Roles and Limits

The platform enforces these limits; exceeding one produces a refusal with a stated reason rather than a queue.

Item	Limit	Notes
Total accounts	50	Includes the bootstrap admin.
Additional Administrators	10	The bootstrap admin is not counted.
Concurrent signed-in accounts	3	The bootstrap admin can always sign in and does not consume a slot.
Session lifetime	24 hours	The session ends and requires a new sign-in.
Idle sign-out	30 minutes	A screen nobody touches signs itself out. The timer runs from the last pointer, key, wheel, or touch event, not from the last network request.
Sub-Agents per device	10	The Main Agent is not counted. Updating an existing Agent is not affected by this limit.
Agents running Tasks at once	5	A Task for a sixth Agent is rejected, not queued.
Concurrent Tasks per Agent	1	A busy Agent does not accept another Task.
Task Markdown size	64 KB	Per Task definition.
Material ZIP size	1 GB	Extracted into the Agent's materials/ directory.
Agent package size	20 MB	Per Agent ZIP.

Two roles exist, and a role cannot be changed after the account is created:

Operation	Administrator	User with assigned Agent	User without assigned Agent
View Agents	All	Main Agent and assigned Agents	Main Agent only
Create, update, or delete an Agent	Yes	No	No
Create or delete a Task definition	Yes	No	No
Start or stop a Task	All Tasks	Tasks for assigned Agents	No
View Task Runs	All	Runs within the permitted scope	No
View Logs and Sessions	All	Tasks that User started	No
Create accounts, assign Agents	Yes	No	No
View Audit	Yes	No	No
Use Main Agent Chat	Yes, sessions isolated per account	No	No
Change retention or OverlayFS	Yes	No	No

Only the bootstrap admin—the account the device ships with—can delete another account or force another account to sign out. It cannot itself be deleted, disabled, or changed to another role.

Related documentation

• Accounts and Roles for creating accounts and assigning Agents.
• System Requirements for what a device needs before installation.