Usage policies govern what your organization spends, where work may happen, and which accounts developers may use.
What’s on the page
Tab strip
Budget Limit fields
Spend Limit and Window are set together — they describe one rule. The alert threshold defaults to 80%, and the warning still allows the request through, so a developer gets notice before work stops. The enforcement message takes up to 500 characters.
When more than one budget policy reaches the same developer, one of them applies — the lowest priority number wins, and the rest are ignored. Budgets are never added together, and the stricter one does not automatically win. See Cost Policies.
Budget blocking covers Claude Code, Claude Cowork and Codex. Spend limits cover those three and Cursor.
Repositories Scope
Names the GitHub organization your agents may work in: agents can read code anywhere, but changing files or running git outside it is blocked. The dialog is Create Repository Policy.
A policy opens at
/policies/repository-scope/[id], listing the incidents against it with a search on repository, user, tool or trace ID and a date range. With none it reads No Incidents Yet.
Account Access
Decides which vendor account a developer may be signed into when they run a coding agent. In the Create Account Access Policy dialog, each tool — Claude Code, Codex and Cursor — is restricted on its own: switch one on, then fill in the lists you want. Security Policies has the full rules.
An empty list places no restriction on its axis, so a tool switched on with nothing filled in accepts every account, and a policy with no tool switched on (No tools restricted) refuses nobody. Cowork has no switch of its own and uses the Claude Code lists.
The policy’s own page shows Blocked attempt insights — Blocked by AI Tool and Blocked by Reason — with a search on email, domain, organization ID or trace ID.