docs: align plans and guides with the current product

AGENTS.md

@@ -12,15 +12,14 @@
 
 The navigation keeps Home first, then sorts the top-level sections and the pages inside each section alphabetically:
 
-- **Administration** - `/admin-panel`. Browser-admin access, dashboards, governance records, runtime controls, and network policy.
-- **Agents (Beta)** - `/developers/*`. Guides cover Agent setup, threads, context, projects, schedules, preferences, and webhooks. Architecture and the REST API reference live here too, with API pages under `/developers/api-ref/*`.
+- **Administration** - `/admin-panel`. Browser-admin access, account and runtime dashboards, sponsorship, and network policy.
+- **Agents (Beta)** - `/developers/*`. Guides cover Agent setup, configuration and sharing, manual testing, threads, context, projects, schedules, preferences, and current webhook availability. Architecture and the REST API reference live here too, with API pages under `/developers/api-ref/*`.
 - **App setup** - `/integrations/{github, gmail, google-calendar, slack}`. Per-app permissions and prompts, not feature pages. All of them connect through the Apps tab of the Add MCP dialog.
 - **Deployment models** - `/deployment-models`. Current availability and operating boundaries for Fluso Cloud, dedicated AWS VPC, planned Azure VNet, and scoped on-premises deployments.
 - **Features** - `/features/*`. Approvals and permissions, Apps and MCP servers, Chat, Confidential mode, Imports, Memory, Projects, Skills, and Tasks.
 - **Get started** - `/going-deeper`, `/introduction`, `/quickstart`. These pages explain the path from first setup to daily use.
 - **Reference** - `/resources/{faq, legal, pricing}`. Legal links to the terms of service at `https://fluso.ai/terms` and privacy policy at `https://fluso.ai/privacy`; do not duplicate the policies in the docs.
 - **Release notes** - `/release-notes`. Customer-facing changes, newest first.
-- **Remote access** - `/remote/*`. Ways to use Fluso away from the desktop app.
 - **Workflows** - `/workflows/*`. Six concrete stories: bug-to-PR, content launch, knowledge recall, meetings, morning brief, and research-to-deck.
 
 The home page (`/`) is a router into the journey, with three sections: just landed, already set up, daily user.

components/diagrams.tsx

@@ -76,7 +76,7 @@ export function MemoryScopeDiagram() {
     >
       <Layer
         label="Global preferences"
-        detail="Your timezone, response style, and standing instructions apply in every project"
+        detail="Your response style and standing instructions apply across ordinary project chats"
         icon={Users}
         emphasis
       />
@@ -91,7 +91,7 @@ export function MemoryScopeDiagram() {
         id="memory-scope-caption"
         className="mt-4 text-center text-xs leading-relaxed text-fd-muted-foreground"
       >
-        Global preferences apply everywhere. Project context and working memory
+        Ordinary chats use global preferences. Project context and working memory
         stay inside their project.
       </figcaption>
     </figure>
@@ -212,7 +212,7 @@ export function KnowledgeGraphDiagram() {
 const architectureServices = [
   {
     label: 'Fluso client',
-    detail: 'Desktop or remote',
+    detail: 'Desktop or mobile',
     x: 10,
     icon: MessageSquareText,
   },

content/docs/admin-panel.mdx

@@ -2,91 +2,64 @@
 title: Admin panel
 sidebarTitle: Admin panel
 icon: shield-user
-description: Review users, runtimes, recorded model usage, identity and access changes, and network policy from Fluso Admin.
+description: Inspect accounts, runtimes, recorded usage, sponsorship, and network policy in Fluso Admin.
 ---
 
-Fluso Admin is a separate browser interface for authorized operators. It shows account, runtime, usage, and governance records without exposing the content of members' work.
+Fluso Admin is a separate browser interface for authorized operators. A personal Pro or Confidential subscription does not grant administrator access.
 
-<Note>
-  Your organization provides its Fluso Admin address and assigns the panel
-  role. This is separate from the organization role recorded under **Teams &
-  access**.
-</Note>
+Your deployment operator provides the address and assigns a **Read-only** or **Read & write admin** role. The backend checks that role on each admin request.
 
