# Single sign-on and fail-closed repos

> 2026-10-19 · CLI 0.5.2 · New, Fixed, Security · https://comity.so/changelog/2026-10-19-sso-and-fail-closed

Sign in through your identity provider, and make a repo require Comity before agents can edit it. Update the CLI with `comity update`.

## New

**Single sign-on.** Business and Enterprise orgs can sign in with Okta, Microsoft Entra ID, Google Workspace, Auth0 or any OpenID Connect provider, and require it for their team. Set it up in **Settings → Single sign-on**. [Docs](/docs/admin/sso)

**Fail-closed repos.** Set **Settings → Policy → When Comity is unreachable** to **Block edits**, and agents won't edit that repo while Comity can't be reached. `comity fail-open` is the emergency override, and every use shows up in the audit log. [Docs](/docs/how-it-works#fail-closed)

## Fixed

**Repo policy overrides.** Saving a repo's policy now stores only the rules you changed, so everything else keeps following the org default. [Docs](/docs/admin/policies#where-policies-live)