Event-Driven Notification Platform · View 22 of 26 · 5 · Operations

Administration and Operations Surface

What an operator can do, who may do it, and which actions are dangerous enough to gate.

Editable source SVG draw.io All views

Decisions

The console is a client of the Admin API and has no privileged path of its own, so every capability is scriptable and testable
Read, configure and dangerous are three separate authorisation tiers, not one admin role
Every dangerous action requires step-up authentication, a second approver and writes an audit record before it runs

Why replay is treated as dangerous

A careless range can re-decide millions of events and, if deduplication is degraded, re-send them
Capped by event count and time range, requires a second approver, and dry-run reports the affected count before execution
The same treatment applies to DLQ redrive, PII erasure and tenant pause

Deliberate omissions

The console's screen designs and information architecture, which are a product deliverable
Break-glass access, which follows the enterprise privileged-access standard rather than a platform-specific one

◀ Observability and Operations All views The Operator Loop ▶