[{"data":1,"prerenderedAt":474},["ShallowReactive",2],{"navigation_docs":3,"-docs-guide-org-sign-in-policy":170,"-docs-guide-org-sign-in-policy-surround":469},[4,8,45,125,135],{"title":5,"path":6,"stem":7},"TheSpider Documentation","\u002Fdocs","docs\u002Findex",{"title":9,"icon":10,"path":11,"stem":12,"children":13,"page":44},"Getting Started","i-lucide-rocket","\u002Fdocs\u002Fgetting-started","docs\u002F1.getting-started",[14,19,24,29,34,39],{"title":15,"path":16,"stem":17,"icon":18},"Introduction","\u002Fdocs\u002Fgetting-started\u002Fintroduction","docs\u002F1.getting-started\u002F1.introduction","i-lucide-house",{"title":20,"path":21,"stem":22,"icon":23},"AI Setup Wizard","\u002Fdocs\u002Fgetting-started\u002Fai-setup","docs\u002F1.getting-started\u002F2.ai-setup","i-lucide-sparkles",{"title":25,"path":26,"stem":27,"icon":28},"Install the agent","\u002Fdocs\u002Fgetting-started\u002Finstallation","docs\u002F1.getting-started\u002F3.installation","i-lucide-download",{"title":30,"path":31,"stem":32,"icon":33},"Cloud quickstart","\u002Fdocs\u002Fgetting-started\u002Fquickstart","docs\u002F1.getting-started\u002F4.quickstart","i-lucide-zap",{"title":35,"path":36,"stem":37,"icon":38},"Connect over MCP","\u002Fdocs\u002Fgetting-started\u002Fmcp","docs\u002F1.getting-started\u002F5.mcp","i-lucide-plug",{"title":40,"path":41,"stem":42,"icon":43},"Pricing","\u002Fdocs\u002Fgetting-started\u002Fpricing","docs\u002F1.getting-started\u002F6.pricing","i-lucide-badge-dollar-sign",false,{"title":46,"icon":47,"path":48,"stem":49,"children":50,"page":44},"Guide","i-lucide-book-open","\u002Fdocs\u002Fguide","docs\u002F2.guide",[51,56,61,66,71,76,81,86,91,96,101,106,111,115,120],{"title":52,"path":53,"stem":54,"icon":55},"Configuration","\u002Fdocs\u002Fguide\u002Fconfiguration","docs\u002F2.guide\u002F01.configuration","i-lucide-settings",{"title":57,"path":58,"stem":59,"icon":60},"The agent","\u002Fdocs\u002Fguide\u002Fagent","docs\u002F2.guide\u002F02.agent","i-lucide-terminal",{"title":62,"path":63,"stem":64,"icon":65},"Campaigns","\u002Fdocs\u002Fguide\u002Fcampaigns","docs\u002F2.guide\u002F03.campaigns","i-lucide-layers",{"title":67,"path":68,"stem":69,"icon":70},"Campaign cadence","\u002Fdocs\u002Fguide\u002Faudit-workflows","docs\u002F2.guide\u002F04.audit-workflows","i-lucide-git-compare-arrows",{"title":72,"path":73,"stem":74,"icon":75},"Triage","\u002Fdocs\u002Fguide\u002Ftriage","docs\u002F2.guide\u002F05.triage","i-lucide-list-checks",{"title":77,"path":78,"stem":79,"icon":80},"PR gate","\u002Fdocs\u002Fguide\u002Fpr-gate","docs\u002F2.guide\u002F06.pr-gate","i-lucide-git-pull-request",{"title":82,"path":83,"stem":84,"icon":85},"Data handling & privacy","\u002Fdocs\u002Fguide\u002Fdata-handling","docs\u002F2.guide\u002F07.data-handling","i-lucide-shield-check",{"title":87,"path":88,"stem":89,"icon":90},"Author an audit methodology","\u002Fdocs\u002Fguide\u002Fmethodology","docs\u002F2.guide\u002F08.methodology","i-lucide-panels-top-left",{"title":92,"path":93,"stem":94,"icon":95},"Configure a custom model runner","\u002Fdocs\u002Fguide\u002Fcustom-runner","docs\u002F2.guide\u002F09.custom-runner","i-lucide-terminal-square",{"title":97,"path":98,"stem":99,"icon":100},"Runner troubleshooting","\u002Fdocs\u002Fguide\u002Ftroubleshooting","docs\u002F2.guide\u002F10.troubleshooting","i-lucide-wrench",{"title":102,"path":103,"stem":104,"icon":105},"Host an external execution