# Tanomis developer docs

> Build and deploy governed AI agents with Tanomis.

- [Tanomis documentation](https://docs.tanomis.com/): Run AI agents as a governed service. You write the agent; Tanomis packages it, runs it per tenant, and gives every action an identity, a policy check, and a record.
- [Platform API](https://docs.tanomis.com/api): The application-facing HTTP surface for agents that are already deployed and enabled for the tenant selected by your workspace.
- [Invoke once and stream](https://docs.tanomis.com/api/agents/invoke-agent): POST /v1/agents/{agent_name}/runs: Create a session and stream one run in a single request.
- [List agents](https://docs.tanomis.com/api/agents/list-agents): GET /v1/agents: Return the agents enabled for the selected tenant.
- [Delete a file](https://docs.tanomis.com/api/files/delete-file): DELETE /v1/sessions/{session_id}/files/{file_id}: Delete a file from the session.
- [Download file bytes](https://docs.tanomis.com/api/files/download-file-content): GET /v1/sessions/{session_id}/files/{file_id}/content: Download the file's bytes.
- [List files](https://docs.tanomis.com/api/files/list-files): GET /v1/sessions/{session_id}/files: List the files in the session with their status.
- [Prepare a file](https://docs.tanomis.com/api/files/prepare-file): POST /v1/sessions/{session_id}/files: Prepare file metadata before uploading bytes.
- [Upload file bytes](https://docs.tanomis.com/api/files/upload-file-content): PUT /v1/sessions/{session_id}/files/{file_id}/content: Upload the prepared file's bytes with `Content-Type: application/octet-stream` and a `Content-Length` equal to the prepared `size_bytes`.
- [Answer an interaction](https://docs.tanomis.com/api/interactions/answer-interaction): POST /v1/sessions/{session_id}/interactions/{interaction_key}/answer: Accept a durable human answer by the stable `interaction_key`.
- [List interactions](https://docs.tanomis.com/api/interactions/list-interactions): GET /v1/sessions/{session_id}/interactions: List the session's human questions and permission decisions.
- [Cancel a run](https://docs.tanomis.com/api/runs/cancel-run): POST /v1/sessions/{session_id}/runs/{run_id}/cancel: Request cancellation of an active run.
- [Read a run](https://docs.tanomis.com/api/runs/get-run): GET /v1/sessions/{session_id}/runs/{run_id}: Read one run.
- [List runs](https://docs.tanomis.com/api/runs/list-runs): GET /v1/sessions/{session_id}/runs: List the session's runs.
- [Start a run](https://docs.tanomis.com/api/runs/start-run): POST /v1/sessions/{session_id}/runs: Start one run inside an existing session.
- [Stream run events](https://docs.tanomis.com/api/runs/stream-run-events): GET /v1/sessions/{session_id}/runs/{run_id}/events: Stream or replay the run's events as server-sent events.
- [Create a session](https://docs.tanomis.com/api/sessions/create-session): POST /v1/sessions: Create a reusable session for one enabled agent.
- [Read a session](https://docs.tanomis.com/api/sessions/get-session): GET /v1/sessions/{session_id}: Read one session, including `awaiting_input` and, where file attachments are enabled, `session_files_supported`.
- [List sessions](https://docs.tanomis.com/api/sessions/list-sessions): GET /v1/sessions: List the caller's sessions in the selected tenant.
- [Resume a session](https://docs.tanomis.com/api/sessions/resume-session): POST /v1/sessions/{session_id}/resume: Restart a stopped, failed, or expired session.
- [Stop a session](https://docs.tanomis.com/api/sessions/stop-session): POST /v1/sessions/{session_id}/stop: Stop the session and release its active runtime.
- [List workspaces](https://docs.tanomis.com/api/workspaces/list-workspaces): GET /v1/me/workspaces: Return only the workspace projections granted to the caller.
- [Inspect the caller](https://docs.tanomis.com/api/workspaces/whoami): GET /v1/whoami: Confirm which identity and capabilities the access token resolved.
- [Changelog](https://docs.tanomis.com/changelog): Platform, CLI, manifest, and API changes that affect what you build on Tanomis, newest first.
- [Journey commands](https://docs.tanomis.com/cli): A focused reference for the tanomis commands used to authenticate, scaffold, deploy, inspect, and run.
- [tanomis agent](https://docs.tanomis.com/cli/agent): Reference for tanomis agent: author, register, and inspect agents.
- [tanomis agent delete-local](https://docs.tanomis.com/cli/agent/delete-local): Reference for tanomis agent delete-local: delete a scaffolded agent directory from disk.
- [tanomis agent deploy](https://docs.tanomis.com/cli/agent/deploy): Reference for tanomis agent deploy: package, upload, and remotely build an agent from local source.
- [tanomis agent disable](https://docs.tanomis.com/cli/agent/disable): Reference for tanomis agent disable: remove an agent's enablement for specific tenants (inverse of enable).
- [tanomis agent enable](https://docs.tanomis.com/cli/agent/enable): Reference for tanomis agent enable: enable a global agent for tenants.
- [tanomis agent get](https://docs.tanomis.com/cli/agent/get): Reference for tanomis agent get: show the agent and versions served in the selected workspace.
- [tanomis agent harnesses](https://docs.tanomis.com/cli/agent/harnesses): Reference for tanomis agent harnesses: list available agent harnesses.
- [tanomis agent inventory](https://docs.tanomis.com/cli/agent/inventory): Reference for tanomis agent inventory: list the per-version inventory (AI-BOM) of the agents a tenant can see.
- [tanomis agent ls](https://docs.tanomis.com/cli/agent/ls): Reference for tanomis agent ls: list registered agents (or, with --tenant, the agents a tenant can run).
- [tanomis agent new](https://docs.tanomis.com/cli/agent/new): Reference for tanomis agent new: scaffold a new agent from a harness template.
- [tanomis agent promote](https://docs.tanomis.com/cli/agent/promote): Reference for tanomis agent promote: promote a version to production (alias for transition --to production).
- [tanomis agent rm](https://docs.tanomis.com/cli/agent/rm): Reference for tanomis agent rm: soft-retire one scope-qualified agent from the registry.
- [tanomis agent rollout](https://docs.tanomis.com/cli/agent/rollout): Reference for tanomis agent rollout: roll a version out to specific tenants (promote-if-needed, then enable).
- [tanomis agent statuses](https://docs.tanomis.com/cli/agent/statuses): Reference for tanomis agent statuses: show the version lifecycle: statuses and their allowed transitions.
- [tanomis agent versions](https://docs.tanomis.com/cli/agent/versions): Reference for tanomis agent versions: list an agent's version lineage (label, id, status, kind).
- [tanomis auth](https://docs.tanomis.com/cli/auth): Reference for tanomis auth: inspect authentication state.
- [tanomis auth status](https://docs.tanomis.com/cli/auth/status): Reference for tanomis auth status: show the active context's auth state.
- [tanomis config](https://docs.tanomis.com/cli/config): Reference for tanomis config: manage tanomis configuration and contexts.
- [tanomis config current-context](https://docs.tanomis.com/cli/config/current-context): Reference for tanomis config current-context: print the active context name.
- [tanomis config delete-context](https://docs.tanomis.com/cli/config/delete-context): Reference for tanomis config delete-context: remove a context and clear its cached credentials.
- [tanomis config use-context](https://docs.tanomis.com/cli/config/use-context): Reference for tanomis config use-context: set the active context.
- [tanomis config view](https://docs.tanomis.com/cli/config/view): Reference for tanomis config view: show the effective configuration.
- [tanomis docs](https://docs.tanomis.com/cli/docs): Reference for tanomis docs: serve the documentation to coding agents.
- [tanomis docs serve](https://docs.tanomis.com/cli/docs/serve): Reference for tanomis docs serve: serve the documentation to a coding agent as MCP tools over stdio.
- [tanomis login](https://docs.tanomis.com/cli/login): Reference for tanomis login: log in to a hosted control plane via OIDC.
- [tanomis logout](https://docs.tanomis.com/cli/logout): Reference for tanomis logout: clear cached credentials for the active (or --context) context.
- [tanomis m2m](https://docs.tanomis.com/cli/m2m): Reference for tanomis m2m: manage organization machine clients (human owner/admin login required).
- [tanomis m2m create](https://docs.tanomis.com/cli/m2m/create): Reference for tanomis m2m create: create a client and show its secret once.
- [tanomis m2m delete](https://docs.tanomis.com/cli/m2m/delete): Reference for tanomis m2m delete: delete a client and its credentials.
