All features
Control
Platform console
The operator's console across firms, which can see what it did and nothing else.
Running a multi-tenant platform requires an operator view: creating firms, seeing platform-level metrics, investigating a problem. The risk is that such a console quietly becomes a master key to every client's confidential material.
So the boundary is drawn explicitly. The console has its own authentication, session and audit trail, and it does not read a firm's audit log. That table is tenant data, and its descriptions name matters, clients and documents. The console can see what the console did, and nothing else.
Operations
- Firm creation and management
- Platform-level metrics across tenants
- Its own authentication and session handling, separate from firm sign-in
The boundary
- A platform audit trail recording what operators did
- No access to a firm's own audit log, whose entries name matters, clients and documents
- Visibility rules stated in the code rather than left to convention