You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Commit 5901590
Browse filesBrowse the repository at this point in the historyBrowse files
Copy file name to clipboardExpand all lines: docs/ai-control-plane/getting-started/index.mdx
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ next:
10
10
import { Callout } from"@/mdx/components";
11
11
12
12
<Callouttitle="Built in the open"type="info">
13
-
The AI Control Plane is backed by [Gram](https://github.com/speakeasy-api/gram), an open source project maintained by the Speakeasy team. The project name still appears in the `gram` CLI, the `@gram-ai/*` packages, and `getgram.ai` URLs.
13
+
The AI Control Plane is backed by an [open source project](https://github.com/speakeasy-api/gram)maintained by the Speakeasy team.
14
14
</Callout>
15
15
16
16
This guide gets an organization from sign-in to a governed AI rollout: connect the identity provider, turn on logging, point Claude and the other agent platforms at the platform, distribute MCP servers to the team, and turn on security policies, then watch live traffic confirm it is all working. The work happens on the organization setup board, reached from **Finish organization setup** at the bottom of the organization sidebar.
@@ -23,7 +23,7 @@ This guide gets an organization from sign-in to a governed AI rollout: connect t
23
23
24
24
## The setup board
25
25
26
-
After [signing up](https://login.speakeasy.com/sign-up?state=return_url%3Dhttps%253A%252F%252Fapp.getgram.ai%252Frpc%252Fauth.callback%26speakeasy_as_provider%3Dtrue%26state%3DeyJmaW5hbF9kZXN0aW5hdGlvbl91cmwiOiIvIn0&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback) or [logging in](https://login.speakeasy.com/?client_id=client_01J0XGGZ8MEQS57C5RKB00KN35&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback), the **Organization setup** board guides organization admins through rollout. The **Start enterprise rollout** card on the organization home page (**Begin rollout**, or **Resume rollout** once started) and the **Finish organization setup** action at the bottom of the organization sidebar both lead there, and the board is always available at the organization's `/setup` path.
26
+
After [signing up](https://login.speakeasy.com/sign-up?state=return_url%3Dhttps%253A%252F%252Fai.speakeasy.com%252Frpc%252Fauth.callback%26speakeasy_as_provider%3Dtrue%26state%3DeyJmaW5hbF9kZXN0aW5hdGlvbl91cmwiOiIvIn0&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback) or [logging in](https://login.speakeasy.com/?client_id=client_01J0XGGZ8MEQS57C5RKB00KN35&redirect_uri=https%3A%2F%2Fapp.speakeasy.com%2Fv1%2Fauth%2Fcallback), the **Organization setup** board guides organization admins through rollout. The **Start enterprise rollout** card on the organization home page (**Begin rollout**, or **Resume rollout** once started) and the **Finish organization setup** action at the bottom of the organization sidebar both lead there, and the board is always available at the organization's `/setup` path.
27
27
28
28
Each outcome is a card. Cards move across four columns, **To do**, **In progress**, **Awaiting support**, and **Done**, by drag and drop or from the card menu. Opening a card lands on its own page at a short slug (`/setup/idp`, `/setup/anthropic-observability`, and so on), with a rail of that card's own steps, one on screen at a time, a **Get support** button, and **Mark done** at the end. The board remembers each card's status and owner, so the work can be split across admins and picked up later. The **Wizard** view in the header walks the same cards front to back for a single owner who wants to finish in one sitting.
29
29
@@ -35,7 +35,7 @@ Each outcome is a card. Cards move across four columns, **To do**, **In progress
35
35
36
36
Three steps recur across cards. Each one is completed once and then shows as done wherever it appears.
37
37
38
-
**Enable logging** turns on **Enable Logs**, **Record Tool I/O**, and **Agent Session Capture** together, with a retention banner and a link to [**Organization settings > Settings > Logging & Telemetry**](https://app.getgram.ai/@self/logs) for the remaining options. Nothing downstream can show traffic until this is on. See [Logging and telemetry](/docs/ai-control-plane/org-admin/logging-and-telemetry).
