tenant-adminUpdated 2026-08-17

Workspace Settings

What this covers

Tessallite splits configuration across three levels so each setting has one clear owner:

Workspace identity (display name, slug) and workspace deletion are managed by a system admin from System Administration.

SSO (SAML/OIDC) can be configured per workspace from the project drawer Identity provider section without restarting the process. Group-to-role mappings stay on the separate SSO Mappings section of the same drawer. The deployment still needs a trusted public origin (PUBLIC_BASE_URL or CORS_ORIGINS) so login redirects cannot be pointed at an attacker host.

Where each setting lives

SettingScreen
Source / target connections (PostgreSQL, BigQuery, Hadoop / Spark)Project drawer, Connections tab
LLM provider bundles (OpenAI, Anthropic, Gemini, DeepSeek, GLM, Ollama)Project drawer, LLM Configurations tab
Conversational agent (brief, tone, safety, judge, webhook, retention)Project drawer, seven agent tabs
Default aggregate scheduleModel Configuration, Aggregates tab
AI optimizer sweep knobsModel Configuration, AI Optimizer tab
Pocket-table behaviourModel Configuration, Pocket tab
Predictive-aggregate thresholdsModel Configuration, Predictive tab
Per-model ceilingsModel Configuration, Limits tab
Query timeout, schema sync cadence, rate limits, Spark Thrift defaultsSystem Configuration
Workspace display name, slug, deletionSystem Administration (system admin only)
SSO (SAML / OIDC overlay)Project configuration drawer, Identity provider
SSO group mappingsProject configuration drawer, SSO Mappings
Embed token inventoryProject configuration drawer, Embed tokens

Related