Reference

Settings

Settings is where you configure your organisation as a whole and secure your own account: the organisation profile and governance defaults, your subscription, account security, single sign-on, and personal API tokens. Most organisation-wide sections are owner-gated; the security section is always about your own login.

Organisation

The Organisation page holds the settings that apply to everyone in the workspace. You can edit the organisation's name and pick its timezone from the grouped IANA list (UTC by default). The timezone is more than display polish. It drives when scheduled work is considered due and how times are shown across the app.

Two controls here shape governance directly:

• Require two-factor authentication: when on, every member must have 2FA enabled to use the organisation. This is enforced when a member's tenant context is resolved, not just suggested.
• Proposer cannot approve (segregation of duties): when on, the person who proposes an action cannot also approve it, so a second pair of eyes is always required at the approval gate.

The same page carries Providers & data controls: the allow-list of model providers your agents may use, an opt-out flag for provider data retention (zero-retention), and the retention windows for run history and audit logs. Retention is bounded. There is a compliance floor you cannot go below and a plan-derived ceiling you cannot exceed.

The organisation's slug is shown but is immutable; it cannot be changed here.

Billing & subscription

Billing shows your current plan, subscription status and trial state, plus usage against your plan's limits. The change-plan flow, payment methods and invoices are handled through Stripe.

The key actions:

• Subscribe to a plan: you are sent to Stripe Checkout; your local subscription is created when Stripe confirms by webhook, so the page may briefly wait and refresh after you return. Where the Terms of Service requires it, you must accept the terms to subscribe, and that acceptance is recorded with the exact version agreed.
• Change plan: upgrade or downgrade your live subscription. The self-serve catalogue excludes sales-assisted tiers; Enterprise stays as a "contact us to scale up" option.
• Cancel: cancels at period end, so access continues through the grace period; you can resume any time before that period ends.
• Billing portal: manage your payment method and view invoices in Stripe's hosted portal.

The usage meters you see (seats, workers, integrations, governed repositories, runs, actions) come from the same evaluation point that enforcement reads, so what's displayed is exactly what the limits act on. You are never shown a token or raw-cost gauge. A trialling organisation that has never checked out has no billing account yet, so the page explains that rather than offering a portal link that would fail. If a trial ends without a valid subscription, usage is locked until you subscribe. Billing and checkout stay reachable so you can unlock it.

Account security

Unlike the organisation-wide pages, Security is about your own account. From here you can:

• Change your password: updating it automatically revokes all your other sessions; the session you're using stays signed in.
• Manage two-factor authentication: enable or confirm 2FA (subject to platform configuration). If your organisation requires 2FA, this is where you satisfy that requirement.
• Manage passkeys: where passkeys are enabled, review your registered authenticators with their created and last-used times.
• Review active sessions: see each signed-in device with a device summary, IP address and last-active time, and revoke any session that isn't the one you're currently using.

Session listing and per-device revocation are available when the database session store is in use; otherwise that section is hidden. Raw session identifiers never reach your browser, only a hashed reference used for the revoke action. The Security page (and the revoke action) are protected by a password re-confirmation step.

Single sign-on

Single sign-on (SSO) lets your identity provider (IdP) mint sessions into the organisation, and lets a SCIM bearer token write your directory. You can configure one or more connections using SAML or OIDC, enable or disable them, edit their attribute and role maps, and issue or revoke SCIM tokens for provisioning.

Each connection summary gives you the URLs to paste into your IdP console, along with the login URL. For SAML that means the ACS URL, metadata URL and SP entity ID; for OIDC the callback URL. Public fields (endpoints, certificates, client IDs) are shown so you can edit without re-typing. Secrets are write-only: an OIDC client secret or SAML private key is reported only as "configured" and is never echoed back; leaving a secret blank when editing keeps the stored value.

Role mapping can resolve a group claim to any role except owner — a group claim can never escalate to owner. A freshly issued or rotated SCIM token is shown exactly once, immediately after creation; copy it then, because it cannot be retrieved again.

API tokens

API tokens are personal access tokens you create for the organisation you're currently acting in, for scripts and integrations that call the API. You give a token a name and choose its abilities from the permission groups you actually hold here; a token is a delegation of your own authority and can never grant more than you have.

Expiry is mandatory: tokens default to 90 days and may live at most 365 days. The plaintext token is displayed only once, right after creation. Copy it then, because afterwards only its hash is stored. The list shows each token's abilities, last-used and created times, expiry, and whether it has expired; revoke any token from here.

Tokens are scoped to a single organisation, so the abilities offered and the tokens listed are always for your current workspace. If your membership is removed, or a role change strips an ability a live token carries, the affected tokens are automatically revoked.

Next steps