- [tanomis m2m disable](https://docs.tanomis.com/cli/m2m/disable): Reference for tanomis m2m disable: disable a client at the next authorization decision.
- [tanomis m2m enable](https://docs.tanomis.com/cli/m2m/enable): Reference for tanomis m2m enable: re-enable a client.
- [tanomis m2m get](https://docs.tanomis.com/cli/m2m/get): Reference for tanomis m2m get: inspect a client and its credential metadata.
- [tanomis m2m ls](https://docs.tanomis.com/cli/m2m/ls): Reference for tanomis m2m ls: list machine clients.
- [tanomis m2m permissions](https://docs.tanomis.com/cli/m2m/permissions): Reference for tanomis m2m permissions: change a client's permission profile or scopes.
- [tanomis m2m rename](https://docs.tanomis.com/cli/m2m/rename): Reference for tanomis m2m rename: rename a client.
- [tanomis m2m revoke](https://docs.tanomis.com/cli/m2m/revoke): Reference for tanomis m2m revoke: revoke a credential.
- [tanomis m2m rotate](https://docs.tanomis.com/cli/m2m/rotate): Reference for tanomis m2m rotate: create an overlapping credential and show its secret once.
- [tanomis mcp](https://docs.tanomis.com/cli/mcp): Reference for tanomis mcp: manage governed MCP connectors.
- [tanomis mcp connector](https://docs.tanomis.com/cli/mcp/connector): Reference for tanomis mcp connector: create, inspect, and test MCP connectors.
- [tanomis mcp connector create](https://docs.tanomis.com/cli/mcp/connector/create): Reference for tanomis mcp connector create: create an MCP connector.
- [tanomis mcp connector discover](https://docs.tanomis.com/cli/mcp/connector/discover): Reference for tanomis mcp connector discover: discover tools and print the inventory diff.
- [tanomis mcp connector get](https://docs.tanomis.com/cli/mcp/connector/get): Reference for tanomis mcp connector get: show one MCP connector.
- [tanomis mcp connector list](https://docs.tanomis.com/cli/mcp/connector/list): Reference for tanomis mcp connector list: list MCP connectors.
- [tanomis mcp connector review](https://docs.tanomis.com/cli/mcp/connector/review): Reference for tanomis mcp connector review: set review status for one discovered MCP tool.
- [tanomis mcp connector set-status](https://docs.tanomis.com/cli/mcp/connector/set-status): Reference for tanomis mcp connector set-status: set a connector's lifecycle status (draft|active|degraded|disabled|retired).
- [tanomis mcp connector test](https://docs.tanomis.com/cli/mcp/connector/test): Reference for tanomis mcp connector test: probe connector reachability and tools/list.
- [tanomis mcp connector tools](https://docs.tanomis.com/cli/mcp/connector/tools): Reference for tanomis mcp connector tools: list discovered tools for an MCP connector.
- [tanomis org tenants](https://docs.tanomis.com/cli/org/tenants): Reference for tanomis org tenants: provision and manage your organization's tenants.
- [tanomis org tenants create](https://docs.tanomis.com/cli/org/tenants/create): Reference for tanomis org tenants create: provision a tenant in this organization.
- [tanomis org tenants get](https://docs.tanomis.com/cli/org/tenants/get): Reference for tanomis org tenants get: inspect a tenant.
- [tanomis org tenants ls](https://docs.tanomis.com/cli/org/tenants/ls): Reference for tanomis org tenants ls: list organization tenants.
- [tanomis org tenants offboard](https://docs.tanomis.com/cli/org/tenants/offboard): Reference for tanomis org tenants offboard: withdraw access and tear down a tenant's resources.
- [tanomis org tenants retry](https://docs.tanomis.com/cli/org/tenants/retry): Reference for tanomis org tenants retry: retry failed provisioning.
- [tanomis session](https://docs.tanomis.com/cli/session): Reference for tanomis session: run, observe, stop, and reap runtime sessions.
- [tanomis session file](https://docs.tanomis.com/cli/session/file): Reference for tanomis session file: manage files in an existing session.
- [tanomis session file get](https://docs.tanomis.com/cli/session/file/get): Reference for tanomis session file get: download a session file.
