Platform support access

Tenvyr platform support does not reuse tenant accounts, tenant roles, browser cookies, passwords, TOTP, or tenant OIDC sessions. It has a separate operator identity, session, authorization, database, and audit path.

Operator authentication

An approved workforce bridge supplies a short-lived, one-use assertion with:

• a stable workforce subject;
• WebAuthn completed within five minutes;
• an assertion lifetime no longer than two minutes; and
• an authenticated signature from the bridge.

Tenvyr exchanges it for an opaque operator session that expires after 15 minutes. The token is returned once and belongs only in an approved operator credential agent.

Request a support grant

A support request must specify:

• the exact tenant UUID;
• inventory:read, audit:read, or both;
• a purpose of at least ten characters;
• a ticket reference; and
• an expiry from five minutes through one hour.

The request is pending and cannot read customer data.

Independent approval

A different operator must approve or reject the request with fresh WebAuthn. The decision is immutable. The requester cannot approve their own grant.

An approved grant is:

• read-only;
• capability-scoped;
• bound to the requesting operator session;
• time-bounded;
• revocable; and
• recorded in both tenant and platform-operator audit chains.

Customer-data reads

Customer inventory and audit routes accept only the approved support-grant ID. They reject tenant selectors and derive the tenant through restrictive database row-level security.

Every read rechecks requester identity, independent approval, capability, recent WebAuthn, expiry, and revocation. An expired, rejected, or revoked grant fails closed.

Emergency revocation

An operator with fresh WebAuthn may revoke the grant with a reason. Subsequent authorization and database checks fail immediately. Preserve the ticket, request, decision, read events, and revocation as incident or support evidence.

What support access cannot do

The support plane cannot:

• change tenant policy;
• create or approve SSH access;
• read private keys or authentication secrets;
• modify customer resources;
• bypass tenant isolation; or
• become a terminal proxy.