Admin guide
This guide is for the people who decide which agents may act, who approves what, and how evidence is kept:
- Customer tenant admins and MSPs register agents, bind their credentials, grant them narrow authority on a provider's service and choose who approves.
- Finance and business approvers decide on the exact transaction in the approval page or in their own workflow system, and later see the result.
- Enterprise admins (Axiom Control) adopt existing projects, connect approval systems, watch fleet health, contain incidents and deliver evidence to their SIEM.
Every task has a console screen and an API call. The console lives at app.sectigoaxiom.com; the API at api.sectigoaxiom.com. Console calls use your session cookie plus the x-axiom-csrf header on unsafe methods. A caller who cannot see a resource gets 404, never 403, so scope boundaries cannot be probed.
Roles
Roles bind to a scope. Org roles also apply to the tenants an org owns and the projects enrolled in it.
| Scope | Roles |
|---|---|
| Tenant | tenant_admin, finance_approver, approver, auditor |
| Project | project_owner, developer, viewer |
| Org | org_admin, security_admin, app_owner, approver, auditor |
| Permission | Held by |
|---|---|
agent.write | tenant_admin, org_admin, security_admin |
grant.write | tenant_admin, org_admin |
approval.decide | finance_approver, approver |
evidence.read | project_owner, developer, viewer, tenant_admin, auditor, org_admin, security_admin |
evidence.export | project_owner, tenant_admin, auditor, org_admin, security_admin |
policy.publish | project_owner, org_admin, security_admin |
incident.respond | org_admin, security_admin |
connector.write | org_admin, security_admin |
A policy author can never satisfy an approval that their own rule requires: publishing a rule is not an approval (see Approvers and approval modes).
Console map
| Screen | Path | Use it to |
|---|---|---|
| Customer tenants | /app/tenants | Pick the tenant you administer |
| Agents | /app/tenants/:tid/agents | Register agents, bind keys, suspend or retire |
| Access and delegation | /app/tenants/:tid/access | Grant agents operations on a service |
| Members and approvers | /app/tenants/:tid/members | Assign finance_approver, approver, auditor roles |
| Trust profile | /app/tenants/:tid/trust | Accept workload identity issuers |
| Approvals | /app/approvals | The approvals waiting on you |
| Approval page | /approve/:id | Approve or deny one exact request |
| Action detail | /app/actions/:aid | Timeline and diagnosis for one action |
| Policies (project) | /app/projects/:pid/policies | Draft, simulate, publish and roll back |
| Control: organisation pages | /control/orgs/:oid/... | Verification, members, SSO, enrollment, connectors, fleet, org policies, incidents, evidence, SIEM, inventory |
Where to start
- Register and admit an agent and bind its key.
- Grant it authority with an approval threshold and a ceiling.
- Map approvers and choose an approval mode.
- Decide deadlines and relay settings.
- Read the failure modes so you know what each problem looks like, and the “finance already approved this” diagnosis.
Developer preview
Approval connectors run in simulated mode and none is qualified against a real customer tenant; only ServiceNow implements the request and readback path. Sectigo Certificate Manager runs in mock mode, backed by a local development CA, until SCM credentials are configured. Card checkout is not connected. Each page says where this matters.