✦

Nebula Admin

Knowledge and access control

Sign in to manage access

Every view and update is authorized through the Belt family Microsoft Entra tenant. Only parent administrators can change access.

Registration received

You are signed in, but a parent has to approve your access before you can use the knowledge base.

Loading current permissions…

People

Each person has a ceiling — the most any of their profiles can grant — and a kill switch.

Clients

One piece of assistant software signing in as one person. Disabling a client denies its calls but keeps its profile bindings.

Profiles

A use case: which domains it may read or write, and which clients may select it.

Set up a client

Choose who is being set up and on what, and follow the generated steps. Nothing here is a secret.

The profile below does not appear in any command, and that is correct. Nothing a client sends decides its access: the gateway resolves the profile from the signed-in person and the client software, against the single binding recorded here. Pick the profile to see whose setup you are generating and which clients are eligible.

Profile

Client

Instructions for

Profile

Person

Profile ID

Eligible clients

Knowledge access

Edit person

This person registered themselves and has no access yet. Correct their ID if needed, set a ceiling, and tick Enabled to approve. The ID is fixed once approved.

Display name

Entra sign-in

Person ID

Enabled Parent administrator

Maximum access ceiling

Client

The Entra registration is created in infrastructure. Everything below is stored in the authorization table and takes effect on the next MCP call.

Display name

Client ID

Software

A client is a piece of assistant software, shared by everyone who runs it. Who may use it, and for what, is set on each profile under “Eligible clients”. Every session names its profile explicitly; there is no default.

Entra client ID

Enabled — unchecking denies every call from this client immediately