Skip to content

Admin portal

Purpose

BizOS is a multi-tenant SaaS: each customer company is a tenant with its own isolated database and its own subdomain, and new tenants are provisioned automatically after sign-up. The admin portal is the internal web application the BizOS team uses to run that platform: see every tenant, step in when automation fails, protect tenant data, and know the platform is healthy.

The admin portal is not the tenant admin area. Tenant admins manage their own users and settings inside their workspace; operators manage tenants as a whole from the admin portal.

Parts

The portal is specified and built in three parts. Operations comes first because the platform cannot go live without it.

Part Scope Status
Operations Operator access and audit, tenant management, provisioning monitor, backup/restore/reset, system health Draft (this folder)
Billing Plan catalog, subscriptions, invoices and payments, revenue and payment status dashboard Not started
Platform configuration AI provider settings, default tenant configuration, platform-wide settings Not started

Operations specs

File Prefix Covers
00-layout.md LAY Portal frame: sidebar navigation, header, collapsed and mobile sidebar, page not found
01-operator-access.md ACC Operator accounts, roles, sign-in with MFA, operator activity log
02-tenant-management.md TEN Tenant list and detail, suspend, reactivate, delete
03-provisioning-monitor.md PRV Provisioning runs, step status, retry, alerts
04-backup-restore-reset.md BKP Per-tenant backups, restore, reset to defaults, maintenance mode
05-system-health.md HLT Operations dashboard, service status, background jobs, schema migrations, email delivery
06-all-users.md USR All user accounts across workspaces, status, roles, search, filters, and pagination
07-crm-oversight.md OVR Tenant detail CRM & Sales tab

Principles

  1. Separate from tenants. The portal runs on its own reserved host (for example admin.<root-domain>), with its own operator accounts. Tenant user accounts can never sign in to it, and operator accounts can never sign in to a tenant workspace.
  2. Metadata, not business data. Operators see tenant metadata (name, subdomain, status, owner contact, user count, storage, activity) but not tenant business records (customers, contracts, tasks, transactions). Any future support access to tenant data needs its own spec and tenant consent.
  3. Every action is audited. Every operator write is recorded with who, when, target, reason, and result. Destructive actions require a reason and a typed confirmation.
  4. Least privilege. Read access by default; risky actions are limited to the roles that need them.
  5. Safe by default. Destructive actions take an automatic backup first, and deletion has a grace period.
  6. Summarise, then link. The portal shows an operations summary; it does not replace dedicated monitoring and logging tools.
Admin portal
├── Dashboard                  (HLT)
├── Tenancy                    (TEN)
│   └── Tenant detail
│       ├── Overview
│       ├── CRM & Sales        (OVR)
│       ├── Provisioning       (PRV)
│       ├── Backups            (BKP)
│       └── Activity           (ACC audit, filtered to the tenant)
├── Provisioning               (PRV)
├── System health              (HLT)
│   ├── Services
│   ├── Background jobs
│   ├── Schema migrations
│   └── Email delivery
├── Operators                  (ACC)
├── All users                  (USR)
├── Roles & permissions        (ACC)
├── SMTP settings              (SMTP)
└── Activity log               (ACC)

Shared rules

  • Reserved subdomains (admin, api, app, www, status, mail, and any added later) can never be assigned to a tenant; sign-up and every subdomain check must reject them.
  • Lists are paginated (default 25 rows), sortable, and filterable; the current filter is kept in the URL so it can be shared.
  • Times are shown in the operator's time zone and stored in UTC.
  • Every confirmation dialog for a destructive action names the tenant and the consequence in plain words.

Glossary

Term Meaning
Tenant One customer company, with its own isolated database and subdomain
Tenant owner The first user of a tenant, created at sign-up
Operator A member of the BizOS team with an admin portal account
Control plane The shared database that stores tenants, operators, and platform records, separate from tenant databases
Provisioning run One execution of the automated steps that create a tenant
Maintenance mode A tenant state in which its users see a maintenance page while an operator action runs