Workspace policies

1. 1

   Go to 'Publishing policies' in your Workspace settings under 'Security' then 'Privacy & security'.

   This is where all the publishing rules are managed.

2. 2

   For the policy you want to set, click 'Configure' or flip its switch to open its settings.

   This lets you decide if the policy should block publishing or just require approval, and set any specific conditions.

3. 3

   Read the summary in the dialog to understand what will happen and how many approvals might be needed.

   This helps you see the impact of your policy choice before you turn it on.

4. 4

   Select 'Turn on' to activate the policy (or 'Update' for 'Block publishing from unverified domains').

   This applies the new rule to how apps are published in your workspace.

Please set up the following workspace policies for publishing:

1.  **Restrict publishing with unresolved PII findings**: Require approval for apps with unresolved personal data findings.
2.  **Require approval for external collaborators to publish**: Always require approval when someone from outside our company tries to publish an app.
3.  **Restrict publishing externally**: Require approval for public apps, and only allow owners and admins to publish without approval. Set approvals to last for 7 days.
4.  **Require approval to publish apps that use connectors**: Always require approval for apps that use any type of connector.
5.  **Block publishing from unverified domains**: Block publishing if the user's email domain is not one of our verified company domains.

Workspace policies

Rules that control when an app in your company's Lovable account can be shared with others.

PII findings

Instances where Lovable's scanner finds personal information, like names or email addresses, in your app's data or chat.

External collaborators

People from outside your company who have been invited to work on a Lovable project.

Connectors

Tools that let your Lovable app link to and use information from other services, like a database or a customer relationship management system.

Unverified domains

Email addresses that do not belong to a company email address that your Lovable account has confirmed it owns.

• Enabling 'Block publishing from unverified domains' without first verifying your company's email domains will block everyone from publishing.
• Switching a policy from 'Require approval' to 'Block', disabling a policy, or changing connector types for the 'Require approval to publish apps that use connectors' policy will cancel all pending approval requests without approving them.
• Approvers cannot approve their own requests; another admin or owner must do it.
• Policies have no test mode, so it's best to start with 'Require approval' mode to gauge impact before switching to 'Block'.