Git remote policy

Included from Basic tier

A git remote policy is one entry of the git identity authorisation allow list — {scope, remote, rev patterns, principals} — evaluated, deny-all by default, at every door where a git identity is used: change create, a workflow's change-step reach, the git-rev refresh retry, and template-version create/sync. Entries are created or replaced whole (replacing a seeded entry clears its reviewed-at-upgrade marker), deleting one returns its remotes to deny-all, and a global allow-all switch exists for the global security administrator. Served by the v2 GitRemotePolicyService (ListGitRemotePolicies, GetGitRemotePolicy, PutGitRemotePolicy, DeleteGitRemotePolicy, GetGitRemotePolicyMode, SetGitRemotePolicyMode); every write is audited and enforcement follows within a request.

GitRemotePolicy

GitRemotePolicy is one allow-list entry.

Field	Type	Meaning
created_at	timestamp	When the record was created.
default_identity	boolean	Marks the remote as the explicit git-identity default for its scope (defaults are policy-entry properties).
description	string	Free-text description.
id	string	The record's identity.
principal_groups	array of string	Covered principal groups (the pair of principal_user_ids; both lists empty covers anyone with path rights).
principal_user_ids	array of string	Covered principals; both lists empty covers anyone with path rights.
project_code	string	The scope: a project code, or empty for the global scope.
remote	string	The covered remote's configured name on nodes in scope.
rev_patterns	array of string	Allowed rev globs ('' any sequence, '?' one character); [""] allows every rev.
seeded	boolean	Grandfathered at upgrade; the Security review queue leads with these. Cleared by the first reviewed replace.
updated_at	timestamp	When the record was last updated.

Related pages

• opschain docs resources/git_remote — the remotes the policy covers.
• opschain docs resources/git_credential — the stored identities the doors use.
• opschain docs resources/template — the template-version doors the policy gates.