Description
Staff Operator Authority is the security plane for DOTS employees who need to operate the hosted platform across tenant boundaries. It is intentionally separate from customer workspace RBAC: operator actors carry no company identifier, use a dedicated platform.* permission catalog, and never enter the customer can() evaluator. Five role baselines resolve to additive atom sets, while invalid or unrecognized roles produce no actor and fail authentication closed.
Cross-tenant reads and mutations pass through the shared platform service rather than hand-rolled route queries. The customer-content firewall is enforced by both role design and the absence of production routes honoring content or impersonation atoms. Every operator read is audited with contained telemetry behavior, while mutations couple their audit record atomically to the state change.
Selling Points
- Separates internal operational privilege from customer workspace roles, preventing a staff identity from accidentally masquerading as a tenant principal.
- Gives support, analysis, administration, and ownership responsibilities distinct additive baselines.
- Keeps customer content unavailable to ordinary staff roles even when they can inspect platform-wide metadata and health.
- Fails closed when an operator record has an unknown role or inactive status.
- Produces an audit trail for cross-tenant operations without relying on application screens to remember logging.
User Story
A support analyst signs in to the staff console and receives only the metrics and operational capabilities in their platform role. They can review fleet health but cannot manage operators or access customer content. An owner can perform the narrower set of privileged administration actions, and every read or mutation is attributed. The operations team walks away with useful platform access that remains distinct from customer tenancy.
Extension Surface
This capability is fixed_core. The catalog in packages/platform/src/internal/catalog.ts, baselines in packages/platform/src/internal/baselines.ts, and fail-closed actor construction in packages/platform/src/actor.ts are internal security contracts. The browser gate in apps/admin/src/modules/access/components/OperatorGate.tsx consumes them, but there is no supported external role, atom, or operator-auth plugin registry.
Capabilities & Limits
- Resolves five staff roles into a dedicated platform permission set.
- Gates and audits sanctioned cross-tenant metadata and operator-management operations.
- Keeps customer RBAC and staff authority structurally separate.
- Does not currently expose production customer-content or impersonation routes.
- Uses additive grants only; it is not a conditional policy engine.
Implementation Map
packages/platform/src/internal/catalog.tspackages/platform/src/internal/baselines.tspackages/api/src/auth/platform-auth.tsapps/admin/src/modules/access/components/OperatorGate.tsx