wandb · mdlinville · Sep 4, 2026 · Sep 4, 2026 · Sep 8, 2026
@@ -14,16 +14,16 @@ Use W&B to save your code, compare code across runs, view local changes, and cap
 Configure code saving for your team or organization. Team and organization controls are documented in [Configure privacy settings](/platform/hosting/privacy-settings).
 
 <Info>
-By default, W&B disables code saving for all teams. Before you can turn it on for a team, an organization admin must enable it at the organization level. See the [Organization](#organization) section.
+By default, W&B disables code saving for all teams. Before you can turn it on for a team, an organization admin must leave **Disable default code saving** turned off for the organization. See the [Organization](#organization) section.
 </Info>
 
 ### Team
 
-To enable code saving for a team as a team admin, navigate to the **Settings** page, then go to the **Privacy** section, and configure **Enable code saving by default** for runs in that team. This option is available only when an organization admin has not enforced code saving restrictions for the whole organization. For navigation steps, see [Configure privacy settings for a team](/platform/hosting/privacy-settings#configure-privacy-settings-for-a-team).
+To enable code saving for a team as a team admin, navigate to the **Settings** page, then go to the **Privacy** section, and configure **Enable code saving by default** for runs in that team. This option is available only when an organization admin has not turned on **Disable default code saving** for the whole organization. For navigation steps, see [Configure privacy settings for a team](/platform/hosting/privacy-settings#configure-privacy-settings-for-a-team).
 
 ### Organization
 
-To enable code saving for an organization as an organization admin, navigate to **Settings**, go to the **Privacy** section, and turn on **Enforce default code saving restrictions** so code saving stays off by default for every team. While this enforcement is on, team admins cannot turn on **Enable code saving by default** for a team. For the full list of organization controls, see [Enforce privacy settings for all teams](/platform/hosting/privacy-settings#enforce-privacy-settings-for-all-teams).
+As an organization admin, navigate to **Settings**, select **Privacy**, then use **Disable default code saving** in the **Project and content security** section to control whether code saving is off by default for every team. While that setting is on, team admins can't turn on **Enable code saving by default** for their team. For the full list of organization controls, see [Enforce privacy settings for all teams](/platform/hosting/privacy-settings#enforce-privacy-settings-for-all-teams).
 
 ## Save code
 

@@ -62,7 +62,7 @@ Go to the **Privacy** section on the team **Settings** page to change privacy de
 - Allow any team member to invite other members, rather than only team admins.
 - Manage whether code saving is turned on by default for the team.
 
-For navigation steps and the organization-level **Enforce default code saving restrictions** control, see [Configure privacy settings](/platform/hosting/privacy-settings).
+For navigation steps and the organization-level **Disable default code saving** control, see [Configure privacy settings](/platform/hosting/privacy-settings).
 
 ## Usage
 

@@ -141,55 +141,48 @@ If a key was exposed publicly, delete it immediately rather than waiting to upda
 
 ## Restrict how members use API keys
 
-Organization admins can restrict key creation and use. The available restrictions differ by deployment type, and each is set through the `updateOrganizationPrivacySettings` GraphQL mutation rather than through the W&B App.
+Organization admins can restrict key creation and use from the organization settings in the W&B App. These restrictions limit which keys can reach your organization's resources and who can create new ones. The following sections describe the available restrictions, which differ by deployment type.
 
-### Require organization API keys
+### Enforce organization-scoped API keys
 
-Available in **Multi-tenant Cloud** for Enterprise organizations.
+Available in **Multi-tenant Cloud** for Enterprise organizations. W&B enables this setting per organization. If you don't see it, contact your W&B account team.
 
-When enabled, only organization API keys can access the organization's resources. Personal API keys that a member uses across several organizations no longer work against this organization, which prevents a key leaked from elsewhere from reaching your data.
+When enforced, only organization API keys and keys that belong to service accounts in the organization can reach the organization's resources. A personal API key that a member uses across several organizations no longer works against this organization, which prevents a key leaked from elsewhere from reaching your data.
 
-Replace `[ORGANIZATION-ID]` with the ID of your organization.
+<Warning>
+Personal API keys lose read and write access to the organization as soon as you enforce this setting, and any integration that uses a personal key stops working. Notify your users before you enforce it.
+</Warning>
 
-```graphql
-mutation RequireOrgScopedAPIKeys {
-  updateOrganizationPrivacySettings(
-    input: {organizationId: "[ORGANIZATION-ID]", requireOrgScopedAPIKeys: true}
-  ) {
-    success
-  }
-}
-```
+To enforce organization-scoped API keys, complete the following steps:
 
-This setting requires that organization API keys are already enabled for your organization. Contact your W&B account team to confirm.
+1. Sign in as an organization admin.
+2. Open your organization settings, then select **Authentication** in the left navigation.
+3. Next to **Enforce organization-scoped API keys**, click **Enforce**.
+4. Type your organization name to confirm, then click **Enforce Organization-Scoped API Keys**.
+
+W&B then shows an **Enforced** label next to the setting. To stop enforcing it, return to **Authentication** and click **Disable**.
 