38
+
**Enable logging** turns on **Enable Logs**, **Record Tool I/O**, and **Agent Session Capture** together, with a retention banner and a link to [**Organization settings > Settings > Logging & Telemetry**](https://ai.speakeasy.com/@self/logs) for the remaining options. Nothing downstream can show traffic until this is on. See [Logging and telemetry](/docs/ai-control-plane/org-admin/logging-and-telemetry).
39
39
40
40
**Publish plugin marketplace** publishes a private GitHub repository that acts as the team's plugin marketplace for Claude Code, Cursor, and Codex. It ships with the core observability plugin, which collects usage metrics and enforces authorization, and any plugins built later publish there too. This happens once per project. Add at least one member of the GitHub organization as a collaborator so the repository is discoverable inside agent platforms; the collaborators become admins on the repository so they can connect it to Cursor, Claude, and other marketplaces. See [Plugins](/docs/ai-control-plane/mcp-gateway/plugins).
41
41
@@ -47,7 +47,7 @@ Three steps recur across cards. Each one is completed once and then shows as don
47
47
48
48
### Set up identity provider
49
49
50
-
Connect the SSO provider so the team signs in with existing credentials, then sync its directory so users, groups, and roles stay in step with the identity provider. Both can be finished later from [**Organization settings > Team > IDP and SSO**](https://app.getgram.ai/@self/identity); see [IDP and SSO](/docs/ai-control-plane/org-admin/identity). Once people are signing in, the [Identity](/docs/ai-control-plane/identity) section is where every agent session gets tied to a person, an agent, or a remote identity provider.
50
+
Connect the SSO provider so the team signs in with existing credentials, then sync its directory so users, groups, and roles stay in step with the identity provider. Both can be finished later from [**Organization settings > Team > IDP and SSO**](https://ai.speakeasy.com/@self/identity); see [IDP and SSO](/docs/ai-control-plane/org-admin/identity). Once people are signing in, the [Identity](/docs/ai-control-plane/identity) section is where every agent session gets tied to a person, an agent, or a remote identity provider.
51
51
52
52
**Single sign-on**: pick the organization's SSO provider (Okta, Entra ID, Google Workspace, OneLogin, JumpCloud, PingFederate, and more) and click **Connect**. The WorkOS portal opens in a new tab to configure the connection. Finish there, then return and click **Verify connection**.
53
53
@@ -80,7 +80,7 @@ Claude Cowork and Claude Code are both configured from Claude.ai: organization p
80
80
81
81

82
82
83
-
**Confirm traffic** completes after any tool runs in Claude Code or Cursor, or a Cowork session starts. The observability plugin's hooks run inside a Cowork session, not in an ordinary Claude conversation: on claude.ai, start a new conversation, switch the **Claude Cowork** toggle on, then send a message. The same per-platform instructions are available later from [**MCP Gateway > Plugins**](https://app.getgram.ai/@self/projects/default/plugins); see [Distributing plugins to Anthropic](/docs/ai-control-plane/mcp-gateway/plugins/anthropic).
83
+
**Confirm traffic** completes after any tool runs in Claude Code or Cursor, or a Cowork session starts. The observability plugin's hooks run inside a Cowork session, not in an ordinary Claude conversation: on claude.ai, start a new conversation, switch the **Claude Cowork** toggle on, then send a message. The same per-platform instructions are available later from [**MCP Gateway > Plugins**](https://ai.speakeasy.com/@self/projects/default/plugins); see [Distributing plugins to Anthropic](/docs/ai-control-plane/mcp-gateway/plugins/anthropic).
