1.0.0-rc.1 · Release Candidate1 min read
AutoCore Accessing Admin and Admin Navigation
How operators reach the authenticated Admin console and interpret permission-filtered navigation.
Use the sanitized deployment example https://admin.example.com. A real deployment URL, administrator credential, or installation identifier does not belong in public documentation. The shell authenticates first, shows a no-access state when no console permission is present, and filters links by the current permission set.
| Area | Source-verified boundary |
|---|---|
| Desktop layout | Permission-filtered sidebar with grouped navigation and longest-match active state. |
| Mobile layout | Horizontally scrollable navigation strip, theme control, and sign-out control. |
| Authentication | Email login, HttpOnly refresh cookie, in-memory access token, and single-flight refresh. |
| Authorization | The API guard is authoritative; hidden navigation is presentation only. |
Verification
Verify the route, permission, response state, audit outcome, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.