Riven Control
Internal onlyThe staff-facing control plane: fleet state, tenant administration, quota governance, and incident tooling. Internal only — not reachable with a customer account.
Internal only. Control is restricted to Riven staff and is documented here so its role in the architecture is legible. Customer administration lives in Riven Console; there is no customer-facing path into Control.
What Control is for#
Control is the operator view of the whole platform, across every tenant. Where Console answers "what is my account doing", Control answers "what is the fleet doing" — and it is the system of record for quota governance, which is why GET /billing/quota reports "source": "control".
Responsibilities#
- Quota governance — plan definitions, allowances, overage policy, and the authoritative spend ledger that the public quota endpoint reads from.
- Tenant administration — provisioning, plan changes, and single-tenant deployment records for Business Suite customers.
- Fleet state — health and capacity of on-prem inference pools, and the routing weights consumed by Ultra Router.
- Incident tooling — draining a pool, forcing fallback, and publishing to Riven Status.
- Audit — staff access to tenant-scoped data is logged; the retention and review commitments are published on Riven Trust.
Access model#
Control requires a staff identity from the corporate directory through Riven Auth, and is not exposed on the public edge. Customer API keys carry no Control scope whatsoever — a rvn_ key cannot reach it even with a valid session.