Anchor OS Customer Workspace

Session

Overview

Agreements Masked

Identifiers Token-only

Admin plane Isolated

This workspace is ready for customer-authenticated flows. Backend record APIs can be connected next without reusing workforce authentication.

Agreements

Agreement records Expose customer-visible terms and status here after the customer API adopts token-bound authorization.
Payment and reporting artifacts Continue masking identifiers; rely on `vault_ref` and `tax_id_last4` in all UI-bound payloads.

Counterparties

Customer-facing parties Identity Platform owns login state; actor identity resolution stays server-side and token-only.
Support access Use the internal admin plane for workforce investigations instead of exposing operator controls here.

Tasks

Customer checklists Ideal next API surface for secure file exchange, status updates, and attested completion events.
PII submission Route raw identifiers only through the dedicated tokenizer boundary, never through the main event plane.

Audit Feed

Auth source Identity Platform tenant session with environment-specific runtime config emitted from Terraform.
Protected admin plane The internal workforce dashboard remains behind LB + IAP and is never reachable from the customer workspace.
Identifier handling No raw SSNs, TINs, or FTI are displayed in this workspace. Use tokens, vault refs, and masked last-4 only.

Sign in to reach customer records