Master console overview

The master console at app.1pvn.com is the platform-wide control center for managing tenants (chambers), staff access, and the platform-admin team. This guide covers every section of the console and explains how platform-admin work differs from per-tenant admin work.

Purpose: Create and oversee tenants, manage who can sign into each one, view system-wide metrics, and maintain the platform-admin roster.

Audience: Platform administrators only. Per-tenant admins have a separate admin panel inside their own workspace.

Prerequisites: Your email must already be registered in the platform_admins table. Ask an existing platform admin to add you if you do not have access yet.

Overview

The master console is a platform-level interface that sits above all individual tenants. Unlike per-tenant admins (who work inside one workspace managing users and content), platform admins manage the infrastructure layer: tenants themselves, who can sign in to them, and the platform-admin team.

From the master console you can:

View system totals — active, suspended, and provisioning tenant counts plus total users across all tenants
Review tenant scorecards — per-tenant metrics (users, submissions, pipeline, consultations, open issues, last activity)
Create new tenants — assign a subdomain, data region, and staff allowlist
Manage staff access — control email domains and allowlists per tenant
Suspend or activate tenants — take tenants offline or bring them back
Manage platform admins — add or remove members of the super-admin team

All actions are logged to the audit trail.

Signing in and the workspace picker

Step 1: Navigate to app.1pvn.com

Open your browser and go to app.1pvn.com — not a tenant subdomain like eccp.1pvn.com.

Step 2: Sign in with Google

Click Sign in with Google
Complete Google's sign-in screen
You are redirected to the workspace picker page

If your email is not registered as a platform admin, you will only see tenant workspaces you have access to (or a "not associated with any workspace" message). Contact an existing platform admin to add your email.

Screenshot: Google sign-in on app.1pvn.com, then workspace picker page

Step 3: Workspace picker

After signing in you land on the Choose a workspace page, which shows:

Buttons for each tenant you have access to
A Master console link at the bottom (visible only to platform admins)

What you can do here:

Click a tenant button — you are signed into that tenant's workspace via a single-use handoff token. Use this to troubleshoot something inside a specific tenant.
Click Master console — you enter the platform-wide management interface at /console/overview.

Screenshot: "Choose a workspace" page with tenant buttons and "Master console" link

System overview and tenant scorecards

Accessing the overview

From the workspace picker click Master console, or go to app.1pvn.com/console/overview directly.

System totals (top of page)

Four summary cards appear at the top:

Card	What it shows
Active tenants	Count of tenants with status = active; footer shows suspended and provisioning counts
Total users	Sum of all users across all tenants (no PII, count only)
Tenants tracked	Number of tenants included in the scorecard below
Stale metrics	Number of tenants whose snapshot is missing or more than 2 calendar days old

Tenant scorecard table

Below the summary cards, one row per tenant shows:

Column	Example
Tenant	Display name + subdomain.1pvn.com
Status	Active / Suspended / Provisioning badge
Users	14
Submissions	127
Pipeline	8 active ($4.2M)
Consults	23
Open issues	2
Metrics as of	03 Jul 2026 (amber if stale)
Last activity	2d ago
Workspace	Open button

Metrics staleness: If a snapshot is missing or more than 2 calendar days old, the "Metrics as of" date turns amber. Snapshots are computed by the daily compute-daily-snapshot workflow (runs at midnight Manila time).

Open button: Clicking Open on a scorecard row signs you into that tenant's workspace via a handoff token, the same as clicking the tenant button on the workspace picker.

The console shows aggregate metrics only — no submission titles, contact names, or sensitive content. This protects tenant data and keeps the view focused on operational health.

Screenshot: System totals cards + tenant scorecard table with stale amber badge example

Managing tenants and allowlists

Navigate to tenant management

Go to app.1pvn.com/console/tenants.

The page has three sections:

Federations table (read-only) — lists data-residency regions (display name, region label, data host region, residency status). These are configured at the infrastructure level and cannot be edited here.
Tenants table — your working area, showing all tenants with status badges and action buttons.
Create tenant form — at the bottom of the page.

View or update a tenant's allowlist

Each row in the tenants table has a collapsible "Edit staff allowlist for [Tenant Name]" toggle. Click it to expand an inline panel with:

Staff email domains — comma-separated list (e.g., eccp.com, eccp.org)
Staff email allowlist — comma-separated individual emails (e.g., john.doe@external.com)

These two fields have their own Save allowlist button.

Below them, a separate form holds:

Logo URL — an HTTPS URL to an image file; shown on the tenant's login page and app header. Leave blank to use the default 1PVN mark.

The logo has its own Save logo button.

How allowlists work:

Staff email domains — anyone whose email ends in a listed domain can sign in (e.g., eccp.com allows anyone@eccp.com)
Staff email allowlist — specific individual email addresses that are allowed regardless of domain

Both lists work together. A user can sign in if they match either a domain or an exact email. Matching is case-insensitive.

Saving is a full replacement, not an append. Whatever you enter in those fields becomes the complete list. Remove an entry by deleting it from the field before saving.

Create a new tenant

Scroll to the Create tenant section at the bottom of /console/tenants and fill in the form:

Display name (required) — e.g., "Philippine Climate Action Chamber"
Subdomain (required) — e.g., climate-chamber (becomes climate-chamber.1pvn.com). Must be lowercase letters, digits, and hyphens; cannot start or end with a hyphen.
Region (required) — select a federation from the dropdown. Federations represent data-residency regions.
Staff email domains (optional) — comma-separated, e.g., climate.org, partner.gov.ph
Legal name (optional) — formal registered name for compliance records
Staff email allowlist (optional) — comma-separated individual emails

Click Create tenant.

Expected result: The tenant row appears in the tenants table above with status provisioning. An audit event is logged.

Common errors:

"That subdomain is already taken" — choose a different subdomain
Validation error on subdomain format — use only lowercase letters, digits, and hyphens

Screenshot: Create tenant form with fields filled in

Suspend or activate a tenant

In the tenants table, each tenant row has a status action button:

If the tenant is active, the button reads Suspend
If the tenant is suspended or provisioning, the button reads Activate

Click the button to toggle status. An audit event is logged.

Effect of suspend: Staff members cannot sign in to the tenant. All data is preserved. You can activate the tenant again at any time.

Screenshot: Tenants table row with Suspend button highlighted

Platform admins registry

Accessing the admin roster

Go to app.1pvn.com/console/admins.

You see a table listing all current platform admins with their email address and the date they were added.

Add a platform admin

Scroll to the Add platform admin form at the bottom of the page
Enter an email address
Click Add

Expected result: The email is added to the platform_admins table (stored lowercased). That person can now sign in to app.1pvn.com/console and manage tenants, allowlists, and the admin roster. Adding an email that already exists is a no-op — no error is shown.

Screenshot: "Add platform admin" form with email field

Remove a platform admin

Find the person in the admin roster table
Click Remove on their row

Expected result: The email is removed. That person loses platform-wide console access. They retain any per-tenant admin roles they hold separately.

Safety guard: The Remove button is disabled when only one platform admin remains. This prevents accidental lockout of the entire console.

Screenshot: Admin roster table with Remove button disabled on the last remaining admin

Platform admin vs tenant admin

Platform admin (you, at app.1pvn.com)

Scope: The entire 1PVN deployment — all tenants and all users
Where you work: Master console at app.1pvn.com
What you can do:
- Create, suspend, or activate tenants
- Manage staff allowlists for any tenant
- Add or remove other platform admins
- View system-wide metrics and the audit trail
- Access federation/region information (read-only)
What you cannot do: Directly manage users inside a tenant, or create submissions and documents on behalf of users

Tenant admin (per-workspace admin, e.g., at eccp.1pvn.com/admin)

Scope: A single tenant workspace
Where they work: Inside that tenant's admin panel
What they can do:
- Promote or demote user roles within the workspace
- Manage templates, workflows, forms, email settings
- View that tenant's audit log
What they cannot do: Access other tenants or the master console, create new tenants, or manage allowlists

Comparison

Aspect	Platform Admin	Tenant Admin
Manages	Tenants, access control, platform health	Users, content, workflows in one workspace
Access	app.1pvn.com/console	subdomain.1pvn.com/admin
Creates tenants	Yes	No
Manages allowlists	Yes, for any tenant	No
Manages users	No	Yes, within their workspace
Audit scope	All tenants and platform events	Single tenant only

Can one person hold both roles?

Yes. You can be a platform admin and also an admin inside a specific tenant workspace. The two roles are independent and coexist.

Best practices

Keep allowlists tight. Review staff email domains and allowlists quarterly. Remove stale entries to reduce the risk of unauthorized access.
Use domains for your organization, the allowlist for guests. If your organization has a domain (e.g., yourorg.com), add it to staff email domains. Use the allowlist for external partners or one-off guest accounts.
Follow subdomain naming conventions. Use lowercase with hyphens as word separators (e.g., green-energy-hub). Subdomains cannot be renamed after creation.
Test logo URLs before saving. Paste the URL into a browser tab to confirm the image loads before saving. Use HTTPS URLs from a CDN or your own server.
Maintain at least two or three platform admins. A single platform admin is a single point of failure. The Remove button prevents removing the last admin, but having backups is still safer.
Record why you change the admin roster. The audit log captures who made the change but not why. Keep your own notes or use a shared ops doc to record the reason.
Match region to your data requirements. Pick the federation region that aligns with your data-protection obligations for each tenant (e.g., EU tenants in a European region).