agent","\u002Fdocs\u002Fguide\u002Fexternal-agent","docs\u002F2.guide\u002F11.external-agent","i-lucide-plug-zap",{"title":107,"path":108,"stem":109,"icon":110},"Refine","\u002Fdocs\u002Fguide\u002Frefine","docs\u002F2.guide\u002F12.refine","i-lucide-repeat",{"title":112,"path":113,"stem":114,"icon":65},"Audit profiles","\u002Fdocs\u002Fguide\u002Fprofiles","docs\u002F2.guide\u002F13.profiles",{"title":116,"path":117,"stem":118,"icon":119},"Account security","\u002Fdocs\u002Fguide\u002Faccount-security","docs\u002F2.guide\u002F14.account-security","i-lucide-shield-user",{"title":121,"path":122,"stem":123,"icon":124},"Org sign-in policy","\u002Fdocs\u002Fguide\u002Forg-sign-in-policy","docs\u002F2.guide\u002F15.org-sign-in-policy","i-lucide-lock-keyhole",{"title":126,"icon":127,"path":128,"stem":129,"children":130,"page":44},"Deploy","i-lucide-server","\u002Fdocs\u002Fdeploy","docs\u002F3.deploy",[131],{"title":132,"path":133,"stem":134,"icon":127},"On-prem overview","\u002Fdocs\u002Fdeploy\u002Fonprem","docs\u002F3.deploy\u002F2.onprem",{"title":136,"icon":137,"path":138,"stem":139,"children":140,"page":44},"Reference","i-lucide-code","\u002Fdocs\u002Freference","docs\u002F4.reference",[141,146,151,156,160,165],{"title":142,"path":143,"stem":144,"icon":145},"API reference","\u002Fdocs\u002Freference\u002Fapi","docs\u002F4.reference\u002F1.api","i-lucide-code-xml",{"title":147,"path":148,"stem":149,"icon":150},"Concepts and glossary","\u002Fdocs\u002Freference\u002Fconcepts","docs\u002F4.reference\u002F2.concepts","i-lucide-book-marked",{"title":152,"path":153,"stem":154,"icon":155},"Runner contract","\u002Fdocs\u002Freference\u002Frunner-contract","docs\u002F4.reference\u002F3.runner-contract","i-lucide-file-json-2",{"title":157,"path":158,"stem":159,"icon":28},"Findings export","\u002Fdocs\u002Freference\u002Ffindings-export","docs\u002F4.reference\u002F4.findings-export",{"title":161,"path":162,"stem":163,"icon":164},"Agent CLI contracts","\u002Fdocs\u002Freference\u002Fagent-cli-json","docs\u002F4.reference\u002F5.agent-cli-json","i-lucide-braces",{"title":166,"path":167,"stem":168,"icon":169},"Agent downloads","\u002Fdocs\u002Freference\u002Fdownloads","docs\u002F4.reference\u002F6.downloads","i-lucide-hard-drive-download",{"id":171,"title":121,"body":172,"description":462,"extension":463,"links":464,"meta":465,"navigation":466,"path":122,"seo":467,"stem":123,"__hash__":468},"docs\u002Fdocs\u002F2.guide\u002F15.org-sign-in-policy.md",{"type":173,"value":174,"toc":451},"minimark",[175,184,189,254,261,264,267,271,274,319,322,326,332,355,361,367,371,378,382,393,400,404,430,434,442],[176,177,178,179,183],"p",{},"An organization owner can require how members sign in, and which email addresses they may use.\nOpen ",[180,181,182],"strong",{},"Organization settings → Sign-in policy",".",[185,186,188],"h2",{"id":187},"the-two-rules","The two rules",[190,191,192,205],"table",{},[193,194,195],"thead",{},[196,197,198,202],"tr",{},[199,200,201],"th",{},"Rule",[199,203,204],{},"Effect",[206,207,208,229],"tbody",{},[196,209,210,221],{},[211,212,213,216,217],"td",{},[180,214,215],{},"Require"," ",[218,219,220],"em",{},"(this organization's methods)",[211,222,223,224,228],{},"Members must sign in with one of the checked methods, for example Google or ",[225,226,227],"code",{},"SSO (acme-okta)",". Password and email-link sign-ins are refused for this organization.",[196,230,231,236],{},[211,232,233],{},[180,234,235],{},"Allowed