Admin Guide

Internal-only surface at ai.numintek.com/admin. For Danum platform operators, not tenant customers.

Who is an admin

Users with AdminUser records. Roles:

• SUPER_ADMIN — wildcard permission (all actions).
• ADMIN — most actions except deleting other admins.
• SUPPORT — read-only + impersonate.
• FINANCE — billing + payment approvals only.
• COMPLIANCE — audit log, compliance rules, data subject requests.

Editable at /admin/roles. SUPER_ADMIN role always keeps the wildcard.

Common workflows

Approve a manual payment

1. /admin/payments-manual → open a SUBMITTED row.
2. Verify proof image against Danum bank statement (amount + sender + date).
3. Click Approve — invoice becomes PAID, subscription activates.

Impersonate a tenant (support)

1. /admin/tenants/<id> → Issue impersonation token → reason (min 8 chars).
2. Copy the JWT that appears.
3. Paste as danum_session cookie in a browser (or Authorization: Bearer for API).
4. Session is valid 30 minutes. Every issuance is audit-logged.

Send a broadcast

1. /admin/broadcasts → Compose new broadcast.
2. Title + body (markdown OK).
3. Audience: ALL, PLAN_TIER, INDUSTRY, or TENANT_LIST.
4. Channels: IN_APP (dashboard notification) + EMAIL (via Resend).
5. Save → Send (idempotent, safe to retry).

Toggle a feature flag

1. /admin/feature-flags.
2. Toggle isActive for master on/off.
3. defaultValue returned when no tenant override exists.
4. Override per tenant via Overrides collapse.

Verify audit chain

/admin/audit → Verify chain. Runs SHA-256 chain check across all audit rows (scoped by tenant if you set the filter). intact: false → escalate to security lead. Do not delete or modify the flagged row.

Support hub

/admin/support is a card grid pointing to every ops surface plus an escalation playbook (billing dispute, security incident, compliance report, outage).

Runbook

Deploy, restore, secret rotation, incident response — see docs/RUNBOOK.md in the repo.