Platform Operations Tier 0

1 · The negative claim is the product. Platform Operations runs the software and holds no fiduciary authority. Every withheld capability is refused at the API and at the database — never by hiding a control. An operator who calls the endpoint directly gets the same refusal, and the refusal is written to the audit log with outcome=failure. If a capability can only be withheld in the UI, it is not withheld.
2 · View-as is a named act, not a privilege. A session requires four things and starts without none of them: a resolvable support ticket, a reason in the operator's own words, an explicit duration with a 60-minute ceiling, and an authorisation — tenant approval by default, break-glass only for a Sev-1 and only with a second Open1031 approver who is not the requester. Expiry is enforced server-side; an expired token is refused even with the tab still open. Extension does not exist — start a new session with a new reason.
3 · Attribution never borrows the tenant's identity. Every row inside a session records actor as the operator and on_behalf_of as the tenant user. The tenant user is never the author. A tenant reading their own history can separate their own actions from ours without asking us.
4 · The banner is not dismissible and is not private. It renders full-width above all chrome for the whole session, carries the operator's name, the reason, the scope and a live countdown, and appears for the impersonated user and for colleagues who open a record the session touched. An invisible support session is the failure mode this design exists to prevent.
5 · Blocked attempts are evidence, not noise. A refusal inside a session is logged, surfaced in the session ledger, and shown to the tenant. A refused request — a tenant admin declining — stays in the ledger permanently. Never garbage-collect a decline.
6 · A flag may change behaviour, never whether a control runs. compliance.four_eyes_disbursement, compliance.kyc_gate and audit.write are rendered as locked rows precisely so the absence of a switch is visible. Do not implement them as flags defaulted to on.
7 · Reflect the RLS as it is. Platform read access to sensitive fields is the platform_admin_read_sensitive policy: SELECT only, on a table that stores a Social Security number as last-4 plus a hash. No UPDATE and no DELETE grant exists for this role, and the UI must never render an editable control over a field the role cannot write.
8 · An overdue or degraded thing never renders as satisfied. A degraded dependency stays red while it is degraded. An outage never extends a statutory 45- or 180-day clock — the clock is tracked, and any adjustment is a four-eyes override with a written legal basis, taken in the tenant's own console.
9 · Provenance pills are load-bearing. Solid Enforced in code marks a claim that is true in the API today. Dashed pills mark a design that is not built: session-scoped NPI masking, per-entry audit hash chaining, and automated authentication-anomaly scoring. Do not remove a dashed pill by deleting the pill — remove it by shipping the code.
10 · Tokens only. No raw hex; the view-as chrome uses the --impersonate-* family added to tokens.css, deliberately outside the good/warn/bad triad so a support session never reads as an error and never dilutes red. Light and dark are both designed. Every interactive element carries hover, focus-visible, active and disabled states, and all motion is state-conveying and respects prefers-reduced-motion.
All tenants, people, amounts, tickets and identifiers on this page are synthetic.