Platform Admin console¶
Status: Current | Last reviewed: 2026-09-29
The Platform Admin console is where platform (super) administrators manage tenants and the users across all of them. It's separate from a single tenant's Configuration screens — those manage one tenant; this manages the whole platform.
You'll only see it if you're a platform administrator. Open it from the profile menu in the bottom-left (your name) → Admin.
The same profile menu lists every active tenant. Select a tenant before working with its agents, workflows, or integrations. Platform-admin status grants the ability to switch to any active tenant; it does not mix another tenant's agents into the currently selected workspace.
What you can do¶
The console has two tabs.
Tenants¶
- Create a tenant — give it a name, an optional icon (emoji or image URL),
and a slug. The slug is a short, URL-safe identifier (e.g.
acme) used to map single sign-on group claims to the tenant. It can't be changed after creation, so pick it carefully. - Edit a tenant's display name and icon.
- Deactivate a tenant. Its data is preserved, but users can no longer access it. (The default tenant can't be deactivated.)
- Manage members — open a tenant's Members to add a user, change a member's role, or remove them.
Users¶
- Create a user — enter a username (their sign-in identifier), and optionally a display name and email. When you create a user you get a one-time recovery link — copy it and send it to the person so they can set their password. There's no email sent automatically.
- Regenerate a recovery link for an existing user (the key icon) if they need to reset access.
- Edit a user's display name, email, and active status.
- Deactivate a user so they can no longer sign in.
- Grant or revoke platform admin (the shield icons) to give or remove full platform-wide access.
Roles¶
When you add a tenant member, choose Admin, Builder or Viewer. Admin has full tenant access. Builder creates, edits and runs agents of every type and manages tools. Viewer browses and runs saved agents, including workflows, without authoring or configuration access.
Platform Admin is a separate platform-wide assignment with all operations in every tenant, even when the user's explicit tenant membership is Viewer. Tenant Admins manage their own tenant's members through Settings → Access → Members; they cannot grant Platform Admin or administer another tenant.
See User roles for the full matrix and migration mappings.
How changes stick¶
Access in TrueServe is ultimately governed by your identity provider (Authentik). The console writes your changes to both TrueServe and the identity provider, so they take effect immediately and survive the user's next sign-in. Behind the scenes, tenant membership is represented as identity-provider groups; the console keeps those in sync for you — you don't manage them by hand.
Safeguards¶
A few actions are deliberately blocked to prevent locking yourself or the platform out:
- You can't deactivate your own account.
- You can't revoke your own platform-admin.
- You can't revoke the last remaining platform admin.
If write actions are unavailable¶
If the console shows a banner that identity-provider write-back isn't configured, your deployment hasn't been given an Authentik admin token yet. You can still view tenants and users, but creating or changing them is disabled until an operator configures it. Ask your platform operator to set the Authentik admin credentials.