# Roll out Mindset > Sets up your org, signs people in, makes the day-one decisions and takes the first agent to production, then keeps the fleet in shape. Builders work from a coding agent and operators from an AI client, both through the MCP server, or in the Studio. In Mindset, an agent is a prompt and a model, held to an order by a script when needed. It uses connections to outside systems, operations on them, functions and widgets. Every change is a version, and every execution is a run. Every piece sits on one security and compliance layer: the org sets its posture once, and every agent works under it, with the audit trail and, once an admin turns it on, personal data redaction. The platform runs in your own cloud (AWS, GCP or Azure) or is hosted by Mindset. Your app reaches agents through the SDK, your server through the API, and people through the Hub and schedules. Highlighted: Builders, Operators. ## Choose what moves first Start with automations people already rely on: skill files, prompt documents, MCP servers, the spreadsheet someone updates every Friday. Ask six questions of each: 1. Does it change anything? 2. Can that change be undone? 3. Does anyone other than its builder rely on the output? 4. Does it run under a person's own credentials? 5. Does it run when nobody is watching? 6. Does it touch personal or regulated data? Any yes, and it belongs in Mindset. Six noes, and it's a personal tool: leave it alone. Then check it can move. Mindset reaches HTTP APIs, databases, Google Sheets, remote MCP servers and knowledge bases. It can't drive a web page or connect an MCP server that runs only on a laptop. Start with the biggest one that passes, because you already know how it should behave. ## Set up the org Your company is an **org**, and one org never sees into another. It starts with one [environment](https://docs.mindset.ai/docs/environments), Sandbox. Its **region** comes from the deployment you sign up on and can't change. ### 1. Accept your invite as the first admin ### 2. Settings → Model keys Add a key for your model provider. Your own agents can't run without one. Orca and the builders run meanwhile. See [Use your agents from AI clients](https://docs.mindset.ai/docs/use-your-agents-from-claude-and-other-ai-clients#model-keys). ### 3. Settings → Members **Invite member**, as **Admin** (the Studio and **Settings**) or **User** (the Hub, with the agents published to them). ### 4. Settings → Environments Usually add Test and Production. Connections belong to one environment, and API keys work in one only. ``` Invite priya@example.com as an admin and tom@example.com as a user, and list who in our org hasn't accepted their invite yet. ``` ## Sign-in and SSO People sign in with email and password, an emailed sign-in link (one use, one hour), or **Sign in with Google** when the deployment has it set up. A session lasts until it's idle for 7 days. > **Info:** There's no SAML or OIDC single sign-on, no Microsoft sign-in and no two-factor authentication inside Mindset. Google is the only federated option. **Auto-group new sign-ins**, on **Settings → Members** and off by default, adds anyone who signs in on the same email domain as one of your admins, as a user. Free and disposable domains never qualify. A person in several orgs signs in to each separately, and **Find my organization by email** on the front door finds them. ## Day-one decisions | Decision | Where | Default | | ------------------------------------------------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------- | | Whether new write operations turn on automatically | **Settings → Systems** | On. See [Approve what agents can do](https://docs.mindset.ai/docs/approve-what-an-agent-can-do) | | Personal data policy and audit retention | **Settings → Governance** | Off, and 6 months. See [Audit and personal data](https://docs.mindset.ai/docs/audit-and-personal-data) | | Whether the built-in agents run on your own key | **Settings → Governance** | Mindset's key | | Embedding key for knowledge search | **Settings → Embedding keys** | The deployment's key | | Reply language, and whether members may build personal agents | **Settings → Defaults** | Personal agents off | | Telemetry to your own tooling | **Settings → Governance** | Off. See [See what happened](https://docs.mindset.ai/docs/check-what-happened#alert-from-your-own-tooling) | | API keys for software that starts agents | **Settings → API keys** | None | | Inviting people to use agents from their AI client | **Settings → Systems → Connect an AI client** | None | Settings apply to everyone at once and aren't versioned. > **Info:** These settings are your org's [compliance posture](https://docs.mindset.ai/docs/compliance). Decide them before the first agent goes live, because they apply to every agent at once. ## Take the first one all the way | Stage | Who | | ------------------------------------------------------------------------------------------------ | ------------------------------------------ | | Set up the org, environments and members | Your Mindset owner, with us | | Connect the first system and enable the operations it needs | The system owner, with us | | Build in Test, run its test parameters and acceptance tests, find the cheapest model that passes | The person who built the original, with us | | Repeat in Production, run the test parameters there, make it available, read its runs daily | Mindset owner and system owner | Tested status is kept per environment, so a script won't go live in Production until the operations it calls have succeeded there, unless an admin chooses to go live untested. Don't start the second agent until you can say what a normal run of the first looks like. It costs a fraction of the first, because the connections already exist. ## Keep it in shape Mindset enforces named operations, credentials on the connection and a record of every run. Your team keeps three conventions it can't enforce: - **Every agent names an owner and a backup** in its description, in one format, such as `Owner: Priya Shah. Backup: Tom Ellis.` - **Personal tools stay personal.** Don't register or review them. - **Agents nobody uses get switched off.** Anything that hasn't run in thirty days is a question. | When | Who | What to look at | | ---------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | Daily, ten minutes | Mindset owner | Anything **Failing**, sessions that ended **Tool failed** or **Model error**, runs waiting on a person | | Weekly, thirty minutes | Owner and backup | The slowest tail, the top three agents by cost, acceptance test trends, **Used without grant**, new write operations | | Monthly, an hour | Add security and a system owner | Cost by model, idle and never-used agents, who holds which writes, governance changes in the audit trail | | Quarterly | Add leadership | Time saved against your baseline, owners reconfirmed | Capture the baseline (time spent the manual way) before the first agent goes live. Nobody can reconstruct it afterward. ## Done when - Everyone who needs Mindset can sign in, with the right role. - The day-one decisions are made on purpose and written down. - The first agent runs in Production, and your team could build the second without help. - One named person owns the daily check, and the monthly hour is in the diary.