> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# App policy

> Control whether your organization can use Apps and which external hosts those apps are allowed to load resources from.

<Note>
  **Organization Admin** permissions are required to access and modify app policy settings.
</Note>

The **Settings > Apps** tab controls whether your organization can use [Apps](/visualize-present/apps) and which external hosts those apps may load resources from.

## Enable apps

Controls whether your organization can use [Apps](/visualize-present/apps), which let you build custom data experiences beyond traditional dashboards.

To restrict app creation to specific users or groups rather than turning apps off entirely, use the granular permission on a [custom role](/administration/users/custom-roles#permissions-reference).

## External source policy

Apps run in a sandboxed iframe whose Content Security Policy blocks outbound network requests by default. The **External source policy** sets the organization-wide ceiling on which external hosts that policy will open up — for images, scripts, stylesheets, fonts, and network connections.

This is separate from, and takes precedence over, the [**Safe domains**](/visualize-present/apps/settings#safe-domains) setting an app editor configures on an individual app.

### Policy options

| Policy            | What apps can load                                                                       | Effect on an app's Safe domains                            |
| ----------------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| **Open**          | Omni's default hosts, plus any host an app editor adds                                   | Honored as written                                         |
| **Omni defaults** | Omni's default hosts only                                                                | Ignored                                                    |
| **Custom**        | Only the hosts you list — these **replace** the default hosts rather than adding to them | Honored only where an entry falls within one of your hosts |

**Omni defaults** is the policy for an organization that hasn't chosen one.

<Warning>
  Under **Custom**, your list replaces Omni's default hosts. If your apps rely on a default host — a charting library from `cdn.jsdelivr.net`, or `fonts.googleapis.com` — you have to list it yourself or those resources stop loading.
</Warning>

To block external loading entirely, choose **Custom** and leave the host list empty. There's no separate off switch: an empty custom list means an app loads nothing from any external host.

### Setting a custom host list

1. Go to **Settings > Apps**.

2. Under **External source policy**, set **Source policy** to **Custom**.

3. Enter your hosts in the **Custom hosts** field. Add one host per line, or separate them with commas or spaces:

   ```text theme={null}
   cdn.example.com
   *.assets.acme.co
   cdn.jsdelivr.net
   ```

4. Click **Save source policy**.

A custom list accepts up to 25 hosts and uses the same formats as an app's [Safe domains](/visualize-present/apps/settings#domain-formats). A `*.` wildcard matches subdomains but not the domain itself, so `*.example.com` covers `cdn.example.com` but not `example.com`.

## Next steps

* [Apps](/visualize-present/apps)
* [App settings](/visualize-present/apps/settings) — the per-app settings an editor controls
* [Organization settings](/administration/settings)