> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Install products

> Step-by-step guide to initialize and configure the Prisme.ai platform products (Agent Creator, LLM Gateway, Storage, Governe, Insights, Builder, Helper Agents) on a self-hosted environment.

This guide walks you through installing and configuring the **platform products** on a self-hosted Prisme.ai deployment — **Agent Creator**, **LLM Gateway**, **Storage** (vector store), **Governe**, **Insights**, **Builder**, **Helper Agents** — once the platform itself is up and running.

If you are upgrading an existing instance from legacy products, follow [Migration v27](/self-hosting/operations/migration-v27) instead.

The installation is split into five phases:

<Steps>
  <Step title="First connection">
    Log in as super admin and create your organization.
  </Step>

  <Step title="Products initialization">
    Import the new platform workspaces in the correct order.
  </Step>

  <Step title="Post-install configuration">
    Declare LLM providers, models, vector store and organization settings.
  </Step>

  <Step title="Organization configuration">
    Allowed models, join rules, appearance, menu.
  </Step>

  <Step title="SecureChat setup">
    Initialize the Secure Chat agent.
  </Step>
</Steps>

<Info>
  This page assumes the platform is **already deployed and configured** — Helm release rolled out, image tags pinned, `WORKSPACE_SECRET_*` credentials exposed, readiness check passing. If you are not at that point yet, follow [Install with Helm](/self-hosting/kubernetes/helm) then [Configuration](/self-hosting/kubernetes/configuration).
</Info>

## Prerequisites

Before starting product installation, make sure:

* You can sign in as a **super admin** (configured under `config.admins` in your Helm values).
* The **Platform** workspace is visible in Builder.
* LLM provider credentials are available as platform secrets or environment variables.

***

## 1. First connection

<Steps>
  <Step title="Log in as super admin">
    Once all services are deployed, sign in to the platform with a super admin account — the accounts listed under `config.admins` in your Helm values.
  </Step>

  <Step title="Create your organization">
    From the onboarding screen, create your organization:

    * **Name** — the display name shown across the UI.
    * **Technical name** — the unique identifier used throughout the platform. It **cannot be changed** after creation.
  </Step>

  <Step title="Verify platform readiness">
    Open the native **Govern** app from the left menu and open the **Infrastructure** page.
    Verify the platform is healthy by testing native **Services** connectivity with the Test buttons at the bottom of the page.

    You can also manually call the [Readiness API](/self-hosting/operations/testing#platform-readiness-api) with shell commands.

    <Note>
      The **Vector store** block requires the **Storage** workspace to be imported first — it is configured and tested in [3.4 Vector store](#34-vector-store) below.
    </Note>
  </Step>

  <Step title="Open Builder">
    After creation, you should be redirected to a near-empty platform with two links in the left menu: **Builder** and **Govern**. Open **Builder**.
  </Step>
</Steps>

***

## 2. Products initialization

The platform products are imported in **four sequential groups** via the **Platform** workspace bulk import:

<CardGroup cols={2}>
  <Card title="base1" icon="cube">
    Foundation apps (Custom Code, Prisme.ai API, …).
  </Card>

  <Card title="base2" icon="cubes">
    Extended base (Crawler, RedisSearch, …).
  </Card>

  <Card title="extended" icon="boxes-stacked">
    Legacy AI products (Knowledges, AI Store, …) — still required as a dependency for the platform products. They will disappear in a future release.
  </Card>

  <Card title="one-product" icon="box-archive">
    Main platform products (LLM Gateway, Storage, Governe, Agent Creator, …).
  </Card>
</CardGroup>

<Warning>
  Always wait for `workspaces.bulkImport.completed` (with no errors) before importing the next group — each group depends on the previous one.
</Warning>

### Import from the UI

<Steps>
  <Step title="Open the Platform workspace">
    The **Platform** workspace is only visible to super admins.
  </Step>

  <Step title="Trigger the bulk import">
    Navigate to **Settings** → **Versions** → **Platform Pull**, then select the **Release vXXX** platform repository.
  </Step>

  <Step title="Select the group and start the import">
    Pick the group, start the import, and close the modal.
  </Step>

  <Step title="Monitor progress">
    From the **Activity** feed of the Platform workspace, wait for the `workspaces.bulkImport.completed` event before moving on.
  </Step>

  <Step title="Repeat for the next group">
    Import the groups in order: `base1` → `base2` → `extended` → `one-product`.
  </Step>
</Steps>

### Import from the API

You can trigger the same import through the API instead of the UI:

```bash theme={null}
curl -X POST "${API_URL}/v2/workspaces/platform/versions/latest/pull" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"repository": {"id": "release"}, "groups": ["base1"]}'
```

Repeat with `base2`, `extended`, then `one-product`.

<Warning>
  Re-importing a group can overwrite workspace changes made in Builder since the previous import. Use it intentionally.
</Warning>

***

## 3. Post-install configuration

Once all groups are imported, configure each new workspace in the order below.

