Policy

Parameters

Response200 OK

fieldsmap of objectRequired

Request body

agent_branches_untrustedboolean or null

allow_full_buildboolean or null

allowed_kindsarray of strings or null

approval_selfstring or null

default refuse: whether the requester of a job may decide its approval gates; record accepts it and audits each as approval.sod_exception. never lets an agent decideOne of refuse, record

artifact_retention_daysinteger or null

budget_hard_limitboolean or null

true refuses new jobs past the cap (budget_exceeded); false only warns

budget_units_per_monthinteger or null

the tenant's own monthly cap in cost units; a platform budget overrides it

budget_warn_at_percentinteger or null

1-100; usage at or past this share of the month's cap warns

cache_hit_max_age_daysinteger or null

the oldest recorded success a task cache lookup may be served from; default 7

cache_quota_bytesinteger or null

cached_failuresboolean or null

default true: a key that failed cleanly twice and never passed is answered failed at submit, and a clean red answers its waiting twins; --no-cache always runs

cancel_in_progressboolean or null

default false: a submit cancels the submitter's older job of the same branch, kind and targets

dedup_window_secsinteger or null

0-86400, default 600: how long a succeeded job answers an identical tree submission

default_kindstring or null

egress_allowlistarray of strings or null

egress_modestring or null

fair_share_weightinteger or null

1-1000, default 1: the repository's share of the fleet, against the running slots that order the queue; a repo row's wins over the tenant row's

hard_jobs_per_dayinteger or null

hard_jobs_per_sessioninteger or null

hard_units_per_dayinteger or null

hard_units_per_sessioninteger or null

id_token_unprotectedboolean or null

default false: an id token reaches only a trusted_ci job on a protected ref; true lets a person's or their agent's job and protected-branch ci off those refs have one too, which says ref_protected: false

job_retention_daysinteger or null

log_retention_daysinteger or null

max_artifact_bytesinteger or null

max_blob_bytesinteger or null

max_concurrent_per_actorinteger or null

per principal and actor; unset, the tenant's cap (the runaway guard is per session: half the tenant's cap, at least 4, derived only). 0 clears an override

max_concurrent_per_tenantinteger or null

unset, derived from the fleet: twice the factories' reported ceilings in slots, plus the online slots no factory reports, plus 4, and at least 32. 0 clears an override

max_detached_auditsinteger or null

default 4: the audit jobs an organisation may have queued or running; a sampled audit of a trusted job's submit hit answers the task at once and runs as its own job. beyond it the hit is served without its audit; 0 keeps every audit inline in the job

max_escalated_cost_unitsinteger or null

max_inline_blob_bytesinteger or null

max_job_timeout_secsinteger or null

max_log_bytesinteger or null

max_task_cpusinteger or null

max_task_memoryinteger or null

the most memory and cpus one task may request; a manifest over either is 422 resources_exceed_policy, a learned default is clamped to it

max_task_timeout_secsinteger or null

max_tree_bytesinteger or null

max_tree_entriesinteger or null

max_units_per_jobinteger or null

secret_scopesmap of object or null

the tenant row only: who receives each pass_env secret, by name; a name mapped to null goes back to the default (trusted_ci on the policy's trusted_ci_refs), every other name is kept

soft_units_per_dayinteger or null

soft_units_per_sessioninteger or null

static_workers_min_truststring or null

tiers, with no order on purpose (amendment 2026-10-27): trusted_ci is protected-branch automation and the cache writer every tier reads, trusted_interactive a person's own work, and neither is "below" the other, so every rule over tiers names the tiers it meansOne of untrusted, trusted_ci, trusted_interactive

trees_requests_per_minuteinteger or null

trusted_ci_refsarray of strings or null

untrusted_principalsarray of strings or null

untrusted_refsarray of strings or null

warm_workspacesboolean or null

Response200 OK

fieldsmap of objectRequired