Intelligence Hub
What this screen is for
The Intelligence Hub is a catalogue of predefined business questions — which actors are affected by a compromised key, which keys expire this month, what did this user do last week — grouped into scenarios. Each question is a recipe: one or more reads of the same data the Dashboard, Analytics & Reports and the Audit Log show, run when you ask. The answer is computed at that moment, from what the server returns then, so it describes the tenant or the platform now and not when the question was written.
The Hub asks; it does not act. Every question in the catalogue is a read. Nothing you do here creates, changes, rotates, revokes or deletes anything, and no question offers a follow-up action. A question that would change state belongs to the screen that owns the capability, where the confirmation and the audit trail live.
You can trust that because the console's own build checks it four ways: no question declares any verb other than GET; nothing anywhere in the catalogue declares a post-execution action; no entry in the table that prices the questions is marked as mutating; and every question still resolves against that table, so those three zeros are measurements rather than a broken lookup.
The catalogue ships with the console, so it is the same on every installation. Which questions you are shown, and which of those you can run, is decided per question, as described next.
What must exist first
The Intelligence Hub entry is in the navigation of a tenant administrator and a key manager, and, on a customer-operated install, in the platform navigation too. The platform navigation of a SaaS install carries no entry, so a platform administrator there usually opens the Hub from inside a tenant. No permission shows or hides the screen itself: permissions decide question by question.
Each question is admitted in one place, from four facts about you, and your role is not one of them:
- The plane of the question: a platform-wide question or a question about one tenant.
- Whether a tenant is in scope — your own, or one you entered — and, on the platform, the Scope you chose.
- The permissions your session holds, against those the question's reads require.
- The tenant type and deployment type, for a question limited to some. Today no question is.
The outcome is offered, blocked or not applicable, and a blocked question that only needs a tenant is shown apart:
- Offered: the card carries Execute, and the question page shows its input form.
- Blocked: the card is listed, with a notice in place of the button saying why it cannot run right now. A notice about permissions names the exact authority to request.
- Requires entering a tenant: blocked because the question answers about one tenant and cannot be answered from where you are. These questions are not cards: they are listed together in one collapsed section, described below.
- Not applicable: the question is not listed, not counted and not reachable by link. A platform-wide question is never applicable inside a tenant, nor to a session holding no platform authority.
Admission is what this console offers, not what the platform permits: the server checks every read again and refuses what your session may not do, whatever was rendered here.
Decisions you make here
Choosing the scope on the platform
A platform administrator with no tenant in scope, holding a platform permission, sees a Scope control above the figures: Whole platform, the default, or One tenant with a Tenant list. The choice is kept in the page address, so a reload or a shared link keeps it.
Choosing a tenant does not enter it. It narrows the platform-wide answers to that tenant: no token is exchanged, your session does not change, and nothing is read through the tenant's own context. A link naming a tenant that is not in the platform tenant list is not applied; the page shows Linked tenant not available and the whole platform.
What each scope offers:
- A question with a platform equivalent runs on the platform reads, for the whole platform or filtered by the chosen tenant. A few of them answer only for the whole platform.
- A question that follows one correlation ID runs from the platform, for the whole platform only.
- A platform-wide question is offered only under Whole platform; under One tenant it is not listed.
- Every other question needs a tenant, and is listed under Requires entering a tenant.
Choosing how to browse
Browse by Scenario shows one card per scenario that has at least one listed question, with its count; opening a card lists that scenario's questions. Browse by Category shows the listed questions under tabs such as Security, Compliance and Operations, plus Recent, which holds the questions you ran in this tenant from this browser, up to ten distinct ones. The search box filters whichever view is open. Switching views clears it.
The four figures at the top count what you can run in the current scope, not the whole catalogue: Total Questions is the questions offered to you, Priority (P0) those of them in the highest priority band, Scenarios the scenarios with at least one listed question, and Recent the distinct questions in your history for this tenant. A scenario card counts its offered questions too; a scenario with none is drawn muted after the others and still opens.
Acting on a blocked question
A blocked question stays visible so you can do something about it. Read the notice: for a missing authority, request the scope it names from whoever assigns your roles. A permission that reaches your session is applied without reloading the catalogue.
When nothing at all can run, the page says No question can be run in this context and lists each distinct reason once, with the scope it concerns. When not one question is applicable — a platform administrator inside a tenant is the usual case — it says No questions apply to this context and offers only Execution History: change context, or open the Hub from a destination that has a tenant.
Entering a tenant for the questions that need one
The questions that need a tenant are gathered at the end of the page in one collapsed section, Requires entering a tenant (N), where N is their number. Opening it lists them and shows one control for all of them:
- With One tenant chosen, Enter followed by the tenant's name opens Confirm Impersonation, the same confirmation as on the Tenants screen, including the support-access window on a SaaS install. Confirming lands you on this same page inside the tenant.
- With Whole platform, there is no button: the section asks you to choose one tenant in the scope selector above.
- When you cannot enter that tenant, or any tenant, there is no button: the section says why.
Without the Scope control, the section points you to the context selector instead.
Running a question
Execute on a card, or a question inside a scenario, opens the question's own page, where you supply its inputs and read its answer:
How it relates to other screens
A scenario is an ordered list of independent questions; each is run on its own:
Execution History keeps a record of what you ran, in this browser only:
The questions read the same reports and trails these screens show in full, so a figure can be checked against them:
A question that reads an audit trail is itself an audit read, and the audit service records it under your name:
A platform administrator enters a tenant from the Tenants screen, or from the Requires entering a tenant section here, which is what puts a tenant in scope: