docs: add IP restriction guide (organization, folder, application)

docs/administration/index.md

@@ -6,5 +6,6 @@ Platform administration guides for managing workspaces, accounts, and platform r
 
 - [Account Management](account-management.md) - User accounts, organizations, and role-based access control
 - [Workspace Management](workspace.md) - Creating and managing workspaces and folders
+- [IP Restriction](ip-restriction.md) - IP allowlists at the organization, folder, and application levels
 - [Data Retention](data-retention.md) - Data retention policies and compliance
 - [Support](support.md) - Getting help and support resources

docs/administration/ip-restriction.md

@@ -0,0 +1,77 @@
+# IP Restriction
+
+IP restriction lets you define an IP allowlist that controls which client IPs can reach your resources.
+Requests whose client IP does not match the configured CIDR blocks are rejected at the routing layer, before they reach any application.
+
+You can apply IP restriction at three levels, matching the [account hierarchy](account-management) (Organization → Folder → Workspace, with applications running inside workspaces):
+
+- **Organization** — applies to every workspace in the organization.
+- **Folder** — applies to every workspace in a folder.
+- **Application** — applies to a single application.
+
+Organization- and folder-level restrictions are managed through the [Tailor Platform Terraform provider](https://registry.terraform.io/providers/tailor-platform/tailor/latest) (version `>= 2.16.0`). Application-level restriction is configured in the [application manifest](/guides/application).
+
+## How the layers combine
+
+When more than one layer is configured, a request must satisfy **all** of them — the layers compose with **AND**. For example, if both an organization-level and a folder-level rule exist, the client IP must match both allowlists to reach a workspace in that folder. A layer with no rule configured imposes no restriction at that level.
+
+## Organization level
+
+Use [`tailor_organization_ip_restriction`](https://registry.terraform.io/providers/tailor-platform/tailor/latest/docs/resources/organization_ip_restriction) to apply an allowlist across every workspace in the organization.
+
+```hcl {{ label: "organization_ip_restriction.tf" }}
+resource "tailor_organization_ip_restriction" "this" {
+  organization_id = "<organization_id>"
+  allowed_ip_addresses = [
+    "203.0.113.10/32", # a single public IP
+    "198.51.100.0/24", # a public subnet range
+  ]
+}
+```
+
+| Argument               | Type           | Description                                                                                                                                                       |
+| ---------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `organization_id`      | String         | The ID of the organization. Changing this forces replacement of the resource. **(required)**                                                                      |
+| `allowed_ip_addresses` | List of String | List of allowed IPv4/IPv6 addresses or CIDR blocks. Each entry must be a **public** address; private, loopback, and multicast ranges are rejected. **(required)** |
+
+## Folder level
+
+Use [`tailor_organization_folder_ip_restriction`](https://registry.terraform.io/providers/tailor-platform/tailor/latest/docs/resources/organization_folder_ip_restriction) to apply an allowlist to every workspace in a [folder](account-management#folders). This composes with any organization-level rule (AND).
+
+```hcl {{ label: "organization_folder_ip_restriction.tf" }}
+resource "tailor_organization_folder_ip_restriction" "this" {
+  organization_id = "<organization_id>"
+  folder_id       = "<folder_id>"
+  allowed_ip_addresses = [
+    "203.0.113.10/32",
+    "198.51.100.0/24",
+  ]
+}
+```
+
+| Argument               | Type           | Description                                                                                                                                                       |
+| ---------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `organization_id`      | String         | The ID of the organization that owns the folder. Changing this forces replacement of the resource. **(required)**                                                 |
+| `folder_id`            | String         | The ID of the folder. Changing this forces replacement of the resource. **(required)**                                                                            |
+| `allowed_ip_addresses` | List of String | List of allowed IPv4/IPv6 addresses or CIDR blocks. Each entry must be a **public** address; private, loopback, and multicast ranges are rejected. **(required)** |
+
+## Application level
+
+To restrict access to a single application, set [`AllowedIPAddresses`](/guides/application) in the application manifest. This applies on top of any organization- and folder-level rules.
+
+## Provider configuration
+
+The organization- and folder-level resources require the Tailor Platform Terraform provider:
+
+```hcl {{ label: "provider.tf" }}
+terraform {
+  required_providers {
+    tailor = {
+      source  = "tailor-platform/tailor"
+      version = ">= 2.16.0"
+    }
+  }
+}
+
+provider "tailor" {}
+```

docs/guides/application.md

@@ -13,7 +13,7 @@ In the spec property, the following child properties can be defined:
 
 - `Name`: The gateway name. Name of the gateway that will be used as the application's subdomain, e.g. setting `Name` to `my-app` will create API endpoints at `my-app-{WORKSPACE_HASH}.erp.dev/query`. Cannot duplicate a NAME that is being used by other users. **(required)**
 - `Cors`: The origins. Defines the origin to which requests are allowed.
-- `AllowedIPAddresses`: A list of IP addresses authorized to access the application, preventing unauthorized access. Each entry is a string in the format CIDR. Example: `["1.1.1.1/32", "2.2.2.0/24"]`.
+- `AllowedIPAddresses`: A list of IP addresses authorized to access the application, preventing unauthorized access. Each entry is a string in the format CIDR. Example: `["1.1.1.1/32", "2.2.2.0/24"]`. To restrict access more broadly across an organization or folder, see [IP Restriction](/administration/ip-restriction).
 - `Auth`: The authentication service. Defines the authentication service to be used.
 - `Subgraphs`: The services you use.