Instance modules
Every ExoHuman instance runs the same released images. Instance modules decide whether a built-in capability exists on a given instance at all. Modules are on by default; there is no separate “enterprise edition” to install. Each module appears where it belongs — in Settings, on the sign-in page or on agent pages — when it is on.
Available modules
Section titled “Available modules”| Module | What it provides | Where it appears |
|---|---|---|
projects | Workspace projects: members, tasks, log, files, steward | Workspace sidebar |
audit | The audit log viewer, hash-chain verification and export (events are always recorded) | Audit page |
user_management | Member provisioning, invitations, suspend/reactivate, activity | People and teams |
retention | Retention windows below the default floor | Instance → Retention and backups |
ephemeral_agents | Short-lived agents created with a time budget | Agent creation |
2fa | TOTP two-factor sign-in, recovery codes, admin policy | My account, sign-in |
sso | OpenID Connect single sign-on | People and teams, sign-in buttons |
scim | SCIM 2.0 user provisioning from your identity provider | People and teams |
siem | Audit forwarding to an HTTPS webhook, Splunk HEC or syslog | Instance → Security event export |
credential_vault | Organisation secrets granted per agent | Integrations |
skill_runner | A managed runner agent that executes library skills for granted agents | Agents |
a2a | Per-agent A2A exposure and inbound allowlist | Agent settings |
assignments | Primary owner, approvers, roles and seats per agent | Agent settings |
permissions_matrix | Who-can-call-whom permission matrix | People and teams |
cross_model_validation | A second model referees validated scheduled runs (guardrails) | Agent guardrails |
slack_per_agent_bots | A dedicated Slack bot per agent | Agent integrations |
telemetry | Local activation insights (nothing leaves the instance) | Instance |
onboarding | Getting-started checklist computed from real platform state | Dashboard |
system_teardown | Preview and remove every agent of a multi-agent system | Systems |
A disabled module’s navigation and pages are hidden and its API routes answer 403. Its MCP tools are removed too.
Turning modules on or off
Section titled “Turning modules on or off”Modules are part of your instance’s configuration, which our team operates. To switch a module off — for example SCIM or SIEM export if you don’t use them — or back on, ask support. The choice survives every update.
Some modules depend on your plan. See Plans & pricing for what each plan includes.
Modules vs. feature access
Section titled “Modules vs. feature access”Modules decide what exists on the instance; feature access decides which people inside it may use a gated capability. Both are enforced by the backend.