Portals

A portal is a signed-in chat page that gives a chosen group of people a simple, branded way to use selected agents. It lives at its own address (/p/{address}), people sign in with their normal Console account, and nothing about it gives them access to the dashboard. You decide which published agents it offers, who may open it, from which networks, what people must accept first, and what they can do in the chat.

Use a portal when you want employees, partners or customers to talk to an agent without handing them Studio, API tokens or a project membership. Typical cases are an HR assistant for all staff, a support-engineer assistant for one group, or a pilot of a new agent for ten named people.

Enterprise module

Portals are part of the enterprise edition. The dashboard page exists in the community build but shows an upgrade prompt; the /api/portals (administration) and /api/portal/* (chat) routes answer 402 with module: "portals" until the tenant has an active enterprise license. See Licensing.

What you get

For the people who use it	For the administrator
A chat page with a history, an agent picker, starter questions and a welcome message	A portal that offers up to 50 published agents, in the order you choose
Streaming answers, tool progress, approvals and questions the agent asks them	Who may open it: everyone in the organization, or chosen people and groups, plus IAM deny rules on top
File attachments for agents that take files	A network restriction by IP range, with a self-check so you do not lock yourself out
Copy, regenerate and edit-and-resend; thumbs up/down with reasons	Branding: theme, logo, header title, browser-tab name, icons and link-preview image
Rename, pin and bulk-delete conversations; generated titles	Terms people accept before use, an "AI-generated" label and legal links
Export a conversation as Markdown, JSON or a printable page	Announcement banners, per-portal rate limits, and a change history of every setting
Background alerts when an answer is ready or an approval waits	A test session, a "View as" check, duplicate / export / import, and usage statistics

How it works

 person ──► /p/hr-desk ──► sign in (normal Console account)
                              │
                              ▼
        every request (fail closed):
          - request guard: same-origin check, size limit, per-person rate limits
          - signed in, and an active licence for the workspace?
          - the portal exists in the person's workspace?
          - policy engine: may this person open it?   (access list + IAM rules + network)
          - portal enabled?
          - terms accepted? (chat routes answer 403 until they are)
                              │
                              ▼
        chat (agent-server protocol)  ──►  the agent's PUBLISHED version runs in Console
                              │
                              ▼
        conversation stored in the normal agent conversation store
        (source: portal, visible read-only in Studio sessions)

Three things are worth knowing before you start:

• The portal runs the published version of each agent. Edit an agent in Studio, then publish again for the change to reach the portal. This also applies to the agent's Files, Approvals & questions, Experience and usage-limit settings.
• There is no workspace in the address. /p/hr-desk is the same link for everyone; the workspace comes from the person's session. Addresses are unique inside one workspace.
• Access is decided by the policy engine on every request, not once at sign-in. The portal's access list is its built-in rule; IAM deny rules can still block people on the list, and no allow rule can add anyone to it. If the engine cannot decide, the person sees "Temporarily unavailable" rather than "No access".

Core concepts

Concept	What it is
Portal	The chat page and its settings: name, address, agents, access, look, features, compliance, limits.
Address	The short slug in /p/{address}: 3 to 48 lowercase letters, digits or hyphens. Leave it empty and Console generates an 8-character code.
Agent catalog	The ordered list of published agents the portal offers. The first one is the default.
Access list	Everyone in the organization, or selected people and groups. Selected with nobody chosen means nobody.
Network restriction	An optional allow-list of IP ranges the portal can be used from.
Chat features	Switches for message actions, history management, titles, feedback, export, background alerts and deep links.
Compliance	Terms people accept (versioned), an AI label, and legal links.
Announcements	Banners above the chat with an importance and an optional schedule.
Limits	Per-person rate and volume limits for this portal, bounded by platform ceilings.
Test session	A marked session in which an owner or admin can try a portal that is switched off or does not list them.
Change history	A record of every settings change: who, when, from where, and what changed.

Quick start

1. Publish an agent. A portal can only offer agents that are active and have a published version. See Build and publish an agent.
2. Open Operate → Portals and press Create portal. Give it a name, pick the agents, and choose who can use it. Leave the address empty to get a generated one.
3. Save. The confirmation screen shows the portal link; use Open portal to see it as a person would.
4. On the portal's page, open Chat features, Compliance, Appearance and Limits and adjust them. Each tab has its own Save; the change history records who changed what.
5. Check the audience with Access → View as, or try the portal yourself with … → Open as test.
6. Share the link. People are asked to sign in first and are then taken back to the portal.

The administration guide goes through every tab; the user guide describes what people see.

What a new portal starts with

A portal created now starts with the recommended chat features and nothing else switched on. A portal that was created before the chat features existed is "legacy": everything below stays off until an administrator opens its Chat features tab and saves. Nothing changes for an existing portal on its own.

Setting	New portal	Legacy portal
Copy, regenerate, edit	On	Off
Rename, pin, bulk delete	On	Off
Generated titles	The agent's own model	Off
Feedback (with comments)	On	Off
Export (without tool calls)	On	Off
Tab counter for background alerts	On	Off
Sound and desktop alerts	Off	Off
Deep links send the question	Off (fill the box only)	Off
Terms, AI label, announcements, network restriction	Off	Off
Rate limits	Platform values	Platform values

In this section

• Administering portals — create a portal and configure every tab: agents, access, network restriction, appearance and browser tab, chat features, compliance, announcements, limits, history, duplicate / export / import, test sessions and statistics.
• Using a portal — what people see: signing in, terms, chat, approvals and questions, files, regenerate and edit, feedback, history, export, notifications and language.
• Administration API and reference — the /api/portals administration routes and the /api/portal/{key} runtime routes with request and response examples, every setting with its default and limits, and error codes.
• Troubleshooting and FAQ — "No access", "Not available from here", a missing paperclip, rate limits and more.
• Embedding a portal — show a portal inside your own application, with a signed identity.
• Portal access boundaries — the policy engine's side: deny rules, network restriction, test sessions and View as in depth.

What's new

This release adds the chat experience, compliance and administration tools below. Every one is a stored setting with a default, and existing portals behave as before until you change them.

• Message actions: copy an answer, regenerate the newest answer, edit and resend a message.
• History management: rename, pin and delete several conversations at once; generated titles.
• Feedback: thumbs up/down with reasons and an optional comment, visible to builders on the agent's Feedback tab.
• Welcome and starters: a Markdown welcome with variables and pictures, per-agent welcome and up to six starter questions, and links that open a portal on an agent with a question typed in.
• Compliance: versioned terms people accept, an AI-generated label, legal links, and announcement banners.
• Network restriction: an IP allow-list with a self-check.
• Test session and "View as": try a portal as an administrator, or check what a person or group would meet, without signing in as them.
• Duplicate, export and import: move a portal's settings between portals and workspaces with a dry run first.
• Limits and change history: per-portal rate limits, and an audit trail of every setting change with CSV and JSON export.
• Branding: browser-tab name, description, icon, home-screen icon and link-preview image.
• Export a conversation and background alerts for the people who use the portal.
• Embedding: show a portal inside your own application as a chat bubble, an inline panel or an iframe, with an identity your application signs. This is configured on the Embed tab; see Embedding a portal.

Where to go next

• Authentication — how people sign in to Console.
• Multi-Tenancy — how a workspace is picked from the session, which is why portal addresses carry no workspace.
• Build and publish an agent — the agent a portal runs.
• Agent Server and Chat UI — the open-source protocol and chat component a portal is built on.
• Licensing — enabling enterprise modules.