Enterprise controls

Controls sit in three layers; each layer sets the limits for the one below it.

Three layers of control

Layer	Set by	Where	When it applies	Representative controls
1. Install	The install admin	Admin Console (install configuration)	On the next deploy	Data location, model gateway and providers, agent network access, connector destinations
2. Platform	Context’s deployment team and your point of contact	Setup console and deployment switches	Without a redeploy	Sign-in and SCIM, Context Code and task desktop, model guardrails, scheduled tasks
3. Organization and workspace	Organization and workspace admins	Settings in the app	Immediately	Roles and permissions, sharing and export lock, connectors for the organization, audit log

flowchart TD
  I["Layer 1: Install (install admin, Admin Console, next deploy)"] -->|sets the limits for| P["Layer 2: Platform (Context's deployment team and your point of contact, no redeploy)"]
  P -->|sets the limits for| O["Layer 3: Organization and workspace (org and workspace admins, Settings, immediately)"]

These are representative controls. The Admin Console and Settings show every control and its current value.

Install

Set by the install admin in the Admin Console (install configuration). Applies on the next deploy. Sets the limits for the platform layer.

Control	What it sets
Data location	Your own database and file storage
Model gateway and providers	Which model providers the install can reach
Agent network access	Open internet, a domain allowlist, or workspace only
Connector destinations	Public services only, or approved private hosts too (see Connectors)

Platform

Set by Context’s deployment team and your point of contact, in the setup console and deployment switches. Applies without a redeploy. Sets the limits for the organization and workspace layer.

Control	What it sets
Sign-in and SCIM	Password, single sign-on, user provisioning
Context Code and task desktop	On or off for the whole install (see Higher-risk features)
Model guardrails	Checks on model calls, including PII filters
Scheduled tasks	Allow or block new schedules

Organization and workspace

Set by organization and workspace admins in Settings in the app. Applies immediately.

Control	What it sets
Roles and permissions	What owners, admins, members and viewers can do (see Roles)
Sharing and export lock	Sharing outside a workspace; lock items in or out (see Workspace settings)
Connectors for the organization	Turn off any connector; each change audited (see Connectors)
Audit log	Who did what, with CSV export (see Audit log)