### 3.1 AI Governance — set the admin token

The **AI Governance** workspace needs an `adminAccessToken` to call platform APIs on behalf of administrators.

<Steps>
  <Step title="Generate a long-term token">
    From your super admin account, generate a long-term API token (Settings → Account → API tokens).
  </Step>

  <Step title="Paste it into the workspace">
    In **Builder**, open the **AI Governance** workspace → **Settings** → **Secrets**, paste the value into `adminAccessToken`, then **Save**.
  </Step>
</Steps>

### 3.2 LLM providers

<Steps>
  <Step title="Open the Govern app">
    From the left menu, open **Govern** → **Models** → **Providers** tab.
  </Step>

  <Step title="Declare each provider">
    Click **Add provider** and pick the provider type (OpenAI, Azure OpenAI, AWS Bedrock, …). For each provider:

    * Set the **secret names** to match the secrets you exposed via `WORKSPACE_SECRET_llm-gateway_*` environment variables (or stored in the **LLM Gateway** workspace Secrets).
    * Configure provider-specific options (region, endpoint, deployment name, …).

    <Tip>
      Hover the **(i)** icon next to a secret input to see the matching environment variable name.
    </Tip>
  </Step>

  <Step title="(Optional) Configure secrets from the UI">
    If you'd rather store the secrets on the platform itself instead of through env vars:

    1. Open **Builder** in a new tab.
    2. Open the **LLM Gateway** workspace → **Settings** → **Secrets**.
    3. Add the secrets, using the **same names** as referenced by your providers.
  </Step>

  <Step title="Save">
    Save the providers configuration.
  </Step>
</Steps>

<Info>
  All LLM providers can be **exported and re-imported** from the three-dot menu — useful for replicating configuration across environments.
</Info>

### 3.3 LLM models

<Steps>
  <Step title="Open the Models tab">
    Still in **Govern** → **Models**, switch to the **Models** tab.
  </Step>

  <Step title="Declare each model">
    Click **Add model** and select the provider, model identifier, capabilities (completion / embedding / vision), and any default parameters.
  </Step>

  <Step title="Verify with the Test button">
    For every model:

    * Open it and click **Test** — the model response is shown below the button.
    * For **embedding** models, the **dimensions** option must be set explicitly.
  </Step>
</Steps>

<Info>
  Models can also be exported / imported in bulk from the three-dot menu.
</Info>

### 3.4 Vector store

<Steps>
  <Step title="Open the Infrastructure page">
    From the **Govern** menu, open **Infrastructure**.
  </Step>

  <Step title="Pick a driver">
    Select your vector store driver: **Elasticsearch** or **OpenSearch**.
  </Step>

  <Step title="Set credential secret names">
    Make sure the credential secret names match the values you exposed via `WORKSPACE_SECRET_storage_*` environment variables.

    <Tip>
      Hover the **(i)** icon next to a secret input to see the matching environment variable name.
    </Tip>

    To configure secrets directly from the UI instead:

    1. Open **Builder** in a new tab.
    2. Open the **Storage** workspace → **Settings** → **Secrets**.
    3. Add the secrets.
  </Step>

  <Step title="Set the index prefix">
    Set `vector_store_index_prefix` to the prefix you want for your RAG indexes (e.g. `prod_rag`).
  </Step>

  <Step title="Save and Test">
    **Save** the configuration, then click **Test**. If the test fails, review your environment variables, secrets, or database connectivity and try again.
  </Step>
</Steps>

<Info>
  The raw vector store configuration lives in **Storage** workspace settings — accessible via the **Edit** button at the top right of the Storage workspace.
</Info>

### 3.5 Infrastructure checkup

While on the **Infrastructure** page, use the **Test** button at the bottom of the **Services** block to verify connectivity to all platform databases.

### 3.6 Helper agents (optional)

Helper agents assist users while they fill forms in Prisme.ai products.

<Steps>
  <Step title="Configure HELPER_AGENT_ENDPOINT">
    Set `HELPER_AGENT_ENDPOINT` on the relevant services.
  </Step>

  <Step title="Initialize">
    Open the **Helper Agents** workspace and run the initialization automations.
  </Step>

  <Step title="Wire credentials in Governe">
    Configure the generated helper credentials in Governe.
  </Step>

  <Step title="Test">
    Open a product form and confirm helpers are available.
  </Step>
</Steps>

***

## 4. Organization configuration

### 4.1 Allowed models

<Steps>
  <Step title="Open your organization">
    Open **Organizations** and select the organization you created in step 2.
  </Step>

  <Step title="Open Agent controls">
    Navigate to **Agent controls**.
  </Step>

  <Step title="Pick allowed models">
    Select all models you want to make available (you can use **Select all**). Models can be reordered by drag-and-drop.
  </Step>

  <Step title="Set defaults">
    Choose the default **Completions** and **Embeddings** models for the organization.
  </Step>

  <Step title="Save">
    Scroll to the bottom of the page and click **Save**.
  </Step>
</Steps>

### 4.2 Join rules

Join rules control which users automatically become members of your organization.

