Proposal: Delegated administration

A tenant or organization admin must manage their own scope without global access. This specs scoped admin roles on the existing Forseti self-authorization model (ADR-0021 / ADR-0006) — no new architecture.

Motivation

A multi-tenant platform cannot route all administration through a global admin. Tenant and org admins, helpdesk, and auditors each need a bounded slice — and that bound must be enforced, not conventional.

Design

• An admin capability is a Forseti relation (ADR-0006) scoped to a tenant, realm, or organization (ADR-0012 / proposal 0015): standard roles such as tenant-admin, realm-admin, helpdesk (reset/unlock only, no secret read), auditor (read-only).
• The admin API (ADR-0021) authorizes every operation against Forseti at the caller's scope — a tenant admin cannot touch another tenant (rule 3); custom admin roles are relation/policy definitions.
• The break-glass principal (ADR-0021) remains the bootstrap; every admin action is an event (ADR-0022).

Alternatives considered

• Global-admin-only — rejected (does not scale to multi-tenant/org).
• A separate admin-RBAC subsystem — rejected: dogfood Forseti (ADR-0021), one authorization engine.

Graduation criteria

Scoped admin roles are enforced via Forseti; a tenant/org admin is confined to their scope (a property test in the spirit of V7); helpdesk can reset but cannot read secrets.

Backward compatibility

On Forseti + the admin API; admin scoping is relations — no architecture change.

Open questions

• The standard role catalog; custom-role definition surface.