Access control

Every call an agent makes is recorded under the person who asked. This page is the reference. The settings are on Govern every agent.

​

Where identity and records live

​

Organization roles

Manage members and groups under Platform > Organization > Members & groups. Groups can follow your identity provider’s groups through OIDC group sync.

​

Agent scope

An agent reaches only the skills it was given. Admins approve skills for the organization, and a person adds them to an agent. Further limits:

• Approval on a skill action: individual actions can require approval. A requester can withdraw a pending approval. Declining answers that one attempt, and the conversation continues.
• Gated commands: hold matching shell commands on Claude Code, Codex or OpenCode.
• Knowledge bases: attached per agent.
• Budgets: cap what one agent may spend.
• Who can send tasks: under the agent’s Channel settings, the Omni switch and Any agent, Selected agents or No agents. Each task shows which rule allowed it. See Invocation channels.

With a personal skill connection, the agent acts with that person’s own permissions, where systems allow. The outside system’s access control still applies, and its logs name the person.

​

Skill visibility

Each skill’s visibility decides which agents may hold it: The skill’s creator and admins (Root access or Admin) change visibility and allowlists. Others cannot widen a scope, and attaching a skill outside its allowlist is refused. The runtime builds each agent’s workspace from the skills its scope allows, so a scope change applies on the next run. The filter has three modes: The default is report in the current release, so teams can review violations first. enforce follows. On self-hosted installs the switch is XPANDER_SKILL_VISIBILITY_MODE (off, report, enforce). The air-gapped chart renders it from global.skills.visibilityMode, so set it in your values file. Scope changes, publishes and archives are audited as UPDATE_SKILL_ACCESS, PUBLISH_SKILL and ARCHIVE_SKILL (see The record). Repository skills take their scope from xpander.yaml (Publish Skills). What the person adding a skill sees is on Skills.

​

Single sign-on

Sign-in with your identity provider uses OIDC. On cloud and hybrid, an admin sets it under Platform > Organization > Access > Single sign-on. On air-gapped it runs inside the perimeter: see SSO with your identity provider. Provisioning, deprovisioning and MFA stay in your identity provider, and group claims can map to xpander groups.

​

API keys

Air-gapped installs mint all credentials in-cluster at install time. Keep keys in your secrets manager and rotate them. Deleting an organization key revokes it within a minute at most.

​

The record

Per task: messages, each skill call with parameters and result, and each model call with cost, under the person who asked. In xpander Chat (Session Manager) and over the API (GET /v1/tasks/{id}/thread, GET /v1/tasks/{id}/llm_usage). Organization audit log: Platform > AI governance > Audit log, filterable by event type and exportable as CSV or JSON.

​

Next steps