Settings

/Settings is for workspace governance: identity, people, security, plan, usage, and audit. Configuration used while building and running work lives beside the product it affects: Data model, Task configuration, and Resources. What you can see and change depends on your workspace role.

Settings uses the same application layout and sidebar as the rest of Rollout. On a settings page, that sidebar switches to explicit ownership groups: Your account for global profile, preferences, and sign-in security; Apps & access for Authorized apps, Connected accounts, and personal API keys; and <workspace> workspace for membership and workspace governance. If you do not have an active workspace, the personal groups remain fully available and the workspace group is omitted.

Your display name and picture are global. Your mention handle is specific to each workspace and lives under My workspace profile. Authorized apps are grants to act as you; Connected accounts are OAuth/tool identities you own; workspace Connections are governed Resources and may be private or shared.

Roles and access

Every member has a workspace-level role:

Member — works in the workspace; can view General, Security & governance, Plan usage, and resources shared with them.
Admin — everything above, plus Members & roles, Plan management, Audit log, Data model, Task configuration, and Archive.
Owner — the workspace creator's protected role. Only the owner sees the Danger zone in General.

Operations is not a workspace-admin destination. It is a separate, cross-workspace support console available only to explicitly allowlisted Rollout operators.

Pages that members can open but not change (General and Security & governance) show a note and render read-only controls. Admin-only pages redirect non-admins back to General.

General

The workspace's identity and defaults. Members can view; admins can edit.

Name — rename the workspace in place.
Fiscal year starts — pick the start month. Fiscal-year filter tokens shift for everyone in the workspace.

Members & roles

Admins invite teammates, adjust roles, and manage access at /settings/members.

Invite member — enter an email and choose Member or Admin. Invitees join with a workspace-level role; team membership is managed on team pages.
Change role — switch a member between Member and Admin. The select saves on change. You cannot demote yourself if you are the last admin, and the owner's role can't be changed here.
Invites — resend or revoke a pending invite.
Suspend / Activate — suspended members immediately lose access but keep their history.
Remove — removes the member from the workspace immediately. The owner can't be suspended or removed from settings.

Plan & usage

Plan and consumption now form one family under /settings/plan:

Plan shows the current commercial plan, included usage, concurrent-run limit, and storage allowance. Cloud subscriptions expose billing management; self-hosted installations expose license state here instead of in General.
Usage at /settings/plan/usage shows recent runner time, storage, managed AI consumption, spend by workflow, workflow activity, and cluster resources.
Capacity links to the operational capacity controls in Resources.

Everyone can view usage. Plan and billing controls are admin-only. Credit-pack checkout appears only for entitled Cloud Pro subscriptions and never replaces the platform subscription.

Data model

Admin-only. Data model owns reusable structure and taxonomy across the workspace:

Record types define schemas for custom records.
Field sets at /data-model/field-sets add reusable fields to tasks, projects, objectives, and documents. They are not custom-record schemas.
Labels at /data-model/labels are shared taxonomy for work, automation, documents, and custom records.

See Record Types & Records for the record-type guide.

Task configuration

Task statuses and task types live at /tasks/settings/statuses, beside Tasks. Cycle defaults live at /tasks/settings/cycles, with owner-only invariant diagnostics at /tasks/settings/cycles/diagnostics. Operations is reserved for Rollout's allowlisted cross-workspace operator console.

Resources

Resources is the workspace inventory used to build, connect, and run automation: agents, tools, connections, secrets, devices, storage, and capacity.

Agents

AI agent identities you bind to message and call trigger nodes in your Workflows. Any active member can create a private agent; sharing follows the private/team/workspace model, and team access inherits through the hierarchy.

Each agent has a name, handle, description, and avatar.
The capability profile (model, BYOK model, token budget, BYOK connection) overrides the AI node's own settings wherever the agent acts.
Deactivated agents keep their bindings but stop answering. Admins can designate a workspace-shared agent as the default.
The agent's Registered workflows list is read-only here — edit bindings from the trigger node in the workflow editor.

Connections

Credentials and connectivity that back workflow Nodes — OAuth, credential, and connectivity providers. Add and share workspace Connections at /resources/connections. Personal authorization grants live under Authorized apps, while user-owned OAuth identities live under Connected accounts. See Integrations for providers, scopes, and sharing.

Secrets

Named values workflow steps resolve at runtime. Values are write-only: set exactly once at creation and never viewable again, anywhere.

Names are UPPER_SNAKE_CASE (a letter, then letters, digits, or underscores; max 63 characters).
A secret is either a locally encrypted value or a 1Password reference (op://vault/item/field) — the reference option appears only when the workspace has a 1Password Connection.
Sharing follows the private/team/workspace model. Workspace admins do not bypass private secrets.
Every access to the secret store is recorded in the audit log. See Security for the encryption model.

Security & governance

/settings/security contains network and runtime rules applied to the workspace's workflow Runs. Members can read the policy; only admins can change it.

Outbound network access — off by default. When on, Runs can only reach the listed destinations over HTTPS: plan defaults plus custom additions on Cloud Pro or Business. Changes apply to new Runs within a few minutes.
Container image registries — off by default. When on, workflow images must come from the allowed registries; custom entries replace the defaults (docker.io, ghcr.io). Enforced when Workflows are saved and when Runs start.

Devices

Devices registered by the Rollout client apps, with per-device sharing and the capabilities exposed to Workflows. Manage them at /resources/devices. A device stays private to its owner until deliberately shared. See Desktop App Companion.

Audit log

Admin-only, append-only — entries cannot be edited or deleted. The Secrets, Access, and Billing tabs separate secret-store activity, operational sharing and ownership changes, and commercial events. See Security.

API keys

API keys are personal and live under your account at /account/api-keys, not in workspace settings. Each key is bound to one workspace and acts on your behalf inside it. Generate a key, copy it once, and use it as a bearer token — for example in your local MCP config (see MCP Integration). Revoke keys individually or all at once.

Danger zone

Owner-only. Delete workspace permanently deletes the workspace and all of its data — projects, tasks, workflows, messages, and activity history. There is no grace period and no recovery. You confirm by typing the workspace name, and a recent re-authentication is required; everyone in the workspace loses access immediately.