Crew Studio
Visual builder for prompt-based crew creation. Describe your workflow in natural language, get a scaffolded crew you can edit and deploy.
Deployment
Three paths to production:
- ▸CLI:
crewai deploy create / push / status / logs / list / remove - ▸GitHub: connect a repo; deploys on push.
- ▸Zip / Web UI: upload a bundle via the platform.
Pre-Deployment Checklist
- ✓Project type set in
pyproject.toml(crew or flow). - ✓
uv.lockcommitted. - ✓
src/structure withcrew.py(Crews) orcrews/dir (Flows). - ✓Env vars set in the platform UI.
- ✓Local
crewai runpasses.
Triggers & Webhooks
Drive deployed automations from outside: Slack /kickoff, email, scheduled, or arbitrary HTTPS webhooks. List/test locally with crewai triggers list / run <trigger>.
From code, InvokeCrewAIAutomationTool chains AMP automations inside a crew when the platform issues compatible credentials.
RBAC & Governance
Organization roles: Owner, Admin, Editor, Viewer. Entity-level permissions on automations, LLM connections, Git repos, env vars. Feature Permissions Matrix in AMP shows who can do what.
SSO Providers
Supported identity providers and their env vars (used by the self-hosted Factory):
- Okta — OKTA_CLIENT_ID, OKTA_CLIENT_SECRET, OKTA_SITE, OKTA_AUTHORIZATION_SERVER, OKTA_AUDIENCE
- Entra ID — ENTRA_ID_CLIENT_ID, ENTRA_ID_CLIENT_SECRET, ENTRA_ID_TENANT_ID
- KeyCloak — KEYCLOAK_SITE, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID/SECRET, KEYCLOAK_AUDIENCE
- Auth0 — AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET
- WorkOS — WORKOS_*
CLI Quick Reference
crewai login # device-flow SSO
crewai org list / current / switch
crewai deploy push
crewai deploy logs
crewai triggers list
crewai enterprise configureSelf-Hosted Factory
Run AMP on your own infra via Helm. Configure SSO via env vars. Full data control; recommended for regulated industries.
Notes
Map identity to least privilege
Studio, triggers, and Factory features often span multiple environments. Treat service principals separately from human SSO users, and scope API keys to the smallest crew surface that still runs your workflows.
Governed fleets still need prompt and tool review
RBAC stops the wrong people from shipping changes; it does not stop a well-intentioned prompt from leaking PII. Pair access controls with redaction, approvals, and audit trails on tool calls.
Self-hosted upgrades are your migration program
Pin versions and rehearse upgrades on a staging cluster. Enterprise agents often embed long-lived memory and triggers, so database migrations and event schemas need the same rigor as application deploys.
Document who owns on-call for agent incidents
When automation touches customers, define escalation paths for model outages, quota exhaustion, and partial failures. Runbooks beat heroics when a trigger fires at 2 a.m.
CrewAI enterprise FAQ
What is CrewAI Crew Studio?
Crew Studio is a managed experience for assembling and operating crews with guardrails, collaboration features, and deployment integrations aimed at teams that want less bespoke wiring.
What does AMP mean in CrewAI?
AMP refers to CrewAI's enterprise automation and management plane: policies, triggers, observability hooks, and packaging patterns that help operators run agents safely at scale.
How does SSO work with CrewAI deployments?
Enterprise deployments integrate standard identity providers so user access, audit trails, and role mappings align with corporate security baselines instead of ad-hoc API keys alone.
When should I self-host the CrewAI Factory?
Self-host when data residency, VPC isolation, or custom connectors demand infrastructure you control, and pair it with your existing secrets, logging, and CI/CD systems.
Where can I compare open source CrewAI to enterprise options?
Read this lesson for packaging and policy differences, then follow observability and production tutorials to understand runtime requirements before you commit to a topology.
See also: DevShelfHub's CrewAI tool review for a product-level comparison, pricing notes, and links back into this tutorial series.