@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/config/engine-settings-destinations.js

@@ -41,8 +41,12 @@
  * `companion-exports`: a symbol reachable through two public doors is a symbol whose two doors
  * drift. Every consumer — including this package's own — imports it from `@wildo-ai/saas-models`.
  */
-import { CoreFeature, CoreResourceOperation, CoreResourceType, CORE_APP_ROLES, CORE_ORG_ROLES, EngineSettingsDestinationRef, ResourcePrimaryScope } from '@wildo-ai/saas-models';
+import { CHAT_IDENTITY_LINK_OWN_VARIANT_KEY, CoreFeature, CoreResourceOperation, CoreResourceType, CORE_APP_ROLES, CORE_ORG_ROLES, EngineCapability, EngineSettingsDestinationRef, ResourcePrimaryScope, UserSelf_Operations } from '@wildo-ai/saas-models';
+import { StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas.js';
 import { SettingsPanelRef, SettingsSectionTargetKind } from './settings-hub.frontend.schemas.js';
+import { RelationshipSideCapability } from './relationship-side-capabilities.frontend.utils.js';
+import { DirectoryProvisioningCapability } from './directory-provisioning-capabilities.frontend.utils.js';
+/** @wildo_source:part:start saas.frontend.settings-hub.engine-destination-roles facet:layer:frontend facet:family:settings facet:audience:app-developer */
 /** Org-management destinations are visible to organization owners and admins. */
 const ORG_MANAGEMENT_ROLES = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN];
 /**
@@ -55,6 +59,7 @@ const ORG_MANAGEMENT_ROLES = [CORE_ORG_ROLES.ORG_OWNER, CORE_ORG_ROLES.ORG_ADMIN
  * Widen this only alongside the operation roles it would then have to match.
  */
 const APPLICATION_ADMINISTRATION_ROLES = [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN];
+/** @wildo_source:part:end saas.frontend.settings-hub.engine-destination-roles */
 /**
  * Runtime capability key for "billing is enabled for this app". Wired in
  * `useLauncherRuntimeAvailabilityContext` (`runtimeCapabilities.billingEnabled`);
@@ -62,6 +67,12 @@ const APPLICATION_ADMINISTRATION_ROLES = [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN];
  * single source of truth.
  */
 const BILLING_ENABLED_CAPABILITY = 'billingEnabled';
+/**
+ * The runtime capability on in an application that declares at least one professional qualification kind (#2967), set by
+ * `useLauncherRuntimeAvailabilityContext` from the published `professionalQualificationKinds`: an application whose
+ * decisions require no qualification has nothing to record.
+ */
+export const PROFESSIONAL_QUALIFICATIONS_DECLARED_CAPABILITY = 'professionalQualificationsDeclared';
 /**
  * Runtime capability keys for the enterprise-config features. Unlike billing
  * (which reads `appConfig.billing.enabled`), these have no app-config toggle.
@@ -90,9 +101,16 @@ const BILLING_ENABLED_CAPABILITY = 'billingEnabled';
  * axis rather than the ENTITLED one so that a billing-on organization whose plan lacks the feature
  * still survives the filter and can render an upgrade prompt via `FeatureGate`; an application whose
  * catalogue grants the feature nowhere offers it to nobody, and the section vanishes.
+ *
+ * **SCIM reads two capabilities, both of which need the current organization's type** (#2613, #2649). The section is
+ * gated on {@link DirectoryProvisioningCapability.SETTINGS_REACHABLE}, its provisioning tab on
+ * {@link DirectoryProvisioningCapability.ENABLED}: offered, AND the type declares `scimProvisioning`
+ * (`isOrganizationTypeDirectoryProvisioned`, the rule the SCIM API admits a request by). An organization of a type no
+ * directory may provision is offered no SCIM settings, because a token minted there would authenticate a directory the
+ * API refuses, UNLESS it still holds an unrevoked token: then the section shows the tokens alone, with Revoke and nothing
+ * else, until the last one is revoked. See `directory-provisioning-capabilities.frontend.utils.ts`.
  */
 const SSO_ENABLED_CAPABILITY = 'ssoEnabled';
-const SCIM_ENABLED_CAPABILITY = 'scimEnabled';
 const SIEM_ENABLED_CAPABILITY = 'siemEnabled';
 const WEBHOOKS_ENABLED_CAPABILITY = 'webhooksEnabled';
 /**
@@ -107,6 +125,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     // ── Account ────────────────────────────────────────────────────
     {
         ref: EngineSettingsDestinationRef.PROFILE,
+        icon: StandardIconReference.PROFILE,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
             resourceType: CoreResourceType.USER_SELF_PROFILES,
@@ -115,14 +134,17 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.SECURITY,
+        icon: StandardIconReference.LOCK,
         target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.SECURITY },
     },
     {
         ref: EngineSettingsDestinationRef.APPEARANCE,
+        icon: StandardIconReference.PALETTE,
         target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.APPEARANCE },
     },
     {
         ref: EngineSettingsDestinationRef.PREFERENCES,
+        icon: StandardIconReference.SLIDERS,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
             resourceType: CoreResourceType.USER_SELF_PREFERENCES,
@@ -130,14 +152,28 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         },
     },
     {
-        // The caller's OWN received invitations (Approach P) — their own INVITED membership
-        // rows across orgs they haven't joined yet. Distinct from the org-admin's view of
-        // sent invites, which are now just INVITED-status rows in the 'members' list (no
-        // separate org 'invitations' section). No `requiredRoles`: any authenticated user
-        // can act on invitations addressed to them (authorized server-side by userId-ownership).
+        // The caller's OWN received invitations: their own INVITED membership rows across orgs they
+        // haven't joined yet (Approach P), and the representing organizations' invitations sent to their proven
+        // address, which they receive into an organization they own or decline (#2716). Distinct
+        // from the org-admin's view of sent invites, which are INVITED-status rows in the 'members'
+        // list. No `requiredRoles`: any authenticated user can act on invitations addressed to them
+        // (authorized server-side by userId-ownership, or by the proven address for a representing organization's).
         ref: EngineSettingsDestinationRef.MY_INVITATIONS,
+        icon: StandardIconReference.MAIL,
         target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.INVITATIONS },
     },
+    {
+        // Where a person deactivates their own account (#2324): the operation's own surface. Not the account record, which
+        // has no routed UPDATE and would be an unsubmittable pane (see the enum member). No `requiredRoles`: the verb is
+        // `APP_USER` and self-scoped, so a role gate could only hide it from the account's owner.
+        ref: EngineSettingsDestinationRef.DEACTIVATE_ACCOUNT,
+        icon: StandardIconReference.USER_COG,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.USER_SELF,
+            operation: UserSelf_Operations.DEACTIVATE_ACCOUNT,
+        },
+    },
     {
         // Where a PERSON connects their own third-party accounts.
         //
@@ -151,44 +187,79 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // "the application declared a provider" would hide the screen exactly when somebody is looking
         // for it, since providers are declared whether or not anyone has connected one.
         ref: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS,
-        // TWO tabs, because the screen answers two questions and one of them has no resource behind it.
+        icon: StandardIconReference.PLUG,
+        // ONE panel, one list (#2319): every provider this person may connect and every account they have connected, each
+        // row with its state and its acts — connect, replace a typed credential, reconnect, turn off or on, disconnect.
