Admin UI

The Admin UI is a standalone React dashboard that speaks to the IAM REST API — deploy it next to your app (or behind an admin-only route) and manage access without writing a screen.

What it manages

Area	Capabilities
Users	create, activate/deactivate, assign roles & groups, per-tenant search
Roles	role hierarchy (parent roles), system-role protection
Groups	membership, group-level role grants
Resources	your registered business resources, their fields (with sensitivity), linked actions
Actions	the catalog — CRUD, cross-cutting, workflow — plus custom verbs
Permission matrix	the grid: resource × action (× field) → ALLOW / DENY per role
Audit	who changed what, when, from where — with before/after values

The permission matrix

The core screen. Rows are resources (and their fields), columns are actions, cells cycle — → ALLOW → DENY. Two visual rules mirror the engine’s semantics:

• DENY cells dominate — a DENY anywhere renders the effective state as denied, exactly as resolution will decide it.
• Unset means denied — the implicit-deny default is visible, not assumed.

Resources you registered via annotations or yml appear here automatically after startup — the matrix is where registration ends and authorization begins.

Deployment

The dashboard is a static build — host it anywhere (S3, nginx, Vercel). Point it at your API:

VITE_IAM_API_URL=https://api.yourapp.com npm run build

Access to the dashboard itself is governed by IAM: it logs in through the same /api/iam/v1/auth endpoints and requires the iam_* admin resources — which only privileged roles hold.