> ## Documentation Index
> Fetch the complete documentation index at: https://docs-stg.outerlayer.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Platform admin access

> What OuterLayer staff can do in your organization when they hold temporary access, and how you see each change.

OuterLayer staff, called platform admins, can ask for temporary access to your organization to fix a problem. Examples are a broken tracker connection and a factory key that needs rotation for a locked-out customer.

A platform admin never sees your data without a grant. The admin must give a reason and confirm that you gave permission.

## Roles a grant can give

The platform admin chooses one role for each grant. Read is the default.

| Role | What the admin can do |
| - | - |
| Read | View data. Change nothing. |
| Write | View data. Add work, review work, edit specs, change tracker connections and create factory keys. |
| Admin | Do everything an organization admin does. This includes inviting members, changing roles, creating organization keys and changing SSO settings. |

A grant never gives the owner role. A platform admin cannot invite an owner, promote anyone to owner, or change or remove an owner.

A grant lasts 24 hours. The admin can end it sooner. When it ends, the admin loses the membership, whatever its role.

## What you are told

Each owner gets an email when a grant starts. The email names the admin, the role and the time the grant ends.

When a grant ends, each owner gets a second email. It lists each change the admin made. If the admin made none, it says so.

## See each change in the audit log

Each change that a platform admin makes under a grant adds one row to your audit log. The action is **Platform admin access write**. The row shows the admin's email, the permission the change needed, and the route or action that made it. Reads add no row.

To see the rows, open **Organization settings → Audit log**. Choose **Platform Admin Access Write** in the **Action** filter. The audit log needs an Enterprise plan. The emails do not.

If OuterLayer cannot write an audit row, the change still stands. OuterLayer reports the failure to its error monitoring.

## What stays after the grant ends

Ending a grant removes only the membership. Objects the admin created stay in your organization. Examples are keys, invited members and settings.

Review the audit log after a grant ends. Delete any key or member you do not expect.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.