Skip to main content

​
Overview

The Workspace Policies page is the admin configuration surface for workspace-wide rules that apply across Genesis. Use Config → Workspace Policies when you need to block sensitive tool families, configure onboarding behavior, or change the default visibility for new chat threads.

​
Access

This page requires the access_config_panel permission. In most deployments, that means admins or custom roles that have been granted full config-panel access.

​
What admins configure here

  • global tool-family controls for sensitive tools,
  • onboarding flow toggles,
  • required and optional onboarding topics,
  • default thread visibility for new threads.

​
Tool Permissions

The Tool Permissions section manages global tool families that sit above normal role-based access. Genesis Desktop and hosted Try Me always keep high-risk tools enabled, regardless of the saved policy. Genesis Desktop always keeps coding-agent tools disabled. Their controls are locked on this page; attempts to change a forced policy are refused. Role permissions can still deny individual tool calls. See Genesis Agent Security Controls — Global Tool Toggles for how these deployment-level overrides interact with RBAC. When High-Risk Tool Controls are blocked, the page’s warning banner names the blocked tools from the workspace’s current list, including tools added after the page was written. When either control is blocked, the affected tools stay unavailable even if a role would otherwise allow them. Saving either control or Default Thread Visibility writes workspace_policy.updated rows to ADMIN_AUDIT_LOG (target_id is the policy key, such as high_risk_tools_disabled or default_thread_visibility). See RBAC Practical Guide → Admin audit log. High-risk tool state, default roles for new users, and default thread visibility are saved in EXT_SERVICE_CONFIG on the SQLAlchemy metadata database when that database is enabled; otherwise, Genesis uses the legacy database connector. Each read or write makes one metadata-database query in SQLAlchemy metadata mode. This allows these settings to be saved on Postgres-backed deployments, including Databricks Apps. Default roles are configured on Users and Roles.

​
Onboarding

The Onboarding section centralizes workspace-wide onboarding policy.

​
Onboarding Flow Controls

Use these toggles to control the overall onboarding flow:
  • Enable onboarding flow
  • Include admins in onboarding
  • Require existing users to onboard
If a setting is locked by environment configuration, Genesis shows the controlling environment variable name and disables editing for that field.

​
Required Topics and Optional Topics

Admins can edit onboarding topics as key/label pairs:
  • Required Topics must contain at least one saved topic before onboarding configuration can be saved.
  • Optional Topics can be left empty when you do not want suggested follow-up topics.
  • Genesis normalizes topic keys so they remain short, stable identifiers.

​
Workspace Defaults

Use Default Thread Visibility to choose whether new chat threads start as Public or Private.
  • Public threads are visible to all users.
  • Private threads are visible only to the creator.
When no saved visibility setting exists, Genesis uses threads.default_visibility (default: public). If reading a saved setting fails, Genesis uses private rather than risking broader thread visibility.
Default Roles for New Users still live on Users and Roles, inside the Roles tab.

​
Automation surface