CONTEXT_OSALPHA

Settings and permissions

Personalize your account, protect access, and configure organization and team rules.

Purpose

This guide brings together personal, security, organization, and workflow settings that control the Allye experience. It also explains how permissions determine what each person or agent can view and change.

Prerequisites

  • Be authenticated.
  • For personal settings, have access to your own account.
  • For organization settings, have organization:manage permission.
  • To configure a team's workflow, have administrative access to the team or boards module.

Key concepts

Personal settings

In Settings, the current tabs are:

  • Tokens: personal credentials for authorized integrations.
  • Profile: name, language, and password.
  • Personalization: personal documents and core documents used for context.
  • Security: MFA for your account.

Organization settings

In Organization, administrators can edit the name and description, require MFA for all users, and determine whether moving an item should automatically update its descendants.

Permissions

Permissions combine a module and an action. The modules used by the application include work items, boards, documentation, skills, access management, analytics, API catalog, and organization. Actions can be view, create, edit, delete, import, export, and manage.

The manage capability differs from simply viewing or editing: it enables administrative operations and, in modules with team scope, may allow activity beyond the user's own team.

Update your profile

  1. Open Settings > Profile.
  2. Edit your name and confirm.
  3. Choose an available language in the selector.
  4. To change your password, select Change in the security section.
  5. Enter your current password, new password, and confirmation.
  6. Save and confirm the success message.

The email address is read-only on the profile screen. The profile also shows organization, plan, current team, status, and account dates.

Configure theme and personalization

The theme can be Light, Dark, or System. The preference is kept for the user's experience and may be synchronized with personal settings.

In the Personalization tab:

  1. Create a personal document or core document.
  2. Enter a title and content.
  3. Edit fields directly in the list or detail sheet.
  4. Delete documents that should no longer influence your context.

Use personal documents for recurring preferences and context. Do not put secrets, tokens, or data that should not be loaded into an agent session there.

Manage personal tokens

  1. Open Settings > Tokens.
  2. Select Create Token.
  3. Enter a name that identifies the use and origin.
  4. Store the token securely when it is created.
  5. Use the displayed prefix only to recognize the token in the list.
  6. Revoke the token when an integration is no longer needed or exposure is suspected.

The list shows status, validity, and last use. Revocation is permanent and removes access from applications that used the token.

Security: never paste the complete value of a token into a memory, document, work item, chat, or skill. Share only the minimum necessary and prefer revoking and recreating a token after exposure.

Manage personal MFA

  1. Open Settings > Security.
  2. Select Enable.
  3. Confirm your password.
  4. Register the QR Code or manual key in a TOTP authenticator.
  5. Enter the six-digit code and confirm.
  6. To disable it, enter your password again if the organization allows it.

When the organization requires MFA, the account must remain protected and the disable option is locked.

Configure the organization

  1. Open Organization.
  2. If you do not have organization:manage, the screen shows Access Denied.
  3. Edit the name or description inline and confirm.
  4. Enable Require two-factor authentication to require MFA for all users.
  5. Enable Cascade Status Move to update children, grandchildren, and great-grandchildren when a parent item changes status.
  6. Verify the result before leaving the page.

Organization changes are applied optimistically in the interface; if saving fails, the screen reverts the value and displays the error.

For agents

  • Treat permissions as part of the context, not as an implementation detail.
  • Before mutating data, confirm whether the action is view, create, edit, delete, import, export, or manage.
  • Never request or store a password, MFA secret, or token in work text.
  • Confirm the active team and owner before operating on resources from another team.
  • If an operation returns access denied, do not try to bypass it through another module; request a permission change or refer the matter to an administrator.
  • Before changing organization or workflow settings, explain the impact for all users and request confirmation.
  • In personal documents, save only preferences and context that the user authorized for reuse.

Current states and limitations

Current state: token, profile, language, password, personalization, MFA, theme, organization, and status cascade settings are represented in the application. The permissions matrix is administered in Team > Access Groups.

  • The organization requires organization:manage permission; when it is missing, the screen does not provide a partial read-only mode.
  • Final permission enforcement occurs in the connected service. The frontend hides actions but should not be used as the sole proof of authorization.
  • The matrix may show actions that do not apply to certain modules; they appear disabled in the interface.
  • Without manage, create, edit, and delete operations are normally restricted to the user's own team.
  • A revoked token cannot be recovered; you must create another one.
  • The Settings screen retains some compatibility integrations, but product behavior is defined by the visible tabs and actions, not by internal callbacks.
  • Development mode without authentication exists for local visual validation and should not be enabled in a real-use environment.

Next steps