SaaS owner or platform administrator
Operate workspaces, plans, gateways, and commercial boundaries
The platform area manages workspaces and commercial controls. It does not grant automatic access to tenant business data. Workspace provisioning, plans, gateways, subscription state, migrations, analytics, support records, and system health belong here.
Before you start
- Platform administrator access with MFA.
- Payment providers kept in sandbox until approval.
- Database and backup ownership documented.
#Provision and verify a workspace
- Create the workspace identity and database connection.
- Test connectivity without exposing credentials.
- Run tenant migrations and seed required permissions.
- Assign the approved plan.
- Verify tenant login and readiness.
- Record backup and support ownership.
#Use plans and billing as enforced controls
Plans define limits and feature availability. Tenant billing shows current plan, usage, checkout, renewal state, coupons, and invoices. Verify sandbox checkout and signed provider webhooks before enabling live payment credentials.
#Separate gateway setup from readiness
Encrypted credentials, mode, callback URL, webhook secret, signature verification, negative cases, refund/cancellation expectations, and provider approval all contribute to readiness. System health should report missing prerequisites rather than hiding them.
#Common mistakes
- Using live gateway credentials during documentation or demo capture.
- Changing a plan without understanding active tenant limits.
- Treating database connectivity as full tenant readiness.
#Verify the result
- Platform MFA is active.
- Tenant connectivity and migrations pass.
- Gateway webhooks are verified in sandbox.
- Health and commercial labels match evidence.