Administer Maia

Use the dashboard

Understand the local administration surface and protect it before network exposure.

The dashboard is Maia's administration interface for configuring messaging gateways, managing users and dashboard access, governing file and folder permissions, reviewing approvals, and operating models, automations, logs, and service health. It runs inside the Maia installation you control.

Start the dashboard

maia dashboard

Useful operating commands:

maia dashboard --port 9119
maia dashboard --no-open
maia dashboard --status
maia dashboard --stop

Expected result. Maia prints the local dashboard address and the browser shows the status or onboarding page.

The plain maia command opens this same dashboard and browser chat. Both commands bind to 127.0.0.1 by default, so another computer cannot connect unless you deliberately add a protected access layer.

Use the right surface

Surface	Use it for
Status	Version, health, gateway state, sessions, and governance posture.
Onboarding	First-time model, gateway, governance, and security-baseline tasks.
Governance → People	Authorize identities, assign roles and existing teams, and manage individual file or folder grants.
Governance → Teams	Create teams, manage membership, team grants, and bounded delegated roots.
Governance → File Access	Review policies first, add role/team/user policies, and configure protected writes.
Governance → Approvals / Settings	Review protected changes and configure the remaining governance controls.
Dashboard Access	Approve, deny, revoke, or restore requests to sign in to the administration interface.
Knowledge	Review shared memory and skill changes.
Cron	Create schedules and decide whether runs require authorization.
Logs	Inspect runtime, gateway, error, and audit events.

Keep the local default

By default, the dashboard listens on 127.0.0.1. Only processes and browsers on the same machine can reach that address.

Do not treat a host check as authentication.

Before binding the dashboard to a LAN or public interface, enable dashboard authentication, configure role gates, and place the service behind a trusted network boundary and TLS reverse proxy.

Choose a protected remote-access boundary

If administrators need remote browser access, consider Tailscale Serve for a private tailnet. When an identity-aware public endpoint is required, use Cloudflare Tunnel together with Cloudflare Access.

Keep Maia's dashboard authentication enabled behind either service, use TLS, restrict the upstream to the access layer, and never use --insecure as a permanent deployment mode.

Keep the dashboard local when chat is enough

An authenticated system admin can ask Maia in a private messaging conversation to admit a user, assign roles and teams, manage direct file grants, create delegated roots, or update folder policies. Maia derives the requester from the gateway event and authorizes every operation again. Team managers can change file policy only inside delegated roots and for their own members.

This flow never changes provider secrets or dashboard credentials. Protected file edits can also continue without opening the dashboard: Maia mentions the selected manager or administrator in the shared gateway conversation, then rechecks that person's authenticated turn when they respond naturally.

Grant dashboard access deliberately

Add the person's stable gateway identity to Governance and assign appropriate roles and teams.
Ask the governed user to send /dashboard in a private channel supported by the configured gateway.
Review the request under Dashboard Access.
Approve only the roles required for that person's administrative work.
Ask the user to send /dashboard again to receive a short-lived sign-in token.

Most employees should use Maia through a gateway and should not receive dashboard access.