Administration

Advanced controls · incident response, AI cap and per-key API limit

Brings together the admin actions for critical moments and for keeping spend in check: force a password change across the whole organization, sign out of all your own sessions, set a monthly AI credit per person or role, and cap the requests each API key can make.

There is a small set of buttons you almost never press, and that you need to know exactly where to find on the day you do. This article gathers those buttons and says precisely what each one does, so you never count on protection that is not there.

Incident response

In Settings, Security, there are two actions at the bottom of the page:

Require a new password from EVERYONE on next access: flags every person in the organization to change their password at their next login. The screen tells you how many users were flagged. This is the right action when you suspect leaked credentials, or when someone with broad access has left the company.
Sign out all sessions: ends the sessions of YOUR account on every device and browser. You are signed out immediately and have to sign in again. This button does NOT drop your colleagues sessions.

To take one specific person offline right now, the path is Settings, Users, and suspend that user. From then on they are blocked from using the system, even with an open session.

Example: On a Friday, a manager finds out the laptop of an analyst who left the company was still signed in. She suspends the user in Settings, Users, which cuts access immediately, and then uses Require a new password from EVERYONE on next access, because a shared integration password may have circulated around the team.

AI spend cap per person

Open Settings and click AI usage.
In the Monthly credit limits block, choose the Scope, either User or Role.
Select the person or the role and enter the Monthly credit (US$).
Save. The limit takes effect in the current month.

Once the credit is used up, that person AI requests are refused with a limit reached message until the month turns over or someone raises the amount. The limit covers usage on the system AI key; if your organization brings its own provider key, that usage is not counted here.

One honest caveat: the cap check is written so that it never takes AI down because of a read failure. If the usage lookup fails for any reason, the call is allowed instead of blocked. The cap is a reliable budget brake in normal operation, not an absolute barrier.

Per-key API limit

In Settings, API, each key has its own limit of requests per minute. A heavy integration gets more headroom; a key handed to a third party gets a conservative cap. Zero means no limit. When a key goes over, the call gets the too many requests response, with an indication of how long to wait.

Choose what the audit trail records

At the top of Settings, Audit trail, the Log settings block turns entire categories on and off: access and permissions, records, data, settings, automations and other actions. The Security category is always recorded and cannot be turned off. Turning a category off reduces the storage you consume, and only applies from that point forward.

Team adoption

On the same Audit trail screen, the Team adoption card shows how many audited actions each person performed in the last thirty days and when the last one was. It tells you who is really using the CRM. Because it counts trail events, turning log categories off lowers those numbers.

Who can do what

Forcing a bulk password change, setting AI credit limits, adjusting API key limits and configuring log categories: only people with permission to manage settings.
Sign out all sessions: anyone, and the effect is always on their own account.
Checking AI spend per person is available to any member of the organization who opens the AI usage screen, not just administrators.

💡 Write down somewhere outside the CRM who the two or three people with permission to manage settings are. During an incident, the time you lose is usually not in performing the action, it is in finding out who has the button.

Open this article inside the system →