         //
-        // "Connect" is the catalogue — what this person MAY connect — and it is a bespoke panel because
-        // connecting is a flow out to a vendor rather than a row somebody creates. "Credentials" is the
-        // ordinary resource list: what they HAVE connected, plus the pasted keys that never went through
-        // a vendor at all.
+        // It was two tabs, "Connect" (the catalogue) and "Credentials" (the resource list of stored rows), and a person had
+        // to match the two up by name to answer "which do I have, and what can I do with each". The panel now lists what is
+        // held beside what is offered; every act on a stored row goes through the credential resource's own operations.
         //
-        // Connect comes FIRST deliberately. On the day somebody opens this screen for the first time the
-        // list is empty, and an empty table is the least informative thing to greet them with; it is also
-        // the tab the connection callback returns them to, carrying the outcome it has to render.
+        // The connection callback returns to this section (`/settings/my-provider-credentials`), and the panel is what
+        // renders its outcome, so a single-panel target is also what keeps that report on screen.
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.CONNECTED_ACCOUNTS },
+    },
+    {
+        // The apps a person let act for them, and the place to take that back (#2317). No `requiredRoles`,
+        // for the integrations sibling's reason: every grant is the person's own (USER_SELF, APP_USER on
+        // every client-facing verb), so a role gate could only hide the screen from someone entitled to it.
+        // Only REMEMBERED approvals are listed: an approval without "remember this app" leaves nothing
+        // behind to revoke here, since the app's tokens end with the session they were issued in.
+        ref: EngineSettingsDestinationRef.AUTHORIZED_APPS,
+        icon: StandardIconReference.THIRD_PARTY_APP,
         target: {
-            kind: SettingsSectionTargetKind.SUB_TABS,
-            subTabs: [
-                {
-                    ref: 'connect',
-                    label: 'Connect',
-                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.CONNECTED_ACCOUNTS },
-                },
-                {
-                    ref: 'credentials',
-                    label: 'Credentials',
-                    target: {
-                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.USER_PROVIDER_CREDENTIALS,
-                        operation: CoreResourceOperation.LIST,
-                    },
-                },
-            ],
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.OAUTH_CONSENT_GRANTS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Whether the agent reached the webhooks an agent client registered for this person's own A2A tasks (#2324): the
+        // delegated-user turns, the ordinary case for an app acting on someone's behalf. No role gate, as for authorized
+        // apps: every row is the person's own. Gated on AI_LLM, because an A2A task is an agent's work and an agent needs a
+        // language model; without one there is nothing to deliver.
+        ref: EngineSettingsDestinationRef.MY_AGENT_PUSH_DELIVERIES,
+        icon: StandardIconReference.NOTIFICATION,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.USER_A2A_PUSH_DELIVERY_LOG,
+            operation: CoreResourceOperation.LIST,
         },
     },
     // ── Organization ───────────────────────────────────────────────
     {
         ref: EngineSettingsDestinationRef.ORGANIZATION_GENERAL,
+        icon: StandardIconReference.ORGANIZATION,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        // The organization's own record, and the three one-row records every organization is created with (#2324): its
+        // profile (name, branding), its preferences and its notification settings. Each had a preset and an update and no
+        // place on any screen. Tabs of one pane, because they answer one question (how this organization presents and
+        // behaves) and each is a single record; a READ of a one-row child drops the id from its path.
         target: {
-            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-            resourceType: CoreResourceType.ORGANIZATIONS,
-            operation: CoreResourceOperation.READ,
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'organization-general-record',
+                    label: 'Organization',
+                    target: { kind: SettingsSectionTargetKind.RESOURCE_OPERATION, resourceType: CoreResourceType.ORGANIZATIONS, operation: CoreResourceOperation.READ },
+                },
+                {
+                    ref: 'organization-general-profile',
+                    label: 'Profile',
+                    target: { kind: SettingsSectionTargetKind.RESOURCE_OPERATION, resourceType: CoreResourceType.ORGANIZATION_PROFILES, operation: CoreResourceOperation.READ },
+                },
+                {
+                    ref: 'organization-general-preferences',
+                    label: 'Preferences',
+                    target: { kind: SettingsSectionTargetKind.RESOURCE_OPERATION, resourceType: CoreResourceType.ORGANIZATION_PREFERENCES, operation: CoreResourceOperation.READ },
+                },
+                {
+                    ref: 'organization-general-notifications',
+                    label: 'Notifications',
+                    target: { kind: SettingsSectionTargetKind.RESOURCE_OPERATION, resourceType: CoreResourceType.ORGANIZATION_NOTIFICATIONS, operation: CoreResourceOperation.READ },
+                },
+            ],
         },
     },
     {
@@ -197,6 +268,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // in this list (filter by status) rather than a parallel destination. The
         // invitee's own pending invitations live in the 'my-invitations' panel.
         ref: EngineSettingsDestinationRef.MEMBERS,
+        icon: StandardIconReference.USERS,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -210,6 +282,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // a unit hierarchy is a POPULATION you navigate. Nested, it was also reachable only by opening a
         // pane a reader had no other reason to open, which is a poor place to keep the org chart.
         ref: EngineSettingsDestinationRef.ORGANIZATION_UNITS,
+        icon: StandardIconReference.HIERARCHY,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -219,6 +292,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.BILLING,
+        icon: StandardIconReference.CREDIT_CARD,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },
         // THE billing home — a bespoke panel over the aggregated BillingContext
@@ -231,6 +305,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.API_KEYS,
+        icon: StandardIconReference.KEY,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -243,6 +318,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // an autonomous agent to a client (#1812). Management roles, although LIST admits any member, because every
         // other verb on the page — create, rotate, bind — is the administrator's.
         ref: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS,
+        icon: StandardIconReference.LINK,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -261,37 +337,19 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // operator is looking for it, since an application declares providers whether or not any tenant
         // has connected one.
         ref: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS,
+        icon: StandardIconReference.PLUG,
         requiredRoles: ORG_MANAGEMENT_ROLES,
-        // TWO tabs, for the person-scope destination's reason: "Connect" is a flow out to a vendor and
-        // has no resource behind it, while "Credentials" is the ordinary list of what the tenant HAS.
-        // Connect comes first because it is where the connection callback returns, carrying the outcome
-        // it has to render.
-        target: {
-            kind: SettingsSectionTargetKind.SUB_TABS,
-            subTabs: [
-                {
-                    ref: 'connect',
-                    label: 'Connect',
-                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS },
-                },
-                {
-                    ref: 'credentials',
-                    label: 'Credentials',
-                    target: {
-                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.ORG_PROVIDER_CREDENTIALS,
-                        operation: CoreResourceOperation.LIST,
-                    },
-                },
-            ],
-        },
+        // ONE panel, one list (#2319), for the person-scope destination's reason; the tenant's connections and the person's
+        // stay apart because the panel ref, and therefore the owner scope, differs.
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.ORGANIZATION_CONNECTED_ACCOUNTS },
     },
     // ── Organization · enterprise credentials & compliance ─────────
     // Each gates on org-admin role + a per-feature runtime capability
-    // (resource-registration presence). Multi-resource domains split into
+    // (whether the application OFFERS the feature; see the keys above). Multi-resource domains split into
     // sub-tabs pairing the singleton config (READ) with its collection (LIST).
