Skip to main content
An organisation app works for your organisation, not for one person. Typical examples are a bot, a scheduled job, or an agent such as Hermes running as a service. It signs in as itself, with a client ID and a secret, and works only in the rooms you allow. Its steps leave evidence under its own name. Apps that people use as themselves, such as Claude, Cursor or an app your organisation lists, are not added here. Each person connects them under Personal apps.

See a room’s organisation apps

In the navigation, open Connections, then Organisation apps. Pick the room in the room picker. The list is headed Organisation apps · this room, or Organisation apps · Finance and every room below when an app reaches the rooms below. Each row shows:
  • the app’s name and its identity: Own identity or Sign-in client (see below);
  • when it was last used, for example used today or not used yet;
  • for an app added in a parent room, From Finance, for every room below;
  • its status, for example Active.
Who can do this: room members see the list. Room owners also open each app and add new ones.

Add an organisation app

Who can do this: room owners.
1

Open the form

Select Add an organisation app.
2

Name it

Enter a Name, for example “Invoice bot”. The name must be unique in the room.
3

Choose where it works

Under Where it works, pick This room only or This room and every room below.
4

Add it

Select Add app. The pane shows Agent registered with the Client ID, the Remote MCP server URL and the Client secret.
5

Copy the secret now

The client secret is shown only once. Copy it and store it where the app runs.
6

Set up the app

Follow 1. Mint an access token: the command exchanges the client ID and secret for a short-lived access token. Then 2. Configure MCP with the access token: paste the configuration and put the token in its place. Run the token command again when the token expires.
The secret is not a token. Never paste it into the configuration. Adding the app does not test it; check the connection with a real request from the app. MCP is the open standard AI apps use to connect to Ainomos.

Identity

Where it works

Only an app with its own identity can reach the rooms below.

Look at an app

Select an app in the list. The pane shows:
  • Where it works, which a room owner can change at any time.
  • Details: the app’s machine identity, when it was connected, the MCP endpoint, the client ID and the sign-in server.
  • Activity in this room: last and first use, and the counts of requests, reads and decision proposals over 7 and 30 days.
  • Configuration file: ready-made blocks for MCP and for Hermes.
An app that signs in through a person waits for its first consent. Until then a room owner sees a small dot on its row, Waiting for its first consent, and its status reads Awaiting consent. It becomes Active when the first person signs in and confirms. Actions an agent wants to take can also need approval. A room owner sets this under Connections, Governance: the Enforcement mode is Monitor, Assisted or Strict, and Tool rules can mark a tool Require approval. In Strict mode such a call waits as an Agent approval in the Inbox until a person approves or denies it. These modes act on tools that run through the Ainomos gateway, which the operator of your installation switches on.

Revoke access

Who can do this: platform admins. Open Settings, then Connections, then the tab Connected apps. It lists every connected app in the organisation, personal and organisation apps alike, with its owner, room, type, status and when it was last seen. You can select several apps and disable or remove them together; you confirm by typing “terminate”. A room owner sees a disabled app with the note that only a platform admin can re-enable it. If an app’s secret is lost, it cannot be shown again: remove the app and add it again.

The Connections settings

Who can do this: platform admins. Settings, Connections has two tabs. Listed apps decides which apps people see under Personal apps:
  • Where people connect from: Only inside the company network offers only apps on the person’s computer. Also from the internet also offers apps that call from their own cloud. On Ainomos cloud this is always from the internet.
  • Apps listed for everyone: drag rows to set the order, and use the switch to set each app Listed or Hidden. The table shows where each app runs and how many people connected it. Hiding an app removes its card and refuses new connections; connections people already made keep working.
  • Add an app lists your own app for everyone: its name, icon and setup page, where it runs, whether it Registers itself or Uses a client ID, its return addresses, the configuration people paste, and up to six steps. A preview shows what members see. Adding or saving an app writes an evidence entry. The sign-in and the return addresses are fixed once the app is added; to change them, remove the app and add it again.
Connected apps holds the list with the kill switch described above, and the Agent proposal cap: how many open decision drafts one app or person can hold per room. Rooms without their own value use this one; a room’s owner or curator can set another in the room details.