Instance policies
Control signup mode, agent safety posture, workspace creation, auto personal workspace, and forgot-password.
On /settings/instance, instance admins set host-wide policies. Licensed hosts may lock some options based on entitlements. Signed-in members can read the current values; only the instance admin can change them.
| Policy | UI label | Meaning |
|---|---|---|
| Signup mode | Invite only / Open signup / SSO only | Who can create accounts |
| Agent safety posture | Strict / Auto / Dangerous | How tool calls pause for approval, and whether Auto screens tool results |
| Allow create workspace | Allow creating workspaces | Users may create additional workspaces |
| Auto personal workspace | Auto personal workspace | Provision a personal workspace for new users |
| Allow forgot password | Allow forgot password | Self-serve reset (needs SMTP for email) |
Agent safety posture
Default is Auto. This control applies to interactive Agent turns.
| Posture | HITL | Result screening |
|---|---|---|
| Strict | Almost every tool waits for in-chat approval, including reviewed reads and sandbox bash/write | After a tool runs, output is checked before the model sees it |
| Auto | Allowlisted reads run; writes and unknown tools wait | Same result screening as Strict |
| Dangerous | Skips those approval pauses | Skips result screening in live chat |
A command policy still blocks high-risk shell (recursive rm, mkfs, dd to /dev/, fork bombs) and destructive SQL (DROP TABLE, TRUNCATE, Mongo drop tools) in every posture, including Dangerous. Denied calls never become an approve prompt.
Auto and Strict also screen tool results for prompt-injection phrases and secret-like tokens (private keys, GitHub PATs, Slack tokens). A match is replaced with a short blocked stub. That is not an approve prompt, and it cannot undo a tool that already ran. Dangerous live chats skip that screening. Scheduled morning briefs and playbooks still screen (and keep Auto HITL) so they are not left unprotected.
Ask mode still blocks tools. Plan-style mutating-tool limits still apply if that mode is used.
See Approvals.
Signup mode notes
- Invite only (default) — registration via invite links
- Open signup —
/sign-upavailable when license allows - SSO only — password signup closed; company SSO on
/sign-in(requires SSO entitlement)
Self-serve forgot-password also requires SMTP (BRAIN_EMAIL_FROM + BRAIN_SMTP_*). Instance admins can still reset passwords without SMTP.