AdministrationTalon Studio v1.0.2-beta

Organisation

Org-level administration — the organisation's identity, the versioned config repo that records every org setting, and the settings that apply across every workspace.

What it covers

Settings → Organisation (/settings) holds config that isn't tied to a single workspace. Admins see three panels; other roles see a note that organisation settings are managed by admins.

Organisation name — the page heading. It is set during first-run onboarding (up to 120 characters).

Getting Started guidance — an on/off switch for the welcome checklist, setup reminders and in-page hints. Turning it off hides them for everyone in the organisation.

Configuration changes — the organisation's config repo, described below.

Configuration as code

Each organisation has its own git repository of YAML under Org/. When an admin saves an org-level setting anywhere in the app, the change applies at once and also appears here as an uncommitted change — the sidebar's Settings entry shows a dot while there is something to commit. Secrets are never written to it: no password hashes, API keys, webhook URLs, client secrets or licence keys.

Org/organisation.yaml

Org name, validation cadence and gate policy, require-MFA, Cribl Lake bucket and prefix, AWS region, GitHub App id, default standard blueprint.

Org/logging/logging.yaml

Syslog forwarding (the CA certificate stays encrypted in the database).

Org/claw/claw.yaml

The Claw coordinator switch.

Org/identity/

users.yaml, roles.yaml, teams.yaml and sso-providers.yaml.

Org/integrations/

notifications.yaml, ai-connections.yaml, ai-settings.yaml, connected-integrations.yaml and mcp-servers.yaml.

Org/agents/agents.yaml

Claw agent overrides.

The panel has Files (a read-only view of the repo), Changes and History tabs. On Changes, stage or discard each file and commit with a message — or have one generated when an AI provider is configured at Connect → AI.

Committing re-applies the committed YAML to the database, so the repo and the running settings agree. Safety checks still run: a commit that would leave no active admin is refused.

On History, Revert restores the org config to an earlier commit as a new commit. Commits and reverts are recorded in the audit log.

Where each setting lives

Org-wide settings are spread over the pages that use them:

Require two-factor authentication

The Security card on Settings → Users & teams. When on, a credentials user without an authenticator is held on their profile page until they enrol; SSO users are exempt.

Change request review policy

The Teams & access tab on Settings → Users & teams: approvals, self-approval, assigned reviewers, AI review, and whether workspaces may only tighten it.

AI connections

Connect → AI. An AI call prefers an enabled connection belonging to its workspace, then the org-wide connections in priority order, falling through to the next if one is unusable; the first org-wide one is marked Primary.

Claw coordinator

Connect → AI, off by default. When on, Claw watches signals (coverage gaps, validation and pipeline failures, new KEV CVEs) and queues a dispatch proposal; nothing runs until someone confirms it. CLAW_ENABLED=false is a separate global kill switch, not the normal on-switch.

Validation gate policy

warn (default) or block: whether behavioural validation failures (failing simulation or golden-event runs, degraded detections, missing environment dependencies) become release blockers. Environment-readiness failures always block. No settings page has a control for it yet; it is stored as validation_gate_policy in Org/organisation.yaml.

SSO, integrations, API, MCP, audit, logging

Their own pages under Settings, each covered in this section.

Settings → Organisation

Organisation settings — the org name as the heading, the Getting Started guidance switch, and the config panel with its Files, Changes and History tabs.

Tip

Commit org config with a message that says why. The repo is the only place a settings change keeps its reason, and a revert is one click from History when a change turns out wrong.