Governance
Administration
- Organization
- ITW Evercoat (Demo)
- Section
- 1 of 7
Users and memberships
Membership binds an existing Keycloak subject to this organization and carries its roles. The application deliberately cannot create credentials — Keycloak owns identity.
Not yet connected. The API is live at /api/admin/members; this table is wired in Slice 2, once authentication supplies a verified principal. No placeholder rows are shown, because invented data is indistinguishable from real data at a glance.
Two guards worth knowing about
- The last administrator cannot be demoted. Revoking the final role that holds
admin.rolesis refused. An organization that can no longer grant any role needs direct database access to recover — the same dead end as a role with no write path. - Members are deactivated, never deleted. Removing the row would orphan every audit event and approval that names it. R&D history is retired by status, not destroyed.