- [tanomis session file ls](https://docs.tanomis.com/cli/session/file/ls): Reference for tanomis session file ls: list session files.
- [tanomis session file put](https://docs.tanomis.com/cli/session/file/put): Reference for tanomis session file put: upload a file without starting a run.
- [tanomis session file rm](https://docs.tanomis.com/cli/session/file/rm): Reference for tanomis session file rm: delete a session file.
- [tanomis session get](https://docs.tanomis.com/cli/session/get): Reference for tanomis session get: show one session.
- [tanomis session ls](https://docs.tanomis.com/cli/session/ls): Reference for tanomis session ls: list sessions.
- [tanomis session run](https://docs.tanomis.com/cli/session/run): Reference for tanomis session run: invoke an agent: create a session, start a run, and stream its output.
- [tanomis session stop](https://docs.tanomis.com/cli/session/stop): Reference for tanomis session stop: stop a running session.
- [tanomis skills](https://docs.tanomis.com/cli/skills): Reference for tanomis skills: install the platform skills for coding agents (Claude Code, Codex, Cursor).
- [tanomis skills install](https://docs.tanomis.com/cli/skills/install): Reference for tanomis skills install: write the platform skills into a coding agent's skills directory.
- [tanomis skills list](https://docs.tanomis.com/cli/skills/list): Reference for tanomis skills list: list the platform skills embedded in this binary.
- [tanomis skills show](https://docs.tanomis.com/cli/skills/show): Reference for tanomis skills show: print one rendered skill without installing it.
- [tanomis version](https://docs.tanomis.com/cli/version): Reference for tanomis version: print tanomis version information.
- [tanomis workspace](https://docs.tanomis.com/cli/workspace): Reference for tanomis workspace: discover and select a managed-SaaS workspace.
- [tanomis workspace clear](https://docs.tanomis.com/cli/workspace/clear): Reference for tanomis workspace clear: clear the active context's workspace selection.
- [tanomis workspace ls](https://docs.tanomis.com/cli/workspace/ls): Reference for tanomis workspace ls: list the organizations and tenants you can access.
- [tanomis workspace show](https://docs.tanomis.com/cli/workspace/show): Reference for tanomis workspace show: show the workspace selected on the active context.
- [tanomis workspace use](https://docs.tanomis.com/cli/workspace/use): Reference for tanomis workspace use: select a workspace and persist it on the active context.
- [Agents and versions](https://docs.tanomis.com/concepts/agents-and-versions): An agent is a name; a version is an immutable build plus its declared contract; enablement decides which tenants a version serves.
- [Policy, approvals, and evidence](https://docs.tanomis.com/concepts/governance): The controls that decide what an agent may do, the points where a person can step in, and the records that prove what happened.
- [Identity and access](https://docs.tanomis.com/concepts/identity-and-access): Who asked, who acted, and how a request is resolved. The identity postures an agent can declare, what the platform actually establishes today, and why a declaration never grants access.
- [Organizations and tenants](https://docs.tanomis.com/concepts/organizations-and-tenants): How a customer organization, its members and roles, its runtime tenants, and the workspace you select fit together.
- [Platform model](https://docs.tanomis.com/concepts/platform-model): The six nouns that explain Tanomis: platform, organization, tenant, agent version, session, run. How they nest, who works at each level, and what an operation changes.
- [Security and isolation model](https://docs.tanomis.com/concepts/security-model): How agents are isolated from each other and from the platform, how tenants are kept apart, and what is signed.
- [Sessions and runs](https://docs.tanomis.com/concepts/sessions-and-runs): A session is where state lives; a run is one request inside it. Statuses, one-active-run, idempotent retries, and what to do when a run waits for a person.
- [Authenticate and select a workspace](https://docs.tanomis.com/getting-started/authenticate-and-select-workspace): Sign in to hosted Tanomis as a person, choose a CLI context and granted workspace, and keep that human login out of application backends.
- [Build with a coding agent](https://docs.tanomis.com/getting-started/coding-agents): Teach Claude Code, Codex, or Cursor to scaffold, deploy, run, and govern Tanomis agents with platform skills and a documentation MCP server, installed by one tanomis command.
- [Tour the Console](https://docs.tanomis.com/getting-started/console-tour): What each screen of the Tanomis Console is for, from the first session to the audit export, and when to reach for the CLI or the API instead.
