> ## Documentation Index
> Fetch the complete documentation index at: https://docs.requestly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Organization resources

> Control what your organization's members can do in Requestly: which external packages scripts may import, and whether members can leave Safe mode.

An organization Owner or Admin can decide what everyone in the organization is allowed to do in Requestly. Those controls live under **Settings > Organization > Resources**, and each individual control is called a resource.

Two resources are governed today, both in the **Scripts & packages** section:

| Resource              | What it controls                                                                    | Where it takes effect                           |
| --------------------- | ----------------------------------------------------------------------------------- | ----------------------------------------------- |
| **External packages** | Which external packages scripts in this organization may import.                    | The Requestly desktop app                       |
| **Script mode**       | Whether members of this organization can run a request's scripts in Developer mode. | The Requestly desktop app and the Requestly CLI |

<Note>
  Resources is enabled per organization. If you are an Owner or Admin and the entry is missing under Settings > Organization, contact Requestly support.
</Note>

## Who can change a policy

Only an organization Owner or Admin can change a policy. Everyone else in the organization sees exactly the same pages, read only: the list carries a quiet **Read only - you can view these settings.** line, and the resource's own page states **You can view this policy but not change it**, along with who to ask. There is no error page and no redirect, so a member can always see what applies to them and who set it.

Every row and every resource page also names who changed the policy last and when. Only the latest change is recorded, so there is no history to browse.

## Change a policy

<Steps>
  <Step title="Open Resources">
    Go to **Settings**, open the **Organization** group and select **Resources**. Each row names the resource, describes what it controls, and shows the choice that currently applies.
  </Step>

  <Step title="Open the resource">
    Click anywhere on the row. The resource gets its own page, where each option is listed with the consequence of choosing it.
  </Step>

  <Step title="Choose an option">
    Options are listed least restrictive first. Selecting one shows what it means for your members before you commit to it.
  </Step>

  <Step title="Curate the list, if the option carries one">
    Some options reveal a list panel. Add and remove entries there. Nothing is written until you save.
  </Step>

  <Step title="Save">
    Click **Save** in the page header. **Save** stays unavailable until you change something, and **Cancel** discards the draft. A successful save returns you to the Resources list.
  </Step>
</Steps>

## External packages

This resource controls which external packages scripts in this organization may import with `require()`. See [Import packages into your scripts](/api-client/import-packages-into-your-scripts) for what `require()` can load.

| Option             | What it means                                                 |
| ------------------ | ------------------------------------------------------------- |
| **Allow all**      | Scripts can import any external package. This is the default. |
| **Allow selected** | Only the packages listed below can be imported.               |
| **Deny**           | Scripts cannot import any external package.                   |

<Note>
  Requestly's built-in library is always available and is exempt from this policy. Packages bundled with Requestly resolve whatever you choose here, including under **Deny**. This setting controls external packages only.
</Note>

That exemption covers everything Requestly ships in the sandbox, reached either by name through `require()` (for example `require('crypto-js')`) or through the convenience globals `_`, `CryptoJS` and `xml2Json`.

### Curate the approved list

Choosing **Allow selected** reveals an **Approved packages** panel. Two entry forms are accepted:

* `axios` permits any version of that package.
* `axios@1.7.2` permits only that release.

Add an entry with **Add** or by pressing Enter. To add several at once, paste them into the field separated by newlines, commas, semicolons or spaces. Duplicates are rejected with a message rather than silently dropped, so if you meant to change a package's version, remove the existing entry first.

Requestly does not verify that an approved package exists. A well-formed name that no registry resolves is still accepted, which is what lets you approve a private or not-yet-published package.

<Warning>
  Pinning a version permits only that release and blocks an unversioned `require()` of the same package. Most scripts do not specify a version, so most scripts break when you pin one.
</Warning>

Saving **Allow selected** with an empty list is blocked, because an empty approved list denies every external package, which is what **Deny** already means. The **Save** button explains itself with "Add at least one entry, or choose Deny.", and the panel offers **Choose Deny instead** as the way out.

### What a governed member sees

Under **Allow selected** or **Deny**, a script that imports a package the policy does not permit is blocked when the request runs, with a message naming the package: `Package 'some-package' is blocked by your organization's package policy. Ask an admin in your organization to approve it.` Installing such a package from the Package Library is refused for the same reason.

## Script mode

This resource controls whether members of this organization can run a request's scripts in Developer mode. Safe mode is what every request opens in either way. See [Script execution modes](/api-client/rq-api-reference/overview#script-execution-modes) for what the two modes do.

| Option                   | What it means                                                                                     |
| ------------------------ | ------------------------------------------------------------------------------------------------- |
| **Allow Developer mode** | Requests open in Safe mode, and a member can switch one into Developer mode. This is the default. |
| **Safe mode only**       | Every request runs in Safe mode. No member can switch one into Developer mode.                    |

Developer mode reaches the host machine: scripts running in it can read files, run shell commands and open raw sockets on the member's machine. Safe mode is still what every request opens in, so this setting decides whether a member may leave it.

Under **Safe mode only**, members see Developer mode marked unavailable rather than hidden. The per-request mode control keeps showing the mode, so a member who reaches for it learns their organization set this instead of discovering it from a script that failed.

### Developer mode in the CLI

`rq collection run --script-execution-mode developer` requires credentials and is refused when the policy is **Safe mode only**. A run that passes no mode flag, or passes `safe`, needs no credentials and is unaffected. See [Script execution mode and your organization's policy](/api-client/cli#script-execution-mode-and-your-organizations-policy).

## How enforcement works

Policies apply to everyone in the group, including the admins who set them.

Enforcement is performed by the Requestly app on each member's machine, in every project, including local ones. It is not enforced at the network level or on our servers. The Resources page states this once, behind the **How enforcement works** link next to the enforcement line, together with the surfaces each resource is enforced on.

A change can take up to a minute to reach a member's machine, and a run already in progress finishes on the policy it started with.

<Warning>
  An out-of-date desktop app does not apply these policies. Policies you set are saved and apply on every up-to-date app, and the Resources page replaces its enforcement line with an update prompt when the app you are reading it in is too old to apply them.
</Warning>

Where a policy denies something, Requestly explains itself rather than failing silently: the restricted surface names what was restricted and says it "has been restricted by your organization's admin." It does not offer a workaround, so it will not suggest installing the desktop app to reach something your admin denied.

## Defaults

A resource with no policy set is **Allow all**. There is no separate "not set" state, so a resource you have never touched behaves exactly as it did before Resources existed, and a newly added resource appears set to **Allow all**.

If loading the policies fails, the page says so rather than showing every resource at its default. Any policies your organization has set stay in force while the page cannot display them.

## Related documentation

* [Import packages into your scripts](/api-client/import-packages-into-your-scripts)
* [Script execution modes](/api-client/rq-api-reference/overview#script-execution-modes)
* [Run collections from the command line](/api-client/cli)
* [User roles in a shared project](/collaboration/how-to-get-started-with-shared-workspace/user-roles)