What your users see in the portal

The portal and the admin console are one application, not two. When someone signs in, the gateway looks at their permissions and picks a navigation to match: an admin gets Agent Security and Agent Observability, and everyone else gets a single AI Gateway group — the self-service portal. Same URL, different sidebar. That's worth knowing before you follow a click-path from these docs and can't find the page: Quickstart exists only in the portal, so an admin reading a user's instructions will look for it in vain.

Users are never asked to do anything but connect their own agents and see what those agents did. Everything governing them — policies, data protection, the org-wide Agent Trail — stays on the admin side.

The five portal pages

Dashboard — "Your AI gateway activity at a glance": the stat cards (Active Agent Instances, Unique Tools Used, Blocked Tool Calls), the execution and hourly charts, and the top-tools and top-agent tables are all pinned to the signed-in user: the gateway scopes the same analytics queries to the caller rather than the organization. It's the admin Analytics view narrowed to one person, and it's the reason a user can see their own blocked calls without seeing anyone else's.

Quickstart — the onboarding page, and the one place a user connects an agent. It shows a grid of supported agents; picking one opens the setup instructions for that agent. Admins have no Quickstart item — they connect from Agent Registry instead, which opens the same dialog. Share the portal URL with your users so they can self-onboard. See Connect an agent for the click-path.

Agents — the user's own agent instances. It's the same table as the admin Agent Instances page, scoped by the gateway to the instances they own, so people can see their own clients without seeing the fleet. Per-instance actions such as disconnecting appear only with the manage_agent_instances permission, and only on instances they own.

Connections — link personal accounts to third-party services. Connect and Disconnect both need the manage_connections permission; without it the nav item never appears. See Connections for how the OAuth flow works and why each user authenticates separately.

Activity — "Review your own agent and connection activity": covered in detail below.

The Activity feed is a restricted view of the audit log

It's the same audit log, run through two restrictions before anything reaches the page:

• Pinned to the caller. The feed only ever returns that user's own events. The admin Agent Trail filter bar isn't rendered in this mode: with nothing left to narrow by, the feed shows no filter chips.
• Clamped to an allowlist. A user sees only the actions that carry their own user ID: tool executions and tool errors, agent created / updated / deleted / revoked / connected, and connection created / removed / revoked. Admin-only actions — policy edits, resource installs, data-protection changes — never appear, even though they're in the same log.

Payloads are stripped the same way. Fields the spec doesn't mark as own-scope are removed before the event is serialized, so where an admin sees which redaction rules fired and how many matches each made, a user sees a single generic Content redacted pill. They learn that something in the response was redacted; they don't learn what your rules look for.

An empty feed offers a Connect an agent button pointing at Quickstart.

Why a user might see less than you expect

The portal is permission-driven throughout, so a user's nav is a function of what your identity provider grants them. If Connections is missing, they lack manage_connections. If Activity is missing, they lack view_audit. If the Dashboard reports "You do not have permission to view this dashboard." then they lack the analytics permissions behind it. Check the grants coming from identity before assuming the page is broken.

Next steps

• Connect an agent — the Quickstart flow your users will follow.
• Connections — the per-user OAuth model behind the Connections page.
• Users — the admin view of the same person, with their agents, resources, and spend.
• Agent Trail — the unrestricted log the Activity feed is carved out of.