Grant platform admin

Platform-admin membership lives in the platform_admins allowlist table. There is deliberately no UI or API for granting it — only SQL (Supabase dashboard → SQL editor, or psql). See ADR 0011 for why.

Grant

insert into platform_admins (user_id, note)
select id, 'founder' from auth.users where email = 'person@example.com'
on conflict (user_id) do nothing;

The account immediately gains:

• the Admin item in the user menu inside the app, and
• access to /admin (Overview, Users, Workspaces, Audit log, AI & docs).

Revoke

delete from platform_admins
where user_id = (select id from auth.users where email = 'person@example.com');

Verify

1. Signed in as the granted account, open /admin — it loads.
2. Any other account gets a 404 on /admin and sees no Admin menu item.
3. select * from platform_admins; lists exactly the accounts you expect.

Notes

• Deactivating a user from /admin/users is an auth ban — it blocks sign-in and token refresh but deletes nothing. Active sessions can persist up to ~1 hour (access-token lifetime).
• Deleting a workspace from /admin/workspaces is permanent: database rows cascade and stored documents are removed from Storage.