Admin Module

What admin-basic installs

$ asa install admin-basic

Real admin control surface. Not a CRUD table with a sidebar.

This is real output from our architecture service — not a downloadable template.

Admin Dashboard

domains/admin/dashboard/ — requires admin.access permission

Total Users

1,247

Active Subscriptions

389

Admin Actions (24h)

17

Recent Activity

role.assign

Assigned 'support' to user@example.com

admin@company.com · 2 min ago

impersonation.start

Impersonating user@example.com (reason: billing issue)

admin@company.com · 15 min ago

user.edit

Updated profile for john@example.com

owner@company.com · 1h ago

User Management

domains/admin/users/ — requires admin.users.list permission

1,247 users
NameRoleActions

Jane Smith

jane@company.com

ownerEdit|Impersonate

John Doe

john@example.com

adminEdit|Impersonate

Sarah Connor

sarah@example.com

supportEdit|Impersonate

Mike Wilson

mike@example.com

userEdit|Impersonate

Safe Impersonation

domains/admin/impersonation/ — requires admin.impersonate permission

Impersonating mike@example.com — Reason: "Billing issue investigation" — Expires in 28 min

Start Impersonation

Required. Stored in audit log. Min 3 characters.

HttpOnly cookie. Server-side only. No fake JWT.

Security: Admin session stays admin. Impersonation is server-side context. All actions are audit-logged with actor + subject chain. Auto-expires after TTL.

Immutable Audit Log

domains/admin/audit-log/ — requires admin.audit.view permission

2026-03-10 22:15:03impersonation.stop

admin@company.commike@example.com

Reason: Billing issue resolved

2026-03-10 21:47:12impersonation.start

admin@company.commike@example.com

Reason: Billing issue investigation

2026-03-10 21:30:05role.assign

owner@company.comsarah@example.com

Reason: Promoted to support

2026-03-10 20:15:44user.delete

admin@company.comspam@example.com

Reason: Spam account

Immutable: DELETE and UPDATE blocked by RLS policy. No admin can erase their own audit trail. Append-only by design.

Permission-Based Guards

shared/admin/guards.ts — check permissions, not role strings

// Every admin handler uses permission guards:
const { user, response } = await requirePermission(
  request, PERMISSIONS.USERS_LIST
);
if (response) return response; // 403 + audit logged

// Built-in roles:
// owner  → all 9 permissions
// admin  → users.list, users.edit, roles.assign
// support → users.list, impersonate, audit.view

// Lint rule SEC-003 blocks admin routes without guards.
// Lint rule ENT-002 blocks role === 'admin' checks.

Why Founders Care About Admin

Technical depth → business impact

Resolve support issues safely

Impersonate users to see exactly what they see — without sharing passwords or asking for screenshots. Faster resolution, happier customers.

Track every admin action

Immutable audit log means you know who did what and when. Required for SOC 2, expected by enterprise customers, essential for trust.

Avoid trust-destroying mistakes

Permission guards prevent support staff from accessing billing. Granular RBAC means the right people have the right access — nothing more.

Admin that customers trust. Not a CRUD table.

Resolve issues safely, track every action, and control access — from install.