> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/configuration/configuration-manager.md).

# Manager Policies

Security Program Management has several control surfaces. Choose the one matching the decision you need to make; a free-text preference is not equivalent to disabling an action type.

| Control                         | Purpose                                                                                                                                                       | API                                       |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| Program policy                  | Autonomy tier, goal coverage, concurrent campaign limits, weekly capacity, announcement window, and review cadence.                                           | `GET`/`PATCH /manager/program`            |
| Tenant action toggles           | Disable PR creation/closure/comments, ticket creation/closure/comments, channel messages, direct messages, or reviewer-candidate selection.                   | `/manager/groundrules`                    |
| Agent action settings           | Block supported action types and set tenant-wide ways-of-working text.                                                                                        | `GET`/`PUT /admin/manager/settings`       |
| Team ground rules               | Team-specific preferences combined with tenant context at runtime.                                                                                            | Team configuration through the Admin API. |
| Escalation policy               | Configure escalation behavior.                                                                                                                                | `GET`/`PUT /manager/escalations/config`   |
| Automatic threat investigations | Assess new shared threats against your environment without a manual request; off by default. See [Threat Intelligence](/capabilities/threat-intelligence.md). | **Settings → Threat Investigations**      |

Ground-rules text is limited to **10,000 characters**. Write concrete instructions about ownership, communication, review, and change-management expectations. Structured blocked action types and toggles should be used for actions that must be disabled.

These controls govern Manager's downstream actions. They do not provide a general “disable triage” switch: detection and triage run upstream. Review [PR Configuration](/configuration/configuration-pull-requests.md) and service settings separately.

Older dashboards expose **Configure → Manager**. The current dashboard does not reproduce every legacy settings screen; use the documented API for controls absent from your tenant's UI. The operator CLI also has Manager ground-rules and agent-settings commands, but it is a separate distribution from the [public CLI](/cli/cli.md).

See the [Manager API](/api-reference/api-reference/manager.md) for request shapes and proposal decisions. Editing a proposed strategy or campaign is not the same as approving it to run.