Manage CAT Pilot with Group Policy

Turn CAT Pilot off, or limit which AI providers it may use, on machines you manage.

CAT Pilot is the AI assistant built into CAT Studio. When a user chats with it, project content goes to an external AI provider — OpenAI, Anthropic, or GitHub Copilot, whichever the user configured. Through its data-query tool, CAT Pilot can also read real rows from the project’s data sources and send them to the provider.

On machines your organization manages, you may need to turn this off or restrict it. CAT Studio supports the standard Windows way to do that: Group Policy, with an ADMX/ADML administrative template. It is the same mechanism Visual Studio, VS Code, Office and Chrome use, so it works with the tooling you already have — Group Policy Editor, Active Directory, or Intune.

CAT Studio reads the policy once, at startup. Users must restart CAT Studio before a policy change takes effect.

What you can control #

• Turn CAT Pilot off. The CAT Pilot button and panel disappear, no chat can be created, and no AI provider can be contacted. The block sits in front of every outbound AI call, not just in the visible UI.
• Allow only specific providers. List the providers CAT Pilot may use; everything else is blocked — including providers added in future CAT Studio versions, until you add their identifier. A provider a user has already configured is not deleted when it becomes blocked; it shows in Settings as “Blocked by your organization”, so nothing is lost if you later relax the policy.

There is no “metadata only” mode. CAT does not parse the queries it runs, so it cannot promise that a query reads no data — a setting that made that promise would be false. If your organization cannot accept data leaving the machine, turn CAT Pilot off.

Registry contract #

At startup, CAT Studio reads these values from the machine hive:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\justcat.it\CAT Studio\CatPilot

The ADMX template below writes this same key — so if you prefer to script your deployment instead of clicking through the Group Policy Editor, write the values directly.

Disabled wins when both are set.

Only HKEY_LOCAL_MACHINE is read. There is no per-user override, so a standard user cannot loosen a policy you set.

Provider identifiers #

Use these in AllowedProviders, one per line:

• openai
• anthropic
• githubCopilot

Download the templates #

• CAT.admx
• CAT.adml (en-US)

Both policies appear in the Group Policy Editor under justcat.it → CAT Studio → CAT Pilot.

Deploy the templates #

Local Group Policy Editor (single machine) #

1. Copy CAT.admx to %SystemRoot%\PolicyDefinitions.
2. Copy CAT.adml to %SystemRoot%\PolicyDefinitions\en-US.
3. Open gpedit.msc and go to Computer Configuration → Administrative Templates → justcat.it → CAT Studio → CAT Pilot.

Active Directory Central Store (domain-wide) #

Copy the same two files into your domain’s Central Store (\\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions and its en-US subfolder); every domain-joined machine picks them up automatically. If you don’t have a Central Store yet, see Microsoft’s guide to creating one.

Microsoft Intune (cloud-managed devices) #

Import CAT.admx/CAT.adml as an Intune custom ADMX profile, then configure the two CAT Pilot policies like any other imported template.

After deploying #

Push the policy to the target machines and have each user restart CAT Studio. The new state — button hidden, or specific providers blocked — applies from the next launch.