Get started with Control plane
Control plane enables you to govern multiple workspaces through a centralized identity. Use this documentation to understand Control plane key components and essential administrator configuration requirements.
Control plane key components
Control plane consists of the following key components:
| Control plane component | Function | Description | Get started |
|---|---|---|---|
| Workspaces | Links multiple workspaces to a single identity for centralized policy management. | Send link requests to workspace owners, and resend, cancel, or unlink workspaces from Control plane. Workspace owners accept or reject link requests from their workspace settings. | Get started with linking workspaces |
| Collaborators | Collaborators help govern workspaces within Control plane. Control plane collaborators are separate from workspace collaborators. | Administrators can invite collaborators, assign roles, and remove access. | Get started with collaborators |
| End user access | Controls which environments end users can access and which groups users belong to. | Add end users manually, assign environment access, and organize users into environment-specific end-user groups. | Get started with end users |
| AI registry | Provides a central place to discover, govern, and share the AI assets built across your organization. | Includes an asset catalog of agents, MCP servers, and AI model routes from linked workspaces. Publish or unpublish assets, and give users and AI clients access through the User portal and Registry MCP. | Get started with the AI registry |
| AI usage | Monitors AI token and request activity across all linked workspaces. | View usage by workspace, environment, route, model, identity, and consumer to see where usage originates, who's driving it, and what's consuming it. | Get started with AI usage |
| Subdomain | Provides the URL where end users access Control plane. | A unique subdomain for your organization. | Get started with subdomains |
Configure Control plane
Administrators must complete the following steps to configure Control plane:
Invite collaborators who help govern workspaces linked to Control plane.
Set up collaborator authentication with your IdP, and then configure either SCIM, JIT, or manual provisioning.
Configure a subdomain so end users can access Control plane.
Link workspaces to enable centralized identity governance.
Create end-user groups for specific environments.
Set up end-user group authentication.
END-USER GROUP AUTHENTICATION IS SEPARATE FROM COLLABORATOR AUTHENTICATION
End-user group authentication requires a separate configuration from collaborator authentication.
Add end users and then assign each user to an end-user group.
Last updated: