Security

Group policies

Centrally manage IBM Bob behaviour across your organization using platform-native policy mechanisms on macOS, Windows, and Linux.

Enterprise policies are currently supported by Bob IDE only.

Enterprise policies let organizations centrally manage IBM Bob settings for their development teams. When a policy is set, it takes priority over any user, workspace, or default setting. IT admins can deploy and enforce specific configurations through their existing device management tooling on Windows, macOS, and Linux.

How policies work

Bob reads policies from a platform-specific source at startup. When a policy is detected, its value is applied and the corresponding setting is locked.

PlatformPolicy sourceMechanism
macOSManaged preferences (com.ibm.bob)MDM configuration profile
WindowsRegistry key Software\Policies\IBM\BobGroup Policy (GPO) or manual registry edit
LinuxJSON file at /etc/bob/policy.jsonConfiguration management tool or manual edit

Sample files

PlatformFileDescription
macOScom.ibm.bob.mobileconfigMDM configuration profile with all supported Bob policies
WindowsIBMBobPolicy.admxADMX administrative template
Windowsen-US/IBMBobPolicy.admlEnglish language resources for the ADMX template
Linuxpolicy.jsonJSON policy file with all supported Bob policies

Installing policies

Bob reads policies from the com.ibm.bob managed-preferences domain. The recommended deployment method is a configuration profile distributed through your MDM.

Download com.ibm.bob.mobileconfig and open it in a text editor. Adjust the policy values for your organization, including only the policies you want to enforce.

Replace the two placeholder UUIDs (PayloadUUID) with unique values. Generate them with:

uuidgen

Deploy the profile via an MDM tool such as Apple Business Manager.

Bob reads policies from the Windows Registry under Software\Policies\IBM\Bob. Deploy values using the provided ADMX/ADML administrative template files and your standard Group Policy infrastructure.

Copy the files to the Group Policy central store on your domain controller:

\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\IBMBobPolicy.admx
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\IBMBobPolicy.adml

Alternatively, copy them to the local policy store on a single machine:

C:\Windows\PolicyDefinitions\IBMBobPolicy.admx
C:\Windows\PolicyDefinitions\en-US\IBMBobPolicy.adml

Deploy the configured policies using an MDM solution like Microsoft Intune, or test them locally using the Local Group Policy Editor:

  • Open the Local Group Policy Editor.
  • Navigate to Computer Configuration (or User Configuration) > Administrative Templates > IBM Bob.

Configure the desired policies. Changes take effect the next time IBM Bob starts.

Bob reads policies from /etc/bob/policy.json.

Download policy.json.

Adjust the sample policy values to your needs. Remove any policies you don't want to enforce.

Restrict the file to root-owned, world-readable:

sudo chown root:root /etc/bob/policy.json
sudo chmod 644 /etc/bob/policy.json
Tip:

Use your standard configuration management tooling (Ansible, Chef, Puppet, Salt) to deploy and maintain /etc/bob/policy.json across your fleet.

The policy file must be a valid JSON object. Unknown keys are ignored. If the file is absent or malformed, Bob starts without any enforced policies.

Supported policies

DisabledAutoApprovalGroups string

Permanently disables auto-approval for one or more tool-permission groups. When this policy is set, users cannot re-enable auto-approval for the listed groups. The corresponding toggles are locked in the Bob UI.

The value is a comma-separated list of permission group IDs:

Group IDTools covered
readFile read, directory listing, search
editFile write, create, and delete
executeTerminal and shell command execution
mcpAll MCP server tool calls
skillSkill activation
todoTodo list updates
subtaskSubtask creation
subagentSubagent spawning
modeMode switching

Example — Disable auto-approval for file edits and command execution:

edit,execute

UpdateMode string

Controls whether Bob automatically checks for and installs updates.

ValueBehaviour
defaultAutomatic checking for updates is enabled and runs in the background
startCheck for updates only when VS Code starts
manualAutomatic checking is disabled. Users can still check for updates manually
noneUpdates are disabled entirely

Example — Disable all automatic updates:

none
How is this topic?