Admin Operations Console

Help

Complete guide for the current governance workspace and every available Admin section.

Back to console

Admin Scope

Admin is a governance operations console. It manages identity governance, tenants, portal access, roles, sessions, audit review, and HR-v2 pilot governance.

Admin does not implement HR, Pulse, Sales, payroll, employee workflows, reports, or dashboards beyond governance review.

Access

Open the Admin portal, enter your operator email, request an OTP, enter the OTP from email, then verify it.

After verification, the console restores your Platform Core session and shows only the sections allowed by your permissions.

  • Portal: current portal key, usually admin-next.
  • Client: configured portal client id.
  • Bootstrap: whether Admin is trusted by Platform Core.
  • Restored: whether a central session was restored.
  • Refresh: latest successful refresh time.
  • Failure: refresh or bootstrap error.
  • Logout: latest logout result.

Permissions

Visible sections depend on Platform Core permissions. If a section is missing, the operator does not have the required permission.

  • platform_owner: full governance, tenant, user, portal, role, session, audit, and HR bridge access.
  • portal_admin: read-focused governance plus portal access, session, and audit operations.
  • manager: user, portal, and session read.
  • member: portal and session read.
  • viewer: portal read only.

Overview

Use Overview as the landing summary. Click Refresh to load current governance health.

  • Operator: current logged-in operator email.
  • Visible sections: number of Admin sections available to your role.
  • Governance health: latest loaded governance health status.
  • Permissions: number of effective permissions.

Governance Health

Use this section to confirm backend readiness before making governance changes.

Click Refresh and confirm core checks are healthy before changing users, roles, sessions, or portal access.

  • Overall: high-level governance status.
  • MongoDB: database connectivity.
  • Redis: cache and session infrastructure status.
  • Audit: audit subsystem status.
  • Session subsystem: session service status.
  • Readiness: Platform Core readiness state.
  • Readiness Checks: detailed key, status, and detail rows.

Directory

Use Directory for read-only lookup across users, tenants, portal assignments, and role assignments.

Set filters, click Refresh, then click a row to jump to related audit evidence.

  • Filters: Search, Role, State, Sort, Direction, Portal, From, and To.
  • Users: _id, email, displayName, status, portalAccess, createdAt.
  • Tenants: _id, key, name, status, createdAt, updatedAt.
  • Portal Assignments: userId, email, portal, status, roles, grantedAt, grantedByUserId.
  • Role Assignments: userId, email, portal, role, accessStatus, grantedAt.

Onboarding

Use Onboarding to prepare a Platform Core identity for governed portal access.

  • Governance Profile: enter Platform User ID, Email, Tenant ID, and Identity Subject, then click Link Profile.
  • Associate Tenant: enter Platform User ID and Tenant ID, then click Associate Tenant.
  • Portal Assignment: enter Platform User ID, choose portal, enter comma-separated roles, then click Assign Portal.
  • Role Assignment: enter Platform User ID, choose portal and role, then click Assign Role.
  • Use View Audit Evidence after a successful action to inspect the generated audit record.

Sessions

Use Sessions to inspect and revoke sessions. Status filters include all, active, revoked, and expired.

Click a session row to open Session Details. Token-like fields are hidden from the detail display.

  • Filters: User, Portal, From, To, and status.
  • Session Records: _id, id, userId, portal, status, createdAt, lastUsedAt, expiresAt, revokedAt.
  • Revoke Session: enter Session ID and Reason, click Revoke Session, then click again to confirm.
  • Revoke User Sessions: enter User ID, optionally select Portal, enter Reason, click Revoke User Sessions, then confirm.
  • Revocation actions require session.revoke and record governance audit evidence.

HR Pilot

Use HR Pilot only for the scoped HR-v2 pilot bridge validation path.

This section is not a broad HR rollout tool.

