Organisation set-up

This section sets out, in order, how an organisation obtains a LightHouse™ tenant and configures it under its own controls.

Responsibilities

Party	Responsibility
Client administrator (client_admin)	Signs up or accepts Atlantic’s invitation, accepts the agreements, verifies domains, connects and tests single sign-on, issues the SCIM token, sends invitations, chooses where agents run and installs the stack. Each action requires a person’s own sign-in; a machine key cannot perform them
The organisation’s IT	Publishes a DNS record, registers LightHouse in the identity provider, configures SCIM provisioning in the directory, and applies the stack
Atlantic	Creates the tenant for sales-led onboarding and records a negotiated agreement by reference. Our certified forward-deployed engineers take part in any step on request

Sequence

• Client administrator: signed in as a person
• Organisation's DNS, identity provider and directory
• LightHouse: the organisation's tenant

Sign-up

1. Client administrator to LightHouse: Sign up, or accept Atlantic's invitation. self-service at /register, or sales-led from an order form
2. Client administrator to LightHouse: Accept the MSA and DPA. by click-through, or a negotiated agreement recorded by reference

Identity

3. Client administrator to LightHouse: Add a domain. LightHouse returns the DNS record to publish
4. Organisation's DNS, identity provider and directory to LightHouse: Publish the TXT record. LightHouse finds it and marks the domain verified
5. Client administrator to LightHouse: Connect the identity provider. it admits only the administrator while in testing
6. Client administrator to Organisation's DNS, identity provider and directory: Sign in through it. the test is confirmed from that session
7. Client administrator to LightHouse: Turn it on. for verified domains, or for every user of the organisation's own provider
8. Organisation's DNS, identity provider and directory to LightHouse: Provision users and groups. SCIM 2.0, with a token issued in LightHouse
9. Client administrator to LightHouse: Invite named people. each with a role and an end date

Deployment and review

10. Client administrator to LightHouse: Choose where agents run. a cloud, Atlantic-hosted, or the organisation's own servers, online or air-gapped
11. Organisation's DNS, identity provider and directory to LightHouse: The stack reports in. signed telemetry, live or imported by file
12. Client administrator to LightHouse: Ask Octy a question. the answer cites its sources
13. LightHouse to Client administrator: Download the security review pack. standard answers, each with its evidence

Each step is taken by the client administrator in LightHouse, with the organisation's DNS, identity provider, directory and infrastructure performing their part. A new identity provider admits only the administrator until a sign-in through it has been confirmed.

Steps

#	Step	In LightHouse	Prerequisite	Page
1	Sign up, or accept Atlantic’s invitation	platform.atlanticagenticlabs.com/register, or the invitation email	—	Sign-up
2	Accept the agreements	During sign-up; new versions at Billing → Terms	—	Agreements
3	Verify domains	Access → Domains	Access to the organisation’s DNS	Verified domains
4	Connect single sign-on	Access → Single sign-on	An application registered in the identity provider	Single sign-on
5	Turn single sign-on on	Access → Single sign-on	A confirmed test sign-in; for a domain rule, a verified domain	Single sign-on
6	Provision from the directory	Access → Provisioning	Single sign-on, for provisioned people to sign in	SCIM provisioning
7	Invite named people and assign roles	Access → Invitations; roles on Access	—	Inviting people, Roles
8	Choose where agents run	Where agents run	—	Clouds; Choosing air-gapped for a site with no network path
9	Install the stack and see it report in	Deployments	Step 8	The set-up mission
10	Ask Octy a question	Home	—	Octy
11	Review security	Settings → Security review	—	The security review pack

LightHouse enforces three dependencies: a tenant exists only after both agreements are accepted; a provider is tested before it is turned on; a sign-in rule for a whole domain requires that domain to be verified. The other steps can be taken in any order.

In the set-up mission

The set-up mission at Setup and admin → Set-up mission tracks steps 3 to 10 alongside branding, billing, models, the first data source and the first agent. Three of its steps correspond to this section:

Mission step	Done when
Verify your domain	At least one domain is verified
See your stack report in	Own cloud or own servers: a deployment has delivered signed telemetry in the last eight days; the step names the deployment and the time. Air-gapped: a telemetry bundle has been imported. Atlantic-hosted: the hosted account is running
Meet Octy	Octy™ has answered a question in the tenant

Each outcome is read from the tenant when the mission is opened and is not stored. Any step can be left for later. Atlantic’s onboarding team has read-only access to the tenant’s mission, and each read is recorded in the tenant’s audit log.

Audit

Each change in this section is recorded in the tenant’s audit log with the person who made it: tenant registration; agreements accepted or recorded; domains added, checked and removed; providers connected, tested, turned on and disconnected; SCIM tokens issued and revoked; invitations sent, accepted and revoked. See Who can see what.