One control surface
A dashboard with range-based KPIs, trends and an explicit list of metrics the server cannot measure, plus menus for customers, revenue, product, access, operations and security, and search across pages and records.
Enterprise Control Center
Operate the platform without crossing the customer data boundary.
The operator console controls tenants, billing, usage, rate limits, alerting, support access, traffic metadata, incidents, feature flags, feedback, audit exports, and go-live gates. It is a private vendor surface, separate from the customer console.
Admin Capabilities
SSO, MFA and break-glass
Operators sign in through your identity provider with authenticator-app MFA and recovery codes. Destructive actions ask for a fresh code. The shared key is an emergency credential only, and every use is audited and raised as critical.
Customer 360
Lifecycle, members, API keys, sessions, feature adoption, per-organization usage and rate limits, invitations by single-use link, notes, and GDPR or audit-package exports for each tenant.
Audited support access
Support can open a customer's console read-only for a limited time with a stated reason. Secrets, exports and changes stay blocked, every request is journaled, customers see each visit, and customer admins can switch access off.
On-call routing
SLA breaches, failed-login spikes, incidents, maintenance, go-live blockers and more go to Slack, email, PagerDuty or a webhook, with de-duplication, reminders, a per-channel rate cap and a delivery log.
Billing and entitlements
After an order form is signed, operators create the Stripe customer and subscription. Revenue figures come from synced Stripe data, per currency, and plan entitlements can be enforced when the catalogue matches your contracts.
Go-live evidence
Run readiness checks, the go-live gate (including operator SSO, MFA and break-glass checks), tenant isolation probe, platform health, retention visibility, and security truth review before launch.
Metadata lens
Traffic Lens monitors source IPs, route pressure, status code families, rate limits, errors, latency, and user agents without request body or query capture.
Governed autopatch
Create autopatch intake, approve/reject fixes, and prepare draft PR metadata. It does not auto-merge into production.
Production Must-Pass
A local green page is not enough. These must pass in the deployment environment that customers will use.
Identity
MORROW_AUTH_MODE=jwt, MORROW_AUTH_REQUIRED=1, production issuer/audience/JWKS, MFA at the identity provider, and no header-auth public production access.
Data layer
Managed Postgres, managed Redis, secret manager, backup/restore evidence, retention policy, and verified RLS with a non-superuser app role.
Admin boundary
Vendor routes behind SSO/VPN, operator SSO with MFA required, shared platform key kept as break-glass only and rotated after any use, traffic monitor export policy defined, and no request bodies, query strings, cookies, or auth headers in traffic records.
Evidence
Passing market readiness report, launch collateral check, browser smoke, Airlock signature smoke, tenant isolation probe, and archived go-live evidence bundle.
Operations
Sentry or equivalent runtime errors, support email, incident contacts, legal-approved privacy/terms/DPA, support process, and escalation runbook.
Operator Flow
- Open the operator console from your private address and choose Sign in with SSO. Enter your authenticator code; on first sign-in, enrol an authenticator app and save the recovery codes. Named operator keys remain available for scripts and carry their own role, so every change is recorded against a person.
- Start on the Dashboard: pick a range, review KPIs against the previous period, and work Needs attention. A metric the server cannot measure is listed as unavailable, never shown as zero.
- Open Customers for each tenant's Customer 360: confirm plan, status and lifecycle, review usage and rate limits, send invitations, and export audit packages when needed.
- When a customer needs hands-on help, start a read-only support session with a reason the customer will see. It ends on its own, can be revoked, and appears in the customer's audit log.
- Connect Alert routing to your on-call tools and send a test, so operators are paged instead of watching the console.
- Use Revenue for subscriptions and invoices synced from Stripe after an order form is signed. No payment is taken on the public website.
- In Traffic Lens, select the recent buffer or retained database history. Apply IP/route filters and export up to 5,000 matching records as NDJSON/OTEL-shaped JSON. Summary totals cover this process only. Clearing the buffer leaves retained history intact. Optional live refresh pauses in hidden tabs.
- Review Security audit logs for administrator changes and authentication outcomes. External identity-provider failures need the IdP's own logs. A request is not a login.
- Run tenant isolation and the go-live gate immediately before external deployment. Keep the operator routes behind your approved SSO/VPN gateway.