Admin Links: Keys Policy Ops Usage Monitor History Keys JSON Usage JSON History JSON Health Models API Docs OpenAPI

Policy Operations

Register users/apps/principals, upsert or revoke quotas, and issue one-time safe tokens.

{{flash}} {{token_panel}}

Query Policy Revisions

Use filters to query quota revisions and paginate each policy table lazily.

Default integrated cap per section. Matches user ID and display name. Matches application ID and display name. Matches principal ID, kind, namespace, groups, app binding. Filter revisions by lane. Exact match for subject policy history (click user/principal rows for shortcut). Contains match for revision name (example: hour). Show active, revoked, or all revisions. Filter pricing revisions by scope. Exact subject match (for example key:openai:prod or ollama:gemma4:e2b). Show active, revoked, or all pricing revisions.
Reset

Register User

Required. Must start with user: (example: user:alice). Optional human-friendly name shown in admin tables.

Register Application

Required. Must start with app: (example: app:crm-assistant). Optional label for reporting and UI.

Register Principal

Required. Prefix must be one of agent:, service:, human:. Optional. Typical values: agent, service, human. Optional CSV list used for ACL sharing (example: app-dev,finance). Optional. Default is tenant:kogwistar. Optional link to an application node (example: app:crm-assistant). Optional free-text purpose for this principal.

Quota Upsert (Append-Only Revision)

Required. One of: principal, user, key, token. Required. The node ID for that lane (example: agent:azure-manual-demo). Required name for revision grouping (example: hour, burst). Required. One of 10s, hour, day, week, month, infinite. Optional budget cap for this period. Optional token cap for this period. Optional request count cap for this period.

Quota Revoke (Append-Only)

Required. One of: principal, user, key, token. Required subject ID to revoke quota for. Required quota name to revoke (append-only revision). Optional reason shown in revision payload and audit.

Pricing Upsert (Append-Only Revision)

Required. One of key, provider_model, model. Required. For provider_model use provider:model. Required non-negative number, for example 0.002. Optional revision note for auditability.

Pricing Revoke (Append-Only)

Required. One of key, provider_model, model. Required. Matches the same key used during upsert. Optional reason shown in pricing revisions.

Issue Safe Token (One-Time Reveal)

Required principal that will authenticate with this safe token. Optional. Default is tenant:kogwistar. Optional. Link this token usage to an end user (example: user:alice). Optional app binding for reporting (example: app:crm-assistant). Optional CSV scopes. Default: model.invoke.

Users

{{users_pager}} {{users_rows}}
User IDDisplay Name

Applications

{{applications_pager}} {{applications_rows}}
Application IDDisplay Name

Principals

{{principals_pager}} {{principals_rows}}
Principal IDKindNamespaceApplication IDGroups

Quota Revisions

{{quotas_pager}} {{quotas_rows}}
IDLaneSubjectQuota NamePeriodMax USDMax TokensMax RequestsRevoked

Pricing Revisions

{{pricing_pager}} {{pricing_rows}}
IDScopeSubjectPrice / 1k tokens (USD)RevokedReason