Administrator Guide

Everything administrators need to configure, secure, and manage an Operanix workspace. This guide covers initial setup through enterprise-grade governance, security, and compliance.

1. Workspace Setup

Your workspace is the top-level container for your organization’s AI workforce. Setting it up correctly ensures a smooth experience for your entire team.

Initial Configuration

1. Sign in to app.operanix.ai with the account that created the workspace (this account is automatically assigned the Owner role).
2. Navigate to Settings → General.
3. Set your Workspace Name (your company or team name).
4. Upload your Company Logo — this appears in the portal, chat widgets, and hosted chat pages.
5. Select your Industry from the dropdown. This optimizes agent behavior and evaluation criteria for your domain.
6. Configure your Timezone for scheduling pipelines and evaluations.

2. User Management

Inviting Team Members

1. Go to Settings → Team.
2. Click Invite Member.
3. Enter the email address and select a role (see RBAC section below).
4. Click Send Invitation. The user receives an email with a sign-up link.

Managing Members

From the Team settings page, administrators can:

• Change roles — Click the role badge next to a member’s name to reassign.
• Remove members — Click the menu icon and select Remove from workspace.
• Assign to departments — Assign members to specific departments for scoped access.

Viewing Invitations

The Pending Invitations tab shows all outstanding invites with their status, sent date, and expiration. You can resend or revoke invitations from this view.

3. Role-Based Access Control (RBAC)

Operanix uses a granular role system with 10 roles to ensure every team member has exactly the access they need — nothing more.

4. Departments

Departments provide organizational boundaries within your workspace, enabling scoped access control and resource isolation.

Creating a Department

1. Go to Settings → Departments.
2. Click Create Department.
3. Enter a name (e.g., “Sales”, “Engineering”, “Customer Success”).
4. Optionally add a description and select a department head.

Assigning Agents to Departments

Navigate to the agent’s settings and select the department from the Department dropdown. Agents can belong to one department at a time. Department-scoped roles (Manager, Operator) can only see and manage agents within their assigned departments.

Assigning Members to Departments

From Settings → Team, click a member’s profile and assign them to one or more departments. Members with department-scoped roles will only see resources (agents, knowledge, evaluations) within their departments.

Scoped Access

When a user has a department-scoped role, their view of the platform is filtered to show only the agents, knowledge, deployments, and analytics for their assigned departments. This is transparent — the platform looks and works the same, but the data is scoped.

5. Single Sign-On (SSO)

SSO lets your team sign in to Operanix using your existing corporate identity provider, eliminating separate passwords and centralizing access management.

Supported Providers

Setup Steps

1. Go to Settings → Security → SSO.
2. Select your identity provider from the list.
3. Follow the provider-specific instructions to register Operanix as an application in your IdP.
4. Enter the required configuration values (Client ID, Client Secret, Issuer URL, or SAML metadata URL).
5. Click Test Connection to verify the integration.
6. Enable SSO and optionally enforce it for all users (disabling password login).

Advanced SSO Features

• Just-In-Time (JIT) Provisioning — Automatically create Operanix accounts when users sign in via SSO for the first time. Assign a default role for JIT-provisioned users.
• Role Mapping — Map IdP groups to Operanix roles. For example, map your “Engineering” IdP group to the Operator role, and your “Leadership” group to the Viewer role.
• Domain Verification — Verify ownership of your email domain to ensure only your organization’s members can access the workspace via SSO.

6. Billing & Plans

Available Plans

Managing Your Subscription

1. Go to Settings → Billing.
2. View your current plan, usage, and billing cycle.
3. Click Upgrade to move to a higher tier. Upgrades take effect immediately with prorated billing.
4. To downgrade, click Change Plan and select a lower tier. Downgrades take effect at the end of the current billing cycle.

Usage Monitoring

The billing dashboard shows real-time usage metrics including:

• Number of active agents vs. plan limit
• Knowledge pages ingested vs. plan limit
• API calls made this billing period
• LLM token consumption by agent and model
• Estimated cost for the current billing cycle

7. Security Settings

Multi-Factor Authentication (MFA)

MFA adds an extra layer of security by requiring a second verification factor during sign-in.

• Enable for your account: Go to Profile → Security and click Enable MFA. Scan the QR code with your authenticator app.
• Enforce for all users: As an admin, go to Settings → Security and toggle Require MFA. All users will be prompted to set up MFA on their next sign-in.

API Key Management

API keys enable server-to-server integrations with Operanix.

1. Go to Settings → Integrations → API Keys.
2. Click Generate Key. Name the key and select its permission scope.
3. Copy the key immediately — it will not be shown again.
4. To revoke a key, click the key’s menu and select Revoke. Revocation is immediate.

Data Security

• Encryption at rest — All data is encrypted with AES-256 in Google Cloud Storage and Firestore.
• Encryption in transit — All API traffic uses TLS 1.3.
• Tenant isolation — Data is strictly isolated per tenant at the database level. Cross-tenant access is architecturally impossible.
• Data residency — Enterprise plans can specify data residency regions for compliance with data sovereignty requirements.
• Data retention — Configure retention policies for conversation logs, audit trails, and knowledge data from Settings → Security → Retention.

8. Governance Setup

Governance ensures your AI agents operate safely, compliantly, and within organizational boundaries.

Creating Policies

1. Navigate to Governance Center in the sidebar.
2. Click Create Policy.
3. Select a policy type: Content Safety, Compliance Rule, Topic Boundary, or Custom.
4. Define the policy conditions (keywords, patterns, or semantic rules).
5. Set the enforcement action: Warn, Require Approval, or Block.
6. Assign the policy to specific agents or apply it workspace-wide.

Compliance Frameworks

Operanix includes pre-built compliance templates for common regulatory frameworks:

• SOC 2 Type II — Security, availability, and confidentiality controls
• GDPR — Data privacy, consent management, right to erasure
• HIPAA — Protected health information safeguards
• Custom Frameworks — Define your own compliance requirements and map them to governance policies

Audit Trail Retention

The audit trail captures every action on the platform. Configure retention from Settings → Security → Retention:

9. Webhooks

Webhooks let you receive real-time notifications when events occur in your Operanix workspace.

Registering a Webhook

1. Go to Settings → Integrations → Webhooks.
2. Click Add Webhook.
3. Enter your endpoint URL (must be HTTPS).
4. Select the events you want to subscribe to (e.g., agent.deployed, evaluation.completed, conversation.started).
5. Click Create. Operanix will send a verification request to your endpoint.

HMAC Verification

Every webhook payload includes an X-Operanix-Signature header containing an HMAC-SHA256 signature. Verify this signature in your endpoint to ensure the payload was sent by Operanix and has not been tampered with.

// Node.js verification example
const crypto = require('crypto');

function verifyWebhook(payload, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(payload)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expected)
  );
}

10. Enterprise Readiness Checklist

Use this checklist to confirm your workspace is fully configured for enterprise production use.

• SSO configured and enforced for all users
• MFA enabled organization-wide
• RBAC roles assigned following principle of least privilege
• Departments created and agents assigned by business function
• Governance policies configured for content safety and compliance
• Trust score thresholds set per agent (stricter for high-risk domains)
• Approval workflows active for production agents
• Audit trail retention set to meet compliance requirements
• API keys generated with scoped permissions (no over-privileged keys)
• Webhook integrations registered and verified
• Data retention policies configured per regulatory requirements
• Emergency rollback procedure documented and tested