     {
         ref: EngineSettingsDestinationRef.SSO,
+        icon: StandardIconReference.LOGIN,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         runtimeAvailability: { requiredCapabilities: [SSO_ENABLED_CAPABILITY] },
         entitlementFeatureId: CoreFeature.SINGLE_SIGN_ON,
@@ -321,8 +379,9 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.SCIM,
+        icon: StandardIconReference.USER_COG,
         requiredRoles: ORG_MANAGEMENT_ROLES,
-        runtimeAvailability: { requiredCapabilities: [SCIM_ENABLED_CAPABILITY] },
+        runtimeAvailability: { requiredCapabilities: [DirectoryProvisioningCapability.SETTINGS_REACHABLE] },
         entitlementFeatureId: CoreFeature.DIRECTORY_PROVISIONING,
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
@@ -330,6 +389,8 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
                 {
                     ref: 'scim-provisioning',
                     label: 'Provisioning',
+                    // Configures a directory, which a type without `scimProvisioning` cannot have: absent in the revoke-only view.
+                    runtimeAvailability: { requiredCapabilities: [DirectoryProvisioningCapability.ENABLED] },
                     target: {
                         kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
                         resourceType: CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG,
@@ -350,6 +411,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.SIEM,
+        icon: StandardIconReference.ACTIVITY,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         runtimeAvailability: { requiredCapabilities: [SIEM_ENABLED_CAPABILITY] },
         entitlementFeatureId: CoreFeature.SECURITY_EVENT_EXPORT,
@@ -379,6 +441,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.WEBHOOKS,
+        icon: StandardIconReference.WEBHOOK,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         runtimeAvailability: { requiredCapabilities: [WEBHOOKS_ENABLED_CAPABILITY] },
         entitlementFeatureId: CoreFeature.M2M_WEBHOOK_DELIVERY,
@@ -411,6 +474,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // application with no inbound handler simply shows an empty log. Not under WEBHOOKS, whose
         // entitlement is the OUTBOUND feature.
         ref: EngineSettingsDestinationRef.INBOUND_DELIVERIES,
+        icon: StandardIconReference.INBOX,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -419,30 +483,50 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         },
     },
     {
-        // Service-provider relationships (#1597), the CLIENT's side. No capability gate: placement is the
-        // gate — an application places it only when one of its organization types declares
-        // `servesAsProvider`, and an organization no firm serves simply shows an empty list.
-        ref: EngineSettingsDestinationRef.SERVICE_PROVIDERS,
+        // A2A push notifications for THIS organization's agent tasks (#2324). Not under WEBHOOKS, which is the outbound
+        // M2M notification feature behind its own entitlement; a push is the agent reporting on a task a client asked of
+        // it. Gated on AI_LLM for the reason given on the account section.
+        ref: EngineSettingsDestinationRef.AGENT_PUSH_DELIVERIES,
+        icon: StandardIconReference.NOTIFICATION,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_A2A_PUSH_DELIVERY_LOG,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Relationships between organizations (#1597, #2722), the GRANTING side. Shown only in an organization whose type
+        // grants in some kind: an organization nobody may represent has no relationships to register, and an application
+        // declaring no relationship kind shows it nowhere, with nothing for its author to delete.
+        ref: EngineSettingsDestinationRef.RELATIONSHIPS,
+        icon: StandardIconReference.HANDSHAKE,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [RelationshipSideCapability.GRANTS] },
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
             subTabs: [
                 {
-                    ref: 'service-providers-relationships',
-                    label: 'Firms',
+                    ref: 'relationships-organizations',
+                    label: 'Organizations',
                     target: {
                         kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_PROVIDER_RELATIONSHIPS,
+                        resourceType: CoreResourceType.ORGANIZATION_RELATIONSHIPS,
                         operation: CoreResourceOperation.LIST,
                     },
                 },
                 {
-                    // #1631: the administrative capabilities this organization lends its firms — grant, revoke, and when each ends.
-                    ref: 'service-providers-delegated-capabilities',
+                    // #1631: the administrative capabilities this organization lends the organizations that represent it — grant,
+                    // revoke, and when each ends.
+                    ref: 'relationships-delegated-capabilities',
                     label: 'Delegated capabilities',
+                    // Only where some kind this organization grants in lends a capability (#2722): under a kind that lends none
+                    // every grant is refused, so the tab would offer nothing that works.
+                    runtimeAvailability: { requiredCapabilities: [RelationshipSideCapability.LENDS] },
                     target: {
                         kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_PROVIDER_CAPABILITY_GRANTS,
+                        resourceType: CoreResourceType.RELATIONSHIP_CAPABILITY_GRANTS,
                         operation: CoreResourceOperation.LIST,
                     },
                 },
@@ -450,55 +534,58 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         },
     },
     {
-        // The FIRM's side (#1597): its mirror of each relationship, and who serves each client.
-        ref: EngineSettingsDestinationRef.SERVICE_CLIENTS,
+        // The REPRESENTING side (#1597, #2722): its mirror of each relationship, its invitations, its model cost and its
+        // people's activity in the organizations it represents (#2874). Shown
+        // only in an organization whose type represents in some kind: a granting-only organization has nobody to assign.
+        // Who serves each relationship is on that relationship's own page, its Team (#2589), not a tab of its own here; the
+        // list stays here as well as in the engine's Clients row, for an application that suppresses that row.
+        ref: EngineSettingsDestinationRef.REPRESENTATIONS,
+        icon: StandardIconReference.BRIEFCASE,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        runtimeAvailability: { requiredCapabilities: [RelationshipSideCapability.REPRESENTS] },
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
             subTabs: [
                 {
-                    ref: 'service-clients-engagements',
-                    label: 'Clients',
+                    ref: 'representations-organizations',
+                    label: 'Organizations',
                     target: {
                         kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_ENGAGEMENTS,
+                        resourceType: CoreResourceType.ORGANIZATION_REPRESENTATIONS,
                         operation: CoreResourceOperation.LIST,
                     },
                 },
                 {
-                    ref: 'service-clients-assignments',
-                    label: 'Assignments',
+                    // #2618: the granting organizations' owners this organization invited by email before they had an organization
+                    // here; each proposal reaches the organization its invitee creates once the address is proven.
+                    ref: 'representations-invitations',
+                    label: 'Invitations',
                     target: {
                         kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_ENGAGEMENT_ASSIGNMENTS,
+                        resourceType: CoreResourceType.RELATIONSHIP_INVITATIONS,
                         operation: CoreResourceOperation.LIST,
                     },
                 },
                 {
-                    // #1632: what the firm's own experts did in its clients — metadata only, and only when the firm switched it on.
-                    ref: 'service-clients-activity-feed',
-                    label: 'Expert activity',
-                    target: {
-                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED,
-                        operation: CoreResourceOperation.LIST,
-                    },
+                    // #2618: what this organization's own work cost, per case, organization worked in, agent or model. Its
+                    // administrator reads it; the section's roles are the ones that confer it.
+                    ref: 'representations-model-cost',
+                    label: 'Model cost',
+                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.REPRESENTING_ORGANIZATION_MODEL_COST_BREAKDOWN },
                 },
                 {
-                    // #1632: the firm owner's decision to collect it, with who, when, and the consultation-notice acknowledgement.