 ## Access roles
 
-The backend checks the administrator role on every request.
-
 | Role | Access |
-| --- | --- |
-| Read-only | View dashboards, users, runtimes, usage, access records, and network policy. Export available reports. |
-| Read and write | All read-only access, plus runtime controls, plan sponsorship, team and Agent access changes, and network policy changes. |
-
-The **Admin** organization role does not grant access to Fluso Admin. Panel access uses the separate read-only or read-and-write role assigned by the operator of your deployment.
-
-## View scope
-
-**Overview** and **Users** cover the configured sign-in instance. **Teams & access** and **Audit log** show one target account and default to the signed-in administrator. To inspect another account, open it from **Users**, then choose **Manage access** or **Audit trail**.
-
-## Admin views
+|---|---|
+| Read-only | Inspect dashboards, users, runtimes, recorded usage, sponsorship, and network policy |
+| Read and write | The same views, plus runtime controls, sponsorship changes, and network-policy changes |
 
-| View | What it shows or controls |
-| --- | --- |
-| **Overview** | Instance-wide identity activity, runtime health, recorded model usage, plan distribution, and users with the highest recorded cost. |
-| **Users** | An instance-wide, searchable user list. Open a user to review their plan, runtime state, usage, and aggregate storage. Read-and-write administrators can control the runtime and grant or extend Sponsored Confidential. |
-| **Runtime fleet** | A cached or refreshed snapshot of running, starting, stopped, failed, unknown, mapped, and unmapped runtimes. Click **Refresh fleet** to reconcile the snapshot before investigating availability. |
-| **LLM costs** | Global cost and token totals from the gateway usage ledger for 30, 90, 180, or 365 days. It does not show prompts, sessions, or model-level detail. |
-| **Observability** | SLA and SLO configuration state, current runtime status coverage and failures, runtime distribution, and recorded cost and token usage for the last 14 days. **Refresh health** updates the fleet snapshot. Run completion, response latency, evaluation, and policy metrics remain unavailable until those sources are recorded. |
-| **Audit log** | The latest 100 identity and access events for the target account. Filter by user, action type, or date, then export the current rows as CSV. |
-| **Teams & access** | Microsoft Entra tenant metadata, members, organization roles, teams, access requests, and Agent access records for the target account. The metadata record does not verify or import a directory by itself. |
-| **Network egress** | Platform-wide origin and provider bundles for egress-governed sandboxes. These controls do not currently have a per-organization boundary. |
+## Current views
 
-## Audit log
+| View | What it shows |
+|---|---|
+| **Overview** | Identity activity, runtime health, plan distribution, recorded usage, and highest-cost users |
+| **Users** | Searchable accounts with plan, sponsorship, runtime state, storage, and recorded usage |
+| **Runtime fleet** | Runtime status and mapped or unmapped instances; **Refresh fleet** reconciles the snapshot |
+| **LLM costs** | Recorded gateway cost and token totals for 30, 90, 180, or 365 days |
+| **Network egress** | Origin and provider rules for egress-governed runtimes |
 
-Each governance event records the actor, action, target, detail, and time. Current action types cover Microsoft Entra metadata, tenant configuration, teams, roles, access requests, and Agent access records.
-
-This is not an Agent activity trace or a complete record of Admin mutations. It does not show tool calls, logins, prompts, document edits, messages, files, knowledge graphs, runtime controls, Sponsored Confidential changes, or network-policy changes. Use an Agent's **Analytics** page for its recorded runs.
+These views do not expose users' messages, project files, or knowledge content. Usage totals describe recorded entries; unavailable data is not evidence of zero usage.
 
 ## Runtime and user controls
 
-Open **Users**, select a person, then review the runtime card. A read-and-write administrator can start, stop, or restart the runtime. Stop and restart are blocked during active work, warm-up, active schedules, or an unhealthy state; there is no force-stop control.
+Open **Users** and select an account. A read-and-write administrator can start, stop, or restart its runtime when the control is available. Active work, warm-up, schedules, or an unhealthy state can block a control. There is no force-stop action.
 
