os.diyaos.com

OS Admin Dashboard

A clean command center for DiyaOS system administration: tenants, platform admins, approvals, security, access, app domains, agents, and audit.
OS-only Review decisions
3 Tenant workspaces 2 active and 1 under setup or review 1 OS admins System-wide administrators with guarded bootstrap history 1 Platform admins Admins responsible for tenant governance on admin.diyaos.com 2 Pending approvals 1 blocked items need explanation or remediation 4 Admin credentials 1 minimum credential required per admin policy 4/4 App clients Shared auth, redirects, origins, OpenAPI, MCP, and A2A readiness 1 Agent identities Agent access must remain permissioned, scoped, and audited 17 High-risk permissions Role, identity, recovery, and break-glass actions require gates

Today

OS Decisions

4 queues
Approve or return admin registrations 2 registration requests are waiting for a scoped decision and audit reason.
high OS admin
Confirm tenant responsibility before activation Each tenant needs a responsible platform admin, tenant admin, security posture, and app-access baseline.
medium Tenant governance
Review passwordless and recovery posture Admins should keep passkeys or FIDO keys healthy before recovery and break-glass paths are needed.
high Security
Check standalone app and domain readiness App clients must align issuer, audience, redirect URI, allowed origin, scopes, and approved domains.
medium App registry

Helpers

What Makes This Usable

tooling
Reusable shell A single OS admin shell keeps navigation, command search, action placement, and host context consistent.
Workflow model Top-level pages share structured workflow data so agents and future registries can reason about the UI.
Detailed consoles Existing Auth/RBAC and Tenant Core consoles remain available as drill-down tools from the cleaner OS pages.
Support and recovery Security support, lost-device recovery, and break-glass paths are visible without making passwords part of the model.
Approval notifications The dashboard can focus the OS admin on decisions that require evidence and cannot be automated away.
Policy guardrails FastAPI services, runtime bindings, and storage-plane declarations stay behind the app surface.
Domain map OS, scoped admin, account, auth, app, tenant-branded, and public website domains are intentionally separate.
Readiness checks The dashboard exposes what is ready, what needs attention, and where the detailed evidence lives.

Workflows

Smooth OS Admin Paths

intent based
Create tenant Start tenant intake, assign the responsible platform admin, and move setup tasks into review.
medium intake / responsibility / setup / activation
Open intake
Invite platform admin OS admin creates platform admins; platform admins do not create peer platform admins.
high identity / scope / OTP step-up / audit
Create admin
Review access Inspect effective permissions, standard roles, custom-role drafts, and review assignments.
high roles / groups / reviews / evidence
Review access
Secure devices Check passkeys, FIDO backup keys, active sessions, recovery requests, and lost-device flows.
high passkeys / sessions / recovery / break-glass
Open security
Register app domain Prepare app clients for DiyaOS-hosted domains or verified white-label tenant domains.
medium client / redirects / origins / approval
Open apps
Govern agents Keep Codex, ChatGPT, MCP, A2A, and service agents behind permissioned tools and audit.
medium identity / tools / approvals / audit
Open agents

Readiness

System Posture

6 checks
Auth/RBAC FastAPI service Shared authority for passwordless, sessions, roles, registration, and audit contracts. OpenAPI contract / MCP manifest planned / A2A card planned
ready
Tenant Core service Tenant lifecycle, setup checklist, app access, invitations, and approval workflow backend. FastAPI boundary / service proxy / runtime binding aware
ready
Storage/Data Capability Plane Services resolve databases, queues, caches, and runtime secrets through logical capabilities. no direct OS storage / service-owned persistence / redacted bindings
watch
Host routing os.diyaos.com is OS-admin-only; admin.diyaos.com is the scoped platform and tenant console. OS dashboard root / scoped /admin / account/auth separation
ready
Passwordless policy WebAuthn and FIDO are primary; OTP is periodic, recovery, or high-risk step-up only. 30-day OTP cadence / admin phishing resistance
watch
Agent control surfaces Agent access uses OpenAPI, MCP, A2A, and CloudEvents-shaped contracts with gates. tool allowlists / approval gates / audit expectations
watch

Evidence

Recent Signals

audit ready
OS admin bootstrap is closed in local seed state A seeded OS admin assignment exists, so first-admin creation is guarded and unavailable. Auth service / latest local state
ok
Scoped admin host retained separately Platform and tenant admins continue through admin.diyaos.com with RBAC-limited workflows. Host resolver / route policy
ready
Tenant service persistence remains service-owned The OS dashboard reads through service APIs and does not own tenant or identity databases. Storage plane / architecture rule
watch
High-risk access remains approval-first Admin creation, role grants, recovery, custom roles, and break-glass require evidence. RBAC policy / current workflow
high