Admin settings

When people other than the agent’s owner use its workspace, for example the staff of an organisation, a few settings matter. They all live in hexaeight-agent.json in the agent’s folder, which only whoever runs the machine can change. Every change to that file is recorded in the audit trail with its old and new hash.

The defaults follow the licence. A business licence assumes many people on shared machines. A personal licence assumes one person, the owner, on their own machine.

	Business licence	Personal licence
Idle sign-out	after 15 minutes	after 8 hours
Privacy notice and consent withdrawal	offered	not offered

An agent that has not been told its licence type gets the business defaults.

Who may sign in

owner decides who may sign in to the workspace: one address, or *@yourcompany.com for anyone at your domain. What each person may do once signed in is decided by the policy rules. Without owner, the sign-in check lets anyone in. That is meant only for development, and the compliance report shows it as a gap.

Idle sign-out

"sessionIdleMinutes": 30

Set it to between 1 and 1440 minutes, or to 0 to turn the sign-out off. The new value applies from the agent’s next start. A value outside that range is ignored and the licence default applies. The compliance report names the value it ignored.

After that much time without activity, the workspace signs the person out. The session key in the browser is dropped, so coming back takes this device and the phone. A turn that is already running finishes first. Each idle sign-out is recorded in the audit trail.

Terms, privacy notice and consent

Everyone who signs in to the workspace accepts its terms before they begin. Each acceptance is kept, sealed: who accepted, which version, when, and the exact words with their hash.

The privacy notice appears on the terms screen, before anyone accepts. The standard notice says what is collected, why, where it goes, how to withdraw consent, and what other rights people have. It names no contact person, so an organisation should use its own:

• Put your text in privacy-notice.txt, next to hexaeight-agent.json. It replaces the standard notice completely, up to 50,000 characters.
• It is read on every request, so no restart is needed.
• The notice is part of what people accept. Change it, and everyone is asked to accept again.
• If the file is empty, too long or unreadable, the standard notice is shown instead, and the compliance report names the problem.

Withdrawing consent. Anyone can withdraw consent at any time by choosing Privacy at the bottom of the workspace. After that, the workspace shows only the terms until they accept again. Withdrawing does not undo what was done before. HexaPilot jobs they already started keep running, so pause those in HexaPilot. Each withdrawal is recorded in the audit trail and kept beside the acceptance.

On or off. The notice and withdrawal always come together. A personal licence leaves them off, because usually the only person who signs in is the owner. If your organisation gives personal licences to its staff, turn them on:

"privacyNotice": true

false turns both off. The setting applies from the agent’s next start.

The AI notice

The workspace tells people they are working with an AI system, both in the terms they accept and under every message box. It also labels exported conversations as AI-generated, on the page and in the file’s metadata.

Answers that your own applications receive through the agent’s API are not labelled. Label them where you show them.

Lock the settings

The running agent only reads hexaeight-agent.json. The installer and the setup commands are what write it. Once setup is done, an administrator can lock the file. After that, nothing running as the agent’s user can change or replace it: not the agent, not its engines, and not a command someone approves in the workspace.

On Linux:

sudo chattr +i hexaeight-agent.json

On macOS:

sudo chown root hexaeight-agent.json && sudo chflags uchg hexaeight-agent.json

Lock privacy-notice.txt the same way if you use one. Unlock the file before you change a setting or run the installer again:

• Linux: sudo chattr -i hexaeight-agent.json
• macOS: sudo chflags nouchg hexaeight-agent.json && sudo chown $USER hexaeight-agent.json

On Windows, in WSL, the lock works the same way inside WSL’s own filesystem. However, the Windows account that owns WSL can always become root inside it. The lock stops everything that runs as the agent’s user, but not that Windows account.

Every change to the file shows up in the audit trail. While the agent runs, a change is recorded with the old and new hash. If someone changes the file while the agent is stopped, the fingerprint taken at the next start is different. With the SIEM sink on, that record also leaves the machine.

Next

• Compliance reports: check that these settings are in force
• Audit trail: where every change and sign-out is recorded