# Organisation set-up > The path from sign-up to a configured LightHouse tenant: sign-up or sales-led onboarding, then domains, single sign-on, provisioning, invitations, where agents run, the stack, Octy and the security review. This section sets out, in order, how an organisation obtains a LightHouse™ tenant and configures it under its own controls. ## Responsibilities | Party | Responsibility | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Client administrator** (`client_admin`) | Signs up or accepts Atlantic’s invitation, accepts the agreements, verifies domains, connects and tests single sign-on, issues the SCIM token, sends invitations, chooses where agents run and installs the stack. Each action requires a person’s own sign-in; a machine key cannot perform them | | **The organisation’s IT** | Publishes a DNS record, registers LightHouse in the identity provider, configures SCIM provisioning in the directory, and applies the stack | | **Atlantic** | Creates the tenant for sales-led onboarding and records a negotiated agreement by reference. Our certified forward-deployed engineers take part in any step on request | ## Sequence - **Client administrator**: signed in as a person - **Organisation's DNS, identity provider and directory** - **LightHouse**: the organisation's tenant Sign-up 1. Client administrator to LightHouse: **Sign up, or accept Atlantic's invitation**. self-service at /register, or sales-led from an order form 2. Client administrator to LightHouse: **Accept the MSA and DPA**. by click-through, or a negotiated agreement recorded by reference Identity 3. Client administrator to LightHouse: **Add a domain**. LightHouse returns the DNS record to publish 4. Organisation's DNS, identity provider and directory to LightHouse: **Publish the TXT record**. LightHouse finds it and marks the domain verified 5. Client administrator to LightHouse: **Connect the identity provider**. it admits only the administrator while in testing 6. Client administrator to Organisation's DNS, identity provider and directory: **Sign in through it**. the test is confirmed from that session 7. Client administrator to LightHouse: **Turn it on**. for verified domains, or for every user of the organisation's own provider 8. Organisation's DNS, identity provider and directory to LightHouse: **Provision users and groups**. SCIM 2.0, with a token issued in LightHouse 9. Client administrator to LightHouse: **Invite named people**. each with a role and an end date Deployment and review 10. Client administrator to LightHouse: **Choose where agents run**. a cloud, Atlantic-hosted, or the organisation's own servers, online or air-gapped 11. Organisation's DNS, identity provider and directory to LightHouse: **The stack reports in**. signed telemetry, live or imported by file 12. Client administrator to LightHouse: **Ask Octy a question**. the answer cites its sources 13. LightHouse to Client administrator: **Download the security review pack**. standard answers, each with its evidence Each step is taken by the client administrator in LightHouse, with the organisation's DNS, identity provider, directory and infrastructure performing their part. A new identity provider admits only the administrator until a sign-in through it has been confirmed. ## Steps | # | Step | In LightHouse | Prerequisite | Page | | -- | ---------------------------------------- | -------------------------------------------------------------------- | -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 1 | Sign up, or accept Atlantic’s invitation | `platform.atlanticagenticlabs.com/register`, or the invitation email | — | [Sign-up](/enterprise/sign-up/) | | 2 | Accept the agreements | During sign-up; new versions at **Billing → Terms** | — | [Agreements](/enterprise/agreements/) | | 3 | Verify domains | **Access → Domains** | Access to the organisation’s DNS | [Verified domains](/enterprise/domains/) | | 4 | Connect single sign-on | **Access → Single sign-on** | An application registered in the identity provider | [Single sign-on](/enterprise/single-sign-on/) | | 5 | Turn single sign-on on | **Access → Single sign-on** | A confirmed test sign-in; for a domain rule, a verified domain | [Single sign-on](/enterprise/single-sign-on/#turning-it-on) | | 6 | Provision from the directory | **Access → Provisioning** | Single sign-on, for provisioned people to sign in | [SCIM provisioning](/enterprise/provisioning/) | | 7 | Invite named people and assign roles | **Access → Invitations**; roles on **Access** | — | [Inviting people](/enterprise/invitations/), [Roles](/api/roles/) | | 8 | Choose where agents run | **Where agents run** | — | [Clouds](/clouds/); [Choosing air-gapped](/enterprise/air-gapped/) for a site with no network path | | 9 | Install the stack and see it report in | **Deployments** | Step 8 | [The set-up mission](/start/setup/) | | 10 | Ask Octy a question | **Home** | — | [Octy](/octy/) | | 11 | Review security | **Settings → Security review** | — | [The security review pack](/enterprise/security-review/) | LightHouse enforces three dependencies: a tenant exists only after both agreements are accepted; a provider is tested before it is turned on; a sign-in rule for a whole domain requires that domain to be verified. The other steps can be taken in any order. ## In the set-up mission The [set-up mission](/start/setup/) at **Setup and admin → Set-up mission** tracks steps 3 to 10 alongside branding, billing, models, the first data source and the first agent. Three of its steps correspond to this section: | Mission step | Done when | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | **Verify your domain** | At least one domain is verified | | **See your stack report in** | Own cloud or own servers: a deployment has delivered signed telemetry in the last eight days; the step names the deployment and the time. Air-gapped: a telemetry bundle has been imported. Atlantic-hosted: the hosted account is running | | **Meet Octy** | Octy™ has answered a question in the tenant | Each outcome is read from the tenant when the mission is opened and is not stored. Any step can be left for later. Atlantic’s onboarding team has read-only access to the tenant’s mission, and each read is recorded in the tenant’s audit log. ## Audit Each change in this section is recorded in the tenant’s audit log with the person who made it: tenant registration; agreements accepted or recorded; domains added, checked and removed; providers connected, tested, turned on and disconnected; SCIM tokens issued and revoked; invitations sent, accepted and revoked. See [Who can see what](/data-sovereignty/access/). Source: https://docs.atlanticagenticlabs.com/enterprise/