- [Get access](https://docs.tanomis.com/getting-started/get-access): How you get into Tanomis: an organization, an invitation, and a first workspace, and what to ask for if you are setting one up.
- [Install tanomis](https://docs.tanomis.com/getting-started/install): Install the tanomis CLI on macOS, Linux, or Windows with one command, verify the download, pin a version in CI, and upgrade.
- [Quickstart](https://docs.tanomis.com/getting-started/quickstart): Scaffold an agent, deploy it once for every tenant on your platform, run it, and open the result in the Console.
- [Audit and evidence](https://docs.tanomis.com/guides/audit/audit-and-evidence): Read the organization's audit trail, understand what the ledger proves, and find the execution record for a run.
- [Export an auditor package](https://docs.tanomis.com/guides/audit/export-an-auditor-package): Hand an auditor a self-contained export of the ledger segment they need, with the integrity metadata to check it.
- [Policy decisions](https://docs.tanomis.com/guides/audit/policy-decisions): Where each allow or deny lands, what a decision record contains, and how to trace a refusal back to the ceiling that caused it.
- [Read the audit trail](https://docs.tanomis.com/guides/audit/read-the-audit-trail): Find what happened, who did it, and under which authority, from the Console's Assurance section or from tanomis org audit.
- [Traces and content classes](https://docs.tanomis.com/guides/audit/traces-and-content-classes): Match a ledger decision to the execution it was made about, and understand which content class you are allowed to see when you do.
- [Verify the ledger independently](https://docs.tanomis.com/guides/audit/verify-the-ledger): Check the audit ledger's hash chain and signatures with an offline verifier you run yourself.
- [Add skills to your agent](https://docs.tanomis.com/guides/build/agent-skills): Ship a folder of SKILL.md files with your agent so the model loads the right procedure on demand, on the Claude Agent SDK and Deep Agents harnesses.
- [Choose a harness](https://docs.tanomis.com/guides/build/choose-a-harness): Claude Agent SDK or Deep Agents. What each one is good at, what your entrypoint returns, and what stays the same whichever you pick.
- [Choose models](https://docs.tanomis.com/guides/build/choose-models): Declare the model an agent uses and the models a run may request, and understand what the tenant's LLM gateway does with every call.
- [Claude Agent SDK](https://docs.tanomis.com/guides/build/claude-agent-sdk): Write the Claude Agent SDK entrypoint, know what the runtime owns, and wire approvals and questions through the manifest.
- [Connect your models](https://docs.tanomis.com/guides/build/connect-your-models): Bring your own model endpoints or provider accounts and route agents to them through the tenant gateway.
- [Deep Agents](https://docs.tanomis.com/guides/build/deep-agents): Return a compiled Deep Agents graph from the entrypoint while Tanomis owns the model route, checkpoints, and the workspace.
- [Generative UI](https://docs.tanomis.com/guides/build/generative-ui): Let an agent return structured UI, rendered by the Console or your own application, instead of only text and tool calls.
- [Manifest essentials](https://docs.tanomis.com/guides/build/manifest-essentials): Understand the agent.yaml fields that control identity, state, models, resources, and policy.
- [Secrets and configuration](https://docs.tanomis.com/guides/build/secrets-and-configuration): Why an agent bundle never carries a credential, how the agent reaches external systems anyway, and where per-run configuration comes from.
- [Session workspace and state](https://docs.tanomis.com/guides/build/session-workspace-and-state): What the agent can write to, what persists across runs and sessions, and how idle and lifetime limits shape a session.
- [Test before you deploy](https://docs.tanomis.com/guides/build/test-before-you-deploy): What you can verify locally, what only a deployed run can show, and how to use a sandbox tenant as your test bed.
- [Write your agent](https://docs.tanomis.com/guides/build/write-your-agent): The entrypoint contract every harness shares, what the runtime passes in, what you return, and what stays out of your code.
- [Create a custom connector](https://docs.tanomis.com/guides/connect-tools/create-a-custom-connector): Register an MCP server as a governed connector for your tenant, discover and review its tools, activate it, and configure agent access.
- [GitHub repositories](https://docs.tanomis.com/guides/connect-tools/github-repositories): Connect GitHub to a workspace, set which repositories agents may use, and declare repository access in a manifest.
