# Build the private platform-administrator control plane

Type: task
Status: open
Blocked by: 20, 27, 28, 42, 43, 44

## Question

Implement authenticated `requirePlatformAdmin` APIs and a private
`/admin/platform` web area for Platform Administrators to create/list/update
Organizations, bootstrap their OWNER, view/change lifecycle state, configure
and test each customer-owned Feishu Application, configure the Organization's
distinct platform-managed Provider Connection, and manage platform-admin
invitations and revocations. Implement ADR-0023's separate Platform Identity,
single standing role, guarded bootstrap procedure, identity-bound single-use
invitations, revocable server-side Platform Session, recent-authentication
step-up, last-administrator protection, fail-closed append-only Platform Audit,
Organization-safe audit projection, and dual-factor offline recovery with
expiring Emergency Platform Grants. Replace rather than reuse the legacy
customer-`User`-bound `PlatformRoleAssignment`/`TEACHER` model. Prove anonymous
users, ordinary members, and Organization admins cannot load either page data
or mutations; every sensitive action is validated, redacted, audited,
observable, and covered by browser-level critical-journey tests. Emergency
workload controls remain integrated through
[Add audited emergency workload brakes](37-emergency-workload-brakes.md).