Admin guide - xpander.ai

What you control

Control	Where	What it does
Approved skills	Skills catalog, per-agent Add a skill	Which outside systems and actions an agent can reach at all
Approvals	Per skill (“These actions need approval”), gated commands, permission mode	Which actions wait for a named person’s sign-off, and for how long
Identity	Per-skill connections: organization or personal; OIDC pre-authentication where systems allow	Whether the agent acts with its own credential or with the asking person’s permissions
Credentials	Vault, workspace secrets	Credentials are injected at the moment of use. The agent never holds one
Models	Settings > LLM: providers, default model, allow-lists	Which models agents may use, frontier or open-weight, and through which provider
Budgets	Settings > Usage (Settings > Budget on subscription-billed organizations), per-agent limits	Spend and usage caps per organization and per agent
Access	Manage access, Org-wide sharing	Who may use, edit or share an agent
Record	Task Manager, task threads, usage	Every task, every skill call, every model call and every decision, under the person who asked

Where xpander runs

Deployment	What runs where	Page
xpander cloud	Everything in xpander’s cloud; agents answer to Slack, Teams, an API or a schedule	Access control
Hybrid	Execution in your Kubernetes cluster, control plane in xpander’s cloud	Hybrid deployment
Air-gapped	Every component inside your perimeter, including sign-in. With OpenCode and an open-weight model, nothing leaves the perimeter	Air-gapped deployment

Every connection that leaves your perimeter in a self-hosted install is optional and under your control. The egress table on the air-gapped page lists each one, when it is used, and the setting that turns it off or points it inside.

In this section

Deploy

Deployments, prerequisites, install, verify, upgrade, scale.

Integrations

AI gateway, AI vendors, MCP gateway, desktop AI clients, Slack workspace, Microsoft Teams tenant, email, identity providers, vault providers, EKS clusters, the data layer, file storage.

Licensing and identity

The two-file license, renewal, and single sign-on with your identity provider.

Security and compliance

Architecture per deployment, certifications, data handling.

Access control

Members, roles, API keys and audit.

​What you control

​Where xpander runs

​In this section