-                    ref: 'service-clients-activity-feed-settings',
-                    label: 'Expert activity feed',
-                    target: {
-                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-                        resourceType: CoreResourceType.SERVICE_PROVIDER_ACTIVITY_FEED_SETTINGS,
-                        operation: CoreResourceOperation.READ,
-                    },
+                    // #2874: what this organization's own people did in the organizations it represents, as far as each discloses
+                    // it. Its administrator reads it; the section's roles are the ones that confer it.
+                    ref: 'representations-activity',
+                    label: 'Activity',
+                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.REPRESENTATIVE_ACTIVITY },
                 },
             ],
         },
     },
     {
         ref: EngineSettingsDestinationRef.AUDIT_LOGS,
+        icon: StandardIconReference.SCROLL,
         requiredRoles: ORG_MANAGEMENT_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -506,17 +593,30 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        // Platform operators' access to this organization (#2323): the tenant's side of the Customer Lockbox record. The
+        // roles the resource admits — owner and administrator, and the delegated approver — because the approver is who
+        // this list is for. Not gated: every application has platform operators, and an organization nobody has asked
+        // about simply shows an empty list.
+        ref: EngineSettingsDestinationRef.OPERATOR_ACCESS,
+        icon: StandardIconReference.SHIELD,
+        requiredRoles: [...ORG_MANAGEMENT_ROLES, CORE_ORG_ROLES.ORG_DELEGATED_APPROVE_ACCESS_GRANTS],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.PLATFORM_ACCESS_GRANTS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
     {
         /**
-         * What this organization is entitled to, and — for a platform administrator — the console that
-         * changes it.
+         * What this organization is entitled to, read-only for everyone.
          *
          * **No `requiredRoles`, and that is the substantive decision.** `organizationFeatures` READ is
-         * `ORG_MEMBER`, so any member may see what their organization actually has; the three operations
-         * that MUTATE it (`enable_feature`, `disable_feature`, `reset_features`) plus UPDATE are
-         * `APP_ADMIN_SUPER_ADMIN` on the resource itself. One screen therefore serves both readers
-         * honestly — a read-only summary for a member, a grant/withdraw console for an operator — without
-         * this destination having to know which one is looking.
+         * `ORG_MEMBER`, so any member may see what their organization actually has. An organization does
+         * not manage its entitlements (Paul, 2026-10-02), so this page offers no verb to anybody, a
+         * super-administrator who is a member included (#2316). The operator changes a tenant's
+         * entitlements on the tenant directory's page for it (Administration → Organizations), through
+         * the crossed `admin` enable and disable.
          *
          * Gating it on org management instead would hide from members the exact page that explains why a
          * feature they were just told to upgrade for is unavailable, which is the moment it is worth most.
@@ -525,6 +625,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
          * the `{id}` segment for a one-to-one parent, and the factory declares no LIST at all.
          */
         ref: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS,
+        icon: StandardIconReference.BADGE_CHECK,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
             resourceType: CoreResourceType.ORGANIZATION_FEATURES,
@@ -537,7 +638,11 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // application-scoped. So it is placed with the tenant's settings rather than the operator's
         // catalogue, and gated on `ORG_OWNER` to match the resource's own READ/LIST roles.
         ref: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS,
+        icon: StandardIconReference.GIFT,
         requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],
+        // Referrals are a billing record: with billing off the backend does not register `REFERRALS`, so the page could
+        // only fail to load (#2314). The same gate as Billing.
+        runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
             resourceType: CoreResourceType.REFERRALS,
@@ -548,6 +653,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // The organization's preservation duties (#1634). ORG_OWNER, as the resource's READ / LIST: a hold stops the
         // tenant's retention schedule and its data subjects' erasures, and the owner is who places and releases it.
         ref: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS,
+        icon: StandardIconReference.SCALE,
         requiredRoles: [CORE_ORG_ROLES.ORG_OWNER],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -555,11 +661,27 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        // The qualifications the organization's people hold (#2967). ORG_ADMIN, as the resource's verbs; only where the
+        // application declares a qualification kind, since nothing else can be recorded.
+        ref: EngineSettingsDestinationRef.ORGANIZATION_PROFESSIONAL_QUALIFICATIONS,
+        icon: StandardIconReference.BADGE_CHECK,
+        requiredRoles: [CORE_ORG_ROLES.ORG_ADMIN],
+        runtimeAvailability: { requiredCapabilities: [PROFESSIONAL_QUALIFICATIONS_DECLARED_CAPABILITY] },
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.PROFESSIONAL_QUALIFICATIONS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
     {
         // Receiving email (#1600): the organization's own domains. No capability gate: the store exists in every
         // application, and one without an inbound email provider shows a claim that cannot reach the provider stage.
         ref: EngineSettingsDestinationRef.EMAIL_DOMAINS,
+        icon: StandardIconReference.GLOBE,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        // An address the application receives mail at exists only when it receives email (#2314).
+        requiredEngineCapabilities: [EngineCapability.EMAIL_INBOUND],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
             resourceType: CoreResourceType.ORGANIZATION_EMAIL_DOMAINS,
@@ -567,23 +689,96 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         },
     },
     {
-        // Receiving email (#1600), the FIRM's side: the mailboxes it keeps on its own domain for the clients it serves.
-        // Placement is the gate, as for `service-clients`.
-        ref: EngineSettingsDestinationRef.CLIENT_MAILBOXES,
+        // Receiving email (#1600), the REPRESENTING side: the mailboxes it keeps on its own domain for the organizations it
+        // represents. Gated on the representing side, as for `representations`.
+        ref: EngineSettingsDestinationRef.RELATIONSHIP_MAILBOXES,
+        icon: StandardIconReference.MAILBOX,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.EMAIL_INBOUND],
+        runtimeAvailability: { requiredCapabilities: [RelationshipSideCapability.REPRESENTS] },
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.RELATIONSHIP_MAILBOXES,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // Which chat account acts as which member (#2660). Org owner/admin, the roles the default LIST and DELETE accept.
+        // No capability gate, like inbound deliveries: the store exists in every application, and an application with no
+        // chat provider deletes the placement.
+        ref: EngineSettingsDestinationRef.CHAT_ACCOUNTS,
+        icon: StandardIconReference.CHAT,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.CHAT_IDENTITY_LINKS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // A member's own chat accounts, and where they unlink one (#2660). No `requiredRoles`: the `own` variants accept
+        // every member and confine both the list and the unlink to the caller's rows, so a role gate could only hide the
+        // screen from the person the security email sends here.
+        ref: EngineSettingsDestinationRef.MY_CHAT_ACCOUNTS,
+        icon: StandardIconReference.CHAT,
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.CHAT_IDENTITY_LINKS,
+            operation: CoreResourceOperation.LIST,
+            operationVariant: CHAT_IDENTITY_LINK_OWN_VARIANT_KEY,
+        },
+    },
+    {
+        // What THIS organization's agents did (#2528): every run held in its name — an A2A client's turn, an autonomous
+        // agent's run — with its origin, status, case, timing and transcript. Org owner/admin, the role the execution
+        // resource's READ and LIST accept on an organization row; AI_LLM, since an application with no agents has no runs.
