Applications
The Applications screen lets you register the governed applications of the tenant (with their agents, models and
tools), record and activate their deployments, suspend or retire them and register their external agents. Portal path:
/agents/applications; its page title is Applications registry. It is used by the application owners and
developers (tenant_admin, developer, application_owner) and by the security officers (security_officer) who
suspend an application.
What the screen shows
An Applications table with Refresh and New application:
| Column | Content |
|---|---|
| Name | Name of the application. |
| Kind | agent_app, assistant, external_agent or workflow. |
| Origin | internal or third_party. |
| Owner | Owner of the application. |
| Risk | low, medium or high. |
| Status | State of the application, for example suspended or retired. |
| Updated | Date of the last change. |
A click on a line opens a side panel with the application and its deployments, read from the API. The list is read in one call. Empty state: No application, "Register an application to govern its agents, models and tools."
Under the table, the form Activate a deployment, "Makes a recorded deployment of an application the active one in its environment.", with the fields Application and Deployment id and a Result area.
Actions
| Button or action | What it does | API call | Roles |
|---|---|---|---|
| Opening the screen, Refresh | Reads the applications. | GET /v1/applications | Member of the tenant |
| New application then Create | Form Name (required), Kind (required), Origin, Risk, Owner, Project, Agents, Models, Tools, Environments (lists, for example dev, prod). | POST /v1/applications | tenant_admin, developer, application_owner |
| Click on a line | Opens the detail panel with the deployments. | GET /v1/applications/{id} | Member of the tenant |
| Deploy | Dialog Version (required), Environment (required), Reason; records a deployment and shows the answer (its identifier included). | POST /v1/applications/{id}/deployments | tenant_admin, developer, application_owner |
| Suspend | Dialog Reason (required); sets the status suspended. Shown unless the application is suspended or retired. | POST /v1/applications/{id}/status | tenant_admin, security_officer |
| Retire | Dialog Reason (required); sets the status retired. Shown unless it is retired. | POST /v1/applications/{id}/status | tenant_admin, security_officer |
| Register external agent | Dialog Name (required), Scopes; shows the answer. Shown for the kind external_agent only. | POST /v1/applications/{id}/external-agents | tenant_admin |
| Activate a deployment, Application, Deployment id, then Run | Browser confirmation "Activate a deployment? This sensitive action is recorded in the audit log.", then the deployment becomes the active one of its environment. | POST /v1/applications/{app_id}/deployments/{deployment_id}/activate | tenant_admin, developer, application_owner |
Roles
From services/control-plane/src/eai/domains/applications/routes.py: every route needs a principal inside a tenant;
creating, deploying and activating require tenant_admin, developer or application_owner (WRITE_ROLES of
services/control-plane/src/eai/domains/agents/kit.py); changing the status requires tenant_admin or
security_officer; registering an external agent requires tenant_admin. platform_admin passes every check. The
portal shows the row actions to every user; the server decides.
Typical tasks
Register and deploy an application
- Register it. Button New application: Name
claims-assistant, Kindassistant, Riskmedium, Agents, Models, Tools it uses, Environmentsdev, prod. Then Create. Expected result: the toast Created and the new line. If it fails:forbiddenwhen your role is not a writer role. - Record a deployment. Row menu > Deploy: Version
1.0.0, Environmentprod, Reason. Expected result: the answer in a side panel, with the deployment identifier. If it fails:application_suspendedwhen the application is suspended. - Activate it. In Activate a deployment, paste the application identifier in Application and the
deployment identifier in Deployment id, then Run and confirm. Expected result: the JSON result of the
activated deployment. If it fails:
application_deployment_not_found(HTTP 404) when the identifiers do not match.
Suspend an application during an incident
- Suspend. Row menu > Suspend, type the Reason, submit. Expected result: the status
suspended. If it fails:forbiddenwhen you are neithertenant_adminnorsecurity_officer.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
forbidden (HTTP 403) with required_roles | The action needs another role (see the Roles section). | Ask a tenant_admin or the application owner. |
application_not_found (HTTP 404) | The application identifier is unknown in the tenant. | Copy the identifier from the detail panel. |
application_deployment_not_found (HTTP 404) | The deployment does not belong to this application. | Copy the deployment identifier returned by Deploy. |
application_suspended (HTTP 409 or 403) | The application is suspended. | Lift the suspension before deploying or calling it. |
| Register external agent is missing | The kind is not external_agent. | Create an application of kind external_agent. |
tenant_required (HTTP 403) | The session does not act inside a tenant. | Sign in with an account of the tenant. |