# Global Admin workflows

Open the operator console at [/admin/](https://projectflow-o4zv.hatchable.site/admin/). This is a separate URL and navigation surface from the Customer Workspace.

## Global Admin scope

Global Admin is the Pactuno control plane: company onboarding and directory, user access and plans, security, support routing, demo environments, and platform activity. Customer project records, Spaces, tasks, documents, reports, and analytics are not shown or served to the Global Admin identity; those remain in the authenticated company workspace at `/app/`.

## Companies and users

Company records are explicit tenants keyed initially by an onboarded primary email domain. To add a user, create a pending directory entry with the employee's real name, email, and company domain; this creates the company tenant when needed and records the invitation under that tenant. This does not create a Hatchable identity. The employee activates their account by using Employee Login and completing the emailed verification code. Do not invent an email address for a login account: the employee must receive the code.

## Company portal and audit

Open a company to update its portal display name, HTTPS logo URL, and primary theme color, add users, or promote a registered user to Company Admin. Each company has a **General audit** report with progress, open and closed projects, wins/losses and win rate, revenue/pipeline/budget/cost figures, overdue work, risks, issues, users, and the most recent company and project audit events. Progress is derived from task and milestone completion; it is a portfolio snapshot, not a financial or compliance certification.

## Plans

Open the user's company, choose a plan for a registered account, and submit the change. Pending directory entries have no registered user ID and cannot be assigned a plan. The result reports the plan update and whether notification email was sent.

## Access and MFA

- Suspend or restore Pactuno access from the company user view.
- Revoke MFA to require that user to enroll again.
- Global Admin is protected from customer user-management actions.

## User removal

Hatchable controls the sign-in identity table. If permanent deletion is denied, Pactuno suspends access and preserves profile/plan records to avoid partial deletion. The console reports the outcome. Do not describe this as a permanently deleted Hatchable identity.

## Notifications

The Global Admin notification bell reports customer-directory user additions, newly registered Pactuno accounts, first-time customer onboarding, plan changes, access suspension/restoration, MFA resets, support-routing changes, user-removal outcomes, and demo workspace creation/removal. Company onboarding notifications are reconciled from invitations and registered accounts; each event is deduplicated. Onboarding events are reconciled from the customer directory and registered-user records, deduplicated, and can be marked read from the notification menu. Administrative changes are recorded when their action succeeds. The badge is hidden when there are no unread items.

## Demo and support

Global Admin manages authenticated fictional demo workspaces and support routing. The shareable public walkthrough at [/customer-demo/](/customer-demo/) is static sample data and does not require a dummy account.