Organisations and sign-in
One installation of Labtagon AI OS can hold several organisations. Each has its own people, groups, policies, settings, branding, LLM providers, models and clients. A person belongs to one organisation; there is always a main organisation.
Platform and Control Panel
Section titled “Platform and Control Panel”Under Administration in the switcher there are two apps (ADR 0073):
- Platform, for platform administrators only: Overview, Network status, Organisations, the runtime (Parts, Machines, Namespaces, Running servers, Database, Builds and checks), External services, and the installation’s Settings and Branding.
- Control Panel, one organisation’s: everything this handbook describes. A platform administrator picks the organisation in the header.
Who belongs where
Section titled “Who belongs where”AI OS places a person in an organisation in this order:
- an address an administrator assigned by hand (People assigned by hand);
- the organisation the sign-in’s claim names, when the installation reads one;
- the domain of their verified e-mail address (Mail domains of the organisation);
- otherwise the main organisation.
Which of these the installation uses is set in its chart (orgs.source); see
Installing with Helm.
A new organisation
Section titled “A new organisation”Platform administrators create one under Platform → Organisations → New organisation: a Name, a Short name, a Claim value and Mail domains. A new organisation starts with the system policies (Default, Everyone, the capabilities Default) and the four default groups. Its checklist asks for:
- a model connection for the chat (see Models and providers),
- a Model access policy (see Policies),
- an administrator,
- its branding.
An organisation’s administrators are made on its page (Make administrator) or by a group that makes its members Administrators of its organisation (see People and groups).
Sign-in
Section titled “Sign-in”People sign in through OpenID Connect. Under Control Panel → Sign-in you choose where the organisation’s people sign in:
- at the platform’s provider (for example Microsoft Entra ID, if the installation has one),
- at the installation’s own provider (its Keycloak),
- or at a provider of the organisation’s own: a name for the button, the Issuer, the Client id, the Client secret and the scopes, with the redirect address shown there to allow at the provider. The client secret is kept encrypted.
Only addresses of the organisation’s domains sign in at its own provider. With e-mail first (a platform setting), AI OS asks for the address and picks the organisation by its domain; an address of no organisation is refused. A provider other than the installation’s own makes nobody a platform administrator (ADR 0078).
A console session lasts 10 hours by default (platform setting session.hours, 1 to 24).
Branding
Section titled “Branding”Control Panel → Branding sets the organisation’s title (by default “AI OS”), tagline, palette, accent colour and logo.
Settings
Section titled “Settings”Control Panel → Settings holds the organisation’s settings, by topic: among them models and Auto, memory, retention, personal data, tool call safety and who approves clients. Modified only shows what differs from the default. What the installation fixes is shown locked.
Settings that matter early, with their defaults:
| Setting | Default |
|---|---|
| Keep files for (days) | 7 |
| Audit log: retention in days | 90 |
| Keep the tool call history (days) | 90 |
| Keep tool call contents (days) | 7 |
| Memories kept | until forgotten; the bin keeps them 30 days |
| Dreaming (tidying memory at night) | on, at 3:00, Europe/Berlin |
| Personal data in prompts to models | off |
| Hold tool calls for approval | those the checks flag |
| Where code a sandbox runs may reach | package indexes, other websites once approved |
What each means for privacy is in Security and privacy.