Roles & Agent Management

The three roles, the Agent Manager role, and audit history.

11. Roles & Agent Management

Most of ENGRAM needs no administration — you sign in and work. Two roles above the everyday Contributor unlock the Administration page (top navigation): Administrator (full control) and Agent Manager (manage your own agents).

11.1 The three roles

Contributor — the default. Full use of ENGRAM (chat, articles, memory, sharing); no Administration access.
Agent Manager — everything a Contributor can do, plus create and run the agents they own. No access to other people's accounts or to system settings.
Administrator — full control: manage every user, every agent, and system settings.

An Administrator sets a user's role from Administration → Users → User Management using the role dropdown. Agents themselves are always Contributor-level and can never be administrators.

11.2 The Agent Manager role

An agent is a non-human account — a bot or assistant (e.g. Claude Code) that connects to ENGRAM with its own access token to read and write memory or KB content. Creating agents used to require an administrator; the Agent Manager role hands that to the people who need it, without giving away the keys to the whole instance.

As an Agent Manager, the Administration page shows just two tabs — Agents and Audit History — and everything is scoped to the agents you own:

Create an agent (name + role) — you become its owner, up to a per-manager limit an administrator sets.
Manage tokens — issue, rotate, and revoke the agent's access tokens (PATs). Token management is owner-only: only the owner can see or mint an agent's tokens.
Enable / disable an agent — disabling immediately suspends it (its tokens stop working), and re-enabling restores them; it's a reversible pause, not a deletion. (Removing an account is the permanent option.) You can also toggle whether an agent is discoverable as a share target.
Audit History — a record of actions taken on your agents.

The Administration page as an Agent Manager sees it — only the Agents and Audit History tabs, listing the agents they own with per-agent role, state, token count, and a Manage tokens control — The Administration page as an Agent Manager sees it — scoped to the agents they own.

Agents that grow teams. Where your operator has enabled it, an Agent Manager can promote an agent it owns to Agent Manager too — so that agent can create its own sub-agents (with create_sub_agent) and hand each one its own token. The Agents table then shows the delegation tree — a parent agent with its sub-agents nested beneath it — while the human at the top stays the single point of quota, audit, and revocation. For a hands-on walkthrough, see the tutorial Atlas grows a team — orchestrating sub-agents with shared memory.

11.3 Audit history

Every administrative action is recorded in an append-only Audit History — who did what, to which account, and when. Administrators see the whole instance; an Agent Manager sees the entries for the agents they own. Filter by action, target, or date to narrow it down.