> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # How CloudThinker Works > Learn the concepts behind every CloudThinker product, from organizations and connections to agents, skills, approvals, and memory. CloudThinker is built from a few pieces: an organization holds workspaces, and each workspace holds the connections, agents, skills, approvals, and memory that every product runs on. Learn these once and every product page reads the same way. ```mermaid theme={null} flowchart TB Org["Organization
billing, plan, members, SSO"] --> WS["Workspace
one isolated environment"] WS --> Conn["Connections
AWS, GitHub, Datadog..."] WS --> Agents["Agents
CloudThinker + custom agents"] WS --> Ctx["Skills, knowledge, memory"] WS --> Appr["Approvals
Rules, Approval mode, approvers"] Conn --> Agents Ctx --> Agents Agents -->|every write| Appr Agents --> Products["Products
Resolve, Review, Cyber, Optimize"] ``` ## The concepts at a glance | Concept | What it is | Where you manage it | | - | - | - | | [Organization](https://docs.cloudthinker.io/guide/organization.md) | The billing and membership boundary. Owns the plan, credits, members, and single sign-on. | Admin Settings | | [Workspace](https://docs.cloudthinker.io/guide/workspaces.md) | An isolated environment inside the organization, such as production and staging, or one per team. Holds connections, chats, and data. | Workspace selector at the top of the sidebar | | [Connection](https://docs.cloudthinker.io/guide/connections/overview.md) | A credential for one external system: an AWS account, a Kubernetes cluster, a GitHub organization. | **More → Workspace settings → Connections** | | [Agent](https://docs.cloudthinker.io/guide/agents/overview.md) | The AI that reads your request, uses connections to look things up, and answers or acts. | **More → Workspace settings → Agents** | | [Skill](https://docs.cloudthinker.io/guide/skills/overview.md) | A reusable instruction set for one kind of task, run from the `/` menu or picked up when relevant. | **More → Workspace settings → Skills** | | [Knowledge](https://docs.cloudthinker.io/guide/knowledge.md) | Your runbooks, policies, and docs, uploaded or crawled, for agents to cite. | **More → Workspace settings → Knowledge** | | [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md) | The checks every write passes before it runs: Rules, the Approval mode, and approvers. | **Approvals** in the sidebar (applies to the current workspace) | | [Memory](https://docs.cloudthinker.io/guide/memory.md) | What agents remember between conversations about your environment and preferences. | **More → Workspace settings → Memory** | ## Organization and workspaces Signing up creates an organization with one workspace. Everything you connect or build lives in a workspace, and nothing crosses between workspaces unless you set it up. | Lives in the organization | Lives in each workspace | | - | - | | Billing, plan, and credits | Connections and [credentials](https://docs.cloudthinker.io/guide/credentials.md) | | Members and org roles: Owner, Admin, Developer, Viewer | Custom agents, skills, knowledge, and memory | | Single sign-on and audit logs | Automations, commands, and approval settings | Org Owners and Admins are Admins in every workspace. Everyone else gets a workspace role per workspace: | Workspace role | Chat with CloudThinker | Create custom agents | Add connections, change approval rules and mode | | - | - | - | - | | **Admin** | Yes | Yes | Yes | | **Developer** | Yes | Yes | No, view only | | **Viewer** | No | No, view only | No, view only | Who can approve a write is set separately, through [approvers](https://docs.cloudthinker.io/guide/approvals/approvers.md). [Workspace permissions](https://docs.cloudthinker.io/guide/security/roles.md#workspace-permissions) has the full list. > [!TIP] > > Use separate workspaces for production and non-production. A connection, its permissions, and its approval settings then can't leak between them. ## Connections set the outer limit An agent can only see and act on what the workspace's connections allow. If your AWS role is read-only, no agent can change your AWS account, whatever your approval settings say. Start with read-only access and widen it when you want agents to make changes. ## Agents | Agent | What it does | How you reach it | | - | - | - | | **CloudThinker** | The built-in assistant. Always on, can use every connection in the workspace. For a big question it starts short-lived [subagents](https://docs.cloudthinker.io/guide/agents/overview.md#subagents) to check several things at once, then merges their results into one answer. | Send a message with no mention, or mention `@CloudThinker` | | [Custom agents](https://docs.cloudthinker.io/guide/agents/customize.md) | Agents your team creates, each with its own instructions and only the connections you assign. | Mention it, such as `@db-reviewer` | A request follows the pattern `@agent #connection request`, and both parts are optional. Plain language works: ```text theme={null} Which pods in the production namespace restarted more than 3 times in the last 24 hours, and why? ``` See [Commands](https://docs.cloudthinker.io/guide/commands.md) for the full syntax. ## Skills, knowledge, and memory These three give agents context before you type anything. Each has a different owner. | | Holds | Who adds it | Use it when | | - | - | - | - | | [Skills](https://docs.cloudthinker.io/guide/skills/overview.md) | Step-by-step instructions for one kind of task | You; a custom agent whose **Skill Learning** setting is **Auto** or **Offer**; and [Dreaming](https://docs.cloudthinker.io/guide/memory-dreaming.md), which runs nightly by default and can create, update, merge, and delete custom skills | The same procedure should run the same way every time | | [Knowledge](https://docs.cloudthinker.io/guide/knowledge.md) | Your documents, as written | You, by uploading files or crawling sites | Agents should quote your runbook or policy | | [Memory](https://docs.cloudthinker.io/guide/memory.md) | Short notes about your environment, preferences, and recent events | Agents, as they work. Admins edit or delete it directly; anyone who can chat can ask CloudThinker to change it | You're tired of re-explaining your setup | Every night, [Dreaming](https://docs.cloudthinker.io/guide/memory-dreaming.md) tidies memory: it merges duplicates and removes what's outdated. It's on by default. A workspace Admin can turn it off. Each run's summary of what it changed is under **More → Workspace settings → Memory → Run history**. To get a deleted memory item back, ask CloudThinker to restore it from its revision history. A custom skill Dreaming deletes can't be restored. ## Approvals gate every change Reads always run. A write (anything that changes a system) is checked in this order: 1. **Always blocked.** A built-in list of calls that never run, such as stopping CloudTrail logging, closing an AWS account, or deleting the `kube-system` namespace. No person or Rule can override it. 2. **Rules.** Each Rule allows a kind of write, asks a person first, or denies it. **Deny** and **Ask first** Rules apply in every mode. See [Rules](https://docs.cloudthinker.io/guide/approvals/rules.md). Rules decide only when Rule enforcement is on for your workspace. It's off by default, and CloudThinker turns it on per workspace. While the **Rules** step on **Approvals** says **In preview**, Rules only record what they would decide, and the Approval mode alone decides. See [Rules troubleshooting](https://docs.cloudthinker.io/guide/approvals/rules.md#troubleshooting). 3. **Approval mode.** Decides what's left. See [Approval mode](https://docs.cloudthinker.io/guide/approvals/approval-mode.md). | Mode | What happens to a write no Deny or Ask first Rule caught | | - | - | | **Manual** | A person approves it, even one an Allow Rule covers. | | **Auto · Rules · Ask me** | An Allow Rule runs it. Anything no Rule covers waits for a person. | | **Auto · Rules · Refuse** | An Allow Rule runs it. Anything no Rule covers is refused. | | **Auto · Rules + AI · Ask me** | An Allow Rule runs it. AI judgment can allow a safe write no Rule covers. The rest wait for a person. | | **Auto · Rules + AI · Refuse** | An Allow Rule runs it. AI judgment can allow a safe write no Rule covers. The rest are refused. | When a write waits, the approval card goes to your [approvers](https://docs.cloudthinker.io/guide/approvals/approvers.md), the people allowed to answer it. AI judgment counts a write as safe when it matches what you asked for and stays in that scope, such as adding the tag you requested to the resource you named. A destructive write, or one with an unclear effect, goes to a person or is refused. New workspaces start on **Auto · Rules + AI · Ask me**. You can set a different mode for one chat from the prompt box. ## The products CloudThinker has four products: Resolve, Review, Cyber, and Optimize. Each investigates one kind of problem and needs only its own connection, so [pick the first one](https://docs.cloudthinker.io/index.md#products) and add the rest later. Approvals, Customize, and Automation aren't products. They're supporting areas that work across all four: Approvals decides which writes run, Customize shapes the agents with your own agents, skills, and knowledge, and Automation runs them on a schedule or an event. Memory belongs to the workspace, so what agents learn in one run is there for later runs in the same workspace, whichever product starts them. ## Where results show up | Place | What you find there | | - | - | | [Home](https://docs.cloudthinker.io/guide/activity.md) | **Needs you** (approvals and decisions waiting on you), **Products**, and **Automation today** | | [Activity](https://docs.cloudthinker.io/guide/activity.md#find-a-past-report-in-activity) | Every report agents have sent you, searchable and filterable | | **Investigation** in the sidebar | Every incident, its root cause, evidence, and proposed fix | | **Automations → Runs** | Every run of every automation, with its status and chat | | [Artifacts](https://docs.cloudthinker.io/guide/artifacts/overview.md) | Dashboards, reports, and files agents built for you | ## Related > **[Quickstart](https://docs.cloudthinker.io/quickstart.md)** > > Put these concepts to work: connect a system and get your first answer in about 10 minutes > **[Agents](https://docs.cloudthinker.io/guide/agents/overview.md)** > > See how CloudThinker, subagents, and custom agents share the work > **[Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md)** > > Decide which changes run on their own and which wait for a person > **[Glossary](https://docs.cloudthinker.io/guide/glossary.md)** > > Look up any term you meet in the product or these docs This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.