Update privacy settings docs for current UI labels

[mdlinville]

Fixes DOCS-3158.

The privacy settings docs had drifted from the product. At the organization scope, five of the six documented labels had been renamed, and the UI had been regrouped into cards the page didn't mention at all. Two settings were missing entirely, and both API key restrictions were documented as GraphQL-only even though both now have a UI.

Every label in this PR was taken verbatim from wandb/core at origin/master and re-checked against server-release-0.84.x.

Organization-scope label changes

Docs said	UI says
Enforce privacy for future projects	Enforce private projects
Enforce invitation control	Limit invitation privileges
Enforce report sharing control	Disable public report sharing
Enforce team self-joining restrictions	Prevent automatic team joining
Enforce default code saving restrictions	Disable default code saving
Enforce team visibility restrictions	unchanged

Team-scope labels were mostly accurate; two were stale (the magic-link setting and the email-domain setting).

Other corrections

• Added two undocumented settings: Restrict invitations to claimed domain and Disable API key creation.
• Added the section grouping the UI uses: Access Control and Project and content security, plus a pointer to Smart features.
• Moved a deployment restriction that was on the wrong setting. The page marked the organization-scope self-joining control as Multi-tenant Cloud only, but gorilla applies no onprem guard to restrictMatchingOrgEmailDomainUsers. The team-scope control is the gated one. Also corrected who can change it: the code requires viewerIsOrgAdmin, not a team admin.
• "After you save changes" was wrong — each toggle fires its mutation on change. Now says changes save immediately.
• Refined who is blocked by Disable API key creation. The old text said members can't create keys; the source blocks users and team service accounts while organization service accounts can still create keys.
• Corrected the in-product message. The page quoted the server-side error; the banner users actually see appends "You can still edit, delete, and use existing API keys."
• Fixed a self-contradiction in the code saving notice, which told readers an admin "must enable it at the organization level" when the actual control is a disable toggle.
• Uncommenting Disable API key creation also repairs a dead anchor: advanced_env_vars.mdx already linked to #disable-api-key-creation, which pointed into commented-out MDX.

Deliberately not changed

The organization API key concept block stays commented out, so the Enforce organization-scoped API keys section is still slightly orphaned — the term isn't defined on the page. Flagged rather than fixed, since un-hiding that content is a separate decision.

Validation

mint validate and mint broken-links both pass. English only; fr/ja/ko regenerate from these files.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
wandb	🟢 Ready	View Preview	Sep 4, 2026, 9:15 PM

---

Page	Change
Code	Changed · +3 −3
Team Settings	Changed · +1 −1
Api Keys	Changed · +23 −30
Privacy Settings	Changed · +51 −25

_{Updated 2026-09-08 22:09:51 UTC for deployment · 711b72d.}

[w-b-hivemind]

HiveMind Sessions

1 session · 28m · $8.53

Session	Agent	Duration	Tokens	Cost	Lines
Update Stale Privacy Settings UI Labels 7452c402-7c32-4e35-9965-90f56873c77e	claude	28m	75.2K	$8.53	+0 -0
Total		28m	75.2K	$8.53	+0 -0

View all sessions in HiveMind →

Run claude --resume 7452c402-7c32-4e35-9965-90f56873c77e to pickup where you left off.

[mdlinville]

Sources and decision log

All source paths are wandb/core at origin/master (fetched at the start of this work), cross-checked against origin/server-release-0.84.x.

Where each label came from

Claim	Source
All 8 organization-scope labels, descriptions, and the two section names	frontends/app/src/pages/OrgDashboard/PrivacySettings/OrgPrivacySettings.tsx
Privacy is a left-nav tab under Settings (not a "section")	frontends/app/src/pages/Billing/AccountSettings/SettingsTab/OrganizationSettingsTabs.tsx — friendlyName: 'Privacy' in TABS
All 7 team-scope labels, in UI order	frontends/app/src/components/TeamSettings/TeamSettings.tsx (Privacy section header, ~L829–1110)
Locked-setting message	TeamSettings.tsx — SET_AT_ORG_LEVEL_MESSAGE
Hiding a team blocks public access to open projects	TeamSettings.tsx — HideTeamFromNonTeamMembersConfirmationModal dialog body
Enforce organization-scoped API keys UI, Enforce/Disable buttons, type-org-name confirm, Enforced pill	frontends/app/src/pages/OrgDashboard/AuthenticationSettings/AuthenticationSettings.tsx
Personal keys lose access / integrations break	AuthenticationSettings.tsx — ConfirmModal warning banner
Disable API key creation blocks users + team service accounts, not org service accounts	OrgPrivacySettings.tsx row description, corroborated by services/gorilla/api/resolver/mutation_tokens.go checkAPIKeyCreationDisabled
Banner text and disabled New key button	getOrganizationPrivacySettings.ts API_KEY_CREATION_DISABLED_MESSAGE; APIKeysTab/APIKeysTabContent.tsx L685–701
Toggles save on change (no Save button)	onCheckedChange → mutation in OrgPrivacySettings.tsx; onChange → updateEntitySettings in TeamSettings.tsx

