---
metadata:
  - name: generator
    content: Diplodoc Platform v5.66.0
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-policies.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/org-policies.md
  - href: https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-policies.md
    type: text/markdown
    title: Markdown version
  - href: https://sourcecraft.dev/portal/docs/en/llms.txt?revision=r21973087
    rel: describedby
title: Setting up organization access policies in SourceCraft
description: 'How to configure an organization''s access policies in SourceCraft using the .sourcecraft/policies.yaml file: restrict repository creation, anonymous access, public visibility, user invitations, and IP-based access.'
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt?revision=r21973087


# Setting up an organization's access policy in SourceCraft

Using an access policy, you can set restrictions for an [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#org) and its resources as code (Configuration as Code). The configuration is stored in the `.sourcecraft/policies.yaml` file on the default branch of a special repository named `.sourcecraft`.

{% note warning %}

Access policies are available only with a [paid subscription](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing.md).

{% endnote %}

## Configuration of .sourcecraft/policies.yaml {#spec}

The example includes all restrictions and specifies a list of allowed networks. Replace the demonstration networks in the `ip_allowlist` with your organization's networks:

```yaml
policies:
  admin_only_repository_creation: true
  anonymous_public_access_disabled: true
  public_visibility_changes_disabled: true
  non_federative_invitations_disabled: true
  ip_allowlist:
    - 192.0.2.0/24
    - 2001:db8::/32
```

The `policies` section contains a [list of allowed networks](#ip-allowlist) and the following logical parameters:

#|
|| **Parameter** | **Restricted if the value is set to `true`** ||
|| `admin_only_repository_creation` | Only [organization administrators](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md#organization-manager-admin) can create repositories. ||
|| `anonymous_public_access_disabled` | Unauthenticated access to the organization's public resources is prohibited both in the browser and when using Git over HTTP(S). ||
|| `public_visibility_changes_disabled` | It is prohibited to set public visibility for the organization, its projects and repositories, including when creating resources. ||
|| `non_federative_invitations_disabled` | Invitations to non-federated users (those without a federation ID) ​​are prohibited, including invitations via email and nickname. For more information, see [SAML-compatible identity federations](https://yandex.cloud/en/docs/organization/concepts/add-federation). ||
|#

To enable the restriction, set the parameter to `true`. To disable, set to `false`. By default, all restrictions are disabled.

{% note info %}

Once enabled, restrictive policies apply only to new resources and actions.

> For example, after enabling the `public_visibility_changes_disabled` policy, previously created public repositories will remain public.
>
> Similarly, after enabling the `non_federative_invitations_disabled` policy, previously added non-federated users are not removed from the organization.

{% endnote %}

### List of allowed networks {#ip-allowlist}

The `policies.ip_allowlist` parameter specifies the list of client networks from which access to the organization's resources is permitted. IPv4 and IPv6 networks in CIDR format are supported. Networks are converted to canonical form; duplicate records are rejected.

{% note warning %}

Before enabling filtering, ensure that the list contains the network from which you are connecting. Organization administrators are not exempt from IP address verification.

{% endnote %}

If the `ip_allowlist` parameter is missing or contains an empty list, IP address filtering is disabled. To disable previously configured filtering, set `ip_allowlist: []` within the `policies` section and save the changes to the default branch.

Specifics of using the list:

* The list is updated after changes pushed to the default branch are processed. In the event of an update error, the previous rules are retained.
* Requests originating from configured internal service networks and specific system background operations are exempt from the check.
* Requests using signed URLs undergo IP address verification, with the exception of [Git LFS](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lfs.md) signed URLs. Using the Git LFS link you have already received, you can get the file from an IP address outside the list of allowed networks. You cannot get a new link from such an address.
* Previously cached public [RAW files](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/raw-content.md#raw) and [repository archives](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/repo-download-archive.md) may remain available until the cache expires; this can take up to five minutes.
* If the organization does not renew its [paid subscription](https://sourcecraft.dev/portal/docs/en/sourcecraft/pricing.md#tariff-differences), access ceases to be restricted.

