Administration

Administration covers who can do what, how content is shared and seeded across environments, and how usage is tracked. It is the operational side of governance.

Access control & ownership

• RBAC — role-based access control governs who can see and do what.
• System vs user resources — system workflows/agents/prompts/chatbots are visible to all and read-only to most users; user resources are private to their owner.
• Workflow ownership — users own, edit, and delete their own workflows; they clone a system workflow (instantiate) to get a private, editable copy.
• Copy-on-write for packs — solution-pack components are system (read-only); "Customize" forks a user-owned copy (forked_from) that pack updates never overwrite.
• Authentication — email/password login, JWT with auto-refresh, protected routes, 401 → login.
• Google OAuth — users connect a Google account for Drive/Gmail; status check and revoke.

Seeding & templates

For deploying content across environments.

• Workflow seeding — import/export workflows as JSON.
• Prompt seeding — pre-load extraction prompts from JSON; system prompts shared to all users.
• Template management — ten built-in templates (KYC, Document Routing, Job Application, New-Hire Welcome, Policy Ingestion, Employee Q&A, Performance Reviews, the three Chatbot templates). Chatbot templates auto-create a Chatbot instance on instantiation.
• Solution packs — seed prompts → agents → workflows → squads in dependency order; tagged pack_slug / pack_version / is_system (see Solution Packs).

Usage & analytics

• Token consumption — AI token usage with estimated USD cost.
• Jobs executed — execution counts per user.
• Storage usage — document storage against quota.
• Workflow analytics — per-workflow execution count, success rate, average time, recent errors; time windows 24h / 7d / 30d.
• Execution tracking — real-time status, step-by-step timeline with inputs/outputs, node-level status (active, skipped, failed, completed), and resume of paused executions via correlation tokens (HITL).
• Dashboards — documents, workflows, executions, recent activity, system health.

Data protection

Data Shield tokenises PII before content reaches an LLM, and writes an immutable audit log (entity counts only). Operators search the admin audit dashboard across tenants; end users see their own activity at /account/activity. Tune retention with DATA_SHIELD_AUDIT_RETENTION_DAYS.