What your users see in the portal

The user portal and the admin console are one application, not two. When someone signs in, the gateway looks at their permissions and picks a navigation to match: an admin gets Agent Security and Agent Observability, and everyone else gets a single AI Gateway group, the user portal. Same URL, different sidebar. That matters when you follow the steps in these docs and can't find a page: Quickstart exists only in the portal, so an admin reading a user's instructions won't find it.

Users are never asked to do anything but connect their own agents and see what those agents did. Everything governing them stays on the admin side: policies, data protection, and the org-wide Agent Trail.

Share the portal link

Open Agent Instances and click Copy portal link in the header, then send that link to your users.

The link opens the portal's Quickstart page, where each person picks the agent they use and follows the setup steps for it. For a walkthrough written for the people receiving that link, point them at Using SecureAuth Agent Authority.

The five portal pages

Dashboard. The user's own activity at a glance. Every element is limited to the signed-in user: the stat cards (Active Agent Instances, Unique Tools Used, Blocked Tool Calls), the execution and hourly charts, and the top-tools and top-agent tables. The gateway runs the same queries as the admin Analytics view but limits them to one person, which is why a user can see their own blocked calls without seeing anyone else's.

Quickstart. The onboarding page, and the one place a user connects an agent. It shows a grid of supported agents, and picking one opens the setup instructions for that agent. Admins have no Quickstart item; they connect from Agent Registry instead, which opens the same dialog. See Connect an agent for the steps, and Share the portal link for how to get the portal address to your users.

Agents. The user's own agent instances. It's the same table as the admin Agent Instances page, limited by the gateway to the instances they own, so people can see their own clients without seeing everyone else's. Per-instance actions such as disconnecting appear only with the manage_agent_instances permission, and only on instances they own.

Connections. Link personal accounts to third-party services. Connect and Disconnect both need the manage_connections permission; without it the nav item never appears. See Connections for how the OAuth flow works and why each user authenticates separately.

Activity. A record of the user's own agent and connection activity, covered in detail below.

The Activity feed is a restricted view of the audit log

It's the same audit log, run through two restrictions before anything reaches the page:

• Limited to the signed-in user. The feed only ever returns that user's own events. The admin Agent Trail filter bar isn't shown here: with nothing left to narrow by, the feed has no filter chips.
• Limited to a fixed list of actions. A user sees only the actions that carry their own user ID: tool executions and tool errors, agent created / updated / deleted / revoked / connected, and connection created / removed / revoked. Admin-only actions never appear, even though they're in the same log: policy edits, resource installs, and data-protection changes.

Payloads are stripped the same way. Any field not marked as the user's own is removed before the event is sent. Where an admin sees which redaction rules fired and how many matches each made, a user sees a single generic Content redacted pill. They learn that something in the response was redacted; they don't learn what your rules look for.

An empty feed offers a Connect an agent button pointing at Quickstart.

Why a user might see less than you expect

The portal is permission-driven throughout, so what a user sees depends on what your identity provider grants them. If Connections is missing, they lack manage_connections. If Activity is missing, they lack view_audit. If the Dashboard reports "You do not have permission to view this dashboard." then they lack the analytics permissions behind it. Check the grants coming from identity before assuming the page is broken.

Next steps

• Using SecureAuth Agent Authority. The guide written for the people you send the portal link to.
• Connect an agent. The Quickstart flow your users will follow.
• Connections. The per-user OAuth model behind the Connections page.
• Users. The admin view of the same person, with their agents, resources, and spend.
• Agent Trail. The full log the Activity feed draws from.