---
page_title: "ona_organization_policies Resource - ona"
subcategory: "Organization"
description: |-
  Singleton Ona organization policy settings for the organization associated with the authenticated provider token. This resource updates the remote policy object in place. Destroying it restores the server-defined policy configuration that existed before Terraform began managing it.
---

# ona_organization_policies (Resource)

Singleton Ona organization policy settings for the organization associated with the authenticated provider token. This resource updates the remote policy object in place. Destroying it restores the server-defined policy configuration that existed before Terraform began managing it.

For product context, see [Organization policies](https://ona.com/docs/ona/organizations/policies/overview).

The provider resolves the organization from its authenticated token. Configure at most one `ona_organization_policies` resource for that organization, and combine the policy arguments you need in that resource.

Set `agent_policy.codex_model_states` with exact Codex model enum names and `allowed` or `disabled` values. Models omitted from the map, including models added later, are allowed. Omit `codex_model_states` to leave the remote model policy unmanaged, or set it to `{}` to clear all model overrides.

Deleting the Terraform resource reapplies the server-defined policy configuration captured before Terraform first managed the organization. Terraform removes the resource from state only after Ona accepts that reset.

## Example Usage

```terraform
resource "ona_organization_policies" "current" {
  members_require_projects           = true
  members_create_projects            = false
  port_sharing_disabled              = true
  maximum_environment_timeout        = "30m"
  delete_archived_environments_after = "168h"
  agent_policy = {
    mcp_disabled                  = false
    scm_tools_disabled            = false
    command_deny_list             = ["git push --force"]
    conversation_sharing_policy   = "organization"
    max_subagents_per_environment = 5
    allowed_agent_ids             = []
    codex_model_states = {
      CODEX_OPEN_AI_MODEL_GPT_5_5     = "disabled"
      CODEX_OPEN_AI_MODEL_GPT_5_6_SOL = "allowed"
    }
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Optional

- `agent_policy` (Attributes) Agent-specific organization policy settings. Omit the block to leave agent policy fields unmanaged. (see [below for nested schema](#nestedatt--agent_policy))
- `allow_local_runners` (Boolean) Whether local runners are allowed. The Ona API rejects enabling local runners through organization policies.
- `allowed_editor_ids` (Set of String) Editor IDs allowed in the organization. The current Ona API cannot clear this field through Terraform; omit it to leave it unmanaged.
- `archive_environments_after` (String) How long stopped environments remain inactive before archival. Must be a whole number of days between 24h and 720h. Use Go duration strings such as `30m`, `24h`, or `0s`.
- `default_editor_id` (String) Default editor ID.
- `default_environment_image` (String) Default container image when no repository image is defined.
- `delete_archived_environments_after` (String) How long archived environments are kept before automatic deletion. `0s` disables automatic deletion; maximum is 672h. Use Go duration strings such as `30m`, `24h`, or `0s`.
- `disable_from_scratch` (Boolean) Whether non-admin users can create blank environments without a Git or URL initializer. Omit to leave the remote setting unmanaged.
- `editor_version_restriction` (Attributes List) Editor version restrictions keyed by editor ID. Omit to leave editor version restrictions unmanaged. (see [below for nested schema](#nestedatt--editor_version_restriction))
- `maximum_environment_lifetime` (String) How long environments may be reused. `0s` means no maximum; maximum is 4320h. Use Go duration strings such as `30m`, `24h`, or `0s`.
- `maximum_environment_timeout` (String) Maximum timeout allowed for environments. `0s` means no limit; non-zero values must be at least `30m`. Use Go duration strings such as `30m`, `24h`, or `0s`.
- `maximum_environments_per_user` (Number) Maximum total environments per user. Omit to leave the remote setting unmanaged.
- `maximum_running_environments_per_user` (Number) Maximum simultaneously running environments per user. Omit to leave the remote setting unmanaged.
- `members_create_projects` (Boolean) Whether organization members can create projects. Configure together with `members_require_projects`.
- `members_require_projects` (Boolean) Whether non-admin users can only create environments from projects. Configure together with `members_create_projects`.
- `port_sharing_disabled` (Boolean) Whether user-initiated port sharing is disabled. Omit to leave the remote setting unmanaged.
- `require_custom_domain_access` (Boolean) Whether users must access via a configured custom domain. Omit to leave the remote setting unmanaged.
- `restrict_account_creation_to_scim` (Boolean) Whether account creation is restricted to SCIM-provisioned users. Omit to leave the remote setting unmanaged.
- `security_policy_id` (String) Default security policy ID assigned to newly created environments. Set an empty string to clear.
- `web_browser_disabled` (Boolean) Whether users can open the built-in web browser from environment pages. Omit to leave the remote setting unmanaged.

### Read-Only

- `id` (String) Terraform resource ID. This is the authenticated organization ID.

<a id="nestedatt--agent_policy"></a>
### Nested Schema for `agent_policy`

Optional:

- `allowed_agent_ids` (Set of String) Agent IDs users may select. Empty means all agents are allowed.
- `codex_model_states` (Map of String) Codex model availability keyed by the exact `CodexOpenAIModel` enum name. Values must be `allowed` or `disabled`. Omit the map to leave the remote Codex model policy unmanaged; use an empty map to clear all explicit overrides. A missing model key is treated as allowed, and future or unlisted models are allowed by default.
- `command_deny_list` (Set of String) Commands agents are not allowed to execute. Omit to leave the deny list unmanaged.
- `conversation_sharing_policy` (String) Conversation sharing policy. Supported values are `disabled` and `organization`.
- `max_subagents_per_environment` (Number) Maximum non-terminal sub-agents per environment. Valid range is 0-10.
- `mcp_disabled` (Boolean) Whether MCP is disabled for agents.
- `scm_tools_allowed_group_id` (String) Group ID allowed to use SCM tools. Empty means unrestricted.
- `scm_tools_disabled` (Boolean) Whether SCM tools are disabled for agents.


<a id="nestedatt--editor_version_restriction"></a>
### Nested Schema for `editor_version_restriction`

Required:

- `editor_id` (String) Editor ID.

Optional:

- `allowed_versions` (Set of String) Allowed editor versions. Empty means latest.

## Import

Import is supported using the following syntax. Use `current` or the authenticated organization ID as the import ID.

The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:

```shell
#!/usr/bin/env bash

terraform import ona_organization_policies.current current
```