Notice when an organization has no usable owner
An organization can lose administrative access through imported data or an out-of-band change, even when normal application actions protect the last owner. Wildo checks the administrative population at startup to make that state visible.
Missing usable owners are reported as errors; a single usable owner receives a warning. A separate application-wide check reports a missing usable super-administrator; its healthy single-administrator case is not the organization-owner warning. These observations help operators act before someone discovers the lockout through a failed task.
Example — Detect a stranded organization after a restore
Restored records leave an organization without an active person holding usable ownership. On startup, the backend reports the organization and records breach evidence when its audit service is available. The operator follows the recovery direction; other organizations can continue running.
For engineers
Read the population under the correct authority
The report resolves roles that confer ownership and checks membership and person status. Its measurement creates a system execution context through the authenticated context factory: a tenant-confined read would be incapable of describing the whole estate.
This excerpt is from startup’s organization-owner report. The arguments are runtime services already resolved by the host; it is not a public endpoint or an instruction to grant a caller system access.
const population = await measureOrganizationsMissingUsableOwner({
authExecutionContextFactory,
repositoriesRegistry: this.repositoriesRegistryService,
errorBuilder: this.errorBuilder,
conferringRoles: resolveOrganizationOwnerConferringRoles(this.authorizationsService),
});
The observation distinguishes organizations with no usable owner from those with exactly one. The super-administrator report measures the application-level population separately. The backend runtime profile owns these reports; confined worker profiles skip populations outside their authority.
Follow a breach into evidence
The organization report now calls the audit service for each stranded organization. This actual call records how the breach was detected; individual audit failures are isolated so the diagnostic does not prevent startup.
await this.auditLogsService?.logOrganizationOwnerFloorBreached({
organizationId: stranded.organizationId,
detectedBy: AdministrativeContinuityBreachDetection.BOOT_REPORT,
remainingUsableOwners: 0,
});
| Population | Operator meaning |
|---|---|
| No usable owner | Administrative continuity is broken; recovery requires an authorized external path |
| Exactly one | Access works, but adding another owner reduces fragility |
| More than one | This measurement has not found the missing-owner condition |
Keep diagnosis separate from repair
The startup report does not appoint an owner or fail readiness. Application-wide loss has no higher in-product scope from which to grant authority, so recovery is an operator procedure. Monitoring the log and available audit stream, and exercising that procedure, are part of operating the application. The report supplements the write guards; it is not a continuous replacement for them.