User Manual

2.1 Sign up and create your organization

1. Go to the AgentPMO web app and click Start Free.
2. Create an account with email or an SSO provider.
3. When prompted to create an organization, enter your company name. The slug is used in API calls — choose something short and memorable (e.g. acme).
4. Invite team members from Settings > Members once your org is set up.

2.2 Get your API key

1. Settings → enter a descriptive key name (e.g. ci-pipeline or local-dev).
2. Click Create Key.
3. The full key is shown once only — copy it immediately and store it securely.

2.3 Install the CLI

npm install -g agentpmo

# Configure your key
agentpmo config set apiKey YOUR_KEY_HERE
agentpmo config set orgSlug your-org-slug

# Verify connectivity
agentpmo status

2.4 Onboarding flow

After creating your organization, the dashboard shows a guided three-step onboarding card:

1. Register Agents — add your AI agents via the UI or the CLI.
2. Assess Compliance — run a risk assessment against at least one framework.
3. Monitor & Report — track metrics, log incidents, and generate reports.

3.1 Stat cards

3.2 Stale agent alert

If any active agent has not sent a heartbeat in the last 24 hours, a yellow warning banner appears listing each stale agent by name. Click any agent name to navigate to its detail page.

3.3 Compliance overview panel

Three columns give an instant compliance posture:

• Left: % of agents assessed, EU AI Act countdown in days, remediation progress bar.
• Middle: Per-framework coverage bars (EU AI Act, NIST AI RMF, ISO 42001, GDPR, SOC 2).
• Right: Active production agents with no assessment — highest priority for the compliance team.

4.1 Registering an agent

Click Register Agent (top right of the Agents page).

4.2 Sending heartbeats

agentpmo heartbeat --agent customer-support-bot

Add this to a cron job or health-check loop every 5 minutes for continuously running agents. An agent that misses heartbeats for 24+ hours is flagged as stale on the dashboard.

4.3 Reporting token usage

agentpmo metrics push \
  --agent customer-support-bot \
  --inputTokens 12500 \
  --outputTokens 3200 \
  --cacheHitTokens 8000 \
  --totalCostUsd 0.042 \
  --model claude-sonnet-4-6

4.4 Agent detail page

Click any agent name to open its detail page. Key sections:

4.5 Agent statuses

5.1 Supported frameworks

5.2 Running a new assessment

Navigate to Compliance > New Assessment and fill in:

5.3 Assessment reviews (peer sign-off)

After an assessment is created, a colleague with at least member role can submit a peer review. Only Approved reviews satisfy EU AI Act conformity check #3.

5.4 Remediation tasks

Each assessment can have one or more remediation tasks:

5.5 Compliance Matrix

Compliance > Matrix — a grid with agents as rows and frameworks as columns. Each cell shows the latest risk level, score, and a staleness indicator (grey) if the assessment is older than 90 days. Empty cells are agents never assessed under that framework.

5.6 Gap Analysis

Compliance > Gap Analysis — lists every framework and, for each, every agent that has not been assessed. Use Assess Now on any row to jump to a pre-filled new-assessment form.

5.7 Framework Comparison

Compliance > Compare — select any two frameworks for a side-by-side comparison of assessment counts, average scores, and risk level distribution.

5.8 Bulk Assessment

Compliance > Bulk — run the same assessment parameters across multiple agents simultaneously. Useful when a new framework becomes relevant for an entire product line.

6.1 The six conformity checks

6.2 Readiness statuses

6.3 Downloading the PDF report

Click Download PDF on the EU AI Act page. The report is suitable for submission to regulators, auditors, or board risk committees. It includes a cover page with the org-level readiness score and a per-agent table with check dots and status badges.

7.1 Charter fields

7.2 Budget health

The dashboard Budget Health card shows the percentage of chartered agents within their expected monthly budget. On the Token Charter list, agents over expected budget are highlighted amber; agents over the runaway limit are highlighted red.

8.1 Adding a dependency

1. Select the dependent agent (the one that calls another).
2. Select the upstream agent (the one being depended upon).
3. Set criticality: critical, high, medium, or low.
4. Optionally add a description.

8.2 Blast radius

The stats panel lists each agent with its blast radius — the number of other agents that would be affected if it failed. Agents with a blast radius of 3+ warrant additional compliance scrutiny and should be prioritized in remediation.

9.1 Running a scan

agentpmo discover

# Print results without uploading
agentpmo discover --output json

9.2 Tool types detected

9.3 Promoting or dismissing

Promote to Agent — opens the registration form with name and external ID pre-filled. Complete the remaining fields and the tool is linked to the new agent.

Dismiss — archives the finding. It will not reappear unless detected again in a future scan.

10.1 Severity levels

10.2 Incident lifecycle

open  →  investigating  →  resolved  →  closed

10.3 Filing an incident

Click New Incident and fill in:

10.4 Filing via CLI

agentpmo incident create \
  --agent customer-support-bot \
  --title "Unexpectedly high hallucination rate detected" \
  --severity p2 \
  --description "Automated eval detected 12% hallucination rate in last 100 runs"

11.1 Token economics section

• Budget utilization — MTD cost vs expected, stretch, and runaway budgets per agent.
• Model tier cost breakdown — haiku vs sonnet vs opus spend.
• Cache efficiency — ratio of cache-hit tokens to total (aim for > 40%).
• Cache leaderboard — agents with the best and worst cache hit rates.

11.2 Scheduled reports

Navigate to Reports > Schedule to set up automatic PDF delivery:

1. Click Schedule Report.
2. Choose Weekly (every Monday at 8 AM) or Monthly (1st of each month at 8 AM).
3. Enter recipient email addresses.
4. Save the schedule.

12.1 Audited resources

12.2 Filters

13.1 API Keys

Create keys in Settings. Keys are shown once — if lost, revoke and create a new one. Name keys descriptively to track which system uses them (e.g. github-actions, staging-server).

13.2 Webhooks

Create a webhook endpoint by providing:

• URL — the HTTPS endpoint that will receive events
• Secret — used to sign payloads with HMAC-SHA256; verify signatures in your receiver
• Events — select which event types to subscribe to

The Webhooks page shows a delivery log with HTTP status codes and response times for each recent delivery attempt.

13.3 Integrations

agentpmo status

agentpmo status
# Connected to AgentPMO  org: acme  role: admin

agentpmo heartbeat

agentpmo heartbeat --agent <external-id>

agentpmo metrics push

agentpmo metrics push \
  --agent <external-id> \
  --inputTokens <n> \
  --outputTokens <n> \
  --cacheHitTokens <n> \
  --cacheMissTokens <n> \
  --totalCostUsd <n> \
  --model <model-id>

agentpmo incident create

agentpmo incident create \
  --agent <external-id> \
  --title "Description of the issue" \
  --severity p2 \
  --description "Full details"

agentpmo discover

agentpmo discover
agentpmo discover --output json  # print without uploading

agentpmo agents list / get

agentpmo agents list
agentpmo agents list --format json
agentpmo agents get --agent customer-support-bot

Agents

Metrics

POST /api/metrics/ingest
{
  "agentId": "agent_xxxx",
  "periodStart": "2026-05-14T00:00:00Z",
  "inputTokens": 12500,
  "outputTokens": 3200,
  "cacheHitTokens": 8000,
  "totalCostUsd": "0.042",
  "modelUsed": "claude-sonnet-4-6"
}

Incidents

Webhook payload verification

import crypto from "crypto";

function verifySignature(payload: string, signature: string, secret: string): boolean {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(payload)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(`sha256=${expected}`)
  );
}