Skip to content

Review Configuration and Team Allowance

Purpose

Review the current file configuration and enable approved models and tools for Teams. Mission Control loads one global YAML file and one file per organization at startup. Configuration displays the current redacted configuration read-only; it has no Validate, Apply, revision or restart controls.

Prerequisites

You need organization.settings.manage as organization.owner or organization.admin to inspect administrative configuration. An operator needs filesystem/environment access for a change and must follow Configure the services. Team allowance requires team.allowance.manage.

Procedure

  1. Review model routes, Connector schemas/classifications, key lifetimes, concurrency, capture/retention, and secret-reference names in source-controlled YAML.
  2. Have the operator prepare files and required nonempty env/NAME variables under Organization-owned names, optionally run config:check, and restart the compatible gateway and Console. Platform settings and cloud SDK credentials are reserved names that a reference cannot use. See File configuration and startup.
  3. Open Manage → Settings and inspect the current redacted configuration and catalog.
  4. Enable the approved resources in the Team using the procedure below.

Connector headers.*.value fields are literal non-secret text, even when they resemble env/NAME. Nested headers.*.credential fields resolve secrets from the gateway environment and never expose their values. Required secret resolution and strict schema/reference checks complete before startup can serve traffic.

Warnings identify valid but consequential choices: auto_execute_action_tool flags each action with autoExecute: true and approval: none; empty_tool_set flags an empty set that grants nothing. Review these during preflight and source review. Warnings do not create a saved revision or block valid startup. See Tool declarations.

The configuration view shows non-secret settings and reference names; it does not expose resolved credentials or activation controls.

Enable models and tools in a Team

Prerequisite: team.allowance.manage in the selected active Team. Open Manage → Teams, select the exact Team and edit its allowance using declared models, tools and deployments. A new Team starts with none. Save with its current revision; the next key policy evaluation intersects that allowance with catalog and key selections. Selected keys do not automatically gain new resources; inherit_team follows the Team allowance.

Use Teams for the complete procedure. An empty catalog requires reviewed YAML and a coordinated restart first. Configuration changes do not replace key policy or create a grant by themselves.

Expected result

The current catalog reflects the files loaded by the running processes. An enabled resource is callable only with the necessary live authorization, declaration/schema constraints and credentials. A new resource does not grant itself Team access.

Verification

Verify private readiness, inspect the redacted current catalog, and make an authorized synthetic model/tool call. New Observe → Requests entries use Configuration hash; older records may retain Legacy configuration revision. No configuration Apply is required after startup.

Failure recovery

Invalid configuration or unresolved required credentials stops startup. Correct the safe reported cause, run preflight again, and restart. Secret reference names a reserved platform environment variable names the file and field of a reference to a platform-owned variable; move that credential to an Organization-owned variable, such as env/ACME_OPENAI_API_KEY, and reference the new name. A running process keeps its previously loaded files until restart. If Console cannot reach gateway management, verify GATEWAY_MANAGEMENT_URL and matching INTERNAL_SERVICE_SECRET; never infer gateway credential resolution from Console file parsing. An upstream outage affects requests and diagnostics but does not block startup or readiness.