TABLE OF CONTENTS
Overview
Control Center is the administrative workspace for making Stack Internal ready, secure, connected, and governable. It brings together the controls an administrator needs to launch a workspace, manage access, connect organizational knowledge, review subject-matter-expert coverage, and register applications that use the Stack Internal API.
Control Center at a glance
| Area | What it is for | Required permission |
|---|---|---|
| Get started | Complete the minimum setup and launch the workspace. | auth:manage + connectors:manage |
| Users | Manage member status and administrator/user roles. | users:manage |
| Single Sign-On (SSO) | Configure and review company identity-provider access. | auth:manage |
| MCP | Manage the workspace’s Model Context Protocol access pathway. | mcp:manage |
| Sources | Connect and maintain approved knowledge sources. | connectors:manage |
| SMEs | Review mapped subject matter experts and knowledge-validation coverage. | smes:manage |
| OAuth Applications | Register and revoke scoped API client applications. | oauth-apps:manage |
Getting Started
Use this page to complete the minimum setup required to make the workspace available to regular users.
Get started is a three-step readiness checklist. It reads status from the services that own SSO, source connections, and tenant activation, so the page reflects the current workspace state rather than a separate checklist maintained by hand.
The three steps
- Enable SSO. Configure company sign-in and verify that the page shows SSO as enabled. When available, Control Center also displays the configured authentication method.
- Connect data sources. Connect at least one available source. The launch requirement is satisfied when any source is enabled.
- Launch your workspace. Launch becomes available only when SSO is enabled and at least one source is connected. Confirming launch makes the workspace available to regular users.
After launch: The checklist is replaced by a “Your workspace is now live” confirmation. Administrators can continue to use the other Control Center pages to maintain access, sources, SMEs, and integrations.
Access
Users
Use this page to find workspace members, manage their role, and control whether they can access the workspace.
The Users page displays each member’s name, email address, active status, and role. You can search by name or email, filter by status and role, sort the directory, and change the number of users shown per page.
Available actions
-
Change a user between the Admin and User roles. Role changes update workspace permissions immediately.
-
Deactivate a user to remove workspace access. The user cannot sign in through SSO until reactivated.
-
Reactivate a user to restore access using the user’s existing profile and SSO identity.
-
Use status and role filters to support access reviews and targeted cleanup.
Self-protection: You cannot change your own role or deactivate/reactivate your own account from the Users page. This helps prevent an administrator from accidentally removing their own ability to manage the workspace.
Single Sign-On (SSO)
Use this area to connect Stack Internal to your company identity provider and review sign-in readiness.
Stack Internal uses WorkOS for its enterprise identity layer. During initial setup, the administrator is redirected to the secure WorkOS Admin Portal to configure the organization’s SSO connection. After setup, the Get started page uses the authoritative identity status to show whether SSO is enabled.
MCP
Use this page to enable or disable MCP globally for your workspace.
Data Management
Sources
Use this page to connect, configure, and maintain the knowledge systems Stack Internal can use.
The Sources page separates connected sources from sources that are available to configure. Connection state is shared with Get started, so enabling an approved source can satisfy the workspace launch requirement.
Available source types
-
Stack Internal Community — uses an existing community as a trusted knowledge source. Private teams are excluded from the initial community-ingestion scope.
-
Google Docs — uses an OAuth connection and configured drive IDs to read document content, file names, metadata, and the connected-account email. It does not change, delete, or share files.
-
Slack — ingests selected public channels and can support direct messages for SME verification. Private channels and unrelated DM history are not included.
SMEs
Use this area to review the people mapped as subject matter experts and the coverage available for knowledge validation.
Subject matter experts help Stack Internal keep important knowledge accurate over time. The Control Center entry point is permission-protected and is linked from the live-workspace confirmation so administrators can review mapped SMEs after launch.
How the validation flow fits together
-
A validation request is assigned to a mapped SME for a topic or area of knowledge.
-
The SME can confirm, reject, or edit the candidate knowledge through the supported notification experience.
-
Slack can be used to deliver SME verification prompts when the Slack source/integration is configured for that purpose.
-
The response is returned to the trust workflow as a business event, keeping the validation decision separate from the notification channel.
Admin guidance
-
Review mappings for missing coverage, departed employees, and overloaded experts.
-
Make sure mapped SMEs are active workspace users and can receive the chosen notification method.
-
Use clear ownership and escalation rules for unanswered or disputed validations.
-
Treat SME assignment as a governance role, not simply a directory label.
Developer Tools
OAuth Applications
Use this page to register, review, filter, and revoke custom applications that call Stack Internal APIs.
OAuth Applications is the developer-tools directory for external scripts, tools, and AI agents. The directory shows application name, Client ID, redirect URL, and granted scopes. Administrators can sort the list, filter it by API scope, paginate through results, register a new application, or delete one.
Registering an application
-
Give the application a clear, human-readable name that identifies its owner and purpose.
-
Enter the exact OAuth redirect URL that will receive the authorization response.
-
Select the maximum scopes the application may request. Use the smallest set that supports the integration.
-
Record the Client ID and credential handoff using your organization’s approved secret-management process.
Deleting an application
Deletion is immediate and cannot be undone. It permanently invalidates the application’s Client ID and Client Secret, so scripts, developer tools, and AI agents using those credentials will stop working.
Before deleting: Confirm the application owner, identify active dependencies, communicate the cutoff, and prepare a replacement registration when continuity is required.
If you have any questions or need help, please open a ticket on our help center or email us at support@stackoverflow.com.