Configuring Protection Rules

Set and enforce skill publication requirements across your organization.

Protection rules are the governance layer that controls how skills move from draft to published. This guide covers configuring rules at the org and skill level.

Prerequisites

Admin role in your workspace

Org-Level Rules

Org-level rules apply to all skills unless overridden. Navigate to Settings > Skills to configure them.

Rule	Description	Default
Required reviewers	Minimum approvals before a version can be published	`1`
Allow self-publish	Whether the author can approve their own work	`false`
Reviewer not author	At least one reviewer must differ from the author	`true`
Require sample run	A sample run must be recorded before the version can be submitted	`false`
Require outcome hook	An outcome hook must be configured on the skill	`true`
Reviewer pool	Restrict reviewers to a specific team (null = any member)	`null`

Skill-Level Overrides

Individual skills can tighten (but not loosen) the org-level rules. Open a skill and go to Settings to set overrides.

For example, you might require 2 reviewers for a skill that handles sensitive data, even if the org default is 1.

Via the API

Rules can also be managed programmatically:

# View current org rules
curl -H "Authorization: Bearer hw_..." \
  https://api.headways.ai/v1/orgs/me/protection-rules

# Require 2 reviewers and a sample run
curl -X PUT \
  -H "Authorization: Bearer hw_..." \
  -H "Content-Type: application/json" \
  -d '{"requiredReviewers": 2, "requireSampleRun": true}' \
  https://api.headways.ai/v1/orgs/me/protection-rules

Audit Trail

Every lifecycle event (submit, approve, reject, publish) is logged. View the org activity log at Settings > Activity or export it via GET /v1/orgs/me/audit/export.