Skip to content
CengridCengridCengrid Docs

Onboard people

Each person gets their own isolated workspace: their own memory, files, keychain view, crons, apps and a durable sandbox. They also work with the agent together in shared rooms.

How people get access

Section titled “How people get access”

A person’s identity is their lower-cased verified work email. Slack, Google Chat and web sign-in all resolve to the same person when the email matches.

  • Built-in email sign-in. Access is the allowlist set at deploy time: AUTH_ALLOWED_EMAILS and/or AUTH_ALLOWED_EMAIL_DOMAIN. There is no email-invite screen for this broker. To let someone new in, add their address, or use a domain that covers them, and redeploy.
  • Your own identity provider. Connect it at Admin → Onboarding → Single sign-on. Invite-only join is on by default: only invited emails and admins can join, and anyone else sees “You’re not part of this organization”. You can invite up to 200 emails at a time. Turning invite-only off requires an allowed email domain.
  • Slack. Anyone in the Slack workspace with a visible email maps to a person. A Slack human with no visible email is treated as a guest. Members removed from the Slack directory are deactivated, except addresses on the named allowlist.

Roles

Section titled “Roles”
Role Can
Org admin Everything in the admin console
Team admin Manage the teams they administer from the admin console
Member Use the agent

Manage roles on Users: search for a person, choose Make org admin or Revoke org admin, and set their Primary team. Make someone a team admin from Teams → Members → Make team admin. The Users list combines people seen in sessions, admin grants, directory members and SSO members, and shows sessions, turns and last seen.

What a new person sees

Section titled “What a new person sees”

The first time someone opens the web app with no sessions, Cengrid starts a conversation for them. The agent greets them by name, says what it can do, and walks them through connecting accounts. It does not ask their name or role.

In direct messages, Cengrid keeps a pending-onboarding prompt until the person’s memory records Onboarding: completed v2 or dismissed v2. The built-in /onboarding skill has four conversational steps:

  1. Connect apps. The agent offers the account connections you configured, such as Google, and hands out one-time links for the person to authorise.
  2. Choose a voice. The person picks how the agent talks to them (a low-key one, an editor, or a right hand) and can update their personal soul.
  3. Look around. With their connected tools, the agent reads a work snapshot.
  4. Propose automation. After the person confirms the snapshot, the agent suggests one or two crons, webhooks or apps.

Manage someone’s onboarding

Section titled “Manage someone’s onboarding”

Open a person’s page in the admin console. Their Onboarding tab offers Reset, Mark completed, Mark dismissed and Reset to brand-new. Open web UI as this person is available for support, and every use is audited.

Their personal scope

Section titled “Their personal scope”

Direct messages on every platform share one personal scope, personal:<principalId>. A DM reads the organisation’s capabilities, the person’s primary team’s and their own, and saves new things into the person’s bucket. Personal connections are usable in their owner’s private scope, and in a shared room they need the owner’s approval. See capabilities overview.