Tenant admin console

Configure risk thresholds, transaction limits, custom rules, webhook subscriptions, and JWT signing-material rotation. All writes are audit-logged; critical changes require a second admin to approve.

Sign in

Demo mode mints a short-lived JWT for the configured demo tenant. In production, this card is replaced by your SSO provider.

Subject MFA

1 · Investor dashboard

Live tenant transaction volume and outcomes. Read-only; no admin scopes required beyond tenant_admin:read.

Total transactions

—

Last 24h

—

Allow rate

—

Block / Hold rate

—

Under review

—

Settled

—

Reconciliation matched

—

Reconciliation failed

—

Avg decision time

—

Recent transactions

Click View flow to see the per-stage timeline.

2 · Tenant policy

Risk thresholds, transaction limits, custom rules. Critical changes (e.g. enabling force release) require a second admin to approve.

Risk thresholds

Low risk action Medium risk action High risk action

Transaction limits

Single transaction (units) Daily volume (units)

Force release

allow_force_release allow_quote_override

Custom rules

Each rule scopes an action class to a verdict + message.

3.5 · VES reconciliation (Mark EXECUTED)

When a settlement is stuck in RECONCILIATION_FAILED, an operator can use this workflow to manually mark it as CONFIRMED_EXECUTED or CONFIRMED_NOT_EXECUTED. The operator signs a server-derived canonical payload out-of-band (CLI / HSM); the signature is forwarded to the reconciliation-service, which issues the encrypted σ_VES evidence and emits the audit row. Private keys NEVER cross to the browser.

3 · Pending critical changes

Maker-checker queue. A different admin (≠ proposer) must approve.

4 · JWT signing key

Rotating the key invalidates all existing JWTs (the active grace window via jwt_key_rotated_from lets in-flight tokens verify for one rotation cycle).

Active fingerprint: —
Set at: —
KMS key id: —

5 · Webhooks

HTTPS-only endpoints. Secrets are stored envelope-encrypted; only the fingerprint is shown after registration.

Register a new webhook

URL Description

Subscriptions

6 · Audit log

Append-only, signed-chained. Showing 0 audit events.

Filter: