Decision queue

Approvals

Review high-risk admin, role, recovery, tenant activation, custom role, and agent access changes with clear evidence.

2 pending Open approval inbox

2 Pending approvals 1 blocked items need explanation or remediation 4 Admin credentials 1 minimum credential required per admin policy 1 Agent identities Agent access must remain permissioned, scoped, and audited 17 High-risk permissions Role, identity, recovery, and break-glass actions require gates

Queue

Pending work

4 items

Each decision needs an eligible approver, risk preview, action, and audit reason.

Approve or return admin registrations 2 registration requests are waiting for a scoped decision and audit reason.

pending OS admin

Confirm tenant responsibility before activation Each tenant needs a responsible platform admin, tenant admin, security posture, and app-access baseline.

watch Tenant governance

Review passwordless and recovery posture Admins should keep passkeys or FIDO keys healthy before recovery and break-glass paths are needed.

Check standalone app and domain readiness App clients must align issuer, audience, redirect URI, allowed origin, scopes, and approved domains.

ok App registry

Coverage

Approval types

3 items

These are the decisions OS admins should see at a glance.

Admin registration Platform admins, tenant admins, and sensitive user invitations.

Access and custom roles Role assignment, custom-role draft approval, revocation, and periodic reviews.

Recovery and break-glass Lost-device replacement, emergency sessions, and after-action review.

critical Security

Useful Drill-Downs

existing tools

Approval inbox Access reviews Recovery queue Break-glass