---
title: Organization artifact access
description: Control public artifacts and sharing outside your organization.
slug: /docs/artifact-access
group: organization
updatedAt: 2026-09-22
---

Organization Owners can prevent accidental public publishing and sharing with
people outside the organization. Open **Settings → Organization → Security** and
use the two controls under **External access**.

## Allow public artifacts

Turn this off to stop anonymous access to every owned artifact whose stored
visibility is Public. Members of the publishing organization can still open
those artifacts after signing in. Publishers must choose Company or Private for
new artifacts and updates while the restriction is active.

Existing artifacts keep their Public visibility label. This makes retained
state visible for review and means they become public again if an Owner later
turns the setting on. Use **Review public artifacts** before re-enabling access.

## Allow sharing outside the organization

Turn this off to stop guest access and prevent adding new outside email
recipients. Existing recipient entries remain visible and removable, but they
do not authorize access while the restriction is active. Organization members
and addresses from verified organization domains remain available.

This setting does not stop an Owner from inviting someone as an organization
member. Membership is a separate, explicit access boundary.

## Availability and plan changes

Creating either restriction requires Pro or Enterprise. A restriction remains
active if the organization later moves to another plan. Any Owner can turn
access back on, including after a downgrade.

When public artifacts remain disabled on Free, new Company and Private content
still uses the plan's gated-artifact allowance. At the limit, delete a gated
artifact, upgrade, or ask an Owner to allow public artifacts again.

## When a change takes effect

New publishes, updates, invitations, and guest credentials are blocked as soon
as the database change commits. Existing public and guest access normally stops
within one minute as the setting reaches the edge.

Display.dev cannot recall content that a viewer already downloaded or that an
older browser or shared cache retained. If the Security page says a change
still needs to be applied, retry the same setting; no additional audit event is
created for a repair.

## Recover from a blocked action

- For `public_artifacts_disabled`, choose Company or Private, or ask an Owner
  to enable public artifacts.
- For `external_sharing_disabled`, remove outside recipients, or ask an Owner
  to enable outside sharing.
- Owners change these settings only in the dashboard. The CLI and MCP tools do
  not expose policy-management actions.

See [Sharing and access](/docs/visibility) for artifact-level audiences and
[Plans and limits](/docs/limits) for gated-artifact limits.