> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Policy profiles

> Reuse recommended defaults and mandatory governance ceilings across agent factories.

Policy profiles let workspace administrators maintain one policy and bind it to several factories. Manage them under **Settings** > **Governance** > **Policy profiles**, then select profiles in a factory's policy settings.

## Modes

| Mode            | Behavior                                                                                                                                     |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| **Recommended** | Fills only fields the factory inline policy has not set. Workspace defaults resolve first, followed by the factory's selected profile order. |
| **Mandatory**   | Applies after inline and recommended values and can only tighten the result. Creating or editing one requires the workspace Admin role.      |

Mandatory allowlists intersect. An empty mandatory allowlist means no restriction; it does not clear a lower-level list. If two non-empty allowlists have no common value, that field denies every value. Repository-prefix and CIDR intersections preserve only the narrower overlapping ranges.

Non-zero numeric limits use the smallest value. Egress uses the stricter mode and CIDR intersection. Plan, tool-call, and merge approvals use the stricter level. `trust_repository_agent_config` is an AND, so any mandatory `false` disables it.

## Effective policy

The control plane resolves policy when a session is created and again when a run starts. The resolved value is stored as `AgentSession.effective_policy`, shown read-only on the session detail page, and used for agents, models, templates, repositories, connections, concurrency, hours, builds, egress, approvals, and repository configuration trust.

Editing or deleting a bound profile schedules egress reconciliation for affected factories. Existing sessions keep their stored audit value until their next run, when the effective policy is recomputed.

## Bindings

`WorkspaceSettings.default_policy_profile_ids` applies profiles to every factory in the workspace. `Factory.policy_profile_ids` adds ordered factory bindings. `Automation.limits.policy_profile_id` binds one profile to the sessions an [automation](/docs/ai-studio/ai-engineering/agent-sessions/automations) starts; it is applied last as a mandatory ceiling (egress excluded) and can only tighten the result.

Factory-as-code supports top-level `profiles[]` and `factory.policy_profile_ids`. Terraform uses `orq_policy_profile` and the factory's `policy_profile_ids` attribute.

## API

| Method and path                                  | Purpose                                              |
| ------------------------------------------------ | ---------------------------------------------------- |
| `POST /v2/policy-profiles`                       | Create a recommended or mandatory profile.           |
| `GET /v2/policy-profiles`                        | List profiles in the current workspace.              |
| `GET /v2/policy-profiles/{policy_profile_id}`    | Read one profile.                                    |
| `PATCH /v2/policy-profiles/{policy_profile_id}`  | Update metadata, mode, or the policy payload.        |
| `DELETE /v2/policy-profiles/{policy_profile_id}` | Delete a profile and reconcile bound factory egress. |