Keld Atlas Administrator Guide

Administrators configure the workspace and have access to every surface in Keld Atlas. This guide covers administrator work. For what the two roles see, and for the dashboard views in general, see the Keld Atlas Overview.

The administrator pages are grouped together at the bottom of the sidebar, below Understand and Optimize, and only administrators see them: Integrations, Classifications, Teams, and Activity. Settings is not in that list: open it from the account menu at the very bottom of the sidebar.

Getting started (onboarding)

When you sign up for Keld Atlas, the new workspace wizard guides you through four steps:

1. Set up org: organization basics (required)
2. Create teams: optional; you can add teams later
3. Invite people: optional; supports CSV import of members
4. Connect providers: optional; paste an admin API key from Anthropic or OpenAI (more coming soon) to pull authoritative billed spend from your account

A finish-setup nudge on the Briefing tracks incomplete steps.

Integrations

To access this area, click Integrations in the sidebar. The page has two tabs: Deploy Signal, for rolling out Keld Signal and controlling what it collects, and Provider API Keys, for connecting provider accounts so Keld can pull billed spend.

Deploy Signal

This tab tracks your Keld Signal rollout and holds the installer. Download it for Windows, macOS, or Linux. On each user's computer, Keld Signal detects installed tools (Claude Code, Codex, or Gemini CLI; Cursor and Antigravity coming soon) and writes their telemetry configuration automatically, pointing them at your Keld instance's OTLP endpoint with that user's ingest token. No snippet editing or manual tool restarts are required. Tiles at the top of the tab show how many devices are installed and reporting.

Because the ingest token is issued per user, Keld resolves each event to a person at ingest. This is what makes per-person attribution authoritative rather than self-reported.

A Telemetry Only section further down the tab offers a lower-level alternative to Keld Signal: raw per-call usage, with no enrichment, job categories, or leak detection. Use it only where you cannot install Keld Signal.

Provider API Keys

This tab registers organization-level provider admin keys so Keld can pull billed usage and cost. These are read-only: Keld never writes to a provider or sends prompts through them.

Credentials are stored encrypted at rest. Replace or remove a connection at any time without losing history, and trigger a manual sync per connection. A warning appears on the Integrations navigation item if a pull hits an auth, error, or partial state.

Seat plans, which drive plan-aware cost for flat-rate seats such as Claude Team or Enterprise, are assigned on the Teams page rather than here.

Classifications

To access this area, click Classifications in the sidebar. Classifications define what Keld Signal labels on every prompt, on the user's own computer — this is the feature previously called Enrichment Signals, now split out of Integrations into its own page. The page has three sections: Your classifications (what your organization has added), a Gallery of ready-made templates, and a collapsed Built-in classifications list.

Built-in classifications — Task type, Sensitivity, Domain, Activity, Speech act, Job Category, and Job Subcategory — are fixed. Click one to view its definition and test it in the Lab, but there is no Edit action: you cannot rename a built-in, change its labels, or delete it.

Start from the Gallery

The Gallery holds ready-made classifications grouped into three tabs: Featured, a starter set that applies to most organizations; Financial, for named cost drivers such as customer accounts, paid vendors, and cloud services; and Technical, for engineering concerns such as task type, reliability signals, and errors mentioned. Picking one opens the create drawer pre-filled with its values, so you can review and adjust the wording before saving. Start here rather than from a blank form: the templates are already written to work well with the on-device model.

What a classification can see

Keld Signal classifies one prompt at a time, from that prompt's text alone, using a small model on the user's own computer. A classification only produces useful data if its answer is actually present in the prompt.

• Works well: what the person is asking for, the tone of the request, the engineering concern raised, and any names, tools, or identifiers written in the prompt.
• Works badly: facts a prompt never states, such as which client the work is billed to, which sprint it belongs to, or how large the change is. The model cannot see that context, so it guesses, and the guesses become noise in your reports.

If what you want to track is a fact about the work rather than something visible in the prompt, attribute it with a custom Dimension instead. Dimensions classify on telemetry metadata such as team, repository, and cost center, which Keld already knows for every event.

