Platform Administration & Permissions
How Synthreo app permissions work in Canopy: what ThreoAI, Builder, Pylon and Canopy each do, which permissions you grant, and where platform settings live.
Synthreo has four applications a user can be granted: ThreoAI, Builder, Canopy, and Pylon. Access to each is controlled by an app permission assigned in Canopy.
In Canopy, Platform Admin holds per-organization model access, the company system prompt, sensitive content, connectors and connector defaults, and the skill catalog (see Platform Admin). A separate AI Configuration area is Synthreo-internal: it is gated on a superuser claim, so it does not appear for customers or MSPs, and it is not covered in these docs.
ThreoAI
Section titled “ThreoAI”ThreoAI is the AI chat interface for your organization. It provides conversational access to large language models and supports Experts, file uploads, model comparison, projects, and a catalog of pre-built AI Agents.
URL: https://threo.synthreo.ai
What users can do:
- Chat with AI models
- Create and use Experts
- Upload and analyze files
- Compare model outputs side by side
- Use pre-built AI Agents from the Agents catalog
Builder
Section titled “Builder”Builder is the original no-code tool for creating AI agents and automated workflows. Users connect nodes on a visual canvas to build pipelines that process data, call LLMs, integrate with external systems, and produce outputs.
URL: https://builder.synthreo.ai
Canopy labels this application two ways: a customer’s Accounts tab calls it ThreoBuilder, while the Add User dialog’s permission checkbox reads Builder. They are the same application.
What users can do:
- Design agent workflows on a visual canvas
- Configure LLM nodes, integrations, and data transformations
- Test agents before putting them to work
- Schedule agents to run automatically
- Call agents over the API or connect them to ThreoAI
Builder is live and supported for the agents and workflows already built there.
Pylon is the no-code/low-code workspace where new agentic capability lands. It runs alongside Builder as its own application, with its own permission and its own role catalog. Deterministic node chains live on a DAG; goal-driven autonomous work lives on an Agent.
URL: https://pylon.synthreo.ai
See Welcome to Pylon and the Pylon Overview.
Canopy
Section titled “Canopy”Canopy is the administrative console for the Synthreo platform. It controls who has access to what across the other applications.
URL: https://canopy.synthreo.ai
What admins can do:
- Create and manage customer tenants (multi-tenant hierarchy)
- Add, edit, disable, and remove users
- Assign app permissions (Builder, Canopy, Pylon) and the role held in each
- Configure model access and system prompts for the organization
- Reach child-customer applications for support via Delegate Login and Sign In As
App Permissions
Section titled “App Permissions”Every user holds one or more app permissions that control which applications they can open:
| Permission | Grants Access To | How it is granted |
|---|---|---|
| ThreoAI | AI chat, Experts, Agents, Projects | Automatic. Every user gets a ThreoAI account when their account is created |
| Builder | The ThreoBuilder canvas, node configuration, testing, API | Optional checkbox at creation, or added later |
| Canopy | The admin console, user and customer management | Optional checkbox at creation, or added later |
| Pylon | Pylon DAGs and agents | Optional checkbox at creation, or added later |
Builder, Canopy, and Pylon are region-gated at creation: if the application is not available in the customer’s region, its checkbox is disabled and the tooltip says so.
Permissions are managed per user in Canopy. See Adding a New User and Managing Permissions for the step-by-step guides, and Roles & Permissions for each application’s role catalog.
Troubleshooting
Section titled “Troubleshooting”| Issue | Cause | Fix |
|---|---|---|
| User cannot access ThreoAI | The account is disabled, or setup is not finished | Check the user’s status badge: Disabled means login was disabled, Pending means they have not completed setup |
| User cannot see Builder or Pylon | That permission was never granted | Add the permission on the user’s detail page and assign an appropriate role |
| User cannot sign in to Canopy | No Canopy permission | Add a Canopy permission with a suitable role |
| The permission you want is not in the Application Type list | ThreoAI is deliberately excluded, since every user already has it | Nothing to fix |
Can a user have all four app permissions at the same time? Yes. A user can hold ThreoAI, Builder, Canopy, and Pylon at once and reach all of them with the same sign-in.
Does granting Builder access automatically grant ThreoAI access? Every user already has ThreoAI, so there is nothing to grant there. Builder, Canopy, and Pylon are simply added on top.
Can I remove the ThreoAI permission from a user? No. ThreoAI is created automatically and its permission row carries no delete action. To revoke someone’s access, disable their login or remove their account. Builder, Canopy, and Pylon are the permissions you grant and remove individually.