How the pieces fit
Organization
Your tenant. Members, roles, provider keys, SSO, and the audit history all belong to the organization. Everything else hangs off it.- Created by: anyone signing in for the first time (during onboarding), or an existing admin or super admin through New organization in the organization switcher. AI Builders and Users cannot create organizations.
- Creator’s role: the person who creates an organization becomes its Owner.
- Fields: name, slug, data residency region (
us,eu, orapac; defaults tous), and plan (standardorenterprise; defaults tostandard). These are shown read-only under Settings → General. There is no screen to change them.
Project
A workspace inside an organization, one per agent or workflow you want to observe. Traces, model configs, tracing keys, Cost Calculator runs, and evaluation runs are scoped to a project.- Created by: Owners and Admins (and super admins), from New project in the project switcher or during onboarding.
- On creation: AgentHub generates one live tracing key for the project automatically.
- Almost every page URL is
/<org-slug>/<project-slug>/<page>.
Workspace
Onboarding uses “workspace” for the organization and project you create together (“Name your workspace”). It is not a separate object.Slug
The URL-safe name derived from an organization or project name: lowercased, with every run of characters other thana–z and 0–9 replaced by a hyphen, leading and trailing hyphens removed, and cut to 48 characters. “Acme Support Team” becomes acme-support-team.
- Organization slugs are unique across the whole platform. If yours is taken you will see “An organization with a similar name already exists. Try a different name.”
- Project slugs are unique within their organization (“A project with a similar name already exists.”).
- Slugs are set once and cannot be edited.
Environment
A label on traces and Cost Calculator runs that keeps test and production data apart. Each project gets five environments derived from a base name:<base>_Test, <base>_Pre-Production, <base>_Production, <base>_Staging, and <base>_Development. The environment selector appears in the header only on Cost Calculator pages.
Roles
AgentHub uses two layers of roles. Database roles are created in every organization: Owner, Admin, Editor, and Viewer. Each carries a list of permission strings such asmanage_members or run_agents.
Hub roles decide which product you can use:
The full permission matrix is in Roles and permissions.
Member and invite
A member is a person with a membership in an organization, holding one database role. An invite is a pending membership for an email that has no account yet. Invites expire after 7 days and are accepted at a link of the form/invite/<token>. If the email already has an account, it is added as a member immediately and no invite is created. See Members and invites.
Platform access
A platform-wide allowlist of who may sign in at all, separate from organization membership. An address can be approved individually, or a whole domain can be allowlisted as@company.com. Only super admins manage it. See Platform access.
API Key Vault (BYOK)
The organization’s store of model provider API keys. “Bring your own key” (BYOK) means AgentHub calls the provider with your key and the provider bills you.- Keys are encrypted with AES-256-GCM before they are stored.
- After you save a key, AgentHub only ever shows a short hint, never the full key.
- Keys are validated against the provider before they are saved.
- The Platform Demo Key is a platform-funded key with a $50.00 allowance per organization on Anthropic models. It appears in the vault the first time someone opens Model Manager. Its hint reads
platform-managed.
Model config
A model a project is allowed to use: a provider, a model identifier, a display name, and the vault key it bills to. Model configs feed the LLM-judge evaluators, the Cost Calculator, and the models your employees can pick in ModelHub chat.Tracing key
The credential your agent sends with each trace, scoped to one project. Keys look liketk_live_ or tk_test_ followed by 48 hexadecimal characters. AgentHub stores only a SHA-256 hash and a hint; the full key is shown once, when you create it. See Tracing keys.
Trace and span
A trace is one run of your agent. A span is one step inside it: an LLM call, a tool call, an HTTP request, a database query, a function, or an evaluation. Each span carries its name, kind, model, status (OK or ERROR), tokens in and out, cost in USD, latency, input, output, attributes, and start and end times. A trace holds between 1 and 500 spans per request.
Traces are rolled up from their spans: duration, LLM time, call counts, tokens, and cost. A trace’s source is live for traces your agent sent and simulation for traces the Cost Calculator produced. See Traces and the trace format.
Evaluator
A check that scores a trace from 0 to 1, decides pass or fail, and explains why. There are two kinds:- Offline evaluators are deterministic heuristics. They make no model call and cost nothing.
- LLM-judge evaluators fill a prompt template with the trace and ask a model to grade it. Templates use the placeholders
{{input}},{{output}}, and{{trace}}, and must contain at least one.