# Admin

> Admin panel - RBAC, config, admin tools. Use when building admin UI.

- Skill: `majiayu000/admin-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/admin-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/admin-2/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/admin-2

---


# Admin Guideline

## Tech Stack

* **Framework**: Next.js (with Turbopack)
* **API**: tRPC
* **Database**: Neon (Postgres)
* **ORM**: Drizzle
* **Components**: Radix UI
* **Styling**: Tailwind CSS

## Non-Negotiables

* Admin bootstrap via INITIAL_SUPERADMIN_EMAIL only (one-time, non-reentrant)
* All privilege grants must be audited (who/when/why)
* Actions affecting money/access/security require step-up verification
* Secrets must never be exposed through admin UI
* Only super_admin can promote to admin or access system config

## Context

The admin platform is where operational power lives — and where operational mistakes happen. A well-designed admin reduces human error while giving operators tools to resolve issues quickly.

MFA requirements for admin roles are enforced via `account-security`.

## Driving Questions

* Is bootstrap using INITIAL_SUPERADMIN_EMAIL correctly?
* Can an admin accidentally cause serious damage?
* How would we detect admin access misuse?
* What repetitive admin tasks should be automated?
* Where is audit logging missing?