-The same user page shows aggregate storage. It does not open or delete the user's stored content.
+The storage card reports aggregate usage and limits. It does not open or delete the user's files.
 
-Sponsored Confidential changes entitlement for up to 24 months. They do not change the person's Clerk billing subscription.
+The sponsorship form can grant or extend **Sponsored Confidential**, with an expiry up to 24 months away. Sponsorship changes access, not the person's Clerk subscription or billing schedule.
 
 ## Network egress
 
-Use **Network egress** to review the origins available to egress-governed sandboxes. A read-and-write administrator can create, edit, or delete provider bundles and delete existing Shared rules. The current panel does not add or edit a standalone Shared rule.
+A read-and-write administrator can create, edit, or delete provider bundles and delete existing Shared rules. The current panel does not add or edit standalone Shared rules.
 
 <Warning>
-  A change here applies to every egress-governed user. **Ask** requests user
-  approval and saves the user's Allow or Deny choice. A global **Deny** gives no
-  prompt and cannot be overridden. Disabling or deleting a bundle removes only
-  rules created by that bundle; other global rules and user grants remain.
+  These controls apply across egress-governed users, rather than to one organization. A global Deny blocks the origin without an approval prompt. Disabling or deleting a bundle removes its own rules; other global rules and user grants remain.
 </Warning>
 
+## Enterprise administration
+
+The current panel does not provide the previously described **Teams & access**, **Audit log**, or **Observability** pages, Microsoft Entra setup, or their CSV export controls. Scope identity integrations, organization-wide audit requirements, and monitoring exports with the deployment team. See [Deployment models](/deployment-models).
+
 ## Troubleshooting
 
 <AccordionGroup>
-  <Accordion title="The Admin panel role is missing">
-    Sign in with the account your deployment operator authorized. An
-    organization role does not grant panel access. Ask the deployment operator
-    or [contact Fluso support](mailto:support@premai.io) if the panel role is
-    missing.
+  <Accordion title="I cannot open Fluso Admin">
+    Use the address and account authorized by your deployment operator. A personal subscription or ordinary organization membership does not grant panel access.
   </Accordion>
-  <Accordion title="A dashboard says data is unavailable">
-    The panel distinguishes recorded data from missing telemetry. Retry the
-    view. If it remains unavailable, check the source service rather than
-    treating the empty value as zero.
+  <Accordion title="A dashboard cannot load data">
+    Retry the view. If it stays unavailable, contact the deployment operator with the failing page and time. Do not interpret a failed request as an empty account or zero usage.
   </Accordion>
   <Accordion title="A runtime control is unavailable">
-    Check whether the runtime is busy, warming, unhealthy, already stopped, or
-    has active schedules or other durable work. Retry after the blocking state
-    clears. Fluso does not force-stop a runtime from this panel.
+    Check its current state and ongoing work. Retry after the blocking condition clears; the panel does not force-stop active work.
   </Accordion>
 </AccordionGroup>
 
-## Next
-
-See [Legal](/resources/legal) for Fluso's privacy policy.
+See [Legal](/resources/legal) for Fluso's terms and privacy policy.

content/docs/deployment-models.mdx

@@ -50,11 +50,11 @@ Agree on these boundaries before treating the design as approved:
 
 ## Operational telemetry
 
-AWS deployments send service logs to CloudWatch and define CloudWatch alarms. Fluso's knowledge service emits structured logs and can export traces and metrics through OpenTelemetry (OTLP). The current AWS collector routes traces to X-Ray and metrics to CloudWatch; Prometheus scraping is optional.
+Telemetry depends on the deployed services and collector configuration. AWS deployments can use CloudWatch for logs and alarms. Services may also support OpenTelemetry collectors; agree on enabled exporters and destinations for each deployment.
 
 Traces can include prompt and response text. For a dedicated or on-premises deployment, agree which signals are captured, where they are stored, how long they are retained, and which customer-owned collectors are supported.
 
