Skip to content

VIDAI Control Plane admin guide

These docs describe VIDAI Control Plane 0.8.0. Open the License page in your console to confirm your deployment's running version.

This is the friendly walk-through for admins running the VIDAI Control Plane. We've grouped the pages around what you're trying to do, not the feature names, so you can land on the right page without already knowing the jargon.

The VIDAI Control Plane ships in two editions: Community (free, the control plane plus everything you need to run it sensibly) and Enterprise (adds compliance routing, ML guardrails, BI exports, webhook delivery, ledger replay). Pages that describe Enterprise-only surfaces carry an Enterprise edition note at the top. The full breakdown lives on Licensing & tiers.

If you're reading this for the first time, start with Getting started. It walks you through the first 30 minutes: what's on the dashboard, who can see what, and the shortest path from "logged in" to "answering an admin's first question."

If you've been here before, the index below mirrors the sidebar. Pages are grouped four ways: Identity (who is using the control plane), Traffic (what they're allowed to send and where it goes), Observe (what's happening right now and what happened yesterday), System (the bits that keep the control plane honest).

💡 Pro tip. Every page has the same shape: what it's for, when you'd open it, an annotated screenshot, walkthroughs by scenario, a reference table at the end, and a Q-and-A. The 2am rescue lives in the reference table; the everyday "how do I…" lives in the walkthroughs.

Start here

  • Install VIDAI Server: bundle delivery, deployment models (Docker quickstart is self-service; binary, airgap, and Helm are arranged with the licensing team), and how the install hands off to the console.
  • Getting started: the first 30 minutes inside the console. What you'll see, who can see it, and what to click first.
  • Licensing & tiers: what's in each edition, how the licence resolves at startup, what the five banner states on the License page mean, and what happens to your data if an Enterprise licence lapses.
  • Console navigation: the grouped sidebar (Identity / Traffic / Observe / System), the header bell, the docs icon, and where common actions live.

The two stories the VIDAI Control Plane exists to tell

Most of this guide is organised by screen. These two pages are organised by the question you came with. Read the relevant one first; each tells the end-to-end arc and links into the screen-level detail.

  • Compliance & governance: the leading story. "Can I prove our AI is governed?" Obligations → how the control plane enforces them (guardrails + routing) → how it proves it (obligation %, immutable record, ISO/IEC 42001 audit evidence, and the honest-scope candour that's the real differentiator) → where it all reads at once on the dashboard.
  • Cost control: "Is our AI spend under control, and can I show where it went?" Act at request time → attribute every dollar → a ledger that doesn't silently re-write history.

Identity: who's using the control plane

  • API Keys: minting keys, who owns them, what they're allowed to call, the deep-link from / to /users.
  • Users: human accounts, group membership, rate-limit role, the delete ceremony.
  • Groups: hierarchical groups for permission and policy inheritance. Groups split two ways (teams for people and applications for agents) and both live here.
  • Agents: automated identities (bots, scheduled jobs, integrations). They look like users but don't have a person to email; they live inside applications.
  • Applications: the container for related agents. One per service, one per integration, one per "thing on its own deployment lifecycle."

Traffic: what they can send and where it goes

  • Providers: the upstream LLM services (OpenAI, Anthropic, Gemini, Bedrock, Vertex, Azure-OpenAI). Each provider has a protocol; translation between SDKs and upstreams is automatic.
  • Provider catalogue: the per-vendor reference card: endpoint, key portal, model-name prefixes, discovery support, which SDK pairs naturally with it. The what to put in the form page.
  • Models: the model registry. What's reachable, what each model is aliased to, which provider serves it.
  • Routing: redirect rules, A/B tests, deny policies, spend circuits. The wizard walks you through each create flow; edit is a flat form.
  • Fallback: per-source fallback chains. When the primary provider falters, traffic transparently shifts to the next healthy entry. Circuit-breaker state + composition with routing covered here.
  • Rate Limits: RPM caps. The console surfaces global + per-key today; role-scoped limits are API-only.
  • Guardrails: content policy via regex rules (Community baseline), the action ladder (block / mask / log_only / redirect), and the VidaiGuard ML tab (Enterprise). Composition across user / group / key is covered in Groups + API Keys; this page is the rule-shop.

Observe: what's happening, and what happened

  • Dashboard: the at-a-glance landing surface. VIDAI Impact, Cost Insights, Compliance Insights, Lifecycle hygiene, Actionable Signals, and the notification bell in the header.
  • Cost Engine: rate cards, pricing sync, what-if analysis (Community baseline), plus ledger replay and rate-card history (Enterprise). The page where you answer "why did our spend look like that?"
  • Compliance: Enterprise. The Compliance Insights panel covers compliance by obligation (residency / sensitive data / model access), VidaiGuard status, human-vs-agent enforcement posture, and rule tagging.
  • ISO/IEC 42001 audit evidence: Enterprise. The audit-evidence block in depth covers the role model (system of record vs evidence enabler), the 9 controls the control plane speaks to, and the honest-scope framing (it provides evidence; it does not certify).
  • Audit Log: every admin action recorded. The page you open when a customer asks "who changed this, when?"
  • Request Logs: every proxied request. Searchable by key, model, status, routing rule. The page you open when you're debugging a specific call.
  • BI Tables: Enterprise. Pull-based projections for external BI stacks. The bi_read_only role lives for this page; CSV export per tab.
  • Observability (Prometheus): the /metrics scrape endpoint, the 15-metric catalogue, scrape recipe, and Grafana starter queries. For your monitoring team's stack, alongside the in-console dashboard.

System: the bits that keep things honest

  • Webhooks: Enterprise. Push-based event deliveries with HMAC signing. The deployment-side egress note matters here: your firewall has to let traffic out.
  • License: what the License page shows you, namely tier, status, capabilities, and deployment versions. Pair with Licensing & tiers for the conceptual side.
  • Settings: your own account. Change password, edit profile, toggle theme.

What's not here yet

The console has a few surfaces that don't have admin-guide pages yet because they're brand new or actively changing:

  • The notification bell in the header is documented inline in Console navigation. It aggregates license expiry, misconfigurations, and showcase exclusions today.
  • VidaiGuard (the ML-based guardrails sub-tab on the Guardrails page) gets a deeper page when the guardrails-redesign workstream lands. For now, Guardrails covers it at a high level.

📌 Worth knowing. The role you log in as decides what you see in the sidebar. Admin sees everything. bi_read_only sees BI Tables and the dashboard read-only. Regular users see API Keys (their own keys) and Settings only. If a page is missing from your sidebar, that's role gating, not a bug. (Tier gating is separate: Enterprise pages stay visible on Community with an Enterprise pill, they don't disappear; see Licensing & tiers.)

Conventions used in these pages

  • 💡 Pro tip: knowledge a power user picks up after a month. Optional, useful, never load-bearing.
  • ⚠️ Watch out: a real gotcha. The kind of thing that wastes an afternoon if you trip on it.
  • 📌 Worth knowing: a non-obvious decision the system made for you. Not wrong, just surprising.

Screenshots live at ../screenshots/<area>/. Page filenames are kebab-case-singular (api-keys.md, rate-limits.md); the agentic identity page is agentic.md deliberately, because the AGENTS.md filename is reserved by AI-agent tooling.