Organisation Capabilities

The Capabilities page under Admin → Organisation → Settings is where you control which external integrations and PebbleFlows assets are available to users in your organisation.

Find it at Admin → Organisation → Settings → Capabilities.

Don’t confuse this with User Settings → Capabilities. This page is organisation-level provisioning — what’s available to be enabled by users. The User Settings page is where individual users actually toggle them on for their own sessions.

What a capability is

A capability is anything that extends what PebbleChat or PebbleFlows can do beyond the base model. Capabilities are grouped into five tabs:

The page header banner reads “View enabled capability instances across all categories and enable additional capabilities from the catalog.”

The Enabled Instances table

The table on the page lists capability instances that are currently enabled for your organisation. Each row shows:

• Integration — the provider name
• Tools — a brief summary of what tools the integration exposes
• Status — Requires User Configuration (each user must complete OAuth themselves) or Ready
• Enabled — toggle to turn this instance on/off without removing it
• Actions — configure, re-authenticate, remove

Above the table is an Enable a Capability button (top-right) for adding new capability instances from the platform catalogue.

Step-by-step: enabling Microsoft 365

1. Click Enable a Capability
2. Browse the catalogue and pick Microsoft 365
3. The integration is added to the Enabled Instances table with status Requires User Configuration
4. Configure the OAuth client — paste the Microsoft Entra ID app’s Client ID and Tenant ID into the integration’s settings
5. Save
6. Tell your users they can now connect their Microsoft accounts via User Settings → Capabilities
7. Each user authenticates with their own Microsoft account; the org-level config provides the OAuth shell, the user-level config provides the per-user identity

For full setup details, see the Microsoft 365 integration guide.

Step-by-step: enabling Jira

1. Click Enable a Capability
2. Pick Jira from the catalogue
3. Configure the Jira instance URL and OAuth credentials
4. Save
5. Users connect their personal Jira accounts via User Settings → Capabilities

Tabs explained in detail

Integrations

Top-level connections to third-party platforms via MCP (Model Context Protocol). One integration provides many tools — Microsoft 365, for example, provides email, calendar, files, Teams, OneNote, and SharePoint tools.

Tools

Individual tools, including the integration tools (one row per Microsoft 365 sub-tool, etc.) plus standalone tools like Brave Search, Tavily Search, Calculator, Code Interpreter.

This is where you’d disable a specific tool from a capable integration — for example, leaving Microsoft 365 enabled but disabling the “send email” tool to prevent PebbleChat from sending email on users’ behalf.

Skills

Skills are Claude Code-compatible prompt templates — a Persona plus optional supporting files and code — that PebbleChat loads on demand when they match a user’s task. They’re a major capability with their own documentation at PebbleChat → Skills. This tab is where you manage them at organisation level.

What you see in this tab

Every skill that’s been imported or created at platform, organisation, or workspace scope. Each row shows:

• Skill name and description — what it does
• Scope badge — platform, organisation, or workspace
• Runtime — none (prose-only), python, node (deferred)
• Enablement toggle — per-scope, on/off for that scope’s users
• Scan status — the result of the 13-rule security scan (pass / warn / block)
• Source — GitHub (for imported), UI (for manually created)

Above the list are search, filter by scope, and two action buttons: Import Skill and Deploy to All Users.

Step-by-step: deploying a skill to your whole organisation

1. Pick the skill from the list
2. Click Deploy to All Users (org admin only)
3. Confirm
4. Behind the scenes, PebbleAI bulk-enables the skill for every user in the organisation and fires an in-app notification to each of them via their notifications bell

The notification includes the skill name, what it does, and a link to the Skills management page. Users don’t need to take any action — the skill is immediately discoverable in their next chat.

Step-by-step: scoping a skill to one workspace

1. Import or create the skill with workspace scope
2. Pick the target workspace in the import dialog
3. Save
4. The skill is visible only to users in that workspace
5. Users in other workspaces won’t see it in their Skills management page or discover it at chat time

Use this for team-specific patterns — e.g. a cyber-incident-response skill that should only be available to your security team.

Step-by-step: importing from the Anthropic official catalogue

PebbleAI ships with a set of official Anthropic skills pre-imported at platform scope (pdf, docx, xlsx, pptx, mcp-builder, webapp-testing, skill-creator, slack-gif-creator, frontend-design, brand-guidelines, and more). These are available immediately once the Skills capability is enabled.

