Set rules for all your computers
Decide, rule by rule, what Scopebond stops before it happens and what it only records, for every agent at once, for one environment, or for one agent. Changes reach each connected computer within a few minutes of its next action. Only an owner or admin can change a rule; everyone in the workspace can see the settings.
What Block and Monitor mean
| Setting | What happens on the computer | What you see in the workspace |
|---|---|---|
| Block | The action is stopped before it runs, and the agent is told why | The action, marked Blocked |
| Monitor | The action runs | The action, with the rule it matched |
Always on: protection of Scopebond's own settings and your agents' hook settings. An agent can never switch off its own guardrails, and nobody can relax this from the workspace.
Recorded only: some actions (for example, installing packages) are not yet reported separately by coding agents. They are recorded with the activity, but you cannot block them yet.
Until you change a rule here, each computer keeps the rules it was set up with. Those starter rules already block the risky actions, so nothing changes when you connect a computer.
Change a rule
- Open Workspace rules.
- Under Show settings for, choose All agents, one environment, one team or one agent.
- Tick the rules to change, then choose Block or Monitor.
- For Contact websites and online services, list the sites your agents need before you choose Block (for example
api.github.com, *.npmjs.org). Everything else is stopped. - For branches and programs you can add to each computer's own list. You cannot remove entries from it here.
- Select Review change. The preview says what changes, how many connected computers it reaches, which narrower settings stay, and how often the rule matched in the last seven days.
- Select Apply. If your workspace requires a second person for changes to Block, the button reads Ask for approval, and another owner, admin or reviewer approves it under Waiting for approval.
If someone else changed the rules while you were looking at a preview, you see the updated preview instead. Check it and apply again.
Exceptions
A setting for one agent beats a setting for its team, which beats a setting for its environment, which beats a setting for all agents. A team setting reaches the agents the team owns (set on the Agents page), including agents given to the team later. A rule shows N exceptions differ when narrower settings disagree with the one you are looking at.
- A setting for an environment, team or agent is an exception: Scopebond asks Why is it needed?, who owns it, and whether it ends after 1, 7 or 30 days. When it ends, Scopebond removes it the same way a person would, and the wider setting applies again on each computer within a few minutes of its next activity.
- Workspace rules → Exceptions lists every exception with its reason, owner and end, those ending in the next 7 days, and those that ended in the last 30 days. An owner or admin can End now.
- An exception that blocks Read passwords, keys or secrets or Change build and release settings can skip exact paths (a folder ends in
/**), and one that blocks Push straight to a protected branch can skip exact branch names. A skip matches exactly, same case, and never covers Scopebond's own settings. Computers apply skips from Scopebond 0.11.0; until a computer is updated it keeps protecting those targets. - When you change a rule for all agents, an environment or a team, narrower settings are kept unless you tick Also replace different settings.
- To remove an exception, choose that environment, team or agent under Show settings for and select Use the wider setting, or use End now on the Exceptions tab.
See whether each computer has your rules
The line above the rules says how many computers have applied the latest version. Show computers lists each one:
| State | Meaning | What to do |
|---|---|---|
| Uses its own rules | You have not changed any rule for this computer's environment | Nothing |
| Applied | The computer confirmed it loaded exactly this version | Nothing |
| Applying | It will pick up the change on its next action | Nothing; it updates within a few minutes |
| Waiting for the computer | It has not been active for 15 minutes | It updates when it is next used |
| Needs a Scopebond update | It is active but runs a Scopebond version that cannot receive rules from the workspace | On that computer run npx -y @scopebond/hook@latest install |
| Could not apply | The computer refused the version, with the reason shown | Its previous rules stay in force. Check the reason, then change the rule again |
To check right away on a computer instead of waiting, run npx -y @scopebond/hook@latest policy sync there. npx -y @scopebond/hook@latest status shows which rules are in force and when they were last checked. In Windows PowerShell, type npx.cmd instead of npx if PowerShell says running scripts is disabled.
A computer follows workspace rules only once a setting reaches it: a setting for all agents, for its environment or for its own agent. A change made for one agent leaves the other computers in its environment on their own rules, and they keep reading Uses its own rules.
Undo a change
Open Recent changes under the rules and select Restore this version next to the version you want. This creates a new version with those settings, so the history stays complete. Exceptions for single agents stay as they are now.
On the computer
While the workspace sets the rules, editing them on that computer (scopebond rules …) is refused with a message pointing here. If you disconnect the computer, or remove every rule change for its environment, it goes back to its own rules. A computer is never left without rules.