Business: Policy
Overview · Setup Organization · People · Policy · Workspace · Share Guard · Activity
Org-wide defaults every enrolled browser gets. Edit, then Apply policy. Load defaults resets the form to stock values. Discard changes reloads the last published policy. Per-person overrides are on People → View, not here.
The form is built from the live policy schema. Left nav on the Policy tab jumps section to section. Sections below match the product labels.
| Organization Profile | Org name (blank uses the registered business name), Support contact, Support URL, optional banner, Show the managed badge in the toolbar, Managed-by line. |
| Web Access | Access mode: Block listed sites, or Allow only listed sites. Blocked / Allowed / Warn-only sites. Blocked categories. Per-site daily time limits. Blocked top-level domains. Block raw IP address URLs, punycode, URL shorteners, file://, data:, pop-up windows. Force SafeSearch, Force YouTube restricted mode, Require HTTPS, Block form submissions over HTTP, Block mixed content, Block unrecognized TLDs, Warn when a work password is reused off-domain. |
| Work Hours and Limits | Enforce work hours, Work day starts/ends, Work days. Outside work hours: Allow, Warn but allow, or Block everything except allowed sites. Break windows. Daily browsing limit in minutes (0 = none). Enforce per-site time limits. |
| Downloads and Uploads | Block executable downloads. Blocked / Allowed file extensions. Download location (same as Settings → Download Location; blank keeps each seat's folder). Max download size in MB (0 = none). Always ask where to save. Block uploads to unapproved sites plus Approved upload hosts. Block password-protected archives. Quarantine unrecognized file types. Block print to file. |
| Browser Lockdown | Lock settings against staff changes, Additional locked setting keys, Force any browser setting (or Copy this browser's look). Settings pages staff can open. Lock PowerUp installation with Allowed / Blocked PowerUps. Lock extension installation with Allowed / Blocked extension ids. Lock profile creation, Maximum profiles. Block private tabs, DevTools, clearing history/cookies/cache/download history. Lock theme selection, toolbar layout, the rest of Appearance, import/export, VPN/Tor/proxy controls, password export, payment autofill, saving new passwords, AI assistant, screenshots, Cast to TV, page translation, clipboard history, site notifications, location, camera, microphone, printing, removing the Business PowerUp, default search engine, homepage. |
| Paid Capabilities | Stealth VPN, Tor, AI assistant. Each is Follow the license on the machine, Allowed, or Switched off for this seat. Allowed does not hand out a license. Assign seats on People. |
| Network and Routing | Proxy mode: none, system, manual, or PAC. Proxy server, bypass list, PAC URL. Route work domains through the VPN plus Work domains. Block Tor, Block third-party proxy tools, Forced DNS, Block QUIC. Allowed networks (CIDR or SSID). Only allow browsing on an allowed network. |
| Workspace and Apps | Edited here, shown to staff on the Workspace tab. Work app dock, Startup tabs, Homepage, New tab URL, Company bookmarks, Staff cannot edit company bookmarks, Saved workspaces, Client containers, Pinned tabs, Default search engine. |
| Share Guard | Same switches as the Share Guard tab. Enable Share Guard, hide personal bookmarks / other profiles / history suggestions / downloads bar, mute notifications, close non-work tabs, blur tab thumbnails, Share Guard hotkey. |
| Reporting | Report site visits, blocked attempts, downloads, searches, tamper attempts, browser version. Log AI assistant use, Include the prompt wording, Include the model reply, Log what the AI did in the browser, AI action detail (changes vs everything), Max characters kept per AI entry, Report interval, Keep activity for (days), Anonymize device and user names, Notification email. |
| Compliance and Check-in | Check-in interval (minutes), Offline grace period (hours), When grace expires (warn / lock browsing / drop policy), Keep a local audit log, Require a minimum browser version, Minimum browser version, Lock browser after idle (minutes), Block unmanaged profiles, Alert on tamper attempts. |
| Local Administration | Require a local admin PIN, Allow the local admin to override org policy, Staff must type a reason to override policy, Admin unlock window (minutes), Manager device ids. |
| Staff Messages | Blocked page title, Blocked page message, Contact line, Outside work hours message, Blocked download message. |
Related
Overview · People · Workspace · Share Guard