-{/*
 ### Disable API key creation
 
 Available in **Dedicated Cloud** and **Self-Managed** v0.84.0 and above.
 
-When enabled, members of the organization can't create new API keys. Existing keys keep working, so turning this on doesn't interrupt running jobs. Use it when your organization issues keys through a controlled process and you want to prevent members from creating their own.
+When enabled, users and team service accounts can't create new API keys. Organization service accounts can still create keys, and existing keys keep working, so turning this on doesn't interrupt running jobs. Use it when your organization issues keys through a controlled process and you want to prevent members from creating their own.
 
-Replace `[ORGANIZATION-ID]` with the ID of your organization.
+To disable API key creation, complete the following steps:
 
-```graphql
-mutation DisableAPIKeyCreation {
-  updateOrganizationPrivacySettings(
-    input: {organizationId: "[ORGANIZATION-ID]", disableApiKeyCreation: true}
-  ) {
-    success
-  }
-}
-```
+1. Sign in as an organization admin.
+2. Open your organization dashboard, then select **Privacy** in the left navigation.
+3. In the **Access Control** section, turn on **Disable API key creation**.
 
-A member who tries to create a key after you enable this setting receives the following error:
+W&B saves the change immediately. For the other settings on this tab, see [Configure privacy settings](/platform/hosting/privacy-settings#enforce-privacy-settings-for-all-teams).
+
+While the setting is on, the **API Keys** tab disables the **New key** button and shows the following message:
 
 ```text
-API key creation has been disabled by your organization administrator
+API key creation has been disabled by your organization administrator. You can still edit, delete, and use existing API keys.
 ```
 
 To restrict service account creation as well, see [`GORILLA_DISABLE_TEAM_SERVICE_ACCOUNT_CREATION`](/platform/hosting/iam/advanced_env_vars), which prevents the creation of new team-scoped service accounts in Dedicated Cloud and Self-Managed v0.83.0 and above.
-*/}
 
 ## Availability
 

@@ -14,40 +14,66 @@ To avoid unexpected changes in team workflows, W&B recommends that organization
 
 ## Enforce privacy settings for all teams
 
-Organization admins can enforce privacy settings for all teams in their organization from within the **Privacy** section of the **Settings** tab in the account or organization dashboard. If organization admins enforce a setting, team admins can't configure it within their respective teams.
+Organization admins can enforce privacy settings for all teams in their organization from the **Privacy** tab of the organization settings. An enforced setting applies to every team in the organization, and team admins can't override it at the team scope. When a team admin opens a setting that you enforce, W&B shows the following message: "This setting is locked because it's enforced org-wide. To make changes, please contact your org admin."
 
-* **Enforce team visibility restrictions**: Hides teams, members, and member profiles from users outside those teams across the organization.
-* **Enforce privacy for future projects**: Requires all new projects in all teams to be private or [restricted](./iam/access-management/restricted-projects).
-* **Enforce invitation control**: Prevents non-admins from inviting members to any team.
-* **Enforce report sharing control**: Turns off public sharing of reports in private projects and deactivates existing magic links.
-* **Enforce team self-joining restrictions**: Restricts users with matching organization email domain from automatically joining any team.
-  <Note>This setting is only available in [Multi-tenant Cloud](./hosting-options/multi_tenant_cloud) deployments.</Note>
-* **Enforce default code saving restrictions**: Turns off code saving by default for all teams.
-
-To open organization privacy settings:
+To open organization privacy settings, complete the following steps:
 
 1. Sign in as an organization admin.
 2. On Multi-tenant Cloud, navigate to `https://wandb.ai/account-settings/[ORGANIZATION]/settings`. Replace `[ORGANIZATION]` with your organization name. On Dedicated Cloud or Self-Managed deployments, open your instance organization dashboard. For environment-specific URLs, see [Add and manage users](/platform/hosting/iam/access-management/manage-organization#add-and-manage-users).
-3. Open the **Privacy** section and configure **Enforce default code saving restrictions** and any other organization-wide controls you need.
+3. In the left navigation, select **Privacy**.
 
-After you save changes, the enforced settings apply to all teams in the organization, and team admins can no longer override them at the team scope.
+The following sections describe the settings on the **Privacy** tab. Each setting is a toggle, and W&B saves your changes immediately.
 
-## Configure privacy settings for a team
+### Access Control
 
-If a setting isn't enforced at the organization scope, team admins can manage it for their own team from the **Privacy** section of the team **Settings** tab. Each setting is configurable as long as it isn't enforced at the organization scope:
+Manage team visibility and member joining processes.
 
