Tenants & Platform Admin
Ticku is multi-tenant: one deployment hosts many customer organizations (tenants). Two distinct admin roles operate at different levels:
| Role | Scope | Manages |
|---|---|---|
Tenant admin (Membership.isAdmin) | One tenant | Users, projects, roles, tags, statuses, calendar, webhooks, email — inside that tenant |
Platform admin (User.isPlatformAdmin) | The whole platform | The tenants themselves — create, approve, suspend, and other platform admins |
This page covers the platform admin role. For inside-a-tenant administration see the rest of the Admin Guide.
The platform admin panel
Platform admins manage tenants from the admin area (/admin/tenants):
| Action | What it does |
|---|---|
| List tenants | All tenants and their status |
| Create tenant | Provision a new tenant directly (lands ACTIVE) — see Tenant Provisioning |
| List pending | Self-serve registrations awaiting review |
| Approve / Reject | Action a PENDING_APPROVAL self-serve registration |
| Suspend / Restore | Block or restore a tenant's access (data stays intact) |
| List tenant members | See who belongs to a tenant |
| Grant / Revoke platform admin | Manage who holds the platform role |
Tenant lifecycle
Login and API access are allowed only when a tenant is ACTIVE. Tenants are never hard-deleted — suspension is the reversible way to cut off access while keeping data.
Who can be a platform admin
- Platform-admin accounts are restricted to the platform operator's own email domain — a tenant admin at a customer org can never become one.
- At least one platform admin must always exist. The panel refuses to remove the last one (including yourself) until another is in place — there is no in-app way back from zero.
- The very first platform admin is created during initial setup (
/setup), which refuses to run once any user exists. See Deployment Runbook.
Tenant switching (for members)
A regular user who belongs to more than one tenant uses the tenant switcher to move between them. Switching:
- Re-resolves their role, admin status, and permissions from the target tenant's membership.
- Remembers the choice (a
ticku_tenantcookie / the/t/{slug}path). - Never crosses data between tenants — see Multi-Tenancy.
Users can also set a primary tenant, which is where they land by default.
Related
- Multi-Tenancy — how isolation works
- Tenant Provisioning — creating tenants
- Authentication — domain resolution & self-serve registration