Manager Policies
Security Program Management has several control surfaces. Choose the one matching the decision you need to make; a free-text preference is not equivalent to disabling an action type.
Program policy
Autonomy tier, goal coverage, concurrent campaign limits, weekly capacity, announcement window, and review cadence.
GET/PATCH /manager/program
Tenant action toggles
Disable PR creation/closure/comments, ticket creation/closure/comments, channel messages, direct messages, or reviewer-candidate selection.
/manager/groundrules
Agent action settings
Block supported action types and set tenant-wide ways-of-working text.
GET/PUT /admin/manager/settings
Team ground rules
Team-specific preferences combined with tenant context at runtime.
Team configuration through the Admin API.
Escalation policy
Configure escalation behavior.
GET/PUT /manager/escalations/config
Automatic threat investigations
Assess new shared threats against your environment without a manual request; off by default. See Threat Intelligence.
Settings → Threat Investigations
Ground-rules text is limited to 10,000 characters. Write concrete instructions about ownership, communication, review, and change-management expectations. Structured blocked action types and toggles should be used for actions that must be disabled.
These controls govern Manager's downstream actions. They do not provide a general “disable triage” switch: detection and triage run upstream. Review PR Configuration and service settings separately.
Older dashboards expose Configure → Manager. The current dashboard does not reproduce every legacy settings screen; use the documented API for controls absent from your tenant's UI. The operator CLI also has Manager ground-rules and agent-settings commands, but it is a separate distribution from the public CLI.
See the Manager API for request shapes and proposal decisions. Editing a proposed strategy or campaign is not the same as approving it to run.
Last updated