> ## Documentation Index
> Fetch the complete documentation index at: https://ona.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization policies

> Control resource usage, enforce consistency, and implement security restrictions across your organization.

> [!NOTE]
>
> Most policies require an [Enterprise plan](https://ona.com/pricing). Auto-stop timeout is available on Core and Enterprise.

Go to **Settings → Organization → Policies** to configure. Only administrators can access policies.

**Key behavior:**

* Changes take effect immediately for new actions
* Existing environments are not affected unless the policy governs a scheduled lifecycle action

## Available policies

| Policy | Purpose |
| - | - |
| [Editor restrictions](https://ona.com/docs/ona/organizations/policies/editor-restrictions.md) | Standardize which editors and versions your team can use |
| [Auto-stop timeout](https://ona.com/docs/ona/organizations/policies/environment-timeout.md) | Limit auto-stop timeout options |
| [Environment limits](https://ona.com/docs/ona/organizations/policies/environment-limits.md) | Cap total and concurrent environments per user |
| [Maximum environment lifetime](https://ona.com/docs/ona/organizations/policies/environment-lifetime.md) | Set a maximum age for environments and optionally block restarting expired ones |
| [Archive timing](https://ona.com/docs/ona/organizations/policies/archive-timing.md) | Set when stopped Enterprise environments move to Archived |
| [Environment creation](https://ona.com/docs/ona/organizations/policies/environment-creation.md) | Restrict blank environment creation for members |
| [Project creation](https://ona.com/docs/ona/organizations/policies/project-creation.md) | Restrict project creation to admins; members must use existing projects |
| [Port sharing](https://ona.com/docs/ona/organizations/policies/port-sharing.md) | Control user-initiated port exposure from environments |
| [Web browser](https://ona.com/docs/ona/organizations/policies/web-browser.md) | Control whether members can open the built-in browser from environment pages |
| [Default image](https://ona.com/docs/ona/organizations/policies/default-image.md) | Set default devcontainer image |
| [Auto-delete](https://ona.com/docs/ona/organizations/policies/auto-delete.md) | Set retention period for archived environments |
| [Security agents](https://ona.com/docs/ona/organizations/policies/security-agents.md) | Deploy CrowdStrike Falcon to all environments |
| [Executable deny list](https://ona.com/docs/ona/organizations/policies/executable-deny-list.md) | Block specific executables from running in environments |
| [Command deny list](https://ona.com/docs/ona/command-deny-list.md) | Block specific commands from agent execution |
| [SCM tools](https://ona.com/docs/ona/organizations/policies/scm-tools.md) | Control agents' GitHub and GitLab access |
| [Automation limits](https://ona.com/docs/ona/automations/guardrails.md#organization-policy-limits) | Preview organization limits for selected Enterprise customers |
| [Restrict account creation to SCIM](https://ona.com/docs/ona/organizations/policies/scim-account-restriction.md) | Allow only SCIM-provisioned users to access the organization |

> [!NOTE]
>
> Looking for default environment image settings? See [Default image policy](https://ona.com/docs/ona/organizations/policies/default-image.md).

## Tracking changes

All policy changes are recorded in [audit logs](https://ona.com/docs/ona/audit-logs/overview.md), including who changed what and when.

## Best practices

* **Start gradually**: Begin with moderate limits and adjust based on usage patterns
* **Review regularly**: Check usage patterns quarterly or after team changes
* **Avoid over-restricting**: Use environment creation restrictions before requiring project-based creation for all member environments


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.