Platform Admin Agent

Platform Admin Agent

1. What it is

Platform Admin Agent is an AI assistant that lets administrators manage users, audit permissions, inspect org structure, and check system health through natural-language conversation in Ask AI. It works with live data — ask a question about your business, and it queries the actual records.

• Enablement: Licensed app, disabled by default. Included in the Platform Enterprise package. On other tiers it is available only through a licence grant from your account team — it is not sold as a separate line item. An admin enables it from the Apps Marketplace, then configures it from the app’s Settings tab.
• What it is not: Platform Admin Agent works with live data and takes actions. It is not a help or documentation assistant — for questions about how to use a feature or where to find a setting, ask @platform_help instead.

2. Standing it up

1. Go to Apps → Manage Apps and enable Platform Admin Agent. A license must already be granted for your business.
2. Open Apps → Platform Admin Agent → Settings. The agent is enabled for read-only queries by default.
3. Decide whether to turn on Allow write tools (off by default). With this on, admins can activate or deactivate users, change roles, resend invitations, send password-reset links, and stage records from pasted text for import through the agent. Each write action requires explicit confirmation before it runs. Writes also need Enable Action Execution on in Apps → Ask AI → Settings, where it is on by default.
4. Decide whether to turn on Allow autonomous operations (off by default). This lets autonomous playbooks run unattended — sentinel metric alerts, email, tasks, notifications, webhooks, and AI analysis; all but AI analysis also need Enable Action Execution. When this and write tools are both on, and Enable Action Execution is on in Ask AI settings, remediation scans you run from chat also queue a pending-approval action for each finding someone could act on, and notify only the admins who could make that change.
5. Open Ask AI from the top bar and try a prompt such as “How many active users do we have?” The Overview tab of the app shows nine suggested prompts you can click to open Ask AI with the question prefilled.

Only Admin and Super Admin users can see or use this agent. Non-admins cannot invoke it, and the app tile is hidden from them in the Apps page and sidebar.

3. How it fits together

Read tools, write tools, and autonomous tools are the three layers of capability, each controlled by its own setting.

Read tools are available whenever the agent is enabled — in Ask AI, only while Enable Action Execution is on, because turning it off stops every agent tool, reads included. They let you:

• Search and inspect user accounts (by name, email, role, status, department, or location).
• List departments and locations with user counts.
• Get a role summary — how many users hold each role.
• Check a specific user’s permissions.
• List all Admin and Super Admin accounts.
• List pending invitations that have not been accepted.
• Search the platform audit log by user, action, or date range.
• Get a system overview: active users, inactive users, enabled apps, and business info.
• Audit org data quality — find active users missing a department, manager, job title, or location.
• Compare access between two users — see which permissions they share and which differ.
• Check app access health — inspect enablement, licensing, pinning, and configuration drift across all apps.
• Check integration health — inspect external integrations, their health state, and last sync time without exposing credentials.
• Check agent harness health — see Descriptor v2 coverage, effective tool counts, and contract integrity.

Read tools never change anything.

Write tools require both the Allow write tools toggle and Ask AI’s Enable Action Execution to be on. There are five:

• Activate or deactivate a user — sets the user’s membership status in this business.
• Change a user’s role — switches a user between member, manager, admin, and super admin; only a super admin can grant admin or super admin.
• Resend an invitation — emails the invitation to an existing user who has not yet signed in to this business: with a temporary password if they have never signed in, or with just their sign-in link if they have signed in before (to another business, for example), leaving their password unchanged. The agent refuses while Welcome Emails are turned off in Admin → General Settings → Notifications (User Accounts & Sign-in).
• Send a password-reset email — emails the user a self-serve password-reset link. Password Reset Emails are always on — people need them to get back into their account — so they cannot be turned off.
• Stage an import — stages records from text you paste for a Smart Import target. Nothing is written until you commit the import on its review page.

Every Ask AI write action waits for explicit confirmation; the four account changes also show a before-and-after diff preview. Connected MCP clients use their authenticated scopes and the signed-in user’s permissions to execute directly; each call is recorded in the connector activity log, and the MCP host may show its own confirmation prompt.

Autonomous tools require the Allow autonomous operations toggle, and all but AI analysis also need Ask AI’s Enable Action Execution. They run without a human in the loop — invoked by automation playbooks on a schedule, not by chat. Capabilities include sentinel metric alerts (fire when a watched metric crosses a threshold), webhooks, email, task creation, in-app notifications, and AI analysis.

Remediation scans sit between read and write. You run them from Ask AI — nothing runs them on a schedule. Two scans exist: one surfaces stale invitations (not accepted within a configurable number of days), the other surfaces privileged accounts that may need an access review (admins who have not signed in within a configurable window). When autonomous operations are off or paused, or write tools are off, the scans return findings as evidence only. With Enable Action Execution off in Ask AI settings, they do not run at all. Otherwise, each finding that someone could act on also queues a pending-approval action and notifies only the admins who could carry out its recommended step — Super Admins alone for a change to a Super Admin account, and never the person the finding is about. A finding with no recommended step, a step nobody could run (such as an invitation to someone with no email address), or nobody else eligible to approve it comes back for manual review instead of being queued.

