Switch User Policy
The Switch User policy in the organization settings controls whether an admin is able to create a resource that is owned by another user.
It is specifically designed for automation use cases, such as:
- An AI conversation started by an automation bot that is triggered by an external event, such as a GitHub issue or a Slack message. The bot starts the conversation, but the ownership of that conversation should belong to the user who triggered the event.
- A sandbox created by automation on behalf of a user. The sandbox must be owned by that user, rather than by the automation bot holding the admin privilege.
Authorization Rule
This is the general rule, applied to all resource types, that defines who is allowed to specify a different user as the owner of a newly created resource.
It can be set to one of the following values:
| Value | Who may specify an alternative owner |
|---|---|
NONE |
Nobody — this is the default, and switch user is disabled for the particular resource type. |
EXPLICIT |
Only the admins explicitly listed, including service accounts. |
USERS |
All admin users, but not service accounts. Service accounts must still be listed explicitly. |
ALL |
All admin users and all service accounts. |
The value is applied per resource type, so a resource type left at NONE keeps switch user disabled even when another type allows it.
Sandbox Specific
When the target resource type is a sandbox, Enforce Shared Mode can be enabled as well. With this option, a newly created sandbox may not have a sharing mode more relaxed than the org's default setting.
This keeps a bot from creating sandboxes that are more widely accessible than the org policy intends, while still handing ownership to the user the automation acts for.
See Also
- Org and User — org membership, roles, and admin privileges
- Service Account — the machine identities used by automation
- Sandbox Sharing Mode — the modes constrained by Enforce Shared Mode
- Agentic Sessions — conversations that automation may start for a user
- Launch Sandbox in CI — automation that creates sandboxes