Admin
Platform state across all users, for facility operators.
Usage across users
Maintenance mode
Annotation mismatches
Visibility only; enforcement is unchanged. A row means the backend's readOnlyHint disagrees with the broker's action_type. To resolve it, set a target_action_types glob for the service (keys are service names; globs match the prefixed tool name), declare the permission under custom_permissions if it is site-defined, or ask the backend to correct its annotation.
Tool mapping drift
Visibility only. Unmapped tools are advertised by the backend but have no required_permission entry and no __default__, so they are disabled: add them to the service's required_permission. Stale entries are mapped keys the backend no longer advertises (usually a backend rename): rename or remove them. Unroutable tools are advertised without the service's prefix (an apply_namespace: false backend that renamed its tools), so no caller sees them: update the service's prefix and required_permission keys to the backend's names.
HTCondor credmon sync
The broker stores a short-lived token per user and credential type in the facility's credd, so jobs that request use_oauth_services = af_krb5, af_x509 get the user's credentials on the worker node. Only one broker replica runs each sync.