<Steps>
  <Step title="Open Join Rules">
    Navigate to the **Join Rules** page.
  </Step>

  <Step title="Add a rule">
    Add a rule with:

    * **Field**: `Email`
    * **Operator**: `matches (wildcard)`
    * **Value**: `*` to match all authenticated users

    Or configure a more specific filter if you only want a subset of users to join automatically. Other users can still join with an **invite code** or be invited manually by an org admin.
  </Step>

  <Step title="Pick the assigned role">
    On a fresh install there is no legacy role mapping to fall back on, so set **Assign role** explicitly — typically `org:member` for the default rule, and add stricter rules above it for admins / builders.
  </Step>
</Steps>

<Tip>
  For more advanced rules — assigning different roles or groups based on email or SSO metadata — see the [Join Rules documentation](/products/ai-governance/identity-access#join-rules).
</Tip>

### 4.3 Appearance

Configure your platform branding: name, favicon, colors, terms of use, …

<Info>
  All appearance settings can be exported / imported via the three-dot menu in the top-right corner.
</Info>

### 4.4 Menu editor

A default menu template is [available here](https://cdn.prisme.ai/templates/menu-builder-template.json).

<Steps>
  <Step title="Download the template">
    Download the JSON file from the URL above.
  </Step>

  <Step title="Import it">
    Open the **Menu Editor**, click the three-dot menu in the top-right corner, and import the JSON file.
  </Step>

  <Step title="Save and refresh">
    Save your changes and refresh the page — the left menu should now be populated.
  </Step>
</Steps>

***

## 5. SecureChat setup

<Steps>
  <Step title="Open the builder">
    Sign in and open **Builder**.
  </Step>

  <Step title="Open the Secure-chat Agent workspace">
    Open the **Secure-chat Agent** workspace, automatically imported with the `one-product` workspaces group.
  </Step>

  <Step title="Open the update-agent automation">
    Open the **Automations** menu on the left and open the `update-agent` automation.
  </Step>

  <Step title="Execute">
    Click the green **Execute** button at the top right corner of the page, then run it.
  </Step>

  <Step title="Confirm everything went well">
    The automation should output something like:

    ```json theme={null}
    {
      "agentId": "agent_be13a30ea3f24b14abfdf6cb6181d933",
      "name": "Secure Chat",
      "model": "gpt-5.1-chat",
      "created": true,
      "updated": false
    }
    ```
  </Step>

  <Step title="Verify the agent">
    Open the **Agent creator** product from the left menu — your should see your Secure Chat agent ready to use and test.
  </Step>
</Steps>

***

## Validation checklist

Before handing the platform to users, verify:

* Readiness API returns `ready` for required services.
* All product import groups completed without errors.
* Governe has a valid `adminAccessToken`.
* Organization join rules assign the expected roles and groups.
* Menu entries point to the enabled products.
* At least one completion model and one embedding model are tested and allowed.
* Storage infrastructure test passes.
* Agent Creator can create and run a test agent.
* Documents upload work well directly inside the agent chat
* Insights access is restricted and dashboards load.

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="A product is missing from the menu">
    Check the Governe menu editor and organization access rules. Also confirm the product workspace was imported by the `one-product` group.
  </Accordion>

  <Accordion title="Models do not appear in Agent Creator">
    Confirm that the model exists in **Govern > Models**, the provider is saved, the model test succeeds, and the model is allowed for the user's organization.
  </Accordion>

  <Accordion title="Model tests fail">
    Check provider secret names, network egress to the model provider, provider API versions, deployment names, and rate limits.
  </Accordion>

  <Accordion title="Storage test fails">
    Check `WORKSPACE_SECRET_storage_*` secret names, vector store host reachability, credentials, TLS settings, and index permissions.
  </Accordion>

  <Accordion title="Bulk import reports errors">
    Open the `workspaces.bulkImport.completed` event in the Platform workspace Activity feed. Check the `errors` payload, resolve missing dependencies or slug conflicts, then re-import the failed group.
  </Accordion>

  <Accordion title="Custom Code apps fail after import">
    Check `prismeai-functions` logs for dependency installation errors. If dependencies are still installing or missing, re-save the affected Custom Code app to restart installation.
  </Accordion>
</AccordionGroup>

***

## Next steps

<CardGroup cols={2}>
  <Card title="Migration v27" icon="arrow-right-arrow-left" href="/self-hosting/operations/migration-v27">
    Already running an older version? Use the migration guide instead.
  </Card>

  <Card title="Model governance" icon="robot" href="/products/ai-governance/model-governance">
    Manage providers, models, defaults, and routing behavior.
  </Card>

  <Card title="Agent Creator" icon="wand-magic-sparkles" href="/products/agent-factory/overview">
    Create and test agents once models and storage are configured.
  </Card>

  <Card title="Operate" icon="tools" href="/self-hosting/operations/updates">
    Updates, backups and scaling.
  </Card>
</CardGroup>