Skip to main content
Organizations provide logical separation of infrastructure within your 2501 account. They enable multi-tenancy, allowing you to partition resources, agents, and operations based on your operational structure.

​
What is an Organization?

An organization is a scoping boundary that groups related infrastructure and operations. All operational resources are associated with an organization, providing isolation and access control within your account.

​
Organization Structure

Your tenant is the isolation boundary: nothing is ever visible across tenants, whatever a user’s role or scope. Inside the tenant, every resource is scoped in exactly one of three ways.

​
Organization-scoped resources

These resources always belong to one organization and cannot be made tenant-wide:
  • Hosts: target systems, including their gMSA configuration
  • Agents: each agent belongs to its host’s organization
  • Tasks and Jobs: execution history
  • Job Schedules: recurring and deferred work
  • Tickets and their comments
  • Chats and their messages
  • Gateways: ticket routing integrations
  • Webhooks: outbound notifications
  • Network Discovery: scans and the nodes they find
  • Knowledge: uploaded documents and the host facts extracted from them

​
Shared resources

These resources can be scoped to a specific organization or left unscoped, which makes them available across all organizations in your tenant:
  • Credentials: authentication secrets
  • Specialties: agent domain configurations
  • Operational Rules: mandatory procedures
  • Blacklists: prohibited commands
  • Plugins: MCP integrations and tools
  • Providers: LLM endpoints, tenant-wide unless Scoped to current organization is ticked when creating one. Models belong to a provider and take its scope: an organization-scoped provider’s models are available only to that organization
  • API keys: scope is chosen when the key is created and cannot be changed afterwards
  • Verifier exceptions: one tenant default plus one override per organization, managed by administrators
When a shared resource is organization-scoped, only agents and operations within that organization can use it. When unscoped, it is available to every organization. An organization can also hold a credential with the same name as a tenant-wide one: the organization’s own is used first and the tenant-wide one is the fallback, so a shared default can be overridden per organization.
Creating or editing a tenant-wide shared resource requires tenant-level access. Users restricted to specific organizations can read tenant-wide resources but only write within their own organizations. Tenant-wide providers and the model catalog are further limited to tenant-level administrators. Verifier exceptions are the one exception to the read rule: an organization-restricted administrator sees and edits only their organization’s override, not the tenant default it replaces.

​
Tenant-level resources

These have no organization at all - they describe the tenant itself:
  • Organizations and Users, including which organizations each user belongs to
  • Licensing: plan and usage limits

​
Creating Organizations

Organizations can be created from Command Center → Settings → Organizations. Click New Organization, enter a name, and save. Previously this required the CLI or direct database access. The CLI path is still available via 2501 infra. See Users & Organizations for the full setup workflow.