Platform Admin Agent
1. What it is
Platform Admin Agent is an AI assistant that lets administrators manage users, audit permissions, inspect org structure, and check system health through natural-language conversation in Ask AI. It works with live data — ask a question about your business, and it queries the actual records.
- Enablement: Licensed app, disabled by default. Included in the Platform Enterprise package. Standard-tier tenants can purchase it as an add-on. An admin enables it from the Apps Marketplace, then configures it from the app’s Settings tab.
- What it is not: Platform Admin Agent works with live data and takes actions. It is not a help or documentation assistant — for questions about how to use a feature or where to find a setting, ask @platform_help instead.
2. Standing it up
- Go to Apps → Manage Apps and enable Platform Admin Agent. A license must already be granted for your business.
- Open Apps → Platform Admin Agent → Settings. The agent is enabled for read-only queries by default.
- Decide whether to turn on Allow write tools (off by default). With this on, admins can activate or deactivate users, change roles, send invitations, and trigger password resets through the agent. Each write action shows a diff preview and requires explicit confirmation before it runs.
- Decide whether to turn on Allow autonomous operations (off by default). This lets the agent run unattended — sentinel metric alerts, scheduled remediation scans, email, tasks, notifications, webhooks, and AI analysis. Remediation scans also queue pending-approval actions when this is on.
- Open Ask AI from the top bar and try a prompt such as “How many active users do we have?” The Overview tab of the app shows nine suggested prompts you can click to open Ask AI with the question prefilled.
Only Admin and Super Admin users can see or use this agent. Non-admins cannot invoke it, and the app tile is hidden from them in the Apps page and sidebar.
3. How it fits together
Read tools, write tools, and autonomous tools are the three layers of capability, each controlled by its own setting.
Read tools are always available when the agent is enabled. They let you:
- Search and inspect user accounts (by name, email, role, status, department, or location).
- List departments and locations with user counts.
- Get a role summary — how many users hold each role.
- Check a specific user’s permissions.
- List all Admin and Super Admin accounts.
- List pending invitations that have not been accepted.
- Search the platform audit log by user, action, or date range.
- Get a system overview: active users, inactive users, enabled apps, and business info.
- Audit org data quality — find active users missing a department, manager, job title, or location.
- Compare access between two users — see which permissions they share and which differ.
- Check app access health — inspect enablement, licensing, pinning, and configuration drift across all apps.
- Check integration health — inspect external integrations, their health state, and last sync time without exposing credentials.
- Check agent harness health — see Descriptor v2 coverage, effective tool counts, and contract integrity.
Read tools never change anything.
Write tools require the Allow write tools toggle to be on. There are four:
- Activate or deactivate a user — sets the user’s membership status in this business.
- Change a user’s role — switches a user between member, manager, and admin.
- Send or resend an invitation — emails an invitation link to a user who has not yet accepted.
- Send a password-reset email — emails the user a self-serve password-reset link.
Every write action shows a before-and-after diff preview and waits for explicit confirmation. Connected MCP clients receive an approval request instead, unless the admin has marked that connector trusted for this business.
Autonomous tools require the Allow autonomous operations toggle. They run without a human in the loop — invoked by automation playbooks on a schedule, not by chat. Capabilities include sentinel metric alerts (fire when a watched metric crosses a threshold), webhooks, email, task creation, in-app notifications, and AI analysis.
Remediation scans sit between read and write. Two scans exist: one surfaces stale invitations (not accepted within a configurable number of days), the other surfaces privileged accounts that may need an access review (admins who have not signed in within a configurable window). When autonomous operations are off, the scans return findings as evidence only. When autonomous operations are on, each finding also queues a pending-approval action and notifies every active admin.
Worked example — stale invitation cleanup:
An admin asks “Scan for failed invitations.” The agent finds 3 invitations older than 7 days that were never accepted. With autonomous operations off, it lists the 3 users and recommends re-sending or deactivating each one — no action is taken. With autonomous operations on, it also creates 3 pending-approval actions visible in Admin → AI Operations → Pending Approvals. Another admin reviews each one, approves or rejects it, and the approved action executes through the same write-tool path with the same safety guards.
