Administration

Configure how your organization uses koinon: who can access it, how knowledge is processed and which applications may connect. Organization settings and protected installation configuration have different owners.

Start with the task

What you need to do	Follow this path	Result to check
Install the product and establish the first administrator	First start in production	The verified account has the intended organization membership; API and worker roles use the migrated stores.
Configure an existing organization for its first useful answer	Guided configuration	A representative source is processed and an authorized user receives a source-backed answer.
Change a provider, model, embedding target or delivery policy	Configuration lifecycle	The new operation succeeds, source history remains readable and the rollback conditions are understood.
Find a particular administration control	Administration guide	The correct page, organization and authority are identified before a change.
Choose models and document RAG or RLM behavior	Knowledge behavior	Current model assignments, supported capabilities and saved policy agree.
Configure original files and durable processing	Storage providers, then durable staging	Final objects and staged originals survive process replacement; the relevant consumers are enabled.
Diagnose an unavailable service or index	Platform health	The observation, coverage and next action are understood without treating unknown as healthy.
Enable administrator email without directory synchronization	Operator delivery contacts	A separately approved contact has a genuine signed binding, current administrator authority and valid expiry; this does not grant membership or replace invitation verification.

Open Settings from the avatar menu in the intended installation. An account with one authorized organization enters that organization without a selector. Only accounts with several authorized organizations need to choose one using the organization selector. The browser administration area requires organization administrator access. Deployment operators use protected installation configuration for infrastructure; scoped API permissions do not automatically open browser administration. See the role boundaries before assigning authority.

Set up an organization

The Knowledge & AI overview in Settings groups connections, model assignments, answer behavior, the shared assistant and indexing by task. Connection counts describe saved records and recorded checks; they do not certify the entire knowledge pipeline. Follow guided configuration for the setup sequence, or use the administration guide to find a particular setting. Identity and appearance covers the installation's name, logos and colors.

Manage people and connected applications

People and organization explains the directory, organization structure and access controls. Use Authorized applications to review a connection. Register applications covers the deployment's OAuth configuration.

A personal API token and an authorized application have different lifecycles. The profile and API token guide describes personal credentials and their permission bounds.

Corporate profile synchronization explains organization names, photos and positions, verified identity bindings, provider requirements and refresh status. Personal preferences and access roles retain their separate ownership.

Choose knowledge behavior

Use organization knowledge behavior for RAG, RLM and retrieval settings. Agents, embeddings and knowledge engines explains how these choices fit together.

Configure infrastructure

An operator manages databases, storage, encryption and deployment observations. Start with Operations and file storage. Organization model settings do not change a storage bucket or database binding. Final document, structured and private-file profiles are separate from durable bulk staging; configure both the needed stores and the workers that consume them.

Check a change before extending it

Save the smallest useful configuration, reload it and run the intended operation with representative example data. Repeat the read with an end-user account and a source outside that account's scope. Inspect processing state, source versions and answer audit rather than relying only on a success message in the form.

The first-run acceptance exercise gives a repeatable sequence. Keep its outcomes with the deployment's change record. Provider readiness, a completed import and a published answer are different observations, and none replaces a tested backup and restore.