Access and troubleshooting

Common Company Brain problems and how to resolve them. If your symptom is not here, check How it works for the expected behavior of each flow.

Provisioning can take several minutes; the page polls the runtime until it is serving. Wait for the timeout before retrying.
A failed deployment keeps the identifier and its reserved plan slot; use the retry action. Retry reuses the stored provider and credential mode unless you explicitly change them.
If a subscription provider needs a re-authorization step, the retry card shows the provider's credential prompt (or no input for device-code providers).

The chat surface only mounts once the runtime answers its health check. Recent key changes, restarts, or pod recreation keep the overlay up briefly by design.
If it never mounts, retry provisioning from the assistant page, then re-open the assistant.

Device-code providers (ChatGPT, GitHub Copilot, MiniMax) open a provider page with a one-time code; codes expire, so restart the flow if it stalls.
Claude subscriptions need a setup-token generated by Claude Code on your own computer — an API key will not work.
Plan-key providers (Qwen, Z.AI) need the key issued for the global Coding Plan, not the standard pay-as-you-go API key.
Applying a connection that times out or returns a service error may still be in progress; re-open the connection dialog to check the current state instead of re-submitting immediately.

OpenClaw and Hermes share one assistant entitlement. Business School 3, 10, and 25 People plans grant 3, 10, and 25 total slots across both kinds.
Delete an identifier you no longer need to free its slot; identifiers created before a failed deployment still occupy a slot until deleted.
Over-plan assistants use the billing selector; enterprise installations are unlimited.

Only owners see all identifiers; members must be invited to the specific identifier.
View-only members can open the runtime and see health, but manage actions (edit, members, deploy, destroy, transfer) stay with the owner or creator.
After access changes, the member's open pages pick it up on the next check; a reload forces it.

Confirm the channel binding exists for this assistant — bindings are assistant- and runtime-scoped, so connecting a channel to one assistant does not serve another.
Confirm the runtime is healthy; the Discord path needs a serving runtime.
Response controls on the Discord sheet decide which messages get answers; check the configured response mode.

On erxes SaaS, an organization must be approved by a platform administrator before owners can set up Postiz. Ask your platform contact.
Uninvited users see guidance only — the workspace URL is never exposed.
Access is rechecked periodically and on tab focus; removed access unmounts the embedded workspace on the next check, not instantly.

Only the active organization owner can create the tenant workspace; the login email is derived server-side and the Postiz password is separate from any erxes password.
The password field clears after submission and is never stored by erxes; use Postiz's own recovery if the password is lost.
The initial Postiz Admin choice is one-time and immutable; if the initial admin was deactivated, recovery requires a separately authorized operator procedure — there is no automatic owner takeover.

Admins invite active erxes users as Admin or Member from the header's Invite team member sheet; owners have no bypass after initialization.
The initial admin cannot be removed or demoted, and admins cannot change their own role.
erxes access does not sign anyone into Postiz — normal Postiz login and membership still apply, and provider connections are configured in Postiz itself.

Sharing is disabled by default; a current Postiz Admin must enable it before members can share.
content_api permissions (assignment, publishing, sharing, author scope, language) apply independently — the bridge never bypasses them.
The bridge verifies matching JWT-derived signing keys on both APIs; if content_api and agent_api were upgraded at different times, envelopes fail until both are current.

Enrollment codes are single-use and expire in 15 minutes; request a new one after expiry.
Retries keep the installation identity — a lost response does not create a duplicate installation.
Enrollment is initial-only: once team access is initialized there is no self-service re-enrollment or rotation; credential changes need the operator recovery procedure.

Expired or revoked access removes only the erxes-side link. Direct Postiz sessions, schedules, and workspace data are untouched, and renewal restores the same workspace.

Operate on one system.