Skip to main content

Organization Admin Runbooks

These customer runbooks focus on organization access. Never paste invitation links, credentials, secret values, recovery codes, or complete audit exports into support messages.

Compromised Administrator​

  1. Use a separate trusted owner or security-administrator session.
  2. Suspend the affected membership.
  3. Revoke the person's organization sessions.
  4. Revoke automation credentials, identity credentials, grants, delegations, and pending approvals changed during the suspected period.
  5. Inspect audit history by actor, resource, and time.
  6. Rotate affected external credentials.
  7. Run an access review before restoring access.

Stolen Or Misrouted Invitation​

  1. Revoke the invitation from Organization -> People -> Invitations.
  2. If it may already have been accepted, suspend the resulting membership.
  3. Revoke that person's sessions.
  4. Review invitation creation, resend, acceptance, and related audit events.
  5. Send a replacement only after confirming the intended verified email.

External Partner Offboarding​

  1. Confirm the partner's owned work is transferred.
  2. Suspend the partner group to stop inherited access immediately.
  3. Revoke direct grants that do not come from the group.
  4. Revoke active sessions and automation credentials.
  5. Remove members or let approved guest expiry complete.
  6. Archive the partner group after the review is complete.

Incorrect Grant Or Delegation​

  1. Revoke the exact grant or delegation.
  2. Use Explain access to identify additional direct, group, or inherited sources.
  3. Confirm an already-open page, terminal, or direct API request no longer succeeds.
  4. Review actions taken while access was active.
  5. Create a narrower replacement only after the scope and role are verified.

Identity Provider Outage​

  1. Keep at least one verified local organization owner available.
  2. Disable the affected connection if discovery or health is unsafe.
  3. Restore the last known-good public metadata and credential configuration.
  4. Verify local owner access, provider health, MFA policy, and directory token state.
  5. Re-enable federated sign-in only after a controlled test succeeds.

Ownership Recovery​

Moltern prevents normal removal of the final active owner. If no owner can authenticate, contact Moltern support with the organization name, verified company domain, incident reference, and an authorized company contact. The recovery workflow requires two separate platform operators and creates customer-visible audit evidence.

Budget Incident​

  1. Open Organization -> Budgets and Billing.
  2. Verify that the latest measurements are current.
  3. Identify the workspace and workload responsible for the increase.
  4. Adjust a PAYG cap, budget, or workload capacity only with the appropriate owner.
  5. Do not delete running data solely to clear an alert.
  6. Export the bounded usage record for finance review.

Escalation Information​

Include the organization, workspace, approximate time, visible error, and request identifier. Do not include passwords, tokens, private keys, connection strings, or secret values.

Related: Organization security, roles and scoped access, and troubleshooting.