Skip to content

Admin guide

Admin guide

This is the operational reference for IT admins running Greenlight. It assumes operational literacy with cloud, identity, and source control. Citizen developers use a different surface — see the For citizen developers guide.

The reference architecture — everything Greenlight puts in your subscription: the control-plane Azure resources, the AKS cluster running the control plane, and the per-app workloads and resources it provisions as teams build:

Greenlight reference architecture inside a customer Azure subscription. Control-plane resources: managed DNS zone, Key Vault, container registry, and PostgreSQL. An AKS cluster runs the Greenlight control plane — audit logger, policy enforcement, app observability, data broker, MCP API, governance dashboard and app registry, app RBAC and permission settings, and the Knowledge store. Citizen developer workloads are grouped by team (finance, sales, analyst apps) as server, cron, and webhook-triggered workloads, with per-app resources: PostgreSQL database, AI gateway, blob store, Redis, and email server. Coding agents (Claude, Cursor, Codex) reach the control plane over MCP; app users and IT admins come in through the browser via SSO and the ingress gateway; code flows through the org's source-control system; the data broker reaches integrations like Snowflake, Salesforce, Slack, Teams, Outlook, and on-prem databases.

New to the dashboard? Start with the dashboard tour — every major screen in one scroll. The work then splits into three phases: install (one-time), configure (per organization), and operate (ongoing).

Install

Page	Purpose
Install on Azure	Bicep install, sizing defaults, post-install verification.
DNS & TLS	The single delegated zone and the certificate story.

Configure

Page	Purpose
Identity, SSO & RBAC	Connect Entra ID, Okta, or Google with OIDC, and map IdP groups to Greenlight roles.
Source control & the policy check	Install the Greenlight GitHub App and understand the check it posts on every PR.
Agent plugin rollout	Turn on the Greenlight plugin for Codex, Claude Code, and Cursor. For Claude, apply the dashboard’s organization settings block to pre-approve every Greenlight MCP and CLI action in Auto Mode, including control-plane-hosted CLI installation and refresh.
Manage integrations	Register upstream services, attach credentials, grant to apps.
Manage policies	Tune the OPA governance bundle — enforcement, enable/disable, and per-rule configuration.
Curate Knowledge	Author org Knowledge and review agent proposals.

Operate

Page	Purpose
Observability & audit	The audit log, runtime logs, metrics, and the evidence story.
Kill switch & restore	Stop an app, restore one, and the audit trail behind each.
Upgrades	The customer-owned updater and release eligibility model.

Next

Install on Azure Start here for a first install.

Security posture The one-page summary for security reviewers.