Scope
This track is for platform administrators: identity, integrations, approvals, audit, and
incident command. It assumes you have completed the End-User guide and hold the
Administrator role.
The admin model
- Least privilege: grant the narrowest role that lets a person work. Prefer scoped, time-boxed
elevation over standing admin.
- Four-eyes everywhere: every destructive or gated action needs a second approver. Self-approval
is blocked by design.
- Everything is logged: all admin actions are written to the tamper-evident audit chain
(SHA-256 hash-chain, WORM). Assume your actions will be reviewed.
- Reversibility first: prefer changes that can be rolled back; back up before you touch state.
Standard admin roles
| Role | Can do | Cannot do |
|---|
| User Admin | Invite/disable users, reset MFA | Change policy, touch data |
| Security Admin | Policies, controls, integrations | Billing, tenant deletion |
| Platform Admin | Everything within the tenant | Cross-tenant / billing |
| Auditor | Read-only audit + evidence | Any change |
The approval gate
Gated action types (examples): bulk approvals, VM patch application, destructive data operations,
tenant deletion, policy publish, secret rotation. Each flows through the approval queue with:
- Justification (why) and blast radius (what it affects).
- Evidence attachment (scan result, change ticket, test output).
- Two-person approval with rationale recorded.
⚠️ Never disable a safety control to make a task pass. Fix the task, or formally request an exception.
Change discipline
- Use change tickets for anything user-visible.
- Maintain rollback plans; test in a non-production lane first.
- Announce maintenance via the status page.