org-policy-model-rules-auditlisted

# Skill: Org Policy Model Rules Audit Enterprise and business teams govern which models their developers can use. A model available in the public picker may be blocked by org policy; a policy intended to restrict a model may be misconfigured. This skill structures the audit so gaps are found before they produce compliance findings or unexpected bills. **Security-reviewer escalation rule:** any finding that involves API key scope, token storage, or a compliance verdict (SOC 2 / FedRAMP / GDPR applicability) escalates immediately to `ravenclaude-core/security-reviewer`. This skill audits policy configuration; it does not produce compliance opinions. ## Step 1 — Identify the platforms in scope The three ecosystems in this plugin have different governance surfaces: | Platform | Governance surface | Scope | |---|---|---| | GitHub Copilot Business | GitHub org settings → Copilot → Model rules | Allow/deny specific models for all org members | | GitHub Copilot Enterprise | Same as Business + GHEC-level policy | Broader controls; enterprise-managed users | | OpenAI Codex / API | OpenAI org settings → Usage policies | Org-level model access; project-scoped API keys | | xAI Grok API | API key ownership | No org-level picker controls as of this writing [verify-at-use] | ## Step 2 — Audit GitHub Copilot model rules (Business / Enterprise) For each org on Business or Enterprise: ``` [ ] Navigate to: org → Settings → Copilot → Policies → Model availability [ ] Document the current