# ControlTower

> ControlTower is the SecondStack admin dashboard for models, providers, system prompts, guardrails, access control, config deployment, and usage analytics.

Canonical: <https://docs.secondstack.ai/features/controltower/>
Updated: 2026-07-07

---

ControlTower is the administration dashboard for the whole platform. It is where administrators configure models, providers, prompts, guardrails, and access control, deploy those settings to the running services, and monitor usage — one panel for the entire AI stack.

<p class="ss-mock-caption">ControlTower's analytics view, with the admin navigation for users, teams, providers, models, guardrails, and deployment.</p>

## What administrators manage

- **Providers and models** — connect LLM providers, register models, and group them by capability.
- **System prompts** — configure default and role-specific prompt content.
- **Guardrails** — enable the SecondGuard checks, set their mode (including fail-closed or fail-open), and apply them globally or per team.
- **MCP tools** — register Model Context Protocol tools available to chats and agents.
- **Teams, groups, and users** — organize people and set their access.
- **Access control** — grant model access by team, group, or user across the chat and API channels. See [API Routing](/features/api-routing/).
- **Localized content and general settings** — including white-label branding.

## Configuration deployment

ControlTower doesn't just store configuration — it **deploys rendered configs** to the underlying services (the SecondGate gateway, SecondChat, SecondGuard guardrails, and inference) and can trigger the necessary service restarts. Changes made in the dashboard become the live configuration of the platform.

## Monitoring and analytics

- **Usage analytics dashboards** cover requests, spend, latency, and error rate, with breakdowns by user, team, and model. See [Cost Management](/features/cost-management/).
- A first-party, **read-only analytics interface** is also exposed as an MCP tool, so usage data can be queried conversationally.
- A **Sync Jobs** view shows the status of identity and membership synchronization with your upstream provider.

## Roles and surfaces

ControlTower presents three surfaces for different audiences:

- **Admin** — full platform configuration and oversight.
- **Team supervisor** — budget and usage visibility for a manager's teams.
- **User self-service** — the personal [User Dashboard](/features/user-dashboard/) for keys, budgets, and logs.

## Related

- [API Routing](/features/api-routing/) — the gateway ControlTower configures.
- [Cost Management](/features/cost-management/) — budgets and analytics.
- [User Dashboard](/features/user-dashboard/) — the end-user surface.