OPERATOR GUIDE · GS-100

Establish a controlled session and complete a first operation.

This guide covers access prerequisites, sign-in, session behavior, console navigation, request correlation, safe first actions, and the evidence an operator should retain.

Owner
Platform Enablement
Version
1.3
Reviewed
05 Aug 2026
Review cycle
Quarterly

1. Prerequisites

Access requires an assigned username, an active role, an approved browser, and the registered second factor when the identity is privileged. Do not reuse another operator's session or transfer session cookies between devices.

ItemRequired stateOwner
IdentityAssigned and not suspendedAccess administration
RoleMatches the planned operationResource owner
Second factorAvailable for privileged identitiesIdentity holder
Change referencePresent for production mutationChange requester

2. Sign-in sequence

  1. Open the canonical HTTPS origin and confirm the host is nodeblobstore.com.
  2. Enter the assigned username and password. The response does not disclose which field failed.
  3. When prompted, complete the five-minute verification challenge. A challenge is bound to its initiating source and is removed after success.
  4. Confirm the displayed name, role, team, and production environment before acting.
Session boundary

The browser receives an opaque, host-scoped, Secure, HttpOnly, SameSite=Strict cookie. The token is validated against a server record on every authenticated API request.

4. Complete a first operation

Begin with a read-only inspection. Open a regional or pipeline record, note its identifier and health, then correlate the page with the current status notice. If a mutation is authorized, use the smallest operation that satisfies the change and record the returned request ID.

Scope: one named resource · Authority: assigned role plus approved change · Evidence: request ID, resource ID, and UTC time · Rollback: documented before execution

A disabled control indicates either read-only access or an unsupported transition. Do not attempt to work around it with direct requests.

5. Evidence and handoff

For consequential activity retain the change ID, resource ID, request ID, actor, UTC time, expected state, observed state, and reviewer. Never paste credentials, cookies, MFA values, connector secrets, or private endpoint material into a handoff.

6. Troubleshooting

ResponseMeaningNext action
401Session missing, revoked, or expiredSign in again through the canonical origin
403Role, origin, or CSRF validation failedVerify authority; do not repeat blindly
409Requested transition conflicts with current stateRefresh the resource and review the transition
429Attempt window exceededStop retries and wait for the stated window