ObjectOSAdministration
Where system administrators manage users, access, settings, and integrations — and which page answers which task.
This section is for the system administrator of an ObjectOS deployment: the person who onboards users, grants access, wires up sign-in, email, storage, and integrations, and keeps the system healthy. You manage people and their permissions day to day; the applications, objects, and permission sets themselves ship with the platform and the app packages you install.
Setup and Studio
Permissions are designed in Studio, assigned in Setup. That
sentence is the canonical statement of a split that runs through the
whole product, not a rule about permissions alone: Setup operates a
running deployment, Studio authors the metadata that deployment runs.
Both live inside the same UI at /_console/; neither is a surface of
its own.
| Setup | Studio | |
|---|---|---|
| Answers | Who is here, and what may they do? | What does this app consist of? |
| Where | /_console/apps/setup | /_console/studio |
| Gated by | setup.access | studio.access |
| For | System administrators | Implementers and developers |
Most administration never leaves Setup — you enter Studio only to author permission sets or to run the explain engine.
The Setup app
The built-in administration app lives at /apps/setup and
requires the setup.access permission. Its left-hand navigation is
contributed at runtime by the capability plugins that are loaded, so the
menu you see reflects exactly what your deployment runs — a disabled
capability contributes nothing and its group stays empty.
The stable navigation groups:
| Group | What you find there |
|---|---|
| Overview | System Overview dashboard |
| People & Organization | Users, Business Units, Teams, Organizations, Invitations |
| Access Control | Positions, Permission Sets, Sharing Rules, Record Shares, API Keys |
| Approvals | Approval processes (when the approvals plugin is loaded) |
| Configuration | All Settings, Branding, Authentication, Email, File Storage, AI & Embedder, Knowledge, Feature Flags |
| Diagnostics | Sessions, Notification Events, Audit Logs |
| Integrations | Webhooks |
| Advanced | OAuth Applications, Signing Keys (JWKS), Identity Links, User Preferences |
Task map
| I need to… | Read |
|---|---|
| Add users, build the org tree, manage teams | Users & Organization |
| Onboard, offboard, or change someone's access | Managing Access |
| Understand the whole access model | Permissions |
| Configure sign-in, OAuth, SSO, 2FA | Authentication |
| Change runtime and tenant settings | System Settings |
| Set up transactional email delivery | |
| Configure file storage (S3, local disk) | Storage |
| Connect external business databases | Data Sources |
| Use the REST API and API keys | API Access |
| Deliver outbound webhooks | Webhooks |
| Configure AI providers, embedders, RAG | AI Service |
| Connect Claude or another MCP client | Connect AI Tools (MCP) |
| Configure artifact loading, database, cache | Runtime Configuration |
| Plan backups and disaster recovery | Backup |
| Upgrade or roll back safely | Upgrade |
| Harden for production | Production Readiness |
| Read logs, metrics, and audit trails | Observability |
| Diagnose a broken deployment | Troubleshooting |
Where to go next
| Task | Page |
|---|---|
| Your first admin task: add people and structure | Users & Organization |
| Give a new hire access | Managing Access |
| Learn the layered access model | Permissions |
| Pre-production checklist | Production Readiness |