Administrator security
Control Center access can affect users, organizations, billing, models, developer resources, and platform configuration. Administrator security therefore needs a stronger boundary than normal product access.Least privilege
Separate responsibilities where practical. Support staff, billing operators, model operators, and security administrators do not need identical permissions. Use RBAC permission bundles rather than giving every operator the broadest role.Sensitive operations
High-impact actions should require clear intent and stronger confirmation where the active product supports it. Examples include:- permanent deletion
- broad session revocation
- plan or credit changes
- model publishing
- platform maintenance settings
- destructive storage/artifact operations
- organization ownership changes
Auditability
Sensitive actions should produce enough audit context to identify:- the acting administrator
- target resource
- action
- timestamp
- relevant reason or change context where supported
Support boundaries
Support diagnostics should expose the minimum account and system state needed to resolve the issue. Support Mode is intended to reduce the need for unrestricted administrator access.Private content
Operational authority does not automatically justify reading private user content. Keep metadata, diagnostics, and content access as separate permission concerns.Sessions
Administrator sessions deserve careful handling because a compromised admin session has a much larger blast radius than a normal user session. Use the strongest account-protection options available for administrator identities and revoke sessions promptly when a device or account may be compromised.Configuration changes
Platform-wide settings can create security or availability impact even when they are not labeled “security settings.” Validate scope, record important changes, and verify health after modifying models, tools, limits, registration, or maintenance behavior.RBAC & Support Mode
See how Starfire separates administrator capabilities by role and permission.