Admin — product requirements
admin.riversync.com — the RiverSync console for the platform itself: tenants, provisioning, plans and platform health. RiverSync is the platform owner; this is where that ownership is exercised.
1Requirements
Tenant directory — every customer and partner tenant: type, plan, devices, status; suspend/restore is admin-role-only.
Provisioning — create tenants, commission devices to a customer's site, attach the initial maintenance agreement (handed off from a won Pipeline deal).
Plans & billing — platform plans and pricing across tenants (accounting + admin roles).
Platform health — service status, uptime, admin audit trail.
View-as — RiverSync users can act inside a customer tenant through an audited impersonation session with a persistent banner; entry and every action are logged to both audit trails.
Ticket communication — the RiverSync service desk. The agent works every tenant's support tickets in the one reusable multi-party conversation (DM-55, SVC-19): reply to the customer, add RiverSync-only internal notes, use quick replies, bring in a servicing partner (ticket.partner-joined) and schedule visits, then resolve/reopen. The agent may also open a ticket on the customer's behalf through the same comprehensive composer (affected device, category → sub-category, priority, details, attachments, with RiverSync Assist) — OpenedByParty=riversync, visible to the customer (DM-60). The surface is specified in SPEC-UIX-TKT and deployed as a dedicated page in the Admin app (apps/admin/Admin Tickets.html, viewer=agent). (PTL-4, PAR-14, DM-60)
Service scheduling — propose & coordinate. RiverSync (dispatch) schedules every corrective, maintenance and preventive visit by proposing the customer several candidate time slots, constrained by the customer's standing scheduling preferences (windows · blackout dates · lead time), and coordinating the servicing partner where one covers the device. The customer accepts one slot in the Portal (PTL-11) and the visit is scheduled for Field execution; the servicing partner works its assigned visits within scope (PAR-15). The propose → select model and its entities are specified in SPEC-PWF-SCH / SPEC-UIX-SCH (VisitProposal · VisitProposalOption · SchedulingPreference, DM-57…59; Field owns scheduling, SVC-20). Dispatch is the shared PV.Schedule engine (persona=riversync, all tenants), prototype apps/admin/Admin Schedule.html. Every scheduling action is audited (ADM-5). (PTL-11, PAR-15, FLD-1)
2Navigation & menu visibility
Admin is RiverSync-only (entitlement: riversync tenant — master AUTH-2): it never appears to customer or partner accounts. Because the only accounts that can reach it belong to the riversync tenant, the console has no tenant context to switch — the signed-in persona is always a riversync user, and only the role varies (admin · support · sales · accounting · engineer). Acting inside a customer tenant is never a tenant switch; it is the audited view-as session (ADM-5). The sidebar below is the shell ADMIN_NAV model; within it each riversync role reaches only what the riversync permission matrix grants (RiverSync Permissions). An item a role cannot reach is hidden from the sidebar and blocked on a direct visit.
| Menu item | Admin | Support | Sales | Acct. | Engineer |
|---|---|---|---|---|---|
| Operations | |||||
| Tenants | Full | Read | — | Read | — |
| Provisioning | Full | — | — | — | — |
| Billing & plans | Full | — | — | Full | — |
| Platform | |||||
| System health | Full | — | — | — | — |
| Admin audit | Read | — | — | — | — |
| Settings | |||||
| Users | Full | — | — | — | — |
| Roles | Full | — | — | — | — |
| Permissions | Full | — | — | — | — |
| Security | Full | — | — | — | — |
Suspend / restore a tenant is admin-role-only (ADM-1) — support and accounting read the Tenants directory but cannot act on it. The sales and engineer columns are all —: those roles hold no Admin grant at all (FED-18) — they never see an Admin tile and every console page is blocked on a direct visit. Platform health and the whole Settings group are admin-only; whether support should read System health is an open question below.
3Open questions
- Which Admin actions require a second admin's approval (tenant suspension, plan overrides)?
- Does view-as need customer consent or notification beyond the audit entry?
