06.18
Administration and platform console
Executive summary
Two consoles with different reach. Clinic administration manages users, roles, invitations, sessions, audit review and erasure inside one tenant. The platform console — rollout grants, model releases, clinician licences, entitlements, AI reports, bug reports, security anomalies — is the only cross-tenant surface, and every action on it is audited. Cross-tenant reads use an explicit platform scope rather than a bypass of row-level security.
Overview
- ProductionGovern · Administration and platform consoleOperate the platform and each clinic without giving any operator a path around tenant isolation.
Pipeline
- Clinic administrators act through tenant-scoped admin routes behind authentication and an admin rate limiter.
- Platform administrators act through
/api/platform/*, which additionally requires the platform-admin role. - Cross-tenant work runs under an explicit platform scope helper and an audited admin-action wrapper.
- A scheduled anomaly scan reads the audit trail for cross-clinic access patterns and raises security anomalies.
Data owned
- Users, roles, clinic membership
- Holds
- Authorization
- Rollout grants and entitlements
- Holds
- Who may use what
- Security anomalies
- Holds
- Flagged access patterns from the audit trail
- Bug reports
- Holds
- Stored in Cloud Storage and forwarded to the issue tracker
| Store | Holds |
|---|---|
| Users, roles, clinic membership | Authorization |
| Rollout grants and entitlements | Who may use what |
| Security anomalies | Flagged access patterns from the audit trail |
| Bug reports | Stored in Cloud Storage and forwarded to the issue tracker |
Models and engines
This module makes no model calls. Everything it computes is deterministic code.
Guardrails
- Platform routes require a separate role on top of authentication.
- Cross-tenant scope is explicit and audited; accepted exceptions live in a tenant-isolation exception register enforced by a test.
- Erasure runs through one audited endpoint with tombstones replayed after any restore.
Rollout and status
- ProductionClinic administration and platform consoleAudited
Interfaces
- Consumes
- What
- Audit trail
- Consumes
- What
- Rollout and entitlement state
- Emits
- What
- Grants, releases and entitlements
- Emits
- What
- Security anomalies
| Direction | What |
|---|---|
| Consumes | Audit trail |
| Consumes | Rollout and entitlement state |
| Emits | Grants, releases and entitlements |
| Emits | Security anomalies |
SOURCE OF TRUTH
server/routes/admin.tsserver/routes/platform*.tsserver/services/anomalyDetection.tsdocs/runbooks/tenant-isolation-exception-register.md