Governance

Governance

The top-level item is visible when the user holds a View permission on any of these resources: VirtualKeys, Teams, Users, Customers, UserProvisioning, RBAC, AccessProfiles or Governance. The /workspace/governance route redirects to virtual keys.

Virtual Keys (/workspace/governance/virtual-keys)

Manage virtual keys, their permissions, budgets and usage limits. The list polls every 5 seconds, with search and filters by customer, team and user.

• Creation and edit sheet, sections: basic information (mandatory name, description).
• Provider configuration: allowed models, blocked models, per-provider budget, per-provider usage limits (token limits and request limits).
• MCP client configuration: allowed tools or allow all tools.
• Usage limits configuration.
• Entity assignment: assignment type, selecting a team or a customer.
• Denied by default: no provider configured means denied by default; no MCP client configured means denied by default.

Teams (/workspace/governance/teams)

Team list with search and pagination. The customer name comes on each row and the virtual key count is computed on the server.

• Teams carry the budgets used by the Overview screen of the Costs group and by the Executive panel.

Customers (/workspace/governance/customers)

Customer management; the table also consults teams (Teams.View). Editing happens in a dedicated sheet.

Copilot access (/workspace/governance/copilot)

Where each Copilot surface is reached and under which contract. The secret does not enter or leave through this screen: point to an environment variable of the appliance.

• Per surface configuration: credential via environment variable (recommended, the key stays out of the appliance state file) or a value stored on the appliance in 0600 mode; seat price in USD (from the customer contract, not a public price list); days in the period; import hour in UTC.
• Rules shown on the screen: the secret never leaves through the API; price and period are configuration; the APIs close per day and the inventory describes yesterday.
• Without the module: GET /api/atlasberg/copilot/conexoes returns the full configuration and adds modulo_licenciado (false) plus modulo_aviso. The screen shows the notice and the whole form, with the Save button disabled and a tooltip explaining why; Remove stays active, because deleting a secret never depends on an up-to-date license. Saving without the module is refused by the server with 403.

Access Profiles (/workspace/governance/access-profiles)

Only enters the menu in enterprise builds, under the same criterion as the Alerting group.

About Atlasberg Platform

Atlasberg Platform is the control layer between a company and every AI model: each request is authenticated with a virtual key, filtered by policy and DLP, routed to the right provider and written to a hash-chained audit trail. It exposes an OpenAI-compatible API, so applications only swap the base URL.

The same artifact runs in Atlasberg Cloud, in your VPC, on-premises or fully air-gapped, and is priced by capacity and modules, never per seat.

This page is part of the official documentation. To talk to the engineering team, write to [email protected] or use https://atlasberg.com/contato. Answers come within one business day.