Super Admin protection. Unless the acting admin is themselves a Super Admin, the agent refuses to deactivate, change the role of, send an invitation to, or reset the password of any Super Admin account. The agent also refuses any action that would leave the business with no active Super Admin, or with no active administrator at all. These guards apply equally in chat, through MCP, and through the autonomous action runner.
Ask AI is the interface. This is an agent-only app — it has no data-entry forms or grids of its own. Every conversation runs through Ask AI. The app surface has five tabs: Overview (suggested prompts), My Activity (your personal usage), Analytics (business-wide usage), Autonomous Operations (playbook execution ledger), and Settings. The @platform_admin mention is hidden from the autocomplete for non-admin users, so they do not encounter a control that would reject them.
4. Running it
Asking a question
Open Ask AI and type a natural-language question. The agent recognises admin-intent queries and routes them automatically. You can also click any of the nine suggested prompts on the Overview tab to open Ask AI with the question prefilled.
Example prompts:
- “How many active users do we have?”
- “Show me all admins in this business”
- “List pending invitations”
- “Show me users by department”
- “Audit users missing department, manager, job title, or location”
- “Compare permissions of user A and user B”
- “Check app licensing and configuration health”
- “Show unhealthy or stale integrations”
- “Show recent permission changes”
Making a change (write tools)
Ask the agent to perform a write action — for example, “Deactivate jane@example.com.” The agent looks up the user, shows a diff preview of what will change, and asks you to confirm. Confirm to execute, or decline to cancel.
You can identify users by email address or by user ID in any write request. The agent resolves emails case-insensitively.
Reviewing autonomous operations
Go to Apps → Platform Admin Agent → Autonomous Operations. This page shows the safety state (Running, Paused, or Disabled), a 7-day action breakdown by status, and the recent action ledger. Pending approvals link to the Automation Hub approval queue where another admin can approve or reject them.
Pausing autonomous operations
On the Autonomous Operations page, click Pause autonomous operations to immediately stop all autonomous playbooks for this business. Click Resume autonomous operations to restart them. The pause is an emergency stop — no autonomous action runs while it is active.
Reviewing your personal usage
Go to Apps → Platform Admin Agent → My Activity. This page shows your tool calls, success rate, which tools you use most (classified as read or write), and your recent call history. The time range can be set to 7, 30, or 90 days (default 30).
Reviewing business-wide analytics
Go to Apps → Platform Admin Agent → Analytics. This shows all admins’ activity aggregated: how many admins used the agent, total tool calls, read vs. write breakdown, tool mix with success rates and latency, routing quality, safety status, and approximate token cost. The same 7/30/90-day range selector applies.
The Settings page also links to the platform-wide Agent Health page under Admin, which covers all AI agents in the business, not just this one.
5. Settings
All settings are at Apps → Platform Admin Agent → Settings.
| Setting | Default | What it changes |
|---|---|---|
| Enable Platform Admin Agent | On | Master switch. When off, the entire app disappears from the Apps page, sidebar, and navigation shortcut. History and analytics pages remain accessible so admins can review past activity. |
| Allow write tools | Off | Unlocks four actions: activate/deactivate user, change role, send invitation, and send password-reset email. Each one still requires explicit confirmation before it executes. |
| Allow autonomous operations | Off | Lets autonomous playbooks run unattended: sentinel alerts, remediation scans with approval-action queueing, webhooks, email, tasks, notifications, and AI analysis. Autonomous operations include AI analysis, which makes billable LLM calls without anyone watching. |
Write tools and autonomous operations are independent. You can enable write tools without enabling autonomous operations, or vice versa. Both require the agent itself to be enabled.
Turning the agent off disables the whole app, including its sidebar entry and navigation shortcut. To re-enable it, go to Apps → Manage Apps.
6. More help
- Platform Admin Agent FAQ — specific setup and operating questions, limits, and troubleshooting
- Ask AI for Admins — how Ask AI routes questions, including how it reaches this agent
- AI Operations — the platform-wide pause controls, approval queues, and agent health dashboard
- Ask AI — the assistant answers questions about Platform Admin Agent from these articles.