How do I give finance or executives stricter Haven protection?
Short answer
Put them in their own Haven group and give that group a stricter policy: Active Enforce while everyone else is still monitored, more protected sites, a tighter extension allow list. A group's rules can tighten the organization's, never loosen them.
Why start with one team
The people who approve payments, run payroll or sign contracts get the most targeted phishing, and a fake vendor portal or payroll login costs the most when it works. Raising the bar for them doesn't have to mean raising it for everyone.
Steps
- Make a group. Add people by hand, or map an existing Workspace group so membership keeps itself current.
Connecting Google Workspace lets Haven map existing Workspace groups onto Haven groups so membership keeps itself up to date, and you can disconnect from the same page.
- Give the group its own policy.
A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's.
- Protect the sites that matter to them, such as your payroll system, banking portals and the vendor portals they pay through.
You can add your own sites to Haven's protected list, and an organization can add sites for its whole team. A site you add is protected whichever categories are switched on.
- Tighten the extension allow list.
Password managers are allowed to keep running on Protected sites by default. Once an organization adds its first allowed extension, its own allow list takes over: every extension not on it, password managers included, is paused on Protected sites.
- Lock what shouldn't change.
Every category and site an organization picks for Protected sites is Required by that organization: always Protected for every member it reaches, and members can't turn it off.
How rules combine
In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them.
Check what someone actually gets
Admins can open a member in the Haven console to see which sites are Protected for them and why, on the member's own page; the Protected sites page shows the same for a group through its scope picker.
Using the same trick for a pilot
A pilot works the same way: leave the organization in Monitor-only and switch just the pilot group to Active Enforce.
How Haven handles this
- Connecting Google Workspace lets Haven map existing Workspace groups onto Haven groups so membership keeps itself up to date, and you can disconnect from the same page.Verified by engineering October 28, 2026
- A Haven group can carry its own enforcement mode, its own Protected categories and sites, an extension allow list and settings, so one organization can hold different teams to different policies. A group's categories and sites reach its members as Required, on top of the organization's. A group's rules can make it stricter than the organization, not looser: a group set to Monitor-only does not relax an organization that is enforcing.Verified by engineering October 29, 2026
- You can add your own sites to Haven's protected list, and an organization can add sites for its whole team. A site you add is protected whichever categories are switched on. An organization can add up to 30 of its own protected sites, at no extra cost.Verified by engineering October 28, 2026
- Password managers are allowed to keep running on Protected sites by default. Once an organization adds its first allowed extension, its own allow list takes over: every extension not on it, password managers included, is paused on Protected sites. Applies to Haven Business organizations.Verified by engineering October 29, 2026
- Every category and site an organization picks for Protected sites is Required by that organization: always Protected for every member it reaches, and members can't turn it off. There is no separate lock or Required switch. To stop requiring something, an admin removes the row, or unticks single sites inside a category, on the Protected sites page.Verified by engineering October 29, 2026
- In a Haven organization, what the organization or a group requires is Protected for every member it reaches, whatever the member would choose: members can't turn it off. A member's Protected sites are everything the organization and each of their groups require, added together. Where organization and group settings disagree on enforcement or a setting, Haven applies the more protective, and someone in several groups gets the most senior role and the most protective policy of any of them. Allowed extensions work the other way: a group's list adds to the organization's allow list for that group.Verified by engineering October 29, 2026
- Admins can open a member in the Haven console to see which sites are Protected for them and why, on the member's own page; the Protected sites page shows the same for a group through its scope picker.Verified by engineering October 29, 2026