Linked-account admin
- Type
- linked_account_admin
- Category
- Sharing
- Enforced atWhen this policy is checked: while someone tries to open, while they create or change an invitation or hold, on a membership change or background sweep (lifecycle), or after a denial (record only).
- Authoring-time
- TiersWhere an admin can set this policy: the whole organization, one integration, or the physical device when the connector supports a device steward.
- Org
- EnforcementEnforcement modes this type accepts. Enforce applies the row. Require approval (user sharing only) opens an admin approval inbox instead of blocking.
- Enforce
- DefaultWhat happens when no row of this type is configured.
- Not configured — warn and require acknowledgment (historical PalGate default).
PalGate setup probes whether the connected vendor account is a hardware admin of the gate. This org-tier policy decides what happens when it is not. Default when no row exists is warn and require acknowledgment (the historical PalGate default). Who may share gate users is a separate user_sharing policy.
When it is enforced
Evaluated when someone creates or updates an invitation, hold, or share. Requests that would exceed the limit are rejected — they are not silently rewritten.
Where to set it
Settings → Policies (org).
Policies never grant access. See thepolicies architecture guidefor how org, integration, and device tiers combine.
Arguments
The config object on create/update. Row fields outsideconfig are enforcement (this type acceptsenforce; any other value is rejected with 400), enabled (disabled rows never apply), and capability.
| Name | Type | Required | Values | Description |
|---|---|---|---|---|
| mode | string | Yes | warn_onlywarn_and_ackadmin_only | warn_only: allow setup with a warning. warn_and_ack: require the operator to acknowledge. admin_only: block until a hardware-admin vendor account is used. |
How overlapping rows combine
Most-restrictive mode across applicable org-tree rows.
Example
Connecting PalGate with a non-admin vendor account cannot finish setup until an admin account is used.
{ "mode": "admin_only"}Integrations
This type is documented on these connectors:
- PalGate Cloud (palgate_cloud)