Admin guide

Managing an active Nebbos deployment day-to-day. This guide covers the admin surfaces every Enterprise operator sees; the underlying substrate is the same as MCP reference and REST API reference, so every action here is scriptable.

Managing users

Adding a user

Users are provisioned through the operator’s identity provider rather than directly in Nebbos. Adding a user to an SSO group mapped to a Nebbos department creates the operator identity automatically. Nebbos does not expose a manual user-create path; such a path would bypass the operator’s identity plane and is not implemented.

Changing a user’s tier

Tier is a property of the operator’s identity, not something an admin toggles on Nebbos. To elevate a user from Guest to Host:

1. In your IdP, add the user to the Host-mapped group for their department.
2. The user re-authenticates on their device.
3. On the next call, the substrate resolves the new tier from the identity plane.

No Nebbos-side click required. Every tier change lands in the audit chain.

Removing a user

Remove the user from every relevant IdP group. The Nebbos substrate revokes the operator identity’s tokens on the next sync (worst case: 15 minutes for token expiry). To force-revoke immediately, call the revocation endpoint or use the CLI:

nebbos identity revoke --operator <operator_id> --reason "employee offboarding"

Managing departments

Creating a department

Architect-tier operation. Departments define the scope every Pearl serves and the isolation boundary every row respects.

nebbos admin department create \
  --name "Finance" \
  --parent-org "your-org-id" \
  --justification "New finance function; Q1 2027 operational readiness."

Merging or splitting departments

Both are substrate mutations that require Architect tier + an enclave-signed approval. Merges preserve the audit chain of both source departments; splits preserve the audit chain of the origin department in each resulting department. No history is lost.

Managing Pearls

Retraining a Pearl

Retraining ingests a new batch of decisions into the memory register. Retraining requires Host tier and produces an audit-chain entry the compliance officer can inspect.

nebbos pearl retrain \
  --pearl-id <id> \
  --training-set ./decisions.jsonl \
  --justification "Q1 policy refresh; forty new decisions on refund handling."

Auditing a Pearl’s reasoning

Every Pearl recommendation carries a citation trail. Query it directly:

nebbos pearl explain --recommendation-id <id>

Returns the memory registers consulted, the past decisions cited, and the source documents referenced. This is the artefact your compliance officer will ask for on a decision review.

Managing Cradles

See Cradle provisioning for first-time setup and the replacement path. Day-to-day, the Cradle’s lifecycle events (attach, detach, key rotation, memory sync) are all audited automatically.

Rotating a Cradle’s key

Architect-tier operation. Runs the key ceremony in place; the operator continues to use the same Cradle device, but the underlying key rotates. Common cadence: every 12 months, or after any incident that could indicate compromise.

Managing signals

Signals are cross-domain risk observations raised by the Orchestrator. Admin surfaces:

• Read — list active signals, filter by department, severity, or age
• Acknowledge — Host tier + human-token; the acknowledgement names the delegator
• Escalate — increase severity or route to a different owner
• Resolve — close the signal with a resolution note; note appended to the chain

Managing subscriptions & webhooks

Every webhook subscription is an admin-level artefact — the audit chain records who added it, what topics it subscribes to, and every delivery attempt. See Webhooks for the delivery semantics.

Managing the audit chain

The chain is append-only. Admins cannot delete entries, edit entries, or filter what gets written. What admins can do:

• Verify — nebbos audit verify --from <event_id> --to <event_id> returns a signed receipt.
• Export — a segment or the operator’s entire scope, see Portability & export.
• Bookmark — pin a specific entry with a memo for later reference.

Rate limits & quotas

Per-tier ceilings apply uniformly. See Rate limits & quotas. For higher quotas, request through your deployment lead; a substrate-side lift is per-operation-category, not global.

Getting help

Enterprise operators have a named deployment lead available in a shared channel. For general questions, FAQ. For a specific incident, follow Incident response.