84
84
85
85
### Set up observability in other platforms
86
86
@@ -99,23 +99,23 @@ Neither OpenCode nor OpenClaw has a plugin marketplace, so the observability plu
99
99
100
100
### Set up LiteLLM
101
101
102
-
Point a LiteLLM proxy at the platform so its traffic is scanned by risk policies and lands in observability. The card is hidden by default. Its steps, **Create a LiteLLM instance**, **Configure the proxy**, and **Confirm traffic**, are driven by the instance itself, so they match what [**Organization settings > Settings > AI Integrations**](https://app.getgram.ai/@self/ai-integrations) shows. See [LiteLLM](/docs/ai-control-plane/org-admin/ai-integrations/litellm).
102
+
Point a LiteLLM proxy at the platform so its traffic is scanned by risk policies and lands in observability. The card is hidden by default. Its steps, **Create a LiteLLM instance**, **Configure the proxy**, and **Confirm traffic**, are driven by the instance itself, so they match what [**Organization settings > Settings > AI Integrations**](https://ai.speakeasy.com/@self/ai-integrations) shows. See [LiteLLM](/docs/ai-control-plane/org-admin/ai-integrations/litellm).
103
103
104
104
### Configure integrations
105
105
106
-
Optionally connect admin and compliance APIs so the platform can import usage, spend, and review data across agent platforms: the Cursor Admin API, the Anthropic Compliance API, and the OpenAI Compliance Logs API. This step is optional. Add or edit provider keys later from [**Organization settings > Settings > AI Integrations**](https://app.getgram.ai/@self/ai-integrations); see [AI integrations](/docs/ai-control-plane/org-admin/ai-integrations).
106
+
Optionally connect admin and compliance APIs so the platform can import usage, spend, and review data across agent platforms: the Cursor Admin API, the Anthropic Compliance API, and the OpenAI Compliance Logs API. This step is optional. Add or edit provider keys later from [**Organization settings > Settings > AI Integrations**](https://ai.speakeasy.com/@self/ai-integrations); see [AI integrations](/docs/ai-control-plane/org-admin/ai-integrations).
107
107
108
108

109
109
110
110
### Distribute MCP servers
111
111
112
-
Choose MCP servers from the catalog to roll out to the organization. Selected servers deploy to the project, bundle into the default plugin, and publish to the marketplace so the team can install them. The card is hidden by default; the same rollout is available any time from [**MCP Gateway > MCP**](https://app.getgram.ai/@self/projects/default/mcp), described in [MCP Gateway](/docs/ai-control-plane/mcp-gateway) and the [catalog](/docs/ai-control-plane/mcp-gateway/catalog).
112
+
Choose MCP servers from the catalog to roll out to the organization. Selected servers deploy to the project, bundle into the default plugin, and publish to the marketplace so the team can install them. The card is hidden by default; the same rollout is available any time from [**MCP Gateway > MCP**](https://ai.speakeasy.com/@self/projects/default/mcp), described in [MCP Gateway](/docs/ai-control-plane/mcp-gateway) and the [catalog](/docs/ai-control-plane/mcp-gateway/catalog).
113
113
114
114

115
115
116
116
### Configure policies
117
117
118
-
Pick what to flag or block in agent traffic. Shadow MCP enforcement forces every MCP tool call through the control plane, so unmanaged servers are blocked and RBAC, authorization, and audit trails stay enforced. Each detection category (secrets, personal identifiable information, prompt injection, financial information, and more) can flag or block on a finding. The card is hidden by default. Refine actions, message scopes, and individual rules any time from [**Security and Policy > Guardrails**](https://app.getgram.ai/@self/projects/default/risk-policies); see [Guardrails](/docs/ai-control-plane/secure/guardrails).
118
+
Pick what to flag or block in agent traffic. Shadow MCP enforcement forces every MCP tool call through the control plane, so unmanaged servers are blocked and RBAC, authorization, and audit trails stay enforced. Each detection category (secrets, personal identifiable information, prompt injection, financial information, and more) can flag or block on a finding. The card is hidden by default. Refine actions, message scopes, and individual rules any time from [**Security and Policy > Guardrails**](https://ai.speakeasy.com/@self/projects/default/risk-policies); see [Guardrails](/docs/ai-control-plane/secure/guardrails).
119
119
120
120

0 commit comments