# Configuring policies

Policy settings control which [AI tools](#tools-tab), [agents](ai-agents.html), [MCP servers](mcp-servers.html), and [BYOK providers](ai-providers.html) are available to users, groups, and service accounts under the policy. You can configure the policy settings in the corresponding tabs on the policy page.

A custom policy inherits each setting from the default policy until you override or extend it. For details on these states, see [Inherited, overridden and changed settings](ai-policies.html#setting-states). To learn how they appear on this page, see [Setting state indicators](#setting-state-indicators).

> **Note:**
> Viewing policy settings  requires the [View AI settings](roles.html#permissions_view_ai_settings) permission.  Managing AI policies  requires the [Manage AI settings](roles.html#permissions_manage_ai_settings) or [Manage organization](roles.html#permissions_manage_org) permission.

Procedure: Edit a policy

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the tab you want to edit: General, MCP, Agents, or Tools.

4. Make the necessary changes on the selected tab. For all available settings, refer to [Policy settings](#policy-settings).

5. In the upper right corner, click Save.

6. In the dialog, review the summary of changes and click Save to apply them.

A success message appears in the lower right corner once changes are saved. It may take a few minutes for the changes to take effect. The duration depends on the number of users, groups, and service accounts assigned to the policy.

## Setting state indicators

Changes to policy settings are not saved automatically. You need to apply your changes by clicking Save. Until you save, each changed setting is marked with a yellow bar, and the tab shows a yellow dot. If you try to leave the policy page while there are unsaved changes, you are prompted to either Save or Discard changes.

While you edit a custom policy, a colored bar to the left of a setting shows its state:

* No bar: the setting is inherited and saved. The custom policy doesn't define its own value for it, so the setting uses the [default policy](ai-policies.html#default-policy) value and changes automatically when the default policy changes.

* Yellow bar: the setting has an unsaved change. Its current value differs from the last saved value because you either overrode an inherited setting or reverted a saved override. Saving resolves the yellow bar.

* Blue bar: the setting is a saved override. The custom policy defines its own value for it and no longer follows the default policy. So later changes to the default policy don't affect this setting.

A colored dot to the left of a tab name indicates that the tab contains such settings: a yellow dot indicates unsaved changes, a blue dot indicates saved overrides.

To revert a setting to the value inherited from the default policy, hover over the setting and click ![Revert icon](images/ai-assistant-revert-icon.svg) to the left. The hover revert icon applies to toggles and selectors. For [agents](#agents-tab) and [MCP servers](#mcp-tab), you revert an item from its context menu: click ![Ellipsis icon](images/union.svg) in the corresponding row and select Reset.

The icon is shown only if the setting is overridden. The result depends on whether the override was already saved:

* If the override has not yet been saved (the yellow bar is shown), the setting returns to the inherited state immediately (no bar).

* If the override was already saved (the blue bar is shown), reverting sets the value back to the inherited one but counts as a new unsaved change, so the blue bar turns yellow. You must click Save for the setting to become inherited again.

> **Note:**
> Reverting a saved override does not take effect until you save the policy. If you leave the page without saving, the setting stays overridden.

For example, the Cloud tasks setting can go through these states:

1. In a new custom policy, it is inherited from the default policy. No bar is shown.

2. You disable it. The setting now has an unsaved change, and the yellow bar is shown.

3. You click Save. The override is saved, and the blue bar is shown.

4. Later, you click ![Revert icon](images/ai-assistant-revert-icon.svg). The value returns to its inherited enabled state, but the revert has not been saved yet, so the yellow bar is shown.

5. You click Save again. The setting is inherited again, and no bar is shown.

## Policy settings

### General settings

On the General tab, the following settings are available:

| Setting | Description |
| --- | --- |
| Name | Policy name. |
| Description | Optional description that explains the purpose of the policy. |
| Cloud tasks | Determines whether users and service accounts under the policy can use remote environments managed by JetBrains to run AI agent sessions. When enabled, users and service accounts are allowed to use cloud-based AI agents.   Default value: enabled.    |
| AI provider | Specifies the AI provider used for all AI-powered features. The features that don't support the selected provider's models are not available, and [agents](#agents-tab) appear greyed out in the AI tools ([AI Assistant](https://www.jetbrains.com.cn/en-us/help/ai-assistant/about-ai-assistant.html) and [JetBrains Air](https://www.jetbrains.com.cn/en-us/help/air/getting-started.html)).   Default value: JetBrains AI.     > **Note:** > Currently, the AI provider can only be specified in the [default policy](ai-policies.html#default-policy).    |

### MCP servers

> **Note:**
> MCP servers configured at the organization level currently apply only to [AI Assistant](https://www.jetbrains.com.cn/en-us/help/ai-assistant/mcp.html) and [JetBrains Air](https://www.jetbrains.com.cn/en-us/help/air/mcp-servers.html), not to agents used through [Central CLI](https://www.jetbrains.com.cn/en-us/help/central-cli/quickstart.html).

