Instance administration
An instance admin sits one level above workspace admins. Where a workspace admin manages a single workspace, an instance admin manages the instance itself — the deployment that hosts every workspace. This is the person (or few people) who stood up Tembo Agent Studio (TAS) for your organization.
If you only run agents day to day, you can skip this page — see the operator introduction instead.
Who is an instance admin
Section titled “Who is an instance admin”Instance admins are set by the INSTANCE_ADMIN_EMAILS environment variable
at deploy time — a comma-separated allowlist of email addresses. There’s no
in-app screen to grant the role; it’s a property of the deployment, so it stays
under the control of whoever operates the server.
On a fresh instance, account creation is closed: the only people who can sign
in are emails on the INSTANCE_ADMIN_EMAILS list (or anyone holding a pending
workspace invitation). So the first instance admin to sign in bootstraps
everything — they create the first workspace and invite the rest of the team from
there.
What instance admins can do
Section titled “What instance admins can do”Beyond everything a workspace admin can do in workspaces they belong to, instance admins alone can:
- Create workspaces. The “Create workspace” action only appears for instance admins. Everyone else joins a workspace by invitation.
- Set the instance name and branding. A dedicated Instance settings page
lives at the top level (
/settings, outside any workspace) and is visible only to instance admins. The instance name shows up in the app shell and sign-in; it falls back to theTAS_INSTANCE_NAMEenvironment variable until you set one.
Instance settings vs. workspace settings
Section titled “Instance settings vs. workspace settings”It’s worth keeping the two scopes straight:
| Instance admin | Workspace admin | |
|---|---|---|
| Scope | The whole deployment | One workspace |
| Set up by | INSTANCE_ADMIN_EMAILS env var | Invited + assigned the workspace_admin role |
| Manages | Instance name/branding, creating workspaces, hosting | Members & roles, repository, provider keys, connections, Slack apps |
| Settings home | /settings (top level) | /<workspace>/settings |
For the workspace side, see Settings and Audit & roles. For standing up the deployment in the first place — provider keys, the Tembo API key, architecture, and the platform guides — see the admin introduction and the setup checklist.