stored audit value until their next run, when the effective policy is recomputed.

## Bindings

`WorkspaceSettings.default_policy_profile_ids` applies profiles to every factory in the workspace. `Factory.policy_profile_ids` adds ordered factory bindings. `Loop.limits.policy_profile_id` binds one profile to the sessions a [loop](https://docs.orq.ai/ai-studio/ai-engineering/agent-sessions/loops) starts; it is applied last as a mandatory ceiling (egress excluded) and can only tighten the result.

Factory-as-code supports top-level `profiles[]` and `factory.policy_profile_ids`. Terraform uses `orq_policy_profile` and the factory's `policy_profile_ids` attribute.

## API

| Method and path | Purpose |
| - | - |
| `POST /v2/policy-profiles` | Create a recommended or mandatory profile. |
| `GET /v2/policy-profiles` | List profiles in the current workspace. |
| `GET /v2/policy-profiles/{policy_profile_id}` | Read one profile. |
| `PATCH /v2/policy-profiles/{policy_profile_id}` | Update metadata, mode, or the policy payload. |
| `DELETE /v2/policy-profiles/{policy_profile_id}` | Delete a profile and reconcile bound factory egress. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.