-* **Hide this team from all non-members**: Hides the team from users who aren't members.
-* **Make all future team projects private**: Ensures all new projects created in the team are private (public sharing isn't allowed).
-* **Allow any team member to invite other members**: Lets all team members invite new members, not only admins.
-* **Turn off public sharing for reports in private projects**: Disables public sharing of reports and deactivates existing magic links.
-* **Allow users with matching organization email domain to join this team**: Lets users with the same email domain join the team automatically.
-  <Note>This setting is only available in [Multi-tenant Cloud](./hosting-options/multi_tenant_cloud) deployments.</Note>
-* **Enable code saving by default**: Automatically saves code for all runs in the team.
+* **Enforce team visibility restrictions**: Each user can see only the teams they belong to and the profiles of their teammates. Teams and users outside their memberships are hidden.
+* **Prevent automatic team joining**: Users with a matching organization email domain can't automatically join any team. Explicit invitations are required.
+* **Limit invitation privileges**: Only administrators can invite new members to any team.
+* **Restrict invitations to claimed domain**: Only users whose email address ends in your organization's claimed email domain can be invited to the organization.
+  <Note>This setting appears only in [Multi-tenant Cloud](./hosting-options/multi_tenant_cloud), for Enterprise organizations that have claimed an email domain. See [Domain capture](./iam/access-management/manage-organization#domain-capture).</Note>
+* **Disable API key creation**: Users and team service accounts can't create new API keys. Organization service accounts can still create keys, and existing keys keep working. See [Disable API key creation](./iam/api-keys#disable-api-key-creation).
+  <Note>This setting appears only in Dedicated Cloud and Self-Managed v0.84.0 and above.</Note>
+
+### Project and content security
+
+Control project privacy and regulate content sharing.
+
+* **Enforce private projects**: All new projects across all teams are set to private or [restricted](./iam/access-management/restricted-projects), and can't be made public or open at the team scope.
+* **Disable public report sharing**: Turns off public sharing of reports from private projects and deactivates existing public links.
+* **Disable default code saving**: Turns off code saving by default for all teams. See [Code saving](/models/app/features/panels/code).
+
+### Smart features
+
+The **Smart features** section controls LLM-powered features and data sharing. This section appears on the **Privacy** tab only if your organization has access to W&B AI features. See [Governance and security](/aria/governance).
+
+### ARIA
 
-To open team privacy settings:
+The **ARIA** section controls what ARIA can do across your organization's projects. This section appears on the **Privacy** tab only if project memory is enabled for your organization.
+
+* **Enable project memory**: Lets ARIA remember project details, such as conventions and past corrections, and apply them in future conversations. ARIA shares a project's memory with the team that owns the project. When this setting is off, ARIA uses no memories and records nothing new, but existing memory is kept. See [View and manage project memories](/aria/overview#view-and-manage-project-memories).
+
+## Configure privacy settings for a team
+
+If a setting isn't enforced at the organization scope, team admins can manage it for their own team from the **Privacy** section of the team **Settings** page.
+
+To open team privacy settings, complete the following steps:
 
 1. Navigate to `https://wandb.ai/[TEAM]`. Replace `[TEAM]` with your team name.
-2. Select **Team settings** in the left navigation.
-3. Open the **Privacy** section and configure **Enable code saving by default**.
+2. In the left navigation, select **Team settings**.
+3. Open the **Privacy** section.
+
+The **Privacy** section contains the following settings. W&B saves your changes immediately.
+
+* **Default visibility for new projects in [TEAM]**: Sets the visibility scope that W&B applies to new projects in the team. See [Visibility scopes](./iam/access-management/restricted-projects#visibility-scopes).
+* **Hide this team from all non-members**: Hides the team from users who aren't members.
+  <Warning>Hiding a team also blocks public access to any open projects and reports that belong to that team. W&B asks you to confirm before applying this setting.</Warning>
+* **Make all future team projects private (public sharing not allowed)**: Ensures all new projects created in the team are private.
+* **Allow any team member to invite other members (not just admins)**: Lets all team members invite new members, not only admins.
+* **Disable public sharing to outside of team for reports in private projects**: Turns off public sharing of reports in the team's private projects. This also deactivates existing magic links.
+* **Automatically recommend new users with matching email domains (`[DOMAIN]`) join this team upon signup**: Prompts new users whose email address matches your organization's claimed email domain to join this team when they sign up. In the W&B App, `[DOMAIN]` is your organization's claimed email domain.
+  <Note>This setting appears only in [Multi-tenant Cloud](./hosting-options/multi_tenant_cloud), and only organization admins can change it. If your organization hasn't claimed an email domain, the setting instead links to **Enable domain capture** in organization settings. See [Domain capture](./iam/access-management/manage-organization#domain-capture).</Note>
+* **Enable code saving by default**: Automatically saves code for all runs in the team. See [Code saving](/models/app/features/panels/code).
 
-After you save changes, the selected settings apply to your team.
+Settings you configure here apply only to this team. They don't affect other teams in the organization.