> ## Documentation Index
> Fetch the complete documentation index at: https://platform.atlan.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on Atlan objects, use the Atlan MCP server at https://api.atlan.com/mcp or the SDK. To install or publish skills from a terminal, use the `aireg` CLI; `aireg --map json` prints its command map. The `atlanai` CLI is deprecated. Run a read-only identity check before any write.
> The docs MCP server at /mcp searches these docs only. It cannot read or change Atlan objects.
> SDK packages: Python `atlanai` (PyPI) and TypeScript `@atlanai/sdk` (npm). Show Python first, then TypeScript.
> These docs cover Atlan AI Registry, Atlan's hosted product. The AI registry specification and aireg CLI are maintained separately. /open-source lists publicly reachable signed installers and explains that the source repository and hosted CLI reference currently require GitHub access. Do not claim the repository or its reference docs are publicly accessible. Use these docs for Atlan-specific setup such as the adapter, sign-in and workspaces.

# Security

> Choose the identity, access, credential, and trace privacy controls for your organization.

Atlan checks the signed-in identity and workspace access when people, API keys,
and agents read or change Registry content. Organization roles govern settings;
workspace roles govern the content in each workspace.

Start with the control that matches the job:

| Job | Control |
| - | - |
| Connect your identity provider and choose company sign-in policy | [Authentication](/admin/security/how-tos/configure-sso) |
| Verify company domains and decide who may join | [Domains](/admin/security/how-tos/manage-domains) |
| Give scripts and services their own identity | [API keys](/admin/security/how-tos/manage-api-keys) |
| Give a team access to shared workspaces | [Groups](/administer/users/how-tos/manage-groups) and [workspace roles](/administer/workspaces/references/roles-and-access) |
| Review account changes and sign-in events | [Audit log](/admin/security/how-tos/review-audit-log) |
| Decide whether session content is stored | [Trace privacy](/admin/security/how-tos/manage-trace-privacy) |
| End a device session or withdraw an agent's consent | [Sessions and agent access](/admin/security/how-tos/review-personal-access) |

## Organization and workspace access

Use **Member** for day-to-day work and **Admin** for people who manage organization
settings. A workspace has its own **Admin**, **Builder**, and **Viewer**
roles. Check both scopes when someone cannot reach a resource.

API keys and agents also need workspace access. Knowing a workspace ID or holding
a valid credential does not grant access to its content. See [Roles and
access](/administer/workspaces/references/roles-and-access).

## Review before sharing data

Skill packages may contain instructions, scripts, and references. Review a skill's
[source](/registry/skills/concepts/source), [security
results](/registry/skills/concepts/security), and release before using it with a
client that can run code or call external tools.

Session content can contain prompts, responses, and files used by an agent.
Configure [trace privacy](/admin/security/how-tos/manage-trace-privacy) before
collecting sensitive work. Turning content storage off does not turn usage
analytics off.

For architecture and data boundaries, see [Platform
architecture](/platform/references/architecture). Atlan's privacy policy and data
processing agreement are linked in this site's footer.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.