+        ref: EngineSettingsDestinationRef.AGENT_RUNS,
+        icon: StandardIconReference.BRAIN,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_FLOW_ACTOR_EXECUTIONS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // The organization's autonomous agents (#2528): when each runs, its latest runs here, and the turns that did not run
+        // with the reason. Org owner/admin, the roles the read admits and the ones that bind a client to an agent; AI_LLM,
+        // since an application with no agents has none to show.
+        ref: EngineSettingsDestinationRef.AUTONOMOUS_AGENTS,
+        icon: StandardIconReference.CLOCK,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.AUTONOMOUS_AGENTS },
+    },
+    {
+        // Which declared chat agent answers the organization's people on each chat connection (#2665). Org owner/admin, the
+        // roles the resource's reads and writes accept; AI_LLM, since an application with no language model has no agent to
+        // choose. An application with no chat provider deletes the placement, as for the chat accounts.
+        ref: EngineSettingsDestinationRef.CHAT_AGENTS,
+        icon: StandardIconReference.CHAT,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
-            resourceType: CoreResourceType.CLIENT_MAILBOXES,
+            resourceType: CoreResourceType.ORGANIZATION_CHAT_SETTINGS,
             operation: CoreResourceOperation.LIST,
         },
     },
     {
-        // Experts' corrections to agent work (#1599). The rate first: it is what an administrator comes to read, and it
-        // needs neither setting. Then the two organization singletons (each page is its READ, created in its default state
-        // on first access), then the ledger the export authorisation governs. No capability gate: the records exist in
-        // every application with agents, and one without them shows an empty rate.
+        // Reviewers' corrections to agent work (#1599). The rate first: it is what an administrator comes to read, and it
+        // needs neither setting; then the decisions it is computed from, and the reports members made of agents' replies
+        // (#2842). Then the two organization singletons (each page is its READ, created in its default state
+        // on first access), then running an export under that authorisation, then the ledger it adds to.
+        //
+        // Gated on AI_LLM (#2314): an agent's work exists only in an application with a language model. Until then this
+        // section showed in every application with an empty rate, which read as a feature the product has and nobody
+        // uses rather than one it does not have.
         ref: EngineSettingsDestinationRef.AGENT_WORK_REVIEW,
+        icon: StandardIconReference.BRAIN,
         requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
             subTabs: [
@@ -592,6 +787,27 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
                     label: 'Override rate',
                     target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.AGENT_WORK_OVERRIDE_RATE },
                 },
+                {
+                    // The records the rate is computed from (#2324): each decision with its outcome, agent, tool and decider.
+                    ref: 'agent-work-decisions',
+                    label: 'Decisions',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATION_AGENT_WORK_DECISIONS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    // What the organization's members reported of its agents' replies (#2842): the triage queue, each report taken on
+                    // and resolved or dismissed from its drawer. The organization's administrators only, the role its LIST accepts.
+                    ref: 'agent-behavior-reports',
+                    label: 'Reports',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.AGENT_BEHAVIOR_REPORTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
                 {
                     ref: 'agent-work-content-capture',
                     label: 'Content capture',
@@ -610,6 +826,12 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
                         operation: CoreResourceOperation.READ,
                     },
                 },
+                {
+                    // Running one (#2327): an agent, a window and where the dataset goes, then the file. Beside the ledger it adds to.
+                    ref: 'agent-work-run-export',
+                    label: 'Run an export',
+                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.AGENT_WORK_EVALUATION_EXPORT },
+                },
                 {
                     ref: 'agent-work-exports',
                     label: 'Exports',
@@ -622,6 +844,18 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             ],
         },
     },
+    {
+        // #2292 R8: the organization's tightening of its agents' content guardrails. One page, the resource's READ.
+        ref: EngineSettingsDestinationRef.AGENT_POLICY,
+        icon: StandardIconReference.BRAIN,
+        requiredRoles: ORG_MANAGEMENT_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.ORGANIZATION_AGENT_POLICIES,
+            operation: CoreResourceOperation.READ,
+        },
+    },
     // ── Application administration ─────────────────────────────────
     //
     // The operator's own surfaces. An application places these in a category scoped to
@@ -636,6 +870,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     // would make an application's configuration depend on its own price list.
     {
         ref: EngineSettingsDestinationRef.APPLICATION_GENERAL,
+        icon: StandardIconReference.APP_WINDOW,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         // 1:1 with the application, so READ addresses it with no id segment.
         target: {
@@ -646,6 +881,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_VERSIONS,
+        icon: StandardIconReference.HISTORY,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -659,6 +895,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // does NOT enable it for any organization. An operator who cannot see both states cannot tell
         // which of the two refused a delivery.
         ref: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS,
+        icon: StandardIconReference.BADGE_CHECK,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -668,6 +905,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_API_KEYS,
+        icon: StandardIconReference.KEY,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -677,10 +915,11 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_SSO,
+        icon: StandardIconReference.LOGIN,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         // Two tabs mirroring the organization sibling: the singleton configuration, then the collection
-        // of connections. LIST rather than READ for the connections because the application variant's
-        // READ is an `INTERNAL_CALL` and has no route — only LIST is `API_CALL`.
+        // of connections. LIST rather than READ for the connections because the tab is the registry: a
+        // connection is opened (READ), created and edited from it — all of them routes since #2519.
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
             subTabs: [
@@ -710,6 +949,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // exist — the token resource is organization-scoped only. A second tab here would have nothing
         // to address.
         ref: EngineSettingsDestinationRef.APPLICATION_SCIM,
+        icon: StandardIconReference.USER_COG,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -719,6 +959,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_SIEM,
+        icon: StandardIconReference.ACTIVITY,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         // LIST for the dead-letter queue: its READ is `REPOSITORY_ONLY` and therefore route-less, same
         // as the organization sibling.
@@ -748,6 +989,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS,
+        icon: StandardIconReference.WEBHOOK,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.SUB_TABS,
@@ -806,6 +1048,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
          * itself, that "a price is meaningless without its product".
          */
         ref: EngineSettingsDestinationRef.BILLING_CATALOG,
+        icon: StandardIconReference.PACKAGE,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         runtimeAvailability: { requiredCapabilities: [BILLING_ENABLED_CAPABILITY] },
         target: {
@@ -834,6 +1077,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
     },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS,
+        icon: StandardIconReference.LINK,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -847,6 +1091,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
         // rule is supervised, and putting the supervision behind the thing it supervises would mean an
         // administrator needs an elevation to discover that elevations are being taken.
         ref: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS,
+        icon: StandardIconReference.SHIELD,
         requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -854,8 +1099,46 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        /**
+         * Every tenant of the application (#2315), listed through the governed `directory` variant: it
+         * needs an application-wide access grant a second administrator signed, and records each read.
+         *
+         * Two tabs, because the list is empty-by-refusal until a grant exists: the operator who lands
+         * here without one needs the place to request it next to the list that asked for it. A row opens
+         * the tenant through its crossed READ, which needs that tenant's own platform access grant.
