Control Plane Admin (Dev) checking…roles: —
Help & Guidance
Use this console to operate the Control Plane: plans, entitlements, identity mapping, domain claims, usage metering, and admin settings.
- Billing & Seats: configure plan defaults; Upgrade flows handled in Tenant Admin via Checkout.
- Identity: set SCIM group → role mapping; enable SSO/SCIM for Enterprise tenants.
- Domain Claims: verify customer domains for SSO group mapping (Enterprise).
- Usage & Audit: inspect usage summaries; use Tenant Admin for audit log viewing.
- Security: WAF, RLS isolation, encrypted storage; rotate secrets in vaults.
- Docs: see Tenant Admin Guide and Deploy Runbook.
Provision Organization
Create a new tenant and optionally seed a workspace. Choose plan corporate for Enterprise.
{}
Help & Guidance
- Select corporate for Enterprise tenants.
- After provisioning, use Identity and Domain sections to configure SSO/SCIM.
- Docs: Enterprise Onboarding
Entitlements Check
{}
Workspaces
Plan Toggle (Demo)
Switch current org plan for demos. Requires ALLOW_PLAN_TOGGLE=true on Control Plane API.
External Data Plane
Register an external database and storage for this Org. In production, store DB URL in Secrets Manager; in dev, plaintext is accepted.
Custom AI Provider
Configure a private AI endpoint for this Org. Requires AI_CUSTOM_PROVIDER_ENABLE=true on API.
{}
Usage Summary (AI Tokens)
{}
Last 30 Days
{}
Ingest Test Usage Event
Org Usage (Admin)
Reads usage for the current Org Id using admin endpoint.
{}
Org Settings (Branding)
{}
Billing / Checkout
Billing Portal
Subscription Snapshot
{}
Webhook Dev Helper
SSO Smoke Test (Cognito)
Help & Guidance
- Configure env in Control Plane API:
COGNITO_DOMAIN, COGNITO_CLIENT_ID, COGNITO_REDIRECT_URL.
- Open Hosted UI to verify redirect (API returns 302). If misconfigured, API returns 501 and lists missing vars.
- Use Simulate Callback to test code exchange; optional PKCE verifier header can be included.
- Docs: AUTH_COGNITO, Enterprise Onboarding, Admin Control Plane Runbook
{}
Domain Claims
Help & Guidance
- Create a claim for the customer domain (example.com).
- Add a DNS TXT record value:
sip-verify=<token>.
- Propagation can take minutes; then paste the TXT value or token and Verify.
Example TXT record: sip-verify=<token>
Help: Enterprise at Scale
Quick guidance for onboarding many Enterprise customers in parallel.
- Throughput: each tenant typically takes 10–20 minutes end-to-end (provision, domain, SSO). With prep, one operator can handle 10–20/day.
- Operator tasks: Provision org, share domain TXT token, set group→role mapping defaults, verify claim, sanity-check SSO callback.
- Customer IT tasks: Create DNS TXT (sip-verify=<token>), configure IdP app (Cognito/Okta/Azure AD), enable SCIM, confirm login test.
- Parallelization: Use Org Search and Favorites to juggle multiple customers; tokens/audit show progress and who changed what.
- Guardrails: Domain token normalization helps reduce copy/paste errors; SSO smoke test shows missing env quickly.
- Handover: After SSO works, ask IT to test SCIM Users/Groups; confirm seat caps and role mapping; escalate only if mapping conflicts arise.
Control Plane Admin v0.9.89 e5db486cbe31