Two Surfaces
This boundary explains why Quickstart takes you through two sign-ins. You first authenticate with the shared Control Plane, then enter the separately authenticated Dashboard on your own Stack.
The Control Plane
The Control Plane is shared across tenants. It owns your GitHub OAuth sign-in, billing relationship, and the provisioning lifecycle that creates and operates your Stack. Its tenant data is limited to the account, billing, provisioning, status, and usage facts required for those responsibilities.
Agent work runs on your Stack. Your Threads, Runs, Runtime Credentials, and Workspaces stay there.
Your Stack
Your Stack is a dedicated deployment that runs the Harness. Its Server exposes the Harness over HTTP, its Dispatcher picks up eligible Issues, and its Dashboard lets you observe and operate that work. Every Thread, Run, Event, connected Provider, and watched Project lives on infrastructure provisioned for you.
Why the Surfaces Are Separate
- Tenant isolation. Each Stack has its own Event journals, conversation history, and Credentials. One tenant's Runs can't reach another tenant's data.
- Independent lifecycles. The Control Plane manages billing and your Stack's desired deployment state. Your Stack applies that state while continuing to own agent execution and data.
- A narrow handoff. After you sign in, the Control Plane sends your browser to your Stack with a short-lived, single-use code. Your Stack redeems the code and creates its own session. The two surfaces don't share a secret or browser session. See Auth & Consent for the complete authentication flow.
The Dispatcher on your Stack also uses a machine-to-machine channel with the Control Plane. It fetches desired state and reports status and usage with an identity that's separate from both browser sessions. This channel requires no direct interaction from you.
Related
- Quickstart: go from Control Plane sign-in to the Dashboard on your Stack.
- Auth & Consent: understand the two sessions and the separate credentials used to connect a Provider.
- Data & Privacy: see what data stays on your Stack and where backups live.