> ## Documentation Index > Fetch the complete documentation index at: https://docs.outerlayer.ai/llms.txt > Use this file to discover all available pages before exploring further. # Platform admin access > What OuterLayer staff can read and change in your organization, with a temporary grant and without one, and how you see each change. OuterLayer staff with a platform admin account can reach your organization in three ways: * **A temporary grant** makes an admin a member of your organization for 24 hours. * **The support console** shows staff your runner hosts and build attempts. It needs no grant. * **The organization page** lets an admin see and change your account's plan and limits. It needs no grant. A platform admin account needs an OuterLayer staff email address and a platform role. ## Temporary access An admin asks for a grant to fix a problem. Examples: a tracker connection that no longer works, or a factory key to replace for a customer who is locked out. The admin must give a reason and confirm that you gave permission. OuterLayer records the reason. The emails do not include it. OuterLayer does not ask you to approve a grant. ### Roles a grant can give The admin chooses one role for each grant. Read is the default. | Role | What the admin can do | What the admin cannot do | | - | - | - | | Read | Read your work items, evidence, uploaded sessions, factories, repository connections, runner hosts, metrics and member list. | Change anything. See API keys. Change settings or billing. | | Write | Everything Read allows. Add work, ask for a build, review work, file and edit specs, change tracker connections, and list and create factory keys. | Delete factories. Manage members, roles, SSO or organization keys. Change settings or billing. | | Admin | Everything Write allows. Merge pull requests from the Work page. Manage factories, repository and tracker connections, members, roles and organization keys. Change organization settings, and set up or change SSO. Read billing and the audit log. | Give, change or remove the owner role. Remove SSO. Change billing. | Read includes uploaded sessions. A session at the `full` tier holds prompts, tool output and code. See [What leaves your machine](https://docs.outerlayer.ai/what-leaves-your-machine.md). A grant never gives the owner role. A platform admin cannot invite an owner, promote anyone to owner, or change or remove an owner. A grant lasts 24 hours. Any platform admin can end it sooner. When a grant ends, OuterLayer removes the admin's membership. A job that runs each minute removes it, so access can last about a minute past the 24 hours. ## The support console The console lists runner hosts and build attempts across organizations. For one build attempt it shows: * the runner log * what the attempt ran in, and the hosts it reached * the counts of its agent session * the final message of that session OuterLayer scrubs the runner log and the final message again. It cuts the final message to 20,000 characters. The console only reads. It writes an audit row for each view, and it shows nothing when OuterLayer cannot write that row. ## The organization page Any platform admin can open your organization's page without a grant. The page shows: * the organization's name, the creator's email and the billing state * the member list, with each member's name, email and role * the number of factories and API keys, and the SSO state and domains * each factory's repositories, tracker addresses and runner hosts An admin can do these things without a grant: * Change the trial end and the plan. * Change a limit or a feature for your organization. * Create a runner key for one of your factories, when managed builds are on for your organization. A [managed runner](https://docs.outerlayer.ai/build-security.md#managed-runners) uses the key. For each build it claims, the key gets the factory's Anthropic API key. * Delete a person's account. * Delete the organization, after typing its name. ## What you are told Each owner gets an email when a grant starts. The email names the admin, the role and the time the grant ends. When a grant ends, each owner gets a second email. It lists each change the admin made. If the admin made none, it says so. The support console and the organization page send no email. ## See each change in the audit log Each change that a platform admin makes under a grant adds one row to your audit log. The action is **Platform admin access write**. The row shows the admin's email and the route or action that made the change. Its details show the permission the change needed. Reads under a grant add no row. Two support console views add a row to your audit log: one of your build attempts, and the support section of your organization's page. The action is **Support view**. A list across organizations adds a row that names no organization, so your audit log does not show it. A runner key that a platform admin creates adds a row with the action **Managed runner key created**. A change of your plan, trial end, limits or features adds no row to your audit log. To see the rows, open **Organization settings → Audit log**. Choose **Platform admin access write** in the **Action** filter. The other two actions show under **All actions**. The audit log needs an Enterprise plan. The emails do not. If OuterLayer cannot write an audit row for a change under a grant, the change still happens, and OuterLayer is alerted. The email at the end of the grant lists the audit rows, so it does not list that change. ## What stays after the grant ends Ending a grant removes only the membership. Objects the admin created stay in your organization. Examples are keys, invited members and settings. 1. Read the email you get when a grant ends. On an Enterprise plan, the audit log shows the same changes. 2. Delete any key or member you do not expect. See [Security and privacy](https://docs.outerlayer.ai/security-and-privacy.md) for the other security and privacy pages. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.