Support access
The expiring, audited operator grant platform staff use when you ask for help, how you end it, and exactly what staff can and cannot see without one.
Concept · Updated 2026-10-17 · Describes release 0.1.164
When you ask platform staff for help they grant themselves an expiring membership — the break-glass grant — which shows up in your Members table and in your audit log. This page states what that grant is and where the staff data boundary runs. Your own members and roles are on Members and roles; the rows a grant writes are in the Audit log.
No superadmin bypass. Platform staff hold no implicit access to your tenant's content. Without a real membership row they see the No tenant membership empty state in the portal. The only staff path to tenant data is an audited, expiring support grant that appears in your Members table. What staff can see without one is stated plainly in What platform staff can and cannot see.
Support access (break-glass)
When you ask for help, platform staff still need a membership. They grant themselves an expiring one from the platform console — an operator membership, never an owner.
What that grant is:
- Visible. The row appears in your Members table with a
supportbadge and a value in the Expires column. - Bounded.
operator— so staff can investigate, but cannot approve or release a change, or change members, roles, SSO, appearance, model tiers or the approval-gate configuration. - Expiring. 24 hours by default (a deployment setting). The moment it expires the permissions are gone, reads fall back to 404 and the row leaves your Members table; the stored row itself is removed on that staff account's next request.
- Audited.
support.grantedon the way in, carrying the staff email and the TTL in seconds;support.revokedon the way out, recording who revoked it and whose grant it was. Re-granting resets the clock and writes anothersupport.granted. - Revocable by you. Click Remove on the support row at any moment. Staff can also revoke their own grant from the console.
- Optional platform-wide. Deployments can disable staff self-grant entirely, in which case the console shows no grant button and staff can only be added by you, by email, like anyone else.
The staff side of the same feature — how an engineer requests one and what their console shows — is Customers and workspaces → Staff support access (break-glass).
What platform staff can and cannot see
The staff data boundary is a real boundary, but it is not total, and an enterprise reviewer deserves the exact line rather than a reassurance.
Without any membership, platform staff cannot read your tenant's content. No incidents, investigations, RCA text, chat sessions, knowledge bodies, artifacts, datasource configuration or lakehouse data — in the portal or through the API. There is no superadmin shortcut in the permission check; a staff account with no membership row gets the No tenant membership empty state, exactly like anyone else.
Without a membership, platform staff can still see configuration and aggregates from the platform console: your tenant's name, slug and enabled/disabled state; your member list including email addresses, roles and support expiries; your pillar agent configuration including any custom prompts you wrote; your role names; and your identity provider's issuer and claimed email domains. Treat pillar prompts as configuration, not as a private notebook.
Platform staff can read audit rows. The platform console has its own audit view over every row on the deployment, filterable by tenant. Your audit log is a compliance record, not a private one — which is exactly why the scrubbing and hashing rules of the audit log matter: a chat question is a hash, a remediation detail is scrubbed and truncated, and no payload carries a secret. Staff can also export your trail from the console; every staff export is written into your log as audit.exported with via: platform-admin, so you see that it happened.
Reading your data requires a support grant, which is visible in your Members table, expiring, revocable by you and audited on both sides.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
A support row you did not add |
Platform staff took a break-glass grant | It expires by itself; click Remove to end it now, and read the support.granted audit row |
Limits and gotchas
- Membership is the only door to your data. Platform staff with no membership see no tenant content at all — not through the portal, not through the API. They do see configuration and aggregates, and they can read audit rows; the exact line is What platform staff can and cannot see. A disabled tenant fails closed for everyone, including its own owner.