Creating your own

Click New classification and pick a type:

• Pick one label (single-label): exactly one label is applied.
• Pick every label that fits (multi-label): any labels that apply are attached.
• Find names in the prompts (entity): pulls spans of a given type out of the prompt. Those spans are masked on-device before anything is sent to Keld.
• Fill in a record (structure): pulls several related fields out of the prompt into one record.

Give it a name — this becomes its report column — and an optional description, then fill in the type-specific values or fields. A classification needs at least 2 label values (single-label or multi-label), at least 1 named entity type (entity), or at least 1 named field (structure) before you can create it; a custom classification also cannot reuse a built-in's key.

Write values and descriptions in plain language. The model matches on meaning rather than on codes, and it reads what you write. This is the single biggest factor in whether a custom classification produces useful data.

• For single-label and multi-label, each value is a short natural-language phrase, and that phrase itself is what the model matches against. "debugging an error" classifies well; "ERR_DBG" does not.
• For entity and structure, each type or field has a name plus a description of what to pull out. For example, the type vendor, described as "the name of a third-party vendor, SaaS product, or paid tool".
• The classification's own Description is read by the model as context every time it labels. One sentence naming a couple of real examples from your organization noticeably improves accuracy.

Threshold. For single-label, multi-label, and entity types, a segmented control sets how confident the model must be before it applies a label: Guess more (labels more prompts, tolerates a few wrong), Recommended (the default balance), or Guess less (fewer wrong labels, more sent to review). An Advanced toggle exposes the raw 0–1 threshold.

Pattern (entity only). Under Advanced, an entity type can carry a pattern that keeps only values matching a strict format. Anything the model finds that does not fit is dropped. Leave it empty unless the values really are formatted consistently.

Depends on. A single-label or multi-label classification can depend on another one, so its label set changes with the parent's result — Job Subcategory works this way, depending on Job Category. If the parent has a fixed value set, you can also define a different label set per parent value. A classification cannot depend on itself or form a loop with another, and Keld runs classifications in dependency order.

Test it in the Lab. The create/edit drawer, and the read-only built-in details view, both include a Lab panel: type a prompt and press Test (⌘/Ctrl+Enter) to preview how the current draft — including unsaved edits — would label it. This test runs in Atlas; day-to-day labeling happens on each person's device.

Click Create classifier to save. Closing the drawer with unsaved changes asks you to confirm before discarding them.

Examples

These three go beyond what the Gallery ships, and show one of each common type.

Regulatory framework records which compliance regimes a prompt refers to. It is distinct from the built-in Sensitivity pass, which detects whether sensitive data is present rather than which regime governs it.

Ticket IDs ties AI work to items in your issue tracker, and is a case where a pattern earns its place.

Deployment captures several related details from one prompt as a single record. Name it Deployment and describe it as "details of a software deployment mentioned in a prompt: which service, which environment, which version", then add three fields:

Changes reach every running Keld Signal installation within about 5 minutes, on the same schedule as the rest of your enrichment policy. Classifications control what gets labeled; the enrichment policy in Settings controls what leaves the machine.

Teams

To access this area, click Teams in the sidebar. The page has two tabs: People and Agents & Apps.

People

Manage teams, members, roles, and invitations. To change a user's team membership, drag their row into the new team section. Assign each member a per-provider seat plan so cost is attributed honestly per person, distinguishing flat-rate seats from usage-based consumption. Click a member to set their plans, or select several members and click Manage plans to set them in bulk.

• Invite members: enter an email address and pick a role; the person gets a join link by email. Pending invitations are visible and can be revoked. Bulk CSV import is available during onboarding.
• Remove: the member's historical usage stays attributed to them.
• Edit: rename a team, delete it, or set its budget from the Edit Team drawer.

Agents & Apps

Autonomous agents are tracked as their own class of user, separate from the people who run them. The Agents & Apps tab shows your agent roster with headline figures for agent types, agents currently live, month-to-date spend, and total runs.

Agents appear in one of two states:

• Claimed agents are registered with their own identity and API key. Their spend is attributed to the agent.
• Discovered agents have been seen in telemetry riding on a person's ingest token but are not yet registered. Their spend is attributed to that person.

