Tenant Admin Console — Guide

Overview

The Tenant Admin Console lets organization owners and admins manage branding, usage, subscriptions, members, and content packs without developer access.

What Tenant Admins Can Do

- Branding: Update primary/secondary colors and logo for the console and theme.
- Entitlements: Inspect current plan features and limits.
- Usage: View monthly AI token usage and rate limits; export recent usage events.
- Subscription: View Stripe subscription snapshot (status, period, Creator seats, Business Lever add-on).
- Upgrade / Checkout: Create Stripe Checkout sessions to add Creator seats or enable Business Lever.
- Invite Viewer: Invite unbilled Viewer users by email.
- Manage Members: List members, filter by role, change roles (Creator promotions respect seat cap), and resend Viewer invites.
- Prompt Packs: Publish and manage Prompt Packs at org or workspace scope; set active/pin.

Viewer Experience & RBAC

- Viewers are read-only:
  - Can see Strategic Framework (uploaded vs emergent) and Portfolio analysis.
  - Creation, uploads, and Business Levers are hidden by default.
- Creators and Admins can create/edit content and upload strategy.

How to Get More Seats

- Use the “Upgrade / Checkout” card to purchase additional Creator seats.
- After successful payment, the subscription snapshot updates and the Creator seat cap is raised automatically.
- Promotions to Creator respect the new seat cap.

Upgrade to Enterprise Tier

- Contact support to enable SSO/SCIM and Enterprise features (BYO keys, residency options, advanced levers).
- Settings → API Configuration now surfaces an “Organization AI Key” panel (visible when `VITE_REMOTE_AI=true`). Admins can paste the tenant’s OpenAI key once and it will be stored in AWS Secrets Manager (eu-north-1) for all users.
- Enterprise onboarding includes domain verification, IdP federation, group→role mapping, and governance setup.

InfoSec & Controls

- Data Isolation: Row-Level Security (RLS) ensures strict org-level isolation in Aurora PostgreSQL.
- Storage: S3 objects are encrypted server-side; SSE-KMS optional per-tenant.
- Access: API is fronted by WAF; audit logs capture critical admin activities (invites, role changes, settings).
- Secrets: Keys stored in vault (e.g., AWS Secrets Manager) and never exposed in clear to clients.

Troubleshooting & Tips

- If seat promotions fail with “cap exceeded”, purchase more seats via Checkout or downgrade other Creators.
- If invites emails don’t arrive, verify SES configuration or contact support—invites still create Viewer memberships.
- Use “Manage Members” to quickly adjust roles and resend invites; use “Audit Logs” to review actions.