---
id: UJ-070
title: Operate the system-admin control plane
actors: [SUPER_ADMIN, BILLING admin, SUPPORT admin]
surface: admin.zync.is
goal: Manage Zync tenants, plans, roles, tax/configuration, users, and system-level reporting without entering tenant application sessions.
trigger: System administrator signs into the admin control plane.
preconditions:
  - Active admin account and admin session; TOTP when configured; required admin role permission.
success_state: System change is persisted, scoped, audited, and visible in admin history.
source_specs:
  - docs/specs/2026-05-30-admin-dashboard.md
  - docs/specs/2026-05-31-admin-reports-analytics.md
  - docs/specs/2026-05-31-billing-plans-management-ui.md
  - docs/specs/2026-05-30-foundation-auth-rbac.md
  - docs/specs/2026-05-31-system-status-page.md
---

## Happy path

1. Admin opens `admin.zync.is` → authenticates with isolated admin credentials and TOTP if required.
2. Admin searches tenants/users or opens dashboard → sees only control-plane data allowed by admin role.
3. Admin provisions tenant, changes subscription/tier, manages tenant roles/users, updates tax rates, or freezes/unfreezes access → system validates and records actor/reason/history.
4. Admin opens system reports/analytics → filters by tenant/time/status and exports permitted data.
5. Admin signs out → admin session is revoked/expired independently from any tenant session.

## Alternate and failure paths

- Invalid credential/TOTP, suspended admin, missing permission, or stale session → deny action and log security event.
- Destructive tenant action → require confirmation and policy-specific safeguards; preserve audit trail.
- Tenant is frozen/suspended → tenant users receive controlled access state; no unrelated tenant is affected.

## Permissions and boundaries

- `admin.zync.is` is separate from `app.zync.is`; admin authentication does not imply OWNER access.
- Billing/support/admin roles are permission-scoped; SUPER_ADMIN owns system-wide operations.

## Source specs

- `docs/specs/2026-05-30-admin-dashboard.md`
- `docs/specs/2026-05-31-admin-reports-analytics.md`
- `docs/specs/2026-05-31-billing-plans-management-ui.md`
- `docs/specs/2026-05-30-foundation-auth-rbac.md`
- `docs/specs/2026-05-31-system-status-page.md`