Portkey-AI · kiran-4444 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026 · Jul 28, 2026
diff --git a/...ence/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx b/...ence/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions.mdx
@@ -0,0 +1,77 @@
+---
+title: "List Workspace Exclusions"
+description: "List workspaces excluded from organization-level input or output guardrails"
+api: "GET https://api.portkey.ai/v1/workspace-exclusions/input-guardrails"
+playground: none
+---
+
+List active workspace exclusions for **organization-level input or output guardrails**. Optionally filter by a single workspace.
+
+Choose the path based on which exclusions you want to list:
+
+| Entity | Endpoint |
+|--------|----------|
+| Input guardrails | `GET /v1/workspace-exclusions/input-guardrails` |
+| Output guardrails | `GET /v1/workspace-exclusions/output-guardrails` |
+
+Query parameters and response shape are the same for both.
+
+<Info>
+  Requires an Admin API key (`organisation-service`) with the `organisation_exclusions.list` scope. Only Organization Owners and Admins can be granted this scope.
+</Info>
+
+## Query Parameters
+
+<ParamField query="organisation_id" type="string" required>
+  Organization UUID.
+</ParamField>
+
+<ParamField query="workspace_id" type="string">
+  Optional workspace UUID or workspace slug. When provided, returns exclusions for that workspace only.
+</ParamField>
+
+## Example Request
+
+### List input guardrail exclusions
+
+```bash
+curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/input-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6" \
+  -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY"
+```
+
+### List output guardrail exclusions for one workspace
+
+```bash
+curl -X GET "https://api.portkey.ai/v1/workspace-exclusions/output-guardrails?organisation_id=6e44dcff-c77a-4325-a653-a77459f40aa6&workspace_id=ws-sandbox" \
+  -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY"
+```
+
+## Example Response
+
+```json
+{
+  "success": true,
+  "data": {
+    "exclusions": [
+      {
+        "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+        "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6",
+        "workspace_id": "11111111-2222-3333-4444-555555555555",
+        "entity_type": "input_guardrails",
+        "status": "active",
+        "created_by": "user_or_key_id",
+        "created_at": "2026-07-28T12:00:00.000Z",
+        "last_updated_at": "2026-07-28T12:00:00.000Z"
+      }
+    ]
+  }
+}
+```
+
+`entity_type` is `input_guardrails` or `output_guardrails`, matching the endpoint you called.
+
+## Related
+
+- [Update Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions)
+- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails)
+- [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) — includes `organisation_exclusions.update` / `.list`
diff --git a/...ce/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx b/...ce/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions.mdx
@@ -0,0 +1,94 @@
+---
+title: "Update Workspace Exclusions"
+description: "Bulk update which workspaces are excluded from organization-level input or output guardrails"
+api: "PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails"
+playground: none
+---
+
+Exclude or re-include workspaces from **organization-level input or output guardrails**. When a workspace is excluded, the corresponding org default guardrails are not applied to requests in that workspace.
+
+Choose the path based on which org-level defaults you want to change:
+
+| Entity | Endpoint |
+|--------|----------|
+| Input guardrails | `PUT /v1/workspace-exclusions/input-guardrails` |
+| Output guardrails | `PUT /v1/workspace-exclusions/output-guardrails` |
+
+Request body, validation, and response shape are the same for both.
+
+<Info>
+  Requires an Admin API key (`organisation-service`) with the `organisation_exclusions.update` scope. Only Organization Owners and Admins can be granted this scope.
+</Info>
+
+## Body Parameters
+
+<ParamField body="organisation_id" type="string" required>
+  Organization UUID.
+</ParamField>
+
+<ParamField body="workspaces" type="object[]" required>
+  List of workspace exclusion updates. Must contain at least one entry. Duplicate `workspace_id` values are rejected.
+</ParamField>
+
+<ParamField body="workspaces[].workspace_id" type="string" required>
+  Workspace UUID or workspace slug (for example, `ws-engineering`).
+</ParamField>
+
+<ParamField body="workspaces[].excluded" type="boolean" required>
+  Set to `true` to exclude the workspace from the selected org-level guardrails. Set to `false` to remove the exclusion and re-apply org defaults.
+</ParamField>
+
+<ParamField body="override_existing" type="boolean" default={false}>
+  When `true`, archives all existing active exclusions for that entity type in the organization, then applies the provided `workspaces` list. When `false` (default), only the listed workspaces are upserted.
+</ParamField>
+
+## Example Request
+
+### Exclude a workspace from org input guardrails
+
+```bash
+curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \
+  -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6",
+    "workspaces": [
+      { "workspace_id": "ws-sandbox", "excluded": true },
+      { "workspace_id": "ws-staging", "excluded": false }
+    ],
+    "override_existing": false
+  }'
+```
+
+### Exclude a workspace from org output guardrails
+
+```bash
+curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/output-guardrails \
+  -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "organisation_id": "6e44dcff-c77a-4325-a653-a77459f40aa6",
+    "workspaces": [
+      { "workspace_id": "ws-sandbox", "excluded": true }
+    ]
+  }'
+```
+
+## Example Response
+
+```json
+{
+  "success": true,
+  "data": {
+    "message": "Workspace exclusions for input guardrails updated successfully"
+  }
+}
+```
+
+The `message` text reflects the entity type you updated (`input guardrails` or `output guardrails`).
+
+## Related
+
+- [List Workspace Exclusions](/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions)
+- [Enforcing Org Level Guardrails](/product/administration/enforce-orgnization-level-guardrails)
+- [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) — includes `organisation_exclusions.update` / `.list`
diff --git a/docs.json b/docs.json
@@ -1205,6 +1205,13 @@
                   "api-reference/admin-api/control-plane/guardrails/delete-guardrail"
                 ]
               },
+              {
+                "group": "Workspace Exclusions",
+                "pages": [
+                  "api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions",
+                  "api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions"
+                ]
+              },
               {
                 "group": "Secret References",
                 "pages": [
@@ -2254,6 +2261,13 @@
                   "api-reference/admin-api/control-plane/guardrails/delete-guardrail"
                 ]
               },
+              {
+                "group": "Workspace Exclusions",
+                "pages": [
+                  "api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions",
+                  "api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions"
+                ]
+              },
               {
                 "group": "OpenAPI",
                 "pages": [