+         */
+        ref: EngineSettingsDestinationRef.APPLICATION_ORGANIZATIONS,
+        icon: StandardIconReference.ORGANIZATION,
+        requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'application-organizations-directory',
+                    label: 'All organizations',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.ORGANIZATIONS,
+                        operation: CoreResourceOperation.LIST,
+                        operationVariant: 'directory',
+                    },
+                },
+                {
+                    ref: 'application-organizations-access-grants',
+                    label: 'Access windows',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.APPLICATION_ACCESS_GRANTS,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+            ],
+        },
+    },
     {
         ref: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES,
+        icon: StandardIconReference.INBOX,
         requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -863,9 +1146,114 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
+    {
+        // A2A push notifications for the application's own agent tasks — turns made with an application machine
+        // credential (#2324). Super-admin, like the application webhooks; gated on AI_LLM like its two siblings.
+        ref: EngineSettingsDestinationRef.APPLICATION_AGENT_PUSH_DELIVERIES,
+        icon: StandardIconReference.NOTIFICATION,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.APPLICATION_A2A_PUSH_DELIVERY_LOG,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // What the application's OWN agents did (#2528): the runs held at application scope, made with an application
+        // machine credential. Super-admin, the role the execution resource accepts on an application row; AI_LLM like its
+        // organization twin.
+        ref: EngineSettingsDestinationRef.APPLICATION_AGENT_RUNS,
+        icon: StandardIconReference.BRAIN,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.APPLICATION_FLOW_ACTOR_EXECUTIONS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // What reviewers did with agents' proposals in the application's OWN work (#2324): the application-scope decisions,
+        // the work no tenant owns. Only the decisions: the content-capture setting, the export authorisation and the
+        // export ledger are each an organization's own decision. Super-admin, the role the records accept; AI_LLM like
+        // the organization section.
+        ref: EngineSettingsDestinationRef.APPLICATION_AGENT_WORK_REVIEW,
+        icon: StandardIconReference.BRAIN,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.APPLICATION_AGENT_WORK_DECISIONS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // The agents suspended for the whole application (#2843): one page, the policy's READ (1:1 with the application, so
+        // no id segment; the first read creates the empty row), carrying Suspend and Resume. Super-admin, the role both verbs
+        // require: the READ also admits an application viewer, but a viewer would land on a page whose only actions refuse
+        // them. AI_LLM like the organization's agent policy.
+        ref: EngineSettingsDestinationRef.APPLICATION_AGENT_POLICY,
+        icon: StandardIconReference.BRAIN,
+        requiredRoles: APPLICATION_ADMINISTRATION_ROLES,
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.APPLICATION_AGENT_POLICIES,
+            operation: CoreResourceOperation.READ,
+        },
+    },
+    {
+        // Which organization unit each partition of the operator's ERP belongs to (#2324): the edge unit narrowing reads to
+        // keep a subsidiary's members to their own company's rows. The deployment's own configuration, so super-admin
+        // only, and the resource is application-scoped for that reason. Not gated: an application that declares no
+        // partitioned system of record simply has an empty list here.
+        ref: EngineSettingsDestinationRef.APPLICATION_SYSTEM_OF_RECORD_PARTITIONS,
+        icon: StandardIconReference.ORGANIZATION,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+        target: {
+            kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+            resourceType: CoreResourceType.SYSTEM_OF_RECORD_PARTITION_ASSIGNMENTS,
+            operation: CoreResourceOperation.LIST,
+        },
+    },
+    {
+        // What the application's model calls cost (#2324, #2528). The two roles the records and the summary accept,
+        // because the billing manager is who reconciles this against invoices. Only an application that calls models has
+        // anything to show.
+        //
+        // Two tabs. By month first: each organization's spend per month and currency, the records invoices are reconciled
+        // against, and what this section showed alone (so a link to the section still opens it). Then the breakdown: the same
+        // spend per case, organization, agent or model over a window, in money, which is what an organization that bills its
+        // work (a firm, say) prices it from.
+        ref: EngineSettingsDestinationRef.APPLICATION_MODEL_COSTS,
+        icon: StandardIconReference.RECEIPT,
+        requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_ADMIN_BILLING_MANAGER],
+        requiredEngineCapabilities: [EngineCapability.AI_LLM],
+        target: {
+            kind: SettingsSectionTargetKind.SUB_TABS,
+            subTabs: [
+                {
+                    ref: 'model-costs-by-month',
+                    label: 'By month',
+                    target: {
+                        kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
+                        resourceType: CoreResourceType.MODEL_COST_PERIOD_AGGREGATES,
+                        operation: CoreResourceOperation.LIST,
+                    },
+                },
+                {
+                    ref: 'model-costs-breakdown',
+                    label: 'Breakdown',
+                    target: { kind: SettingsSectionTargetKind.ENGINE_PANEL, panelRef: SettingsPanelRef.MODEL_COST_BREAKDOWN },
+                },
+            ],
+        },
+    },
     {
         // Both roles the records accept, like the audit trail below: the evidence reader is who this record is for.
         ref: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT,
+        icon: StandardIconReference.CLOCK,
         requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -885,6 +1273,7 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
          * `APPLICATION_ADMINISTRATION_ROLES`.
          */
         ref: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS,
+        icon: StandardIconReference.SCROLL,
         requiredRoles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN, CORE_APP_ROLES.APP_AUDIT_EVIDENCE_READER],
         target: {
             kind: SettingsSectionTargetKind.RESOURCE_OPERATION,
@@ -892,10 +1281,21 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
             operation: CoreResourceOperation.LIST,
         },
     },
-    // NO tenant-directory and NO user-directory destination here, deliberately — see the note under
-    // `EngineSettingsDestinationRef` for why neither is a placement problem. Both reads that look like
-    // they would serve one are confined or grant-gated ON PURPOSE, and placing them would advertise a
-    // population the section cannot actually show.
+    // NO user-directory destination here, deliberately — see the note under `EngineSettingsDestinationRef`.
+    // The tenant directory is APPLICATION_ORGANIZATIONS above, through the governed `directory` read.
+];
+/**
+ * The rail's sub-categories (#2329), shared by the Organization and Administration categories so the same kind of
+ * surface sits under the same heading in both. A proposal: an application declares its own `groups` and `groupRef`s.
+ * The general and identity-of-the-scope entries (General, Organizations, Versions) stay above the groups.
+ */
+export const SCAFFOLD_SETTINGS_RAIL_GROUPS = [
+    { ref: 'people', label: 'People', order: 0 },
+    { ref: 'billing', label: 'Billing & entitlements', order: 1 },
+    { ref: 'security', label: 'Security & access', order: 2 },
+    { ref: 'integrations', label: 'Integrations', order: 3 },
+    { ref: 'compliance', label: 'Compliance', order: 4 },
+    { ref: 'ai', label: 'AI', order: 5 },
 ];
 /**
  * The full placement set `wildo init` scaffolds into a new application's config.
@@ -919,13 +1319,13 @@ export const ENGINE_SETTINGS_DESTINATIONS = [
 export const SCAFFOLD_SETTINGS_HUB_CONFIG = {
     categories: [
         { ref: 'account', label: 'Account', scope: ResourcePrimaryScope.USER_SELF, order: 0 },
-        { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1 },
+        { ref: 'organization', label: 'Organization', scope: ResourcePrimaryScope.ORGANIZATIONS, order: 1, groups: SCAFFOLD_SETTINGS_RAIL_GROUPS },
         // The operator's own scope. Scaffolded like everything else so a new application starts
         // complete: `APPLICATION` scope plus `APP_ADMIN_SUPER_ADMIN` on every destination means an
         // ordinary member never sees the heading, and a category whose sections are all gated out is
         // dropped rather than rendered empty — so placing it costs an application nothing and NOT
         // placing it would hide the whole administration surface behind documentation.
