Skip to main content

Protection rulesets

Enterprise Edition

Protection Rulesets are an Enterprise Edition feature.

Protection rulesets allow workspace admins to enforce governance policies that control how changes can be made within a workspace. These rules help maintain code quality, enforce review processes, and prevent accidental modifications in production environments.

Available rules​

Disable direct deployment​

When enabled, this rule prevents users from directly deploying scripts, flows, or apps to the workspace. Instead, users must:

This rule is particularly useful for production workspaces where all changes should go through a review process before being deployed.

Disable workspace forking​

When enabled, this rule prevents users from creating workspace forks of the current workspace.

Restrict public app access​

When enabled, only workspace admins and bypass users can make an app publicly accessible without login (anonymous execution mode). Apps that are already public can still be redeployed.

Restrict guest app access​

When enabled, only workspace admins and bypass users can open an app to guests, that is anyone who signs in through the identity provider, with no workspace membership and no seat. Apps that already admit guests can still be redeployed.

Restrict public run sharing​

When enabled, only workspace admins and bypass users can copy a public link to a run, which is readable by anyone without logging in. The read-only link for workspace members stays available to everyone. Public links minted before the rule was enabled keep working, so enable it before handing out links you may want to keep private.

Creating a protection ruleset​

  1. Navigate to Workspace Settings > Protection Rulesets
  2. Click Add Rule to create a new protection rule
  3. Select the rules to enable
  4. Optionally configure bypass permissions for specific users or groups
  5. Save the rule

Rulset creation page

The rule can take up to 60s to activate.

Bypass permissions​

Each protection rule can be configured with bypass permissions, allowing specific users or groups to override the rule when necessary.

Users with bypass permissions will see a checkbox to bypass the rule. Once checked, the disabled actions become available. When using the CLI or API endpoints directly, bypassers will be able to perform the actions as if no rule was in place.

Use cases​

Production Environment Protection

Enable "Disable Direct Deployment" on production workspaces to ensure all changes go through proper review and testing before deployment. Combined with Git Sync, this creates a robust CI/CD pipeline.

Controlled Development Workflow

Use "Disable Workspace Forking" when you want developers to work exclusively through Git branches rather than workspace forks. This keeps all development activity tracked in your version control system.

Compliance Requirements

Protection rulesets help meet compliance requirements that mandate separation of duties or change approval processes. The bypass permissions feature allows you to document and control exceptions.

Locking a prod workspace paired with a dev workspace

When you pair a dev workspace with a prod workspace, the lock options reuse these rules under a reserved rule named dev_workspace_lock. "Block direct edits" applies "Disable direct deployment" and "Prevent forking" applies "Disable workspace forking". The rule is added on pairing and removed when the dev workspace is detached, deleted, or archived.