# Manage Baseline Workspace Policy


This guide explains how to manage the baseline policy applicable for each workspace within your RudderStack organization.

## Overview

The **Baseline Workspace Policies** tab lists all the workspaces available in your RudderStack organization along with details like number of groups and members within each workspace. Each workspace has one baseline policy.

{{< image src="images/access-management/baseline-workspace-policies-tab.webp" alt="Baseline workspace policies tab" >}}

This tab also lets you configure and manage the baseline policy applicable to each workspace in your RudderStack organization. All the groups, members, and [Service Access Tokens]({{< ref "access-management/service-access-tokens.md" >}}) in that workspace automatically inherit this baseline policy.

For example, an Admin can give every member the ability to create sources and destinations for testing purposes in the **Dev** workspace. 

### Use cases 

Baseline workspace policies are useful for configuring permissions that should apply **by default** across an entire workspace. Some common use cases include: 

- Increasing access in **Dev** workspaces to streamline testing and troubleshooting
- Ensuring restricted access in **Prod** workspaces to protect production pipelines and PII
- Enabling self-serve configuration of low-impact resources (like [Alerts]({{< ref "monitor/alerts.md" >}}))

#### Examples

- Give every member the ability to create sources and destinations for testing purposes in the **Dev** workspace.
- Give access to Live Events PII permissions in **Dev** workspace so that anyone in the workspace can test and troubleshoot, but restrict Live Events access in **Prod** to ensure InfoSec compliance.
- Grant permissions for Alert Overrides so that different team members can configure resource-specific notifications that are relevant to their role/team.

Instead of editing each individual member's policy or even creating a group for such use cases, they can simply [configure a baseline policy](#configure-baseline-workspace-policy) to grant the [required permissions]({{< ref "access-management/policies-overview.md#edit-connect-and-create--delete-permissions" >}}) within that workspace.

### Plan-wise limits

Not all RudderStack plans allow customizing the baseline workspace policy. See the [Plan-wise Features]({{< ref "access-management/plan-wise-features.md#baseline-workspace-policy" >}}) guide for more details on baseline workspace policy limits across different plans.

## Default behavior

Unless otherwise configured by an Admin, the baseline workspace policy is set to:

-  **View-only** for [resources]({{< ref "access-management/policies-overview.md#resource-permissions" >}}) 
- **No access** to [PII views]({{< ref "access-management/policies-overview.md#pii-permissions" >}}) in [Enterprise](https://www.rudderstack.com/enterprise-quote/) plan
- **Full** PII access to all members in **non-Enterprise** plans

## Configure Baseline Workspace Policy

{{< warning >}}
See [Important considerations](#important-considerations) before configuring your baseline workspace policy.
{{< /warning >}}

To configure a baseline workspace policy:

1. Select a workspace.
2. Use the policy editor to configure the baseline workspace policy for that workspace. 

{{< info >}}
All the groups, members, and Service Access Tokens in that workspace will automatically inherit the baseline workspace policy.
{{< /info >}} 

{{< image src="images/access-management/configure-baseline-workspace-policy.webp" alt="Configure baseline workspace policy" >}}

3. Configure permissions for different [resources]({{< ref "access-management/policies-overview.md#resource-permissions" >}}) and [PII]({{< ref "access-management/policies-overview.md#pii-permissions" >}}).
4. Click **Save** to save the configuration and enforce the baseline workspace policy.

## Important considerations

In RudderStack’s Access Management system, the permissions are [additive]({{< ref "access-management/concepts.md#additive-permissions-model" >}}), meaning users inherit all permissions granted to them via the baseline workspace policy, [Group Workspace Policy]({{< ref "access-management/groups.md" >}}), and [Member Workspace Policy]({{< ref "access-management/members.md" >}}). Permissions are accumulated, never overridden or subtracted.

When configuring a baseline workspace policy, RudderStack recommends adopting a **minimum necessary access** principle. This ensures that onboarding users with restricted access needs (like contractors or external collaborators) can be done without major rework later on.

{{< danger >}}
Adjusting an established baseline workspace policy later can cause broad ripple effects across your organization. It may affect the permissions of existing users and require substantial effort and rework to restore the intended security and access levels.
{{< /danger >}}