Worked example — stale invitation cleanup:
An admin asks “Scan for failed invitations.” The agent finds 3 invitations older than 7 days that were never accepted. With autonomous operations off, it lists the 3 users and recommends re-sending or deactivating each one — no action is taken. With autonomous operations, write tools and Enable Action Execution all on, it also creates 3 pending-approval actions visible in Admin → AI Operations → Pending Approvals and notifies the admins who could resend those invitations. One of them reviews each action, approves or rejects it, and the approved action executes as that admin, through the same write-tool path with the same safety guards.

Super Admin protection. Unless the acting admin is themselves a Super Admin, the agent refuses to deactivate, change the role of, send an invitation to, or reset the password of any Super Admin account. The agent also refuses any action that would leave the business with no active Super Admin, or with no active administrator at all. These guards apply equally in chat, through MCP, and through the autonomous action runner. They also decide who can approve or reject a queued remediation action: an approved action runs as the admin who approved it, so AI Operations, the approvals email and AI Home offer Approve and Reject only to someone who could make that change themselves — and never to the person the finding is about.

Ask AI is the interface. This is an agent-only app — it has no data-entry forms or grids of its own. Every conversation runs through Ask AI. The app surface has five tabs: Overview (suggested prompts), My Activity (your personal usage), Analytics (business-wide usage), Autonomous Operations (playbook execution ledger), and Settings. The @platform_admin mention is hidden from the autocomplete for non-admin users, so they do not encounter a control that would reject them.

4. Running it

Asking a question

Open Ask AI and type a natural-language question. The agent recognises admin-intent queries and routes them automatically. You can also click any of the nine suggested prompts on the Overview tab to open Ask AI with the question prefilled.

Example prompts:

• “How many active users do we have?”
• “Show me all admins in this business”
• “List pending invitations”
• “Show me users by department”
• “Audit users missing department, manager, job title, or location”
• “Compare permissions of user A and user B”
• “Check app licensing and configuration health”
• “Show unhealthy or stale integrations”
• “Show recent permission changes”

Making a change (write tools)

Ask the agent to perform a write action — for example, “Deactivate jane@example.com.” The agent looks up the user, shows a diff preview of what will change, and asks you to confirm. Confirm to execute, or decline to cancel.

You can identify users by email address or by user ID in any write request. The agent resolves emails case-insensitively.

Reviewing autonomous operations

Go to Apps → Platform Admin Agent → Autonomous Operations. This page shows the safety state (Running, Paused, or Disabled), a 7-day action breakdown by status, and the recent action ledger. Pending approvals link to the Automation Hub approval queue, where an admin who could make the change can approve or reject them.

Pausing autonomous operations

On the Autonomous Operations page, click Pause autonomous operations to immediately stop all autonomous playbooks for this business. Click Resume autonomous operations to restart them. The pause is an emergency stop — no autonomous action runs while it is active. Remediation already waiting for approval can’t be approved until you resume, but it can still be rejected. Pausing doesn’t keep it waiting indefinitely: a review still waiting for approval is cancelled automatically 14 days after it was queued, paused or not.

Reviewing your personal usage

Go to Apps → Platform Admin Agent → My Activity. This page shows your tool calls, success rate, which tools you use most (classified as read or write), and your recent call history. The time range can be set to 7, 30, or 90 days (default 30).

Reviewing business-wide analytics

Go to Apps → Platform Admin Agent → Analytics. This shows all admins’ activity aggregated: how many admins used the agent, total tool calls, read vs. write breakdown, tool mix with success rates and latency, routing quality, safety status, and approximate token cost. The same 7/30/90-day range selector applies.

The Settings page also links to the platform-wide Agent Health page under Admin, which covers all AI agents in the business, not just this one.

5. Settings

All settings are at Apps → Platform Admin Agent → Settings.

Setting	Default	What it changes
Enable Platform Admin Agent	On	Master switch. When off, the entire app disappears from the Apps page, sidebar, and navigation shortcut. History and analytics pages remain accessible so admins can review past activity.
Allow write tools	Off	Unlocks five actions: activate/deactivate user, change role, resend invitation, send password-reset email, and stage an import. Ask AI’s Enable Action Execution must be on too. Each one still requires explicit confirmation before it executes. Approved remediation actions run through these same tools, so with this off the scans queue nothing and an action already queued can only be rejected, until it is cancelled automatically 14 days after it was queued.
Allow autonomous operations	Off	Lets autonomous playbooks run unattended: sentinel alerts, webhooks, email, tasks, notifications, and AI analysis; all but AI analysis also need Ask AI’s Enable Action Execution. Autonomous operations include AI analysis, which makes billable LLM calls without anyone watching. With write tools and Ask AI’s Enable Action Execution also on, makes the remediation scans you run from chat queue an approval for each finding someone could act on.

Write tools and autonomous operations are independent. You can enable write tools without enabling autonomous operations, or vice versa — remediation approvals are the one place they meet, and they need both, plus Enable Action Execution in Ask AI settings. Both require the agent itself to be enabled.

Turning the agent off disables the whole app, including its sidebar entry and navigation shortcut. To re-enable it, go to Apps → Manage Apps.

6. More help

• Platform Admin Agent FAQ — specific setup and operating questions, limits, and troubleshooting
• Ask AI for Admins — how Ask AI routes questions, including how it reaches this agent
• AI Operations — the platform-wide pause controls, approval queues, and agent health dashboard
• Ask AI — the assistant answers questions about Platform Admin Agent from these articles.