Administrator access

Choose the right authority

Authority	Purpose
Installation administrator	Initial setup and installation-wide administration using the configured bootstrap credential
Authorized platform administrator	Platform configuration through an authenticated member session with the necessary permissions
Company or workspace operator	Scoped customer resources; ownership does not grant platform-wide Provider or configuration access
Provider member	The Provider’s own permitted business records, rather than platform administration

The dashboard restores a server session and checks its permissions before rendering protected administration routes. APIs check access independently. Do not use a customer workspace key as a platform administrator credential.

Bootstrap and member sign-in

1. Keep the configured NIU_ADMIN_TOKENS credential in your deployment secret store.
2. Open /installation for initial administrator access. Do not distribute the bootstrap credential to application developers or place it in browser storage or a public setup file.
3. Provision scoped member access through the supported management interfaces. Use /login for ordinary configured password sign-in.
4. Confirm the effective scope and permissions with the session endpoint before running management automation.

Read the security overview for password sessions, expiry, revocation, cookies and deployment requirements. Self-registration and a complete OIDC/SAML login flow are not implemented; there is no current dashboard OAuth configuration workflow to follow.

Keep changes scoped

Grant the smallest necessary authority. A workspace owner must not be able to grant company-wide or platform-wide access by changing a URL. Revoke unused sessions and credentials, and use audit logs to review recorded access changes. A missing audit event does not prove an operation was attempted or rejected.

选择正确的权限角色

权限角色	用途
安装实例管理员	使用已配置的引导凭证进行初始设置与全局安装实例管理
授权平台管理员	通过具备必要权限的已认证成员会话进行平台配置
公司或工作空间操作员	管理限定范围的客户资源；拥有工作空间所有权不会授予平台级模型供应商或全局配置的访问权限
模型供应商成员	查看模型供应商自身获批的业务记录，而非进行平台管理

控制台在渲染受保护的管理路由之前，会先恢复服务端会话并检查其权限。各 API 也会独立校验访问权限。请勿将客户的工作空间密钥当作平台管理员凭证使用。

引导设置与成员登录

1. 将已配置的 NIU_ADMIN_TOKENS 凭证保存在部署环境的机密存储中。
2. 打开 /installation 进行初始管理员访问。请勿将引导凭证分发给应用开发人员，也不要将其放入浏览器存储或公开的设置文件中。
3. 通过受支持的管理界面配置限定范围的成员访问权限。普通已配置密码的登录请使用 /login。
4. 在运行管理自动化脚本之前，请先通过会话端点确认当前生效的作用域和权限。

有关密码会话、过期、吊销、Cookie 及部署要求，请阅读安全概览。目前尚未实现自助注册及完整的 OIDC/SAML 登录流程；控制台中也没有可遵循的 OAuth 配置工作流。

保持权限变更的最小作用域

请遵循最小权限原则授予所需的最小权限。工作空间所有者绝不能仅通过修改 URL 就授予公司级或平台级的访问权限。请及时吊销不再使用的会话和凭证，并使用审计日志审查已记录的访问权限变更。不存在某条审计事件并不能证明某项操作曾被尝试或已被拒绝。