Skip to main content

Operator onboarding and recovery

This chapter is for separately authorised platform operators. Tenant ADMIN/SUPER_ADMIN credentials do not sign in to /operator. Use the normal tenant login for tenant business work.

Operator sessions​

OPERATOR can manage tenants, entitlements and recovery. AUDITOR has read access to tenant/platform audit information. Operator sessions last 30 minutes and are kept in browser memory; reloading requires sign-in again. Five failed operator sign-ins lock new sign-ins for 15 minutes. These limits describe the operator identity system, not a universal promise about tenant-account timing.

Create and onboard a tenant​

  1. Sign in at /operator with the separate platform account.
  2. Open the create-tenant flow and enter Tenant code, Tenant name, First owner username and First owner email.
  3. Review the selected business and submit. The owner starts disabled pending setup.
  4. Select the tenant and enter a verified request/reference as the reason for the relevant operator action.
  5. In Accounts & recovery, issue the first owner's setup link.
  6. Copy the private link and deliver it through your verified support channel. The application does not send the email or verify mailbox ownership.
  7. The owner opens the link, sets a password and then signs in using the normal tenant login.
  8. Configure platform module/feature entitlements with their required dependencies and a reason.
  9. Hand tenant capability, staff role and unit setup to the authorised tenant owner.

The create flow retains a provisioning key for retries of the same tenant and changes it when the code changes. Matching details/key return the same tenant; conflicting details are rejected. If a response is lost, inspect the tenant list before starting another create request.

Recover access​

Verify the requester independently, select the exact tenant/account and provide the audited reason. Issue a recovery link through Accounts & recovery. The newest link supersedes older links and expires after 30 minutes. Issuance invalidates old sessions; acceptance changes the password, unlocks the account, consumes setup links and requires normal login afterwards.

Recovery does not re-enable an ordinarily disabled account. Pending first/replacement-owner invitations are an explicit exception. Suspended tenants cannot receive/accept setup links. A successful password setup does not change roles, units or subscription entitlements.

Replace an owner​

Select the previous owner and provide the replacement username, email and verified reason. Replacement disables the old owner immediately and preserves history, creates a disabled new owner and requires a separate invitation. There can be a period with no usable owner until setup completes. Plan that interruption before submitting.

Suspend or reactivate​

Use the tenant lifecycle action with a verified reason. Lifecycle changes revoke tenant sessions and pending setup links; activation does not resurrect an expired/invalidated link. Reissue setup where necessary and have staff sign in again. Entitlement changes still do not grant operational roles or units.

Private setup links are credentials. Do not paste them into screenshots, shared tickets or this guide. First-platform-operator bootstrap and additional operator-account maintenance are deployment/support procedures outside this browser guide; no default operator password is created.