Settings

The Settings page is the central configuration area for the management dashboard. It is organised into seven tabs. Every signed-in user sees User and Limits. Administrators also see System, Admin, Networking, and Security. Users with the users.view permission also see Users. Use it to tune system performance windows, set the Appliance ID that integrations send, choose which audit events the VP Audit Log keeps, run backups, manage user accounts, check appliance resource usage, and set personal dashboard display preferences.

Access Settings from the dashboard sidebar under Settings.

System tab

Applies to the entire gateway instance. Requires administrator role. Changes take effect immediately when saved.

Fields

Actions

User tab

Personal preferences saved to your user account. These override system defaults for your dashboard session only. Other users are not affected.

Fields

Actions

Admin tab

System-level operations. Requires administrator role.

System actions

Export storage

Produces a PII-redacted, encrypted snapshot of the storage directory.

Backup and restore

Full backup includes all data, including private keys, secrets, and credentials: everything required to fully restore the service. Backup files are encrypted with AES-256-GCM.

Prometheus authentication

Prometheus scrape authentication is not configured from this tab. It’s set on the Metrics page, under the OpenTelemetry tab, not here.

Feature flags

Changes to feature flags take effect immediately.

Networking tab

Shows the gateway’s inbound mTLS (mutual TLS) and client authentication configuration. Requires administrator role. These settings are read-only; they reflect the platform’s network configuration and cannot be changed from the dashboard.

Security tab

The VP Audit card controls what the VP Audit Log keeps: the governance records shown on the Audit page. Requires administrator role.

These settings apply to the VP Audit Log only. Each integration whose event set holds audit events receives them independently of what the VP Audit Log keeps. See Send audit events to an external system.

Fields

Audit events

Events to keep lists the following events, in this order. The same events appear under the Governance Audit groups of an event set on the Integrations page.

Request events such as Authentication Failed, Rate Limited, and Request Rejected are recorded once for every request they apply to, so on a busy or heavily probed surface they can produce a large number of records.

Actions

Limits tab

Visible to every signed-in user, with no permission requirement. Shows a read-only summary of the appliance-wide resource caps configured for this deployment, alongside how much of each is currently in use. Check it before provisioning a new secret, surface, policy, connection, integration, or proxy to see whether there is headroom left, or to understand why a create action was just blocked.

Fields

The table reuses the heading Limit for two different columns: the leftmost names the resource, the rightmost gives its numeric cap.

Some resources are capped both individually and as a group. A deployment might, for example, cap the total number of proxies while also capping how many of those may be MCP proxies or A2A proxies specifically. Creating a new proxy is blocked once either the group total or the specific type’s own cap is reached, whichever comes first. Where a resource has this kind of grouping, the table lists the group total and each of its sub-types as separate rows. The dashboard shows only the plain-language name for each row, but a row can be matched back to your own limits.json by its dot-notation key, for example proxies for the total and proxies.mcp for the MCP-specific cap.

If no limits are configured for this deployment, the tab shows “No resource limits are configured. All entity types are currently uncapped.” instead of a table.

When a limit is reached

Creating a new secret, surface, policy, connection, integration, or proxy is blocked once its resource cap is reached, whether that is the specific type’s own cap or the group total it belongs to. The create button shows a small “Limit reached” popup naming the resource and its current usage, and suggesting an appliance tier upgrade. This behaviour applies wherever a create action exists across the dashboard, not only when you have the Limits tab open.

Users tab

Visible to administrators only. Lists all gateway users with their username, role, status, and last login time. Users self-register from the login page using a passkey and appear here with New status until an administrator approves them. Provides edit and delete operations for existing accounts.

Roles

Agent Gateway enforces role-based access control with three roles. Roles are hierarchical: each role includes all capabilities of the roles below it.

Administrator

Full access to all permissions.

• System settings (view and edit)
• User management (create, approve, edit, and delete all accounts)
• Trust registry management
• Surface configuration and deletion
• API key and certificate management
• Integration management (add, edit, test, and delete endpoints, event sets, and integrations) and gateway configuration reload
• Agent identity issuance
• Storage backup, restore, and export
• Gateway management (edit and delete)
• Secrets management (view, edit, and delete)
• Trust authority management (edit and delete)
• JWT Verification Strategies and STS Clients management
• Policy management
• Payment record edit and delete
• Audit log access

Another Administrator can downgrade or delete an Administrator account, with one exception: the only remaining approved Administrator account is protected, and its role and status cannot be changed and it cannot be deleted by any user.

Power User

Inherits all User access, plus:

• Mediator management (view, edit, and delete)
• MCP proxy management (view, edit, and delete)
• A2A proxy management (view, edit, and delete)
• Notification and issuer management (edit and delete)
• Payment viewing and retry
• Surface payload capture

Power Users cannot access user management, system settings, trust registry or surface configuration, API keys, certificates, storage operations, or the audit log.

User

Read-only access to most shared gateway resources:

• View gateways, trust registries, surfaces, integrations, notifications, issuers, trust authorities, metrics, the dashboard, and logs

Users cannot manage user accounts, modify system settings, edit trust registries or surfaces, manage API keys, or perform storage operations.

User status

Related

• Observability: How the dashboard home screen uses metrics retention and bucket size to display traffic data.
• Audit log: What the VP Audit Log keeps and how Governance Audit integrations receive audit events.
• Integrations reference: Template variables, including ${APPLIANCE_ID}, and the Governance Audit delivery limits.