Admin guide - xpander.ai

You approve skills, models and policies once. Every new agent starts inside them, and every call it makes is checked, credentialed, counted and recorded as it happens.

What you control

Control	Where	What it decides
Available skills	Platform > Agents > Skills registry	Which outside systems agents and MCP clients can reach, and who sees each
Approvals	Per skill, gated commands, permission mode	Which actions wait for a named person
Identity	Organization or personal connections, OIDC pre-authentication where systems allow	Whether the agent acts with its own credential or the asking person’s permissions
Credentials	Vault, workspace secrets	Injected at the moment of use. The agent never holds one
Models	Platform > AI governance > Models	Which models and providers agents may use, through the LLM Gateway
Budgets	Platform > AI governance > Budgets	Spend caps per organization, group, member, API key and agent
Access	Manage access, Org-wide sharing	Who may use, edit or share an agent
Record	Session Manager, Platform > AI governance > Logs and Usage	Every task, skill call, model call and decision, under the person who asked

Where xpander runs

Deployment	What runs where	Page
xpander cloud	Everything in xpander’s cloud	Access control
Hybrid	Execution in your Kubernetes cluster, control plane in xpander’s cloud	Hybrid deployment
Air-gapped	Everything inside your perimeter, including sign-in. With OpenCode and an open-weight model, nothing leaves	Air-gapped deployment

On a self-hosted install, every outbound connection is optional. The air-gapped page lists each one and the setting that turns it off.

Next steps

Deploy xpander

Install, verify, upgrade, scale.

Connect your systems

Gateways, Slack, Teams, identity, vaults.

Install your license and sign-in

License and single sign-on.

Review security and compliance

Architecture and certifications.

Manage members, roles and keys

Members, roles, keys and audit.