Configuring Org Policy

Org policy lives at /policy/npm (redirected from /policy) and controls how every install for your org is evaluated.

Evaluation order

pkgPlease checks, in this order: allowlist → managed rule packs → blocklist → thresholds. An allowlist entry always overrides a managed-pack block.

Thresholds

• Block threshold (block_threat) — threat score at or above this blocks the install outright.
• Warn threshold (warn_threat) — threat score at or above this (but below the block threshold) warns instead of blocking.
• Warn trust (warn_trust) — trust score below this warns.
• Completeness floor (completeness_floor) — minimum scoring confidence required before trust/threat are trusted at all.
• Minimum package age (min_package_age_days) — set to 0 to disable. Note: an unpinned install (no exact version requested) always resolves to the newest version that clears this floor, regardless of the action setting below.
• Package age action (min_package_age_action) — block, warn, or allow for a version younger than the floor.

Click Save thresholds to apply changes.

Allowlist

Add an entry with a package name, optional exact version, optional expiration (in hours), and a reason. Allowlist entries override everything else in the evaluation order — use them for one-off exceptions.

Blocklist

Add an entry with a package name, optional exact version, and a reason. Blocklist entries hard-block regardless of score.

Managed Rules

pkgPlease maintains curated Package Rules and Signal Rules packs. Each pack has a name, a severity (block or warn), a description, and an entry count — toggle a pack on or off wholesale instead of adding its entries one at a time.

Seeing policy in action

Use the Approvals queue to review anything your policy blocked, or the Audit Log to see every decision your policy has made.