How CloudThinker Works

Learn the concepts behind every CloudThinker product, from organizations and connections to agents, skills, approvals, and memory.

CloudThinker is built from a few pieces: an organization holds workspaces, and each workspace holds the connections, agents, skills, approvals, and memory that every product runs on. Learn these once and every product page reads the same way.

The concepts at a glance

Concept	What it is	Where you manage it
Organization	The billing and membership boundary. Owns the plan, credits, members, and single sign-on.	Admin Settings
Workspace	An isolated environment inside the organization, such as production and staging, or one per team. Holds connections, chats, and data.	Workspace selector at the top of the sidebar
Connection	A credential for one external system: an AWS account, a Kubernetes cluster, a GitHub organization.	More → Workspace settings → Connections
Agent	The AI that reads your request, uses connections to look things up, and answers or acts.	More → Workspace settings → Agents
Skill	A reusable instruction set for one kind of task, run from the / menu or picked up when relevant.	More → Workspace settings → Skills
Knowledge	Your runbooks, policies, and docs, uploaded or crawled, for agents to cite.	More → Workspace settings → Knowledge
Approvals	The checks every write passes before it runs: Rules, the Approval mode, and approvers.	Approvals in the sidebar (applies to the current workspace)
Memory	What agents remember between conversations about your environment and preferences.	More → Workspace settings → Memory

Organization and workspaces

Signing up creates an organization with one workspace. Everything you connect or build lives in a workspace, and nothing crosses between workspaces unless you set it up.

Lives in the organization	Lives in each workspace
Billing, plan, and credits	Connections and credentials
Members and org roles: Owner, Admin, Developer, Viewer	Custom agents, skills, knowledge, and memory
Single sign-on and audit logs	Automations, commands, and approval settings

Org Owners and Admins are Admins in every workspace. Everyone else gets a workspace role per workspace:

Workspace role	Chat with CloudThinker	Create custom agents	Add connections, change approval rules and mode
Admin	Yes	Yes	Yes
Developer	Yes	Yes	No, view only
Viewer	No	No, view only	No, view only

Who can approve a write is set separately, through approvers. Workspace permissions has the full list.

Use separate workspaces for production and non-production. A connection, its permissions, and its approval settings then can’t leak between them.

Connections set the outer limit

An agent can only see and act on what the workspace’s connections allow. If your AWS role is read-only, no agent can change your AWS account, whatever your approval settings say. Start with read-only access and widen it when you want agents to make changes.

Agents

Agent	What it does	How you reach it
CloudThinker	The built-in assistant. Always on, can use every connection in the workspace. For a big question it starts short-lived subagents to check several things at once, then merges their results into one answer.	Send a message with no mention, or mention @CloudThinker
Custom agents	Agents your team creates, each with its own instructions and only the connections you assign.	Mention it, such as @db-reviewer

A request follows the pattern @agent #connection request, and both parts are optional. Plain language works:

Which pods in the production namespace restarted more than 3 times in the last 24 hours, and why?

See Commands for the full syntax.

Skills, knowledge, and memory

These three give agents context before you type anything. Each has a different owner.

	Holds	Who adds it	Use it when
Skills	Step-by-step instructions for one kind of task	You; a custom agent whose Skill Learning setting is Auto or Offer; and Dreaming, which runs nightly by default and can create, update, merge, and delete custom skills	The same procedure should run the same way every time
Knowledge	Your documents, as written	You, by uploading files or crawling sites	Agents should quote your runbook or policy
Memory	Short notes about your environment, preferences, and recent events	Agents, as they work. Admins edit or delete it directly; anyone who can chat can ask CloudThinker to change it	You’re tired of re-explaining your setup

Every night, Dreaming tidies memory: it merges duplicates and removes what’s outdated. It’s on by default. A workspace Admin can turn it off. Each run’s summary of what it changed is under More → Workspace settings → Memory → Run history. To get a deleted memory item back, ask CloudThinker to restore it from its revision history. A custom skill Dreaming deletes can’t be restored.

Approvals gate every change

Reads always run. A write (anything that changes a system) is checked in this order:

1. Always blocked. A built-in list of calls that never run, such as stopping CloudTrail logging, closing an AWS account, or deleting the kube-system namespace. No person or Rule can override it.

2. Rules. Each Rule allows a kind of write, asks a person first, or denies it. Deny and Ask first Rules apply in every mode. See Rules.

   Rules decide only when Rule enforcement is on for your workspace. It’s off by default, and CloudThinker turns it on per workspace. While the Rules step on Approvals says In preview, Rules only record what they would decide, and the Approval mode alone decides. See Rules troubleshooting.

3. Approval mode. Decides what’s left. See Approval mode.

Mode	What happens to a write no Deny or Ask first Rule caught
Manual	A person approves it, even one an Allow Rule covers.
Auto · Rules · Ask me	An Allow Rule runs it. Anything no Rule covers waits for a person.
Auto · Rules · Refuse	An Allow Rule runs it. Anything no Rule covers is refused.
Auto · Rules + AI · Ask me	An Allow Rule runs it. AI judgment can allow a safe write no Rule covers. The rest wait for a person.
Auto · Rules + AI · Refuse	An Allow Rule runs it. AI judgment can allow a safe write no Rule covers. The rest are refused.

When a write waits, the approval card goes to your approvers, the people allowed to answer it.

AI judgment counts a write as safe when it matches what you asked for and stays in that scope, such as adding the tag you requested to the resource you named. A destructive write, or one with an unclear effect, goes to a person or is refused.

New workspaces start on Auto · Rules + AI · Ask me. You can set a different mode for one chat from the prompt box.

The products

CloudThinker has four products: Resolve, Review, Cyber, and Optimize. Each investigates one kind of problem and needs only its own connection, so pick the first one and add the rest later.

Approvals, Customize, and Automation aren’t products. They’re supporting areas that work across all four: Approvals decides which writes run, Customize shapes the agents with your own agents, skills, and knowledge, and Automation runs them on a schedule or an event. Memory belongs to the workspace, so what agents learn in one run is there for later runs in the same workspace, whichever product starts them.

Where results show up

Place	What you find there
Home	Needs you (approvals and decisions waiting on you), Products, and Automation today
Activity	Every report agents have sent you, searchable and filterable
Investigation in the sidebar	Every incident, its root cause, evidence, and proposed fix
Automations → Runs	Every run of every automation, with its status and chat
Artifacts	Dashboards, reports, and files agents built for you

Related

Quickstart

Put these concepts to work: connect a system and get your first answer in about 10 minutes

Agents

See how CloudThinker, subagents, and custom agents share the work

Approvals

Decide which changes run on their own and which wait for a person

Glossary

Look up any term you meet in the product or these docs