Group policies
Centrally manage IBM Bob behaviour across your organization using platform-native policy mechanisms on macOS, Windows, and Linux.
Enterprise policies are currently supported by Bob IDE only.
Enterprise policies let organizations centrally manage IBM Bob settings for their development teams. When a policy is set, it takes priority over any user, workspace, or default setting. IT admins can deploy and enforce specific configurations through their existing device management tooling on Windows, macOS, and Linux.
How policies work
Bob reads policies from a platform-specific source at startup. When a policy is detected, its value is applied and the corresponding setting is locked.
| Platform | Policy source | Mechanism |
|---|---|---|
| macOS | Managed preferences (com.ibm.bob) | MDM configuration profile |
| Windows | Registry key Software\Policies\IBM\Bob | Group Policy (GPO) or manual registry edit |
| Linux | JSON file at /etc/bob/policy.json | Configuration management tool or manual edit |
Sample files
| Platform | File | Description |
|---|---|---|
| macOS | com.ibm.bob.mobileconfig | MDM configuration profile with all supported Bob policies |
| Windows | IBMBobPolicy.admx | ADMX administrative template |
| Windows | en-US/IBMBobPolicy.adml | English language resources for the ADMX template |
| Linux | policy.json | JSON policy file with all supported Bob policies |
Installing policies
Bob reads policies from the com.ibm.bob managed-preferences domain. The recommended deployment method is a configuration profile distributed through your MDM.
Download com.ibm.bob.mobileconfig and open it in a text editor. Adjust the policy values for your organization, including only the policies you want to enforce.
Replace the two placeholder UUIDs (PayloadUUID) with unique values. Generate them with:
uuidgenDeploy the profile via an MDM tool such as Apple Business Manager.
Bob reads policies from the Windows Registry under Software\Policies\IBM\Bob. Deploy values using the provided ADMX/ADML administrative template files and your standard Group Policy infrastructure.
Copy the files to the Group Policy central store on your domain controller:
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\IBMBobPolicy.admx
\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\IBMBobPolicy.admlAlternatively, copy them to the local policy store on a single machine:
C:\Windows\PolicyDefinitions\IBMBobPolicy.admx
C:\Windows\PolicyDefinitions\en-US\IBMBobPolicy.admlDeploy the configured policies using an MDM solution like Microsoft Intune, or test them locally using the Local Group Policy Editor:
- Open the Local Group Policy Editor.
- Navigate to Computer Configuration (or User Configuration) > Administrative Templates > IBM Bob.
Configure the desired policies. Changes take effect the next time IBM Bob starts.
Bob reads policies from /etc/bob/policy.json.
Download policy.json.
Adjust the sample policy values to your needs. Remove any policies you don't want to enforce.
Restrict the file to root-owned, world-readable:
sudo chown root:root /etc/bob/policy.json
sudo chmod 644 /etc/bob/policy.jsonUse your standard configuration management tooling (Ansible, Chef, Puppet, Salt) to deploy and maintain /etc/bob/policy.json across your fleet.
The policy file must be a valid JSON object. Unknown keys are ignored. If the file is absent or malformed, Bob starts without any enforced policies.
Supported policies
DisabledAutoApprovalGroups string
Permanently disables auto-approval for one or more tool-permission groups. When this policy is set, users cannot re-enable auto-approval for the listed groups. The corresponding toggles are locked in the Bob UI.
The value is a comma-separated list of permission group IDs:
| Group ID | Tools covered |
|---|---|
read | File read, directory listing, search |
edit | File write, create, and delete |
execute | Terminal and shell command execution |
mcp | All MCP server tool calls |
skill | Skill activation |
todo | Todo list updates |
subtask | Subtask creation |
subagent | Subagent spawning |
mode | Mode switching |
Example — Disable auto-approval for file edits and command execution:
edit,executeUpdateMode string
Controls whether Bob automatically checks for and installs updates.
| Value | Behaviour |
|---|---|
default | Automatic checking for updates is enabled and runs in the background |
start | Check for updates only when VS Code starts |
manual | Automatic checking is disabled. Users can still check for updates manually |
none | Updates are disabled entirely |
Example — Disable all automatic updates:
noneWorkspace trust
Control which projects can use Bob's full capabilities with workspace folder trust.
Plan overview
Scale IBM Bob across your organization with centralized control. Get enhanced team management capabilities, shared Bobcoin allocation, and dedicated support to help your organization maximize productivity.