Skip to main content
Teams & Policies are the multi-tenant authorization boundary: every resource in the Core Engine belongs to a project, every actor holds a role inside it, and sensitive actions can be gated behind human approval. Trusting a backend with your customer conversations sets a high bar. Unpod treats control as architecture, not as an enterprise questionnaire filled in later: scoping is not a filter applied at the API edge - an entity, conversation, or recording outside your project does not exist for your keys. Teams and roles decide who reads and writes; policies decide which actions - sending a payment link, placing a call outside allowed hours, escalating a journey - stop and wait for a human before they run. Deployment is part of control. The Core Engine runs managed, dedicated, hybrid, or self-hosted - and the SDK does not change between them. Where the data lives is a deployment decision, not a rewrite.

​
The primitives

​
On the spine

Teams & Policies do not sit on the spine - they govern it. Every read and write against entities, conversations, and outcomes resolves through a project scope and a role before it executes. Policies read the action an agent or journey is about to take and either let it pass or hold it as a pending approval; each grant, denial, and approval decision emits an audit event alongside the event stream.

​
What stays hidden

Internal organization mappings. How projects, teams, and billing tenants map onto each other inside Unpod - and how a key resolves to its scope at request time - is not a public surface. You work with projects, roles, and keys; the tenancy machinery underneath is Unpod’s job.

​
Status

Spaces, roles, and API keys: production - every call, message, and record in the system is already scoped through them. Policy-gated approvals: in build, shipping with the journey engine. Self-hosted deployment: available today via the self-hosting quickstart.

​
Go deeper

API Keys

Create and rotate the credentials your agents and servers hold.

Space APIs

Address a project and its records over REST.

Self-Hosting

Run the stack in your own infrastructure - same SDK.

Observability

See what your agents did - logs, recordings, traces.