Administer another tenant

Platform authority confers no access to a tenant's data on its own (IDN-ELV-001). An elevation is a bounded, recorded grant that lets you administer one tenant for a limited time.

The tenant can see this elevation in their own audit records, including who you are and the justification you give (IDN-ELV-005). It ends automatically and can be ended sooner.

Sign in

This console shows nothing until you are signed in — not the queue, not identity administration, and not the dashboard.

· · ·

Messages in the chain

Attachments

Listed, not openable — these were sandboxed at admission and this view does not serve them.

    Headers 
    
    
    

    
    
  
    
    

    



    
  
    
    
    
      
    Dashboard
    
      
    How your correspondence is flowing, stage by stage. Each
        card shows the worst state of its parts and then lists them, so the colour
        is never the whole story. Checked every 15 seconds — last at
        —.
    
    
    
    
    
  
    

  
  

  
    

  

    



    
  
    
    
    
      
    Dashboard
    
      
    Left to right is outside to inside. Platform services sit
        underneath because every plane depends on them. Probed live through the
        gateway every 15s — last at —.
    
    
    
    
    
  
    

  
    
  
    
    
    
    
    
    
  
    

  

    




    
  
    Import a mail file
    
  
    Loads .eml files through the same admission pipeline
    as any other message (ING-FIL-001). Use it to bring existing
    correspondence in — an archive, a client's forwarded mail — rather than to relay
    something that has just arrived. For that, use
    Compose.
    

  
    
    
    What is this correspondence?
    
    
    This decides whether the platform may ever answer it, so it is
      asked before the files rather than after.
    
    
    
    
    
    There is no option here for live mail, and
      that is deliberate. An imported message is admitted with a non-live origin
      (ING-FIL-003) and the run token minted for it carries no capability
      to send (ING-FIL-004) — so importing a customer's old question
      cannot result in them being emailed about it weeks later. The service refuses
      origin=live outright; this list is not what enforces it.
    
  
    

  
    
    
    Files
    
    
    
    No files chosen.
    
    
    
  
    

  

    


    
  
    Compose a message
    
  
    This enters the same admission pipeline as a message that
    arrived by mail or came in on a file import (ING-SUB-001). Nothing
    downstream can tell it apart, and nothing here is trusted more than a message
    relayed by a tenant's own backend.
    

  
  
    Submitted on behalf of your signed-in
    tenant. There is no tenant field here and typing one would have no effect:
    the tenant comes from your session token (ING-SUB-003).
    

  
    
    
    
      
      
    
    
    
    
    
    
    
    
      Idempotency key — — the same
        key rides every retry of this message, so a double-click produces one enquiry
        (ING-SUB-008).
    
  
    

  
  
  

  

    



    
  
    Ingestion — Manage
    

  
    
    
    Intake limits
    
    
    What this tenant's intake accepts. Enforced by
      ingestion-svc before a request is buffered or parsed
      (ING-LIM-002), and owned here as configuration
      (CFG-COV-016) so a change is versioned, revertible and audited.
    
    
    A tenant may set a limit below the platform ceiling and
      never above it (ING-LIM-003). A value of zero is refused: stopping
      intake is a tenant lifecycle action, not a limit.
    
    
    Reading the configured limits…
    
    
    
  
    

  
    
    
    Intake paths and publication
    
    
    
    Not reported by this deployment.
      CON-ADM-014 requires the intake-path and publication flags shown
      here, and ingestion-svc exposes no endpoint that carries them. This
      panel shows nothing rather than an all-clear it cannot support: an operator
      looking at a stalled queue would otherwise read "no problems" from a page that
      never asked.
    
    
    Of the five intake paths, two accept anything today —
      file import and the submission endpoint behind Compose. Publication to
      the event bus is not wired, so nothing downstream is notified of an admitted
      message.
    
  
    

    



    
  
    Runs
    
  
    
  
    
  
  

    


    
  
    Parties
    
  
    Who this tenant corresponds with — accounts and prospects, and the
    people, systems and agents acting for them. An index, not a customer store
    (PTY-MOD-007a): identity and the association graph only. Orders,
    invoices and prices stay in the tenant's own system, reached live through
    external_ref.
    

