Post

🆕 Guardrails for Enterprise workspaces Set a policy once and enforce it across every project, in the dashboard and the API. Here's what you can lock down ↓

Restrict generate domain stops non-admins from generating public *.railway.app domains, so internal services stay internal • Non-admins see a banner explaining the restriction • API requests are rejected • Auto-generation is skipped for templates and new environments

Restrict TCP proxy does the same for raw TCP: non-admins can't create public TCP proxies, so there's no accidentally exposing your database to the internet Neither policy touches custom domains or private networking between services, and admins keep full access