> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replicas.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security policies

> Require user identity and code-host attribution, block agent merges, and manage static egress.

Organization admins open [Organization → Settings → Security](https://app.replicas.dev/dashboard/settings?tab=security) to review and change organization-wide safeguards.

| Policy                          | What it requires                                                                                                                                  |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Require Replicas account**    | Slack and Linear users must belong to the Replicas organization before they can start work.                                                       |
| **Require code host connected** | Dashboard, Slack, and Linear users must connect a personal GitHub or GitLab account.                                                              |
| **Require PR user attribution** | Commits, pushes, and pull or merge requests use the triggering user's code-host identity. This also enables and locks the two requirements above. |
| **Block agent PR/MR merges**    | Agents cannot merge pull or merge requests or push directly to protected default branches.                                                        |

See [PR attribution](/features/github#pr-attribution) and [PR merge blocking](/features/github#pr-merge-blocking) for identity resolution, automation behavior, and blocked commands.

The same tab manages the organization's [static egress IP](/features/static-egress-ip).