Platform Admin vs. Tenant Owner vs. Tenant Admin

The three admin levels that people mix up — and what each one controls.

These three roles sound alike but operate at different scopes: within one workspace (admin and owner) versus across every workspace (platform admin).

Follow these steps:

1. Tenant Admin — manages a single workspace: people, payroll, settings, approvals. Cannot demote the Owner, and cannot see other workspaces.

2. Tenant Owner — the highest level inside a workspace: everything admin can do, plus promoting owners, custom domain, and billing decisions. Only the Owner can assign the Owner role.

3. Platform Admin — operates across all workspaces: tenants, plans, pricing, releases, system health. It can act on behalf of a tenant, from /admin, but shouldn't change tenant settings casually.

4. When in doubt — workspace configuration belongs to admins/owners; cross-workspace control belongs to platform admins.

5. For an audit trail, check /admin/audit — every platform-level action is logged.