Administration overview

The Admin section is visible only to tenant admins. It appears as its own collapsible section in the sidebar, below your regular workspace navigation, and remembers whether you last left it expanded or collapsed. If your account is not a tenant admin, you will not see it at all.

The nine admin areas

• Access Control - manage who has access to what: members, per-user and per-group tool and skill grants, agent ownership, provisioning rules, and raw relationship tuples.
• Tools - edit the tool vocabulary itself (effect class, description, enabled) and register custom tools backed by an MCP server.
• Skill bundles - author and manage skill bundles, including keyword auto-load triggers.
• MCP servers - register MCP servers so their tools can be granted to agents.
• Agents - create and configure agents: identity, model and provider, skills, approval mode, personality, direct access, and API keys.
• LLM providers - configure the LLM providers Taikon can use, their dialects, pricing, and defaults.
• Scheduled runs - an org-wide, read-only view of every user’s scheduled runs.
• Policy & audit - the live audit stream, historical audit search, a per-task decision trace, a policy simulator, and alert history.
• Settings - three pages covering governance, network & limits, and integrations.

Every admin page fails closed

If you reach an admin page or route without tenant-admin access, whether through the sidebar or a direct link, the page shows “You are not a tenant admin.” instead of an error or a partial view. This check happens on the server every time, not only when the sidebar first decides whether to show you the Admin section.

Because of that, whether an admin link appears in your sidebar is a convenience, not the actual security boundary. Hiding a control from someone who lacks access is about not confusing them, not about preventing the underlying action. The same principle applies to ordinary workspace navigation, described in the User Guide.

The “authorization service disabled” banner

Some admin pages, most visibly Access Control, can show a banner explaining that the authorization service is disabled and the deployment is running in an allow-all mode. This is not something you fix from inside the admin UI: it is a property of how your Taikon deployment was set up, not an admin setting. If you see it, contact whoever operates your Taikon deployment.