Admin console

The admin console is where access administrators manage who can use Stream Trace and what they can do. Access requires the relevant global permission for each section (for example users.manage for Users); instance_admin and access_admin cover all of management.

Users

List users, invite new ones, edit their global roles and team memberships, deactivate accounts, and revoke sessions to force re-authentication. Requires users.manage.

Teams

Create and update teams and manage their membership, assigning team-scoped roles to each member. Requires teams.manage.

Roles

Review the built-in roles and create custom roles by picking any combination of global or team permissions. Requires roles.manage.

Stream ownership

Map streams to the teams that own them, or override the ownership that was provisioned from configuration. Requires stream_ownership.manage.

Audit log

Browse supported publish, replay, DLQ retry/discard, administration, and authentication outcomes, filterable by action, outcome, resource type, and time. Entries include available actor, IP, timestamp, request ID, and outcome context. Ordinary reads, exports, and general permission denials are not recorded. Requires audit.read.

Audit writes are best-effort: supported actions attempt to write an event to the instance database, and action success is not rolled back if that write fails. The log is not immutable or complete compliance evidence. Its survival depends on the database volume and backups. Retention is currently unbounded, so monitor database growth and manage database and backup retention during evaluation.

Settings

View the effective auth configuration - enabled methods, OIDC providers, signup mode - to confirm how the instance is set up. Requires system.settings.read.