Organization and personal settings
Landfall keeps two settings areas apart. Organization settings belong to the organization and are reachable only by its owners and admins. Your settings belong to you and are reachable by every member. Nothing you can reach from one area changes the other.
Who sees what
| Your role | In the rail | Organization Settings | Your settings |
|---|---|---|---|
| Owner or admin | Settings and Your settings | General, Members, Security & SSO, Billing, Governance, Workflows, Beacon, Audit log | Profile, Connected assistants, API keys |
| Billing admin, responder, viewer | Your settings only | A page saying the settings are managed by your admins, with their names. No form. | Profile, Connected assistants, API keys |
| Guest or coding-agent session | Neither | Not reachable | Not reachable |
The server enforces the same line regardless of what the app shows: every organization setting is refused for a session that is not an owner or admin. The app hides what cannot be used so nobody lands on a form they cannot save.
Your settings
Open it from the rail or from your initials at the bottom of the rail. It holds your display name and theme, the coding assistants you have connected to Landfall (and how to disconnect one), and your own API keys. These are yours: a coding assistant or a key you create acts as you, in the organization you are in, and an admin does not see or manage them from the organization area.
Organization settings
Owners and admins configure how the organization signs in (identity provider, domain claims, SSO policy), who can join (invitations, guest join), how findings enter the shared context (governance and the admission gate), lifecycle workflows, Beacon's standing instructions, integrations and ingest tokens, and billing. A member who opens one of these addresses is told who the organization's admins are.
The audit log and its export
Every security-relevant action in an organization is recorded: sign-in and SSO changes, invitations, settings changes, integration changes, trigger deliveries, and refused attempts that go through a service check (for example a member asking for the audit log). Settings → Audit log lists the entries newest first with the actor's name, the action, the target and the outcome, and can be filtered by time range, actor, outcome and incident. The filter is part of the page address, so a view can be shared with another admin.
Export produces a CSV or JSON file of the filtered entries, up to 10,000 per export; the page says when that cap was hit so you can narrow the filter. The export itself is recorded in the audit log, with the format, the filter and the number of entries, so reading the record is part of the record.
CSV columns: occurredAt, actorType, actorId, actorDisplayName, action, targetType, targetId, outcome, incidentId.