> ## Documentation Index
> Fetch the complete documentation index at: https://docs.molesignal.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Administration overview

> Understand workspace administration, personal settings, and the protected platform scope.

MoleSignal separates three administration contexts.

| Context                | Scope                                                                                           |
| ---------------------- | ----------------------------------------------------------------------------------------------- |
| Personal account       | Profile, preferences, password entry points, sessions, and memberships.                         |
| Organization workspace | Members, roles, access policy, streams, alerts, reports, and workspace settings.                |
| Platform `_sys` scope  | Platform administrators, system telemetry, license history, and global organization management. |

## Workspace administration

Use **IAM** for users and access:

* pending user approvals, members, and invitations;
* teams and service accounts;
* built-in and custom roles;
* role bindings, resource relationships, and cross-organization grants;
* email-domain policy and SSO providers.

Use **Settings** for workspace and operational policy:

* workspace name, stable identifiers, signup, sharing, and preference defaults;
* billing where SaaS is available;
* remote clusters and nodes;
* cipher keys, regex patterns, domains, correlation, model pricing, and running queries;
* audit events.

## Platform administration

The permanent `_sys` organization is not a normal tenant. A system-scoped session can access only
the routes granted by platform permissions.

Typical platform permissions include:

* `sys.organizations.manage`;
* `sys.licenses.read` and `sys.licenses.manage`;
* `sys.telemetry.read`, `sys.telemetry.manage`, and `sys.trace_debug.manage`;
* `sys.administrators.manage`;
* `sys.settings.manage`.

Tenant JWTs and `ms_*` API tokens cannot discover protected `_sys` metadata.

## Where to continue

<CardGroup cols={2}>
  <Card title="Identity & access" icon="users" href="/en-US/identity">
    Roles, permissions, groups, service accounts, SSO, and cross-workspace access.
  </Card>

  <Card title="Settings" icon="gear" href="/en-US/settings">
    Workspace and platform settings by section.
  </Card>

  <Card title="Resource sharing" icon="share-nodes" href="/en-US/resource-sharing">
    Share dashboards and reports safely.
  </Card>

  <Card title="Editions" icon="key" href="/en-US/editions">
    Compare OpenSource Edition, Enterprise Edition, and the planned MoleSignal Cloud model.
  </Card>
</CardGroup>