-[Fluso Admin](/admin-panel) shows the product records it receives, including runtime health, recorded cost and token usage, and governance events. It does not replace infrastructure monitoring or promise export of every operational signal.
+[Fluso Admin](/admin-panel) shows the product records it receives, including runtime health, recorded model usage and costs, and network-egress events. It does not replace infrastructure monitoring or promise export of every operational signal.
 
 ## Choose a model
 

content/docs/developers/agent-builder.mdx

@@ -2,39 +2,45 @@
 title: Agent builder
 sidebarTitle: Agent builder
 icon: workflow
-description: Turn a plain-language request into an Agent draft, then review or refine it before saving.
+description: Create and refine a saved Agent through a conversation or a form.
 ---
 
-Open **Control Panel → Create Agent** to start in Agent Studio. Describe the job in plain language. Studio drafts the Agent definition and a small workflow preview before anything is saved.
+<Note>
+  Agents is a beta workspace. Availability depends on the app's release and beta configuration. Buying Pro does not by itself enable Agents or add a Control Panel.
+</Note>
 
-> *"Create a customer escalation coordinator. Gather the customer, impact, urgency, and open questions. Read relevant Gmail and Google Drive context, classify the case as P0 or P1, prepare the next steps, and require approval before sending anything."*
+Open **Agents → New Agent**. Describe the job to the Agent manager:
 
-## Build the first draft
+> *"Create a customer escalation coordinator. Gather the customer, impact, urgency, and open questions. Read the connected support sources, classify the case as P0 or P1, and prepare the next steps. Ask for approval before sending anything."*
 
-A useful request names four things:
+The manager can create and modify saved Agents during the conversation. Review what it creates before using it for live work.
 
-- The input, such as a support request or release candidate.
-- The outcome, such as a severity decision or handoff package.
-- The sources and capabilities the Agent may use.
-- The boundaries that must hold, such as approval before an external action.
+## Describe the job
 
-Select **Build**. Studio returns the Agent name, description, instructions, and a short graph of the proposed steps. The graph is a design preview. It helps you check the order and decision points, but it is not executable code.
+Name the input and expected result, the sources the Agent may use, and the boundaries it must respect. Keep credentials out of the instructions; connect Apps through **Plugins → MCP**.
 
-## Refine without starting over
+For example, refine the Agent with:
 
-Use the Studio message box to change the draft:
+> *"Use P0 for a complete outage and P1 for degraded service with a workaround. Prepare customer replies as drafts for review."*
 
-> *"Only use P0 and P1. Run the Gmail and Drive lookups in parallel. Stop for approval before sending a customer reply."*
+## Use the form
 
-Studio revises the current draft and replaces the workflow preview. If a request fails, the last valid preview stays in place so you can retry.
+Choose **Fill in a form instead** when creating an Agent, or open **Edit** from an existing Agent's details.
 
-## Create or open the editor
+- **Name** is the label shown in the workspace.
+- **Purpose and instructions** describe the result, sources, and standing rules.
+- Choose the project, response mode, skills, and Apps the Agent can use.
+- Add knowledge files for stable reference material.
+- Select **Create Agent** or **Save changes**.
 
-- Select **Create Agent** when the draft is ready.
-- Select **Go to editor** when you want to inspect every field, capability, knowledge file, or thread setting first.
+The form accepts up to 25 knowledge files, with a 20 MiB limit per file. Review the selected capabilities and [approval settings](/features/approvals) before allowing external changes.
 
-Studio only selects capabilities already available to you. Creating the Agent saves the definition. Existing Agent threads keep the definition they started with, so test changes in a new thread.
+## Refine an existing Agent
+
+Choose **Modify** in the Agent menu to return to the manager. Use **Edit** to change the fields directly.
+
+The main conversation uses the updated configuration on its next turn. A running turn finishes with its accepted configuration, and existing delegated sessions keep theirs. See [Threads and contexts](/developers/threads-and-contexts).
 
 ## Next
 
-See [Agent description](/developers/agent-description) for field boundaries and [Threads and contexts](/developers/threads-and-contexts) for what a new Agent thread receives.
+See [Agent description](/developers/agent-description) for writing instructions and [Testing Agents](/developers/evaluations) for a manual review loop.