For CoverGuard staff. The CoverGuard super-admin role is a strict superset of every other persona: you see everything, own the platform `/admin` surface, and can act-as (impersonate) any user.
How you get this role. You don't self-select it. Every validated@coverguard.iostaff email is automatically elevated toCOVERGUARD_ADMIN— just sign in with your company email (email verification required). The platform owner is seeded as super-admin directly. The in-app role-change API refuses to grant or demote admin roles, so elevation is by staff domain or direct DB action only.
What you can see that customers can't
- Admin tab → the platform `/admin` surface — stats, users, Observability
(PlatformPulse), agent rules, demo accounts, API-key approvals, staff→user outreach. The tab sits in the top nav to the right of Sys Admin and keys off your real staff role. Observability lives inside this console now (Admin → Observability), not as its own tab.
- Act-as any user (except a peer super-admin).
Everything a Buyer/Agent/Lender/Insurance/Admin sees is also visible to you.
Key staff workflows
Users & roles — /admin/users
List, search, and inspect users. Change a user's persona (cannot grant/demote ADMIN/COVERGUARD_ADMIN). Provision a user's AI key on their behalf — refused for admin targets, and every change is audited.
Act-as (impersonation) — "pull up anyone's instance"
It's an overlay, not a session takeover: you keep your own login and the client adds an act-as header to each request. From the /admin/users table, click Act as. A persistent banner shows who you're viewing, with one-click Exit. Start/stop are audited. You can never act-as another super-admin, and act-as sessions always use the managed AI key (never the target's BYOK key). See Platform admin & observability.
Observability (PlatformPulse) — merged into Admin → Overview (/admin)
The single consolidated platform-health + business dashboard. It's merged into the Admin → Overview page — it follows the system-overview stats on the same page (it used to be its own Observability tab; /admin/observability now redirects to /admin). Two views (toggle at the top): the AI dashboard (default) — a Power BI-style, AI-forward view over real production data, with slicers, an auto AI headline, an Ask bar, and per-card Explain/Draft (grounded managed-key answers, deterministic fallback when no AI key); and Classic (?view=classic) — the original single-column live dashboard over real telemetry: overview, trends, composed health, the Focus feed (users to flag now from real signals — dunning, error bursts, carrier exits), platform metrics, the new-user activation funnel by persona, recent events, and per-user timelines. This also subsumed the old Usage page (/admin/usage redirects here).
Staff → user AI outreach (ADR-0013)
From the Observability Focus feed, AI-draft a message to a user (managed key, guardrail-screened, never auto-sends), review it, and send. Recipients can opt out (the send path respects it). Draft/send are rate-limited per staffer.
Agent rules — /admin/rules
Override the out-of-the-box CoverGuard Agents' objectives ("rules") from the app instead of editing code. Overrides apply to future installs; already-provisioned agents keep the objective they were created with.
Partner API-key approvals — /admin API keys
Approve or suspend partner API keys (the KEY_NOT_APPROVED gate), independent of billing.
Demo accounts — /admin/demo-accounts
List and (re)provision the seeded demo accounts.
Activity history — user × company × property
The activity history (surfaced in admin tooling) is a single, append-only, queryable record of meaningful user + property actions. Filter by user, company/team, property, event type, and time window; it's paginated and requires at least one filter (no unbounded scans). Use it to answer "what did this user / company / property do?" — distinct from usage telemetry, which answers "how is the platform being used / where does it hurt".
Guardrails to remember
- Super-admins always use the managed AI key — never a customer's BYOK key, even under
act-as. Impersonation forces the managed key.
- You cannot act-as a peer super-admin.
- Role grants for admin personas are DB-only — the API won't do it.
- Outreach never auto-sends — a human reviews and sends; opted-out users are protected.
Troubleshooting quick hits
See Admin & staff tools troubleshooting. Quick hits:
- "Observability/admin 403s for me." — Your staff email may not be email-verified yet, or
your role hasn't been elevated. Confirm email_confirmed_at and re-sign-in.
- "Act-as won't start for a user." — The target may be a peer super-admin (not allowed),
or invalid. Check the audit log.
- "AI usage report is empty." — Historic; AI-cost telemetry began accruing from a
fix point forward, so older windows can read empty.
Do this next
Open Observability and work the Focus feed — it surfaces the users worth a human touch right now (dunning, error bursts, carrier exits). Draft outreach, review it, and send.