  • Pilot identity summary: pilot email, Platform user, HR user, tenant, eligibility, and session owner.
  • Validate Eligibility: checks whether the pilot identity is eligible.
  • Run Handoff Dry-Run: validates handoff without activating HR session ownership.
  • Run Denial Path: validates controlled rejection for mismatched HR identity data.
  • Execute Pilot Validation: runs the pilot validation path and requires user management permission.
  • Load Audit Evidence: loads pilot audit records.
  • View Bridge Audit: opens audit filtered to hr.sso.bridge.validated.

Lifecycle

Use Lifecycle to review one user's access history. Enter Platform User ID, click Refresh, then review the profile and histories.

  • Profile: platformUserId, email, tenantId, accountState, stateReason.
  • Role History: role assignment and revocation audit rows.
  • Assignment History: portal assignment audit rows.
  • Revocation History: access or session revocation audit rows.

Access Review

Use Access Review for periodic governance review. Filter by portal, role, state, or date range, then click Refresh.

  • Portal Access Inventory: portal access grants and statuses.
  • Role Inventory: role assignments by user and portal.
  • Inactive Users: inactive Platform Core users.
  • Locked Users: governance profiles with locked state.
  • Disabled Users: governance profiles with disabled state.
  • Click assignment rows to inspect audit context.

Audit Events

Use Audit Events for direct audit search and export.

Set filters, click Refresh, page through results, then export JSON or CSV when evidence needs to be attached to an incident or review record.

  • Filters: Actor, Target, Event, Portal, From, and To.
  • Audit Records: eventType, actor, target, outcome, createdAt, metadata.
  • Pagination: Previous, current page, Next.
  • Exports: Export JSON and Export CSV.

Investigation Presets

Use Investigation Presets for common audit investigations.

Click Refresh, select a preset, optionally filter by actor, target, portal, or date range, then click Run.

  • Authentication events: OTP, login, refresh, and session lifecycle.
  • Portal access changes: portal grants, revocations, and denials.
  • Role changes: role creation, assignment, and revocation.
  • Tenant changes: tenant lifecycle and user tenant changes.
  • Governance actions: bootstrap, profile, state, and tenant governance changes.
  • Session revocations: platform and governance session revocation events.

Tenants

Use Tenants to view and manage governance tenants.

  • Tenant table: _id, key, name, status, createdAt, updatedAt.
  • Create Tenant: enter Key and Name, select active, suspended, or archived, then click Create Tenant.
  • Update Tenant: enter Tenant ID, optional new Name, Status, and Reason, click Update Tenant, then click again to confirm.

Users

Use Users to view and govern user profiles and portal access.

  • User table: email, platformUserId, tenantId, accountState, createdAt.
  • Link Profile: enter Platform User ID, Email, Tenant ID, Identity Subject, select State, then click Link Profile.
  • Change State: enter Platform User ID, select State, enter Reason, click Change State, then click again to confirm.
  • Link Tenant: enter Platform User ID and Tenant ID, then click Link Tenant.
  • Grant Portal: enter Platform User ID, select Portal, enter comma-separated Roles, select Status, then click Grant Portal.
  • Revoke Portal: enter Platform User ID, select Portal, click Revoke Portal, then click again to confirm.

Roles

Use Roles to view role definitions and manage role assignments.

  • Role table: key, portalScope, rank, permissions.
  • Assign Role: enter Platform User ID, select Portal, Role, and Status, then click Assign Role.
  • Revoke Role: enter Platform User ID, select Portal and Role, click Revoke Role, then click again to confirm.

General Usage Rules

Use Refresh after changing filters or completing an action.

Filters are stored in browser local storage, so previous filters may remain when you return.

Changing most filters resets pagination to page 1.

Mutating actions show a result panel and usually offer View Audit Evidence.

Destructive or sensitive actions require a second click confirmation.

Current Limitations

Admin currently covers governance operations only.

Post-go-live reporting, dashboard expansion, and non-governance Admin business workflows are deferred.

HR-v2 controls are scoped to bridge and pilot validation and should not be treated as broad HR rollout controls.