Platform Administrator Guide

Role purpose

The Platform Administrator manages the shared CivitasVote platform without becoming the routine operator of every election. The role creates associations and ordinary authorised users, assigns association governance and maintains platform access records.

Appointment

A technical superuser appoints an active ordinary application user. The appointee must not be a Django staff user or superuser. Record the authority reference and validity dates. Revoke the appointment with a reason when it ends.

User management

Manual creation

Enter email, full name, temporary password, active state and forced-password-change setting. Verify the user signs in and changes the password. Do not grant staff or superuser status.

Import

Use the exact headers:

email,first_name,last_name,temporary_password,is_active

Upload CSV/XLSX, review validation and duplicate counts, inspect every error, then commit. Protect the source file because it contains temporary passwords.

Update, reset and deactivate

Correct names and email through the controlled form. Administrative resets create a temporary password and require change. Deactivation blocks access while preserving historical references. Destructive actions are POST-only.

Association management

Create the official association record, privacy details, colours, optional logo, approved institutional-email domains, retention period and active state. Assign active ordinary users as Owner or Administrator. A user can have only one membership record per association.

Election-cycle record governance

Platform visibility does not create a general power to erase association election history. An association Owner or Administrator should resolve an accidental unused Draft through the supported workflow. The Platform Administrator may investigate access, configuration and implementation issues, but must not delete a protected cycle through Django Admin, a database client or an ad hoc shell command.

Where a controlled deletion action exists, it should recheck that the Draft has no appointments, nominations, register use, credentials, ballots, tally, approvals, declarations, incidents, objections, complaints or other audit-dependent records. For every other case, retain the cycle and use cancellation, invalidation or a documented replacement process.

Election-officer oversight

The Control Centre election-officer register displays appointment state across cycles. Use it to identify future, current, read-only, expired and revoked appointments. It does not grant the Platform Administrator power to make election decisions merely because the record is visible.

Security boundaries

• never use a shared Platform Administrator account;
• never place .env, keys or databases in uploaded import files;
• never activate a user solely to preserve a former appointment;
• do not appoint technical superusers as ordinary administrators;
• do not change live election data through Django Admin as a shortcut;
• record revocation reasons and investigate unexpected access.

Handover checklist

1. Confirm associations and governance memberships.
2. confirm ordinary user details and active states;
3. confirm appointment records and references;
4. export or document pending imports;
5. confirm no temporary passwords remain in unsecured files;
6. revoke the former appointment and appoint the successor;
7. verify audit events.