Access policy
Limit where members and API tokens can connect from, sign idle members out, and require two-factor sign-in for a Veriom workspace.
This page is for a workspace Admin or Owner. The access policy sets three rules for everyone in the workspace: which networks can connect, how long an idle session lasts, and whether two-factor sign-in is required.
Before you start
- You have the Admin or Owner role.
- Requiring two-factor authentication is part of the Free Trial, Growth, and Enterprise plans. The network list and idle sign-out are on every plan.
Open Settings and select Access policy. Each change asks you to confirm your identity.
Limit sign-in by network
- In IP allowlist, enter an address or CIDR block in Add an address or CIDR block, for example
203.0.113.0/24, and press Enter. - Click Add my current IP if your own address is not on the list yet. The card shows Your address is allowed once it is.
- Click Save access policy.
The list holds up to 100 entries. It applies to browser sessions, API tokens, and MCP clients. A request from any other address gets 403 ip_not_allowed, and members see that the workspace does not allow their network.
If the list would block your own address, Veriom warns This list would lock you out and asks Save an allowlist without your address? before saving.
To allow every network again, remove all entries. With no list, members and tokens can connect from anywhere.
Sign out idle members
In Idle sessions, set Sign out after to 15, 30, 60, 120, 240, or 480 minutes idle, then click Save access policy. Activity in any Veriom tab counts. A member who is idle that long must sign in again, and their next request gets 428 session_idle_timeout. API tokens are not affected.
Require two-factor sign-in
- Set up two-factor authentication on your own account first, under Settings → Security. If you skip this, Veriom asks you to do it right after you save.
- In Two-factor authentication, turn on Require two-factor authentication.
- Click Save access policy.
Members without a second factor are asked to set one up under Security before they continue (428 mfa_enrollment_required). An authenticator app or a passkey works.
If something goes wrong
| Problem | Fix |
|---|---|
| You locked yourself out with the network list | Ask another Admin or Owner, on an allowed network, to add your address |
| Someone else changed the access policy | Another Admin saved first. Their version is loaded. Make your change again and save |
ip_not_allowed from CI or an MCP client | Add the runner's or client's outgoing address to the list |
Was this guide useful?
Your response stays in this browser unless you open a GitHub issue.