Getting started as an admin

Give your team a setup that works on day one: an agent, the tools it needs, and a stack that every new member gets automatically. Start with the four steps below. The rest of this page covers what to add as your team grows.

You choose which platform features your organization uses, such as deputies, webhooks and the Slack connection, in Settings > Platform. See Platform features.

You reach settings from the organization chip at the top right. Select it, then select Organization settings. The admin-only pages in the left rail are Stacks, Network policies and Dashboards.

The minimum useful setup

Install an agent and a source tool. Open Marketplace. On the Browse tab, select Install on an agent, such as Claude Code, and on a source tool, such as GitHub. Or open the Stacks tab and select Install stack on a ready-made stack: Marshal installs what it needs and creates an editable draft in Stacks.
Build and publish a stack. A stack bundles the agent, its tools and its network policy. Members build their manifests from it. Open Stacks, select New stack, add modules, and select Publish v1. See Build and publish a stack.
Give the stack to everyone. In the stack editor, open Automation and turn on Auto-seed new members, so every new member gets a manifest from this stack. For people who are already here, open More stack actions and choose Push to members.
Invite your team. Go to Settings, then Members, and select Invite member. See Invite a teammate.

What you should see: a new member signs in, connects their own credentials under Connections, and finds a manifest ready on New Space. From there they are one click from a working agent.

When you need it

Platform features

Turn whole features on or off for your organization in Settings > Platform. A change applies right away, with no restart.

Deputies and runs: deputies, missions, runs and the approval inbox. On by default.
Webhooks: receive events from GitHub, Slack and other services through Marshal’s Webhook Relay, with no inbound access to your install. Off by default.
Slack and OAuth sign-in: connect Slack and other OAuth apps through Marshal’s Auth Broker. Off by default. Apps you register yourself do not need it.

Flip a switch and select Save changes. Webhooks and the Slack connection each show the address they connect to. The default is right for almost everyone. While a feature is off, its pages say “This feature is not enabled”, and its own settings page gives an admin a link straight to Settings > Platform.

Members and roles

To reset a member’s password, select Reset password on the member row. Marshal shows the new password once. Share it over a private channel.
To remove a person, see Remove a member. Marshal asks you to pick a new owner for anything they own that other people use.
Only an owner can change a role. An admin resets passwords for members only and cannot remove an owner.

See Roles and permissions.

Teams

A team owns manifests, credentials and deputies for a group instead of one person at a time. Go to Settings, then Teams, and select New team. See Create and manage a team and Owners, teams and scope.

A credential lets an agent use a service, such as GitHub or Claude. Nobody can read a credential value after it is saved, not even an owner. Each member connects their own on Connections. You can also create a credential owned by a team or the organization, and share it with Share on its row. People you share with can use it in their spaces. They cannot see, edit, rotate or share it. See Share a credential with a team and Credentials and connections.

Network policy and approvals

Every space blocks outgoing network traffic by default. A network policy lists what to allow or deny, and every organization starts with a default policy.

Open Network policies in the left rail.
Select New policy, or Duplicate an existing one.
Enter a Name and Description. Set Default action. Use deny as the default and add allow rules.
Select + Add rule. Enter the Domains, such as github.com, and optional Tools. Pick a protocol and an action for the rule.
To let members save their own approvals, turn on Manifest self-service: “Allow users to remember their own network approvals”.
Select Create policy.

When a space tries to reach a blocked domain, the member sees it on the Blocked tab and can approve it for that space, or choose Approve & remember for next run to save it to their manifest when the policy allows self-service. A deny rule in the policy always wins. See Approve a blocked domain and Network policy.

Audit log

Open Audit in the left rail and switch to Organization to see events for everyone. To store audit events with an external provider or forward them to a SIEM, go to Settings, then Auditing. See Read the audit log and Audit log.

Retention

Retention windows are organization settings. Go to Settings, then Configuration:

Audit Retention Days (group Security): how long audit events stay in the database.
Finished Run Disk Retention (hours) (group Spaces): how long a finished run’s space stays stopped before it is archived.
Archived Space Retention (days) (group Spaces): how long an archived space is kept before it is deleted, with its workspace backup.

Change a value and select Save Changes. See Retention and archive.

Next: see your setup work

Open your own first space from the stack you just published: Your first task.