---
title: Team and Enterprise Settings
summary: Roles, single sign-on, the audit log, and usage limits: what's available once more than one person uses the same instance.
date: 2026-09-09
---

# Team and Enterprise Settings

Roles, single sign-on, the audit log, and usage limits: what's available once more than one person uses the same instance.

Everything below lives under **Settings** and applies once your HeartBeatAgents instance is shared by more than one person. Single sign-on and custom roles are gated to the Nexus plan; accounts, the audit log, and usage limits are available on every plan.

## Accounts

An administrator provisions employee accounts from **Settings → Accounts**, each with its own workspace. An account signs in either with a password you set (temporary: they change it themselves at first sign-in) or SSO-only, with no password at all.

Deactivating an account has two distinct scopes, and they matter:

- **Deactivate account and suspend agents**: also stops that workspace's agents, standing orders, and running tasks.
- **Deactivate account only**: their agents and automations keep running autonomously.

The last remaining administrator can't be deactivated or demoted, and nobody can deactivate or demote their own account; another administrator has to do it.

## Roles

Beyond the built-in Administrator and Member distinction, custom roles (Nexus plan) let you grant a narrower, specific set of permissions to an account. You can only grant a permission you hold yourself, so a custom role can't be used to escalate beyond what its creator is allowed to do.

Workspace permissions, grantable to any account in your organization:

- **Agents**: create, read, update, delete, execute
- **Monitors** (standing orders): create, read, update, delete, execute
- **Conversations**: create, read, delete
- **Tools**: create, read, update, delete
- **Organization**: read, update, manage members, manage roles
- **API keys**: create, read, revoke
- **Audit log**: read
- **Integration definitions**: manage (defining or changing a custom integration; connecting to one that already exists doesn't need this)

A separate set of instance-level permissions (system health, license, SSO, the public tunnel, user provisioning, and authoring instance-wide roles) governs the install itself rather than one workspace. These are held only by the instance administrator, never granted through a workspace's own custom roles, so a workspace owner can't reach install-wide settings just by being an owner.

## Single sign-on

Available on the Nexus plan. Configure your identity provider's OIDC issuer URL, client ID, and client secret, then restrict sign-in to specific email domains. Two provisioning modes:

- **Require admin provisioning** (recommended): only accounts an administrator has already added can sign in through SSO. Anyone else is turned away.
- **Auto-provision on first sign-in**: anyone in your allowed email domains gets an account automatically the first time they sign in.

## Audit log

Every tool an agent ran, what it was given, and what it returned, filterable by tool, agent, or status, and exportable as CSV or JSONL. Each execution is chained into a tamper-evident hash log: the audit page can verify the whole chain on demand, and names exactly where it breaks if a row has been altered, rather than reporting a bare mismatch.

## Usage and limits

Set a daily spend ceiling, across every agent, for the whole organization. Once it's reached, new runs pause until the next day instead of continuing to bill. You can also override the per-model price used for cost tracking: a model with no override and no built-in catalog price accrues zero tracked cost, so it can't be capped by a budget until you price it yourself.

## License

Plans (Trial, Core, Scale, Nexus) are managed from **Settings → License**. A Nexus license is synced from the license server rather than edited locally: change the agent cap or another entitlement there, then click **Sync** here to pull the update.

## Related

- [Security](/en/docs/guides/security): the boundaries every one of these settings operates inside
- [Configuration](/en/docs/getting-started/configuration): initial setup, before a second person joins
- [Value Tracking](/en/docs/features/value-tracking): the other organization-wide setting, currency and hourly rate, that isn't specifically about access control
- [Custom Integrations](/en/docs/guides/custom-integrations): defining your own integration, another org-level capability alongside accounts and roles