Set the connection mode

When an agent calls a platform, the proxy needs to decide whose OAuth token to use. That decision is governed by connection mode. You set one default for your entire org; per-platform overrides only when a platform needs different handling.

This page lives at /connection-mode in the sidebar (managers only). Per-user modes require an Enterprise plan; everyone else is locked to Shared.

The three modes

Mode	What happens	Use it when
Shared (manager’s token)	Every agent uses the manager’s connection. No audit-trail change downstream — the SaaS just sees one identity (yours).	Default for most platforms. Quick to set up, no per-user OAuth dances.
Per user with fallback	Invitees use their own connection when present; fall back to the manager’s. Audit log shows `credential_source` per call (`self` / `org_fallback`).	You want individual attribution where possible but don’t want to block invitees who haven’t connected yet.
Per user (strict)	Invitees MUST connect their own token first. If they haven’t, the call fails closed with HTTP 412 and a connect link.	High-stakes platforms where attribution to a specific human is required — finance, customer-facing comms, compliance-sensitive systems.

The layout

The page has three sections, top to bottom:

1. Default mode

One dropdown that applies to every platform. Changing this re-evaluates the effective mode for every platform that doesn’t have an override. There’s no per-platform migration step — it’s instant.

2. Overrides

Only platforms whose mode differs from the default appear here. The page starts with this section empty.

+ Add override opens an inline form: pick a platform (the picker hides platforms that already have an override), pick a mode, click Save.
Mode dropdown on each row updates the override in place.
Remove drops the override row entirely — that platform falls back to the default.

The Remove button is different from changing the override to match the default. Removing the row means the platform tracks the default if you later change it; setting the override to the same value as today’s default pins it.

3. Browse all platforms

Collapsed by default. Expand it to see every platform with a chip showing its effective mode (default or override). A (override) marker and amber chip flag platforms that aren’t using the default. Searchable. This view is read-only — to change a platform’s mode, add or edit an override above.

Common patterns

“I want everything per-user-strict except Slack.” Set the default to Per user (strict). Add an override for Slack set to Shared.

“I just want one platform — Stripe — to require per-user.” Leave the default at Shared. Add an override for Stripe set to Per user (strict).

“I’m experimenting — let me roll back.” Each override is independent and reversible. The default can be flipped back at any time.

What the proxy actually does

For each /v1/actions call, the proxy resolves the connection mode in this order:

Look up the per-platform override for this (org, platform). If present, use it.
Otherwise use the org’s default_connection_mode.
Final safety net: Shared.

All resolution paths emit an audit log entry with metadata.credential_source so you can answer “which token did this call use?” weeks later.

Plan gate

Free / Solo / Pro / Team — you can only choose Shared. The other dropdown options are visible but disabled.
Enterprise — all three modes; both the default and overrides can be any of them.

Server enforces the gate too — the dashboard hides disallowed modes, but the API returns 402 if you somehow try to set a disallowed value.