Windsurf Enterprise RBAC

Overview

Manage team access to Windsurf AI IDE features, workspace settings, and code generation capabilities. Windsurf (by Codeium) uses per-seat licensing with workspace roles that control access to AI features like Cascade (agentic flows), Supercomplete, and Command.

Prerequisites

• Windsurf Pro or Enterprise plan (per-seat pricing)
• Organization admin access at windsurf.com/dashboard
• Identity provider for SSO (Enterprise only)

Instructions

Step 1: Configure Organization-Wide AI Policies

In Windsurf Admin Dashboard > Policies:

# Recommended enterprise AI policy settings
ai_policies:
  code_context_sharing: "workspace_only"     # AI cannot see code outside workspace
  telemetry: "anonymized"                     # No raw code sent to telemetry
  allowed_models: ["windsurf-cascade", "windsurf-supercomplete"]
  code_generation_review: "suggest_only"      # AI suggests, human applies
  max_cascade_steps: 10                       # Limit agentic flow depth

Step 2: Manage Seat Assignments

# seat-allocation.yaml
teams:
  engineering:
    plan: pro
    seats: 25
    features: [cascade, supercomplete, command, inline_chat]
  design:
    plan: pro
    seats: 5
    features: [supercomplete, command]  # No cascade (agentic flows)
  contractors:
    plan: basic
    seats: 10
    features: [supercomplete]  # Limited AI features

Assign seats via Admin Dashboard > Members > Invite with Role.

Step 3: Enable SSO (Enterprise Only)

In Admin Dashboard > Security > SSO:

• Configure SAML 2.0 with your IdP
• Map IdP groups to Windsurf workspace roles (Admin, Member)
• Enable "Enforce SSO" to block password login
• Set auto-provisioning for new users from approved email domains

Step 4: Set Workspace Access Boundaries

Control which repositories and folders Windsurf AI can access:

// .windsurf/settings.json (workspace-level)
{
  "ai.contextExclusions": [
    "**/secrets/**",
    "**/.env*",
    "**/credentials/**"
  ],
  "ai.allowedWorkspaces": ["src", "lib", "tests"]
}

Step 5: Review AI Usage Metrics

Monitor the Admin Dashboard for per-user AI usage: completions accepted, Cascade flows run, and tokens consumed. Use this data for seat optimization (remove seats from users with <10 AI interactions per month).

Error Handling

Examples

Basic usage: Apply windsurf enterprise rbac to a standard project setup with default configuration options.

Advanced scenario: Customize windsurf enterprise rbac for production environments with multiple constraints and team-specific requirements.

Output

• Configuration files or code changes applied to the project
• Validation report confirming correct implementation
• Summary of changes made and their rationale

Resources

• Official Windsurf Enterprise Rbac documentation
• Community best practices and patterns
• Related skills in this plugin pack