Administration

Platform admin is an instance-wide flag on your account, separate from the workspace roles (owner, admin, member). It unlocks the Admin section in the sidebar — Overview, Users, and Organizations across every workspace.

The first user created on a fresh instance becomes platform admin automatically, no matter which path the account came in through (the setup screen or plain sign-up). Complete first run before exposing the instance publicly, so that account is yours. After that, platform admins are made and unmade from Admin → Users.

Admin → Overview shows instance totals: users, organizations, connections, bots, and banned users.

Admin → Users lists every account on the instance — name, email, platform role, status, and creation date (the first 100, when there are more). Each row offers:

• Set password — set a new password for the account directly. On instances without email configured, this is how password resets happen.
• Ban / Unban— a banned user is signed out and blocked from the instance. You can't ban yourself.
• Make platform admin / Remove platform admin — grant or revoke the platform admin flag. You can't demote yourself.
• Impersonate — browse Gondola as that user. Not offered for yourself, banned users, or other platform admins.
• Agency mode — enable it on a user so they can create multiple workspaces (for example, one per customer).

1. 1

   Start from the user list

   Admin → Users → Impersonate on the row. Confirm, and you land in the app as that user.

2. 2

   Work as them

   An amber banner stays across the top the whole time: You're viewing Gondola as <email> — everything you do is done as them.

3. 3

   Stop impersonating

   The banner's button restores your own session and returns you to the user list.

Both starting and stopping are written to the audit log of the workspace the impersonated user had active, with the acting admin recorded as the actor.

Admin → Organizationslists every workspace on the instance: name, slug, plan, member count, and creation date. You can also create a workspace on a user's behalf from this page. Opening one shows:

• Members — the full list with roles.
• Connections — names, account identifiers, and auth methods only. Credentials are never loaded into admin views.
• Bots — with status, transport, and last error.
• Plan — a free / pro / enterprise selector, editable in place.

Workspace secrets stay secret. Snowflake tokens, private keys, and Slack credentials are AES-256-GCM encrypted in the database, the UI never renders them for anyone (they're write-only — replace, never read), and admin screens don't load them at all. A platform admin can manage users and workspaces without ever seeing a credential.