MCM-40 — Nexus Admin Creates Another Nexus Admin

← Back to MCM Nexus overview

As a Nexus Admin,
I want to create another Nexus Admin account directly from the Nexus console,
so that additional RevDau staff can get console access without anyone needing direct Keycloak access.

Acceptance Criteria

• A Nexus-Admin-only "Manage Nexus Admins" area lists every existing Nexus Admin.
• A Nexus Admin can create a new Nexus Admin by entering their name and email — no Organization is attached, since Nexus Admins aren't scoped to a customer Organization the way Customer Users are.
• Creating a new Nexus Admin follows the same temporary-password pattern used elsewhere in Nexus: a temporary password is generated and emailed with a login link, and the new Nexus Admin must set a new password on first login.
• The temporary password expires 24 hours after issuance; if the new Nexus Admin hasn't logged in by then, it no longer works.
• This flow can only ever create a Nexus Admin account — it is a separate area from customer signup and cannot be used to create or affect a Customer User or an Organization.
• A Nexus Admin cannot deactivate or remove their own account through this area, to prevent accidentally locking themselves out.
• Every Nexus Admin creation is recorded (who created whom, when) for accountability.
• This flow requires an existing Nexus Admin to invoke it, so it cannot create the very first one. The first Nexus Admin — mcm@revdau.ai — is provisioned outside this flow, as part of environment setup/deployment, before any customer-facing signup traffic exists; every Nexus Admin after that is created through this story, starting from mcm@revdau.ai.

Technical Design

A new Nexus-Admin-only user-management area, alongside the existing Organization-management area, lets a Nexus Admin create another Nexus Admin. Creation reuses the same temporary-password-plus-forced-first-login-reset mechanism already used for customer accounts (see MCM-02 — Customer Self-Signup), just assigning the Nexus Admin role instead of Customer, and with no Organization association, and sends its own Nexus-Admin-worded welcome email (see Email Template below) rather than a customer-facing one. The creating Nexus Admin's identity is recorded against the new account for audit purposes. The very first Nexus Admin, mcm@revdau.ai, is instead seeded directly as part of environment setup (e.g. a one-time deployment script or manual Keycloak provisioning) since this in-app flow has no bootstrap path of its own — it always requires an already-authenticated Nexus Admin to call it.

Email Template

Subject: Your MCM Nexus Admin Account is Ready

Dear <Nexus Admin Name>,

Greetings from the MCM Team!

An MCM Nexus Admin account has been created for you by <Creating Admin Name>. Use the temporary password below to log in and set your own password.

## Your Login Details

Portal: https://nexus.mcm.revdau.ai/login
Email: <Nexus Admin Email>
Temporary Password: <generated password>

This temporary password expires in 24 hours — please log in and set your new password before then.

You'll be asked to set a new password the first time you log in.

If you have any questions, reach out to the Nexus Admin who created your account or to support.

Support Email: mcm@revdau.ai

Best Regards,
MCM Team

UI / Frontend Changes

• New "Manage Nexus Admins" page: list of existing Nexus Admins, with a "Create Nexus Admin" action (name and email form).
• Confirmation step before creating a new Nexus Admin account.
• No self-deactivation/self-removal control on this page — a Nexus Admin cannot act on their own account here.

Out of Scope

• Deactivating or revoking another Nexus Admin's access — tracked separately.
• Role granularity within Nexus Admins (e.g. read-only vs full access) — every Nexus Admin has the same level of access for now.