Skip to content

Administration#

Everything a platform team configures after the install: who exists, what they may do, what it costs, and what happened.

Every task here is available three ways — nexusctl, the REST API, and the MCP endpoint — plus the admin UI. All four enforce the same RBAC, the same policies, and the same audit.

Start here#

  • Organizations, teams, projects

    The hierarchy, project roles, and why org policies act as a ceiling over every project.

  • Policies

    The policy document in full — network verdicts and transports, credentials, connectors, integrations, managed inference, PII masking.

  • Policy bindings

    Attaching policies to users and tokens, merge order, and finding bindings clipped by the org ceiling.

  • API tokens

    Non-interactive identities for CI, scripts, and external agents.

  • SSO

    Authenticate users against your own OIDC provider.

  • Spending limits

    Budget caps per org, user, agent, and sandbox, and where the money went.

  • Audit trail

    Every call from every surface, allowed and denied, filterable and exportable.

  • Product telemetry

    What the platform emits, how to turn it off, and how to point it at your own collector.

  • Skills

    Give your coding agent the platform's mental model and let it administer Lens Agents for you.

The governance ceiling#

The single most useful control the platform gives a central team is the org policy ceiling.

An org-scoped policy is an upper bound, not a default. When a sandbox's effective policy is resolved, anything a project binding grants beyond the org policy is clipped away. Write one org policy naming what the organization permits at all, and no project can exceed it regardless of who configures it.

Clipping is silent by design, so review it:

nexusctl policy-binding list-drift --org acme

Each entry is a project that believes it granted more than the organization allows. See Policy bindings.

Set up a new install#

  1. Activate the install with a service-account Lens ID, not a personal one.
  2. Point SSO at your own identity provider.
  3. Create the org policy ceiling — the domains, connectors, and inference providers the company permits at all. See Policies.
  4. Split projects along your real blast radius, usually environment or team.
  5. Set an org spending limit before the first autonomous agent runs, not after.
  6. Create teams and grant project access through them rather than to individuals.
  7. Harden sandboxes with a microVM runtime class.
  8. Schedule the drift review and an audit trail export into your SIEM.

Rollout planning, air-gapped deployments, and hardened runtime classes are worth a conversation. Talk to us.