Administrator Guide
This chapter is for tenant administrators and platform owners responsible for keeping Regurai running cleanly inside the firm.
Administrator roles
| Role | Capabilities |
|---|---|
owner | Full access to the tenant, including access governance, audit log viewer, and admin pages. |
admin | Manage users, grants, and most configuration. Cannot read every audit entry. |
auditor | Read-only: access governance reviews, audit log viewer. Cannot mutate state. |
risk_officer, compliance_officer, model_owner, user | Functional roles — see Authentication & Authorization. |
Roles are stored in public.user_roles and never on the profile/users table. See the security chapter for why.
User management
Today, users self-register via Supabase Auth on /auth (where enabled) or are invited by an owner / admin. After first sign-in they are forced through MFA enrolment.
To grant a user a role:
- Open Access Governance v2.
- Find the user (or invite them).
- Issue an
access_grantwith the appropriate role and expiry. - The grant is recorded in
access_grantsand a corresponding entry appears inaccess_audit_log.
Role management
The role switcher in the top navigation is intentionally only visible on Access Governance pages (/app/access-governance and /app/access-governance-v2). Switching roles outside this surface is not possible — every role change opens a confirmation modal (RoleChangeConfirmModal) and writes an audit entry.
Access reviews
Periodic access reviews are run from Access Governance v2 → Reviews:
- Start a review cycle (quarterly recommended).
- The system lists every active grant in scope.
- Reviewers attest or revoke each grant.
- Attestations land in
access_reviews; revocations also write toaccess_audit_log. - At cycle close, generate the evidence pack from
/app/evidence.
Configuration
| Setting | Where |
|---|---|
| Branding (logo, colours) | src/styles.css tokens; src/assets/regurai-mark.png |
| Sidebar items | src/components/app/Sidebar.tsx |
| Idle timeout (default 60 min) | src/hooks/useInactivityTimer.ts |
| Rate-limit threshold (default 5/15m) | supabase/functions/login-rate-limit/index.ts |
| Manual version / revisions | src/content/manual/MANUAL_META.ts |
Monitoring and maintenance
| What to watch | Where |
|---|---|
| Failed sign-ins per IP | public.sec_login_attempts (service-role query) |
| Audit log entries | /app/audit-log-viewer (owner / auditor) |
| Edge function errors | Lovable Cloud edge function logs |
| Server function errors | Worker stdout, Lovable Cloud dashboard |
| Database health | Supabase project info & db_health |
| MFA enrolment coverage | supabase.auth.admin.listUsers() cross-reference with TOTP factors |
GDPR / DSAR handling
Data Subject Access Requests are recorded in public.gdpr_requests. Workflow:
- Subject submits request (via support channel).
- DPO records the request in
gdpr_requestswith statusreceived. - Investigation → export / deletion as required.
- Response delivered; status moves to
closed; evidence retained for the regulatory retention period.
Operational hygiene
- Rotate the Lovable Cloud service-role key on staff turnover.
- Re-run the security scan after every release; aim for zero critical findings.
- Review the Change Management chapter monthly; close out open ADRs and tech-debt entries.