  
  
    
  
  
    

  
  
  
  
  

  
  
    
    
    
    
    
    
  
    
  
    A party added here is created confirmed: you
    asserted it, so it does not appear in the unconfirmed queue above. Parties may
    also reach this list by other routes — this console is told what exists, not
    how it got here.
    

  
  
  
    

  

    


    
  
    Identity administration
    
  
    Tenants are platform-plane (CON-IDN-002). Everything inside a
    tenant is tenant-plane. There is no identity directory — members are added by
    exact issuer and subject, because a searchable one would disclose which
    addresses exist in other tenants (CON-IDN-004).
    
  

  
    
    
    Tenants platform plane
      
      
    
    
    NameStatus
    
      
    
    
    
    
    
    One action, not four — IDN-TEN-005 makes the
      tenant, its default workspace, the first membership and the first admin role
      atomic.
    
  
    

  
  
    

  
  
    
  
    
    
      
    
      
    
      
        
        
      
    
    
      

  

  
  
    
    
      
    Onboard tenant
    
      
    Creates the tenant, its default workspace, the first
        membership and the first admin role as one atomic act
        (IDN-TEN-005).
    
      
    This is the tenant's bootstrap, and the first
        administrator is not optional. Members are added by someone who is
        already inside the tenant — the route is tenant-scoped, so it needs a
        session that names this tenant. A tenant created with nobody in it could
        therefore never acquire anyone: not by you, because platform authority
        grants no standing access to tenant data (IDN-ELV-001), and
        not by them, because there is no one yet. This form is the one place a
        membership can be created from outside, which is what makes it onboarding
        rather than an edit.
    
      
    Name the person who will run this tenant, not
        yourself. After this they add everyone else — including further
        administrators, of which a tenant may have any number — from inside, with
        their own session and their own audit trail.
    

      

      
    
        First administrator
        
    Identified by issuer and subject — who
          vouched for them, and their id there. Together these are the account key
          (IDN-IDM-002).
    
        
    They must already exist in the identity provider.
          The subject IS their id there, so it cannot be known before the account
          does — there is no invite-by-email, and an address on its own cannot
          create anyone. Either create their account first and use the id it
          returns, or let them sign in once: they will be refused for having no
          membership, and the page that refuses them prints the subject to send
          you.
    

        
        
    Issuer: —
          fixed for this deployment — a value entered here is not used
    

        

        
      
    

      
        
        
        
      
    
    
      

  
  
    
    
      
    Add member
    
      
    Adds the identity to this tenant and grants no
        role — membership and role assignment are separate acts with different
        blast radii (CON-IDN-005). Assign roles from the member's Edit
        panel afterwards.
    
      
    There is no directory to search: an identity is named by
        exact issuer and subject, because a searchable list would
        disclose which addresses exist in other tenants
        (CON-IDN-004).
    

      
    Issuer: —
        fixed for this deployment — a value entered here is not used
    

      

      

      
        
        
      
    
    
      

  
    
    
      
    Edit tenant
    
      
    Platform-plane fields only. Pipelines, intents, tone,
        approval thresholds and credentials are tenant-plane and are not reachable
        from here (CON-IDN-016, CON-ELV-002).
    
      
      
      
        
        
      
    
    
      

  
    
    
      
    Edit membership
    
      
    
      
    Roles
    
      
    
      
        
        
      
    
    
      

    





    
  
    Configuration
    
  
    A revision is immutable and publication is a separate act
    (CFG-VER-001, CFG-VER-005). Saving changes nothing
    until a configuration set is published, and every row below says which state
    it is in.
    

  
  
  

  
    



    
  
    Usage & cost
    
  
    Consumption for this tenant. Broa's internal provider cost
    and margin are not shown here and are not sent to this page
    (CON-MTR-003).
    

  
  

  

    


    
  
    Audit records
    
  
    Every decision and action, including reads
    (AUD-COV-001, AUD-COV-002). Reading this page is
    itself an audited access.
    

  
    
    
    
    
    
    
    
  
    

  
  

  
  
    
    Event-type registry 
      live from audit-svc
    
    What this platform can record, and which types are
      critical — AUD-CAP-004 forbids the action from completing
      until a critical event is durably persisted.