Modes
Mandatory allowlists intersect. An empty mandatory allowlist means no restriction; it does not clear a lower-level list. If two non-empty allowlists have no common value, that field denies every value. Repository-prefix and CIDR intersections preserve only the narrower overlapping ranges.
Non-zero numeric limits use the smallest value. Egress uses the stricter mode and CIDR intersection. Plan, tool-call, and merge approvals use the stricter level.
trust_repository_agent_config is an AND, so any mandatory false disables it.
Effective policy
The control plane resolves policy when a session is created and again when a run starts. The resolved value is stored asAgentSession.effective_policy, shown read-only on the session detail page, and used for agents, models, templates, repositories, connections, concurrency, hours, builds, egress, approvals, and repository configuration trust.
Editing or deleting a bound profile schedules egress reconciliation for affected factories. Existing sessions keep their stored audit value until their next run, when the effective policy is recomputed.
Bindings
WorkspaceSettings.default_policy_profile_ids applies profiles to every factory in the workspace. Factory.policy_profile_ids adds ordered factory bindings. Automation.limits.policy_profile_id binds one profile to the sessions an automation starts; it is applied last as a mandatory ceiling (egress excluded) and can only tighten the result.
Factory-as-code supports top-level profiles[] and factory.policy_profile_ids. Terraform uses orq_policy_profile and the factory’s policy_profile_ids attribute.