---
title: Console tour
description: Every page in the console and the question it answers.
---

The console is grouped by what you are doing, not by what the data is:
**Operate**, **Secure**, **Connect**, **Develop**, **Administer**. The first
group is daily operation, the second is the security surface, and there is no
commerce group because there is no commerce.

:::security Navigation gates rendering, not access
A page you cannot use is hidden so you are not led to a screen that will refuse
you. That is a courtesy, not a control — the control plane re-authorizes every
request regardless of what the browser chose to draw.

Never reason about security from what the console displays.
:::

`⌘K` opens the command palette from anywhere. Pages are reachable by name and by
keyword, so "kill switch" finds the Security Center.

## Operate

### Overview `/`

The question: *is anything wrong right now?*

Fleet health, enforcement mode per environment, recent decisions, pending
approvals, open incidents. The page to leave open on a second monitor.

### Agents `/agents`

The question: *what agents exist and what state are they in?*

Lifecycle state, environment, last action, risk level, verification status. The
detail page carries identity and key generation, the passport, capability
grants, the delegation chain, recent actions, and the lifecycle controls —
pause, resume, suspend, revoke, rotate key.

Revoke shows the full blast radius before asking, and requires step-up. It is
terminal.

### Approvals `/approvals`

The question: *what is waiting on a human?*

Carries a badge with the pending count. Each card shows the full decision
context: the agent, the delegation chain, the tool, the parameters, the amount,
the policy and rule that required approval, the risk signals with their
explanations, the agent's recent history, and the `purpose` the agent supplied.

:::warning This is the page that rots
An unwatched queue turns approval rules into timeouts, and an action that
expired is an action that silently did not happen. It needs a named owner and a
response-time expectation. See [Approvals queue](/operate/approvals-queue).
:::

### Actions `/actions`

The question: *what has been decided, and why?*

Searchable, filterable by decision, agent, tool and time. The detail page is the
complete lineage — every policy consulted, every rule that matched with its
per-condition trace, the resolved authority, every risk signal, the approval,
the credential lease by reference, the downstream status.

This is where you go when someone says "the agent was blocked and I do not know
why".

## Secure

### Policies `/policies`

The question: *what are the rules, and do they do what we think?*

List with scope, version and status. The detail page has the visual builder, the
version history, a structured diff between any two versions, the test cases and
their results, and the simulator.

Activation needs `policy:activate`, step-up, a reason, and passing tests.

### Delegations `/delegations`

The question: *who can do what, through whom?*

Both a list and a graph. The graph is the useful one — "what can this agent
reach, and through which hops" is hard to read from rows and obvious from edges.

### Tools `/tools`

The question: *what is callable, and by whom?*

Kind, required capability, destination allowlist, risk level, the dangerous
flag, and which agents are authorized. Disable is immediate and applies to every
agent.

### Credentials `/credentials`

The question: *what secrets exist, and how old are they?*

Metadata only. **No page in the console ever displays credential material** —
there is no endpoint that returns it. Status, type, provider, last rotated,
lease count. Rotate and revoke both require step-up.

### Risk `/risk`

The question: *what is unusual?*

Score distribution, signal breakdown, highest-risk tools, destinations in play,
policy violations, credential anomalies. Every score decomposes into named
signals with human-readable explanations. See
[Risk Center](/operate/risk-center).

### Trust `/trust`

The question: *what evidence do we hold, and what is about to lapse?*

Evidence by type with status and expiry. `EXPIRING` is the status to act on —
it is the window before a policy requiring that evidence starts refusing.

### Audit `/audit`

The question: *what happened, and can we prove it?*

Searchable by severity, type, actor and time. The detail view shows the event's
position in the hash chain. Integrity verification and export are both here;
export requires a reason and is itself an audit event.

### Security Center `/security`

The question: *what needs attention, and what can I do about it?*

Per-area counts and a threat feed, plus every emergency control. Each control
has a **side-effect-free blast radius preview** — so nobody finds out what a
control does by using it.

Executing one needs `security:emergency_action`, step-up, a reason, and
`confirm_blast_radius: true`.

### Incidents `/incidents`

The question: *what are we investigating?*

Carries a badge with the open count. Severity, affected agents, timeline, linked
actions and audit events. Open incidents are visible to policy through
`trust.active_incidents`, so an agent under investigation can be held to a
stricter rule automatically.

## Connect

### Registry `/registry`

The question: *what agents does my organization have?*

The private, organization-scoped directory for internal discovery. Publishing to
it grants no authority. It is not a marketplace — see [Scope](/scope).

### MCP `/mcp`

The question: *which MCP servers are connected and what have we authorized?*

Servers with status and transport. The detail page lists discovered tools, each
authorized or not, with per-tool authorize and disable.

Discovery and authorization are separate steps: a newly discovered tool is
unauthorized until a human authorizes it.

### A2A `/a2a`

The question: *which external agents can we deal with?*

Connections with verification state. A connection starts `PENDING` and stays
unusable until its remote passport verifies against the registered key. Block
is immediate and applies to in-flight sessions.

## Develop

### Developer `/developer`

Quick start, SDK, CLI, API Explorer, Webhooks.

**API Explorer** reads the live API catalogue and greys out endpoints your
session cannot call, showing the missing permission. It is the fastest way to
find out *why* something is refused — and the same catalogue generates the
[REST API reference](/reference/api) here.

## Administer

### Admin `/admin/*`

| | Question |
| --- | --- |
| Team | Who has access? |
| Roles | What does each role grant? |
| API keys | What automation has access? |
| SSO | How do people authenticate? |
| Networks | Which networks may reach us? |
| Compliance | What controls do we satisfy, with what evidence? |
| Usage | What is our Veefore consumption? |
| Settings | Organization configuration |

**Compliance** is populated from live system state rather than a questionnaire,
so the evidence a control claims is evidence the system can actually produce.

**Usage** is Veefore's own metering — protected actions and agents. Nothing to
do with what your agents do.

## Design notes

**No purple.** The palette is neutral slate with colour reserved for meaning:
green allowed, amber approval or warning, red blocked or critical, blue
informational. An operator deciding whether to revoke a production agent should
not be looking at a consumer product.

**Colour is never the only signal.** Every status carries text and an icon shape
too, so the console works for colour-blind operators and in monochrome.

**Dark mode is designed, not inverted.** Surfaces are tuned so borders stay
visible and semantic hues keep their contrast ratio instead of becoming neon.

**Empty, error and permission-denied are three different states.** "No agents
yet" and "we could not load agents" and "you cannot see agents" look different,
because conflating them sends people debugging the wrong thing. There are tests
asserting they stay distinguishable.

## Related

:::cards

:::card Approvals queue | /operate/approvals-queue
Operating the queue.
:::

:::card Risk Center | /operate/risk-center
Reading and tuning risk.
:::

:::card Emergency controls | /operate/emergency-controls
Every control and its blast radius.
:::

:::card Audit and export | /operate/audit-and-export
Evidence packs and integrity.
:::

:::