Govern policy and limits
Inspect publication policy, identity authorities, quota, and operator-owned retention.
Open Settings for the selected Backend and Environment. Reading this workspace requires backend.read; links to identity authorities appear only when the signed-in human may read them.
Choose Publication, Capacity and retention, or Access and credentials. Publication shows the selected Environment’s effective policy and whether it comes from the Backend default or an override. Choose the Environment or Backend default scope before editing. Required permissions and revision details expand below the controls. Unsaved choices remain intact when refreshed evidence changes; use Use current values to acknowledge the newer baseline, or Reset selection to discard your edit.
Publication policy
Jetrepo shows the Backend default, the selected Environment override, and the effective mode:
- Autonomous adds no extra publication Approval; stronger operation-specific requirements still apply.
- Human approval required waits for an authorized human decision.
- A different person must approve excludes the requester and delegating human from approving publication.
- Use Backend default removes the Environment override.
Changing the Backend default requires operation.execute and backend.update; changing an Environment override requires operation.execute and environment.protect. Review the before/after summary, then choose Request policy change. The request creates an immutable Candidate and starts its governed Operation. Changing publication policy itself requires a different authorized approver by default, even when the current publication mode is Autonomous. Approval requires operation.approve and the same domain permission: backend.update for a Backend default or environment.protect for an override.
Settings keeps the current effective policy visible and shows recent policy requests from the selected Environment. View review request opens the exact Candidate and Operation. The old policy remains effective until the approved Operation succeeds. A failed submission preserves the selected value; Retry policy request reuses its prepared Candidate while the baseline is unchanged. Existing Candidates retain sealed policy evidence and fail if the applicable policy changes. Environment protection and publication Approval are separate controls.
Automatic approvals
An operator may enable Automatic approvals for a specific Backend. It is off by default and is separate from the Autonomous publication mode. When enabled, authorized Backend-scoped Operations execute without a human Approval decision, including definitions that normally require a different approver and Delivery-key creation restricted to that Backend. It does not grant permissions, change identity-class restrictions, approve Organization-wide keys, publish unrequested content, or skip Candidate, quota, recovery, or credential checks.
Settings shows the active flag and its operator ownership. Agents cannot enable it through Management MCP. The publication policies remain configured and take effect when the flag is disabled. A changed effective Approval policy requires a new Candidate; an old Approval-waiting Operation is not silently marked approved. See operator configuration.
Identity authorities
Settings links to the existing authorities rather than duplicating them:
- Members and roles requires
ac.read; - Organization keys requires
apiKey.read.
Those pages retain their own create, update, scope, and revocation permissions. Navigation never grants access.
Quota and retention
The page reports used, reserved, maximum, and last-reconciled storage evidence plus per-Backend Environment and Alias limits. It also reports retained-revision/Environment days, failed-Candidate hours, and the Alias rollback window.
Storage and retention values are operator-owned self-hosted configuration. The governance console observes them but does not silently override deployment policy. Operators set storage defaults and retention windows through the documented environment values, while per-Backend Environment and Alias counts come from Backend policy.