Staff and administration
What Dylog staff can do, and where user and tenant administration happens.
Staff are Dylog employees whose account role contains admin. Accounts has no staff console of its own:
administration happens in the Better Auth Infra dashboard, which is connected to this service with the
project key and talks to the same API every other client uses.
Super-user access
Staff hold an automatic owner membership in every organization. It is created when a tenant is created,
refreshed on every staff sign-in, granted when someone is promoted and removed when they are demoted.
Tenants see staff in their People list but cannot remove or downgrade them.
Two consequences worth knowing:
- Staff JWTs carry
is_staff: trueand the active organization's claims, so backends can either treat staff as a normal owner of that tenant or grant broader access based onis_staff. - The organization switcher for staff lists every tenant. Use
/api/token?org=<slug>in tools that must act on a specific tenant.
What staff do where
| Task | Where |
|---|---|
| Create a tenant | Account → Organizations → Create organization (staff only) |
| Invite, remove or re-role members | The organization's People page |
| Search users, change roles, ban | Better Auth Infra dashboard |
| Revoke sessions, impersonate | Better Auth Infra dashboard |
| Audit log | Activity tabs in accounts, or the Infra dashboard |
Impersonation sessions last thirty minutes, are marked with impersonatedBy, and show a banner in the
user menu. Use them to reproduce what a customer sees, never to change security settings on their behalf.
Promoting and demoting
Change a user's role to include admin from the Infra dashboard (or POST /api/auth/admin/set-role
with a staff session). Demoting removes their automatic memberships but keeps any real membership they were
invited into. Staff cannot delete their own account.