Warnings

Suspended users may stay signed in temporarily. If a staff member is already signed in when you suspend their tenant, their existing session remains valid until it expires (typically several hours). There is no immediate force-logout mechanism.
Allowlist save replaces, not appends. When you save the allowlist form, whatever is in the input fields at that moment becomes the full list. If you clear a domain or email by mistake, it is removed immediately.
Subdomains are permanent. You cannot rename a subdomain after a tenant is created. If you need a different subdomain, create a new tenant and plan a data migration. Contact ops for help.
Handoff tokens expire in 60 seconds. When you click a tenant button or Open, a single-use token is generated. If you wait more than 60 seconds before the redirect completes, the token expires and you see a handoff error. Go back to the workspace picker and click again.
Logo URL is not validated for content. The console accepts any HTTPS URL without scanning the image. Only use URLs you control or trust.

Troubleshooting

You see "not associated with any workspace" after signing in

Symptom: You sign in with Google on app.1pvn.com but the workspace picker shows no tenants and no Master console link.

Cause: Your email is not in any tenant's allowlist and is not a platform admin.

Fix: Ask an existing platform admin to add your email at app.1pvn.com/console/admins. Sign out and sign in again after they confirm it is added.

"That subdomain is already taken" when creating a tenant

Symptom: You submit the create tenant form and see "That subdomain is already taken".

Cause: Another tenant is already using that subdomain, or it is reserved.

Fix: Choose a different subdomain. Try adding a suffix or abbreviation (e.g., climate-hub, phcc, climate-apac).

A staff member cannot sign in to a tenant

Symptom: A staff member tries to sign in at a tenant subdomain (e.g., eccp.1pvn.com) but sees "Access restricted to authorized accounts only".

Cause 1: Their email is not in the tenant's allowlist.

Fix:

Go to app.1pvn.com/console/tenants
Click "Edit staff allowlist for [Tenant Name]"
Add their domain to Staff email domains (e.g., example.com) or their full email to Staff email allowlist (e.g., name@example.com)
Click Save allowlist
Ask them to try signing in again

Cause 2: The tenant is suspended.

Fix: Click Activate on that tenant's row in the tenants table.

Handoff error after clicking a tenant or Open button

Symptom: You click a tenant button or the Open button on the scorecard and land on a page showing a handoff error.

Cause: The single-use handoff token expired (valid for 60 seconds) or was already consumed.

Fix: Navigate back to app.1pvn.com/console and click the tenant again to generate a fresh token.

Logo is not showing on the tenant's login page

Symptom: You saved a logo URL for a tenant but the logo does not appear on its login page.

Cause 1: The URL is not accessible or is using HTTP instead of HTTPS.

Fix: Paste the URL into a browser tab. Confirm it loads over HTTPS. Update the Logo URL field with a corrected URL and click Save logo.

Cause 2: CORS headers on the image host are blocking the browser from loading it.

Fix: Confirm with your CDN or image host that the URL allows cross-origin embedding.

Remove button is grayed out for a platform admin

Symptom: You try to remove a platform admin but the Remove button is disabled.

Cause: That person is the only remaining platform admin. Removing them would lock everyone out.

Fix: Add at least one other platform admin first, then remove the original one.

FAQ

Q: Can I use the master console to reset a user's password inside a tenant?

A: No. Password and session management for users within a tenant is handled at the Supabase Auth level, not through the master console. Contact ops if you need to assist a specific user.

Q: What happens to tenant data when I suspend a tenant?

A: Suspension is a soft status change only. All data is preserved in the database. No records are deleted. You can restore the tenant to active by clicking Activate.

Q: Can I rename a tenant's subdomain?

A: No. Subdomains are permanent after creation. If you need a different subdomain, create a new tenant and plan a data migration with ops.

Q: What is the difference between Staff email domains and Staff email allowlist?

A: Staff email domains (e.g., eccp.com) allow anyone whose email ends with that domain to sign in. Staff email allowlist (e.g., john@external.com) allows specific individual emails regardless of their domain. Both lists are active at the same time.

Q: Can I paste multiple emails or domains at once?

A: Yes. Both fields accept comma-separated values. Paste a list like @org1.com, @org2.com, guest@vendor.io and click Save allowlist. All entries are saved together.

Q: How often does the scorecard data refresh?

A: Metrics are computed by the daily snapshot workflow, which runs at midnight Manila time. Data on the scorecard can be up to 24 hours old. If a snapshot is missing or more than 2 calendar days old, the "Metrics as of" date turns amber to flag it as stale.

Q: Where can I see a log of who changed allowlists or added admins?

A: All master-console actions are logged to the audit trail. You can query audit_events for actions including tenant.create, tenant.allowlist_updated, tenant.status_change, platform_admin.added, and platform_admin.removed. Ask your compliance officer or ops team for access to audit queries.

Q: A staff member was signed in when I suspended their tenant. Are they locked out immediately?

A: No. Their existing session remains valid until it expires naturally. There is no immediate force-logout mechanism. If you need immediate access removal, ask the user to sign out or contact ops to invalidate sessions at the Supabase Auth level.

Roles and access — all role types including platform-admin, admin, staff, and public
System architecture overview — how the handoff token and multi-tenant routing work under the hood
Staff workbench overview — what tenant staff see inside a workspace
Detailed guides for tenant provisioning/allowlists and platform-admin management are planned for Wave 4 — see the roadmap.