Canonical KHEMS administration
User and facility provisioning
Changes are validated server-side and recorded under your signed-in identity.
Supabase Auth + canonical RBAC
Invite or assign a user
Existing accounts are reused. New accounts receive an invitation; administrators never set the user's password.
Inactive until every check passes
Provision a facility
The service validates the canonical identity, YMS Sheet, private document library, and Google service-account access before activation.
Canonical facilities
| Facility | State | YMS resources | Action |
|---|
Read-only inspection and exact preview
Google Sheet maintenance
The API resolves the canonical spreadsheet, reads metadata and row-one headers, and previews the annual archive layout. Preview does not edit a Sheet or enable archival or purge.
Sheet maintenance verified
Maintenance preview
- Migration
- —
- Archive year
- —
- Timezone
- —
- Apply state
- —
Planned changes
Conflicts
Durable audit
Recent provisioning requests
| Updated | Type | Status | Target | Result |
|---|