Policy issues
Find workspaces whose environments no longer match your organisation's declared environment policy.
Settings → Governance → Policy Issues lists every shared workspace whose environments disagree with the environment ladder your organisation declares under Settings → Governance → General.
The environment policy is a creation-time template. It is applied when a workspace is created — editing it afterwards does not change any workspace that already exists. This page is how you see which ones were left behind.
Why this page exists
When you add a workspace, its environments are seeded from your organisation's environment policy (or from the built-in Development + Production defaults if you have not saved one). From that moment the workspace owns its own environments.
Change the policy later — rename a rung, add one, mark Production read-only — and nothing reconciles the workspaces you already have. Without this page the disagreement is invisible: Governance says one thing, the workspace does another, and the first symptom is usually behavioural. A Production environment that was seeded as writable keeps behaving as writable, so switching to it in Agentic opens the workflow editor instead of the monitor.
What it reports
Each finding names one environment and one kind of disagreement.
| Badge | Meaning |
|---|---|
| Write access | The environment accepts writes when the policy says it is read-only, or the reverse. |
| Missing | The policy declares this environment; the workspace does not have it. |
| Undeclared | The workspace has this environment; the policy does not declare it. |
| Order | The environment sits at a different position in the ladder than the policy declares. |
Read-only and order are reported separately for the same environment, so fixing one does not hide the other.
Personal workspaces are never listed. A personal workspace has exactly one environment
(main) created outside the policy, so the organisation ladder has never applied to it.
If a workspace's environments cannot be read, it is listed as Unreadable rather than counted as compliant — an unknown state is never presented as a clean one.
Fixing a finding
This page reports; it does not change anything. Use Environments → on any finding to open that workspace's own Environments tab, where you can:
- toggle Read only on an environment;
- create an environment the policy declares but the workspace lacks;
- rename, re-slug, reorder, or delete an environment.
Every change writes an audit event scoped to that one workspace.
Changing an environment's slug can break integrations and triggers that reference it by slug. Prefer creating the declared environment over re-slugging an existing one when workflows are already bound to it.
Deciding what to fix
Not every finding is a defect. An Undeclared environment is often a deliberate extra rung for one team, and a workspace that predates your policy may legitimately keep its original ladder. The page tells you where reality and policy differ; whether to change the workspace, the policy, or neither is your call.
Related
- Workspaces — personal vs shared workspaces
- Admin roles — who can see Governance settings