> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/approved-countries.md).

# Approved Countries

Declare the countries you expect Git and pull-request activity from, so activity from anywhere else raises a behavioral check.

Heeler records the country each piece of Git and pull-request activity came from. On its own that's a filter; once you tell Heeler which countries you *expect*, it becomes a control. **Administration → Program → Approved Countries** is where you declare that expectation, per GitHub organization. Activity that reaches a repository from a country outside the declared set raises the high-severity [**Activity from unapproved country**](/mrecEO40m5D6bt7Pq5pE/findings/behavioral-checks.md) check.

{% hint style="info" %}
Changing anything on this page requires the **Administrator** role. An **Administrator (read-only)** can view it but can't make changes.
{% endhint %}

## How the country is determined

The country comes from your provider's own audit record for the event. **Heeler does not geolocate IP addresses** — there is no lookup, no inference, and no third-party geo service in the path. If the provider recorded no country for an event, the event carries none rather than a guess.

## Declaring your approved set

Each **GitHub organization** on your connections gets its own list, because expectations differ: a US-only subsidiary and a globally staffed platform team don't share a baseline. Only GitHub organizations appear here — other connection types don't supply the audit records this check reads.

Pick countries by name; Heeler resolves the provider's country codes to names so you aren't matching on `SG` or `BR` by hand.

{% hint style="warning" %}
**The check is dormant until you declare a list.** An organization with no approved countries raises nothing — an empty list means "no expectation stated", not "no country is allowed". This is deliberate: it keeps an unconfigured tenant quiet instead of flagging all of its activity.
{% endhint %}

## What a detection looks like

A detection is scoped to the **organization**, not to a single repository, and carries the audit events behind it as evidence: the actor, the credential, and the repositories the activity touched.

Because the check reads the same activity as the rest of [Behavioral Checks](/mrecEO40m5D6bt7Pq5pE/findings/behavioral-checks.md), you triage it the same way: open it, read the events, and mark it **Trusted** if the activity is expected. Trusting one detection doesn't change the policy — if the country is legitimately yours now, add it here.

## Getting told about it

Pair the policy with a workflow so an unapproved-country hit reaches someone. The **New Behavioral Detection** trigger fires on new behavioral checks, including this one, and can open a ticket or post to Slack at the severity you choose — see [Triggers](/mrecEO40m5D6bt7Pq5pE/operate/workflows/triggers.md).

## Related

* [Behavioral Checks](/mrecEO40m5D6bt7Pq5pE/findings/behavioral-checks.md) — the full detection catalog and how activity becomes a check.
* [Triggers](/mrecEO40m5D6bt7Pq5pE/operate/workflows/triggers.md) — routing a detection into Slack or a ticket.
* [Trusted Domains](/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/trusted-domains.md) — the other program-policy list that changes how Heeler scores what it sees.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/administer-and-monitor/program-policy/approved-countries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.