Administer another tenant

Platform authority confers no access to a tenant's data on its own (IDN-ELV-001). An elevation is a bounded, recorded grant that lets you administer one tenant for a limited time.

The tenant can see this elevation in their own audit records, including who you are and the justification you give (IDN-ELV-005). It ends automatically and can be ended sooner.

What you may do there

Sign in

You are currently signed out, please sign in for access to Broa.

· · ·

Messages in the chain

Attachments

Listed, not openable — these were sandboxed at admission and this view does not serve them.

    Headers
    
        

    Dashboard

    How your correspondence is flowing, stage by stage. Each card shows the worst state of its parts and then lists them, so the colour is never the whole story. Checked every 15 seconds — last at —.

    Dashboard

    Probed —

    Import a mail file

    Loads .eml files through the same admission pipeline as any other message (ING-FIL-001). Use it to bring existing correspondence in — an archive, a client's forwarded mail — rather than to relay something that has just arrived. For that, use Compose.

    What is this correspondence?

    This decides whether the platform may ever answer it, so it is asked before the files rather than after.

    There is no option here for live mail, and that is deliberate. An imported message is admitted with a non-live origin (ING-FIL-003) and the run token minted for it carries no capability to send (ING-FIL-004) — so importing a customer's old question cannot result in them being emailed about it weeks later. The service refuses origin=live outright; this list is not what enforces it.

    Files

    No files chosen.

    Compose a message

    This enters the same admission pipeline as a message that arrived by mail or came in on a file import (ING-SUB-001). Nothing downstream can tell it apart, and nothing here is trusted more than a message relayed by a tenant's own backend.

    Submitting into the tenant you are working in. There is no tenant field here and typing one would have no effect (ING-SUB-003).

    Idempotency key — — the same key rides every retry of this message, so a double-click produces one enquiry (ING-SUB-008).

    Ingestion — Manage

    Intake limits

    What this tenant's intake accepts. Enforced by ingestion-svc before a request is buffered or parsed (ING-LIM-002), and owned here as configuration (CFG-COV-016) so a change is versioned, revertible and audited.

    A tenant may set a limit below the platform ceiling and never above it (ING-LIM-003). A value of zero is refused: stopping intake is a tenant lifecycle action, not a limit.

    Reading the configured limits…

    Intake paths and publication

    Not reported by this deployment. CON-ADM-014 requires the intake-path and publication flags shown here, and ingestion-svc exposes no endpoint that carries them. This panel shows nothing rather than an all-clear it cannot support: an operator looking at a stalled queue would otherwise read "no problems" from a page that never asked.

    Of the five intake paths, two accept anything today — file import and the submission endpoint behind Compose. Publication to the event bus is not wired, so nothing downstream is notified of an admitted message.

    Runs

    Run

    Delete this run

    Knowledge

    What the assistant can read for this tenant: whether its indexes are current, the products and documents it holds down to the passages it reads, and what a question would retrieve. Read-only.

    Detail

    Pricing rules

    The quantity discounts Broa may state in a reply. Every price in a reply is computed by code from these rules and the catalog list price; an email asking for more than they give is held for a Tenant Admin to decide. Changes take effect only when published.

    Publish pricing rules

    This takes effect for live correspondence as soon as it is published. It is not reversed by closing this dialog.

    Discount exceptions

    Replies Broa has blocked because the customer asked for more discount than the pricing rules give. Each reply already quotes what the rules allow. Grant a larger discount and Broa writes a new reply at that discount; decline and the reply stays as it is. Every decision is recorded and audited.

    Exception

    Confirm

    Parties

    Who this tenant corresponds with — accounts and prospects, and the people, systems and agents acting for them. An index, not a customer store (PTY-MOD-007a): identity and the association graph only. Orders, invoices and prices stay in the tenant's own system, reached live through external_ref.

    A party added here is created confirmed: you asserted it, so it does not appear in the unconfirmed queue above. Parties may also reach this list by other routes — this console is told what exists, not how it got here.

    Identity administration

    Tenants are platform-plane (CON-IDN-002). Everything inside a tenant is tenant-plane. There is no identity directory — members are added by exact issuer and subject, because a searchable one would disclose which addresses exist in other tenants (CON-IDN-004).

    Tenants platform plane

    NameStatus

    One action, not four — IDN-TEN-005 makes the tenant, its default workspace, the first membership and the first admin role atomic.

    Onboard tenant

    Creates the tenant, its default workspace, the first membership and the first admin role as one atomic act (IDN-TEN-005).

    This is the tenant's bootstrap, and the first administrator is not optional. Members are added by someone who is already inside the tenant — the route is tenant-scoped, so it needs a session that names this tenant. A tenant created with nobody in it could therefore never acquire anyone: not by you, because platform authority grants no standing access to tenant data (IDN-ELV-001), and not by them, because there is no one yet. This form is the one place a membership can be created from outside, which is what makes it onboarding rather than an edit.

    Name the person who will run this tenant, not yourself. After this they add everyone else — including further administrators, of which a tenant may have any number — from inside, with their own session and their own audit trail.

    First administrator

    Identified by issuer and subject — who vouched for them, and their id there. Together these are the account key (IDN-IDM-002).

