Identity, Organizations, and Tenant Boundaries

Organization Agent Settings use the same explicit Organization context at /api/v1/organizations/{organization_id}/agent-settings and require a real Membership with Organization update authority. Platform Administrator status alone does not grant access through this Organization route.

The Organization model allowlist and Organization Agent Settings default are related but not interchangeable. An Organization-owned default must match allowed_models; updating the allowlist is rejected if it would exclude that default or an existing explicit Agent override. The allowlist is stored on the Organization and may contain patterns, while default_model is one concrete model stored separately in Organization Agent Settings and validated against the live catalogue when available.

An Organization with no Agent Settings row and one with default_model set to null both follow the current platform default. The Settings row is created lazily on the first meaningful write. Clearing the Organization default returns to platform-following behavior. There is no separately administered Platform Agent Settings layer: the platform fallback currently comes from deployment configuration.

Model resolution is: explicit Agent model override; otherwise Organization-owned default; otherwise the platform default from AGENT_DEFAULT_MODEL. Defaults are resolved rather than copied, so a platform-default change can affect Organizations still following the platform and an Organization-default change can affect Agents still inheriting from that Organization.

A stopped inheriting Agent resolves the current default at its next start. A running Agent keeps its current runtime model until restarted; explicit Agent overrides are not moved by Organization or platform default changes, and clearing an override returns the Agent to inheritance. Agent reads expose model source and effective model so the UI does not rederive them, and running and pending values remain distinct.

Agent Settings responses include default_model, effective_default_model, default_model_source, inheriting_agent_count, override_agent_count, and updated_at. The own default is nullable; the effective default is resolved; the source distinguishes organization and platform; and the counts are Organization-wide impact summaries, not an Agent Access visibility bypass. Changing the setting requires Organization update authority and records the transition for audit and event delivery.

allowed_models: Organization-owned allowed models or patterns for explicit Agent overrides and an Organization-owned default.

default_model: optional Organization Agent Settings concrete default model.

AGENT_DEFAULT_MODEL: deployment configuration fallback when the Organization owns no default.

Agent model: empty inherits; a concrete value is an explicit Agent override.

Organization Agent Settings are managed from /dashboard/[orgId]/settings. Platform View has no active Organization and does not manage tenant Agent Settings through Organization-scoped hooks. Platform View may manage global Platform Templates and Platform Skills through their dedicated Platform APIs, but those global catalogues are distinct from Organization Templates, Organization or Agent-private Skills, and Agent Settings.

For focused workflows, continue with /guides/get-started/create-organization, /guides/observe-and-govern/organizations-and-members, /guides/observe-and-govern/organization-agent-settings, /guides/agents/configuration, /guides/agent-lifecycle-and-configuration, and /guides/roles-permissions-and-agent-access.

Platform Administrators do not receive synthetic Memberships, implicit Agent Access, or an Organization Agent Settings override path.