Organization Admin Overview

As an organization admin, you define the security boundaries and governance rules that all teams and developers must follow.

Your Responsibilities

Security Policies

Define what plugins, MCP servers, and images are blocked globally.

Delegation

Control which teams can add plugins, MCP servers, or custom configurations.

Marketplaces

Approve plugin marketplaces that teams can use.

Team Profiles

Create and manage team profiles (inline or federated).

The Three-Layer Model

SCC enforces a hierarchical configuration system:

Organization (org-config.json)
    ↓ security blocks + defaults
Team Profile (profiles section)
    ↓ additional plugins/servers
Project (.scc.yaml in repo root)
    ↓ project-specific additions

Each layer can add to the previous, but cannot remove security restrictions.

Note

Think of it as: You set the guardrails. Teams work within them. Projects customize further if teams allow it.

What You Control (That Cannot Be Overridden)

Setting	Purpose
security.blocked_plugins	Plugin patterns nobody can use
security.blocked_mcp_servers	MCP server patterns nobody can use
security.blocked_base_images	Docker images nobody can use
security.allow_stdio_mcp	Whether stdio MCP servers are permitted
defaults.allowed_plugins	Governance whitelist for plugins

What Teams Control (Within Your Boundaries)

Setting	Controlled By
Additional plugins	Team leads (if delegated)
Additional MCP servers	Team leads (if delegated)
Session settings	Team leads
Project override policy	Team leads

Configuration Approaches

Inline Profiles

Team configurations live directly in your org config file:

{
  "profiles": {
    "backend": {
      "additional_plugins": ["java-tools@internal"]
    }
  }
}

Best for: Small organizations, centralized control.

Federated Teams (GitOps)

Teams manage their own config repositories:

{
  "profiles": {
    "platform": {
      "config_source": {
        "source": "github",
        "owner": "myorg",
        "repo": "platform-config"
      }
    }
  }
}

Best for: Large organizations, team autonomy.

Quick Validation

Always validate your configuration:

scc org validate org-config.json

Check effective configuration:

scc config explain

Next Steps

Config Setup

Create your org-config.json. Set up →

Security Policies

Define security blocks. Learn more →

Delegation

Control team permissions. Learn more →