email domains",[211,237,238,239,242,243,246,247,250,251,183],{},"Members need a ",[180,240,241],{},"verified"," email address in one of the domains (up to 20). ",[218,244,245],{},"Include subdomains"," also accepts ",[225,248,249],{},"eu.example.com"," for ",[225,252,253],{},"example.com",[176,255,256,257,260],{},"The method list shows only the methods ",[180,258,259],{},"this"," organization can use: the Google, GitHub and Microsoft\nsign-ins the server has configured, plus SSO connections approved for this organization. Another\norganization's SSO connection never counts here.",[176,262,263],{},"An SSO sign-in counts only for addresses inside the connection's registered domains. An address from\nanother domain signed in through the same identity provider is treated like any unverified sign-in.",[176,265,266],{},"A domain is a member restriction, not proof of employment: it checks the verified address on the\naccount. On a server without email, password accounts cannot verify their address, so a domain rule\nadmits only provider and SSO sign-ins that come with a verified address.",[185,268,270],{"id":269},"who-it-applies-to","Who it applies to",[176,272,273],{},"The policy is checked on every request that acts on the organization:",[275,276,277,284,297,303,309],"ul",{},[278,279,280,283],"li",{},[180,281,282],{},"Browser sessions."," A member who signed in another way sees the organization with a lock and the\nfix (\"requires sign-in with Google\"), with buttons to sign in that way or to link the provider. They\nkeep their membership and can use their other organizations.",[278,285,286,289,290,293,294,296],{},[180,287,288],{},"CLI tokens"," are judged by how the browser session that approved ",[225,291,292],{},"thespider-agent login"," signed\nin. If that does not satisfy the policy, run ",[225,295,292],{}," again and approve it while\nsigned in with an allowed method.",[278,298,299,302],{},[180,300,301],{},"MCP authorizations"," are judged the same way, by the session that approved them. Re-authorize the\nMCP client after signing in with an allowed method.",[278,304,305,308],{},[180,306,307],{},"Enrollment (CI) tokens"," belong to no person and are not affected.",[278,310,311,314,315,318],{},[180,312,313],{},"New members."," Invitations, invitation links and operator additions are refused for an address\noutside the allowed domains (",[225,316,317],{},"email_domain_not_allowed","). A refused invitation stays valid, so the\nperson can verify their address and use the same link.",[176,320,321],{},"Nothing is removed when you turn a policy on: existing members and tokens stay, and start working again\nonce they satisfy it.",[185,323,325],{"id":324},"before-you-save","Before you save",[176,327,328,331],{},[180,329,330],{},"Preview impact"," lists the members who would be blocked and why, pending invitations that could no\nlonger be accepted, and CLI or MCP tokens that would stop working. Saving is refused when:",[275,333,334,341,348],{},[278,335,336,337,340],{},"your own current session would not satisfy the policy (",[225,338,339],{},"policy_would_lock_out_actor","),",[278,342,343,344,347],{},"no owner could sign in under it (",[225,345,346],{},"no_compliant_owner","), or",[278,349,350,351,354],{},"it names a method this organization does not have (",[225,352,353],{},"sign_in_method_unavailable",").",[176,356,357,358,354],{},"Only owners can change the policy, from a browser, after a