Administrator guide

For the people who set up, connect and run the deployment.

Setup and access

Create the first administrator, invite and manage people, and assign abilities and Teams.

  • First-run setupFind the one-time setup token on a fresh deployment and use it to create the first administrator.
  • Inviting peopleInvite teammates from Settings, choose their abilities, and share the setup link by email or by hand.
  • AbilitiesWhat each ability allows, how the Team page assigns them, and why Admin covers instance administration only.
  • Managing peopleChange abilities, revoke and reactivate access, resend invites, delete people, and allow password sign-in.
  • TeamsCreate Teams, manage their members, and understand what a Team limits.
  • Exporting or erasing a person's dataDownload everything held about one person, or erase it after their access is revoked, while the audit trail stays in place.

Sign-in and SSO

Set up single sign-on and see how the sign-in page chooses between it and a password.

  • Set up single sign-onConnect your identity provider with OpenID Connect or SAML 2.0, verify your domain, map roles to abilities and Teams, and delete a domain.
  • How sign-in chooses a methodHow the sign-in page decides between a password and your company's single sign-on, and how to exempt a person.
  • Set up SCIM provisioningLet your identity provider create, deactivate and group people automatically with SCIM 2.0: generate the token, connect Microsoft Entra, and map groups to abilities and Teams.
  • Send Okta groups for role mappingConfigure Okta to send a groups claim (OIDC) or a groups attribute (SAML) so group membership maps to abilities in Workforce Intelligence.
  • Send Auth0 roles for role mappingAdd an Auth0 Action that puts the user's roles in the ID token under a namespaced claim, then map that claim to abilities in Workforce Intelligence.
  • Google Workspace and role mappingGoogle Workspace sign-in over OpenID Connect gives member access only. To map groups to abilities, use SAML.

AI providers

Connect model providers, manage their keys, and set the default models.

  • Adding a model providerConnect Workforce Intelligence to a model provider such as Anthropic, OpenAI, Amazon Bedrock, Azure OpenAI, Google Vertex AI, Groq, Mistral or Ollama, and edit it later.
  • Provider keys and how they are storedAdd, replace or remove a provider's API key or AWS credentials, and what protects stored keys, including why you must keep the master key.
  • Testing, activating and removing a providerCheck that a provider is reachable, bring a keyless provider back online, and remove a provider you no longer use.
  • Default modelsSet the company default chat model, the default small model, the default embeddings model, the image reading model and the image generation model, and what each one is used for.
  • Use AWS BedrockConnect Amazon Bedrock as a model provider using the server's IAM role, access keys or a Bedrock API key, and the minimum IAM policy it needs.
  • Use Azure OpenAIConnect an Azure OpenAI resource as a model provider: endpoint, API version, key and the deployments Coworkers can use.
  • Use Google Vertex AIConnect Google Vertex AI as a model provider with a service account key file, a project and a location.

Company settings

Change the company name, configure outgoing email, and export the company archive.

  • Company nameWhere to find the Company settings page and how to change your company's name.
  • Outgoing emailConfigure the SMTP server the product uses to send invitations, test it, and what to do when email is not set up.
  • Exporting the company archiveDownload all Coworkers, Knowledge Bases and conversations as a single portable ZIP archive.
  • Coworker creation settingChoose how much a person must provide to create a Coworker: Minimal, Guided or Strict (with approval).
  • FeaturesSet the company's Product areas (Coworkers, Apps, Knowledge Bases, Workflows, WI Score and Map) and turn behaviors such as MCP Server and Search box relevance ranking on or off.
  • Feedback synthesisTurn the weekly feedback synthesis on or off, run it for the whole company on demand, and what it needs to run.
  • Reviewing and editing connectorsThe Connectors page lists your organization's outside systems: SharePoint, outside-system connections such as GitHub, and every connector your Coworkers have built with who built it, where it is enabled, its guidance, code, dependencies and secrets. Its creator can edit it.
  • Knowledge limitsSet how large a document the Knowledge Bases will index: file size, pages, rows, characters and processing guards, with their defaults and ceilings.
  • Promotion gatesDecide what must happen before a Coworker or App moves to its next phase: nothing, an approval, or measures the platform checks.
  • Conversation quality reviewHow Coworker conversations are reviewed automatically, the sampling share and low-usage settings, what it costs, and what is and is not stored.
  • Conversation retentionChoose how long conversation content is kept, preview what a period would remove, run a cleanup on demand and review cleanup history.
  • Connecting outside systems like GitHubAdd a connection to an outside system with your own OAuth app, attach its tools, and choose which functions Coworkers may use and how each starts.
  • Connecting SharePointRegister a Microsoft Entra application and grant it read access to your sites, then add it under Connectors so Knowledge Bases can sync SharePoint sites.
  • Global instructionsWrite company-wide guidance that every Coworker follows, review and restore earlier versions, and preview what a Coworker starts from.
  • Value estimatesThe Value estimates switch, the daily schedule, how a run picks its model, the monthly spend limit and its environment variable.
  • Connect Microsoft 365Register an app in Microsoft Entra, give it permissions for Calendar, Mail, Files, Teams and People and tasks, and add it to Workforce Intelligence as a connection.
  • The Value rate cardHow the rate card behind Governance > Value works: categories and minute bands, adjustment settings, versions, editing, promoting recurring work types, and who may change it.
  • Connect Google WorkspaceCreate a Google Cloud OAuth client, enable the Gmail, Calendar, Drive, Docs and Sheets APIs, and add it to Workforce Intelligence as a connection.
  • Connect Atlassian (Jira and Confluence)Create an Atlassian OAuth 2.0 (3LO) app, add the Jira, Confluence and User identity permissions, and add it to Workforce Intelligence as a connection.
  • Workflow reviews, outputs and parallel branchesWho can review a workflow run, how run outputs are stored, and the review, inputs and parallel-branch settings a workflow definition carries.

