Console guide
Use the GrayPass Console to manage protected actions, inspect decisions, and configure your workspace.
Sign in and select scope
Before signing in, the console shows Overview and Sign in. Sign in with your invited email address or Google to reveal the workspace views and Environment selector. Your tenant membership determines which controls you can use.
Choose Sandbox or Live before changing actions, inspecting subjects, or creating credentials. Each environment keeps its data separate. Allowed browser origins and commercial agreements are tenant-wide; an action's mode is a separate setting.
If a workspace is missing, check your signed-in email and contact its owner. New personal workspaces start with a sandbox.
Find the right view
| View | Task | What to check |
|---|---|---|
| Overview | See recent activity and work needing attention | Pending holds and setup state |
| Actions | Create an action or change its policy | Active policy version and action mode are separate settings |
| Subjects | Inspect enrollment, revoke, recover, export, or delete | Subject ID and selected environment |
| Activity | Inspect a decision or review a hold | Bound action, reasons, authorization chain, and reported outcome |
| Evaluations | Create and close a technical evaluation | Criteria, selected actions, observation period, and outcome coverage |
| Integrations | Configure credentials, origins, and webhooks | Credential environment and any tenant-wide setting |
| Settings | Configure retention and research participation | Environment scope and consent requirements |
| Billing | Review agreements, usage, installments, and invoices | Contractual billing window and your account permissions |
Roles
Assign roles by task: developers configure integrations, security reviewers resolve holds, and administrators manage workspace controls.
| Role | Intended access |
|---|---|
| Viewer | Read permitted tenant views and billing information. |
| Developer | Viewer access plus supported development operations such as creating actions, policy versions, subjects, and evaluations. |
| Security reviewer | Viewer access plus permitted outcome/review operations. |
| Administrator | Developer and reviewer capabilities plus administrative activation and lifecycle operations. |
| Owner | Administrator capabilities plus owner-only environment administration. |
An owner or administrator can manage agreement drafts, the payment portal, and non-renewal. Developer, security-reviewer, and viewer memberships can inspect Billing. Contact GrayPass for invoice release and financial corrections.
For membership changes, contact your workspace owner or founders@graypass.org. If a control is unavailable, check your role before asking an authorized colleague to perform the operation under their own account.
A routine integration review
- Select the sandbox environment and verify the expected credential scope and exact application origin.
- Create or inspect the protected action and its policy version. Confirm the action mode separately.
- Follow a test subject from enrollment through authorization. Inspect coverage, reasons, limitations, and the challenge/hold path.
- Confirm that your application verifies the resulting proof and reports its outcome against the correct logical operation.
- Inspect webhook test delivery and a deliberate failure/replay scenario.
- Review retention and research settings before introducing real user data.
- For a live shadow evaluation, confirm the intended users, policy, data handling, commercial terms, and evaluation criteria.
The quickstart exercises the API sequence; actions and policies explains the policy model.
Review a hold
Use Activity to locate the authorization by its identifier, subject, action, and time. Review the exact pending operation in your own system as well as the GrayPass reason codes. Confirm the reviewer has the required role and an independent basis for the decision.
Submit the approve or reject resolution with the review context. Your backend must retrieve the resulting authorization and verify it against the saved request before any execution. Record the final business outcome. If the amount, destination, or account context has changed, start a new authorization instead of approving the old hold.
Retention and research settings
Settings shows each environment's retention and research participation. Retention governs decision traces, events, and derived evidence. Use subject lifecycle operations to remove customer subjects and templates. Research retention also requires deployment enablement, current per-subject consent, and an explicit opt-in on each evidence frame. Collect consent from each subject separately from environment configuration. See research choices.
The usage table in Settings is diagnostic. Use Billing for the agreement's UTC anniversary windows, allowances, estimates, and invoice details. See usage and billing.
When the console looks wrong
First check tenant, environment, account, and role. A 401 generally requires a valid sign-in; a 403 may reflect insufficient permission or a rejected cross-origin mutation. Confirm the live environment and commercial stage, then use that environment's credentials.
For support, record the view, UTC time, request identifier if shown, environment kind, and a minimal synthetic reproduction. Remove secrets and subject data from screenshots. See troubleshooting and security.