PKPEEK Docs
Docs/Oversight, support & audit

PEEK support access

Screen 8.1 — request, approve and activate an exceptional, scoped and time-boxed support window.

PEEK Support Operator · PEEK Technical Reviewer

/peek/customers/tenant-a/8-1
Live walkthrough · PEEK support access
/peek/customers/tenant-a/8-1

By default PEEK sees only sanitized metadata. When support genuinely needs more, the operator requests a support window naming the exact resources, permitted actions, purpose and expiry. There is no standing content privilege, no global impersonation and no self-approval.

Support window lifecycle

  1. 1. Request

    Support Operator (support.request) specifies purpose, resources, actions and expiry.

  2. 2. Agency approval

    The agency approves the request.

  3. 3. Independent PEEK review

    A Technical Reviewer (support.review) who is not the requester reviews it.

  4. 4. Activate

    Activate approved support window opens a bounded session; every access is logged.

  5. 5. Expire or revoke

    The session ends automatically at expiry or on revocation — no manual cleanup.

8.1 · PEEK Support Access

Control exceptional scoped support access. Open it at /peek/customers/tenant-a/8-1 (any tenant ID you can access works in place of tenant-a). The primary action is Activate approved support window, which requires support.request or support.review.

How 8.1 works

  1. 1. Request exact resources, permitted actions, purpose and expiry

  2. 2. Collect agency approval and independent PEEK review before session activation

Screen 8.1 contract

Fields shown
Purpose, agency approval, independent reviewer, scope, expiry, session
Primary action
Activate approved support window
Required capability
support.request or support.review
Validation
No standing content privilege, self-approval or global impersonation. Server enforces actor, tenant, operation and time scope.
Successful outcome
Bounded support session logs each access and expires or revokes without manual cleanup.
Screen states
Loading; empty; ready; restricted; stale; error; review pending
Audit event
admin.screen.8.1.action (acceptance test AT-UI-8.1)
Requirements
R02, R06, R21, R28, SYS02, SYS04, SYS06, SYS10, SYS11, SYS20, SYS23, UI-8.1
Boundary — Sanitized metadata is the default and no requester can self-approve access.
Rejected even if the browser allows it — Use an expired session or access another resource within the same tenant; deny and audit it.

Related guides

Access and credential audit

Screen 8.2 — filter and export authorized identity, access, credential-lifecycle and policy audit events.

Rules and guards

The system-wide rules every PEEK screen and command enforces, independent of the UI.