Administrator roles and first setup

Begin after administrator sign-in. Check the issuer and active account against the deployment's enrolled initial operator. Use a separate enrolled identity to verify ordinary access.

Server Administrator

Operates the native identity directory when that route is configured and uses the approved platform MCP endpoint for workspace creation. Open Server Administration → Identity directory to check native users and groups.

Workspace Administrator

Creates applications in that workspace. The successful workspace create grants its authorized creator this role.

Application Administrator

Manages the individual application's configuration and grants. Application creation grants this role to its creator. Give other users the application role they need and verify their effective access separately.

1. Use the platform endpoint to create the workspace. Record the returned ID and Active status.
2. Create the first application through the workspace-bound MCP endpoint. The browser Workspace selector lists workspaces from accessible applications, so a new empty workspace needs this first application before its browser creation form is available. Follow Workspaces and applications.
3. Grant the intended user a scoped role under Users & Security. In a separate session, verify that the application appears and the allowed actions match the grant.

If Server Administration is missing, verify the platform browser route and active platform authority. If Create application is disabled, check the selected workspace and its workspace-level role.