> ## Documentation Index
> Fetch the complete documentation index at: https://docs.envzero.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Controls for repository custom flows

> Choose whether env0.yml files in your repositories run, limit pull request custom flows to verified users, and manage custom flows with a new permission.

> [!WARNING]
>
> **Terraform users:** add `MANAGE_CUSTOM_FLOWS` to the `permissions` of each `env0_custom_role` resource that has `EDIT_PROJECT_SETTINGS` or `EDIT_ORGANIZATION_SETTINGS`. env zero adds the permission to those roles, so otherwise your next `terraform plan` shows a change that removes it, and applying that plan removes custom flow access from the role. Do not add it to other roles unless you want them to manage custom flows.
>
> **Self-hosted agents:** upgrade to version 3.0.284 or later before you select **Block**, and to version 5.5.13 or later before you select **Verified users only**. On older agents, affected deployments fail with an error that asks you to upgrade the agent.

These controls are rolling out to organizations.

## Repository Custom Flows policy

A new organization policy, **Repository Custom Flows** in **Organization Settings > Policies**, controls whether `env0.yml` files in a template's repository run:

* **Allow**: `env0.yml` files run, as before. This is the default.
* **Verified users only**: a pull request's changed `env0.yml` runs only for a verified VCS user with the Run Tasks permission on the environment. Otherwise env zero runs the tracked branch's `env0.yml` and comments on the pull request with the reason. Deploying a revision other than the tracked one, with a different `env0.yml`, also needs the Run Tasks permission.
* **Block**: `env0.yml` files never run. Only custom flows assigned in env zero run.

To become a verified VCS user, click **Connect** for your VCS provider in **Personal Settings > VCS User IDs** and sign in to your VCS account.

## Manage Custom Flows permission

Custom flows now have their own permission, **Manage Custom Flows** (`MANAGE_CUSTOM_FLOWS`). It is needed to create, edit, delete, assign and unassign custom flows. Organization Admin and Project Admin have it, and env zero adds it to every custom role that can edit project or organization settings.

Roles that have only environment permissions (for example Project Deployer, Environment Deployer and Environment Admin) can still read custom flows, but can no longer create, edit or delete them. Add `MANAGE_CUSTOM_FLOWS` to a custom role to give it that access.

Learn more: [Repository custom flows](https://docs.envzero.com/guides/admin-guide/custom-flows.md#repository-custom-flows), [Custom roles](https://docs.envzero.com/guides/admin-guide/user-role-and-team-management/custom-roles.md#project-permissions)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.