12 — Administration UI

Status: Active frontend handoff

Administration is tenant control-plane UI for authorized users. It is separate
from everyday work projections but uses the same Gateway, tenant and audit
contracts.

Projections

• Organizations and tenant profile
• Users and memberships
• Roles, permissions and policy assignments
• Audit and governance history
• Billing and entitlements
• Deployments and environment health
• API key metadata and rotation state
• Security posture, sessions and connection revocation

Hard rules

• The effective permission set comes from the server; the client never grants
  itself admin navigation or actions.
• Member, role, key, billing and security changes require explicit confirmation,
  expected version and audit reason.
• Sensitive actions may require step-up authentication and governance approval.
• API secret values are displayed only at creation when the backend contract
  explicitly permits it; stored credentials are never returned.
• Tenant deletion, export and retention actions show scope, dependencies,
  recoverability and legal-hold conflicts before confirmation.
• Customer Zero controls never appear in ordinary customer-production tenants.