PKPEEK Docs
Docs/Customers & tenants

Initial agency administrator handoff

Screen 1.9 — activate the agency-designated initial administrator through an independently verified, bounded acceptance flow.

PEEK Platform Administrator · PEEK Technical Reviewer

/peek/customers/tenant-a/1-9
Live walkthrough · Initial agency administrator handoff
/peek/customers/tenant-a/1-9

The handoff is how an agency gets its first administrator — and the last time PEEK touches agency user management. After it completes, routine user management moves to the agency app.

Verified handoff

  1. 1. Record designation

    Administrator records the agency’s designation evidence (from 1.3).

  2. 2. Independent verification

    A different operator holding initial_admin.verify verifies the issuer and subject.

  3. 3. Bounded acceptance

    A scoped, expiring acceptance flow is issued to that exact identity subject.

  4. 4. Agency acceptance

    The designated person signs in through the agency IdP and accepts; only the designated initial-admin scope is activated.

Heads up — Email alone is never sufficient. The requester cannot be the verifier, and PEEK cannot designate itself for agency access. An invitation redeemed by another subject or after expiry is rejected without creating membership.

1.9 · Initial Agency Administrator Handoff

Activate agency-designated initial administrators. Open it at /peek/customers/tenant-a/1-9 (any tenant ID you can access works in place of tenant-a). The primary action is Complete verified handoff, which requires initial_admin.verify.

How 1.9 works

  1. 1. Record designation, independently verify issuer and subject, issue a bounded acceptance flow and record agency acceptance

Screen 1.9 contract

Fields shown
Designation evidence, identity subject, verifier, scope, expiry, acceptance
Primary action
Complete verified handoff
Required capability
initial_admin.verify
Validation
Designation, tenant, scope, expiry and verifier must be valid. Requester cannot be verifier; email alone is insufficient.
Successful outcome
Activate only the designated initial administrator scope; routine user management transfers to the agency app.
Screen states
Loading; empty; ready; restricted; stale; error; review pending
Audit event
admin.screen.1.9.action (acceptance test AT-UI-1.9)
Requirements
R02, R03, R04, R06, R28, SYS02, SYS04, SYS06, SYS10, SYS11, SYS20, SYS23, UI-1.9
Boundary — Requester and verifier are different people and PEEK cannot designate itself for agency access.
Rejected even if the browser allows it — Redeem an invitation as another subject or after expiry; reject without creating membership.

Related guides

Customer scope and administrators

Screens 1.3 and 1.3A — define the agency customer boundary, designate initial administrators, and configure department-wide purchases.

Agency identity and sign-in

Screen 1.8 — register and validate the agency’s trusted identity provider, assurance requirements (MFA, CAC/PIV) and session policy.

Activation readiness and completion

Screens 1.5 and 1.5A — evaluate readiness blockers for the purchased configuration, activate the tenant and read the activation receipt.