diff --git a/product/administration/enforce-orgnization-level-guardrails.mdx b/product/administration/enforce-orgnization-level-guardrails.mdx
@@ -1,38 +1,112 @@
 ---
 title: "Enforcing Org Level Guardrails"
+description: "Enforce organization-wide input and output guardrails, and exclude specific workspaces when needed"
 ---
+
 ## Overview
-Portkey enables organization owners to enforce request guardrails at the organization level. This feature ensures that all API requests made within the organization comply with predefined policies, enhancing security, compliance, and governance.
+
+Portkey enables organization owners and admins to enforce request guardrails at the organization level. This feature ensures that API requests made within the organization comply with predefined policies, enhancing security, compliance, and governance.
 
 ## How It Works
-Organization owners can define input and output guardrails in the Organization Guardrails section. These guardrails are enforced on all API requests made within the organization, ensuring uniform policy enforcement across all users and applications.
+
+Organization owners can define input and output guardrails in the **Organisation Guardrails** section. By default, these guardrails are enforced on API requests across workspaces in the organization.
 
 - **Input Guardrails**: Define checks and constraints for incoming LLM requests.
 - **Output Guardrails**: Ensure LLM responses align with organizational policies.
 
-The guardrails available here are the same as those found in the Guardrails section of the Portkey platform. Multiple providers are supported for setting up guardrails. For a detailed list of supported providers and configurations
+The guardrails available here are the same as those found in the Guardrails section of the Portkey platform. Multiple providers are supported for setting up guardrails.
 
-<Card title="Guardrials Docs" href="/product/guardrails">
-    Learn about the different Guardrails you can set up in Portkey
+<Card title="Guardrails Docs" href="/product/guardrails">
+  Learn about the different Guardrails you can set up in Portkey
 </Card>
 
-
 ## Configuration
+
 ### Setting Up Guardrails Requirements
+
 1. Head to `Admin Settings` on the Portkey dashboard
 2. Navigate to the `Organisation Guardrails` section
 3. Add your `Input` and/or `Output` Guardrails
 4. Save your changes
 
-Once configured, these guardrails will be enforced on all API requests across the organization.
+Once configured, these guardrails are enforced on API requests across the organization, unless a workspace is explicitly excluded (see below).
+
+## Workspace Exclusions
+
+Organization owners and admins can **exclude specific workspaces** from organization-level input and/or output guardrails. Exclusions are managed separately for input and output guardrails, so a workspace can opt out of one without opting out of the other.
+
+When a workspace is excluded from org-level input or output guardrails:
+
+- The corresponding organization default guardrails are **not applied** to requests in that workspace
+- Workspace-level guardrails (if configured) continue to apply independently
+
+This is useful when a workspace needs a different compliance posture—for example, an internal sandbox that should not inherit production org defaults.
+
+### Managing Exclusions via API
+
+Use the Admin API to list and update workspace exclusions. Paths differ by entity type (`input-guardrails` or `output-guardrails`):
+
+| Action | Endpoint |
+|--------|----------|
+| Update exclusions | `PUT /v1/workspace-exclusions/input-guardrails` or `.../output-guardrails` |
+| List exclusions | `GET /v1/workspace-exclusions/input-guardrails` or `.../output-guardrails` |
 
