Identity
ALCYONE_ORG_NAME names the company this operator works for and drives the banner, sign-in card and persona. ALCYONE_AUTH_MODE=session enables the login boundary; accounts are managed with alcyone-operator user-add.
Agent brain
ALCYONE_AGENT_BRAIN selects local or cloud; ALCYONE_CLOUD_API_KEY (server-side only), ALCYONE_CLOUD_BASE_URL, ALCYONE_CLOUD_MODEL and ALCYONE_CLOUD_AUTH_STYLE (bearer or Azure api-key) configure the endpoint. All of it is editable live in Settings; the key itself is never entered in the browser.
Employee tools
Each tool family is offered to the agent only when configured: ALCYONE_HTTP_ALLOWED_HOSTS (outbound HTTP with an SSRF guard), ALCYONE_TESTER_* (drive a Tester installation), ALCYONE_EMAIL_* (IMAP/SMTP triage with draft-then-approve sending).
Behind a proxy
ALCYONE_TRUST_PROXY_IP=1 keys rate limits on the proxy-reported client address. Enable it only behind a proxy you control.