- Should the support role read System health (incident triage), or does platform health stay admin-only?
- Provisioning without the engineer — device commissioning at the desk is now admin-only (FED-18 gives engineer Field only). If field engineers need a desk-side provisioning slice, FED-18 must grant engineer a reachable Admin entry — raise against the Federation PRD.
4Revision history
| Version | Date | Changes |
|---|---|---|
| 0.1 | 12 Jun 2026 | Initial draft — tenants, provisioning, plans, health, view-as |
| 0.2 | 27 Jun 2026 | Navigation & menu visibility (new §2). Documents the Admin sidebar (shell ADMIN_NAV) and a role × menu-item visibility matrix for the five riversync roles, grounded in the RiverSync permission matrix. Admin-role console with accounting (plans) and engineer (provisioning) slices; Platform & Settings admin-only. Open questions and revision history renumbered §3–§4; added a support-vs-System-health open question. No requirement-structure changes. |
| 0.3 | 29 Jun 2026 | Single-tenant clarification + prototype. §2 now states explicitly that the console has no tenant switch — the persona is always a riversync user and only the role varies (the prototype's Tweaks panel offers a RiverSync-role switch only, not a tenant-type switch); acting inside a customer tenant is the audited view-as (ADM-5), never a tenant change. Status: all nine surfaces (Tenants + detail, Provisioning, Billing & plans, System health, Admin audit, Settings Users/Roles/Permissions/Security) and the view-as round-trip are prototyped. No requirement-structure changes. |
| 0.4 | 29 Jun 2026 | Service scheduling (ADM-7 added). RiverSync proposes candidate visit slots — constrained by the customer's standing scheduling preferences — and coordinates the servicing partner; the customer accepts one in the Portal (PTL-11) and the visit is scheduled for Field execution. Specified in the new SPEC-PWF-SCH workflow with entities VisitProposal · VisitProposalOption · SchedulingPreference (DM-57…59) and Field ownership (SVC-20); master ERD §5 + master PRD updated the same turn. |
| 0.5 | 29 Jun 2026 | Dedicated Admin app for dispatch + service desk (ADM-6/ADM-7 prototyped). The RiverSync console is now a real prototype at apps/admin/ on the DS bundle: Admin.html (console overview), Admin Schedule.html (the shared PV.Schedule engine, persona=riversync, all tenants) and Admin Tickets.html (the shared PV.Tickets engine, viewer=agent). ADM-6's prototype path moves from apps/account/Admin Tickets.html to the dedicated app; ADM-7 cross-references SPEC-UIX-SCH. ADM-7 wording updated — the servicing partner now works its assigned visits within scope (PAR-15 v0.11), no longer read-only, cascaded from the DM-59 rewrite. |
| 0.6 | 30 Jun 2026 | Agent ticket creation (ADM-6 extended). The Admin Tickets surface gains the shared New ticket composer — a RiverSync agent opens a ticket on the customer's behalf (OpenedByParty=riversync, visible to the customer) with the comprehensive form (device · category → sub-category · priority · details · attachments) and RiverSync Assist. Same reusable surface as Portal (PTL-4) and Partners (PAR-14); new rule DM-60, SPEC-UIX-TKT v1.1. ERD/Domain/DWF catalogs cascaded the same turn. |
| 0.7 | 2 Jul 2026 | Role × menu matrix aligned to the platform (FED-18 wins). §2 conflicted with the Federation PRD's role × application matrix: it let sales and engineer enter Admin (Tenants read; engineer Provisioning) while FED-18 grants them no Admin tile. Per the platform-wins rule the slices are removed — sales and engineer columns are now all —, hidden and blocked (shell ADMIN_ACCESS trimmed to match); a desk-provisioning open question is logged in §3. The React console pages now also coerce the riversync persona on open (no tenant switch, §2) and resolve the top-bar identity from the signed-in riversync role; the product switcher in the DS AppShell is persona-gated (FED-18). Discrepancy logged here and in SPEC-PRD-FED v0.7. |