-        { ref: 'administration', label: 'Administration', scope: ResourcePrimaryScope.APPLICATION, order: 2 },
+        { ref: 'administration', label: 'Administration', scope: ResourcePrimaryScope.APPLICATION, order: 2, groups: SCAFFOLD_SETTINGS_RAIL_GROUPS },
     ],
     placements: [
         /*
@@ -952,52 +1352,85 @@ export const SCAFFOLD_SETTINGS_HUB_CONFIG = {
         // Same label as the organization placement below, deliberately: it is the same feature, and the
         // CATEGORY is what says whose integrations these are.
         { destinationRef: EngineSettingsDestinationRef.MY_PROVIDER_CREDENTIALS, categoryRef: 'account', label: 'Integrations', order: 5 },
+        { destinationRef: EngineSettingsDestinationRef.AUTHORIZED_APPS, categoryRef: 'account', label: 'Authorized apps', order: 6 },
+        { destinationRef: EngineSettingsDestinationRef.MY_AGENT_PUSH_DELIVERIES, categoryRef: 'account', label: 'Agent push deliveries', order: 7 },
+        // Last in Account, where a step that ends the person's own access belongs.
+        { destinationRef: EngineSettingsDestinationRef.DEACTIVATE_ACCOUNT, categoryRef: 'account', label: 'Deactivate account', order: 8 },
         { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_GENERAL, categoryRef: 'organization', label: 'General', order: 0 },
-        { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', label: 'Members', order: 1 },
+        { destinationRef: EngineSettingsDestinationRef.MEMBERS, categoryRef: 'organization', groupRef: 'people', label: 'Members', order: 1 },
         // Beside Members, because the two are the same KIND of surface — who is in this tenant, and how
         // it is arranged — and a reader looking for one is usually looking for the other.
-        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_UNITS, categoryRef: 'organization', label: 'Organization units', order: 2 },
-        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS, categoryRef: 'organization', label: 'Entitlements', order: 3 },
-        { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', label: 'Billing', order: 4 },
-        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS, categoryRef: 'organization', label: 'Referrals', order: 5 },
-        { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', label: 'API keys', order: 6 },
-        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS, categoryRef: 'organization', label: 'OAuth clients', order: 7 },
-        { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', label: 'Integrations', order: 8 },
-        { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', label: 'SSO — OIDC / SAML', order: 9 },
-        { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', label: 'SCIM provisioning', order: 10 },
-        { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', label: 'SIEM export', order: 11 },
-        { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', label: 'Webhooks', order: 12 },
-        { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', label: 'Audit log', order: 13 },
-        { destinationRef: EngineSettingsDestinationRef.INBOUND_DELIVERIES, categoryRef: 'organization', label: 'Inbound deliveries', order: 14 },
-        // Scaffolded like everything else so a new application starts complete: an application with no
-        // organization type declaring `servesAsProvider` deletes these two lines.
-        { destinationRef: EngineSettingsDestinationRef.SERVICE_PROVIDERS, categoryRef: 'organization', label: 'Service providers', order: 15 },
-        { destinationRef: EngineSettingsDestinationRef.SERVICE_CLIENTS, categoryRef: 'organization', label: 'Clients', order: 16 },
-        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS, categoryRef: 'organization', label: 'Legal holds', order: 17 },
-        // Receiving email (#1600). An application with no inbound email provider deletes these; one whose organization
-        // types declare no `servesAsProvider` deletes `client-mailboxes`.
-        { destinationRef: EngineSettingsDestinationRef.EMAIL_DOMAINS, categoryRef: 'organization', label: 'Email domains', order: 18 },
-        { destinationRef: EngineSettingsDestinationRef.CLIENT_MAILBOXES, categoryRef: 'organization', label: 'Client mailboxes', order: 19 },
-        // Experts' corrections to agent work (#1599). An application with no agents deletes it.
-        { destinationRef: EngineSettingsDestinationRef.AGENT_WORK_REVIEW, categoryRef: 'organization', label: 'Agent work review', order: 20 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_UNITS, categoryRef: 'organization', groupRef: 'people', label: 'Organization units', order: 2 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_ENTITLEMENTS, categoryRef: 'organization', groupRef: 'billing', label: 'Entitlements', order: 3 },
+        { destinationRef: EngineSettingsDestinationRef.BILLING, categoryRef: 'organization', groupRef: 'billing', label: 'Billing', order: 4 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_REFERRALS, categoryRef: 'organization', groupRef: 'billing', label: 'Referrals', order: 5 },
+        { destinationRef: EngineSettingsDestinationRef.API_KEYS, categoryRef: 'organization', groupRef: 'security', label: 'API keys', order: 6 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_OAUTH_CLIENTS, categoryRef: 'organization', groupRef: 'security', label: 'OAuth clients', order: 7 },
+        { destinationRef: EngineSettingsDestinationRef.PROVIDER_CREDENTIALS, categoryRef: 'organization', groupRef: 'integrations', label: 'Integrations', order: 8 },
+        { destinationRef: EngineSettingsDestinationRef.SSO, categoryRef: 'organization', groupRef: 'security', label: 'SSO — OIDC / SAML', order: 9 },
+        { destinationRef: EngineSettingsDestinationRef.SCIM, categoryRef: 'organization', groupRef: 'security', label: 'SCIM provisioning', order: 10 },
+        { destinationRef: EngineSettingsDestinationRef.SIEM, categoryRef: 'organization', groupRef: 'compliance', label: 'SIEM export', order: 11 },
+        { destinationRef: EngineSettingsDestinationRef.WEBHOOKS, categoryRef: 'organization', groupRef: 'integrations', label: 'Webhooks', order: 12 },
+        // Beside Webhooks, because both answer "did our endpoint get told", but its own entry: a different feature with a
+        // different gate. An application with no agents deletes it, like the two others.
+        { destinationRef: EngineSettingsDestinationRef.AGENT_PUSH_DELIVERIES, categoryRef: 'organization', groupRef: 'integrations', label: 'Agent push deliveries', order: 13 },
+        { destinationRef: EngineSettingsDestinationRef.AUDIT_LOGS, categoryRef: 'organization', groupRef: 'compliance', label: 'Audit log', order: 14 },
+        // Beside the audit log: both are the record of who did what to this organization, and an operator's access is one of those acts.
+        { destinationRef: EngineSettingsDestinationRef.OPERATOR_ACCESS, categoryRef: 'organization', groupRef: 'security', label: 'Operator access', order: 15 },
+        { destinationRef: EngineSettingsDestinationRef.INBOUND_DELIVERIES, categoryRef: 'organization', groupRef: 'integrations', label: 'Inbound deliveries', order: 16 },
+        // Scaffolded like everything else so a new application starts complete. Each shows only in an organization whose
+        // type takes that side of some relationship kind, so an application declaring no `organizationRelationships`
+        // shows neither and need not delete them.
