Skip to content

Platform settings

Platform settings are global, not per workspace. A platform operator changes them from the dashboard under Platform administration → Platform settings, and every process picks the new value up without a restart.

This page is the single description of how a setting resolves. Pages that mention an individual setting link here rather than restating the rules.

Who can change them

Reading or changing settings requires the platform-administrator permission described in Authentication. Settings are installation-wide and can contain operational policy that an unaffiliated tenant member must not inspect.

The deploy-time bootstrap task can grant a known provider subject immediately or create an email invitation. A matching trusted email claim accepts that invitation on the next sign-in. Both paths use the administrative database connection; the application database connection cannot grant itself access. The development-only password login is the sole exception: when explicitly armed outside production, it grants its single local account administrator access.

The settings table is global rather than per workspace, and the application database connection has no privileges on it at all. Every write goes through the API's administrator connection.

When a change takes effect

A saved setting normally applies to the very next piece of work. Every process is told about the change as it happens, and even if that notification is missed the value is re-read within 30 seconds. Nothing needs restarting.

A save that succeeds stays saved. The cache in front of it can be unavailable without losing the change.

Settings and their fallbacks

Until you save a value, a setting falls back to the environment variable set for the deployment, and failing that to the built-in default below.

The general numeric settings ignore an unreadable environment value and use their default. The automatic-investigation spending limits do the opposite: an unreadable value stops the platform from starting, so a malformed budget can never become an unenforced one.

Setting Accepted values Fallback Effect
MAX_TOKEN_LIFETIME_SEC 300–2592000 86400 Maximum accepted legacy API bearer-token lifetime in seconds, separate from browser sessions.
SESSION_IDLE_SECONDS 300–604800 86400 Browser idle lifetime in seconds. Valid activity renews idle expiry without changing authentication time or absolute expiry.
SESSION_ABSOLUTE_SECONDS 300–2592000 604800 Absolute browser session lifetime from directory authentication. Applies when a session is created.
CLASSIFY_FAIRNESS_WINDOW_SEC positive integer 3600 Window used to pick the least-recently-served tenant on the classify stream.
INCIDENT_AUTO_ARCHIVE_DAYS 0–3650 7 Age at which an inactive terminal incident is deleted. 0 disables automatic deletion.
RECOVERY_MAX_CHECKS 1–10 3 Recovery verification attempts before the platform stops rechecking.
EVIDENCE_ROW_LIMIT 289–10000 1000 Newest-first ceiling on past tool results one investigation reads back. Bounds the database read, not what the investigator sees.
EVIDENCE_BUDGET_CHARS 83–200000 24000 Size cap on the prior evidence a continued investigation carries, spent newest first. This decides what the investigator sees.
AUTO_INVESTIGATION_TENANT_LIMIT_24H non-negative integer 0 Rolling 24-hour cap on automatic investigations per tenant. 0 is unlimited.
AUTO_INVESTIGATION_MONITOR_LIMIT_24H non-negative integer 0 Rolling 24-hour cap on automatic investigations per monitor. 0 is unlimited.
AUTO_INVESTIGATION_TENANT_COST_LIMIT_USD_24H non-negative 0 Rolling 24-hour configured-cost cap per tenant, in USD. 0 is unlimited.
AUTO_INVESTIGATION_MONITOR_COST_LIMIT_USD_24H non-negative 0 Rolling 24-hour configured-cost cap per monitor, in USD. 0 is unlimited.
REGISTRATION_MODE approval_required, open, or closed approval_required Controls whether workspace registration waits for platform approval, starts immediately, or is closed.
PRODUCT_NAME 1–80 characters PRODUCT_NAME or SRE Platform Names the product on public onboarding surfaces.
PRODUCT_VALUE_LINE 1–180 characters PRODUCT_VALUE_LINE or the built-in evidence-focused value line Explains the product on the public landing page.
TERMS_URL HTTP(S) URL or disabled TERMS_URL Links the terms accepted during workspace registration.
PRIVACY_URL HTTP(S) URL or disabled PRIVACY_URL Links the public privacy notice.
SUPPORT_URL HTTP(S) URL or disabled SUPPORT_URL Links public and access-error screens to support.
LLM_RUNTIME runtime / provider / model selection the environment bootstrap value Selects the active Triage Engine runtime, provider, model, turn cap, and custom pricing.
SMTP validated host, port, sender, TLS mode, and optional username; or disabled SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_FROM, and SMTP_USERNAME Adds a plain-text email copy after the durable in-app notification is written.

Notification email

Every notification is written to the recipient's in-app inbox first. Email is an optional secondary copy. With email disabled, the inbox still works and no delivery error is recorded.

Configure the SMTP host, port, sender email, TLS mode and optional username in Platform administration → Platform settings → Notification email. A username requires a password. The password is encrypted separately from the setting, is write-only, and is never returned to the browser. Use Send test email to deliver a plain-text test to the signed-in platform operator's verified email address. A rejected test displays the SMTP adapter's error so the operator can correct the endpoint or credentials.

Before an operator saves a value, the non-secret fields can fall back to SMTP_HOST, SMTP_PORT, SMTP_SECURE, SMTP_FROM and SMTP_USERNAME. All required fields must be present and valid when any of them is set. Add the password from the Platform settings screen after sign-in. A saved disabled state overrides the environment fallback without affecting in-app delivery.

Registration mode, product name, public value line, and the terms, privacy, and support URLs live in the same administration section. /public-config reads the current values, so a successful save is visible on the next public request without an API restart.