The console
What each area of the console is for, and how a permission you lack changes what you see.
The console is the browser side of penv. It holds your projects and the values inside them. It also holds the identities your pipelines log in with, the record of who did what, and everything under Settings.
The sidebar
Three of the rows are groups. A group opens to reveal the rows under it and has no page of its own.
| Row | Where it goes | Shown when you hold |
|---|---|---|
| Overview | /dashboard | any permission at all |
| Projects | /projects | project:read |
| Machine Identities: All Identities | /identities | machine:read |
| Machine Identities: Connect a Platform | /identities/connect | machine:create |
| Integrations: Connections | /integrations | integration:read |
| Integrations: Dynamic Engines | /integrations/dynamic | dynamic:read |
| Integrations: Providers | /integrations/providers | integration:read |
| Audit Log | /audit | audit:read |
| Billing | /settings/billing | billing:read |
| Encryption | /settings/encryption | org:read |
| Settings: Organization | /settings/organization | org:read |
| Settings: Members | /settings/members | member:read |
| Settings: Roles | /settings/roles | role:read |
| Settings: Security | /settings/security | org:read |
| Settings: Single Sign-On | /settings/sso | sso:read |
| Settings: Danger Zone | /settings/danger | org:read |
One row lights up for the page you are on, chosen by the longest matching address. A connection detail page keeps Connections lit, and /identities/connect lights Connect a Platform rather than All Identities.
At the bottom of the rail, your own menu opens a project picker: a search box, every project you can read, and the environments of whichever project you are inside. It also offers New Project and View All Projects.
On the Free plan a Projects meter sits above that menu, counting projects used against the three your plan allows, with an upgrade prompt once you reach four fifths of it. A paid plan has no meter, because there is no limit to draw.
Overview
/dashboard is the first page after you sign in. Every panel on it is read only when your own permission allows it, so it can never become a way to see identities, members or entries the rest of the console refuses you.
A workspace that has no stored value yet gets a guided version of the page: a setup journey and the encryption card, with the header reading Welcome to Penv Cloud until the first project exists and Finish Your Setup after that. The five steps are create a project, create an environment, set your first secret, create a machine identity, and connect penv. Only the open step carries a button, and the last step carries the snippet that points one environment at Penv Cloud along with the penv pull it takes to fill it.
Once a value is stored the page becomes the summary:
| Panel | What it holds |
|---|---|
| Stat tiles | Projects, environments, members and live machine identities as four numbers. A read that failed shows a dash rather than a zero |
| Usage | Meters for projects and seats against your plan, the environment cap each project gets, and an upgrade prompt on Free at either limit |
| Encryption | Three lines of posture: every value sealed under a hardware-backed master key (AES-256-GCM), values masked until revealed and absent from lists and addresses, reads and writes recorded and never edited |
| Quick actions | New Project, New Machine Identity, and View Audit Log |
| Recent activity | The last six entries, read-only, with a link into the full record |
The setup journey stays as a compact strip until every step is done. The header carries your plan badge and a New Project button.
How a missing permission shows up
Three things happen, in this order.
A row you cannot use disappears from the sidebar.
A group whose rows have all disappeared goes with them.
A page you reach by its address anyway renders "You don't have access to this" inside the console shell, naming the permission your role is missing. The sidebar and the workspace switcher stay where they are, so you can see where you landed.
A grant held on one project is enough to keep the row visible. The page behind it then checks again at its own scope, so Projects stays in the sidebar for somebody whose only grant is on one project, and that project is what they find inside.
Permissions are read from the database on every request. Taking a role away takes effect on the next click rather than at the next sign-in.
Somebody who holds nothing anywhere in the workspace is sent to /no-access, which lists the other workspaces they belong to.
Where a terminal sign-in is approved
penv login prints an eight-character code and opens /device. That page asks for the code, then shows the device name, the address the request came from, and every workspace the credential would reach. The code lasts ten minutes.
Approving asks you to confirm it is you (step-up) when you carry an authenticator. Denying never does, because shutting down a code you did not start should take one click. The credential it mints lasts 30 days from its last use.
| Action | Needs | Confirm it is you | Recorded as |
|---|---|---|---|
| Approve a terminal | a signed-in session | Yes | device.approved |
| Deny a terminal | a signed-in session | No | device.denied |
Both rows are written once per workspace you belong to, because the credential reaches all of them.
Answering an agent's request to open one value happens at /approvals/[id], covered in approvals.
Next: projects and environments.