How to manage client NAS environments without taking ownership away from the client.

Programme model

Integrator workspace: USD 0 · Free Forever
Client subscription: selected and paid by client
Client data: owned by client
Integrator service fees: separate from 1ProNAS billing
Partner commission: optional, disabled by default, Axon-controlled

The first release supports one active primary integrator per client. One integrator may manage many client tenants and partner users, while each technician sees only explicitly assigned clients.

Client ownership

• The client owns its tenant, subscription, billing, users, data, settings and connector identities.
• The client approves, limits and revokes integrator access.
• Removing the integrator does not delete or suspend client data.
• Changing integrators does not transfer payment details.
• Historical audit events remain after access removal.

Integrator roles

Delegated client permissions

Sensitive permissions should support an expiry. Archive and reclaim remain subject to the complete Smart Space Manager verification and approval workflow even when delegated.

Client onboarding

1. Integrator creates a short-lived invitation, or client invites an approved partner.
2. Client verifies email ownership.
3. Client creates or selects the correct tenant.
4. Client accepts legal and relationship disclosures.
5. Client chooses Free Forever or paid usage.
6. Client enters its own billing details where required.
7. Client reviews requested permissions.
8. Client approves, reduces or rejects access.
9. Integrator assigns named technicians.
10. Client pairs every NAS with a separate tenant-bound connector identity.
11. Audit records preserve invitation, acceptance, permissions and assignments.

Technician lifecycle

Assign

1. Confirm partner user is active.
2. Select approved client link.
3. Choose assignment and optional expiry.
4. Record assigning actor.
5. Revalidate assignment on every request.

Remove

1. Disable assignment.
2. Revoke client-scoped sessions.
3. Cancel temporary access.
4. Review recent activity.
5. Preserve audit history.

Staff departure

Disable the partner user, revoke all sessions, remove all assignments, revoke user-specific credentials and transfer open support work.

Billing

The client calculator counts client NAS devices and client human users. Integrator staff and Axon staff are not client users.

Client Free Forever: exactly 1 NAS + 1 client user = USD 0/month
Paid client proposal:
USD 10 platform fee
+ USD 8 per NAS
+ USD 0.20 per client user
Minimum paid: USD 20/month
Integrator account: USD 0

The integrator may charge separately for implementation, support, migration or managed services. Those charges are not part of the initial 1ProNAS subscription engine.

Client removal and integrator transfer

1. Client Owner confirms immediate or scheduled removal.
2. Relationship status changes to revoked.
3. Technician assignments and temporary permissions end.
4. Sessions and cached authorisation are invalidated.
5. Open access requests are cancelled.
6. Client, connector and subscription remain active.
7. Audit history remains available.
8. Replacement integrator starts with a new permission review.

Security rules

• Validate user, integrator, client link, assignment, permission and tenant on every request.
• Never trust only a URL slug, hidden form field or browser selection.
• Use separate connector identity per client NAS.
• Use rate limits by user, partner, tenant and IP.
• Use Secure, HttpOnly and SameSite cookies for human sessions.
• Do not expose payment methods or raw provider secrets.
• Record client context switches and sensitive actions.
• Client approval remains required for billing, archive and reclaim by default.

Database foundation

Alembic migration head:

0003_integrator_foundation

Tables:

integrators
integrator_users
integrator_client_links
integrator_client_permissions
integrator_staff_assignments
integrator_invitations
integrator_access_requests
integrator_support_notes
integrator_referrals
integrator_commission_rules
integrator_commission_events
integrator_audit_events

The schema does not activate public APIs by itself. Real portal functionality must add authentication, authorisation middleware, validation, audit and tests.

Deploy and verify

cd /opt/1pronas
1pronas inventory
1pronas status
1pronas production-backup
1pronas update
bash deploy/install-cli.sh
hash -r
1pronas production-status
1pronas production-backup
1pronas production-restore-test
1pronas production-preflight

Confirm migration:

docker compose -f docker-compose.yml -f docker-compose.production.yml   exec -T 1pronas-space-manager-prod alembic current

Troubleshooting

Integrator page returns 404

cd /opt/1pronas
git log -1 --oneline
docker compose logs --tail=150 1pronas-web
1pronas update --no-cache

Migration remains at 0002

1pronas production-logs
docker compose -f docker-compose.yml -f docker-compose.production.yml   exec -T 1pronas-space-manager-prod alembic heads

Do not edit alembic_version manually.

Wrong client appears

Treat this as a security incident: revoke the session, preserve logs, record request ID, suspend access where needed and investigate tenant filters, assignments and cache keys.

Integrator suspension affects clients

That behaviour is incorrect. Partner suspension must block partner users but keep client tenants, subscriptions, connectors and data active.

Integrator UAT

1. Create one integrator and four partner roles.
2. Link Client A and Client B.
3. Confirm unlinked Client C is invisible.
4. Assign a technician only to Client A.
5. Confirm Client B is denied.
6. Confirm client billing remains separate.
7. Confirm no payment details are visible.
8. Remove the relationship and confirm immediate revocation.
9. Suspend the integrator and confirm clients remain active.
10. Confirm archive and reclaim require client approval.
11. Confirm exports contain only the selected client.
12. Confirm invitation expiry and single use.