# Access Control

Decide who gets to use your AVCodex agent and how they authenticate. Pick from four modes, from fully open (a QR code in a conference room anyone can scan) to strict email whitelisting (your internal programmer team only).

Access Control determines who can chat with the agent. Pick the right mode and the rest of the experience falls into place.

## The Four Auth Modes

| Mode | User Experience | Best For |
|------|---------------------|----------|
| **Open** | No authentication. Users chat anonymously. | Public-facing helpdesk QR codes in conference rooms, demos, broad reach. |
| **Encouraged** | Signup form shown but dismissible. Users can chat as guests. | Lead capture for a dealer-facing agent without blocking access. |
| **Required** | Users must sign in before chatting. | Agents with sensitive content or user-specific features (per-tech ticket lookup). |
| **Restricted** | Users must sign in with a pre-approved email. | Internal AV ops tools, programmer-only assistants, single-client workspaces. |

## Configuring Access Control

**1. Open Access Settings**

Open your agent's **Build** page, then the **Access** tab.

**2. Select an Auth Mode**

Pick one: Open, Encouraged, Required, or Restricted.

**3. Configure Restrictions (Restricted mode only)**

If you picked Restricted, set:
- **Allowed Domain**: an email-domain filter (e.g. `yourintegrator.com`). Only matching emails can access the agent.
- **Allowed Emails**: a comma-separated list of explicit addresses.

## How Each Mode Works

### Open Access

```
User visits the agent
  -> No auth card
  -> Greeting fires immediately
  -> User chats anonymously
```

Zero friction. Right for a QR code on a wall plate in a conference room: scan, get help, walk out. You can still capture an email mid-conversation with the `collectEmail` tool in your system prompt if you want.

### Encouraged Sign-up

```
User visits the agent
  -> Signup form shown (dismissible)
  -> User can sign up OR dismiss and chat as guest
  -> Either way, conversation starts
```

The signup form is the first message. Users who dismiss it see a small banner ("Sign in to save your progress") but can still chat. Useful when you want to capture dealer contact info without slamming the door on first-time visitors.

### Required Sign-up

```
User visits the agent
  -> Signup form shown (not dismissible)
  -> Chat input disabled until authenticated
  -> User signs up or logs in
  -> Greeting fires and chat is active
```

Users must create an account or log in before they can send anything. The chat input is disabled until auth completes. Right when the agent uses User Memory or pulls per-user data (a tech's own assigned rooms, an SE's own pipeline).

### Restricted Access

```
User visits the agent
  -> Signup form shown (not dismissible)
  -> Chat input disabled
  -> User signs up with email
  -> Email is checked against whitelist or domain
  -> If approved: access granted
  -> If not: "Email not allowed" error
```

Same as Required, plus email validation. Only pre-approved emails or emails matching your allowed domain get in. Right for an internal AV ops tool, a single-client portal, or a dealer-only agent.

## HIPAA Mode

When **HIPAA mode** is enabled in the Access tab, the auth mode is locked down:

- **Open** and **Encouraged** are disabled.
- Only **Required** or **Restricted** are allowed.
- Every interaction is authenticated, which helps with compliance.

Useful for healthcare AV environments (hospital boardrooms, telemedicine suites) where any patient-adjacent content needs to be tracked.

## In-Chat Authentication

Authentication happens inside the chat. There is no separate login page. Users see a multi-view auth card that supports:

- **Signup** with email and password.
- **Login** for returning users.
- **OTP verification** via email code.
- **Forgot password** and reset flow.

The auth card appears as a synthetic assistant message so users stay in the conversation.

## Redirect After Signup

For any auth mode, you can set an optional **redirect URL**. After successful signup, the user is sent to that URL before returning to chat. Useful for:

- Onboarding (a "how this AI helpdesk works" page).
- Terms of service acceptance.
- A payment page.
- A branded welcome experience.

## Use Cases

| Mode | Scenario |
|------|----------|
| **Open** | A QR code in every conference room that lets anyone in the room get instant AV help. A public spec-sheet bot for design firms. |
| **Encouraged** | A dealer-facing agent where you want to capture leads but never block first-time visitors. |
| **Required** | A field-tech assistant that pulls each tech's own ServiceNow tickets. A managed-services helpdesk that uses User Memory. |
| **Restricted** | An internal Crestron-programmer assistant for staff only. A single-client portal locked to that client's email domain. |

*AVCodex · Your AV expertise. Amplified by AI.*