Policy: Restrict account-sensitive functionality with opt-in policy

[joshspicer]

Closes https://github.com/microsoft/vscode-internalbacklog/issues/6435

Introduces an Account Policy Gate that disables AI/chat features until:

1. The user is signed into a GitHub account in an admin-approved organization, AND
2. Account-side policy data has resolved.

Activated by the ChatApprovedAccountOrganizations MDM policy (JSON array of org logins; * is a wildcard). When unset, behavior is unchanged. Fail-closed: any unresolved state restricts.

How it works

• AccountPolicyService.computeGateInfo() returns { state, reason, approvedOrganizations } with reasons noAccount / wrongProvider / orgNotApproved / policyNotResolved (transient).
• Three enforcement layers: setForceHidden(true) on IChatEntitlementService, the chatAccountPolicyGateActive context key wrapping the chat view's when clause, and restrictedValue on policy definitions as defense-in-depth.
• Sessions app: full-screen SessionsPolicyBlockedOverlay (Sign In button + approved-org list) for the wrong-account state; defers to the welcome screen for noAccount/wrongProvider; progress bar for the transient loading state.
• Core VS Code: workbench notification with Sign In + Learn More actions; deferred until the default account resolves to avoid startup flash.
• Policy Diagnostics: new "Account Policy Gate" section.

Validation

• tsc + valid-layers-check clean
• 16/16 unit tests pass
• Manual testing: gate blocks chat, notification shows, account swap re-triggers, sessions overlay renders correctly

Manual test

defaults write com.microsoft.VSCodeInsiders ChatApprovedAccountOrganizations -string '["my-org"]'
# Restart, then run "Developer: Policy Diagnostics"
defaults delete com.microsoft.VSCodeInsiders ChatApprovedAccountOrganizations

[github-actions]

Screenshot Changes

Base: b88dca15 Current: d4fa3701

Added (6)

sessions/sessionsPolicyBlocked/Loading/Dark

sessions/sessionsPolicyBlocked/Loading/Light

sessions/sessionsPolicyBlocked/AccountPolicyGate/Dark

sessions/sessionsPolicyBlocked/AccountPolicyGate/Light

sessions/sessionsPolicyBlocked/AccountPolicyGateNoAccount/Dark

sessions/sessionsPolicyBlocked/AccountPolicyGateNoAccount/Light

[Copilot]

Pull request overview

Adds an “Account Policy Gate” that fail-closes AI/chat features until the user is signed into an admin-approved GitHub org and account policy data has resolved, and surfaces this state via UX + telemetry.

Changes:

• Introduces account-policy gate computation in AccountPolicyService and exposes it via IAccountPolicyGateService.
• Adds a workbench contribution to show notifications, set a chat context key, and emit telemetry based on gate transitions.
• Extends policy definitions with restrictedValue support and wires the gate/UX into desktop, web, and sessions entrypoints.

