FinToken XArchitecturePlatform Admin

Platform Admin

FinToken X internal staff. The most dangerous role on the platform — sees everything, can do anything. Every action is distinctly tagged in the audit trail so a Financial Conduct Authority (FCA) auditor can tell admin actions apart from real customer actions. The bypass marking is the single most important regulatory invariant for full production.

Marcus Doyle · Site Reliability, FinToken X

marcus.doyle@fintokenx.uk · 9 years Site Reliability Engineering (SRE) / production engineering · backed up by two on-call engineers

Marcus owns the production environment. He responds to incidents, fixes data hygiene problems on customer files, manages provider credentials and rate limits, and signs off deployments. He has authority to act on behalf of any customer for support purposes — but every such action is recorded with a fingerprint the regulator can read.

Channel
Browser Single-Page Application (SPA) + direct ops tooling out of doc scope
Role-Based Access Control (RBAC)
platform_admin · god-mode
Authority
Anything — but every action audit-marked
Bypass marking
Mandatory; tested by compliance every quarter

The bypass-marking invariant

The single most important rule on this page. Money-control rule 12 is non-negotiable: every action a platform admin takes on behalf of a customer must be tagged in the audit log with the actor role and the on-behalf-of subject. The regulator has to be able to read the audit log and answer "did the customer do this, or did an admin do this?" with a single column lookup.

POSTaudit_log entry · ADMIN_BYPASS shapecanonical record
{
  "id": "audit_a8h2…",
  "timestamp": "2026-05-22T15:48:21.804Z",
  "action": "SUBMIT_INVOICE",
  "actor": "sub_marcus_doyle",
  "actor_role": "platform_admin",
  "on_behalf_of": "sub_cop_g1k_77241",    // the customer's subject ID
  "on_behalf_of_role": "sme_seller",
  "reason": "Support ticket SUP-2026-1184: customer's PDF upload failing on their device, walking them through over the phone.",
  "bypass_gate": ["GATE_3_MLRO_REQUIRED"],   // any guard that was not enforced
  "chain_anchor": "0x7a2c…b811",            // hash anchored on FinToken X Network every 10 minutes
  "resource": { "type": "invoice", "reference": "FX-INV-23A4F" },
  "diff": { "…": "…" }
}
Three things make this load-bearing: (1) actor_role = 'platform_admin' is set by middleware, not by the caller — the platform admin cannot forge it as a customer action. (2) on_behalf_of is required when actor_role = 'platform_admin' and action ∈ customer-actions; missing this returns 422 from the API. (3) Every audit entry hashes to a Merkle root anchored to the FinToken X Network every 10 minutes — tampering with a historical entry breaks the chain. Compliance tests this quarterly by sampling 20 admin-bypass entries and verifying each has an on_behalf_of, a reason, and a non-broken Merkle path.

Console surfaces

RoutePurpose
/adminConsole landing — Key Performance Indicators (KPIs) across the whole platform.
/admin/usersUser management. Subject access exports. Role overrides (with audit marking).
/admin/rolesRBAC matrix. Read-only view of which actions each role can take, with bypass markers.
/admin/configSystem configuration. Feature flags, sandbox-vs-production switches.
/admin/rate-limitsPer-tenant, per-key rate limits.
/admin/providersExternal provider credentials (Sumsub, ComplyAdvantage, Chainalysis, Companies House, FCA register, banking rails).
/admin/deploymentsDeployment history, rollbacks, environment promotion.
/admin/incidentsIncident management. Live and historical incidents with timelines.
/audit-logThe audit log itself. Filterable by actor, actor_role, action, time. The single most-used screen during an FCA review.

The console · /admin

🔒 app.fintokenx.uk/admin
FX
⚙️
📋
🚨
Admin
Marcus D. PLATFORM_ADMIN

Platform admin

Tuesday 22 May 2026 · environment production

Active subjects
1,847
+22 today
Funded MTD
£24.1m
Open incidents
2
P3 + P4
Provider error rate (24h)
0.04%
Sumsub +0.02% vs 7d avg
Audit anchor lag
42s
target < 10 min
Open incidents
ID
Title
Severity
Opened
INC-114
Sumsub webhook delivery delayed (~3 min) for ~2% of submissions
P3
11:44
INC-113
Stale FCA register cache for 1 lender (refresh failed at 02:00, retried OK at 02:14)
P4
02:00
Recent admin-bypass actions (last 24h · 4 entries)
Actor
Action
On behalf of
When
Marcus Doyle
SUBMIT_INVOICE
Coppergate Joinery (sub_cop_g1k…)
15:48
Marcus Doyle
RESEND_BUYER_EMAIL
FX-INV-22A12
14:02
Sarah O.
FORCE_RECONCILE
FX-INV-21Q88 settlement
11:18

Audit log · /audit-log

The single most important screen on the platform. Every action by every actor — customer, broker, lender, investor, partner, compliance, admin — lands here. Tamper-evident via Merkle anchoring to the FinToken X Network every 10 minutes.

