> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Admin Console

> Administration that happens above a single workspace — workspace lifecycle, trusted domains, platform operators, and the records they leave.

Some administration cannot belong to any one workspace: creating and suspending workspaces,
registering a trusted email domain, and deciding who holds platform-operator rights. The Admin
Console is where that work happens. This page explains what it covers, how it relates to your
workspace's own settings, and what it records — because for most readers the useful question is not
how to use it, but what it can reach.

## It is a separate authority

Platform-operator rights are not a workspace role, and no workspace role grants them.

<Note>
  Nothing you can do inside a workspace — not even Owner — grants access to the Admin Console, and
  holding Admin Console access is not the same as being a member of any workspace. The two authorities
  are separate on purpose: a workspace administrator governs their own team, and a platform operator
  governs the platform.
</Note>

## What it covers

| Area                        | What it does                                                                                                                                                                                        |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Workspace lifecycle**     | Creating a workspace, suspending or reactivating one, and deleting one.                                                                                                                             |
| **Trusted domains**         | Registering the verified email domain that auto-joins new people to a workspace. A workspace owner can self-serve their own verified domain from their own settings; anything broader is done here. |
| **Members**                 | Provisioning members into a workspace where an operator has to do it directly.                                                                                                                      |
| **Platform operators**      | Who holds platform-operator rights.                                                                                                                                                                 |
| **Platform activity**       | Cross-workspace totals — workspaces, people, agents, runs — and per-workspace usage.                                                                                                                |
| **Authorization decisions** | The record of access decisions, for diagnosing why an action was allowed or denied.                                                                                                                 |
| **Support sessions**        | Sessions in which an operator acted inside a workspace to assist it, tracked as their own records.                                                                                                  |
| **Fleet health**            | The health of agent workers across the platform.                                                                                                                                                    |

## What it means for your workspace

Two consequences are worth stating plainly, because they are what a security reviewer will ask
about.

* **Workspace-scoped surfaces stay workspace-scoped.** Your [audit log](/security-and-governance/controls/audit-log)
  shows your team's own actions. Platform-level administration is recorded on the platform side
  rather than appearing in your log.
* **Operator assistance is tracked, not ambient.** When an operator acts inside a workspace to help
  it, that is a recorded session rather than an untraced login.

## Next steps

<CardGroup cols={2}>
  <Card title="Accounts & members" href="/security-and-governance/identity-and-access/accounts-members">
    What a workspace owner administers themselves.
  </Card>

  <Card title="Audit log" href="/security-and-governance/controls/audit-log">
    The workspace-scoped record.
  </Card>

  <Card title="Agent isolation & tenancy" href="/security-and-governance/architecture-considerations/agent-isolation-tenancy">
    The boundary this console sits above.
  </Card>

  <Card title="Roles & permissions" href="/security-and-governance/identity-and-access/roles-permissions">
    The authority that does live inside a workspace.
  </Card>
</CardGroup>


## Related topics

- [Audit log](/security-and-governance/controls/audit-log.md)
- [Roles & permissions](/security-and-governance/identity-and-access/roles-permissions.md)
- [Control plane](/get-started/architecture/control-plane.md)
- [Interfaces](/get-started/interfaces.md)
- [Outposts](/manage-your-agents/build/outposts.md)