Access & Security
Login, RBAC, forced password change, and operator claims.
Access to Celestial Observer is restricted to operators authorized by the tenant administrator. The console supports authentication via Firebase (email and password) or corporate OIDC providers configured in the client's infrastructure. Every session is cryptographically bound to the operator's identity claims.
Authentication Flow. Enter the corporate email and password provided by the tenant administrator. On first access, the system will require a forced password change. After authentication, UI permissions are dynamically assembled from the user's Firebase custom claims: the interface will only display tabs and actions you are authorized for.
Role-Based Access Control (RBAC)
dashboard.viewer: Read telemetry, logs, and health checks. Restrictions: no access to Wiki, Settings, or Audit.-
wiki.editor: Edit Wiki documents, use Copilot. Restrictions: cannot approve Memory Candidates or sync. -
wiki.approver: Approve or reject Memory Candidates, Sync Wiki. Restrictions: cannot manage operators or connections. -
dashboard.admin: Full access including operator management. Restrictions: cannot remove own access (anti-lockout).