- [Declare an integration](https://docs.tanomis.com/guides/connect-tools/integration-contracts): Reference a connector and its allowed tools directly in agent.yaml.
- [MCP connectors](https://docs.tanomis.com/guides/connect-tools/mcp-connectors): Reference configured connectors in your manifest, limit tools, and connect personal accounts.
- [Private connections and OAuth](https://docs.tanomis.com/guides/connect-tools/private-connections): Connect your own account, recover a saved request, and disconnect access.
- [Tool approvals and schema pins](https://docs.tanomis.com/guides/connect-tools/tool-approvals-and-schema-pins): Choose approved connector tools and require confirmation for individual calls.
- [Automation credentials](https://docs.tanomis.com/guides/deploy/automation-credentials): Create an organization-owned machine client for CI or a backend, choose its permissions, and rotate its secret.
- [Deploy a version](https://docs.tanomis.com/guides/deploy/deploy-a-version): What tanomis agent deploy does between your source tree and an enabled tenant, and how to read what it tells you.
- [Deploy from CI](https://docs.tanomis.com/guides/deploy/deploy-from-ci): Validate an agent locally in CI and deploy it to a selected tenant with an organization-owned credential.
- [Environments and contexts](https://docs.tanomis.com/guides/deploy/environments-and-contexts): Keep a sandbox tenant that serves no customer, reach customers through rollouts, and keep one CLI context per Tanomis environment.
- [Retire an agent](https://docs.tanomis.com/guides/deploy/retire-an-agent): Stop serving a version to a tenant, deprecate old versions, and soft-retire an agent while keeping its history.
- [Roll out and roll back](https://docs.tanomis.com/guides/deploy/rollout-and-rollback): Move a global agent version to customers one tenant at a time with a canary, graduate it, and restore the known-good baseline in one command.
- [Versions and statuses](https://docs.tanomis.com/guides/deploy/versions-and-statuses): Version labels, the status lifecycle from draft to retired, and how status differs from the enablement that routes traffic.
- [Capture execution traces](https://docs.tanomis.com/guides/evaluate/capture-traces): What a run's execution trace contains, the three content capture levels, and who can read a trace.
- [Datasets and experiments](https://docs.tanomis.com/guides/evaluate/datasets-and-experiments): Curate versioned datasets of examples and run experiments that grade a whole dataset and roll up metrics.
- [Evaluate a version](https://docs.tanomis.com/guides/evaluate/evaluate-a-version): Test a candidate version against the version serving a tenant on real past runs, and post the result on the pull request.
- [Export agent traces with OpenTelemetry](https://docs.tanomis.com/guides/evaluate/export-traces-opentelemetry): Send each run's execution trace to your own observability backend over OTLP, with the content controls your tenant policy allows.
- [Human feedback and annotation](https://docs.tanomis.com/guides/evaluate/human-feedback): Record human judgements beside automated assessments and use them to calibrate scorers.
- [Online monitoring](https://docs.tanomis.com/guides/evaluate/online-monitoring): Score a sample of production runs continuously and alert on drift.
- [Evaluation overview](https://docs.tanomis.com/guides/evaluate/overview): How Tanomis turns a run into a trace, a trace into an assessment, assessments into experiments, and a verdict into a release gate.
- [Scorers and judge models](https://docs.tanomis.com/guides/evaluate/scorers-and-judges): Choose built-in scorers, configure a judge model under the tenant allowlist, and publish a tenant-authored scorer.
- [Data handling and retention](https://docs.tanomis.com/guides/govern/data-handling): What Tanomis stores about your sessions, runs, files, and traces, for how long, and who can read it.
- [Restrict network egress](https://docs.tanomis.com/guides/govern/restrict-network-egress): Declare the external hosts an agent may reach, understand the tenant ceiling that bounds it, and read a refusal.
- [Set the authorization ceiling](https://docs.tanomis.com/guides/govern/set-the-authorization-ceiling): Declare the most authority an agent's own tokens can ever carry, in the three scope grammars the platform accepts, and understand what the ceiling does and does not govern.
- [Support access and break-glass](https://docs.tanomis.com/guides/govern/support-access): How Tanomis support can act inside your workspace, what a support grant contains, and where you see it.
- [Usage and spend](https://docs.tanomis.com/guides/govern/usage-and-spend): How model usage is metered per run, where you read it, and how a session budget bounds what an agent can spend.
