CAPABILITY / PLAN / APPLY

OpenAdmin

An admin UI must not pretend to be an authorization system.

A capability-based public API console for queues, queue fields, components, templates and boards.

IMPLEMENTED / PRE-PUBLISH

CAPABILITIES

Effective READ/WRITE/GRANT/DENY matrix with unknown global capabilities

Dry-run and explicit confirmation before mutation

Queue, queue-field, component, template and board create/update/delete

Workflow and user mutations explicitly marked unsupported by the API

Private actor, resource, payload and outcome history

DATA FLOW

Every change uses user OAuth. There is no service account, fallback or invented global isAdmin.

TRACKER→IFRAME→BACKEND→TRACKER / CHANNEL

FAILURES & BOUNDARIES

403 exposes the actual Tracker denial; unsupported operations return 422 before mutation.

Discuss an integration