> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Baseline

> A pre-written Terraform configuration for a locked-down Orq.ai workspace: model enforcement, workspace-wide PII redaction, secret detection, and a hard monthly budget.

A copy-paste starting point for an **Orq.ai** workspace with the strictest controls enabled from day one. One apply produces:

* **Model enforcement**: only explicitly enabled models can be called.
* **A single model enabled**, shared with a single project. Nothing is shared workspace-wide. Terraform manages only what it declares: models enabled before this apply stay enabled, so start from a clean workspace when full exclusivity matters.
* **Workspace-wide PII redaction** that fails closed: when the detector cannot run, the request is blocked rather than passed through.
* **Secret detection** as a blocking guardrail on both input and output. The built-in detector needs no configuration; see [Guardrail Rules](/docs/ai-gateway/configuration/guardrail-rules) for how the built-ins behave. Output blocking applies to non-streamed responses: a streamed response has already reached the caller by the time the verdict lands.
* **A hard monthly budget** with email alerts at 50% and 80% of the ceiling.
* **A restricted, expiring API key** scoped to the single project, granted only what it needs.

Applying requires a [Management Key](/docs/ai-studio/organization/management-keys) created with the `ALL` permission mode.

## Configuration

```hcl main.tf theme={"theme":{"light":"github-light","dark":"github-dark"}}
terraform {
  required_providers {
    orq = {
      source  = "orq-ai/orq"
      version = "~> 0.2"
    }
  }
}

provider "orq" {}

# Workspace posture

# Singleton: adopts the existing workspace settings. Declare exactly once.
resource "orq_workspace_settings" "this" {
  display_name           = "Acme Production"
  enforce_enabled_models = true # only enabled models are callable

  # Workspace default PII redaction. `on_failure = "block"` fails closed:
  # if the detector is unavailable, the request is rejected.
  pii_redaction = {
    enabled = true
    config = {
      language   = "en"
      entities   = [] # empty list: redact every entity type the detector finds
      on_failure = "block"
      threshold  = 0.5
    }
  }
}

# One project, one model

resource "orq_project" "production" {
  name        = "Production"
  description = "The only project with model access"
}

# Enable a single model and share it with the one project. No workspace-wide
# sharing, no forking, no version pinning.
resource "orq_workspace_model" "gpt4o_mini" {
  model_id = "openai/gpt-4o-mini"
  sharing = {
    project_ids       = [orq_project.production.id]
    allow_fork        = false
    allow_version_pin = false
  }
}

# Guardrails

# Block any request or response carrying credentials or API keys.
resource "orq_guardrail_rule" "secrets" {
  display_name = "Secret detection"
  description  = "Blocks requests and responses containing secrets"
  enabled      = true

  guardrails {
    id           = "orq_secret_detection"
    execute_on   = "both"
    sample_rate  = 1
    is_guardrail = true # enforce: block on detection, do not just observe
  }
}

# Cost controls

resource "orq_notifier" "security_alerts" {
  display_name = "Platform alerts"
  type         = "EMAIL"
  emails       = ["platform-team@example.com"]
}

# Hard workspace-wide spend ceiling. Budget amounts are in USD.
resource "orq_budget" "workspace_monthly" {
  scope = {
    kind = "WORKSPACE" # no target: applies to the whole workspace
  }

  limits = {
    period = "MONTHLY"
    amount = 20 # USD spend ceiling
  }

  is_active = true

  # Early warning at half the ceiling, escalation at 80%. Each alert fires
  # once per period when consumption crosses its threshold.
  alerts {
    threshold_percent = 50
    notifier_ids      = [orq_notifier.security_alerts.id]
  }

  alerts {
    threshold_percent = 80
    notifier_ids      = [orq_notifier.security_alerts.id]
  }
}

# Credentials

# A restricted key for the one workload: scoped to the single project, granted
# only chat completions, with a bounded lifetime. Set the expiry to fit the
# credential policy; the key stops authenticating past it.
resource "orq_api_key" "backend" {
  name            = "production-backend"
  project_id      = orq_project.production.id
  permission_mode = "PERMISSION_MODE_RESTRICTED"

  access = {
    chat_completions = "ACCESS_LEVEL_WRITE"
  }

  expires_at = "2027-01-01T00:00:00Z"
}

output "backend_api_key" {
  value     = orq_api_key.backend.token
  sensitive = true
}
```

## What each control gives

| Control                                           | Effect                                                                                                                                                    |
| ------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enforce_enabled_models`                          | Requests naming a model that is not explicitly enabled are rejected, so a stray model reference cannot route traffic to an unvetted provider.             |
| `pii_redaction` with `on_failure = "block"`       | Requests on supported endpoints are scrubbed of detected PII before reaching a model provider, and detector outages fail closed instead of leaking.       |
| `orq_secret_detection` with `is_guardrail = true` | Credentials pasted into prompts block the request before it is forwarded; credentials in non-streamed responses block the response before it is returned. |
| Workspace `MONTHLY` budget                        | A hard ceiling on spend, with email signals at 50% and 80% before it is reached.                                                                          |
| Restricted expiring key                           | The workload holds the minimum grant, and the credential has a bounded lifetime: issuing a replacement is an explicit, auditable act.                     |

## Beyond Terraform

**Audit Logs** complete the enterprise posture but are an organization-level feature configured outside Terraform: see [Audit Logs](/docs/ai-studio/organization/audit-logs) for enabling and exporting them.

For stricter variants, the [full provider reference](https://registry.terraform.io/providers/orq-ai/orq/latest/docs) covers per-entity budgets (`IDENTITY`, `API_KEY`, `MODEL` scopes), CEL-matched budgets, PII entity allowlists per language, and custom evaluator-backed guardrails.