> ## Documentation Index > Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt > Use this file to discover all available pages before exploring further. # Govern every agent > The controls you set once and every agent inherits. Admins set these controls once, and every agent inherits them. Screenshots show sample data. ## Who may do what **Platform > Organization > Members & groups** gives each member a role and puts members in groups with shared defaults. | Role | What they do | | - | - | | **Root access** | Everything, including organization settings and members | | **Admin** | Manage members, skills, providers, budgets and the settings on this page | | **Member** | Use and assemble agents within what admins allow | Invite members by email. With single sign-on, groups can follow your identity provider's groups (OIDC group sync), so joiners and leavers are handled in your directory. ![Members & groups page listing members with role and status](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-members.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=34f8b99d162c7db690dde7f962054778) Platform > Organization > Members & groups. Shown with sample data. ## Sign-in | Deployment | Sign-in options | | - | - | | Cloud and hybrid | Email code, Google, GitHub, or your own identity provider over OIDC (**Platform > Organization > Access**, an enterprise feature) | | Air-gapped | A bootstrap password, email codes, or your OIDC provider, all inside the perimeter | Registration on xpander's cloud is self-serve and free at chat.xpander.ai. Hybrid and Air-Gapped organizations are set up by their own admins. Setup: [SSO with your identity provider](https://docs.xpander.ai/self-hosted/sso.md). ![Access page with Single sign-on, Roles and API keys tabs and the identity provider settings](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-access-sso.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=b54ff714c8376a75f479b3eb0fe877e1) Platform > Organization > Access > Single sign-on. Shown with sample data. ## Skills: what an agent may reach Admins decide which skills exist and how each connects. **Add skill** on an agent offers only those. Adding a skill to an agent needs no approval. Admins can set any skill to **Off**, which removes it from every agent and refuses its calls. Skills served over MCP follow the same rule. | Connection | Whose permissions | | - | - | | Organization-wide | One shared account's | | Personal | Each person's own, where systems allow | ![Skills registry admin page with Connect clients, Agent-built skills and Add item, and items with their type, source and setting](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-tool-repo.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=3f14ba28efb02c2e5cb19517253a4b47) Platform > Agents > Skills registry: what agents and clients can call, each item's type, source and setting. Shown with sample data. **Platform > Agents > Skills registry** controls: | Control | What it does | | - | - | | **Add item** | Adds a library skill, your own API from an OpenAPI spec, a Markdown skill (written, or imported from `SKILL.md` or a ZIP) or an MCP endpoint | | **Agent-built skills** | **Agents build skills** off: no agent can build one, existing items stay. **Publish without approval** off: an agent-shared item waits for an admin. On a self-hosted install, the same two switches are also on **Platform > Organization > License**, under **Organization features**, as **Agent-built skills** and **Publish agent-built items without approval** | | **Connect clients** | One address for Claude Desktop, ChatGPT or any MCP client, with each person's own sign-in. On Air-Gapped it needs `global.mcp.publicUrl` in the install values | | Item setting | **Auto-injected**, **On by default**, **Optional** or **Off**, with the audience that sees it | Agents can build custom functions, Markdown skills and API skills as drafts, test them and publish them here. ## Approvals: risky actions wait for a named person | Control | What it holds | | - | - | | On a skill, "These actions need approval" | The listed actions, with who approves | | **Gated commands** | On Claude Code, Codex or OpenCode: any shell command matching a pattern | | Permission mode (**Approvals** in the composer) | **Manually approve** holds shell commands, file changes, and web fetches and searches on Claude Code and OpenCode. Gated commands wait in both modes | ![Approvals page with Waiting for you and Decided lists](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/settings-approvals.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=72fdea4fbf3824785f6e785b76269f12) Settings > Approvals: Waiting for you and Decided. Shown with sample data. With no decision within the hold window (four hours by default, configurable), the action does not run and the run continues. A later decision can still approve a pending gated command. Every decision is recorded with the approver's name, including self-approvals allowed for unattended agents. See [Approvals](https://docs.xpander.ai/use/approvals.md). ## Credentials: the agent never holds a secret **Platform > Agents > Secrets** stores every credential encrypted. Agents reference a secret, and the value is injected at the moment of use, never in the prompt, files or record. An external vault (Azure Key Vault today) can be the source. Model provider keys live under **Platform > AI governance > Models** and follow the same rule. ![Secrets page with Storage locations, Bulk add and Add secret, and the list of secret names with location, access and last update](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-secrets.