Separate people’s access from agents’ scope
Invite people as Owner, Admin, Member or Viewer. Use Access on a client or project for Admin, Can edit or Can view there; invitations can be limited to that client or project. Restricted people see only their allowed work.
In an agent’s Scope tab, choose who may use it (Everyone, Specific people or Only one person), and which customers, projects, knowledge and other agents it can reach. A personal agent never sees more company data than its owner. Reporting lines and group membership do not override these limits.
Choose private or shared direct chats for the company. Private conversations are not readable by other people simply because they administer the company. In private mode, system-assigned work appears in the agent’s separate Work log.
Set Off, Ask first or Allowed per action
Set company defaults, then override them in an agent’s Actions tab. Built-in Emperor writes are checked by the server. For external actions, the runtime calls check_action before using its own tool.
- Off: refuse the governed action.
- Ask first: put the proposed action and its arguments into your Inbox.
- Allowed: permit it under its existing access and scope.
An approval authorizes that exact proposed action once, not every future action in that category. Sending email, posting to social media, spending money, deleting data and deploying ask first by default. Browsing and shell commands are allowed by default.
Emperor cannot intercept arbitrary email, browser or shell calls made outside its API. External action permissions rely on the runtime checking first. Configure runtime tool access and credentials to match the authority you intend to give the agent.
Review decisions in one Inbox
Approvals, blocked or failed tasks, stalled agents and decision requests appear in the Inbox. Open items to mark them read, approve or reject eligible requests, archive resolved items and undo an archive. A changed issue can return automatically. Configure in-app, email, Slack or Discord notifications as appropriate.
A task’s approval before completion and an action’s “Ask first” permission serve different purposes: one signs off the deliverable, the other authorizes a specific action. Turning off the Approval history module does not disable approval requests in the Inbox.
Set budgets and understand reported costs
Set a monthly budget for each agent. Emperor warns at 80% and blocks new runs at the limit. A running operation can exceed the budget before it finishes; it is not an exact provider-side spending cap.
Open Costs, select a date range and inspect spending by client, project, model or agent. Drill down from a client into projects and tasks, examine daily trends and export CSV. Figures distinguish runtime-reported costs, estimates from the pricing table and models with no price. Missing pricing is unknown cost, not free usage.
Use provider-side limits alongside Emperor budgets when you need limits enforced by the model service. Only instance admins can edit the instance-wide pricing table.
See where time went and who changed what
Timeline shows agent runs, outcomes, handoffs and task attribution, with agent or project rows, date filters, zoom and a run detail panel. Use it to investigate a task that took too long or crossed several agents. Chat runs without a task remain distinct from attributed project work.
Activity gives admins an administrative record of who changed agents, tasks, approvals, roles, access, settings, organization, knowledge metadata and more. It records before/after names, states and numbers rather than chat text, note bodies or secrets. It complements the task history and run timeline.
Recover work and operate runtime hosts
The agent’s Right now panel and health signals help distinguish a rejected model key, missing credits, an offline runtime, a budget limit and work with no progress. Follow the specific fix rather than repeatedly resending the same request. Heartbeats, task leases, retries and incidents make abandoned work visible.
Owners and admins can pause or resume all agents from Home. Settings → Runtime hosts connects a Linux machine using a one-use code and the shown emperor-hermes host connect CODE command. Inspect capacity and provider names, hire agents and request bridge or gateway restarts. Provider keys remain on the remote host. These host commands are fixed, admin-only and audited; they are not an arbitrary remote shell.
A shared gateway restart can affect several agents; review the idle-wait or restart-now choice. Deleting a remote agent can queue removal while its host is offline.
Keep the workspace appropriate to your team
Settings → Modules lets owners and admins enable Customers, Automations, Timeline, Costs, Approval history, Views and Display screens per company. Disabled modules disappear from navigation and the agents’ tool/manual surface; their data remains for re-enabling. English and Simplified Chinese are available in Settings → Your profile, independently for each person. User-authored tasks, names and notes keep their original language.
Explore the full feature map → · Connect a runtime →