Org defaults & guardrails
Org-wide policy for the bypass engine lives on one settings screen - Bypass Org Settings - editable by users with the ControlLayer_Settings_Admin permission set.
Every setting is optional. A blank value means the shipped default applies. Guardrails are enforced server-side at window creation and reflected live in the wizard.
Settings
Max Duration (Hours)
Applies to indefinite windows only - windows submitted without an end time. When set, the engine stamps end = activation time + this many hours at activation (at creation for immediate windows, at the activation pass for scheduled ones). It is a default for the indefinite case, not a cap on explicit end dates: a window submitted with an explicit end further out is respected.
Blank: no org maximum - indefinite windows stay indefinite.
Require End Date
When checked, the org disallows indefinite windows. Interaction with Max Duration:
| Require End Date | Max Duration | Indefinite request is… |
|---|---|---|
| ✔ | Set | Auto-filled to the default duration |
| ✔ | Blank | Rejected at creation |
| ✘ | Set | Auto-filled to the default duration |
| ✘ | Blank | Allowed, stays indefinite |
The wizard marks its end-date input required whenever this is on.
Max Objects Per Request
Maximum number of objects a single window may cover. Enforced at creation and surfaced in the wizard's live meter. Blank: shipped default of 5.
Enforcement values have a hard 255-character platform ceiling per scope. ControlLayer never truncates - a window that would overflow is blocked at submission. The per-window object limit keeps you well clear of the ceiling; the recommended operational pattern is small, focused windows (often one object at a time).
Retry Ceiling
How many automatic recovery attempts a failed window gets before it stops retrying and waits in Error status for an admin. Blank: shipped default of 3. See Window lifecycle for the full error path.
Recommended starting policy
- Require End Date: on - indefinite bypasses should be a deliberate exception, not a habit.
- Max Duration: 24 hours - long enough for any realistic data operation, short enough to be self-limiting.
- Max Objects: default (5) - raise it only when a real migration demands it.
- Retry Ceiling: default (3).