🔒 app.fintokenx.uk/audit-log?actor_role=platform_admin&range=24h

Audit log

Filtered: actor_role = platform_admin · last 24h · 4 entries · all anchor-verified

Time
Actor
Action
Resource
Anchor
15:48:21
Marcus Doyle platform_admin
SUBMIT_INVOICE on_behalf_of Coppergate Joinery
FX-INV-23A4F
14:21:08
Tom Whitfield buyer_ap
CONFIRM_INVOICE
FX-INV-23A4F
14:21:09
system system
TOKEN_MINT
FXR-INV-23A4F · 0xfx3643…a1f / 23147
14:24:11
Caroline Beck lender
FUND_INVOICE
FX-INV-23A4F · pay_5fz1qa…
14:24:31
Priya Lall compliance_officer
MLRO_APPROVE
sub_cop_g1k_77241 · Coppergate Joinery
Each entry's anchor is verifiable independently — click "Verify anchors" to recompute the Merkle path against the on-chain anchor block. Tamper: any modification to a stored entry breaks the path; the screen would highlight the offending entry in red and refuse to load until ops investigate. Regulator export: "signed CSV" includes the full Merkle proof per entry; FCA can independently verify integrity by checking against the public-readable on-chain anchor.

Incidents · /admin/incidents

Live ops surface. Severity ladder follows standard SRE practice. Incidents that touch customer money or compliance are auto-escalated to compliance for sign-off on resolution.

🔒 app.fintokenx.uk/admin/incidents/INC-114

INC-114 · Sumsub webhook delays

P3 · opened 11:44 · ~2% of submissions delayed by ~3 min

In progress
Impact
  • Onboarding O3 status surface lags Sumsub decision by ~3 min.
  • No customer is given a wrong outcome — the actual decision is correct, just shown later.
  • No money is affected.
Timeline
  • 11:44 · paged on Sumsub webhook latency > 60s
  • 11:51 · acknowledged · Marcus Doyle
  • 11:58 · root cause identified · Sumsub upstream queue saturation
  • 12:14 · Sumsub confirmed they are scaling · ETA 30 min
  • 12:38 · monitoring
Compliance escalation

Auto-escalated to Priya Lall at 11:51 because Gate 1 timing is regulator-relevant. Priya signed off on the user-facing copy ("checks running, please bear with us") at 11:54.

User management · /admin/users

Look up any subject; impersonate (with audit marking); export Data Subject Access Request (DSAR); force role override.

🔒 app.fintokenx.uk/admin/users/sub_cop_g1k_77241

Coppergate Joinery Limited (Ltd) · Aisha Mahmood

sub_cop_g1k_77241 · sme_seller · ACTIVE since 22 May 2026

Identity

Companies House (CH) 07452983 · Sumsub GREEN · ComplyAdvantage clear · Money Laundering Reporting Officer (MLRO) approved by Priya Lall on 22 May 12:18

Activity (90d)

14 invoices · £142,420 cumulative · 0 disputes · 0 Suspicious Activity Report (SAR) triggers

Admin actions
Reminder. Every action on this page is audit-marked with actor_role=platform_admin and on_behalf_of=sub_cop_g1k_77241. Reasons are mandatory and recorded.

Where it can go wrong

BranchMitigation
Admin acts without bypass markingImpossible by design — the middleware sets actor_role; the API rejects customer-action requests from a platform_admin session unless on_behalf_of is set.
Admin tries to freeze a subject for non-compliance reasonsFreeze button requires a compliance sign-off step; freeze without sign-off is rejected at the API.
Audit log anchor breaks (Merkle path failure)Audit-log surface refuses to render until ops investigate; alert pages SRE on call; compliance is auto-notified.
Admin attempts to retroactively edit an audit entryDatabase-level append-only with row-version protection; attempts return 403 and themselves write a new audit entry of the attempt.
Provider credential rotation failsProvider falls into degraded mode — onboarding pauses with a "checks running" status; customer is not silently approved.