Description
Staff Operator Management gives authorized DOTS staff a dedicated roster for administering who can enter the cross-tenant console and what role they hold. Operators can be added by identity email or hosted-auth user identifier, assigned one of the five platform roles, suspended or reactivated, and moved between roles. The UI hides forbidden self-actions and last-owner changes, while the server independently enforces those invariants.
Every successful mutation and its staff audit entry are written as one database operation. A failed audit insert therefore prevents the operator change from persisting, and a duplicate or missing identity returns a stable typed conflict instead of an ambiguous success. The roster itself is a gated, audited cross-tenant read with complete loading, empty, error, and denied presentation.
Selling Points
- Centralizes staff access administration in the same console operators use for platform work.
- Prevents an operator from suspending or re-roling their own account during an active session.
- Protects the last active platform owner, avoiding an unrecoverable operations lockout.
- Couples every roster mutation to an audit entry so privileged changes cannot persist anonymously.
- Supports safe add-by-email resolution without exposing a customer membership workflow to staff identities.
User Story
A platform owner onboards a new support specialist by email, gives them the Support role, and confirms their active roster entry. Months later, the owner suspends that account when responsibilities change. The console prevents unsafe action on the owner’s own row and refuses removal of the final active owner. The team walks away with a current, accountable staff access roster.
Extension Surface
This capability is automatable. The operator list and mutation routes in packages/api/src/routes/platform.ts expose the same guarded lifecycle used by apps/admin/src/modules/operators/components/OperatorsPage.tsx. packages/platform/src/internal/service.ts implements the fixed invariants and atomic audit coupling; there is no supported external operator-directory or role-provider registration seam.
Capabilities & Limits
- Lists staff operators with role and active or suspended status.
- Adds operators and supports suspension, reactivation, and role changes.
- Rejects duplicate identities, self-actions, and changes that remove the last active owner.
- Requires a hosted identity record before an operator can be added by email.
- Manages DOTS staff only; it does not invite or administer customer workspace members.
Implementation Map
packages/platform/src/internal/service.tspackages/db/src/schema/platform-operators.tspackages/api/src/routes/platform.tsapps/admin/src/modules/operators/components/OperatorsPage.tsx