Keys

Create and revoke API keys, and register and review SSH keys.

  • API keysCreate and revoke personal API keys, and issue Coworker and App keys from the company-wide list.
  • SSH keysRegister the public key people use to push App code, and review every registered key as an administrator.
  • Use API keys with AI toolsPoint Claude Code, the OpenAI and Anthropic SDKs and other compatible tools at your deployment with an API key, and how model names, allowed models and budgets apply.

Deployment and install

Install on AWS or your own server, set up HTTPS, and run and back up a deployment.

  • Deployment requirementsWhat you need before installing Workforce Intelligence: a box, open ports, a GitHub token for the image registry, and a public address.
  • Install on AWS with CloudFormationProvision a Workforce Intelligence box with the CloudFormation template: parameters, access over Session Manager, outputs, generated secrets, and data protection.
  • Install on your own serverInstall Workforce Intelligence on a Linux server you manage, using install.sh and an .env file you prepare.
  • First-run setup tokenFind the one-time setup token that the setup wizard asks for on a new installation.
  • Configuration referenceEvery environment variable an operator sets for a production deployment, which are required, and which are fixed by the compose file.
  • Domains and automatic HTTPSServe Workforce Intelligence on your own domain with a certificate that Caddy obtains and renews for you.
  • Day-two operationsCheck status, stop, start, restart, and pull images on a running deployment with Docker Compose.
  • Containers and volumesThe containers and Docker volumes that make up a Workforce Intelligence deployment, and what each one holds.
  • Master key custodyWI_MASTER_KEY protects the data key that encrypts every stored credential. Back it up off the box, and rotate it with WI_MASTER_KEY_OLD.
  • Backups and recovery on AWSHow the CloudFormation deployment protects its root volume, how to check the backups, how to recover a lost instance, and what to arrange on your own server.
  • Production boot checksThe configuration problems that make the application refuse to start in production, and how to fix each one.
  • Rotate the master keyReplace WI_MASTER_KEY with a new key using WI_MASTER_KEY_OLD, confirm the rotation in the admin screen, and remove the old key.

Updates

Check for and install updates, and see how an update runs and what to do if one fails.

  • Checking for and installing updatesUse Settings > Updates to see the running version, check the registry for a newer one, and install it with a guarded, backed-up switchover.
  • What an update changesAn in-app update replaces only the app and web images. When a release changes the stack itself, re-run install.sh first, and what you see if you skip that.
  • How an update runsThe ordered steps of a guarded install: database backup, image pull by digest, a new app container beside the old one, a health check, then the switchover.
  • When an update failsWhat a failed install looks like, what state your deployment is left in, and what is kept for inspection.
  • Registry credentials for updatesHow the in-app updater authenticates to ghcr.io, and what to do when the token expires or the registry refuses it.
  • Docker housekeepingHow Workforce Intelligence removes old update images, finished update containers, unused workbench images and old database backups, what it never touches, and how to run or tune it.

Usage and cost

Read company-wide model usage and spend, and see how cost is calculated.

  • The Usage & cost viewRead company-wide model usage and spend by Coworker, Knowledge Base, system job, team and person, for any month or custom date range.
  • How cost is calculatedWhere the cost figures come from, what Unpriced means for models without a known price, and how self-hosted models are counted.
  • Price models the price list cannot priceEnter per-million-token prices for models that show as Unpriced, price their past calls, and understand how later edits and removals behave.

Infrastructure

Check the status of the Agent VM and the disk usage of the data volume.

  • Agent VM statusRead-only view of the sandbox where Coworkers run their tools, plus disk usage of the data volume.