Accounts and access
Access is layered and the layers compose: Workspace roles, Space roles, Team roles and Campaign roles. Teams are granted access to specific Brands, inherited by sub-teams unless overridden. People sign in with a password, a magic link, Google, or SAML single sign-on configured per Workspace against your identity provider's endpoint and certificate. The Workspace can require two-factor authentication, which uses a time-based code with backup codes, and it can require every member to sign in through the identity provider. A login activity log records method, location and failures.
- Connect your identity provider and require single sign-on for every member.
- Require two-factor authentication for everyone in the Workspace.
- Scope a Team to the Brands it works on, and nothing else.
- Read the login activity log when an account looks wrong.
The audit log
Auditing works at two levels. Each entity carries its own change history with the values before and after, and the Workspace carries a searchable log for compliance. Agent actions land in the same place, each with the reasoning behind it, so a review of what the AI workforce did reads as one record rather than a set of exports.
- Search the Workspace log by actor, entity or date.
- Open an entity's history and read the before and after values.
- Export a compliance report from the governance dashboard.
AI governance
Spending caps apply per Agent run, per Agent per day and per Workspace per month. Kill switches halt one Agent or every Agent at once. Tool approval rules allow, deny or require confirmation for any tool, scoped to the Workspace, an Agent, a Department or a Campaign, defaulting to human confirmation on every call. Destructive actions are classified as automatic, human-in-the-loop or denied, and PII redaction is on by default.
- Set the caps, then watch spend and the forecast against them.
- Deny a tool outright for the Workspace, or require confirmation on each call.
- Set the Autopilot level per Campaign; it defaults to Suggest Only.
White-label
A Workspace can run under its own name: a custom domain, a Brand name, a logo, primary and accent colors, custom CSS, a branded login page, an email sender name, and report header and footer markup. What reaches an internal audience or a client carries your identity rather than Collabre's.
- Point a custom domain at the Workspace and set the logo and colors.
- Brand the login page your people see every morning.
- Write the report header once, and every scheduled report uses it.
API keys and webhooks
API keys carry scopes and rate limits, so a system reads only what it should and cannot flood the API. Webhooks push Collabre events to external systems, and feature flags carry per-Workspace overrides for staged rollouts. Analytics and report data export to CSV and PDF for the systems that prefer a file.
- Issue a scoped key per integration, and revoke one without touching the rest.
- Subscribe a system to the events it needs, and read the delivery status.
Support access
Collabre staff cannot wander into a Workspace. Support access is granted by an owner, time-boxed, and read-only, and every action taken under it is recorded. When a Super Admin enters a Workspace as a user for support, a persistent banner shows it and the session is audit-logged.
- Grant support access for a fixed window when you raise an issue.
- Read the audit log afterwards to see exactly what was viewed.