Read-only console gallery
Every page of the portal, without live data.
Open each workspace, then each page. This shows layout and role boundaries only. It grants no access and changes no record.
Enterprise organizationRead only
Organization console
Organization roles with a written reason.
Assign and revoke enterprise roles. Community memberships stay in the community.
This page
Role path
People on the live page are this organization’s staff.
| Step | Admin | Subject | Must not |
|---|---|---|---|
| Choose | Person already known | Exists as a person | Invent an employee |
| Justify | Business reason | Sees the assignment | Empty justification |
| Confirm | Fresh authenticator | Receives the role | Skip MFA |
| Revoke | Cut off now | Loses the role | Leave a standing grant |
On the live page
Work this role can do
1Assign a role with a reason2Set an end date if needed3Revoke a role4Open identity for SSO
Access boundaries
Least privilege by default
- Organization scope only
- No silent privilege
- MFA for the change
Production access
Preview is not permission.
Real consoles appear only after an authorized role, valid scope and required two-step verification are confirmed.