Administration

Administration

Almost everything an administrator touches lives under Site Configuration, plus the top-level Manage Users surfaces. This page covers what each area is for and the decisions that are easy to get wrong.

Users, groups and roles

Security → Manage Users creates and manages accounts. There is no self-registration; an administrator creates people, or an identity provider does.

Access is granted three ways, and they compose:

• Roles — named bundles, assigned to people or groups
• Groups — collections of people, so a grant can target a team
• Direct grants — a permission given straight to a principal

Security → Hierarchy visualises how roles and groups nest.

Role assignment is itself a privilege

Two guards exist because handing out roles is how privilege escalates:

• Only a super-admin may assign SuperAdmin.
• Nobody may assign a role to themselves unless they already are a super-admin.

Assigning roles to other people is otherwise unrestricted, and revoking is checked against the specific role being revoked rather than the ability to assign roles in general.

A deliberate stopping point: two colluding assigners can still escalate each other. The general rule — you may only delegate permissions you already hold — needs a role-subset comparison the system does not yet have.

Permissions

Security → Set Permissions is where grants are written. A grant is (principal, kind, action, selector).

Kinds and actions

Every entity kind declares the actions that make sense for it — view, edit, delete, create, list, archive, assign, comment, publish, run, share, refreshbindings, and so on. Reuse an existing action rather than inventing one.

Selectors — scoping a grant

The selector is what makes a grant precise instead of global:

/kind[/ids][predicate]

Selector	Means
/record/*	Every record
/record/*[recordtype=INC]	Records of type INC
/record/[assignee=user]	Records assigned to the grant holder
/workflowexecution/{a,b}	Two specific executions
/record/*[assignee=user[supervisor=user]]	Records assigned to someone the holder supervises

Predicates are conjunctive, and the only operator is = — there is no !=, no comparison, no boolean keywords. user resolves to whoever holds the grant, which is what makes "my records" and "my team's records" expressible without naming anyone.

Why can this person do that?

Security → Permission Checker (also called Effective Permissions) answers it directly, for a principal and an action, including which grant or override produced the decision. Use it before theorising — content overrides and inherited grants make manual reasoning unreliable.

Rollout modes

Authorization has three enforcement settings, meant for staged adoption:

Setting	Behaviour
off	Grants ignored
read-only	Reads filtered, writes allowed
full	Both enforced

DryRun under full logs would-be write denials while still allowing them — a migration window, not a resting state. Production requires Enabled=true and Enforcement=full; the host refuses to start otherwise.

AssignSuperAdminToAllExistingUsers ships false and should stay false. Turning it on grants SuperAdmin to every existing user the first time it runs.

Pages and menus

Sitewide → Pages / Menus is the reason the product can be reshaped without a deploy. Menus and most pages are database rows.

A menu item is one of:

• Template — mounts a shipped page by its template key
• Route — points at a built-in parameterised route
• Alias — renders another route's component at a different URL
• Group / separator / action — structure and things like Logout

Items can be hidden rather than deleted, reordered, renamed and re-iconed. If a page seems missing, check whether its item is hidden before assuming it does not exist.

Custom pages can also be authored — content or JSX-backed — and given their own URL and menu placement.

Appearance

Sitewide → Appearance controls site name, logo (image, icon or text), login tagline and cover image, and the full colour palette — header, top menu, sidebar, buttons, surfaces.

The site name and logo text are what the header, login page and browser tab show. Changing them here overrides the shipped defaults; a guarded migration renames the default value on upgrade without touching branding you chose.

Status Appearance separately controls how record and workflow statuses are coloured.

Plugins

Plugins → Manage Plugins installs .zip packages that extend the platform at runtime: hooks, agent skills, connectors, transformers, analyzers, page templates.

Lifecycle is upload → enable → (update) → disable → delete. Enabling loads the assembly and creates the plugin's own database role and schema; each plugin gets plg_<code>, isolated from other plugins' tables.

Plugins → Documentation is the in-app developer guide for writing one, including the IAutoNatePlugin contract and the hook points.

Two operational notes:

• A plugin compiles against AutoNate.Plugin.Abstractions and ships without it, so the host's copy defines type identity. That assembly's version is pinned deliberately; changing it stops every existing plugin loading, with a misleading "type not found" error.
• Plugins are trusted code running in the host process. Installing one is a privileged act.

Observability

Surface	Answers
Bus Watcher	What events are flowing right now, with payloads
Events	The event catalogue — what each event type means and who publishes it
System Health	Are the dependencies reachable and behaving
System Issues	Detected problems, with severity, acknowledge/resolve, and in some cases remediation
Projections	The projection framework's state and retention

Bus Watcher needs a reachable Dapr sidecar; without one it says so rather than appearing empty.

Site settings

Sitewide → General and Features carry sitewide configuration and feature flags. Changes apply across the application.

Security posture worth re-checking

• Secret scanning, push protection and private vulnerability reporting are on for the repository; the equivalent for a deployment is the checklist in Installation.
• The local Compose stack binds every published port to 127.0.0.1 and ships known credentials. It is a development stack; exposing it is a deployment mistake, not a supported mode.
• Report vulnerabilities privately — SECURITY.md, never a public issue.