Staff workflows and architecture

These diagrams describe current source contracts. They do not prove that every provider resource or working-tree addition is deployed. The Internal edition holds deployment, email, AWS and Cloudflare runbooks.

Authentication and sensitive action

Customer inspection and controls

Search is filtered, not an unbounded customer directory. Select the exact account, then inspect the minimum data needed. Account profile inspection is audited. Cloud inspection requires a target reason and writes audit evidence before returning metadata. Content-level descriptive fields add the content permission and fresh step-up; customer document text and file/audio bytes are not supplied by these routes.

A staff key revocation or organisation API-access change does not give the Admin role direct write access to customer credential storage. It sends a narrow signed request to the Web service and records the action. Test and verify both sides before claiming an in-progress control is released.

Support and schools

An internal note stays in the desk. A reply sends email through SES and may change ticket status; verify the recipient/thread and do not submit it as a connectivity test. Inbound HTML is untrusted and must remain in the sandboxed display. Attachment links expire after five minutes and are delivered as downloads; do not log them.

Approving a school application provisions the school through the site service, then updates the ticket and attempts the notification. Inspect the returned emailed and adminLinked outcomes. An unverified mail origin can require an additional written reason. Suspension/restoration can return a cursor as student accounts are processed. Closure requires the school's name, owner role, step-up and reason; continue until closed is true. These actions are distinct from deleting an individual customer account.

Account deletion and maintenance

Scheduled account deletion disables access and starts the thirty-day grace period. Restoration is a supported audited workflow during that period. Immediate purge is an owner-only asynchronous operation on a scheduled account with an exact account-sub confirmation. Reconcile hold status and the final system audit record; HTTP 202 does not establish erasure.

Runtime site configuration uses expectedVersion to protect against concurrent saves. Preserve a failed edit on 409 and compare the refreshed version. A rollup recomputation accepts only a completed UTC day within the last thirty-five days and queues work. Staff role changes must retain an active owner, and the console refuses self-disable/self-role changes.

Staff workflows and architecture

Authentication and sensitive action#

Customer inspection and controls#

Support and schools#

Account deletion and maintenance#

Authentication and sensitive action

Customer inspection and controls

Support and schools

Account deletion and maintenance