Settings

The Settings page is the central configuration area for the management dashboard. It is organised into seven tabs. Every signed-in user sees User and Limits. Administrators also see System, Admin, Networking, and Security. Users with the users.view permission also see Users. Use it to tune system performance windows, configure Prometheus scraping credentials, run backups, manage user accounts, check appliance resource usage, and set personal dashboard display preferences.

Access Settings from the dashboard sidebar under Settings.

System tab

Applies to the entire gateway instance. Requires administrator role. Changes take effect immediately when saved.

Fields

Actions

User tab

Personal preferences saved to your user account. These override system defaults for your dashboard session only. Other users are not affected.

Fields

Actions

Admin tab

System-level operations. Requires administrator role.

System actions

Export storage

Produces a PII-redacted, encrypted snapshot of the storage directory.

Backup and restore

Full backup includes all data, including private keys, secrets, and credentials: everything required to fully restore the service. Backup files are encrypted with AES-256-GCM.

Prometheus authentication

Prometheus scrape authentication is not configured from this tab. It’s set on the Metrics page, under the OpenTelemetry tab, not here.

Feature flags

Changes to feature flags take effect immediately.

Networking tab

Shows the gateway’s inbound mTLS (mutual TLS) and client authentication configuration. Requires administrator role. These settings are read-only; they reflect the platform’s network configuration and cannot be changed from the dashboard.

Security tab

Controls whether the gateway records Verifiable Presentation (VP) evidence of authorisation decisions for compliance auditing. Requires administrator role.

Fields

When Enable VP Auditing is on, an Audit Categories section appears with the following checkboxes:

Enable only the categories you need. Each additional category increases storage usage proportionally to request volume.

Actions

Limits tab

Visible to every signed-in user, with no permission requirement. Shows a read-only summary of the appliance-wide resource caps configured for this deployment, alongside how much of each is currently in use. Check it before provisioning a new secret, surface, policy, connection, integration, or proxy to see whether there is headroom left, or to understand why a create action was just blocked.

Fields

The table reuses the heading Limit for two different columns: the leftmost names the resource, the rightmost gives its numeric cap.

Some resources are capped both individually and as a group. A deployment might, for example, cap the total number of proxies while also capping how many of those may be MCP proxies or A2A proxies specifically. Creating a new proxy is blocked once either the group total or the specific type’s own cap is reached, whichever comes first. Where a resource has this kind of grouping, the table lists the group total and each of its sub-types as separate rows. The dashboard shows only the plain-language name for each row, but a row can be matched back to your own limits.json by its dot-notation key, for example proxies for the total and proxies.mcp for the MCP-specific cap.

If no limits are configured for this deployment, the tab shows “No resource limits are configured. All entity types are currently uncapped.” instead of a table.

When a limit is reached

Creating a new secret, surface, policy, connection, integration, or proxy is blocked once its resource cap is reached, whether that is the specific type’s own cap or the group total it belongs to. The create button shows a small “Limit reached” popup naming the resource and its current usage, and suggesting an appliance tier upgrade. This behaviour applies wherever a create action exists across the dashboard, not only when you have the Limits tab open.

Users tab

Visible to administrators only. Lists all gateway users with their username, role, status, and last login time. Users self-register from the login page using a passkey and appear here with New status until an administrator approves them. Provides edit and delete operations for existing accounts.

Roles

Agent Gateway enforces role-based access control with three roles. Roles are hierarchical: each role includes all capabilities of the roles below it.

Administrator

Full access to all permissions.

• System settings (view and edit)
• User management (create, approve, edit, and delete all accounts)
• Trust registry management
• Surface configuration and deletion
• API key and certificate management
• Integration configuration and gateway configuration reload
• Agent identity issuance
• Storage backup, restore, and export
• Secrets management (edit and delete)
• JWT Verification Strategies and STS Clients management
• Policy management
• Payment record edit and delete
• Audit log access

Another Administrator can downgrade or delete an Administrator account, with one exception: the only remaining approved Administrator account is protected, and its role and status cannot be changed and it cannot be deleted by any user.

Power User

Inherits all User access, plus:

• Mediator management (edit and delete)
• MCP proxy management (view, edit, and delete)
• A2A proxy management (view, edit, and delete)
• Surface payload capture

Power Users cannot access user management, system settings, trust registry or surface configuration, API keys, certificates, storage operations, or the audit log.

User

Read-only access to most shared gateway resources:

• View gateways, mediators, trust registries, surfaces, secrets, metrics, the dashboard, and logs
• View and retry payments
• Manage own notifications, issuers, and authorities

Users cannot manage user accounts, modify system settings, edit trust registries or surfaces, manage API keys, or perform storage operations.

User status

Related

• Observability: How the dashboard home screen uses metrics retention and bucket size to display traffic data.