Enterprise Baseline

A copy-paste starting point for an Orq.ai workspace with the strictest controls enabled from day one. One apply produces:

Model enforcement: only explicitly enabled models can be called.
A single model enabled, shared with a single project. Nothing is shared workspace-wide. Terraform manages only what it declares: models enabled before this apply stay enabled, so start from a clean workspace when full exclusivity matters.
Workspace-wide PII redaction that fails closed: when the detector cannot run, the request is blocked rather than passed through.
Secret detection as a blocking guardrail on both input and output. The built-in detector needs no configuration; see Guardrail Rules for how the built-ins behave. Output blocking applies to non-streamed responses: a streamed response has already reached the caller by the time the verdict lands.
A hard monthly budget with email alerts at 50% and 80% of the ceiling.
A restricted, expiring API key scoped to the single project, granted only what it needs.

Applying requires a Management Key created with the ALL permission mode.

Configuration

main.tf

terraform {
  required_providers {
    orq = {
      source  = "orq-ai/orq"
      version = "~> 0.2"
    }
  }
}

provider "orq" {}

# Workspace posture

# Singleton: adopts the existing workspace settings. Declare exactly once.
resource "orq_workspace_settings" "this" {
  display_name           = "Acme Production"
  enforce_enabled_models = true # only enabled models are callable

  # Workspace default PII redaction. `on_failure = "block"` fails closed:
  # if the detector is unavailable, the request is rejected.
  pii_redaction = {
    enabled = true
    config = {
      language   = "en"
      entities   = [] # empty list: redact every entity type the detector finds
      on_failure = "block"
      threshold  = 0.5
    }
  }
}

# One project, one model

resource "orq_project" "production" {
  name        = "Production"
  description = "The only project with model access"
}

# Enable a single model and share it with the one project. No workspace-wide
# sharing, no forking, no version pinning.
resource "orq_workspace_model" "gpt4o_mini" {
  model_id = "openai/gpt-4o-mini"
  sharing = {
    project_ids       = [orq_project.production.id]
    allow_fork        = false
    allow_version_pin = false
  }
}

# Guardrails

# Block any request or response carrying credentials or API keys.
resource "orq_guardrail_rule" "secrets" {
  display_name = "Secret detection"
  description  = "Blocks requests and responses containing secrets"
  enabled      = true

  guardrails {
    id           = "orq_secret_detection"
    execute_on   = "both"
    sample_rate  = 1
    is_guardrail = true # enforce: block on detection, do not just observe
  }
}

# Cost controls

resource "orq_notifier" "security_alerts" {
  display_name = "Platform alerts"
  type         = "EMAIL"
  emails       = ["platform-team@example.com"]
}

# Hard workspace-wide spend ceiling. Budget amounts are in USD.
resource "orq_budget" "workspace_monthly" {
  scope = {
    kind = "WORKSPACE" # no target: applies to the whole workspace
  }

  limits = {
    period = "MONTHLY"
    amount = 20 # USD spend ceiling
  }

  is_active = true

  # Early warning at half the ceiling, escalation at 80%. Each alert fires
  # once per period when consumption crosses its threshold.
  alerts {
    threshold_percent = 50
    notifier_ids      = [orq_notifier.security_alerts.id]
  }

  alerts {
    threshold_percent = 80
    notifier_ids      = [orq_notifier.security_alerts.id]
  }
}

# Credentials

# A restricted key for the one workload: scoped to the single project, granted
# only chat completions, with a bounded lifetime. Set the expiry to fit the
# credential policy; the key stops authenticating past it.
resource "orq_api_key" "backend" {
  name            = "production-backend"
  project_id      = orq_project.production.id
  permission_mode = "PERMISSION_MODE_RESTRICTED"

  access = {
    chat_completions = "ACCESS_LEVEL_WRITE"
  }

  expires_at = "2027-01-01T00:00:00Z"
}

output "backend_api_key" {
  value     = orq_api_key.backend.token
  sensitive = true
}

What each control gives

Control	Effect
`enforce_enabled_models`	Requests naming a model that is not explicitly enabled are rejected, so a stray model reference cannot route traffic to an unvetted provider.
`pii_redaction` with `on_failure = "block"`	Requests on supported endpoints are scrubbed of detected PII before reaching a model provider, and detector outages fail closed instead of leaking.
`orq_secret_detection` with `is_guardrail = true`	Credentials pasted into prompts block the request before it is forwarded; credentials in non-streamed responses block the response before it is returned.
Workspace `MONTHLY` budget	A hard ceiling on spend, with email signals at 50% and 80% before it is reached.
Restricted expiring key	The workload holds the minimum grant, and the credential has a bounded lifetime: issuing a replacement is an explicit, auditable act.

Beyond Terraform

Audit Logs complete the enterprise posture but are an organization-level feature configured outside Terraform: see Audit Logs for enabling and exporting them. For stricter variants, the full provider reference covers per-entity budgets (IDENTITY, API_KEY, MODEL scopes), CEL-matched budgets, PII entity allowlists per language, and custom evaluator-backed guardrails.

Orq SDK

Terminal & Agents

Terraform

Platform APIs

Management APIs

Configuration

What each control gives

Beyond Terraform

​Configuration

​What each control gives

​Beyond Terraform

Configuration

What each control gives

Beyond Terraform