To import additional skills from public sources:

1. Click Import Skill → From GitHub
2. Paste a repo URL (e.g. github.com/anthropics/skills/blob/main/document-skills/pdf)
3. Pick the target scope (workspace or organisation — you can’t import to platform scope)
4. The security scanner runs automatically. Any block findings fail the import; warn findings require your acknowledgement before proceeding
5. Confirm
6. The skill is now available at the chosen scope

You can also import from a raw URL or a zip upload via the other Import Skill menu items.

Security scanner

Every import, regardless of source, runs through a 13-rule security scanner before it’s stored. The scanner has three severity levels:

• Block — rejected immediately. Rules: shell injection in SKILL.md body, allowed-tools: Bash(...) in frontmatter, binary executables, files > 2 MB or aggregate > 8 MB, body > 256 KB
• Warn — requires acknowledgement. Rules: prompt injection phrases, exfiltration URLs to non-allow-listed domains, hidden Unicode / bidi overrides
• Info — logged for context. Rules: Python runtime required (auto-adds pebbleRuntimes: python), Node runtime required (auto-adds node — execution deferred), shell scripts present (reference text only, not executed)

See PebbleChat → Skills → Security scanner for the user-facing detail.

Skills that execute code

Skills declaring pebbleRuntimes: ['python'] need the code execution sandbox to be available in the target workspace. The sandbox runs Python 3.12 in a gVisor-isolated Kubernetes pod with 1 vCPU, 1 GiB RAM, a 120-second wall-clock timeout, and default-deny network egress. Output files (PDFs, images, spreadsheets) are uploaded to the user’s file store automatically.

If the sandbox isn’t enabled in your deployment, Python skills will still import successfully but won’t run. The Runtime availability gate in the discovery pipeline hides them from users whose workspace can’t execute their code. See Code Execution Sandbox for deployment details.

Flows

Chatflows and Agentflows that have been promoted to organisation-level capabilities. A flow listed here can be @-mentioned by anyone in the org — it’s not just available within its source workspace.

Agents

Multi-agent definitions from PebbleFlows Agentflow V2. An agent listed here is an organisation-level agent any user can invoke.

Disabling a capability instance

Toggle the Enabled column off for any row to temporarily disable a capability without removing it. The integration’s stored OAuth tokens, configuration, and connection state are all preserved — flip it back on when you want to use it again.

When to disable temporarily:

• Provider outage — disable so PebbleChat doesn’t keep retrying broken calls
• Security incident response — disable an integration whose credentials may have leaked while you investigate
• Cost control — disable expensive tools (e.g. paid web search) until budget refresh

Removing a capability instance

Click the delete icon to fully remove. Removal:

• Revokes any stored OAuth tokens
• Clears configuration
• Removes the capability from every user’s available list (forces users to re-authenticate if you re-add it later)

Capabilities and asset discovery

Every capability you provision here is eligible for asset discovery — when a user sends a PebbleChat message, the discovery system can match it against any provisioned capability and pull the relevant ones into context automatically.

For asset discovery to work well:

1. Capability instances need clear descriptions
2. Users need access to the capability (i.e. they’ve completed any per-user OAuth)
3. The capability needs to be marked as discoverable in PebbleFlows (for flows and agents — see Asset Sharing)

See PebbleChat → @Mentions & Tools for the user-side view.

Tips

• Provision integrations early. Users see the integration in their Settings → Capabilities page only after you’ve enabled it here. Get the common ones provisioned before you announce PebbleAI to the team.
• Disable rather than delete when you might come back. Deletion forces every user to re-authenticate, which is a hassle.
• Match scope to actual need. Don’t enable every integration just because you can — each one is a security surface and a thing to keep updated.
• Watch usage in PebbleObserve → Logs to see which capabilities your team actually uses. Cull the unused ones quarterly.

Related

• User Settings → Capabilities — the user-side view; where individual users toggle their own access
• PebbleChat → @Mentions & Tools — how users invoke capabilities from chat
• Asset Sharing — how flow/agent/document store sharing works at asset level
• PebbleFlows Integrations — the catalogue of integrations and their setup details