> ## Documentation Index
> Fetch the complete documentation index at: https://docs.whawit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization policies

> One page governs what WHAWIT's automation may do on your behalf — the Coder, MCP actions, incident automation and the compliance criteria that protect your data

## One place for the rules

WHAWIT acts autonomously: agents investigate, the Coder writes fixes, MCP actions touch
your infrastructure, incidents open and resolve themselves. **Policies** is the page where
your organization decides how far that autonomy goes.

Open **Policies** in the app sidebar (`/policies`). The page is organization-wide: the
rules you set here apply to every project of the organization selected in the switcher.

<Note>
  The page is visible only to holders of the *organization update* capability — the
  **Admin** and **Owner** roles. Responders and viewers do not see the sidebar entry.
</Note>

There is no save button. Each control persists the moment you change it and confirms with
a **Policies updated** toast. Settings are independent — changing one never disturbs the
others.

## What lives here

| Card                    | What it governs                                                                                                                                                                                         |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Coder**               | Rules applied before a coding run can start — e.g. **Require a ticket before launching the Coder**, so every code change traces back to a tracked piece of work.                                        |
| **MCP actions**         | The coarse controls over WHAWIT calling your MCP servers: the master switch, organization-wide approval, and the daily execution budget. Detailed on [Set up MCP Actions](/mcp-actions/setup).          |
| **Compliance**          | The industry criteria — HIPAA, SOC 2, PCI DSS, GDPR, CCPA, Aviation / PNR — that declare which classes of data WHAWIT must treat as protected. Detailed on [Compliance criteria](/policies/compliance). |
| **Incident automation** | How incidents behave without a human: automation over creation, merging and lifecycle.                                                                                                                  |

## Defaults are conservative

An organization that has never touched the page runs on defaults — no setup step is
required, and nothing is applied retroactively when you change a policy later. Turning a
policy off again is immediate and lossless.

## Related

<CardGroup cols={2}>
  <Card title="Compliance criteria" icon="shield-check" href="/policies/compliance">
    Declare the frameworks that govern your data, toggle by toggle.
  </Card>

  <Card title="MCP Actions governance" icon="list-check" href="/mcp-actions/setup">
    Where the per-tool allow-list meets the organization-wide controls.
  </Card>
</CardGroup>