Claiming an agent gives its spend a stable identity of its own. To claim one, open the Agent API Keys drawer and create a key, assigning the agent an owner, team, cost center, and seat tier. The key is displayed once at creation, so record it then; you can revoke it later but not view it again.

Selecting an agent type opens a detail view of its runs.

Any framework can report agent runs today by pointing its OpenTelemetry exporter at Keld with an agent key. First-class Keld Signal setup for LangChain and Vertex AI, where the installer configures the framework for you, is coming soon.

Activity

To access this area, click Activity in the sidebar. Activity is a live stream of your organization's AI tool telemetry, and it is visible to administrators only.

Events are grouped into turns: a prompt, the model's response, and any background calls the tool made on its own. Each turn is collapsible and carries a cost and token summary, with a raw-event inspector for the underlying data. All prompt and response content is redacted.

A configurable KPI strip sits above the feed. You can filter by tool, model, person, team, repository, and agent, and a work filter separates autonomous agent runs from human-initiated work.

Observability and Dimensions

To access this area, click Observability. It covers the last 24 hours, 7 days, 30 days, or 90 days, across four tabs: Financial (cost center and financial category), Technical (model, repository, and source), Team (team and person), and Your Reports (your own Dimensions).

Administrators create and edit Dimensions here. Viewers cannot.

Creating a custom dimension

To create a Dimension, click + Custom Report. A Dimension has a name, a set of values, an effective-from date, and ordered IF/THEN rules. New Dimensions appear on the Your Reports tab.

• Each rule reads: label as {value} when {attribute} {operator} {values}
• Rule attributes: Team, Cost center, Repo, Model, Source, Person, Environment
• Operators: is exactly, is any of, starts with, matches pattern
• Rules run top to bottom; the first match wins. Events matching no rule show as Unmapped.
• A live preview shows how the rules classify the last 30 days before you save.
• Rules are effective-dated, so historical spend keeps its prior labels.

For example, a "Cost ownership" Dimension with the values Product & Engineering, Revenue, and Shared:

1. Label as Product & Engineering when Team is any of Engineering, Platform
2. Label as Revenue when Team is any of Sales, Marketing
3. Label as Shared when Cost center starts with G&A

An event from the Platform team matches rule 1 and stops there. An event matching none of the rules shows as Unmapped.

Editing the CapEx / OpEx rules

CapEx / OpEx is a built-in Dimension with editable, priority-ordered rules. To edit them, open CapEx / OpEx from Observability. You can reorder, add, or remove rules with the same rule builder used for custom Dimensions, and reset to the defaults at any time; resets are effective-dated and non-destructive. The Dimension is built in, so you cannot delete it.

For the default rules and the reasoning behind them, see Capex / Opex rules in the Keld Atlas Viewer Guide.

Briefing and exports

The organization Briefing is the administrator landing page: an executive dashboard over a calendar quarter, the last 7 days, or the last 30 days, filterable by team and provider. Its heading reflects the selected timeframe (for example, "30 Day Brief" or "Q3 2026 Brief"). Viewers see a personal version of this page covering only their own usage.

To export, click the download button in the top right of the Briefing. The export is a ZIP of CSV files covering the summary, spend over time, breakdowns, people, and providers, matching the timeframe and filters currently applied. Exporting is administrator-only.

Enrichment policy

To access this area, open the account menu at the bottom of the sidebar and click Settings. This is organization-wide control of what Keld Signal sends to Keld Atlas.

• Include entity text: when off (the default), domain-entity surface text is stripped before anything is sent. Sensitive spans (PII, secrets, PHI, PCI) are always masked regardless of this setting.

Policy changes reach all running Keld Signal installations within about 5 minutes.

Coming soon

On the integrations side: AWS Bedrock provider connections, Keld Signal support for Cursor and Antigravity, and Keld Signal support for agent frameworks including LangChain and Vertex AI.

Budgets and Billing are not yet available. Until Budgets ships, the Spend vs. Budget figure on the Briefing measures against your prior period's spend as a baseline, so you get over/under and a forecast without configuring anything. User-defined budget ceilings and alerting are coming later in 2026.