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=7b1f73068a66f410a2a5a1cbd0badb5e) Platform > Agents > Secrets: names, location and access; values are never shown. Shown with sample data. ## Models Every model call goes through the [LLM Gateway](https://docs.xpander.ai/run/llm-gateway.md). Agents reach only the providers and models you configure in **Platform > AI governance > Models**, which shows the gateway's **Base URL**, each provider's key status (**Connected** or **Needs a key**) and who may use each model. A call to a provider with no key is refused with a message naming it. Every call is logged in **Platform > AI governance > Logs**. ![Models page with Base URL and a Providers table showing Connected and Needs a key](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-models.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=a6472228a32d2daca5d02f894eb724e6) Platform > AI governance > Models: the Base URL and each provider's key status. Shown on an Air-Gapped install, where the Base URL is [http://llm-gw:4000](http://llm-gw:4000). On a Hybrid install with the release name `xpander`, it is [http://xpander-llm-gw:4000](http://xpander-llm-gw:4000). Shown with sample data. ## Budgets Set limits in **Platform > AI governance > Budgets** for the organization, groups, members, API keys and agents ([Budgets](https://docs.xpander.ai/run/llm-gateway/budgets-and-blocks.md)). See spend in **Platform > AI governance > Usage**. A call that would exceed a blocking budget is refused and says so. ![Budgets page with an overview and tabs for Groups, Members, API keys, Agents and End users](https://mintcdn.com/xpanderai-099931d1/wqIIXSsh0kqA2hZ_/images/verify/platform-budgets.png?fit=max\&auto=format\&n=wqIIXSsh0kqA2hZ_\&q=85\&s=8ba6fbe191c7f88779cc3fc347960627) Platform > AI governance > Budgets: overview and spending limits by scope. Shown with sample data. ## Access to agents and what leaves the workspace Each agent is Private, a group, or **Org-wide**. **Manage access** names who may use it. ![Manage access drawer with visibility options Private, Group and Org-wide](https://mintcdn.com/xpanderai-099931d1/H-WYYv839kjeMNSx/images/use/09-manage-access.png?fit=max\&auto=format\&n=H-WYYv839kjeMNSx\&q=85\&s=8c41305b92120cb60b3c94c116d452e3) Manage access on an agent: private, a group, or the whole organization. Shown with sample data. ## The record | Place | What it holds | | - | - | | **Every task** | Every message, skill call with parameters and result, and model call with cost, under the person who asked. Also over the API: `GET /v1/tasks/{id}/thread` and `/llm_usage` | | **Platform > AI governance > Audit log** | Organization events with who did them: agents, skills, vault secrets, users and invitations, groups and OIDC sync, conversation sharing, organization settings. Filterable, exportable as CSV or JSON | Records live in xpander's cloud, or in your cluster on hybrid and air-gapped installs. See [Audit and debugging](https://docs.xpander.ai/use/agents/audit.md) and [Access control](https://docs.xpander.ai/resources/security-compliance/access-control.md). ## Change settings by asking Omni Admins can ask Omni to change most of these settings, from the [Omni sidekick](https://docs.xpander.ai/use/omni-sidekick.md#change-organization-settings-admins) or an [MCP client](https://docs.xpander.ai/guides/deploy/omni-mcp.md#admin-actions). Omni stays within your role, shows each change before and after, applies it only after you confirm, and records it in **Audit log** under your name. ## Where each control lives | Control | Setting | | - | - | | Roles and members | Platform > Organization > Members & groups | | Sign-in and identity provider | Platform > Organization > Access. Self-hosted: [SSO](https://docs.xpander.ai/self-hosted/sso.md) | | Skills your organization made available, including MCP endpoints | **Platform > Agents > Skills registry**, Add skill on the agent, Settings > Skills > **MCP servers**, Settings > Connections | | Approvals, gated commands, hold time | Skill panel, Agent settings > Advanced > Commands, each approver's Settings > Approvals | | Credentials | Platform > Agents > Secrets, workspace secrets on the agent ([Credentials](https://docs.xpander.ai/use/agents/credentials.md)) | | Models and provider keys | Platform > AI governance > Models | | Budgets and usage | Platform > AI governance > Budgets and Usage | | Who may use an agent | ACCESS row and Manage access | | Record | Session Manager, Platform > AI governance > Logs and Audit log | | Where agents run | Sidebar ENVIRONMENTS switcher, Platform > Agents > Runtime | ## Next steps > **[Set budgets and blocks](https://docs.xpander.ai/run/llm-gateway/budgets-and-blocks.md)** > > Spending limits. > **[Set up single sign-on](https://docs.xpander.ai/self-hosted/sso.md)** > > Connect your identity provider. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.