#### Network restrictions for CI/CD, AI coworkers, and security scanning {#ip-allowlist-ci}

IP address filtering applies to [CI/CD](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md). If worker networks are not included in the allowlist, CI/CD stops working. Along with CI/CD, AI coworkers and [security scanning](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/scanning-switch.md) stop working.

To run CI/CD on [custom workers](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/workers.md#self-hosted-workers), add to the `policies.ip_allowlist` the networks from which these workers access SourceCraft.

To restore CI/CD operations on workers provided by SourceCraft, as well as AI workers and security scanning, add the [public IP address ranges of Yandex Virtual Private Cloud](https://yandex.cloud/en/docs/overview/concepts/public-ips#virtual-private-cloud) to the `policies.ip_allowlist`. SourceCraft workers use addresses from these ranges.

{% note warning %}

These ranges are also used by virtual machines belonging to other Yandex Cloud users. If entire ranges are added, requests from such virtual machines will pass the allowlist check. This weakens the network restriction on access to the organization's resources.

{% endnote %}

To set up an organization's access policy in SourceCraft:
1. [Create the .sourcecraft repository](#prepare).
1. [Configure the access policy](#configure).
1. [Check the configuration](#check).

## Creating the .sourcecraft repository {#prepare}

If the organization does not yet have the `.sourcecraft` repository, [create it](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-config.md#create-repo). To configure policies, you will need access to this repository and the ability to make changes to its default branch.

## Configure the access policy {#configure}

{% list tabs group=instructions %}

- SourceCraft UI {#src}

  1. Open the SourceCraft [home page](https://sourcecraft.dev).
  1. Go to the ![image](../../_assets/console-icons/briefcase.svg) **Organizations** tab and select an organization.
  1. On the organization page, under ![image](../../_assets/console-icons/gear.svg) **Settings**, go to the ![image](../../_assets/console-icons/nut-hex.svg) **Configurations** section.
  1. Click ![image](../../_assets/console-icons/plus.svg) **Blank configuration** on the **Organization policies** card.
  1. Fill in the `.sourcecraft/policies.yaml` file based on the [configuration example](#spec), selecting the appropriate restrictions.
  1. In the top-right corner, click **Commit changes**.
  1. In the window that opens, configure the procedure for changes:
      * In the **Commit message** field, give a comment that will describe the changes you make.
      * Under **Commit branch**, select the default branch.
      * Under **After commit action**, select `Just commit`.
  1. Confirm your changes.

- Command line {#cli}

  1. [Clone](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/repo-clone.md) the `.sourcecraft` repository and navigate to its folder.
  1. Switch to the default branch:

      ```bash
      git switch <default_branch>
      ```

  1. Create a folder and a configuration file:

      ```bash
      mkdir -p .sourcecraft
      nano .sourcecraft/policies.yaml
      ```

  1. Fill in the file based on the [configuration example](#spec), selecting the appropriate restrictions, and save it.
  1. Add the file to the Git index, commit, and push the changes to the default branch:

      ```bash
      git add .sourcecraft/policies.yaml
      git commit -m "Configure organization access policies"
      git push origin <default_branch>
      ```

{% endlist %}

If the changes pass [code review](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/code-review.md), save the configuration in a separate branch and [create a pull request](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/pr-create.md). The policies will be applied after merging into the `.sourcecraft` repository's default branch.

## Checking the configuration {#check}

1. On the organization's page, open **Settings** → **Configurations**.
1. Find the **Organization policies** card and ensure that the **Active** status is displayed. If the configuration contains errors, fix the file and save the changes to the default branch.

To change the policies, [edit](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/code-edit.md) the `.sourcecraft/policies.yaml` file in the `.sourcecraft` repository and save the changes to the default branch.

#### Useful links {#see-also}

* [Changing organization settings in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-edit.md)
* [Setting up approval rules and branch policies at the organization level in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/org-config.md)
* [Setting up custom fields for issues in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/issue-custom-fields.md)
* [Access management in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md)