Account Creation

https://app.example.com is an example address. Replace it with the actual address of your environment, retaining the route path and query parameters.

1. Configuration Goal

Create a user account in the Admin Console that can log in to AOS Work, and select the applicable department, Role, and seat for the account. After the account is created, the system directly creates the user's unique User Base Agent. It starts empty and provides only Explore Skill; it does not read an Agent Template or preset business template, or preload ordinary business Skills.

This chapter covers two account-creation operations:

• An administrator manually creates an account in Accounts;
• An administrator configures whether users may self-register by email in Settings.

2. Configuration Entry

Account management: Account → Roles

After opening it, select one of the following tabs in the content area:

• Accounts: View the account list and manually create accounts;
• Settings: Configure Open Registration and the Email Domain Allowlist.

app.example.com is an example domain. During actual operation, replace it with the AOS Work access domain for the customer environment. Keep the route path /admin/account/role?tab=accounts unchanged.

3. Pre-creation Checklist

Before creating an account, confirm:

1. The current administrator has account-management permission and is in the target organization context;
2. The new account's login username, name, department, Role, seat, and email information are confirmed;
3. The target Role exists and its required Allowed models configuration is complete according to 04 Role Management;
4. If the new account needs quota, the relevant Credit Plan is complete according to 03 Credits Plan Configuration; verify the account's plan and usage after creation;
5. Do not write a password, API Key, Access Token, or other authentication secret in the account name, name, department, notes, or ordinary documents.

4. Account Fields

After clicking + New, the page opens the Add account dialog. The fields shown in the current interface are:

Account is the username used for authentication and login. Name, the display name, and Email are not login usernames; do not extend the username rule to these fields.

5. Manually Create an Account

1. Open Account → Roles and select the Accounts tab.
2. Click + New to open the Add account dialog.
3. In Account, enter a login username matching ^[a-z0-9_]+$.
4. Enter the user's name or display name in Name.
5. Fill in Department using the organization information.
6. Select the prepared Role in Role.
7. In Seat, select the seat type matching the user's responsibilities.
8. Fill in Email using the actual information.
9. Click Create account.

When submitting, the frontend should first indicate the username character restriction and the server should perform the final validation. If the username does not match the rule, the account must not be created. Names, display names, and email addresses are not subject to this username character rule.

6. System Behavior After Creation

After the account is created successfully:

• The new account appears in the Accounts list;
• The system directly creates the account's unique User Base Agent;
• The User Base Agent starts empty and provides only Explore Skill;
• The system continues the existing new-account initialization mechanism, including Role assignment, quota plan, and other existing initialization behavior;
• The user-side selectable model scope is calculated from the current Role's Allowed Models and the models' current availability. Creating an account does not automatically grant access to all models.

7. Configure Open Registration (Optional)

Open Registration allows users to create accounts themselves using an email address and email verification code. It is disabled by default. Only administrators with Manage Account Settings permission can change it.

7.1 Enable or Disable Open Registration

1. Open Account → Roles and select the Settings tab.
2. View or switch the Open Registration toggle in Allow open registration.
3. To restrict registration email addresses, first add domains to Allowed email domains. If no domains are entered, all valid email domains are allowed.
4. Click Save settings to save the toggle and domain list.

If the page shows SMTP is not configured, so open registration cannot be enabled., configure SMTP for the current environment first. Open Registration cannot be enabled while this message is shown.

7.2 Add Email Domains

Add domains in the Allowed email domains input. Press Enter as prompted, or paste multiple domains separated by commas, semicolons, or spaces.

When saving domains, the system:

• removes leading and trailing spaces;
• removes an optional @ prefix and converts the value to lowercase;
• rejects full email addresses, wildcards, and URLs;
• rejects invalid and duplicate domains;
• uses exact domain matching, so configuring example.com does not automatically allow mail.example.com.

To allow a subdomain, add it as a separate entry. Disabling Open Registration does not clear the saved domain allowlist; the existing configuration is used when it is enabled again.

7.3 User Self-registration Flow

After Open Registration is enabled, users can create accounts as follows:

1. From the login page, open Register with email;
2. Submit an email address;
3. Enter the received Email Verification Code;
4. Complete account creation and log in after verification succeeds.

The server rechecks the Open Registration status, email-domain allowlist, code validity, and account uniqueness when sending the code and completing registration. The account is created only after the code is successfully verified. An existing email cannot be registered again.

When a verification code is resent, the old code immediately becomes invalid. After Open Registration is disabled or the email-domain allowlist is narrowed, incomplete registrations are checked against the latest configuration; already-created accounts are not affected.

8. Post-save Verification

8.1 Manually Created Account

1. Return to the Accounts list and search for the newly created login username.
2. Verify the account's Account, Name, Department, Role, Seat, and Email information.
3. If you have the required viewing permission, verify that the account's User Base Agent was generated through the existing mechanism and was not populated with a preset business template or ordinary business Skill.
4. If a quota plan was configured, verify that the account's Credit plan, Billing period, Period usage, and Daily usage displays match expectations.
5. Use the account to perform a login and minimal AOS Work access check. If model verification is required, perform a minimal test call within the Role's allowed model scope.

8.2 Open Registration

1. Return to Settings and confirm that the Allow open registration state matches expectations.
2. Verify that domains in Allowed email domains are normalized, unique, and consistent with the organization scope.
3. Complete one verification-code registration using a test email that matches the allowlist. If no allowlist is configured, use any valid test email.
4. Confirm that the account appears in the Accounts list after successful registration and is initialized through the existing new-account mechanism.

9. Completion Criteria

• The manually created account appears in the Accounts list, with accurate account, name, Role, and seat information;
• The login username matches ^[a-z0-9_]+$, and both the frontend and server perform final validation;
• The account has a unique, empty User Base Agent that provides only Explore Skill;
• The account's Role, selectable model scope, and quota plan have been verified against the existing configuration;
• If Open Registration is enabled, the toggle and email-domain allowlist are saved and verification-code registration has been tested;
• No password, API Key, Access Token, or other authentication secret is recorded in account records or ordinary documents.