Control-Plane Backend

The owner-only service behind insigz Control.html (product §17). It runs the fleet without ever holding tenant data credentials.

Responsibilities

• Tenant lifecycle — provision / suspend / reinstate / decommission, as a durable workflow (infra/51).
• Provisioning orchestration — render the Terraform module + run insigzctl, persisting per-step status so the wizard shows live progress and resumes after a crash.
• Fleet telemetry — pull aggregate metrics (uptime, p99, cost, usage) from Cloud Monitoring per tenant; never raw tenant data.
• Billing/finance — contracts, invoices, margin (ACV − cloud cost); usage signals for capacity.
• Support — tickets, SLA timers.
• Audit — append-only record of every control-plane action; break-glass flagged.
• Break-glass — mint a scoped, time-boxed, reason-bound token to enter a tenant app; write the audit record (§17).

Data store

Its own small Postgres (control-plane DB): tenants registry, contracts/invoices, incidents, tickets, operators+roles, audit, releases/pins. Separate from every tenant DB.

Isolation & trust

• Runs as a privileged-but-scoped service account that can create tenant infra/secrets (provisioning) but is not a secretAccessor on tenant runtime secrets.
• Control-plane RBAC (Owner/Ops/Finance/Support/Read-only — security/41, §17) gates every action; destructive actions need typed confirm; tenant-data access only via logged break-glass.

Gaps to close

• Pick the workflow engine (Cloud Workflows/Temporal) and the provisioning service account's exact IAM.
• Define the break-glass token contract (scope, TTL, what the tenant app accepts) and its audit schema.
• Decide how aggregate telemetry is pulled (Monitoring API queries vs. a metrics export per tenant).