Skip to content
AIOS

Team admin setup

A Team Brain is one shared service per team. It is not a multi-user personal workspace and does not replace the workspace each person owns.

The end state

Section titled “The end state”
Person A workspace ─┐
Person B workspace ─┼─ explicit aios push/query ─ Team Brain
Person C workspace ─┘

The Brain owns membership, authentication, shared storage, tier-filtered retrieval, and team-facing administration. Each individual workspace owns local files, harnesses, validation, and the decision to share.

Admin sequence

Section titled “Admin sequence”

  1. Set up your own individual workspace

    Follow Individual workspace setup. This gives the administrator the same private operating surface every other member uses.

  2. Deploy one Team Brain

    Follow Run your own Team Brain to configure Postgres, environment variables, schema, and the Next.js service.

  3. Establish the team and administrator

    Use the Brain’s documented bootstrap/admin flow. Confirm that the admin can sign in, open the team dashboard, and create a per-machine API key.

  4. Invite members to the Team Brain

    Use Admin → Members in the dashboard or:

    Terminal window
    aios member invite person@example.com --name "Person Name" \
      --handle person --role member --tools all

    The caller must use a team-tier admin key. The route is rate-limited and audited.

    --tools all cascades the invite to Linear, Slack, and GitHub — but each tool has its own prerequisite, and an unconfigured one reports skipped and says nothing else, so the invite appears to succeed while inviting the person to nothing but the Brain:

    • Linear needs an enabled Linear integration with its API key stored in Admin → Integrations. The Member onboarding panel alone is not enough.
    • Slack needs an invite link in Admin → Integrations → Member onboarding, and can only ever hand that link back — it never sends an invite.
    • GitHub needs an org in that same panel, plus a token with admin:org.

    Set these up before the first real onboarding. See Member onboarding prerequisites.

  5. Have each member create their own workspace

    Send each person Join a Team Brain. They create or repair their own workspace, sign in, generate their own API key, approve the Brain origin, and preview their first push.

  6. Verify the boundary

    Each member should run:

    Terminal window
    aios whoami
    aios status
    aios push --dry-run

    Do not ask members to clone an administrator’s personal workspace. Share team context through the Brain and deliberately shared source repositories.

  7. Wire your code repositories into Codebases

    Content arrives via aios push; code does not. Each repo you want on the Codebases dashboard needs the scan-on-merge workflow plus its own three Actions secrets — AIOS_BRAIN_URL, AIOS_TEAM, and a team-tier AIOS_API_KEY. Secrets do not inherit between repositories.

    Follow Wire a repository into Codebases, then verify the first run really scanned rather than silently skipping — the workflow is fail-open, so a green check alone proves nothing.

Operations and reference

Section titled “Operations and reference”