Start here
The dashboard is the day-to-day control plane for Smartflow — spend, policy, routing, agents, and audit — in one React app.
Sign in
Open your deployment’s dashboard URL (on cluster1: https://cluster1.langsmart.app/dashboard/). Sign in with the local admin account or SSO if you’ve configured Auth & SSO.
Admin key
Some views (Traces, Maestro/Shield policy writes, MCP registry, agent credentials) need the SMARTFLOW_ADMIN_KEY. Paste it once under Settings → Admin key. It’s stored in this browser session only and sent as X-Admin-Key on those calls. Keys start with sf- — if your browser autofills a password, clear it and paste the real key.
Demo mode (top bar)
Next to your avatar is a Demo mode toggle. When it’s on, every page renders seeded sample data and every write (propose a policy, register an MCP server, tag a FinOps group, …) stays in this browser tab. Nothing hits production. It clears when you close the tab or sign out. Use it for demos and partner walkthroughs.
Tab map — what each page is for
Quick reference. Jump to a section for more detail.
| Sidebar | What it’s for |
|---|---|
| Home | Live traffic, cache efficiency, cost saved, system health at a glance |
| Policies | Shield / Maestro / Guardrail policies, builder, identity gates, frameworks, compliance scan, audit, atomizer |
| Red-team | Run the built-in adversarial prompt suite; see catch rate and suggested rules |
| Routing | Default provider, strategy, overrides, fallback chains, virtual keys |
| Playground | Send a live chat request through the gateway and inspect the response |
| Traces | Per-request audit log with attribution, cost, risk tier, control/policy IDs |
| Caching | MetaCache hit rates, savings, compression tester + optional quality check |
| FinOps | Spend by provider/model/user/group, budgets, anomalies, reconciliation, digests, policy proposals |
| Sustainability | Energy / carbon view of AI traffic (where instrumented) |
| Data & Sovereignty | Deployment posture, frameworks, connector registration status |
| MCP | Catalog, registered servers, tool-call efficiency stats, discovery |
| Agents | A2A agent registry and AIDA credentials |
| Identity | Device enrollment / Shield identity views |
| Auth & SSO | OIDC/SSO status, config, team mapping |
| Settings | Admin key, session info, PII tokenization notes |
Home
The landing view after login — a pulse check, not a deep dive.
What you’ll see
- Request volume and trend
- Cache efficiency and tokens / cost saved
- Health of the gateway and related services
Morning check-in, status for a standup, or confirming the cluster is healthy before a demo.
Policies
Where governance rules live. The Policies group has several child pages.
Unified list of Shield, Maestro, and Guardrail policies. Filter by engine, search by name, open a policy to inspect or edit.
Create or edit a policy with structured controls instead of raw YAML when the builder supports that engine.
Who can do what — attach policies to groups, roles, or identity claims so enforcement follows your directory.
Regulatory / control frameworks (HIPAA, GDPR, PCI, …) and how they’re assigned to teams.
Paste sample content, pick frameworks, run the multi-engine scan and watch stages (PII, financial control, regulatory) fire.
Evidence-oriented views for audits — what was enforced and what can be shown to reviewers.
Paste a policy document (text). Smartflow returns atomic, control-mapped rules with severity and suggested action. Optionally persist and reload saved atomizations. Uses an LLM engine when a key is available; otherwise a heuristic fallback (the UI badges which engine ran).
Red-team
Self-test your live guardrail stack with a built-in adversarial corpus.
What it does
- Pick categories: prompt injection, jailbreak, PII exfiltration, data leakage, harmful content, regulated advice
- Run the suite against your compliance detector (no external LLM required for the harness itself)
- See catch rate, risk score, per-category breakdown (with NIST function tags), and suggested block rules for misses
After changing policies, before a customer demo, or when you want a concrete “what still gets through” report for security review.
Routing
How traffic chooses a provider and what happens when one fails.
What you’ll configure
- Default provider — where requests go when nothing else overrides
- Strategy — cost / quality / latency preferences
- Overrides — temporary or scoped routes (e.g. force a model for a group)
- Fallback chains — ordered failover when a provider errors
- Virtual keys — issue / revoke gateway keys for apps and teams
Onboarding a new provider, cutting over traffic, or issuing a key for a new app.
Playground
Send a real request through the gateway from the UI.
What it’s for
Quick end-to-end check: model, prompt, response — without leaving the dashboard. Useful after a routing or policy change to confirm the path still behaves.
Traces
Every AI request with attribution and a tamper-evident audit chain.
What you’ll see
- Table: time, user, model/provider, endpoint, risk tier, cost, latency
- Governance column — how many control/policy IDs are mapped on that request
- Drawer: attribution (user, groups, department, key), request meta, Control IDs and Policy IDs as chips, prompt/response (when retained), HMAC chain fields
Incident review, “who spent what,” proving which controls fired, or verifying the audit chain for compliance.
