Teams

Teams replace the old single "team" field — a member can belong to several at once (set per-member in Directory). This list is the set of team names available to pick from; only an admin can add, rename, or remove one.

Company entities

The company/legal-entity a member belongs to — sits above teams in the org hierarchy. Set per-member in Directory (Company entity field). Only an admin can add, rename, or remove one from this list.

Tech access

Members tagged Tech (set the tag per-member in Directory; add the team name in Teams first) can open only the sections switched on below — for system development & QC. Switch one on to open it for checking, and off again afterwards. Everything not listed here is unaffected. Leadership and superadmins always see every section regardless of these switches, and switching a section off never removes access they already had.

Hermes task creation

Final org-wide authority for creating tasks through Hermes. It is closed by default. When open, Hermes directly creates a task after uniquely resolving the accessible project and Team People member. No per-task browser confirmation is required; access and identity are checked again at the write boundary.

Hermes task automation

Database-backed rollout controls for task updates, comment analysis and scheduled task messages. Only a superadmin can change them.

Hermes rules & skills

Teach Hermes how your organisation works using reusable, versioned instructions. Rules and skills can be created, reviewed, enabled, restored, and retired without redeploying the app.

Member roles

All current members and their assigned organisation roles. A member may have more than one role.

Hermes Personal PA beta

Enable Hermes for any member. Access and runtime assignment are stored dynamically in the database; each enabled member receives a private Hermes context, without access to anyone else’s data.

MCP / OAuth clients

Client access rights — review the MCP connection ceiling in Clients management.

Approved clients can use their listed callback URIs for the MCP rights a superadmin grants. Revoking a client blocks its new sign-ins and MCP calls, including calls using an existing token. It does not stop external Hermes runtime chats. No secret is shown or stored.

The company name and short badge shown in the header on every page, on the login page, and in the AI assistant's own introduction. Changes save automatically and take effect for everyone the next time they load a page.

Desk Manager

Give each teammate a home seat (a room — one of your teams — plus a seat slot) and mark AI agents with their role. Home seats anchor people to a spot in the 3D office; agent identity drives the concierge and other automations. A member with more than one team is listed under each.

Leave allowances

Set each member's leave amount per type — each row saves automatically when you change a number.

Open reports of chat messages. Resolve to acknowledge/act on a report, or dismiss it as not actionable — either way it leaves this list.

Miro board access

Sets every project's Miro boards to anyone with the link can open and edit, so teammates can open a project board straight from 5MLOS instead of waiting for an individual invite. Boards created before this setting existed were private by default, which is why some people see "No access to board" on a project they are on.

Read this before running it. After this, the board URL is the only thing protecting the board. Anyone who has a link can open and edit that board, including people outside 5 Miles Lab — there is no sign-in check behind it. 5MLOS only shows board links to people who can see the project, so within 5MLOS this is exactly the intent; the risk is a link pasted somewhere public. This is deliberate: our Miro is a personal, one-person account, so there is no real "share with the team" to use instead — and this run explicitly closes team-level sharing on every board it touches rather than leaving it on whatever Miro defaulted to.

• No emails are sent. This changes each board's sharing setting; nobody gets a Miro notification.
• Edit access, matching what an invited teammate already gets on a project board.
• Team sharing is closed on each board at the same time. On a one-person account it grants nobody anything, so it is shut rather than left on Miro's default.
• Safe to run again. Re-running is a no-op on boards that are already open.
• Pasted board links (boards someone added by URL) are left alone — they are not ours to change. Archived projects are skipped; use the per-project Resync board access button for those.
• Existing individual invites keep working and cost nothing. The per-project Resync board access button is unchanged, and is still the way to put a board into someone's own Miro account.