Last updated
For CoverGuard staff. The CoverGuard super-admin role is a strict superset of every other persona: you see everything, own the platform `/admin` surface, and can act-as (impersonate) any user.
How you get this role. You don't self-select it. Every validated
@coverguard.iostaff email is automatically elevated toCOVERGUARD_ADMIN— just sign in with your company email (email verification required). The platform owner is seeded as super-admin directly. The in-app role-change API refuses to grant or demote admin roles, so elevation is by staff domain or direct DB action only.
What you can see that customers can't
- Admin tab → the platform `/admin` surface — stats, users, Observability (PlatformPulse), agent rules, demo accounts, API-key approvals, staff→user outreach. The tab sits in the top nav to the right of Sys Admin and keys off your real staff role. Observability lives inside this console now (Admin → Observability), not as its own tab.
- Act-as any user (except a peer super-admin).
Everything a Buyer/Agent/Lender/Insurance/Admin sees is also visible to you.
Key staff workflows
Users & roles — /admin/users
List, search, and inspect users. Change a user's persona (cannot grant/demote ADMIN/COVERGUARD_ADMIN). Provision a user's AI key on their behalf — refused for admin targets, and every change is audited.
Act-as (impersonation) — "pull up anyone's instance"
It's an overlay, not a session takeover: you keep your own login and the client adds an act-as header to each request. From the /admin/users table, click Act as. A persistent banner shows who you're viewing, with one-click Exit. Start/stop are audited. You can never act-as another super-admin, and act-as sessions always use the managed AI key (never the target's BYOK key). See Platform admin & observability.
View as — see one Record the way a persona reads it
On a property's Record page, the header has a Preview as select (buyer, seller, agent, broker or lender) that only CoverGuard admins get. Pick one and the Record redraws the way that persona reads it — the consumer or professional Record, and for an agent, broker or lender their role's order, opening sections and glance cells — along with the links and tools that persona gets on the Record (only a seller sees the proceeds calculator, for example). Two buttons in the Record header follow your own account instead: Branded report, which you keep while previewing a buyer, and Share disclosure, which only a seller's own account shows — so you won't see it while previewing a seller. It is not act-as: you stay yourself, the server still decides what's filled in by your access, and nothing is saved — leave the Record and it resets, and it never changes your own "Which best describes you?" answer. It's on the full Record page only, not the pop-out.
Observability (PlatformPulse) — merged into Admin → Overview (/admin)
The single consolidated platform-health + business dashboard. It's merged into the Admin → Overview page — it follows the system-overview stats on the same page (it used to be its own Observability tab; /admin/observability now redirects to /admin). Two views (toggle at the top): the AI dashboard (default) — a Power BI-style, AI-forward view over real production data, with slicers, an auto AI headline, an Ask bar, and per-card Explain/Draft (grounded managed-key answers, deterministic fallback when no AI key); and Classic (?view=classic) — the original single-column live dashboard over real telemetry: overview, trends, composed health, the Focus feed (users to flag now from real signals — dunning, error bursts, carrier exits), platform metrics, the new-user activation funnel by persona, recent events, and per-user timelines. This also subsumed the old Usage page (/admin/usage redirects here).
Staff → user AI outreach (ADR-0013)
From the Observability Focus feed, AI-draft a message to a user (managed key, guardrail-screened, never auto-sends), review it, and send. Recipients can opt out (the send path respects it). Draft/send are rate-limited per staffer.
Agent rules — /admin/rules
Override the out-of-the-box CoverGuard Agents' objectives ("rules") from the app instead of editing code. Overrides apply to future installs; already-provisioned agents keep the objective they were created with.
Partner API-key approvals — /admin API keys
Approve or suspend partner API keys (the KEY_NOT_APPROVED gate), independent of billing.
Platform mode (demo or live) — Admin → Companies → Platform setup
Decide what every visitor is told about the data, without waiting for a redeploy. Demo shows the Modeled data ribbon and demo copy; Live removes them. Pick one and visitors see it within a few minutes. Use deployment default clears your choice and goes back to what the deployment is set to. Your choice wins over the deployment setting, so the control is never read-only. Each change is recorded with who made it and when, and the Overview badge says set in app while your choice is in force. Switching production to Live is a launch decision; make it only once that decision has been made. If the control says the mode can't be stored yet, the deployment is waiting on a database update and follows its default.
Score v3 preview kill switch — Admin → Companies → Platform setup
Partners calling the score API receive the new CoverGuard Score v3 as a clearly labelled preview beside the score they already use. If Product calls a halt — a property the preview declined goes on to bind, the broker pilot raises a stop, or an early result looks wrong — turn on CoverGuard Score v3 preview — kill switch. Partner responses stop carrying the preview within about a minute, with no redeploy; nothing else on the response changes. Turn it off to resume. The Score v3 preview tile on Observability shows whether it is serving or killed, and how many partner accounts received it in the selected window. If the toggle is read-only, the deployment has pinned it with an environment setting and an engineer has to change it.
Demo accounts — /admin/demo-accounts
List and (re)provision the seeded demo accounts. Demo accounts never receive email: alerts, digests and lifecycle emails meant for them are blocked and appear in Email delivery with a demo account label. A test email sent to a demo address is blocked the same way, so test with your own address instead. Beside the six persona accounts the page shows:
- Entitlement test accounts — one account each for the free tier, an expired subscription, a free account that has already used its one free Record, and a team member over their company's seat limit. Enter as opens any of them the same way as a persona. Each is reset to its state every time you provision, so a test that spent its search or its Record is undone by the next run.
- Golden properties — three properties whose risk is pinned, one per decision band (Clear, Constrained, Unplaceable). The badge reads Pinned while the stored band matches the expected one, and Drifted if it does not. Carrier availability is live, so a Record may show a stricter band than the pin, never a softer one.
Provision / refresh can take more than one request: each one does what fits in about ten seconds, and the page keeps going until nothing is left (the button shows the pass number). If a step fails, the page names it; press the button again to retry it. The full procedure, including what must be in place before you run it in production, is in the operations runbook for demo accounts.
Activity history — user × company × property
The activity history (surfaced in admin tooling) is a single, append-only, queryable record of meaningful user + property actions. Filter by user, company/team, property, event type, and time window; it's paginated and requires at least one filter (no unbounded scans). Use it to answer "what did this user / company / property do?" — distinct from usage telemetry, which answers "how is the platform being used / where does it hurt".
Guardrails to remember
- Super-admins always use the managed AI key — never a customer's BYOK key, even under act-as. Impersonation forces the managed key.
- You cannot act-as a peer super-admin.
- Role grants for admin personas are DB-only — the API won't do it.
- Outreach never auto-sends — a human reviews and sends; opted-out users are protected.
Troubleshooting quick hits
See Admin & staff tools troubleshooting. Quick hits:
- "Observability/admin 403s for me." — Your staff email may not be email-verified yet, or your role hasn't been elevated. Confirm
email_confirmed_atand re-sign-in. - "Act-as won't start for a user." — The target may be a peer super-admin (not allowed), or invalid. Check the audit log.
- "AI usage report is empty." — Historic; AI-cost telemetry began accruing from a fix point forward, so older windows can read empty.
Do this next
Open Observability and work the Focus feed — it surfaces the users worth a human touch right now (dunning, error bursts, carrier exits). Draft outreach, review it, and send.