Show a summary per file

File	Description
src/vs/workbench/workbench.common.main.ts	Loads the account policy gate contribution in the workbench.
src/vs/workbench/test/browser/componentFixtures/fixtureUtils.ts	Updates default-account test fixture to include currentDefaultAccount.
src/vs/workbench/services/policies/test/browser/accountPolicyService.test.ts	Adds unit tests for the gate behavior and boot-race scenario.
src/vs/workbench/services/policies/common/accountPolicyService.ts	Implements gate computation + gated policy restriction behavior and exposes gate service/event.
src/vs/workbench/services/policies/browser/accountPolicyGateContribution.ts	Adds notification/telemetry/context-key adapter for the gate.
src/vs/workbench/services/policies/browser/accountPolicyGate.contribution.ts	Registers the gate UX contribution.
src/vs/workbench/services/accounts/browser/defaultAccount.ts	Exposes synchronous currentDefaultAccount getter.
src/vs/workbench/electron-browser/desktop.main.ts	Wires IAccountPolicyGateService and passes managed policy channel to account policy service.
src/vs/workbench/contrib/chat/common/actions/chatContextKeys.ts	Adds chatAccountPolicyGateActive context key.
src/vs/workbench/contrib/chat/browser/chat.contribution.ts	Adds policies/config for approved-org gate + restrictedValue for disabling AI.
src/vs/workbench/browser/web.main.ts	Registers IAccountPolicyGateService in web workbench.
src/vs/workbench/browser/actions/developerActions.ts	Extends Policy Diagnostics to include gate state/reason and raw policy.
src/vs/sessions/test/web.test.ts	Updates sessions test mock for currentDefaultAccount.
src/vs/sessions/sessions.common.main.ts	Loads the gate UX contribution for Sessions windows.
src/vs/sessions/electron-browser/sessions.main.ts	Wires IAccountPolicyGateService and passes managed policy channel to account policy service.
src/vs/platform/policy/common/policy.ts	Adds restrictedValue to policy definitions and helper to compute restricted defaults.
src/vs/platform/defaultAccount/common/defaultAccount.ts	Extends IDefaultAccountService with synchronous currentDefaultAccount.
src/vs/platform/configuration/common/configurations.ts	Plumbs restrictedValue from configuration policy to PolicyDefinition.
src/vs/editor/standalone/browser/standaloneServices.ts	Updates standalone default account service stub for new interface member.
src/vs/editor/contrib/inlineCompletions/test/browser/utils.ts	Updates inline-completions test stub for new interface member.
src/vs/base/common/policy.ts	Documents new restrictedValue field on policies.

Copilot's findings

Comments suppressed due to low confidence (1)

src/vs/workbench/services/policies/test/browser/accountPolicyService.test.ts:470

• This void Emitter; line is only present to silence the unused-import warning from the Emitter import above. Please remove both the unused import and this workaround to keep the test file clean.

	// Ensure unused import does not warn
	void Emitter;

• Files reviewed: 21/21 changed files
• Comments generated: 4

[Copilot]

Copilot's findings

Comments suppressed due to low confidence (1)

src/vs/workbench/services/policies/browser/accountPolicyGateContribution.ts:158

• NOTIFICATION_DISMISSED_KEY is read and removed, but never written. As a result, the “persisted dismissal” path can never be hit and the code comments about “Don't Show Again” are misleading. Either wire this up via IPromptOptions.neverShowAgain (which handles persistence) or remove the unused storage logic.

		if (info.state !== AccountPolicyGateState.Restricted) {
			this.notificationHandle.clear();
			this.dismissedKey = undefined;
			this.storageService.remove(NOTIFICATION_DISMISSED_KEY, StorageScope.APPLICATION);
			return;
		}

		if (!showNotification) {
			return;
		}

		// `policyNotResolved` is transient — don't show a notification for it.
		if (info.reason === AccountPolicyGateUnsatisfiedReason.PolicyNotResolved) {
			return;
		}

		// Build a composite key from the reason + current account name so that
		// swapping to a different account (while still blocked) re-shows the notification.
		const accountName = this.defaultAccountService.currentDefaultAccount?.accountName;
		const notificationKey = `${info.reason ?? ''}:${accountName ?? ''}`;

		// If the key changed (different reason or different account), close the old
		// notification and reset the session-scoped dismissal.
		if (this.dismissedKey !== undefined && this.dismissedKey !== notificationKey) {
			this.notificationHandle.clear();
			this.dismissedKey = undefined;
		}
		this.maybeShowNotification(info, notificationKey);
	}

	private maybeShowNotification(info: IAccountPolicyGateInfo, notificationKey: string): void {
		if (this.notificationHandle.value) {
			return; // already showing for this reason+account
		}
		if (this.dismissedKey === notificationKey) {
			return; // user dismissed for this reason+account this session
		}
		const persistedDismissed = this.storageService.get(NOTIFICATION_DISMISSED_KEY, StorageScope.APPLICATION);
		if (persistedDismissed === notificationKey) {
			return; // user clicked "Don't Show Again" for this same combo on this machine
		}

• Files reviewed: 30/30 changed files
• Comments generated: 6