Home / Docs / Choose the right account for each pane

Workflow guide

Choose the right account for each pane

Separate provider authentication from Profiles, Loadouts and project-specific selections.

Pre-release. Reviewed October 23, 2026. This review covers code behavior, not a packaged release or provider certification.

Understand the scopes

Provider account

Owns authentication and native sessions. A model name is not an account.

Profile and Loadout

Keep reusable project references and role/account choices, not copied credentials.

Pane and project

Choose the identity for this conversation. An override is not a global switch.

Named CLI accounts are supported for Claude, Codex and Gemini. An API endpoint profile does not inherit the CLI's session archive. Other adapters have distinct limits; inspect the capability matrix.

Create and authenticate an isolated account

  1. Open Settings → Profiles → Manage Profiles... and select the provider's account-management control.
  2. Use a short account label, not an email address. Creating a root isolates local configuration; it does not prove authentication.
  3. Complete the provider-owned sign-in flow, then inspect the selected identity before sending a task.
commandem account --agent codex add demo-codex
commandem account --agent codex login demo-codex
commandem account --agent codex list --json

The first command writes an isolated account root. The second begins real sign-in. Do not run those against a production account as a diagnostic experiment.

Select and bind explicitly

  1. Open the chat composer’s agent and model selector and choose an account in its Profile section, after Agent and before Model, for Claude, Codex or Gemini, including when the current account is default. This is the single Profile selector; its menu and accessibility description retain non-default and queued choices. A switch requested during an active turn waits until that turn ends. A configured pane Loadout can select its saved supported account; verify that account still exists and inspect the effective Profile before sending.
  2. Inspect Loadout role bindings in Settings and commandem roles --json.
  3. For unattended work, choose the account explicitly and inspect the resulting receipt. A permitted fallback must be named; quota exhaustion is not permission for a silent switch.

Expected result and recovery

The pane and run receipt identify the intended provider/account. If they disagree, stop dispatching and preserve the receipt. Check whether a pane override, stored run or role binding supplied the choice. Follow account mismatch recovery.

Account usage can be reported, observed, estimated or unknown. Missing quota evidence is not zero usage. Native resume belongs to the source provider/account; changing either may require a reviewed handoff.