On the MCP tab, you choose which of the [Model Context Protocol (MCP) servers](mcp-servers.html) configured at the organization level you provide to the [principals](ai-governance.html#principal) under the policy: users, groups, and service accounts. A server becomes available to them after you add it to the policy.

> **Tip:**
> Users can also add MCP servers locally in their IDEs and JetBrains Air. The servers they can add locally are not limited to the ones configured at the organization level.

In the [default policy](ai-policies.html#default-policy), only the MCP servers you've added are listed. Every server you add to the default policy becomes available to all principals with [AI access](ai-access.html) in your organization, and every custom policy receives it automatically.

A custom policy starts with all the MCP servers inherited from the default policy. In a custom policy, you can extend this set by adding MCP servers that are not in the default policy, or restrict it by disabling servers inherited from the default policy.

> **Note:**
> The default policy doesn't inherit from anything, so every MCP server listed there was added to it directly. [Removing](#remove-mcp-server) an MCP server from the default policy deletes it from the policy entirely. This server becomes unavailable to any custom policy that inherited it. A custom policy can't remove a server that it inherited from the default policy this way. It can only [disable](#disable-mcp-server) it, because the server still belongs to the default policy.

The MCP servers table shows the following:

* Whether a server is inherited from the default policy or added directly to this policy. An inherited server is marked with the Inherited label.

* Whether an inherited server is enabled or disabled. Only inherited servers can be disabled. A disabled server stays in the table, marked with the Disabled label, but it is not available to the principals under the policy.

* Whether a server is Command or Remote. For details, see [MCP servers](mcp-servers.html).

When a principal is assigned to multiple policies, it gets access to the [combined list of MCP servers](ai-policies.html#multiple-policies) available across its policies.

Procedure: Add an MCP server

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the MCP tab.

4. Click Add MCP server and select a server from the dropdown, which lists the MCP servers configured at the organization level and not yet added to the policy.

The MCP server appears in the table and is enabled for the policy.

Procedure: Disable an MCP server

You can disable only an MCP server inherited from the default policy, so this procedure applies only to custom policies.

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the MCP tab.

4. In the MCP servers table, find the server you want to disable.

5. In the corresponding row, click ![Ellipsis icon](images/union.svg) and select Disable MCP server.

The MCP server is marked with the Disabled label and is no longer available to the principals under the policy. Disabling a server overrides the default policy and takes precedence when the effective settings are calculated. For more details, see [Multiple policies assigned to a principal](ai-policies.html#multiple-policies).

To enable the MCP server, click ![Ellipsis icon](images/union.svg) in the corresponding row and select Enable MCP server. To discard the override and return to the state defined in the default policy, select Reset instead. Reverting follows the [same rules](#setting-state-indicators) as other settings.

Procedure: Remove an MCP server

You can remove only an MCP server added directly to a policy. In the default policy, every server is added directly, so you can remove any of them. In a custom policy, this works only for servers added directly to that policy; to make a server inherited from the default policy unavailable, [disable](#disable-mcp-server) it instead.

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the MCP tab.

4. In the MCP servers table, find the MCP server you want to remove.

5. In the corresponding row, click ![Ellipsis icon](images/union.svg) and select Remove MCP server.

6. In the dialog, click Remove to confirm.

The MCP server is removed from the table and is no longer available to the principals under the policy.

> **Tip:**
> Where you add or disable an MCP server depends on who should have access to it:
>
>
>
> * To make an MCP server available to everyone, add it to the default policy.
>
> * To make an MCP server available only to specific principals, add it to the custom policies assigned to them.
>
> * To make an MCP server unavailable for a specific group while everyone else has it, disable the MCP server in that group's custom policy.

### Agents

On the Agents tab, you can control which [AI agents](ai-agents.html) are available to users, groups, and service accounts under the policy.

The All available agents toggle determines how the set of available agents is managed:

* When All available agents is on, all agents available in your organization at that time are available to principals under the policy. The Agents table shows the full list, and you can't add, disable, or remove individual agents.

* When All available agents is off, only the agents listed in the Agents table are available. You can [add](#add-agent), [disable](#disable-agent), and [remove](#remove-agent) agents. Turning All available agents back on discards the manually managed list and restores the full list of agents.

In the [default policy](ai-policies.html#default-policy), All available agents is on initially, so every principal with [AI access](ai-access.html) in your organization can use all available agents. To limit the default policy to a specific set of agents, turn off All available agents.

A custom policy inherits both the All available agents toggle state and the agent list from the default policy. The toggle behaves the same way as in the default policy: to customize the set of agents for its principals, turn off All available agents, and the inherited list becomes editable. The agents inherited from the default policy are marked with the Inherited label.

> **Warning:**
> Agents added to your organization later are not automatically available to principals under existing policies, even when All available agents is turned on. Such an agent is added to the [organization's agent list](ai-agents.html) on the Agents page, but existing policies retain the agents they already have. To make a new agent available to principals, [add it](#add-agent) to the relevant policies.

