Dashboard Guide¶
What you'll learn: How to navigate the Kyvvu dashboard, oversee agents, and manage policies.
Overview¶
The Kyvvu dashboard is a web interface at platform.kyvvu.com for overseeing agents, managing policies, triaging incidents, and generating reports.
Navigation¶
The sidebar provides access to all sections:
| Section | What it shows |
|---|---|
| Workspace switcher | At the top of the sidebar. Every account has a personal workspace and may belong to organizations too; this is how you move between them, and where + New organization… lives. |
| Dashboard | Overview stats (agents, manifests, policies, incidents), recent incidents table, recent activity. |
| Agents | Agent list with risk, environment, last policy fetch. Expand for assigned manifests, resync, view policies. |
| Manifests | The connected repositories and their YAML manifests; assign to agents via the checkbox modal. Every new workspace starts with the Kyvvu/manifests library already connected — it is served from the platform image, so it is there from the first second and needs no GitHub access. Add your own with Add Repository. |
| Logs | Behavioral trace logs — searchable by agent, task ID, time range. Hash chain validation. |
| Incidents | Policy violations with severity, status, environment, agent and occurrence count. |
| Workspace (gear icon) | Tabs: General, Members (shared organizations only), API Keys, Usage, Platform Events, Reports. |
| Admin, Demos | Shown only when they apply: Admin to Kyvvu staff, Demos in the demo and dev environments, in the workspace the demo key belongs to. |
Account settings and Appearance are not under Workspace. They live in the account menu at the foot of the sidebar — Account settings opens as its own screen, and Appearance cycles light → dark → auto in place.
Agent oversight¶
The Agents page lists all registered agents with: - Agent key and ID - Name and purpose - Environment (development / qa / staging / production) - Risk classification (high / limited / minimal / unacceptable / unclassified) - Active/inactive status
Click an agent to see its details, associated policies, recent logs, and incidents.
Why agents cannot be created here¶
There is no "New agent" button, and this is deliberate. An agent comes into
existence when instrumented code calls register_agent() — that call is what
supplies the declared tool allowlist, the risk classification and the
environment, and it is what binds the row to a running process that can be
governed.
A dashboard-created agent would be a row with no code behind it: nothing to
enforce policies on, an empty tool allowlist (which the baseline's "Tool calls
must be in the declared allowlist" rule fails closed on), and a second identity
to reconcile the moment the real agent registers with its own agent_key.
Agents are created by registering them from code or the CLI; the dashboard lists them once registered.
Policy management¶
Policies are created automatically when manifests are assigned to agents. To manage policies: - Manifests page: Connect a repo, browse manifests, assign to agents - Agents page: Expand an agent to see assigned manifests, view policies, update or remove assignments
Log viewer¶
The Logs page displays the behavioral trace as a paginated list of tasks:
- The task list is loaded server-side (GET /api/v1/logs/tasks), one summary row
per task with its agent, environment, step count, and status — 20 tasks per
page. This scales to agents with hundreds of steps per task.
- Filter by agent or time range; the free-text task ID filter resolves a single
task directly.
- Expand a task (or open its details) to lazy-load the full ordered sequence of
steps — steps are fetched on demand, not up front.
- Each step shows its evaluation result (allow / warn / block) and the Behavior data.
- Hash chain validation: click "Validate" on a task to check that its stored entries still match their stored hashes, recomputed by the platform (chain v1). This catches an edit that did not recompute the chain; it is not proof against someone with database access.
Authentication¶
Log in at platform.kyvvu.com with just your email — a one-time sign-in link is sent, no password. Access tokens are refreshed automatically in the background and expire after 60 minutes if the tab is closed.
If you arrived from an invitation link, accepting it signs you in at the same moment — there is no second link to wait for.
Next steps¶
- Incident Management — triage and resolve policy violations
- Workspaces, Organizations & Access — workspaces, members and permissions
- Reports — generate compliance reports