Question

As an enterprise owner, you configure the enterprise-level Actions policy to 'Allow enterprise, and select non-enterprise, actions and reusable workflows' with a specific allow list. An organization owner within the enterprise then wants to further restrict which actions their teams can use, adding their own narrower allow list at the organization level. However, they report they cannot select a less restrictive policy than the enterprise. What is the correct explanation of how these policies interact?

Accepted Answer

Organization-level policies can only be equally or more restrictive than the enterprise policy; the organization may add to its own allow list but cannot permit actions the enterprise policy blocks.

Answer

The organization allow list completely overrides the enterprise allow list, so the organization can permit any action it lists regardless of the enterprise setting.

Answer

Enterprise and organization allow lists are merged additively, so any action listed at either level is permitted across all repositories in the organization.

Answer

Organization owners cannot configure any Actions policy once an enterprise policy is set; all policy control is locked at the enterprise level.