Governance

Administration

Organization
ITW Evercoat (Demo)
Section
1 of 7

Users and memberships

Membership binds an existing Keycloak subject to this organization and carries its roles. The application deliberately cannot create credentials — Keycloak owns identity.

Not yet connected. The API is live at /api/admin/members; this table is wired in Slice 2, once authentication supplies a verified principal. No placeholder rows are shown, because invented data is indistinguishable from real data at a glance.

Two guards worth knowing about

  • The last administrator cannot be demoted. Revoking the final role that holds admin.roles is refused. An organization that can no longer grant any role needs direct database access to recover — the same dead end as a role with no write path.
  • Members are deactivated, never deleted. Removing the row would orphan every audit event and approval that names it. R&D history is retired by status, not destroyed.