    They must already exist in the identity provider. The subject IS their id there, so it cannot be known before the account does — there is no invite-by-email, and an address on its own cannot create anyone. Either create their account first and use the id it returns, or let them sign in once: they will be refused for having no membership, and the page that refuses them prints the subject to send you.

    Issuer: — fixed for this deployment — a value entered here is not used

    Add member

    Adds the identity to this tenant and grants no role — membership and role assignment are separate acts with different blast radii (CON-IDN-005). Assign roles from the member's Edit panel afterwards.

    There is no directory to search: an identity is named by exact issuer and subject, because a searchable list would disclose which addresses exist in other tenants (CON-IDN-004).

    Issuer: — fixed for this deployment — a value entered here is not used

    Edit tenant

    Platform-plane fields only. Pipelines, intents, tone, approval thresholds and credentials are tenant-plane and are not reachable from here (CON-IDN-016, CON-ELV-002).

    Edit membership

    Roles

    Our senders

    Which mail is your own. Broa records a message from one of these senders on its thread and never drafts a reply to it, so it does not answer your own staff. A website enquiry relayed from one of your form addresses is the opposite: it is still answered, addressed to the customer the form names. Nothing here is guessed — only what you list counts. Changes take effect only when published.

    Publish the sender list

    This takes effect for live correspondence as soon as it is published. It is not reversed by closing this dialog.

    Configuration — Advanced, read only

    This page is a read-only history view. Settings are changed on Platform › Settings (Broa's platform administrators): one setting at a time, with the change shown before it is saved and everything else kept in force.

    A revision is immutable and publication is a separate act (CFG-VER-001, CFG-VER-005). Every row below says which state it is in.

    Clients

    Every client, where each one is in Get started, and what is stuck — so a client who stopped halfway is noticed before they give up. Every step is computed, never ticked. A step we cannot see is shown as ?, never as “not yet”. Clicking a client offers borrowed access and nothing else.

    New client

    Raise the spend ceiling for

    The ceiling limits what this client’s work costs Broa in model charges each calendar month. It warns at half, at 80% and at the limit, and stops new runs when reached: new email goes to people instead of being drafted.

    Now:

    What the client is told: that Broa raised their monthly spend ceiling, when, and your reason. Never the number. The raise is recorded, with the amount, only on our side.

    New client

    One action creates the client: their tenant, the first administrator’s account, the starter pack for their business, their spend ceiling, and a fallback forwarding address for their mail. If anything stops halfway, call again — the same attempt finishes what is missing and never makes a second client.

    The company
    Business type — chooses the starter pack they begin with. It is theirs to change afterwards.
    The first administrator

    Normally the client is the first administrator. The account is made active with a one-time password, shown to you once when it is created; they change it at first sign-in. A Broa person taking the seat must use an identity that holds no platform authority.

    Their mail

    The client normally connects their own mailbox in Get started and Broa reads it, so most clients never use this address. It is the fallback for a mail system Broa cannot read: they forward their shared mailbox to . It is reserved now and stays inert — mail to it is refused, not held — until they accept the terms. An address is never given to another client.

    Terms and DPA versions (optional)

    Which documents they will be asked to accept. Leave both empty if none are published yet.

    Spend ceiling

    $100.00 a month

    A limit on what their work costs Broa in model charges each calendar month. The client sees that a limit exists and is warned as they near it and when they reach it — never the amount. Reaching it stops new runs: Broa writes no more replies that month and hands new email to people instead. Every new client starts here; raise it on the Clients screen when they go live.

    Attempt —

    Trouble tickets

    What people at each company asked Broa for help with. Reply, and set where it stands; the company sees each reply as from Broa.

    Where the time goes

    How long Broa takes with a message, from the mailbox to a reply: each part of the way, and each step inside the pipeline, with its model and cost. Read only.

    Settings

    Every setting in one place: where its value comes from, its history, and a safe way to change one at a time. Every change is recorded with its reason and can be restored.

    Generation limits

    How much Broa may write, read, spend and take for one email, by default for every company. Every change is recorded with its reason.

    Borrowed access

    Every time Broa staff open a company, who, why, for how long and whether they could change anything. Each one was emailed to every platform administrator and is visible to the company. Mark each one reviewed once you have looked at it.

    Broa notices

    Tell companies about planned work, a known problem or news. Choose who sees it and when it expires; edit or withdraw it while it shows. Every change is recorded.

    Tenant mailboxes

    Mailboxes used to send approved replies, and whether Broa is reading them.

    Mailbox details

    Client Usage

    How much each client is using Broa, per ISO week (Monday to Sunday, UTC). Counts only: no message, no customer, no person’s name — people are counted per role. Seeing what is behind a number means borrowing access to that client, which is recorded and visible to them.

    Usage & cost

    Consumption for one company. Broa's internal provider cost and margin are not shown here and are not sent to this page (CON-MTR-003).

    Audit records

    Every decision and action, including reads (AUD-COV-001, AUD-COV-002). Reading this page is itself an audited access.

    Event-type registry live from audit-svc

    What this platform can record, and which types are critical — AUD-CAP-004 forbids the action from completing until a critical event is durably persisted.