Administration

Use this page to understand who can do what, how content is shared and seeded across environments, and how usage is tracked. It is the day-to-day side of governance.

Access control and ownership

• RBAC — role-based access control governs who can see and do what.
• System vs user resources — system workflows/agents/prompts/chatbots are visible to all and read-only to most users; user resources are private to their owner.
• Workflow ownership — users own, edit, and delete their own workflows; they clone a system workflow (POST /activities/:id/instantiate) to get a private draft copy named "X (Copy)". Creating a workflow from a template is a separate endpoint (POST /workflow-templates/:id/instantiate).
• Copy-on-write for packs — Solution Pack components are system (read-only); "Customize" forks a user-owned copy (forked_from) that pack updates never overwrite.
• Authentication — email/password login, JWT with auto-refresh, protected routes, 401 → login.
• Google OAuth — users connect a Google account for Drive/Gmail; status check and revoke.

Seeding and templates

Use seeding and templates to deploy content across environments.

• Prompt seeding — pre-load extraction prompts from JSON; system prompts shared to all users.
• Template management — ten built-in templates (KYC, Document Routing, Job Application, New-Hire Welcome, Policy Ingestion, Employee Q&A, Performance Reviews, KB Ingestion (Documents), KB Ingestion (URLs), KB Chat Query). The KB templates (chatbot-*) auto-create a Chatbot instance on instantiation.
• Solution Packs — seed prompts → agents → workflows → squads in dependency order; tagged pack_slug / pack_version / is_system (see Solution Packs).

Usage and analytics

• Token consumption — AI token usage with estimated USD cost.
• Jobs executed — execution counts per user.
• Storage usage — document storage against quota.
• Execution tracking — real-time status, step-by-step timeline with inputs/outputs, node-level status (active, skipped, failed, completed), and resume of paused executions via correlation tokens (HITL).

Data protection

Data Shield tokenises PII before content reaches an LLM, and writes an immutable audit log (entity counts only). Operators search the admin audit dashboard across tenants; end users see their own activity at /account/activity. Tune retention with DATA_SHIELD_AUDIT_RETENTION_DAYS.