Caching
MetaCache performance — exact, semantic, and vector hits — plus a compression tester.
Widgets & charts
Hit rate, tokens saved, cost saved, latency saved, and a breakdown of match types (exact / semantic / vector).
Compression tester
Paste text, compress it, see ratio and token savings. Optional Quality check asks the HHEM faithfulness sidecar for a quality_delta (higher = more faithful to the original). If HHEM isn’t deployed or enabled, the UI shows quality check unavailable instead of failing silently.
FinOps
Cost governance for AI spend — the place finance and platform owners meet.
Live vs Demo mode (FinOps submenu)
- Live — real cluster spend from
/api/finops/* - Demo mode (FinOps submenu) — seeded FinOps story for walkthroughs when live traffic is thin. The site-wide Demo mode toggle also covers FinOps when it’s on.
What you can do
- Spend totals by week / month / year; top provider and model
- Top users or groups (last 30 days); group tagging when IdP hierarchy is missing
- Caching / token savings by provider
- Budgets & burn-rate alerts — caps by all / provider / group; enforce via policy proposal when over
- Spend trend & anomalies — spike days flagged; draft a policy from a spike
- Providers & reconciliation — gateway-metered vs billed spend; surface un-governed spend
- Cost efficiency & ROI — concentration (HHI), allocation coverage, cost-to-value
- Schedule digest — “what changed & where to save” briefing
- CSV / FOCUS-CSV export and a print-ready FinOps PDF report
- Propose policy on recommendations — scope/target pickers and model→model routing
Monthly cost review, catching a runaway team, bringing shadow spend under the gateway, or turning a savings idea into a pending policy for admin approval.
Sustainability
Energy and carbon framing of AI traffic where the deployment instruments it.
What it’s for
ESG / sustainability reporting context for AI usage — pair with FinOps when stakeholders care about both dollars and footprint.
Data & Sovereignty
Deployment posture and where data is allowed to live.
What you’ll see
- Sovereign overlay / region / FIPS / GDPR / CAC / WORM flags
- Enabled compliance frameworks
- Connector registration status (e.g. Box, SharePoint) where configured
MCP
Model Context Protocol — catalog, registration, trust, and efficiency.
Tabs
- Catalog — published MCP servers available to browse
- Registered — servers your gateway trusts; remove when retiring a tool host
- Efficiency — tool-call-reduction benchmark (calls avoided, tokens/cost saved, top tools), discovery-cache hit stats, trajectory-cache hit rate and estimated calls avoided
- + Add server — probe an internal URL, pick a well-known public MCP, or register manually (URL, optional API key, trust flag, cost per call)
Onboarding a new tool server, proving MCP caching is paying for itself, or auditing which tools agents can call.
Agents
A2A agent registry and AIDA credentials.
What you’ll do
- List / register / remove agents
- Issue and revoke AIDA credentials (algorithm, key id, fingerprint shown on create)
Standing up a new agent identity or rotating credentials after a leak or offboarding.
Identity
Device enrollment and Shield-oriented identity views.
What it’s for
Enrollment tokens, device virtual keys, and identity checks used by Aperion Shield / enterprise device flows. Pair with Policies → Identity Gates when you’re binding policy to who’s on the wire.
Auth & SSO
How people sign into the dashboard and how directory groups map in.
What you’ll configure
- SSO status (enabled / healthy)
- OIDC config (issuer, client, redirects)
- Team / group mappings from your IdP
Deeper Entra / Okta patterns: SSO & Unified Identity brief.
Settings
Session credentials and operator-facing notes — not a full cluster control panel.
What’s here
- Admin key — paste
SMARTFLOW_ADMIN_KEYfor this browser session - PII tokenization — explains the proxy-level
PII_TOKENIZE_MODE/PII_TOKENIZE_TYPESenv vars (reversible[[SF_PII_TYPE_n]]tokens). This is a startup flag on the proxy, not a live dashboard toggle — the card includes a copy-pastekubectl set envexample - Session — who you’re signed in as; tokens live in
sessionStorage
Demo mode (site-wide)
Seeded product tour for sales, partners, and internal training.
How it behaves
- Toggle in the top bar (next to your avatar)
- Amber banner while active — Reset session clears simulated writes; Turn off returns to live APIs
- All pages (Home, Policies, Red-team, MCP Efficiency, FinOps, Traces, …) use realistic seed data
- Writes are simulated in
sessionStorageonly — they vanish on tab close or logout - Login / verify endpoints are never intercepted, so you can always authenticate
Any time you need a fully populated story without production risk — investor walkthroughs, partner testing, training new operators.