OPERATOR GUIDE · GS-100
Establish a controlled session and complete a first operation.
This guide covers access prerequisites, sign-in, session behavior, console navigation, request correlation, safe first actions, and the evidence an operator should retain.
1. Prerequisites
Access requires an assigned username, an active role, an approved browser, and the registered second factor when the identity is privileged. Do not reuse another operator's session or transfer session cookies between devices.
| Item | Required state | Owner |
|---|---|---|
| Identity | Assigned and not suspended | Access administration |
| Role | Matches the planned operation | Resource owner |
| Second factor | Available for privileged identities | Identity holder |
| Change reference | Present for production mutation | Change requester |
2. Sign-in sequence
- Open the canonical HTTPS origin and confirm the host is
nodeblobstore.com. - Enter the assigned username and password. The response does not disclose which field failed.
- When prompted, complete the five-minute verification challenge. A challenge is bound to its initiating source and is removed after success.
- Confirm the displayed name, role, team, and production environment before acting.
The browser receives an opaque, host-scoped, Secure, HttpOnly, SameSite=Strict cookie. The token is validated against a server record on every authenticated API request.
4. Complete a first operation
Begin with a read-only inspection. Open a regional or pipeline record, note its identifier and health, then correlate the page with the current status notice. If a mutation is authorized, use the smallest operation that satisfies the change and record the returned request ID.
Scope: one named resource · Authority: assigned role plus approved change · Evidence: request ID, resource ID, and UTC time · Rollback: documented before executionA disabled control indicates either read-only access or an unsupported transition. Do not attempt to work around it with direct requests.
5. Evidence and handoff
For consequential activity retain the change ID, resource ID, request ID, actor, UTC time, expected state, observed state, and reviewer. Never paste credentials, cookies, MFA values, connector secrets, or private endpoint material into a handoff.
6. Troubleshooting
| Response | Meaning | Next action |
|---|---|---|
| 401 | Session missing, revoked, or expired | Sign in again through the canonical origin |
| 403 | Role, origin, or CSRF validation failed | Verify authority; do not repeat blindly |
| 409 | Requested transition conflicts with current state | Refresh the resource and review the transition |
| 429 | Attempt window exceeded | Stop retries and wait for the stated window |
Operational