Operator portal overview

The operator portal is a small Next.js application that runs in the central plane’s region. It’s the day-to-day interface for both tenant administrators and Operayde staff.

What’s in it

• Tenants — list of tenants (for staff) or your own tenant (for you).
• Fleet — every enrolled appliance with status, health, model zoo.
• Virtual keys — mint, revoke, inspect scopes and usage.
• Policies — the current OPA bundle and its deploy history.
• Billing — monthly invoice, usage rollups, downloadable CSV.
• Audit — signed audit heads by day, with offline-verifiable proof.

Auth

The portal uses OIDC against your IdP. Sessions are JWE-encrypted cookies; logouts trigger RP-initiated logout on the IdP. There is no password input on the portal itself.

Roles

Two built-in roles:

• admin — mint keys, push policy, view billing, view audit
• viewer — read-only

Role names come from your IdP claims. Staff get a separate set of roles (staff:admin, staff:support) and a separate IdP realm.