> ## Documentation Index
> Fetch the complete documentation index at: https://docs.genesiscomputing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace Policies

> Manage workspace-wide tool permissions, onboarding behavior, and default visibility policies.

## Overview

The **Workspace Policies** page is the admin configuration surface for
workspace-wide rules that apply across Genesis. Use **Config → Workspace
Policies** when you need to block sensitive tool families, configure
onboarding behavior, or change the default visibility for new chat threads.

## Access

This page requires the `access_config_panel` permission. In most deployments,
that means admins or custom roles that have been granted full config-panel
access.

## What admins configure here

* global tool-family controls for sensitive tools,
* onboarding flow toggles,
* required and optional onboarding topics,
* default thread visibility for new threads.

## Tool Permissions

The **Tool Permissions** section manages global tool families that sit above
normal role-based access.

| Control | What it does |
| - | - |
| **High-Risk Tool Controls** | Globally allow or block the current high-risk tool family for all users and agents. The page shows the exact tool list returned by the workspace, along with whether the family is currently blocked or allowed. Genesis persists the last saved High-Risk Tool Controls state across restarts. |
| **Coding Agent Controls** | Globally allow or block delegated coding tools such as `Claude Code`, `Codex`, and `Cortex Code` for all users and agents. |

Genesis Desktop and hosted **Try Me** always keep high-risk tools enabled,
regardless of the saved policy. Genesis Desktop always keeps coding-agent tools
disabled. Their controls are locked on this page; attempts to change a forced
policy are refused. Role permissions can still deny individual tool calls. See
[Genesis Agent Security Controls — Global Tool Toggles](/docs/Security-Controls/Genesis-Agent-Security-Controls#layer-3-global-tool-toggles-system-level-override)
for how these deployment-level overrides interact with RBAC.

When High-Risk Tool Controls are blocked, the page's warning banner names the
blocked tools from the workspace's current list, including tools added after the
page was written.

When either control is blocked, the affected tools stay unavailable even if a
role would otherwise allow them.

Saving either control or **Default Thread Visibility** writes
`workspace_policy.updated` rows to `ADMIN_AUDIT_LOG` (`target_id` is the
policy key, such as `high_risk_tools_disabled` or `default_thread_visibility`).
See [RBAC Practical Guide → Admin audit log](/docs/Security-Controls/RBAC-Practical-Guide#admin-audit-log).

High-risk tool state, default roles for new users, and default thread
visibility are saved in `EXT_SERVICE_CONFIG` on the SQLAlchemy metadata
database when that database is enabled; otherwise, Genesis uses the legacy
database connector. Each read or write makes one metadata-database query in
SQLAlchemy metadata mode. This allows these settings to be saved on
Postgres-backed deployments, including Databricks Apps. Default roles are
configured on [Users and Roles](/docs/Setup/Users-And-Roles).

## Onboarding

The **Onboarding** section centralizes workspace-wide onboarding policy.

### Onboarding Flow Controls

Use these toggles to control the overall onboarding flow:

* `Enable onboarding flow`
* `Include admins in onboarding`
* `Require existing users to onboard`

If a setting is locked by environment configuration, Genesis shows the
controlling environment variable name and disables editing for that field.

### Required Topics and Optional Topics

Admins can edit onboarding topics as key/label pairs:

* **Required Topics** must contain at least one saved topic before onboarding
  configuration can be saved.
* **Optional Topics** can be left empty when you do not want suggested
  follow-up topics.
* Genesis normalizes topic keys so they remain short, stable identifiers.

## Workspace Defaults

Use **Default Thread Visibility** to choose whether new chat threads start as
`Public` or `Private`.

* `Public` threads are visible to all users.
* `Private` threads are visible only to the creator.

When no saved visibility setting exists, Genesis uses
`threads.default_visibility` (default: `public`). If reading a saved setting
fails, Genesis uses `private` rather than risking broader thread visibility.

<Note>
  **Default Roles for New Users** still live on
  [Users and Roles](/docs/Setup/Users-And-Roles), inside the **Roles** tab.
</Note>

## Automation surface

| Endpoint family | Use |
| - | - |
| `/api/rbac/high-risk-tools/...` | Read the current high-risk tool family and toggle whether it is globally blocked. |
| `/api/rbac/coding-agent-tools/...` | Read the current coding-agent tool family and toggle whether it is globally blocked. |
| `/api/rbac/settings/...` | Read and update the default thread-visibility policy. |
| `/api/config/advanced/...` | Read and update onboarding settings and topic lists surfaced on this page. |

## Related pages

* [Users and Roles](/docs/Setup/Users-And-Roles)
* [Advanced Settings](/docs/Setup/Advanced-Settings)
* [Coding Agent Controls](/docs/User-Guide/Coding-Agent-Controls)