Before you begin

Helmhive runs as a dedicated installation for your organisation. Some steps in these docs are done in the console by a workspace administrator; a few are done outside it by the people who deploy and run the installation. This page tells the two apart so you always know who to ask.

Your operator

Throughout the docs, your operator means the team that deploys and runs your Helmhive installation and its runner hosts. For installations managed by Wavyzz, that is the Wavyzz team; for an installation your own platform team runs, it is them. The operator owns everything that lives on a host rather than in the console:

• the deployment bootstrap secret used once to create the workspace;
• the GitHub App configuration, if you use GitHub;
• runner hosts: deploying an AI or deployment runner with the one-time token the console shows, and signing in to the AI provider on that host;
• runner images: the released Helmhive runner image and any derived image you register as an execution environment;
• outbound email for invitations;
• the deployment execution gate (which targets and adapters may execute).

Everything else, from repository sources to approvals, is done in the console by workspace administrators and service roles.

The first sign-in creates the workspace

1. Sign in with your platform account. Its email address must be verified.
2. On a fresh installation you land on Set up your workspace (Workspace setup · 1 of 2). Enter a Workspace name, a Workspace slug (lowercase words separated by hyphens), and the Deployment bootstrap secret your operator gives you once.
3. Choose Create workspace and continue. The signed-in account becomes the workspace Owner and its recovery owner: the identity that keeps platform sign-in even if Company SSO is later made mandatory.

If you were not expecting this screen, the installation has no workspace yet and you may be signed in with the wrong account; the footer shows Signed in as … — Sign out.

After that, the Overview page’s Next steps checklist drives the rest. Follow Set up a workspace.

How everyone else gets in

• Every person signs in with a platform account whose email address is verified, or through Company SSO once an administrator has configured and activated it.
• Access is granted by invitation only: a workspace invitation (Member or Administrator) or a service-access invitation (Requester, Developer, or Administrator on one service). See Accept an invitation for what the invitee does and Invite people and assign roles for the administrator side.

What you need from your operator before AI delivery

• The released Helmhive runner image reference, to build a derived image with your toolchain. See Build a runner image.
• Someone to deploy each runner from the handoff the console produces and to sign in to the provider (Codex or Claude) on the runner host. See Register a runner.
• A provider subscription for each runner. Every AI job and every connection test uses one or more requests against that subscription; the docs call these provider turns.