Super Admin

SUPERUSER ONLY ← Dashboard
–
Total Users
–
Active Users
–
Total Agents
–
Total Workflows
–
Runs This Month
–
Runs Today
⚡ Advanced Developer Features — CLI Tool
Grant permission for admins to use CLI Tool agents on this installation. Once granted, admins must still accept responsibility in Settings → Advanced before it activates.
📏 Plan limits
The plans were made for the hosted service, not for installed copies. This is the master switch for all of it.
On premises — leave it off. No price list at sign-up, no plans handed out, nobody capped. This is the default.
On the cloud — turn it on. Sign-up then shows the price list, every new account starts on Free (2 agents, 2 workflows, 30 runs a month, no scheduling), and an account that has no plan — one made before you switched this on — is held to those same Free limits.
Anyone who picked a plan is always held to it either way, and superusers are never limited.
💾 Backups
Every night AIK packs the database, the settings and every user's files. A copy kept only on this machine dies with it — send one off-site, encrypted, to storage you own (Backblaze B2 or any S3-compatible). The two passwords that unlock it are shown once: keep them in your password manager, or the backups cannot be read on another machine.
Loading…
Off-site storage
🔗 Connect apps for everyone
Register one app per provider here, and every user of this install connects by pressing 🔗 Connect on Integrations — nobody creates an app of their own. In each app, add this redirect address: …. Google shows users an “unverified app” warning and allows 100 users until Google has verified your app (YouTube and Drive scopes need that review); LinkedIn, Slack and GitHub have their own reviews for public apps. A user's own app, if they add one, is used instead. Secrets are stored encrypted and are never shown again.
👤 Other users' agents and workflows
Admins can always see other users' agents and workflows; every look is written to the activity log. Changing or deleting them is allowed only while this switch is on — use it on a client's written instruction, then switch it off (your DPA: access only to run the service or on the client's instruction). Running another user's agent is never allowed, and their saved passwords and keys are never shown. Every flip of this switch is logged.
🔗 Connect through aikautomation.com
For an AIK on the client's own server. Off: each service is connected with the client's own app (full privacy — the recommended way). On: a connection with no app of its own may sign in through aikautomation.com and AIK's app instead — Google, YouTube, Gmail, HubSpot, LinkedIn, GitHub, Slack, Notion (not Microsoft 365 or TikTok). The person is asked each time. The sign-in then passes AIK's server, and Google/YouTube/Gmail/HubSpot connections renew there about every hour, so they stop if aikautomation.com is down. Needs this AIK's licence and internet access to aikautomation.com.
🔌 Outside tool servers (MCP)
Lets a user give one of their agents one outside tool server (an https:// address, e.g. a GitHub or Linear MCP server) beside AIK's own tools. Off by default. While on, every call to an outside tool still counts as an action — with Ask before acting it waits for the owner's OK — and the Agent Fence page shows it as outside.…. Nothing is ever started on this machine. Leave it off unless a client asks for a specific server.
📁 Folders outside AIK
Users may open folders outside AIK for their own agents (on/off, default on; switch off on a hosted server). Each user still switches it on themselves in Settings → Security and lists the folders. AIK's own files, other users' folders and whole drives are always refused.
On premises — leave it on. Staff need their shared invoices folder.
On the hosted server — switch it off. A user's "outside" folder would be a folder on your server.
🛡️ Agent fence
Run every agent's tools in a sandbox that sees only its own user's files (on/off, default off; needs bubblewrap). Inside it a tool cannot see other users' files, AIK's keys or settings, and the file and Excel tools get no internet. Watch it on the Agent Fence page.
Linux: needs bubblewrap (sudo apt-get install -y bubblewrap). Windows: uses Windows' own AppContainer lock; needs one administrator step the line below names (the installer does it). The browser agent is not fenced on Windows yet.
🌙 Nightly rehearsal
Every night at 03:30 AIK runs a set of real jobs on its own test account — demo invoices through chat, Refuse and Approve, Gmail / YouTube / Google (held, never sent), and a start of every agent — then checks what really happened and reads the last day's run texts for anything that contradicts itself. One e-mail with the result goes to the Super Admins on the nights it runs. Each night's result is below.
✉️ Welcome e-mail
Sent once to every new person, right after they confirm their e-mail address. Empty = nothing is sent — leave it empty on a client's own install, so their staff never get a note written for your customers.
🤖 AI drafts for support tickets
Each new ticket gets a draft answer and a spam check, shown in Support → Ticket Inbox. Nothing is sent until a person presses Send. Every draft uses your own AI model and key, which is why only the super admin can switch it on.
Users — plans, usage, backup, delete — are on the Admin page.
Open users →