Control what your teams' agents and members can use.
What it governs
A usage policy decides which outside resources a team may consume, per category:
| Category | Covers |
|---|---|
| apps | Running apps published by other teams or the public grid |
| knowledge | Reading knowledge and skills published outside the team |
| mcps | Connecting to and calling MCP servers |
| agents | Chatting with and invoking agents |
| flows | Running flows |
A team's own work is never blocked — the policy draws the line at the team boundary, not inside it.
Reach
Each category gets a reach, a ladder of how far outside the team its usage may go:
| Reach | Meaning |
|---|---|
| public | Anything visible: the open grid, public publishers |
| organization | Only resources from teams in the same organization |
| team | Only the team's own resources |
On top of the reach, an allow list opens specific exceptions below it and a block list closes specific ones above it. Entries pin a specific resource or a publisher (every resource from that team) — they are stored by identity, not by name, so renames and namespace changes can't dodge them.
Who sets it
- Organization policy — set by org admins under settings → organization → usage policy; it governs every team in the org, and teams cannot widen it.
- Team policy — for standalone teams, set by the team owner under settings → team → usage policy.
A team page inside an org shows where the policy comes from and points admins to the org editor.
When something is blocked
The person hits a clear refusal naming the policy, and the attempt lands in the policy editor's blocked attempts feed — grouped by resource, most-hit first. An admin can allow any entry from the feed in one click, so real demand surfaces exactly where the decision is made.
Enforcement
The policy is enforced in the permission layer of the API — the same gate every surface goes through: running apps, reading knowledge, MCP tool calls, agent messages, and flow runs. There is no client-side path around it, and denials are written to the audit log.