FAQ
General
Is Fleet required to use Kenaz?
No. The Kenaz Harness and Kenaz Workbench work fully on their own. Fleet is an optional, opt-in control plane that you add when a team needs centralized configuration, shared context, or governance. Signing in from the Harness is always a deliberate choice — nothing is pushed to a Harness that hasn't connected to Fleet.
Who is Fleet for?
- Individual professionals on Pro who want a personal dashboard with usage analytics and cost tracking.
- Teams on Team who need to share context, manage members, and set shared routing policy across the org.
- Enterprises that require SAML SSO, custom policy, compliance reports, and isolated infrastructure.
See Plans & Billing for the full comparison.
How do I get started?
See Getting Started for the end-to-end admin walkthrough: create your account, invite your team, pick a plan, and push your first shared configuration.
Accounts & sign-in
What sign-in methods does Fleet support?
Fleet supports email + password, Google Workspace SSO, and Microsoft / Entra SSO on all plans. Custom SAML or OIDC with your own IdP (Okta, Azure AD, and others) is available on Enterprise. See Accounts & SSO.
What does signing in to Fleet change for a member?
When a member signs in from their Harness, the Harness registers itself with Fleet and starts syncing any shared configuration the admin has published — routing policy, shared context, config bundles. The member can always see what's been applied in the Harness Fleet panel.
Signing out stops the sync. The Harness continues working with its local configuration. Nothing stops working.
What's the difference between email domain discovery and SSO?
When you enter your work email on the Fleet login page, Fleet checks whether your org has a corporate SSO configuration bound to your domain. If it does, you're redirected to your identity provider automatically — you never see a password field. This is email domain discovery. SSO is the underlying protocol (Google, Microsoft, or custom SAML/OIDC on Enterprise) that handles the actual authentication.
I see "account already exists" when signing up. What do I do?
Contact support@kameas.ai. Do not attempt to sign up with a Kameas staff email address — staff accounts are a separate identity category and cannot hold customer org roles.
Organizations, teams & roles
What's the difference between owner, admin, and member?
| Role | Short version |
|---|---|
| org_owner | Full control — billing, org settings, ownership transfer, lockdown, SCIM tokens. One per org. |
| org_admin | Everything except billing changes, ownership transfer, deleting the org, and minting SCIM tokens. |
| org_member | Read the org and member list, contribute to team context, manage their own preferences. Cannot manage others or change policy. |
See the full permissions table in Organizations & Teams.
Can I have more than one owner?
No — there is exactly one org owner at a time. You can transfer ownership to another admin via Settings → Transfer ownership.
How do I remove a member?
From the Members page in the Fleet dashboard. Removing a member revokes their access immediately. Their Harness loses sync on the next connection attempt. See Organizations & Teams.
What admins can push (and what they can't)
What can an admin push to members' Harnesses?
Admins can push:
- Routing policy — which AI providers and models are allowed (Team and above, preset rules; custom Rego on Enterprise).
- Shared context graph — facts, decisions, and reference material that lands in members' Harnesses (Team and above).
- Config bundles — broader policy and tool configuration (Team and above).
Everything is packaged as a signed bundle. The Harness verifies the signature before applying it.
What can't admins push?
Fleet cannot push conversation content, personal files, or anything outside the bounded capabilities above. Prompt and response text stays in the Harness on the member's machine — it never travels to Fleet's servers. Role and plan boundaries are enforced by the Harness: a capability that requires Enterprise doesn't apply in a Team org, and org_members can't receive admin-only configuration.
Can members see what's been pushed to their Harness?
Yes, always. The Fleet panel in the Harness shows which org and team the Harness is connected to, whether a routing policy is active and what it restricts, and what shared context is currently synced. There is no hidden mode.
Can a member opt out of the shared configuration?
Routing policy and config bundles are applied when the Harness is connected to Fleet. If a member signs out from Fleet, their Harness stops syncing and keeps the last verified bundle. They can continue working locally. The Harness is always opt-in — members choose to connect.
Plans & billing
How is billing handled?
Pro and Team are self-serve: monthly or annual, billed through the Fleet dashboard (Settings → Billing). New accounts start with a 14-day free trial — no charge until day 15. Only the org owner can make billing changes. See Plans & Billing.
Can I change plans?
- Pro → Team: upgrade via Settings → Billing → Upgrade plan in the dashboard.
- Team → Enterprise: contact your Kameas account manager or email support@kameas.ai.
How do seats work on the Team plan?
Team billing scales with your active member count. You're billed for whichever is greater — your minimum seat commitment or your current member count. Adding members mid-cycle is prorated; removing members takes effect at the next billing period. You can see your current seat count in Settings → Billing.
I have a promo code. Where do I enter it?
At checkout during sign-up. The discount is applied to your subscription automatically.
Telemetry & privacy
What does Fleet collect, and is it opt-in?
Fleet tracks seven distinct telemetry classes. All are off by default except harness.errors (crash reports — stack traces and error codes, never conversation content), which is on by default but can be turned off. No other telemetry is collected without your explicit consent.
| Class | Default |
|---|---|
harness.usage_counts | Off |
harness.tool_calls | Off |
harness.errors | On (can be disabled) |
harness.diagnostics | Off |
sigil.heuristics | Off |
sigil.predictions | Off |
sigil.suggestions | Off |
See Audit & Telemetry for the full breakdown.
Can an admin require telemetry for all members?
On Team and Enterprise, org owners and admins can require specific telemetry classes org-wide. When a class is required at the org level, members cannot opt out of it. Members can always see the source of each opt-in (user_self, org_policy, or install_default) in their account settings.
Is my conversation content ever sent to Fleet?
No. Prompt and response text never travels to Fleet. Outbound traffic from the Harness goes to your AI provider directly, not through Fleet's servers.
Who can see the audit log?
Org owners and admins. Regular members cannot access it. The audit log records administrative actions — member invitations, role changes, policy updates, SSO configuration — not conversation content. See Audit & Telemetry.
Emergency lockdown
What is emergency lockdown and when should I use it?
Emergency lockdown is a break-glass tool (Team and Enterprise) that lets an admin immediately restrict a specific registered machine — a lost device, a compromised laptop, any situation where you need to act before you have time to remove a member or wait for a session to expire.
Use it when:
- A device is lost, stolen, or believed compromised.
- You want to act immediately while you investigate.
- You need a logged, auditable event tied to a specific time and stated reason.
It's not a substitute for removing a member — after a lockdown, review the member's access from the Members page. See Emergency Lockdown.
Still have a question?
Email support@kameas.ai or open an issue on the relevant Kameas open-source repository.