What You Can Configure in Platform Admin
Everything a tenant offers its users is set in Platform Admin under Tenants → <tenant>. The tenant page shows one card per area; the pencil on a card opens that area's editor, with a Form tab and a JSON tab for the same settings.
| Task | Where in Platform Admin | Guide |
|---|---|---|
| Create a tenant | Tenants → Create tenant | Creating a new tenant |
| Add language models | LLM Configurations card | Managing LLM models |
| Store API keys and passwords | Secrets card | Storing secrets |
| Create and edit agents | Agent & LLM Overview card | Creating and editing agents |
| Let agents write Word files, build PowerPoint decks and read Excel formulas | Agent editor, Capabilities → Tools | User Document Tools, Presentation Tools, DataFrame Tools |
| Connect Outlook, GitHub and other MCP servers | MCP Servers card, and the agent editor | Connecting MCP servers |
| Decide who gets which agents, models, indexes and tools | Who can use it on each agent, model, index and MCP server, Access rules card | Controlling who can use what |
| Make agents ask before they act | Agent editor, setting rules on the Access rules page | Requiring approval for actions |
| Restrict what documents with a confidentiality label allow | Edit Tenant JSON, features.confidentiality_settings: restrictions per label, and for unmapped labels | Tool rules |
| Place agents in the Navigator and set how chat looks | Client Settings and Features cards | Customizing the chat |
| Brand the Navigator | Client Settings card | Branding the Navigator |
| Choose which gated capabilities the agent editor offers | Features card | Tenant-wide agent settings |
| Let Claude Code, Cursor and other apps use the tenant | MCP Server Setups and OAuth clients cards | Exposing the tenant over MCP |
| Search indexes and their filters | Indexes in the left menu | Creating a custom index, Configuring search filters |
| Ingest documents | Content Sources and Workflows in the left menu | Configuring ingestion |
| Sign-in method and anonymous access | Authentication card | Creating a new tenant |
| Document storage | Storage card | Creating a new tenant |
| API keys for integrations | The Navigator's Management → Users | Generating API keys |
Who can change what
Platform Admin roles are per tenant:
| Role | Can |
|---|---|
viewer | Read the tenant's configuration |
analyst | Also read document content |
maintainer | Also change the configuration and run reingestion |
admin | Everything, including editing documents and users' roles |
Assign roles under Users → <user> → Edit Roles. The roles card shows only on installations that enable role control; elsewhere every Platform Admin user can do everything.
When changes take effect
A save writes the tenant at once. The Navigator reads tenant settings through a cache, so a change can take up to a minute to show.