Platform Advisor

Detector framework for tenant-wide health plus read/write parity checks.

What is the Platform Advisor?

The Platform Advisor is a pluggable detector framework that scans tenant state and surfaces actionable suggestions as PlatformRecommendation rows. Examples:

• auto_create_mismatch — an account type sets an explicit auto-create veto on an auto-provisioning system
• system_owner_terminated — owner-based approval routing breaks silently
• owner_handover_due — a terminated owner still owns objects; applying the fix reassigns them to the manager
• dormant_grant — assignments whose last_used_at is older than the dormancy threshold (90 days for humans, 180 days for non-human identities, or NHIs)
• dormant_api_credential — dormant, expired, or over-scoped API credentials
• sod_violation / peer_outlier / cardinality_conflict / privileged_on_nonadmin_account — separation-of-duties (SoD) toxic combinations, over-permissioned outliers, single-value or seat conflicts, and privileged entitlements sitting on a personal account
• account_rule_provisioning_mismatch — read/write parity violations (see the separate concept page)

Per-tenant configuration

Every detector has a DetectorConfig row per tenant with enabled, interval_minutes, auto_remediate, the roles to notify, and optional kind-specific configuration. Rows are created lazily with the detector defaults (enabled=true); tenants can disable individual detectors, tune the scan interval (interval_minutes=null means on-demand only), and turn off the defensive auto-remediation.

Further reading:

• Read/Write Parity
• Failed Jobs Queue
• Reconciliation