Publish policy

Every app starts private. A publish policy says who may open one wider than a share with a colleague. Owners set it. It never lets anyone do more than they could before. It only stops people.

A publish policy is an Enterprise feature. It’s included on Business for early customers, for a limited time.

What it covers

A rule can cover each of these acts:

Act	What it stops
publish	Opening an app to everyone in the workspace, and sharing it with everyone at an email domain
share_outside	Sharing an app with someone outside the workspace: an address that isn’t a member’s and isn’t at one of the workspace’s allowed domains, a domain no allowed domain covers, or a group with such people in it. Making someone inside counts too: adding a member who isn’t at an allowed domain, or adding an allowed domain
public_paths	Opening a public path
bypass_tokens	Making a bypass token
agent_credentials	Minting an agent’s credential
ai_clients	Letting an app take AI clients, and connecting one to an app

An act with no rule is open to whoever can do it now, as before. With a rule, the workspace’s owners may always do it. Besides them, the rule names who else may:

• admins
• every member
• members holding one of the custom roles it names, directly or through a group

A custom role is for members, so it never lets an admin: an admin may only when the rule names admins, whatever groups they’re in. Anyone it doesn’t name may not. Someone outside the workspace is never named, so a rule on ai_clients also stops an outside viewer connecting an AI client to an app shared with them.

Whoever is inside the workspace can be shared with freely, so a rule on share_outside also decides who may add a member from outside the allowed domains, or add an allowed domain. People already members when the rule is set stay members, and aren’t listed as breaking it.

A rule is checked after everything else that decides the act. Someone it refuses sees:

error: acme's publish policy doesn't let you share apps with people outside the workspace. A workspace owner can change it.

The database checks the same rules under the API, so a request that got past the API would still be refused.

See the policy

Every member can see the rules, and what they may do under them:

jiayang policy show acme

publish            owners and admins
share-outside      owners only
public-paths       no rule
bypass-tokens      owners, admins and members
agent-credentials  no rule
ai-clients         owners, admins and members

You may not: publish, share-outside.

In the dashboard, it’s the workspace’s Publish policy page.

Set a rule

Owners set rules. Name who besides the owners may, or nobody:

jiayang policy set acme share-outside --admins
jiayang policy set acme publish --admins --roles publisher,it-helpdesk
jiayang policy set acme public-paths

In acme, owners and admins may share apps with people outside the workspace now.

--members lets every member. --roles takes custom role names, separated by commas.

To take a rule off, so anyone who could do it before may again:

jiayang policy clear acme public-paths

What was done before a rule

A rule stops new shares. It doesn’t undo what’s there. Anything made before a rule by someone it doesn’t name is kept and listed, so you can decide.

jiayang policy breaches acme

share-outside      payroll: shared with pat@gmail.com, by bob@acme.com
public-paths       payroll: public path /hooks/stripe, by bob@acme.com

Owners and admins can see the list. An app open to the whole workspace, or taking AI clients, has no maker on record. It’s listed when none of the app’s owners may do that now.

Owners end them all, or one act’s:

jiayang policy end acme
jiayang policy end acme --act share-outside

Or end them as the rule is set:

jiayang policy set acme share-outside --admins --end

Each one ends the way taking it away by hand would. A share is removed, a path closed, a token, credential or AI client revoked, and an app made private or stopped taking AI clients. People lose access on their next request, within 60 seconds in a browser. In the dashboard, each row has an End button, and End all ends the lot.

Some can’t be ended from here:

• A public path closes only from the dashboard in a browser, as every change to public paths does.
• A path with a webhook verifier stays while the workspace is suspended or on hold, since the hold keeps the verifier.
• Someone in a group your identity provider fills over SCIM is taken out there.

On a plan without it

If your workspace moves to a plan without a publish policy, every rule it has keeps refusing what it refused. Owners can loosen a rule or take it off. Adding or tightening one is refused, and the refusal goes in the audit log as plan.limit with publish_policy.

A custom role named in a rule lets its holders do nothing on a plan without custom roles, since a role adds nothing there.

For agents

The MCP server’s publish_policy tool reads the rules, what the signed-in person may do, and, for owners and admins, what breaks them. An agent can’t change a rule or end anything. An owner does, with jiayang policy or the dashboard.

In the audit log

Action	When
publish_policy.set	A rule is set or changed. The entry names who may, and what the rule was before in was.
publish_policy.remove	A rule is taken off.
publish_policy.end	An owner ended what broke the rules. The entry counts what ended. Each share, path, token, credential and connection also has its own entry, as if taken away by hand, with because: publish_policy.
publish_policy.refuse	A rule refused someone. The entry names the act and what they tried: the address, the domain, the group, the paths, or the token’s or agent’s name.

Each is a webhook event too.