Skip to main content

Admin Panel Overview

Audience: Administrators
Page Type: Reference Guide
Summary: Tenant settings, user management, role definitions, approvals, audit.

Accessing Admin Panel​

COS Admin panel is accessed via /admin URL. Required Role: SUPER_ADMIN

Admin Menu​

Menu ItemDescriptionAccess
Tenant ManagementTenant (company) CRUDSUPER_ADMIN
Holding GroupsTenantGroup managementSUPER_ADMIN
Plan ManagementPlanTemplate and FeatureDefinition CRUDSUPER_ADMIN
Subscription ManagementSubscription CRUD and overridesSUPER_ADMIN
RBAC ManagementDB-based permission managementSUPER_ADMIN
User RolesRole listing and assignmentsSUPER_ADMIN
Global KPI LibraryPlatform-wide KPI templatesSUPER_ADMIN
Global Product KPI LibraryPlatform-wide product KPI templatesSUPER_ADMIN
Global Resource LibraryPlatform-wide resource templatesSUPER_ADMIN
Sector ManagementSector lookupsSUPER_ADMIN
Country ManagementCountry lookupsSUPER_ADMIN
DMA TemplatesDigital Maturity Assessment templatesSUPER_ADMIN
Excellence TemplatesExcellence Assessment templatesSUPER_ADMIN
AI Prompt ManagementAI system prompt templatesSUPER_ADMIN
AI AnalyticsAI usage statisticsSUPER_ADMIN
AI Provider DefaultDefault AI provider settingsSUPER_ADMIN
AI Model RegistryAI model registrySUPER_ADMIN
AI Tool LogsAI tool call logsSUPER_ADMIN

Note: The Admin menu is for SUPER_ADMIN role only. Tenant-level management is under the Platform menu (Tenant Settings, Users, Integrations, etc.).

User Management​

Adding Users​

  1. Platform → Users → Add User
  2. Enter Email and Name
  3. Select Organizational unit
  4. Assign Role (MEMBER, TEAM_LEAD, STRATEGY_MANAGER, ADMIN)
  5. Save - System sends automatic invite email

User Roles (Tenant Level)​

COS uses a 4-layer role architecture:

LayerRoleScopePermissions
PlatformSUPER_ADMINEntire systemFull admin menu, tenant/plan/subscription management
HoldingGROUP_ADMINGroup tenantsView group tenants, view effective plan
TenantADMINSingle tenantUser management, tenant settings, approval workflows
TenantSTRATEGY_MANAGERSingle tenantStrategy modules, themes, planning
TenantTEAM_LEADUnit hierarchyUnit strategy, OKR scoring, team management
TenantMEMBEROwn assignmentsAssigned tasks, OKR updates

Note: There is no "CEO" role in the system. CEO functionality is achieved by assigning the ROOT org unit leader as TEAM_LEAD or ADMIN.

Changing Roles​

  1. Select user in Users table
  2. Edit → Role dropdown
  3. Select new role → Save

Deleting Users​

  1. Select user
  2. Deactivate - Data preserved, access removed
  3. (You can reactivate later)

Role Definitions and Permissions​

COS roles are managed with a DB-based RBAC system. Permissions for each role are defined in the Permission table and loaded via seed.

The sidebar menu uses the new information architecture with the following groups:

Menu GroupContentRoles
DashboardAdmin/Strategy/Team Lead/Employee dashboardsAll roles (dashboard type varies by role)
PlatformTenant settings, users, group mgmt, plan info, integrations, AI settingsADMIN, GROUP_ADMIN, SUPER_ADMIN
ContextOrganization, products, mission/vision, strategic cyclesAll roles (write permission varies)
AnalysisCurrent State, Product Scorecard, Digital Maturity, Excellence Assessment, VRIO, PESTLE, Porter, BCG, FindingsSM, ADMIN + plan feature check
SynthesisProduct SWOT, SWOT, Strategic ThemesSM, ADMIN + plan feature check
ExecutionBSC, OKR Cycles, My OKRs, OKR Control Center, DMA My Tasks, Excellence My TasksAll roles (scope varies by role)
Gap AnalysisStrategic Alignment, Approval Queue, OKR Hygiene, Orphan Console, Gap ActionsSM, ADMIN
LibraryResource Library, KPI/IPF Library, Product KPI LibraryAll roles (write permission varies)
ReportsStrategy Reports, Performance Reports, RoadmapSM, ADMIN + plan feature check
AdminTenant/Group/Plan/Subscription/RBAC/Library/Template/AI managementSUPER_ADMIN

API Permissions​

All API calls are protected by the following guard chain:

@UseGuards(JwtAuthGuard, TenantGuard, OrgUnitScopeGuard, PermissionGuard)
@RequirePermission('module.resource.action')
  • JwtAuthGuard: JWT token validation
  • TenantGuard: Tenant isolation (X-Tenant-ID header)
  • OrgUnitScopeGuard: Organizational unit scope control
  • PermissionGuard: DB-based permission check (Permission table)

Approval Workflows​

PHASE 2 - Resource Approval​

ItemApproverDecision
Corporate ResourceCEOApprove / Reject
Unit ResourceSTRATEGY_MANAGERApprove / Reject

Rejection: System returns to PHASE 1, vision must be updated.

PHASE 4 - OKR Approval​

ItemApprover
Corporate OKRCEO
Unit OKRSTRATEGY_MANAGER

Audit Log​

What is Logged​

  • All data create/update/delete operations
  • All approval/rejection operations
  • All user access (login)
  • All role changes

Viewing Audit Log​

  1. Admin → Audit Log
  2. Filter by Date range, entity type, action
  3. Click on row to see details

Access: People with ADMIN role

Tenant Settings​

Organization Name​

  • Tenant's corporate name
  • Displayed in all reports and dashboards

Fiscal Year Settings​

  • Q1, Q2, Q3, Q4 date ranges
  • OKR cycles depend on this calendar

Email Notifications​

  • Approval reminders
  • Deadline notifications
  • Strategy phase notifications

See also​