Admin is the browser app your deployment serves at /admin, where a person configures Agents, channel grants, people, keys, and network policy. Where Slack is where Agents do the work and the management MCP is how a coding agent drives them, Admin is the one surface that shows a whole deployment at once. This page walks the navigation, the Agent profile, the Settings rail, Audit logs, and what changes when your role is Member.
The navigation
Every screen carries the same left rail: the Chickpea mark, a context list for the section you are in, and the section switcher at the bottom. The switcher holds up to five entries.
| Section | Path | What it holds |
|---|---|---|
| Agents | /admin/agents |
Every Agent, and the editor for one |
| Destinations | /admin/destinations/slack |
The Slack connection and the channel index |
| Team | /admin/team |
The people Chickpea knows, with role and access |
| Usage | /admin/usage |
Token counts and estimated spend |
| Settings | /admin/settings/providers |
Keys, connectors, GitHub, sandbox, network policy |
The address bar mirrors the main panel, so every screen is a real URL you can link or bookmark. A path Admin does not recognise opens your first Agent.
Agents
/admin/agents lists every Agent as a card under Your Agents, with New Agent at the top right. Opening one moves to /admin/agents/<agent id> and keeps the roster in the rail, so you can step between Agents without returning to the list.
An Agent profile
The header holds the avatar, the name with an inline rename, a one-line description, a status chip that reads Active or Archived, and an overflow menu.
Under it, a Destinations card shows Slack: the reply handle, the handle controls, and the channel grant list. Adding a channel here is what makes the Agent mentionable.
Then comes Agent configuration, a card of seven tabs.
| Tab | What it holds |
|---|---|
| Instructions | The role, priorities, and boundaries this Agent follows everywhere it works |
| Skills | Repeatable ways this Agent knows how to help |
| Connections | Team and personal accounts this Agent can use |
| Repositories | Code and documentation this Agent can work with |
| Memory | Durable context this Agent can use wherever it works |
| Schedules | Recurring and one-time work owned by this Agent |
| Model | The intelligence this Agent uses for every response |
Skills, Connections, Repositories, and Schedules carry a count. A tab with an unsaved editor open shows a dot while you are on another tab, because the panel itself is hidden. On an Agent you may not edit, every field renders disabled, and the Memory and Schedules panels say only Agent editors may see them. Private DM schedules never appear in Admin.
Below the tabs, Advanced holds two rows: who can edit this Agent, either the creator and workspace admins or any workspace member, and a coding sandbox row that reads Available once a repository is granted. A sticky save bar appears once anything is dirty and repeats that changes apply to new threads.
The overflow menu
The menu beside the status chip carries three things.
- Duplicate Agent opens the New Agent screen prefilled from this one, with a callout headed “Copied from” the source Agent. Behavior and skills are copied. Channel access, connections, repositories, memory, and schedules stay separate until you grant them. This action stays available on a read-only Agent, so anyone may fork one into an editable copy.
- Archive Agent, or Restore Agent when the Agent is already archived. Archiving disables the Slack handle, removes channel access, and pauses schedules. Restoring re-enables the same handle, channel access, and the schedules the archive paused.
- Legacy default Agent after archive, a selector that appears only when the Agent you are about to archive is the workspace default. It lists the other active Agents and names the one that inherits the legacy routing reference. With no other active Agent it reads “Create another active Agent first” and Archive Agent is disabled.
Destinations
Slack is the only destination today, presented as a page with three tabs.
- Overview shows the connected workspace, the channel count, and how many active Agents use Slack.
- Connection shows the workspace name, its team ID, where the credentials come from, a Test connection button, and a collapsed inbound session diagnostic. On the “Add to Slack” lane it also offers Reconnect with Slack, which refreshes Slack authorization without changing Agents, channel grants, or saved settings. Disconnect stops Chickpea answering; Agents and channel configuration stay saved, and the Slack app stays installed until you remove it in Slack.
- Channels lists every channel with its Agent grants and a readiness status. Opening one goes to
/admin/channels/<workspace id>/<channel id>, which the page itself calls an inventory of reach.
The older path /admin/settings/slack still resolves and lands on the Connection tab.
Team
Team lists the people Chickpea knows, with your own row first. Membership is automatic: full Slack members join the first time they interact with an Agent, and guests and Slack Connect users are not provisioned. Each row shows the person, their handle or email, an access status of Active or Suspended, and their role. Only an Owner sees the role selector and the per-member menu for suspending, restoring, or removing access, and no Owner can act on their own row.
Usage
Usage is present only when the deployment enables it. Two selectors sit at the top: a period from the last 7 days through a custom range, and a breakdown by channel, Agent, provider, or model. Four cards follow, each compared against the previous period: estimated spend, activity, tokens, and average spend per priced operation. Below them sit spend by the chosen breakdown and a recent activity list. The page states the boundary plainly: set spending limits with each model provider, because Chickpea reports estimated spend for activity it handles.
Settings
Settings is a rail of five sections, each with its own path under /admin/settings/.
| Section | Rail label | What it configures |
|---|---|---|
| Connectors | Managed integrations | The managed connector project key and the connected accounts |
| Model providers | Keys and models | The default model and the provider API credentials |
| GitHub | Accounts and access | GitHub connected once, then granted per Agent |
| Coding sandbox | Workspace runtime | The optional Cloudflare Container for coding tasks |
| Outbound access | Network policy | The internet access available to sandbox work |
The default model is the shared model for Chickpea and every Agent that is not pinned. Its card names how many active Agents inherit it, and warns that a change applies to the next admitted message, including replies in existing threads.
Audit logs
Audit logs lives at /admin/audit-logs/scheduled-work. It lists scheduled work by name, scope, schedule, status, last run, and next run, with status and scope filters and a deployment-wide limits panel. A second tab, Network events, is present but disabled and marked as coming later. No button in the current navigation opens Audit logs, so reach it by URL.
On Node
Automatic scheduling is Cloudflare only. On a Node deployment the Audit logs page reports scheduling unavailable on this target, and says definitions stay inspectable while scheduling remains Cloudflare-only in this release. The coding sandbox is a Cloudflare Container and is likewise unavailable.
What each role sees
Admin renders from the signed-in member’s permissions, so the sections you see and the calls the API accepts are the same decision.
| Role | Sections in the switcher | What the role adds |
|---|---|---|
| Member | Agents only | Create Agents, personal connections, and schedules |
| Admin | All five | View the team, create team accounts, configure the deployment |
| Owner | All five | Change roles, suspend, restore, remove, manage sign-in and recovery |
A Member who requests any other path is taken to their first Agent instead.
Why it works this way
Admin, Slack, and the management MCP are three doors onto one management service with the same permissions behind each. Hiding a section and refusing the call are therefore one rule, not two: the switcher is built from the same permission set the API checks. And Admin never asks you to paste a Slack bot token into it.
What is not covered
- Admin authority stops at Slack membership. Publishing an Agent to a channel still requires that you are a member of that channel.
- Audit logs has one working domain today, scheduled work.
- Private DM schedules are never listed in Admin, by design.
- What lives inside each Agent tab, and what each Settings section means in practice, has its own page.
- Sign-in, member provisioning, and the roles themselves are covered on their own page in this section.
Next steps
- Agents: what lives behind each profile tab, from instructions to schedules.
- Handles and channel grants: handles, channel grants, and what publishing hands over.
- Admin: sign-in and roles, the management MCP, and usage estimates.
- Security model: the guarantees behind the permission checks above.
- Deploy and operate: the Cloudflare and Node differences named here.