Administrator guide

#Your first sign-in

KYTRIX support gives you an initial password once, on a call or in an encrypted handover — never in an email or a chat. Sign in, change it (Account → Password), and enrol an authenticator (Account → Second factor): if your deployment enforces a second factor, the console turns you back to enrolment until you do.

#Invite your people — and why two of them must be different humans

Users → Invite. An invitation is a single-use link that dies in seven days; where mail is configured it can be emailed, otherwise you hand the link over yourself. Roles decide what each person can do:

• investigator / senior_investigator — works the alert queue and proposes dispositions.
• compliance_manager — approves the dispositions an investigator proposes (the checker).
• rule_administrator — proposes a ruleset version; rule_approver — activates it.
• tenant_administrator — people, credentials, feed declarations. auditor — reads the audit chain.

#Declare your feeds — including the ones you do not send

Integration health → Declared feed expectations. For each feed you will send, declare its object type and the minimum you expect per hour or per day: a declared feed that goes quiet becomes a coverage finding instead of silence. For each family you do NOT send — a wallet with no control events, say — tick Out of scope, so its absence is expected and never reported as a gap (22 X.1).

#Activate a ruleset — in shadow first

1. Rulesets → the starter set → propose a version (rule_administrator).
2. A different person approves and activates it (rule_approver).
3. Until your tenant is moved to Live, every firing is recorded in the shadow store and delivers nothing — no alert, no webhook — whatever the bindings say. That is the Shadow stage (22 X.3): you read what would have fired before anything reaches your team.

#Credentials and webhooks

• The feed credential support issued carries the ingest scope only: it can post events and cannot read alerts or manage endpoints (06 H.3).
• Webhook endpoints are registered through the API (see the Webhooks page) with a SEPARATE credential carrying webhook_mgmt — ask support for it, use it once, and keep it off the host that runs the feed. The console does not register endpoints.
• Restricted AML events are delivered on the compliance channel only (14 P.5); point that channel at your compliance intake, never at an operational system.

#The onboarding checklist

Onboarding shows every step KYTRIX needs before your first production event, read from the database each time. A step it could not check reads unknown, never green (I7). Work down it until every step is satisfied; the FX-rates step is green on its own for a tenant that moves a single currency.