Enterprise Access Control
One dashboard policy, enforced live in every team member's CLI — fail-closed and always overriding local settings.
On a Teams plan, admins govern the CLI from the Sypha dashboard. The policy is enforced live in every member's CLI within ~10 seconds, fail-closed, and always overrides local settings.
Access Control applies on Teams plans. Individual/free users are unaffected.
What admins control
Tool approvals
15 permission settings — which tools apply silently, prompt for approval, or are denied.
Feature access
Whether Terminal, Browser, and MCP are available at all.
Providers
Which model providers members are allowed to connect and use.
How it's enforced
Always the final word
The admin policy is evaluated last at every permission check. "Allow always", Ctrl+Y auto-accept, and headless sypha run --auto cannot bypass it.
Live, no restart
Policy changes reach members' CLIs within ~10 seconds — no restart, no new message required.
Fail-closed
If the policy can't be confirmed, the CLI restricts rather than allows.
Provider gating
Un-approved providers are hidden from the model picker and /connect; attempting to use one shows a clear "not approved by your administrator" message.
For members
Run /access-control to view your team's live policy, and /permissions to see per-tool settings (admin-restricted tools are shown locked 🔒).