+<CardGroup cols={2}>
+  <Card title="Update Workspace Exclusions" href="/api-reference/admin-api/control-plane/workspace-exclusions/update-workspace-exclusions">
+    Exclude or include workspaces from org-level input or output guardrails
+  </Card>
+  <Card title="List Workspace Exclusions" href="/api-reference/admin-api/control-plane/workspace-exclusions/list-workspace-exclusions">
+    List workspaces excluded from org-level input or output guardrails
+  </Card>
+</CardGroup>
 
+### Permissions
+
+| Action | Roles | API scope |
+|--------|-------|-----------|
+| Update workspace exclusions | Organization Owner, Organization Admin | `organisation_exclusions.update` |
+| List workspace exclusions | Organization Owner, Organization Admin | `organisation_exclusions.list` |
+
+These scopes are available on **Admin (organisation-service) API keys** only. See [API Keys (AuthN and AuthZ)](/product/enterprise-offering/org-management/api-keys-authn-and-authz) for the full scope list.
+
+### Example: Exclude a workspace from org input guardrails
+
+```bash
+curl -X PUT https://api.portkey.ai/v1/workspace-exclusions/input-guardrails \
+  -H "x-portkey-api-key: $PORTKEY_ADMIN_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "organisation_id": "ORG_UUID",
+    "workspaces": [
+      { "workspace_id": "ws-sandbox", "excluded": true }
+    ]
+  }'
+```
+
+To remove an exclusion (re-apply org defaults to the workspace), call the same endpoint with `"excluded": false`.
 
 <Note>
-Best Practices
-- Clearly communicate guardrail requirements to all developers in your organization.
-- Maintain internal documentation on your guardrail policies to ensure consistency.
+**How exclusions interact with workspace guardrails**
+
+Workspace exclusions only clear **organization-level** defaults for that workspace. They do not remove or disable [workspace-level guardrails](/product/administration/enforce-workspace-level-guardials). Configure those separately in workspace settings if needed.
 </Note>
 
+## Related Features
+
+<Card title="Enforcing Workspace Level Guardrails" href="/product/administration/enforce-workspace-level-guardials">
+  Set default input and output guardrails for a specific workspace
+</Card>
+
+<Card title="Configure Guardrail Access Permissions" href="/product/administration/configure-guardrail-access-permissions">
+  Control who can view and manage guardrails within workspaces
+</Card>
+
+## Best Practices
+
+- Clearly communicate org-level guardrail requirements to developers in your organization.
+- Use workspace exclusions sparingly, and document why a workspace is opted out.
+- Prefer workspace-level guardrails when a team needs additional checks on top of org defaults, rather than excluding the workspace entirely.
+
 ## Support
-For questions about configuring metadata schemas or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord).
+
+For questions about configuring organization-level guardrails or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord).
diff --git a/product/administration/enforce-workspace-level-guardials.mdx b/product/administration/enforce-workspace-level-guardials.mdx
@@ -5,6 +5,10 @@ title: "Enforcing Workspace Level Guardrails"
 ## Overview
 Portkey allows workspace owners to enforce request guardrails at the workspace level. This feature ensures that all API requests made within a workspace comply with predefined policies, enhancing security, compliance, and governance at a more granular level.
 
+<Info>
+  Organization-level guardrails may also apply to your workspace. Org defaults are enforced unless the workspace is [explicitly excluded](/product/administration/enforce-orgnization-level-guardrails#workspace-exclusions) by an organization owner or admin. Workspace-level guardrails configured here still apply independently.
+</Info>
+
 ## How It Works
 Workspace owners can define input and output guardrails in the workspace settings. These guardrails are enforced on all API requests made within the workspace, ensuring uniform policy enforcement across all users and applications in that workspace.
 
@@ -34,5 +38,11 @@ Once configured, these guardrails will be enforced on all API requests within th
 - Maintain internal documentation on your workspace guardrail policies to ensure consistency.
 </Note>
 
+## Related Features
+
+<Card title="Enforcing Org Level Guardrails" href="/product/administration/enforce-orgnization-level-guardrails">
+  Apply organization-wide defaults, and exclude specific workspaces when needed
+</Card>
+
 ## Support
 For questions about configuring workspace-level guardrails or troubleshooting issues, contact [Portkey support](mailto:support@portkey.ai) or reach out on [Discord](https://portkey.sh/reddit-discord).
diff --git a/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx b/product/enterprise-offering/org-management/api-keys-authn-and-authz.mdx
@@ -53,6 +53,8 @@ Admin API Keys should be carefully managed and their use should be limited to ne
     | `secret_references.update` | Modify secret references |
     | `secret_references.delete` | Delete secret references |
     | `secret_references.list` | List secret references |
+    | `organisation_exclusions.update` | Update organisation workspace exclusions (for example, org-level guardrail exclusions) |
+    | `organisation_exclusions.list` | List organisation workspace exclusions |
   </Accordion>
 
   <Accordion title="Workspace Management" icon="folder-tree">