> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ainomos.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Organisation apps

> Add apps and bots that work for your organisation rather than for one person, decide where they work, and switch them off.

An organisation app works for your organisation, not for one person. Typical examples are a bot, a scheduled job, or an agent such as Hermes running as a service. It signs in as itself, with a client ID and a secret, and works only in the rooms you allow. Its steps leave evidence under its own name.

Apps that people use as themselves, such as Claude, Cursor or an app your organisation lists, are not added here. Each person connects them under [Personal apps](https://docs.ainomos.ch/apps/connect-apps.md).

## See a room's organisation apps

In the navigation, open **Connections**, then **Organisation apps**. Pick the room in the room picker.

The list is headed **Organisation apps · this room**, or **Organisation apps · Finance and every room below** when an app reaches the rooms below. Each row shows:

* the app's name and its identity: **Own identity** or **Sign-in client** (see below);
* when it was last used, for example **used today** or **not used yet**;
* for an app added in a parent room, **From Finance, for every room below**;
* its status, for example **Active**.

Who can do this: room members see the list. Room owners also open each app and add new ones.

## Add an organisation app

Who can do this: room owners.

**1. Open the form**

Select **Add an organisation app**.

**2. Name it**

Enter a **Name**, for example "Invoice bot". The name must be unique in the room.

**3. Choose where it works**

Under **Where it works**, pick **This room only** or **This room and every room below**.

**4. Add it**

Select **Add app**. The pane shows **Agent registered** with the **Client ID**, the **Remote MCP server URL** and the **Client secret**.

**5. Copy the secret now**

The client secret is shown only once. Copy it and store it where the app runs.

**6. Set up the app**

Follow **1. Mint an access token**: the command exchanges the client ID and secret for a short-lived access token. Then **2. Configure MCP with the access token**: paste the configuration and put the token in its place. Run the token command again when the token expires.

The secret is not a token. Never paste it into the configuration. Adding the app does not test it; check the connection with a real request from the app. MCP is the open standard AI apps use to connect to Ainomos.

### Identity

| Identity | Meaning |
| - | - |
| **Own identity** | The app signs in as itself, without a person. Every new organisation app has this identity. |
| **Sign-in client** | An app that people sign in to as themselves. Such apps were added here before they moved to **Personal apps**. Existing ones stay listed and keep working. |

### Where it works

| Option | Effect |
| - | - |
| **This room only** | The app reaches this room and nothing else. |
| **This room and every room below** | The app also reaches every room under this one. The rooms below show it as inherited. |

Only an app with its own identity can reach the rooms below.

## Look at an app

Select an app in the list. The pane shows:

* **Where it works**, which a room owner can change at any time.
* **Details**: the app's machine identity, when it was connected, the MCP endpoint, the client ID and the sign-in server.
* **Activity in this room**: last and first use, and the counts of requests, reads and decision proposals over 7 and 30 days.
* **Configuration file**: ready-made blocks for MCP and for Hermes.

## Pending first consent and approvals

An app that signs in through a person waits for its first consent. Until then a room owner sees a small dot on its row, **Waiting for its first consent**, and its status reads **Awaiting consent**. It becomes **Active** when the first person signs in and confirms.

Actions an agent wants to take can also need approval. A room owner sets this under **Connections**, **Governance**: the **Enforcement mode** is **Monitor**, **Assisted** or **Strict**, and **Tool rules** can mark a tool **Require approval**. In **Strict** mode such a call waits as an **Agent approval** in the [Inbox](https://docs.ainomos.ch/chat/inbox.md) until a person approves or denies it. These modes act on tools that run through the Ainomos gateway, which the operator of your installation switches on.

## Revoke access

Who can do this: platform admins.

Open **Settings**, then **Connections**, then the tab **Connected apps**. It lists every connected app in the organisation, personal and organisation apps alike, with its owner, room, type, status and when it was last seen.

| Action | Effect |
| - | - |
| **Disable** | The kill switch. The app loses access to all rooms at once. Reversible. |
| **Re-enable** | A disabled app works again immediately. |
| **Remove** | Deletes a disabled app's registration for good. Evidence already recorded is kept. |
| **Revoke access** | Shown instead of **Remove** for an app whose sign-in client other organisations share. Every further connection from it is refused. Cannot be undone. |

You can select several apps and disable or remove them together; you confirm by typing "terminate". A room owner sees a disabled app with the note that only a platform admin can re-enable it.

If an app's secret is lost, it cannot be shown again: remove the app and add it again.

## The Connections settings

Who can do this: platform admins.

**Settings**, **Connections** has two tabs.

**Listed apps** decides which apps people see under **Personal apps**:

* **Where people connect from**: **Only inside the company network** offers only apps on the person's computer. **Also from the internet** also offers apps that call from their own cloud. On Ainomos cloud this is always from the internet.
* **Apps listed for everyone**: drag rows to set the order, and use the switch to set each app **Listed** or **Hidden**. The table shows where each app runs and how many people connected it. Hiding an app removes its card and refuses new connections; connections people already made keep working.
* **Add an app** lists your own app for everyone: its name, icon and setup page, where it runs, whether it **Registers itself** or **Uses a client ID**, its return addresses, the configuration people paste, and up to six steps. A preview shows what members see. Adding or saving an app writes an evidence entry. The sign-in and the return addresses are fixed once the app is added; to change them, remove the app and add it again.

**Connected apps** holds the list with the kill switch described above, and the **Agent proposal cap**: how many open decision drafts one app or person can hold per room. Rooms without their own value use this one; a room's owner or curator can set another in the room details.

## Related

* [Connect your AI apps](https://docs.ainomos.ch/apps/connect-apps.md)
* [What connected apps can do](https://docs.ainomos.ch/apps/what-apps-can-do.md)
* [Rooms](https://docs.ainomos.ch/admin/rooms.md)
* [Inbox](https://docs.ainomos.ch/chat/inbox.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.