Skip to content

Platform Settings

The Admin page holds all platform-wide settings: users, agents, source control, and issue trackers. It is visible in the sidebar only to members of the Cognito platform-admin group (see Setup for bootstrapping the first admin); every underlying API is independently gated on the same group.

The page is organized into four tabs.

A read-only Deployment strip sits above the tabs, showing the canonical application URL, environment, and region. The hostname it reports is the one the backend puts in its OAuth redirect URIs, so it is what every provider's callback URL must match. If you are browsing a hostname other than the canonical one — a deployment with a custom domain still answers on the CloudFront domain and on every alias — the strip says so, because the callback URLs shown further down deliberately use the canonical hostname rather than the one in the address bar.

The hostname itself is not editable here. It is set by the app_domain Terraform variable, and changing it needs a certificate, a CloudFront update, and a frontend rebuild. See Setup → Custom domain.

Users

User Management — grant or revoke the platform-admin role for local Cognito users. Changes apply at the user's next sign-in. Self-demotion is blocked, so an installation cannot remove its current local administrator by accident. Federated users show their identity provider and effective mapped roles, but their role control is read-only because the external IdP is authoritative. See Enterprise SSO.

Day-to-day project access is not managed here — it lives in each project's Members tab.

Agents

Everything the agent runtime needs to run:

  • Agent Credentials — the Bedrock Bearer Token (used by Claude Code, OpenCode, and Codex) and the Kiro API Key. Both are stored as SecureString parameters in SSM; the AgentCore runtime reads them at container startup. The card reports which credentials are set and which CLIs are therefore available to projects. See Prerequisites → Agent authentication.
  • Default Models — the platform-wide default model per CLI (Kiro, Claude Code, OpenCode, Codex), selected from a dropdown of models discovered from the runtime (or "No default — use CLI built-in"). Codex uses Bedrock's OpenAI models with exact openai.* IDs (e.g. openai.gpt-5.5) — the chosen model must be available in the deployment Region. Projects can override these per-CLI in Project Settings → Agent.
  • Graph Enrichment — a switch controlling whether the platform adds LLM-generated summaries to derived artifacts in the knowledge graph (llm or off). The setting takes effect for the next intent, never mid-run; enrichment spend is metered and surfaced on each intent's Audit page.

Source Control

Platform-wide code-host configuration:

  • GitHub — GitHub OAuth app status and GitHub App identity/private-key configuration are shown simultaneously. Projects choose OAuth or App independently; there is no global mode or installation ID. See Git integration → Project-bound authentication.
  • GitLab — the GitLab OAuth app credentials.
  • Default PR strategy — Intent PR opens only the final intent-to-base review; PR per unit also opens draft unit-to-intent reviews and integrates them in dependency order. Projects may inherit or override this default. The default is Intent PR.

Trackers

Issue-tracker OAuth apps and data migrations:

  • Jira Cloud — the Atlassian OAuth 2.0 integration credentials.
  • Source-control trackers — configuration status of GitHub Issues and GitLab Issues (these reuse the Source Control OAuth apps).
  • Tracker Migration — the one-time bulk migration for installs with pre-#194 data; shows a live count of legacy records and a Migrate all action. See Git integration → Migrating from legacy issue integration.

Until a provider shows Configured here, its Connect buttons across the product stay disabled with a hint pointing back to this page.

Not everything operator-facing lives on the Admin page:

  • Workflow and block authoring — the Workflows area, also gated on platform-admin.
  • Infrastructure-level settings — the upstream methodology pin (aidlc_repo_ref), the custom domain (app_domain), and the rest of the deployment configuration live in Terraform; see Setup.