recent sign-in. While a policy is active,\nthe last owner who can sign in under it cannot be demoted or removed (",[225,359,360],{},"last_compliant_owner",[176,362,363,364,183],{},"To turn the policy off, choose ",[180,365,366],{},"Turn off",[185,368,370],{"id":369},"plans","Plans",[176,372,373,374,377],{},"The domain list and requiring Google, GitHub or Microsoft are available on every plan. Naming an SSO\nconnection in the policy needs ",[180,375,376],{},"Business",", as do SSO connections themselves. If an organization\nmoves off Business, its existing policy keeps applying unchanged; an SSO entry it already names shows\n\"Requires Business to change\" and can be removed but not added again.",[185,379,381],{"id":380},"when-a-method-disappears","When a method disappears",[176,383,384,385,388,389,392],{},"If the server stops offering a method (its credentials are removed) or an SSO connection's approval\nis revoked, a policy that needs it has nothing left to accept. The method rule is then suspended (the\nsettings card says so, and its status reads ",[218,386,387],{},"Method rule suspended"," instead of ",[218,390,391],{},"On",") while any domain\nrule still applies. Choose another method or turn the requirement off.",[176,394,395,396,399],{},"A method the policy names but this organization no longer has stays in the list, marked ",[218,397,398],{},"No longer\navailable",". Saving the policy removes it, and the card says so before you save.",[185,401,403],{"id":402},"locked-out","Locked out",[275,405,406,412],{},[278,407,408,411],{},[180,409,410],{},"Cloud:"," contact support. An operator can clear the policy for your organization.",[278,413,414,417,418,421,422,425,426,429],{},[180,415,416],{},"On-prem:"," run ",[225,419,420],{},"bun run src\u002Fauth-admin.ts clear-auth-policy"," on the server (add ",[225,423,424],{},"--org \u003Cslug>","\nfor an org other than the configured one), or set ",[225,427,428],{},"AUTH_POLICY_ENFORCEMENT=off"," and restart.\nTurn enforcement back on afterwards; the settings card warns while it is off.",[185,431,433],{"id":432},"sso-connections","SSO connections",[176,435,436,437,441],{},"SSO connections (OIDC or SAML) are set up by the operator: registered on the server and then\napproved for one organization. A connection signs nobody in until it is approved. See\n",[438,439,440],"a",{"href":133},"On-prem"," and the operator install guide.",[176,443,444,445,447,448,183],{},"See also ",[438,446,116],{"href":117}," and the\n",[438,449,142],{"href":450},"\u002Fdocs\u002Freference\u002Fapi#organization-sign-in-policy",{"title":452,"searchDepth":453,"depth":453,"links":454},"",2,[455,456,457,458,459,460,461],{"id":187,"depth":453,"text":188},{"id":269,"depth":453,"text":270},{"id":324,"depth":453,"text":325},{"id":369,"depth":453,"text":370},{"id":380,"depth":453,"text":381},{"id":402,"depth":453,"text":403},{"id":432,"depth":453,"text":433},"Require Google, GitHub, Microsoft or SSO sign-in and restrict members to your email domains","md",null,{},{"icon":124},{"title":121,"description":462},"_sIDAG2c5Sf4bCigmD-_rlsO64lgTrZVNo8Hi0y51GQ",[470,472],{"title":116,"path":117,"stem":118,"description":471,"icon":119,"children":-1},"Two-factor authentication, passkeys, recovery codes, sign-in alerts, sessions and linked sign-ins",{"title":132,"path":133,"stem":134,"description":473,"icon":127,"children":-1},"When to run TheSpider on your own infrastructure",1793113502435]