Administration

Administration is where an owner or an administrator changes something for the whole organisation — who belongs to it, what it allows, where its data lives, and how its fleet stays current. A member who is neither reaches none of these screens: the server refuses every one of them, and the refusal does not depend on which client asked.

Get things done

• Members and access requests — invite a colleague, change or remove a role, and decide a request to join from one of your join domains.
• Organisation policies — the product switch, delegation to coding agents, where model calls may be processed, plugin policy, the model allowlist, bring-your-own-key, and template sharing, with the audit row each one writes.
• Customer-managed keys — on an Enterprise team, put the organisation's data under your own EU key, and what happens when you revoke it.
• Data residency and rights — the residency policy as an enforced control, how long each kind of record is kept, and how a member's export or erasure request is answered.
• Activity export of usage — send model calls, run errors, billing corrections, and token and cost-estimate metrics to your own OpenTelemetry collector, one switch per kind.
• Stream the audit log to an HTTPS webhook, Amazon S3, Splunk or Sumo Logic — every new entry within a minute.

Reference

• The administrator security baseline — eight settings to review before the first member signs in.
• Identity and device trust — how members sign in, and the device-trust rule a bot's computer needs from your identity provider.
• Team Setup manifests — the setup scripts every team computer runs, and the second-admin approval that ships a change to them.
• Reaching a private network — the exercised recipe for a bot's computer to reach a service on your own network.
• Reading the security-review documents — what the generated compliance documents answer, and what this product does not claim.
• Downloading and updating the desktop app for a fleet — the artefacts, the signed update feed, and the update track.
• Deploying the desktop app across an organisation — pinned installer addresses, Jamf Pro, Kandji, Intune, the silent Windows install, holding the Linux package, and the Update required screen.
• Opening the network path — the hosts to allow on a secure web gateway, exempting them from TLS inspection and buffering, and the checks to run from a member's device.