- [Write tenant policy](https://docs.tanomis.com/guides/govern/write-tenant-policy): Add a rule that limits what agents on a tenant may do, see what it would have done, and publish it as the next version.
- [Organization members and access](https://docs.tanomis.com/guides/manage/organization-members): Invite people, set roles, grant tenants, transfer ownership, and read the audit trail, from the Console or from tanomis.
- [SSO and SCIM](https://docs.tanomis.com/guides/manage/sso-and-scim): Sign members in through your identity provider and sync groups automatically.
- [Customer tenants](https://docs.tanomis.com/guides/manage/tenants-and-environments): Create, inspect, retry, and offboard organization tenants from the Console or CLI.
- [Workspaces](https://docs.tanomis.com/guides/manage/workspaces): What a workspace is, how to switch between them in the CLI and the Console, and why selecting one never widens what you can do.
- [Answer approvals in the Console](https://docs.tanomis.com/guides/run/answer-approvals-in-the-console): Where a paused run shows up in the Console, how to answer a permission request or a question, and how the Supervision inbox orders what is waiting.
- [Approval-required actions](https://docs.tanomis.com/guides/run/approval-required-actions): Pause an agent at the actions you choose, show a person exactly one decision, answer once, and follow the same run to completion.
- [Attach files to a session](https://docs.tanomis.com/guides/run/attach-files): Give an agent documents to work on: prepare the file, upload its bytes, and reference it when you start a run.
- [Authenticate a backend](https://docs.tanomis.com/guides/run/authenticate-your-backend): Discover OAuth settings and use an organization machine client to authenticate platform API requests.
- [Delegate work to another agent](https://docs.tanomis.com/guides/run/delegate-to-another-agent): Let one agent hand a unit of work to another with narrowed authority, wait for the result, and keep every decision in the audit trail.
- [Durable work and settlement](https://docs.tanomis.com/guides/run/durable-work-and-settlement): Bind a run to a unit of durable work that outlives the session, continue it later, and understand what settlement mode adds.
- [Event triggers](https://docs.tanomis.com/guides/run/event-triggers): Start a run when something happens elsewhere: a webhook, a queue message, or a platform event, with the payload delivered to the agent.
- [Fork a session](https://docs.tanomis.com/guides/run/fork-a-session): Start a new session from a point in an existing session's history, with its own lineage and evidence.
- [Invoke from your application](https://docs.tanomis.com/guides/run/invoke-from-your-application): Call a deployed agent from your own backend: discover the workspace, create a session, start a run, and follow it to a result.
- [Scheduled execution](https://docs.tanomis.com/guides/run/scheduled-execution): Run an agent on a schedule without a caller: define a cadence, choose what each run starts with, and follow the runs it produces.
- [Stream and replay events](https://docs.tanomis.com/guides/run/stream-and-replay-events): Consume Tanomis run events, persist a cursor, reconnect safely, and confirm durable run status.
- [Webhooks](https://docs.tanomis.com/guides/run/webhooks): Receive an HTTP request from Tanomis when a lifecycle event happens, such as a run finishing or an approval being requested, instead of polling.
- [Agent manifest](https://docs.tanomis.com/reference/agent-manifest): Current agent.yaml settings, with types, defaults, validation rules, and effects.
- [What is available where](https://docs.tanomis.com/reference/availability): Which capabilities are on for every tenant, which are enabled per tenant, and how to tell from the API or CLI before you build on one.
- [CLI configuration](https://docs.tanomis.com/reference/cli-configuration): Where tanomis keeps its configuration, how contexts and credentials are stored, and the environment variables and flags that override them.
- [Errors reference](https://docs.tanomis.com/reference/errors): Every error code the Platform API and the CLI can return, with its HTTP status and what to do about it.
- [Events reference](https://docs.tanomis.com/reference/events): The envelope every run event shares, the event types a consumer can rely on, and the payload of each.
- [Glossary](https://docs.tanomis.com/reference/glossary): The words Tanomis uses, each defined once, with a link to the page that explains it.
- [Limits and quotas](https://docs.tanomis.com/reference/limits): Request, session, file, and rate limits, with the status you see when you hit one.
- [Organization management API](https://docs.tanomis.com/reference/organization-management-api): Human owner/admin HTTP endpoints for machine client credentials and tenant lifecycle.