Deployment availability

• Disable API key creation is on-prem only: mutation_organizations.go returns "setting disableApiKeyCreation is not supported for this deployment type" when !m.onprem. Per prior confirmation on DOCS-2902, "onprem" covers both Dedicated Cloud and Self-Managed.
• The v0.84.0 claim was verified for the UI, not just the backend. The backend flag landed 2026-08-03/04 (#49478, #49588) and is an ancestor of server-release-0.84.x. The UI toggle landed later (2026-08-18, #49720) and is not an ancestor of that branch — but the string disable-api-key-creation is present in server-release-0.84.x, so it was cherry-picked. Labels in 0.84.x are byte-identical to master. This mattered: had the UI missed the cut, the page would now be telling 0.84.x users to click a toggle they don't have.
• Enforce organization-scoped API keys is SaaS-only, Enterprise, non-academic, behind the create-org-scoped-keys ramp — hence "W&B enables this setting per organization."

Wording decisions

• Kept ### Access Control in title case. It's the product's own section name (title: 'Access Control'), so it overrides the sentence-case heading rule. Flagged by a style pass and deliberately declined.
• Bolded labels drop the product's trailing period (Hide this team from all non-members. → Hide this team from all non-members). Wording is verbatim; only sentence punctuation was dropped so the label reads cleanly before a colon and gloss.
• Split the magic-link label. The product string is two sentences; the second reads as helper text, so it became the gloss rather than part of the bolded label.
• [DOMAIN] placeholder stands in for the interpolated claimed domain in the email-domain label.
• Preserved both H2 anchors (#enforce-privacy-settings-for-all-teams, #configure-privacy-settings-for-a-team) — four pages link to them. Confirmed no English page linked to the renamed #require-organization-api-keys.

Update: ARIA project memory is now included

An earlier revision of this comment listed Enable project memory as an intentional omission, because services/gorilla/api/resolver/query_organization.go (~L2292) notes the aria_project_memory rollout "hasn't reached" all organizations. That call was reversed and the setting is now documented in the ### ARIA section (commit 6642a6f).

Strings are from OrgPrivacySettings.tsx (title: 'Enable project memory', section title: AGENT_NAME where AGENT_NAME = 'ARIA'). Because the toggle is still ramp-gated, the section is introduced with the same hedge used for Smart features — "appears on the Privacy tab only if project memory is enabled for your organization" — rather than presented as universally available. aria/overview.mdx documents project memories from the end-user side but not the organization-level control, so this closes that gap and links to it.

Intentional omissions

• Smart features cross-links to /aria/governance rather than duplicating the three toggle labels, since that page already owns them.
• Release notes were not touched (release-notes/server-releases*.mdx still carry old labels) — they're point-in-time records.
• platform/app/settings-page/teams.mdx was left alone; it already carried the current team labels and served as an independent cross-check.
• The commented-out | Require organization API keys | availability row still uses the old label. Zero user impact while hidden; editing commented content would only add diff noise.

Tooling note

Local mint was upgraded 4.2.866 → 4.2.874 before validating, because CI installs mint@latest and a stale local CLI reports phantom broken links.

[github-actions]

Readability impact

Word-weighted Flesch-Kincaid grade change across 4 changed pages: -0.2 (easier).

Lower Flesch-Kincaid grade and higher reading ease both mean easier to read. This check is informational and never blocks a PR.

Human readability

Page	FK grade before	FK grade after	FK Δ	Reading ease Δ	Direction
models/app/features/panels/code.mdx	8.6	8.6	+0.0	+0.2	unchanged
platform/app/settings-page/team-settings.mdx	8.7	8.7	+0.0	+0.0	unchanged
platform/hosting/iam/api-keys.mdx	7.2	7.9	+0.7	-4.1	harder
platform/hosting/privacy-settings.mdx	11.7	10.1	-1.6	+6.8	easier

AI agent comprehension

Rated 0-3 (higher is easier for an agent to parse and act on).

Page	Before	After	Δ
platform/hosting/iam/api-keys.mdx	2	2	+0
platform/hosting/privacy-settings.mdx	3	2	-1
models/app/features/panels/code.mdx	2	2	+0
platform/app/settings-page/team-settings.mdx	2	2	+0

_{Curated-docs baseline median FK grade by type: conceptual 10.5, procedural 8.8, reference 9.4.}

From workflow run 34284115189

[github-actions]

🔗 Link Checker Results

✅ All links are valid!

No broken links were detected.

Preview: https://wb-21fd5541-docs-3158.mintlify.site