+        { destinationRef: EngineSettingsDestinationRef.RELATIONSHIPS, categoryRef: 'organization', groupRef: 'people', label: 'Relationships', order: 17 },
+        { destinationRef: EngineSettingsDestinationRef.REPRESENTATIONS, categoryRef: 'organization', groupRef: 'people', label: 'Representations', order: 18 },
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_LEGAL_HOLDS, categoryRef: 'organization', groupRef: 'compliance', label: 'Legal holds', order: 19 },
+        // Receiving email (#1600). An application with no inbound email provider deletes these. `relationship-mailboxes` shows
+        // only in an organization whose type represents in some relationship kind.
+        { destinationRef: EngineSettingsDestinationRef.EMAIL_DOMAINS, categoryRef: 'organization', groupRef: 'integrations', label: 'Email domains', order: 20 },
+        { destinationRef: EngineSettingsDestinationRef.RELATIONSHIP_MAILBOXES, categoryRef: 'organization', groupRef: 'integrations', label: 'Relationship mailboxes', order: 21 },
+        // Chat (#2660). The member's own entry is in the ORGANIZATION category because a link belongs to one organization;
+        // an application with no chat provider deletes both.
+        { destinationRef: EngineSettingsDestinationRef.MY_CHAT_ACCOUNTS, categoryRef: 'organization', groupRef: 'integrations', label: 'My chat accounts', order: 22 },
+        { destinationRef: EngineSettingsDestinationRef.CHAT_ACCOUNTS, categoryRef: 'organization', groupRef: 'integrations', label: 'Chat accounts', order: 23 },
+        // Reviewers' corrections to agent work (#1599). An application with no agents deletes it.
+        { destinationRef: EngineSettingsDestinationRef.AGENT_WORK_REVIEW, categoryRef: 'organization', groupRef: 'ai', label: 'Agent work review', order: 24 },
+        // What the organization's agents did (#2528), beside what its reviewers decided about that work.
+        { destinationRef: EngineSettingsDestinationRef.AGENT_RUNS, categoryRef: 'organization', groupRef: 'ai', label: 'Agent runs', order: 25 },
+        // Which agents run here unattended, and what stopped the ones that did not (#2528).
+        { destinationRef: EngineSettingsDestinationRef.AUTONOMOUS_AGENTS, categoryRef: 'organization', groupRef: 'ai', label: 'Autonomous agents', order: 26 },
+        // Which agent answers in chat (#2665), beside the agents that run unattended. An application with no chat provider deletes it.
+        { destinationRef: EngineSettingsDestinationRef.CHAT_AGENTS, categoryRef: 'organization', groupRef: 'ai', label: 'Chat agents', order: 27 },
+        // What the organization's agents' models may be sent and write (#2292), tightened beyond what each agent declares.
+        { destinationRef: EngineSettingsDestinationRef.AGENT_POLICY, categoryRef: 'organization', groupRef: 'ai', label: 'Agent policy', order: 28 },
+        // Who among the organization's people holds which professional qualification (#2967). Shown only where the
+        // application declares a qualification kind, so an application without one need not delete it.
+        { destinationRef: EngineSettingsDestinationRef.ORGANIZATION_PROFESSIONAL_QUALIFICATIONS, categoryRef: 'organization', groupRef: 'people', label: 'Professional qualifications', order: 29 },
         // Administration mirrors the organization order — General, the population, entitlements and
         // commerce, then the integration surfaces in the same sequence — so an operator who has learned
         // one rail has learned the other, and the scope distinction reads as a scope distinction rather
         // than as two unrelated menus.
         { destinationRef: EngineSettingsDestinationRef.APPLICATION_GENERAL, categoryRef: 'administration', label: 'General', order: 0 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS, categoryRef: 'administration', label: 'Entitlements', order: 1 },
-        { destinationRef: EngineSettingsDestinationRef.BILLING_CATALOG, categoryRef: 'administration', label: 'Plans & pricing', order: 2 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_API_KEYS, categoryRef: 'administration', label: 'API keys', order: 3 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS, categoryRef: 'administration', label: 'OAuth clients', order: 4 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SSO, categoryRef: 'administration', label: 'SSO — OIDC / SAML', order: 5 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SCIM, categoryRef: 'administration', label: 'SCIM provisioning', order: 6 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SIEM, categoryRef: 'administration', label: 'SIEM export', order: 7 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS, categoryRef: 'administration', label: 'Webhooks', order: 8 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS, categoryRef: 'administration', label: 'Audit log', order: 9 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS, categoryRef: 'administration', label: 'Access grants', order: 10 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_VERSIONS, categoryRef: 'administration', label: 'Versions', order: 11 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES, categoryRef: 'administration', label: 'Inbound deliveries', order: 12 },
-        { destinationRef: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT, categoryRef: 'administration', label: 'Retention enforcement', order: 13 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_ORGANIZATIONS, categoryRef: 'administration', label: 'Organizations', order: 1 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SYSTEM_OF_RECORD_PARTITIONS, categoryRef: 'administration', label: 'System-of-record partitions', order: 2 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_ENTITLEMENTS, categoryRef: 'administration', groupRef: 'billing', label: 'Entitlements', order: 3 },
+        { destinationRef: EngineSettingsDestinationRef.BILLING_CATALOG, categoryRef: 'administration', groupRef: 'billing', label: 'Plans & pricing', order: 4 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_MODEL_COSTS, categoryRef: 'administration', groupRef: 'billing', label: 'Model costs', order: 5 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_API_KEYS, categoryRef: 'administration', groupRef: 'security', label: 'API keys', order: 6 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_OAUTH_CLIENTS, categoryRef: 'administration', groupRef: 'security', label: 'OAuth clients', order: 7 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SSO, categoryRef: 'administration', groupRef: 'security', label: 'SSO — OIDC / SAML', order: 8 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SCIM, categoryRef: 'administration', groupRef: 'security', label: 'SCIM provisioning', order: 9 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_SIEM, categoryRef: 'administration', groupRef: 'compliance', label: 'SIEM export', order: 10 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_WEBHOOKS, categoryRef: 'administration', groupRef: 'integrations', label: 'Webhooks', order: 11 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AGENT_PUSH_DELIVERIES, categoryRef: 'administration', groupRef: 'integrations', label: 'Agent push deliveries', order: 12 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AUDIT_LOGS, categoryRef: 'administration', groupRef: 'compliance', label: 'Audit log', order: 13 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_ACCESS_GRANTS, categoryRef: 'administration', groupRef: 'security', label: 'Access grants', order: 14 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_VERSIONS, categoryRef: 'administration', label: 'Versions', order: 15 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_INBOUND_DELIVERIES, categoryRef: 'administration', groupRef: 'integrations', label: 'Inbound deliveries', order: 16 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_RETENTION_ENFORCEMENT, categoryRef: 'administration', groupRef: 'compliance', label: 'Retention enforcement', order: 17 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AGENT_WORK_REVIEW, categoryRef: 'administration', groupRef: 'ai', label: 'Agent work review', order: 18 },
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AGENT_RUNS, categoryRef: 'administration', groupRef: 'ai', label: 'Agent runs', order: 19 },
+        // Which agents are switched off for every organization (#2843), beside what the application's agents did.
+        { destinationRef: EngineSettingsDestinationRef.APPLICATION_AGENT_POLICY, categoryRef: 'administration', groupRef: 'ai', label: 'Agent policy', order: 20 },
     ],
     defaultSectionRef: 'profile',
 };