Skip to main content

Admins FAQ

Can users install any agent plugin they want?​

By default, the user controls what plugins are loaded on their own agent (their machine). Workspace admins can restrict via:

vibecontrols config set --scope WORKSPACE \
  --key agent.plugins.allowlist --value '["vibe-plugin-session-tmux","vibe-plugin-tunnel-cloudflare","vibe-plugin-ai"]'

When set, agents only load plugins on the allowlist.

How do I cap sandbox usage?​

Sandbox quotas are platform-level. Set:

vibecontrols config set --scope WORKSPACE --key sandbox.quota.concurrent --value 20

An agent went rogue — how do I quarantine?​

Revoke its API key + disable from the web app:

vibecontrols agents rotate-api-key <agent-id>      # old key invalid
vibecontrols agents update <agent-id> --is-active false

The agent loses backend connectivity. The user re-runs vibe start after the admin un-disables.

Can I disable tunnels workspace-wide?​

vibecontrols config set --scope WORKSPACE --key tunnel.enabled --value false

All tunnel-create calls are denied. Existing tunnels remain until torn down.

How long are sessions retained?​

By default forever (until you delete them). Session.accumulatedSeconds is BigInt — sessions can run for years. Add cleanup with:

vibecontrols config set --scope WORKSPACE \
  --key sessions.cleanup.maxAgeDays --value 90

A scheduled job deletes sessions older than this once a day.

Where does AI-call data go?​

By default to your configured AI provider (Anthropic / OpenAI / OpenRouter). Set ai.providers.<provider>.logRequests = true to also record request metadata (no payloads) in your audit log.

How do I onboard a teammate to a self-hosted instance?​

Send them:

  • The platform tenant invite link (from Burdenoff Workspaces admin)
  • Your agent install command pointing at your platform: npm install -g @vibecontrols/agent @vibecontrols/cli
  • Your CLI auth endpoint configured via env: VIBECONTROLS_API_URL=https://api.your-vibecontrols.example.com