SPEC-APP-ADM · v0.2
27 June 2026
Owner: Platform team

Admin — product requirements

admin.riversync.com — the RiverSync console for the platform itself: tenants, provisioning, plans and platform health. RiverSync is the platform owner; this is where that ownership is exercised.

DraftPartially prototyped (admin tweaks & nav model)

Inherits the master PRD. RiverSync only (master AUTH-2): requires a riversync-tenant account. RiverSync identities and their roles are managed in Account's RiverSync view (SPEC-APP-ACC ACC-4); the riversync permission matrix gates each area here.

1Requirements

ADM-1

Tenant directory — every customer and partner tenant: type, plan, devices, status; suspend/restore is admin-role-only.

ADM-2

Provisioning — create tenants, commission devices to a customer's site, attach the initial maintenance agreement (handed off from a won Pipeline deal).

ADM-3

Plans & billing — platform plans and pricing across tenants (accounting + admin roles).

ADM-4

Platform health — service status, uptime, admin audit trail.

ADM-5

View-as — RiverSync users can act inside a customer tenant through an audited impersonation session with a persistent banner; entry and every action are logged to both audit trails.

2Navigation & menu visibility

Admin is RiverSync-only (entitlement: riversync tenant — master AUTH-2): it never appears to customer or partner accounts. The sidebar below is the shell ADMIN_NAV model; within it each riversync role (admin · support · sales · accounting · engineer) reaches only what the riversync permission matrix grants (RiverSync Permissions). An item a role cannot reach is hidden from the sidebar and blocked on a direct visit.

Full visible, can act Read visible, read-only — hidden & blocked on direct visit

AdminRiverSync

Operations

Tenants142

Provisioning3

Billing & plans

Platform

System health

Admin audit

Settings

Users

Roles

Permissions

Security

Admin is largely an admin-role console: only the admin role manages plans-policy, platform health and the Settings group. The other roles enter for their slice — accounting for plans & pricing, engineer for provisioning & device commissioning — and otherwise read the tenant directory. Sales and support do their work in Pipeline and the Operations console.

View-as (ADM-5) is launched from here by the admin and support roles; every impersonation session is audited to both trails.

Menu item	Admin	Support	Sales	Acct.	Engineer
Operations
Tenants	Full	Read	Read	Read	Read
Provisioning	Full	—	—	—	Full
Billing & plans	Full	—	—	Full	—
Platform
System health	Full	—	—	—	—
Admin audit	Read	—	—	—	—
Settings
Users	Full	—	—	—	—
Roles	Full	—	—	—	—
Permissions	Full	—	—	—	—
Security	Full	—	—	—	—

Suspend / restore a tenant is admin-role-only (ADM-1) — the other roles read the Tenants directory but cannot act on it. Platform health and the whole Settings group are admin-only; whether support should read System health is an open question below.

3Open questions

Which Admin actions require a second admin's approval (tenant suspension, plan overrides)?
Does view-as need customer consent or notification beyond the audit entry?
Should the support role read System health (incident triage), or does platform health stay admin-only?

4Revision history

Version	Date	Changes
0.1	12 Jun 2026	Initial draft — tenants, provisioning, plans, health, view-as
0.2	27 Jun 2026	Navigation & menu visibility (new §2). Documents the Admin sidebar (shell ADMIN_NAV) and a role × menu-item visibility matrix for the five riversync roles, grounded in the RiverSync permission matrix. Admin-role console with accounting (plans) and engineer (provisioning) slices; Platform & Settings admin-only. Open questions and revision history renumbered §3–§4; added a support-vs-System-health open question. No requirement-structure changes.

RiverSync Co., Ltd. · BangkokSPEC-APP-ADM · 1 of 1