> **Note:**
> The default policy doesn't inherit from anything, so every agent listed there was added to it directly. [Removing](#remove-agent) an agent from the default policy deletes it from the policy entirely. This agent becomes unavailable to any custom policy that inherited it. A custom policy can't remove an agent that it inherited from the default policy this way. It can only [disable](#disable-agent) it, because the agent still belongs to the default policy.

When All available agents is off, the Agents table shows the following for each agent:

* Whether the agent is enabled or disabled. A disabled agent stays in the table, marked with the Disabled label, but it is not available to the principals under the policy.

* Whether the agent is inherited from the default policy or added directly to this policy. An inherited agent is marked with the Inherited label.

* Whether the agent is sourced from the global agent registry or added manually at the organization level as a [custom agent](ai-agents.html#custom-agents). A tag in the row shows the source.

When a principal is assigned to multiple policies, it gets access to the [combined list of agents](ai-policies.html#multiple-policies) allowed across its policies. If the assigned policies have different All available agents states, the toggle is resolved to the restrictive state first: it is off if at least one of the policies has it turned off.

Procedure: Add an agent

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the Agents tab.

4. Click Add Agents and, in the dialog, select one or multiple agents from the dropdown, then click Add.

Only [organization's agents](ai-agents.html) that are not yet in the policy can be added. To add all available agents at once, click Add all N agents.

The agents appear in the table and are enabled for the policy.

Procedure: Disable an agent

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the Agents tab.

4. In the Agents table, find the agent you want to disable.

5. In the corresponding row, click ![Ellipsis icon](images/union.svg) and select Disable agent.

The agent is marked with the Disabled label and is no longer available to the principals under the policy. Disabling an inherited agent overrides the default policy and takes precedence when the effective settings are calculated. For more details, see [Multiple policies assigned to a principal](ai-policies.html#multiple-policies).

To enable the agent, click ![Ellipsis icon](images/union.svg) in the corresponding row and select Enable agent. To discard the override on an inherited agent and return to the state defined in the default policy, select Reset instead. Reverting follows the [same rules](#setting-state-indicators) as other settings.

Procedure: Remove an agent

You can remove only an agent added directly to a policy. In the default policy, every agent is added directly, so you can remove any of them. In a custom policy, this works only for agents added directly to that policy; to make an agent inherited from the default policy unavailable, [disable](#disable-agent) it instead. If inherited agents are included in a bulk removal, they are disabled instead.

1. In the sidebar, under AI governance, select Policies.

If you don't see this page, or the controls on this page are inactive, your role doesn't have the necessary [permissions](roles.html#permissions).

2. In the table, click the policy name to open its page. If you are already on the policy page, proceed with the next step.

3. On the policy page, select the Agents tab.

4. In the Agents table, find the agent you want to remove.

5. In the corresponding row, click ![Ellipsis icon](images/union.svg) and select Remove agent.

To remove multiple agents, select them using the checkboxes in the first column and click Remove Agents.

> **Note:**
> If you try to remove an inherited agent, it is marked as Disabled instead of being removed.

6. In the dialog, click Proceed to confirm.

The agents are removed from the table and are no longer available to the principals under the policy.

> **Tip:**
> Where you add or disable an agent depends on who should have access to it:
>
>
>
> * To make an agent available to everyone, add it to the default policy.
>
> * To make an agent available only to specific principals, add it to the custom policies assigned to them.
>
> * To make an agent unavailable for a specific group while everyone else has it, disable the agent in that group's custom policy.

> **Note:**
> Agents that don't support the models of the [provider](#provider) selected on the General tab appear greyed out in the AI tools ([AI Assistant](https://www.jetbrains.com.cn/en-us/help/ai-assistant/about-ai-assistant.html) and [JetBrains Air](https://www.jetbrains.com.cn/en-us/help/air/getting-started.html)).

To control whether users and service accounts can use local agents via the [Agent Client Protocol](https://agentclientprotocol.com/get-started/introduction) (ACP), see the [Tools](#tools-tab) settings.

### Tools

On the Tools tab, you can configure AI tools available to users, groups, and service accounts under the policy.

#### AI Assistant

[AI Assistant](https://www.jetbrains.com.cn/en-us/help/ai-assistant/getting-started-with-ai-assistant.html) is an integrated tool in JetBrains IDEs that enhances software development with AI-powered features.

In the AI Assistant card, you can configure the following settings:

| Setting | Description |
| --- | --- |
| Third-party AI providers |  Determines whether users and service accounts can use a personal API key to connect to locally installed LLMs, bypassing the organization-level AI provider configuration. This enables local Bring Your Own Key (BYOK) connections.  To learn more, refer to the [AI Assistant](https://www.jetbrains.com.cn/en-us/help/ai-assistant/settings-reference-providers-and-api-keys.html#settings-third-party-ai-providers) documentation.   Default value: enabled.    |
| Custom ACP agents | Determines whether users and service accounts can use their own local agents via the Agent Client Protocol (ACP), beyond those configured at the organization level. This is separate from agents configured for the policy on the [Agents](#agents-tab) tab.   Default value: enabled.    |