Assign and enforce a network policy

Assign a policy to a scope

Go to Workspace settings > Network policy for the scope you manage.

Select the policy you want to apply from the list of available policies.

To lock the policy in for this scope and everything nested beneath it, turn on Enforce network policy. When enforcement is on:

The policy applies to all current and future workspaces in the scope.
Nested scopes, and their workspaces, inherit the policy and cannot replace it.

Save your changes.

If you do not enforce the policy, lower scopes and individual workspaces can still choose a different policy. Enforcement is what guarantees consistent behavior across an organization or project.

Select a policy for a workspace

A project owner or security officer can set the network policy for an individual workspace when creating or editing the workspace. If a parent scope enforces a policy, that policy is inherited and the selection is locked.

In the workspace creation or edit flow, open Security settings.

Under Network security, choose a policy. By default a workspace starts with No policy selected.

Select View summary to review exactly what the policy allows or blocks before you apply it.

Save the workspace.

Note:

This requires the Security permission set to Manage. Developers cannot change a workspace’s policy. When a developer creates a personal workspace, its policies are applied automatically from the project and platform settings: required policies are enforced, and other configured policies are applied.

Test a policy

Before you rely on a policy, test it to confirm it allows what you expect and blocks what you do not.

Open the policy in Workspace settings > Network policy.

Select Test policy.

In the test dialog, provide the destinations you want to check.

Review the result to confirm whether each destination is allowed or blocked under the policy.

Testing is especially useful for restrict and inspect policies, where an incomplete allow list can break tooling inside the workspace.

Review the network policy overview

To audit your configuration across the whole deployment, go to Platform settings > Security settings > Network policy overview.

The overview shows, for the platform and each organization:

The applied policy at that scope.

The status, either Enforced or Not enforced.

Select Download report to export the overview for record-keeping or review.

Assign a policy to a scope

Select a policy for a workspace

Test a policy

Review the network policy overview

Related information

In this article